Alarm Priority

What priority is for

When two alarms arrive at once, the operator needs to know which to act on first. That is the only job of alarm priority. It is not a measure of how expensive the equipment is, how loudly a supervisor argued for it, or how embarrassing the failure would be. It is a ranking of urgency, and it only works if it is assigned consistently across every alarm in the system by a method that can be explained.

Priority also drives presentation. The alarm summary sorts by it, the HMI color and sound depend on it, and in a utility with paging or callout, priority is often one of the inputs that decides whether an alarm wakes someone at 2 a.m. or waits for the morning shift. Getting priority wrong in either direction has consequences: a low priority on a chlorine leak is obviously wrong, but a high priority on a communication hiccup trains operators to ignore high priority alarms.

The two questions

ISA-18.2 defines priority as a function of the severity of consequence and the time available for response. Both are judged assuming the operator does nothing: what happens, how bad is it, and how long until it happens.

The matrix itself is chosen by the utility, and the words minor, major, and severe are defined in the alarm philosophy against categories that matter to the site: personnel safety, public health, environmental release, regulatory violation, equipment damage, and cost. A minor consequence might be an equipment repair under a set amount or a brief loss of a non-critical measurement. A severe one is an injury, a sanitary sewer overflow, a treatment violation, or a loss of the ability to supply water. Once the definitions exist, two people rationalizing the same alarm arrive at the same priority, which is the test.

How many levels

Three is the common answer: low, medium, high. Some sites add a fourth, critical or emergency, reserved for a handful of alarms with an immediate safety consequence: a gas detector, a fire alarm, an emergency stop. Beyond four, operators cannot keep the distinctions straight, and the extra levels get used as a way to avoid deciding.

Diagnostic and maintenance notifications that do not require operator action are not alarms at all under ISA-18.2, and should not occupy a priority. Route them to a maintenance list or an event log. A lot of the pressure to add priority levels comes from trying to fit things that are not alarms into the alarm system.

Distribution

The published guidance from EEMUA 191, carried into ISA-18.2, is a target distribution of about 80 percent low, 15 percent medium, and 5 percent high priority across the configured alarms, with under 1 percent in a critical level where one exists. The numbers are not magic. They express the idea that a high-priority alarm should be uncommon enough that it commands attention every time.

A system where 40 percent of alarms are high has not been rationalized; it has been configured by whoever was most worried at the time. The fix is not to demote alarms arbitrarily until the numbers fit but to run each one through the matrix. The distribution then falls out, and if it is still top-heavy the consequence definitions probably need tightening.

Common mistakes

Priority by equipment

Everything on the high-service pumps is high because the pumps are important. The pumps are important; the alarm about a bearing temperature rising slowly is not urgent.

Priority by who asked

A supervisor wants to be sure the alarm is noticed, so it is set high. Priority is the answer to the matrix, and the way to be sure an alarm is noticed is to have few high alarms.

Priority to control notification

An alarm is set high so it pages someone. If the notification system needs a separate criterion, give it one. Coupling the two forces the wrong priority on alarms that need a page but are not urgent, and the reverse.

Same priority for the pre-alarm and the alarm

High level and high-high level on a tank are two alarms with different times to respond. The first is medium, the second is high. Giving both high makes the first one noise.

Priority never revisited

A priority assigned at commissioning under commissioning conditions stays for twenty years. Rationalization is periodic, and the alarm history shows which priorities are wrong.

Priority in presentation

Once assigned, priority should be visible the same way everywhere. ISA-101 and the high-performance HMI practice give each priority a distinct color and, where used, a distinct sound, and reserve those colors for alarms only. The alarm summary sorts by priority and then by time. The alarm indication on a process display uses the priority color and shape. A pager or callout system uses the priority as one input to its escalation rules. When priority looks different on different screens, the operator has to translate, and translation under stress fails.