Alarm Management.

Alarm management is the discipline of making sure an operator receives only the alarms that demand a response, and receives them in time to act. It exists because the marginal cost of adding an alarm in a modern control system is effectively zero, so without discipline the alarm list grows until a process upset produces a flood the operator cannot read, which is precisely the failure mode that contributed to incidents such as Texaco Milford Haven in 1994 and BP Texas City in 2005. ANSI/ISA 18.2 codifies the answer as a lifecycle rather than a one-time configuration. A philosophy that defines what an alarm is, identification of the conditions that warrant one, rationalization that validates each alarm carries a defined operator response and priority, detailed design, implementation, operation, monitoring against rate-based metrics, management of change, and audit. The performance targets the lifecycle works toward, drawn from ISA 18.2 and the EEMUA 191 guidance, are demanding, an average well below one alarm per operator every ten minutes, peaks held in single digits during an upset, almost no alarms left standing for days and most plants miss them without active intervention. The part of this that touches the drawing is narrow. A P&ID may show that an alarm exists and its priority, but the rationalization data, the response, the time to act, the consequence of inaction lives in a separate alarm register. The I/O list anchors which tags can alarm. The alarm register defines how each one should behave.