How to Set Up Alarm Suppression by Plant Mode

Back to Blog

Define the Modes and What They Make Irrelevant

Start by identifying the operating states where alarms genuinely change meaning. A unit that is deliberately shut down should not alarm on low flow, low pressure, or the dozens of conditions that are normal when it is off. A startup sequence passes through states that would trip steady-state alarms it has not reached yet. A pump commanded off should not alarm on not running. Each of these is a mode, and for each you list the specific alarms that are meaningless while it holds - that list is the whole design.

Suppress only what is genuinely irrelevant in the mode, never a blanket silence. The danger in mode-based suppression is over-suppressing - turning off alarms that still matter even in that state, so a real problem during shutdown goes unannounced. For each alarm in each mode, ask whether it could still indicate a genuine problem; if it could, it stays active. Designed suppression is surgical, removing exactly the noise a state creates and nothing more, which is why it is an output of careful alarm rationalization rather than a quick fix.

Distinguish this designed, automatic suppression from operator shelving, because they solve different problems. Suppression by mode is engineered - the system knows a state makes certain alarms meaningless and handles it automatically, the same for every operator every time. Shelving is a manual, temporary operator action for a specific nuisance. Using shelving to paper over a state that should have designed suppression means operators re-do the same silencing every shift, which is exactly the pattern an alarm shelving policy should route toward a suppression design instead.

Tie Suppression to a Reliable State Signal

Suppression is only as trustworthy as the signal that drives it, so choose a state indicator that genuinely reflects reality. Tying low-flow suppression to a pump's run command is reasonable; tying it to something that can disagree with the real state is dangerous, because if the signal says shut down while the unit is actually running, you suppress alarms that are protecting a live process. The state signal must be one that cannot easily lie about the plant's actual condition.

Handle the transitions between modes carefully, because that is where suppression logic breaks. As the plant moves from shutdown to running, alarms must re-activate at the right point in the sequence - not so early that they trip on conditions the startup has not yet satisfied, and not so late that a real problem during the transition goes unseen. The transition is the hardest part to get right, and it deserves the most testing, because a suppression that behaves correctly in steady states can still fail during the move between them.

Guard against the state signal itself failing. If the signal driving suppression goes to bad quality or gets stuck, the suppression logic should fail safe - toward showing alarms rather than hiding them - because a stuck state signal that suppresses live alarms is a silent hole in protection. This ties suppression to your quality-flag strategy: a suppression decision made on a bad-quality state signal should not be trusted to keep hiding alarms.

Keep Suppressed Alarms Visible and Reversible

A suppressed alarm should be visibly suppressed, not invisible. The operator needs to be able to see that an alarm is currently suppressed by design and why, so a suppressed condition is a known, displayed state rather than a silent gap. An alarm that is simply gone with no indication looks the same as an alarm that does not exist, and the operator has no way to know that protection is intentionally off. Visibility is what keeps designed suppression honest.

Make suppression return automatically and immediately when the state changes. The moment the plant leaves the mode, the suppressed alarms must come back to full function, because a suppression that lingers after its state has ended is exactly the silent hole the whole design is meant to avoid. The return should be automatic and tied to the same state signal, never dependent on an operator remembering to re-enable anything, since the thing operators forget is the thing that hurts.

Provide a way to see what is currently suppressed across the plant. A single view of every alarm suppressed by mode right now lets an operator or engineer confirm the suppression matches the actual plant state and catch a suppression that is active when it should not be. This is the same kind of oversight a review of the nuisance alarm population provides, applied to suppression: the aggregate view is where a stuck or wrong suppression becomes visible.

Verifying Suppression Hides Only the Right Alarms

Test each mode by entering the state and confirming the intended alarms suppress while everything else stays active. Drive the plant, or simulate the state signal, into each mode and check that exactly the alarms on that mode's list go suppressed and no others - especially confirming that alarms which could still indicate a real problem in that state remain active. Over-suppression is the failure that matters, so the test is as much about what stays on as what turns off.

Test the transitions hardest, because they are where suppression fails. Move between modes and watch alarms re-activate at the right point, confirming none stays suppressed after its state has ended and none trips prematurely during a startup sequence. Then fail the state signal - drive it bad or stuck - and confirm suppression fails toward showing alarms. These transition and failure tests belong in your configuration validation, because a suppression scheme that works in steady state but leaves a hole during transitions is worse than none.

Common Mistakes to Avoid

The dangerous mistake is over-suppression - blanketing a mode with silence that also hides alarms still indicating real problems in that state. Suppress surgically, and for each alarm in each mode confirm it truly cannot indicate a genuine issue before turning it off. The second mistake is driving suppression from an unreliable state signal that can disagree with the real plant condition, which suppresses live alarms whenever the signal lies.

The third mistake is making suppressed alarms invisible, so the operator cannot tell that protection is intentionally off. Show suppression as a displayed state. The fourth is suppression that does not return promptly when the state changes, leaving a silent hole after its mode has ended - tie the return to the state signal automatically, and test the transitions hardest, because a suppression correct in steady states can still fail in the move between them.

Frequently Asked Questions