Alarm Flood Suppression and Dynamic Shelving

During an upset one root cause can trigger hundreds of correlated alarms; suppression logic collapses them so the operator sees the cause, not the cascade.

The flood problem

A single physical event rarely trips one alarm. A breeder disruption or a cryo failure propagates, and dozens to hundreds of downstream alarms fire within seconds — precisely when the operator has the least spare attention. An unmanaged flood buries the root cause in its own consequences and is a well-documented contributor to control-room incidents across process industries. Kronos suppresses floods so the ranked triage stream stays readable under the worst load.

Techniques

• Cause-and-effect grouping: known consequential alarms fold under their cause
• First-out capture: the first alarm in a cascade is preserved and highlighted
• Dynamic shelving: alarms irrelevant in the current mode are suppressed with an audit trail
• Flood detection: a spike in alarm rate switches the display to root-cause mode
• De-chatter: rapidly toggling alarms are debounced, with the chatter logged

Grouping is model-driven, not just static rules. The anomaly ensembles and the twin's causal structure identify which alarms are consequences of a common root, so the operator gets one root-cause header with the cascade collapsed beneath it and expandable on demand. Nothing is discarded — every suppressed alarm remains in the record for incident replay.

Suppression must be honest

Dynamic shelving is powerful and therefore dangerous: an alarm suppressed for the wrong reason is an alarm that fails silently. So every suppression is auditable — what was shelved, why, in which mode, and for how long — and shelving that hides a safety-relevant alarm is disallowed by rule. When flood mode is active, the interface says so explicitly, so the operator knows they are seeing a rationalized subset, not the full list.

def present(active_alarms, plant_mode, causal_graph):
    active = drop_shelved(active_alarms, plant_mode)      # audited shelving
    if rate(active) > FLOOD_THRESHOLD:
        roots = causal_graph.root_causes(active)          # collapse cascade
        return grouped_view(roots, expandable=True, flood_mode=True)
    return ranked_view(active)                            # normal triage

Suppression is only as trustworthy as the rationalization behind it — see alarm management — and it feeds the same triage stream operators work every shift.