An alarm system can be clear and useful on commissioning day, then gradually become a source of noise. Setpoints get adjusted, equipment changes, transmitters fail, and new operating modes appear without corresponding updates to alarm logic. Eventually, an operator facing an alarm flood may stop reading the screen precisely when fast, accurate decisions matter most.
ANSI/ISA-18.2 provides a lifecycle discipline for keeping alarms rare, relevant and actionable. It is not a substitute for safety interlocks or burner management; it governs the operator-facing alarm layer: which abnormal conditions merit an alarm, what response is expected, and how performance is monitored. For plants investing in furnace automation and control, this discipline protects operator attention and supports consistent production decisions.
Why furnace alarm systems decay
A commissioned system may start with documented alarm limits and clear responsibilities. Over time, local adjustments can bypass the original design intent. A transmitter left in fault, an overly narrow deadband, or a fixed limit applied in every operating state can turn a useful notification into a persistent distraction.
Common nuisance alarms include:
- Chattering: repeatedly switching between normal and alarm states, often because the signal fluctuates near its setpoint.
- Fleeting: appearing briefly and clearing before an operator can investigate or act.
- Stale: remaining active for an extended period without resolution or review.
- Standing: permanently active and eventually treated as part of the background.
- Consequential or follow-on: multiple alarms reporting symptoms of one root cause, rather than separate conditions requiring distinct action.
The result is a loss of trust. If operators learn that most annunciations are irrelevant, important alarms are more likely to be missed among them.
The numbers that define a healthy alarm system
The following are published reference targets and industry guidance, not universal requirements. Actual limits should be assessed against process risk, operator workload, alarm philosophy and site conditions. Performance is typically evaluated using a representative 30-day data window.[1][2][5]
- ~1–2 alarms per 10 minutes per operator: a commonly cited average-rate target for a manageable alarm load.
- More than 10 alarms in 10 minutes: a commonly used alarm-flood threshold.
- Less than ~1% of operating time in flood condition: a reference objective for keeping floods infrequent.
- ~80% low, ~15% medium and ~5% high: a commonly cited priority distribution to help preserve the meaning of high-priority annunciations.
- ~5 stale alarms per day or fewer: an aspirational ceiling for stale alarms remaining after rationalization.
These figures are diagnostic benchmarks, not quotas. The goal is not to generate a prescribed number of alarms; it is to ensure that every alarm deserves an operator’s attention.
Rationalization and the master alarm database
Alarm rationalization is a structured review of each alarm candidate. Under ISA-18.2, an alarm should indicate an abnormal condition that calls for a unique operator action. If it does not, the team should determine whether it belongs as an alarm, should be handled through another indication, or duplicates an existing notification.[1]
A practical alarm philosophy sets the site rules for classification, priority, deadband, response time, shelving, state-based behavior and review. The rationalization team then records each approved alarm in a master alarm database (MADB). At minimum, each record should document:
- Tag and alarm description
- Setpoint and deadband
- Priority and applicable operating state
- Cause and potential consequence
- Required operator action
- Time available to respond
The MADB becomes the controlled document of record, not a spreadsheet that quietly diverges from the configured control system. Changes to alarm limits, priorities, state logic and suppression should follow management of change (MOC), including review, authorization, implementation and verification. That discipline keeps alarm configuration aligned with the process it is meant to support.
State-based alarming for multi-state furnace operations
A fixed alarm setting cannot distinguish a condition that is normal during startup from one that requires intervention during steady production. Reheat furnaces, melting operations and atmosphere-controlled processes move through startup, dry-out, soak, production, delay and shutdown. Those transitions are a frequent source of nuisance alarms when the configured logic remains static.
A published Octave/Honeywell case study describes a five-furnace coker unit at a Middle East refinery. For each of five furnace/drum combinations, 36 temperature alarms had settings, priorities or suppression status changed automatically according to the operating state. The team defined five states: startup, default, decoke, trip and furnace shutdown. A state-detection algorithm read sensor values through OPC every 15 seconds. Six common trouble alarms consolidated an average of 32 input alarms each into a single diagnostic alarm. A watchdog timer restored DCS alarm settings to predetermined defaults if communication with the state module was lost.[3]
The lesson is not to suppress broadly; it is to use approved, documented alarm behavior for the actual process state, with clear failure handling and visible diagnostics.
| Operating state | Fixed-setting problem | State-based treatment |
|---|---|---|
| Cold startup | Expected temperature or flow deviations may alarm before the unit is ready for production. | Apply startup limits and priorities; retain alarms that require an immediate response. |
| Dry-out or heat-up | Ramp conditions can trigger limits intended for normal operating temperature. | Use state-specific thresholds and clear transition criteria. |
| Steady production | Looser startup settings can delay detection of a meaningful deviation. | Restore production limits and priority assignments. |
| Delay or hold | Paused material movement can create predictable process deviations. | Suppress only alarms that are expected and non-actionable; keep consequential alarms active. |
| Shutdown | Falling temperatures and stopped equipment can generate a cascade of expected alarms. | Apply a defined shutdown profile and make relevant abnormal conditions visible. |
Trip forensics: first-out logic and diagnostic messaging
A furnace trip (following, for example, flame loss, a fuel-pressure excursion or a power dip) can generate dozens of consequential alarms within seconds. Without first-out indication, the operator sees a sequence of symptoms but may not know which condition initiated the event.
First-out diagnostics identify the source condition before subsequent alarms obscure the sequence. Messaging should be specific enough to guide investigation: for example, distinguish whether ignition was energized from whether flame-signal strength was insufficient, rather than presenting only a generic lockout message. Emerson’s 2025 discussion of modern burner management describes first-out indication as a diagnostic capability in modern safety platforms; here, the focus is how that information is presented and managed by the alarm layer, not the design or testing of safety interlocks.[4]
The 2023 NFPA 86 revision also illustrates that interlock logic and alarm/annunciation design evolve together: it addresses comparison of a discrete combustion-airflow input with fan-run status and changes the MFT pushbutton circuit requirement from SIL 3 to SIL 2.[4]
Shelving, suppression and the governance trap
ISA-18.2 practice allows supervised, temporary shelving when an alarm is known to be unavailable or non-actionable for a defined period, for example, while a failed transmitter awaits replacement. Shelving should have an authorized purpose, a time limit and an operator-visible shelf list that can be reviewed.
This is not the same as undocumented masking. Uncontrolled suppression hides alarms from operators without making the exposure visible to supervisors or maintenance. The site should review active and expired shelves, reason codes, owners and overdue restoration actions. Every temporary suppression needs an end point and a plan to return the alarm to service.
Apply the discipline to each operation
State-specific alarm design should reflect process hazards and operating sequences, not apply a generic template:
- A steel rolling mill reheat furnace needs distinctions between charging, heating, hold and rolling conditions.
- A melting furnace for steel and an aluminum melting furnace require alarm behavior aligned with charge, melt, hold and pour phases.
- A hot dip galvanizing plant must account for kettle conditions and line states without burying actionable temperature or process deviations.
- In the wire and cable industry, annealing lines need alarms suited to ramp-up, stable running, line stops and restart.
- A metal recycling furnace should differentiate expected feed and batch transitions from abnormal process conditions.
For heat treatment furnaces, atmosphere and cycle stages demand clear state definitions as well as appropriately prioritized alarms.
Keep the alarm layer stocked
Alarm governance depends on healthy instruments and controls. A failed device left in place can become a permanently shelved alarm, weakening the operator’s view of the process. Maintain appropriate flame detectors and scanners, relay or line-monitoring modules, replacement transmitters, and sensors used by state-detection logic.
Alongside condition-based maintenance, establish a recurring alarm-KPI review cadence and retain OEM-default documentation so approved configuration changes remain traceable. Access to suitable furnace spare parts and timely technical support helps return shelved alarms to service and limit avoidable downtime.
A five-phase roadmap
- Alarm philosophy and KPI baseline: Define alarm principles, ownership, priorities and operating-state terminology. Capture a representative 30-day baseline.
- Rationalization and MADB build: Review alarms with operations, instrumentation, process and maintenance teams. Document cause, consequence, action, response time and configuration.
- State-based reconfiguration and first-out review: Identify where fixed settings fail across operating modes. Specify state transitions and review how first-out indications reach the operator.
- Shelving, monitoring and operator training: Set authorization, time limits and visible shelf-list practices. Train operators to interpret alarm priorities and diagnostics.
- Governance, MOC and quarterly metric reviews: Control changes, audit suppression and review flood duration, alarm rates, stale alarms and priority distribution. Track actions to closure.
Turn alarms back into decision tools
Alarm management is an enduring operational discipline, not a one-time commissioning task. A well-governed alarm layer helps operators focus on actionable conditions, supports process availability and strengthens lifecycle value across industrial furnace systems and every other piece of thermal processing equipment on site.
Continental Furnaces brings 35+ years of expertise, ISO-certified quality and customized solutions as an industrial furnace manufacturer. To discuss alarm-aware control design, upgrades or a new furnace project, request a consultation and take a deliberate step toward sustained competitive advantage.
References
- ANSI/ISA-18.2-2016, Management of Alarm Systems for the Process Industries.
- Siemens, “Setting a New Standard in Alarm Management” (2021), white paper.
- Octave/Honeywell, “State-based alarming solves problems for coker unit,” case study.
- Emerson Automation Experts, “Modern Burner Management Control and Optimization” (June 2025), article.
- Rockwell Automation, “Economic and Effective Alarm Management,” white paper.
