Forty alarms at three in the morning: alarm management for the GMP operator

It is ten to three in the morning in a fill-finish building. One operator sits at the supervisory console, covering the clean utilities, the air handling for the aseptic suite and the buffer preparation room next door. The filling line is idle; the next batch starts at six. Then a chiller on the air-handling loop trips.

Within a few minutes the alarm banner is scrolling. Supply air temperature high. Humidity high. Fan feedback discrepancies. Room temperatures, one after another. Underneath sit the alarms nobody cleared on day shift: a filter differential pressure high for a week, a door contact that chatters. Somewhere in that list, between a door alarm and a room temperature, the pressure cascade between the grade B corridor and the grade C room drops below its limit. It is one line among forty. The operator acknowledges page by page, calls the on-call engineer about the chiller, and finds the pressure alarm twenty minutes later.

The scene is a composite, but anyone who has worked nights on a pharmaceutical site will recognise it, along with the deviation report the next morning: root cause, operator did not respond in time; corrective action, retrain the operator. That conclusion is nearly always wrong. The operator did what the alarm system allowed, and the system never showed them what mattered first.

An alarm system is built for a person

Alarm management is done in databases, but its real subject is human attention: how many things one tired person can notice, judge and act on in a few minutes. The reference case comes from outside pharma. On 24 July 1994, after a lightning storm upset the Texaco refinery at Milford Haven, an explosion and fires injured twenty-six people. The UK Health and Safety Executive (HSE) found that in the last 11 minutes before the explosion the two operators had to recognise, acknowledge and act on 275 alarms. Its findings were blunt: too many alarms, poorly prioritised; displays that did not help the operators understand what was happening; inadequate training for a stressful, sustained upset.

A filling suite is not a cracking unit, but the arithmetic of attention is the same. HSE’s list of what reliable operator response needs reads like a design brief: an obvious display of the specific alarm, few false alarms, a low workload, a simple and well-defined response, trained operators, and tests of how well they respond.

Pharmaceutical sites have their own pull in the wrong direction. Almost every signal looks GMP-relevant, so almost everything becomes an alarm, and a good share become high priority because nobody wants to be the one who downgraded a GMP alarm. On paper the result looks careful. At night it is very hard to use.

Alarm, alert, event, record: four different things

ISA-18.2 defines an alarm as an audible and/or visible means of indicating to the operator an equipment malfunction, process deviation or abnormal condition requiring a timely response. Two words carry the definition: operator, and response. If nobody at the console has to do anything within a defined time, it is not an alarm, however important the information is to someone else.

The last row is where pharmaceutical alarm lists fill up. A critical parameter excursion may need the operator within two minutes and quality’s assessment later: two consumers, two time scales. Turning it into one high-priority alarm for both buries the operator’s action under paperwork that quality will do anyway.

What the standards and the regulators say

ANSI/ISA-18.2-2016, Management of Alarm Systems for the Process Industries, revised the 2009 edition and organises alarm management as a life cycle, from philosophy and rationalisation through monitoring and management of change to audit. The IEC adopted that life cycle in IEC 62682, whose second edition, published on 8 December 2022, replaces the 2014 edition, so procedures that still cite the 2014 text need updating. EEMUA 191, whose fourth edition came out at the end of 2024, is a users’ guideline rather than a standard, and the most practical of the three on how to actually do the work.

No GMP text names these documents, and none needs to. 21 CFR 211.68 requires automatic equipment to be routinely checked under a written programme designed to assure proper performance. EU GMP Annex 11 requires any change to a computerised system, configuration included, to follow a defined procedure, and an alarm set point, priority or delay is configuration.

The revised EU GMP Annex 1, published in August 2022 and in operation since 25 August 2023, is more explicit. It requires a warning on critical pressure differentials that is not overridden without assessment, with any alarm delays justified in the contamination control strategy (4.16); alarm events acknowledged and trended, with critical ones reviewed immediately (5.2); and, in grade A, alarms when particle alert levels are exceeded, with a defined response (9.17). Active-ingredient plants that are Seveso establishments have one more hook: Annex III of Directive 2012/18/EU lists procedures for alarm management among the elements of the safety management system.

Nothing here forces ISA-18.2 on a pharmaceutical site. Still, when an inspector asks how a critical alarm is defined, tested, reviewed and changed, the life cycle is the shortest honest answer.

The philosophy: one document the night shift should recognise

Most alarm philosophies we read are written for auditors. A better test is whether an experienced operator recognises the plant in it, and whether a new one learns from it how alarms work on site. Four things matter most.

• A site definition of an alarm. The ISA-18.2 sense, with examples of what is not an alarm here and where it goes instead: status, alerts, quality notifications.
• Priorities from consequence and time. About three levels, set by the consequence of the operator not responding and the time available. HSE’s guidance, after EEMUA, suggests roughly 5% high, 15% medium and 80% low. Product quality is one consequence column next to safety, environment and equipment, and does not sit above them by default.
• Shelving and suppression. Who may hide an alarm, for how long, with what record, and who reviews the list at handover.
• Change. Every added, deleted or modified alarm goes through change control, with its effect on operator load assessed as well as its effect on the product.

The philosophy is a controlled document signed by operations, engineering and quality. It also belongs in the user requirements for every new skid, so that packaged equipment arrives speaking the site’s alarm language rather than the vendor’s.

Rationalisation: the senior operators are the experts

Rationalisation reviews every alarm, existing or proposed, against the philosophy. For each one the team records the cause, the consequence of doing nothing, the operator’s action, the time available, the priority, the set point and the class (safety, GMP, environmental). The output is a master alarm database, the reference for configuration, testing and training.

Who sits at the table decides the result. The engineers know how an alarm is configured. The senior operators know what it means at two in the morning: that the chiller pre-alarm comes ten minutes before the trip, that the buffer tank level switch gives false readings whenever the agitator runs. Quality joins for alarms on critical parameters and classified areas, so that a downgrade is decided with evidence instead of being argued over later in a deviation.

Short, regular sessions work better than a two-week marathon. HSE warns not to underestimate the effort: a quick first pass may get through perhaps fifty alarms per shift, while a thorough redesign can take more than a shift per alarm. Tired teams make poor decisions, and those stay invisible until the next upset.

There is a human return that rarely makes it into a business case. What the senior operators know gets written down for the first time, the juniors hear why each alarm exists, and after a few sessions operators start proposing changes themselves, because for once an improvement programme is making their shift easier.

One warning, which Dunn and Sands — the two co-chairs of the ISA18 committee — make from experience: run as a counting exercise, rationalisation can remove critical alarms. Removing or downgrading a safety or GMP-critical alarm needs its own justification and its own signature.

Training on the response, not on the tag

Most GMP training on alarms is a read-and-sign of the operating procedure: tag names and colours. What operators need is the first ten minutes. Which alarm first, what to check, what to do, how long they have, when to call someone.

The master alarm database already holds all of that. Turned into a short response sheet per alarm, kept at the console, it is the most useful training document the programme produces. HSE asks for training that is realistic for abnormal conditions, and for competence that is tested rather than assumed.

The night shift deserves its own drill, with fewer people on site and the engineer on call at home. A tabletop exercise built on a printed alarm list from a real chiller trip teaches more than any slide: what to acknowledge, what to leave, what to escalate.

Measuring the load: what a shift actually feels like

An alarm system nobody measures drifts. New alarms arrive with every project, and nuisance alarms come back after maintenance. The figures below are ISA-18.2’s indicative targets as reproduced by the two co-chairs of the ISA18 committee; HSE’s older guidance gives the same order of magnitude, no more than one alarm every ten minutes on average in normal operation.

Measure per operating position, not per system: the operator covering utilities, air handling and buffer preparation is one person, even if the three systems come from three vendors. Look at nights separately too, because the same average can hide very different shifts. And when a late response turns up in a deviation, the first question should be the alarm rate in that hour.

Where to start

1. Export a month of alarm journal per operating position: average rate, floods, standing alarms.
2. Fix the ten most frequent alarms first, under change control: deadbands, delays, broken instruments.
3. Count standing and shelved alarms at each handover for two weeks, and ask the night shift which ones they no longer read.
4. Write and sign a short philosophy with operations, engineering and quality.
5. Rationalise one area with its senior operators, train the response, then measure again.

Five common mistakes

• Everything critical. When most alarms are high priority, priority stops meaning anything and the operator falls back on scrolling.
• Treating GMP-relevant as urgent. Quality notifications go to the horn instead of to quality. They deserve a record and a review, not an interruption.
• Retraining as the corrective action. If a response was missed during a flood, the alarm system is part of the root cause. Retraining one operator leaves the flood waiting for the next.
• Shelving without rules. Alarms suppressed at commissioning and never restored, a horn silenced because it was annoying. Every hidden alarm needs an owner, a reason and an end date.
• Buying software and calling it done. Monitoring tools show the problem; the work is in the philosophy, the rationalisation and the training.

An alarm system is judged at three in the morning, by one person, in the first ten minutes of an upset. Design it, rationalise it and train for that moment, and the deviation reports will start to tell a different story.

References

• ISA, *ISA18 alarm management standard updated*, InTech, May/June 2016 (ANSI/ISA-18.2-2016), and IEC, *IEC 62682:2022*, edition 2.0, 8 December 2022.
• HSE, *Better alarm handling*, Chemicals Sheet No 6, March 2000, and *The explosion and fires at the Texaco Refinery, Milford Haven, 24 July 1994*.
• European Commission, EudraLex Volume 4, *Annex 1: Manufacture of Sterile Medicinal Products*, 2022, 4.16, 5.2 and 9.17.
• D. G. Dunn and N. P. Sands, *Alarm management questions that everyone asks*, ISA InTech, March/April 2020, pp. 16–20 (the feature that prompted this article).