Alarm and Indication Philosophy: Annunciation, Latching, Reset and First-Out Logic

An alarm is not every changing switchgear bit: it is a deliberate notification of an abnormal condition that requires a defined operator response within a useful time. Breaker position is normally an indication; a trip-circuit failure is an alarm; a relay operation is an event and may also initiate a first-out alarm. Mixing these concepts creates alarm floods, ambiguous resets and missed root causes.

This article develops a practical alarm and indication philosophy for MV switchgear, protection panels, station HMI and SCADA. It covers prioritisation, annunciation, latching, acknowledgement, reset, first-out, quality, SOE, shelving/suppression and FAT/SAT.

Executive rules

Classify each point as status, event, alarm, trip/lockout or maintenance diagnostic before mapping it to lamps/HMI/SCADA.
Every alarm needs a cause, consequence, priority, operator action, response time, clear condition and owner.
Priority comes from consequence and allowed response time—not from the relay manufacturer or favourite colour.
Acknowledge means “operator has seen it”; reset means “clear a latch if the initiating condition permits”; return-to-normal is the process condition clearing.
Latch only where losing evidence or preventing unsafe automatic reset justifies it.
First-out logic must preserve the initiating cause with adequate time resolution and defined simultaneous-event handling.
Bad/old/test/substituted data must not look like a healthy normal state.
Test alarm floods, chattering, loss of DC/network/time, reset races and restoration—not only individual lamp operation.

1. Standards and scope

Reference	Use
IEC 62682:2022	Alarm-management lifecycle principles for control/HMI systems; directly useful to industrial switchgear installations
IEC 61850-7-3:2010+AMD1:2020	Common data classes for status, measured and controllable information including quality/time concepts
IEC 61850-7-4:2010+AMD1:2020	Compatible logical-node and data-object models
IEC 61850-6:2009+A1:2018+A2:2024	SCL configuration exchange and system relationships
IEEE C37.2-2022	Device function numbers/acronyms including HMI, SOE, historian, trip-circuit monitor and scheme logic
IEC 60255-27:2023	Safety of protection equipment and associated auxiliaries, not alarm rationalisation

IEC 62682 is written for process industries; apply its lifecycle discipline while tailoring priorities and operator roles to the electrical plant. Electrical protection actions remain governed by the protection philosophy and equipment/system standards.

2. Separate five information classes

Class	Purpose	Example
Status/indication	Current equipment state; no abnormality implied	Breaker open/closed, local/remote, truck service
Event/SOE	Time-tagged change used for sequence analysis	Protection pickup, 52a transition, command issued
Alarm	Abnormal condition requiring operator response	Trip circuit unhealthy, VT MCB trip, low DC
Trip/lockout	Automatic protective action and possible reclose inhibit	Bus differential trip, transformer lockout
Diagnostic/maintenance	Condition for engineering/maintenance workflow	IED self-test warning, breaker operation counter threshold

One physical change can create several records: a breaker protection trip may be a high-priority alarm, an SOE event, a latched first-out cause and a lockout state. Keep the semantics separate even if they share an HMI object.

3. Alarm rationalisation register

unique signal/alarm ID and equipment reference;
plain-language alarm text including object and abnormal condition;
initiating logic and normal/alarm state;
credible cause(s) and consequence if no action;
operator action and required response time;
priority and rationale;
delay/debounce/deadband;
latching, acknowledge and reset behaviour;
suppression/shelving/inhibit rules and authority;
first-out group and SOE/time requirement;
quality/failure handling and source ownership;
local lamp, station HMI, SCADA, historian and notification destinations;
test case and maintenance owner.

Rationalisation should eliminate duplicate consequence alarms, not hide useful root causes. “Switchgear alarm” is rarely actionable; “Feeder 12 Trip Circuit 1 Open while breaker closed—inspect before re-energisation” is.

4. Priority philosophy

Use a project risk matrix based on consequence severity and time available for operator intervention. A typical structure has emergency/critical, high, medium and low/advisory classes, but names and counts must match the control-room standard.

Critical: immediate action needed to avoid/limit serious safety, equipment or wide-process consequence.
High: prompt action needed; protection/control redundancy or essential supply at risk.
Medium: abnormal condition needs timely correction but allows investigation.
Low/advisory: maintenance/efficiency issue with longer response; consider whether it should be a work notification rather than an alarm.

A protection trip can be critical or high depending on consequence, while a relay self-test warning may be high if it removes the last protection channel. Limit top priorities so they remain distinguishable during a disturbance.

5. Annunciation states and operator actions

State	Meaning	Typical presentation
Normal	Condition not active	No alarm; status still available
Unacknowledged active	New alarm not yet accepted	Distinct flash/audible by priority
Acknowledged active	Seen but condition remains	Steady active indication
Returned unacknowledged	Condition cleared before acknowledgement	Retain evidence until acknowledged if philosophy requires
Returned acknowledged	Condition cleared and seen	Automatically normal or waiting reset depending latch
Shelved/suppressed/out of service	Not presented by a governed rule	Visible count/state with reason/expiry
Bad/invalid quality	Source cannot assert trustworthy normal/alarm state	Separate invalid/communications alarm; never plain normal

Use audible devices sparingly and allow acknowledgement to silence them without clearing the alarm condition. Lamp test must prove display hardware without operating plant outputs or rewriting event history.

6. Latching philosophy

Latch fast/transient trips whose cause may disappear before the operator arrives.
Latch lockout/reclose-inhibit states where deliberate cause review/reset is essential.
Do not latch every persistent analogue alarm; the live process condition already retains it.
A latched alarm may clear after acknowledgement plus return-to-normal, or require explicit reset—state the rule.
Reset must not clear a still-active input or conceal bad quality.
Loss and restoration of IED/DC power must have defined latch retention; nonvolatile retention can preserve evidence but may preserve stale state.
Local and remote reset authority must reflect safety and operating ownership.

7. Acknowledge, reset and clear are different

Acknowledge records that an operator has seen an alarm and normally changes its presentation. Return-to-normal means the field/logic condition is no longer active. Reset releases a latch or lockout only when its permissive conditions are satisfied. Acknowledge must never operate equipment; reset must not be used as a substitute for fixing the cause.

Record user, time and station for acknowledge/reset where the system supports it.
Define whether one acknowledge acts on one alarm, a visible page or a priority group.
Prevent a global reset from clearing unrelated protection targets before evidence capture.
For mechanical lockout relays, electrical/HMI reset indication must match actual device reset.
Show “active acknowledged” distinctly from “cleared but latched.”
On SCADA link failure, reconcile acknowledgement state without duplicate or lost operator actions.

8. First-out logic

First-out captures the earliest initiating condition in a defined trip group before consequential contacts cascade. Examples include transformer trip causes, generator shutdowns or an ATS abort. It is not simply the first alarm arriving at SCADA, because different IED/network delays can reorder events.

Define the group boundary and which inputs are eligible causes.
Capture at the closest common logic device or use synchronised source timestamps with proven resolution.
Define simultaneous window: two inputs within one scan/time tolerance may both be “first.”
Latch first-out until authorised reset after cause evidence is recorded.
Retain subsequent causes in SOE; first-out must not suppress the full sequence.
Define power-cycle behaviour and nonvolatile data integrity.
Test near-simultaneous input ordering, input bounce, communication delay and reset while active.

9. Delays, debounce, deadband and chattering

Use input debounce only long enough to reject contact bounce/noise without hiding required SOE timing.
Use on-delay for conditions that must persist; use off-delay where brief recovery should not clear an ongoing abnormal episode.
Use analogue deadband/hysteresis and appropriate persistence to prevent repeated threshold crossings.
Separate protective trip delay from alarm delay; the alarm system must not inadvertently slow protection.
Detect chattering/repeating alarms and route them for maintenance while preserving the underlying condition.
Document every delay in the rationalisation register and test at boundary values.

10. Alarm flood and consequential suppression

A bus trip can generate dozens of breaker-open, undervoltage, motor-stopped and communications consequences. The operator needs the initiating trip and the current plant state—not an unstructured cascade.

Suppress only alarms that are logically expected and non-actionable in the current state.
Use state-based suppression for equipment out of service, breaker test position or de-energised bus where approved.
Keep the root-cause alarm, protection operation and critical equipment failures visible.
Do not suppress an alarm merely because another higher-priority alarm is active.
Make suppression rules testable, version-controlled and visible to operators.
On return to service, validate inputs before unsuppressing to prevent a flood.

11. Shelving, inhibit and out-of-service

Mechanism	Proper use	Control
Shelving	Operator temporarily hides a known nuisance alarm	Reason, user, expiry, visible shelved list
Design suppression	Automatic state-based removal of non-actionable alarm	Approved logic and lifecycle test
Inhibit	Prevents alarm generation/processing under a controlled condition	High authority; may affect safety response
Out of service	Equipment/signal formally unavailable for maintenance	Permit/work-order, compensating control, restoration test

These states must never silently make bad data look normal. Count, alarm and audit long-standing shelves/inhibits, especially on protection, trip-circuit, DC and arc-detection signals.

12. Data quality, communications and time

Propagate source quality: valid/invalid, test, substituted, questionable, old data as supported by the protocol/model.
Use source timestamps for SOE where trustworthy; record gateway/SCADA receipt separately.
Define time-sync loss alarm and how uncertainty affects first-out/sequence analysis.
On communication loss, retain last state only with visibly bad/stale quality; do not report it as current healthy state.
On reconnection, avoid replay floods/duplicate events while preserving missed-change evidence.
Map IEC 61850 quality/time to IEC 60870-5-104 or other SCADA protocol without semantic loss; document gateway rules.
Separate network/device health alarm from each point becoming “alarm.”

13. Local panel, station HMI and remote SCADA

Local: immediate equipment identification, trip target, close/trip-circuit health and safe maintenance diagnostics.
Station HMI: topology, priority alarm list, first-out/SOE, source quality and detailed response guidance.
Remote SCADA: actionable alarms/status/measurements appropriate to remote operator authority; avoid exporting every diagnostic bit.
Historian/engineering: high-resolution events, oscillography references, operation counters and maintenance trends.

Use consistent text, equipment IDs and priority across layers. Colours must not be the only coding and should not conflict with established breaker/status conventions. Keep alarm summary navigable during a widespread disturbance.

14. Common switchgear alarm set

protection trip and specific lockout/first-out cause;
breaker fail, pole/position disagreement and mechanism failure;
trip circuit channel 1/2 unhealthy, close circuit failure, low mechanism energy;
DC feeder/charger/battery low/high voltage and earth fault;
VT fuse/MCB/selection failure and CT circuit supervision where available;
busbar protection, arc protection and their channel/watchdog failure;
IED self-supervision, settings/configuration mismatch and network redundancy failure;
switchgear gas/pressure/temperature/partial-discharge alarms where equipment provides validated sensors;
door/access/interlock bypass or equipment out of service;
time-synchronisation failure affecting SOE requirements.

Rationalise exact priorities and aggregation. For example, one lost redundant station-network path may be medium; loss of both paths carrying critical interlocking/trips can be high or critical.

15. FAT/SAT test programme

Review every alarm against the rationalisation register, source signal and operator response.
Inject active, return, acknowledge and reset in every meaningful order.
Verify latched/non-latched and power-cycle behaviour with input active/cleared.
Trigger first-out inputs separately and near-simultaneously; compare local/SOE/SCADA order.
Test priority audible/visual indication, lamp test and colour-independent identification.
Apply chattering, analogue threshold oscillation and mass disturbance/alarm-flood scenarios.
Exercise state suppression, shelving expiry, inhibit/out-of-service authority and restoration.
Remove device/network/time/DC sources; verify bad quality and no false healthy state.
Reconcile local HMI, gateway, SCADA and historian text, priority, timestamp and acknowledgement.
Archive results and performance baselines; resolve every standing/bad-quality alarm before handover.

16. Frequent mistakes

Mistake	Consequence	Correction
Every status becomes alarm	Flood/operator desensitisation	Require defined abnormality/action
Acknowledge clears alarm	Active condition hidden	Separate acknowledge, return and reset
All alarms latched	Stale panels/reset burden	Latch by evidence/safety need
First SCADA arrival is first-out	Network delay misidentifies cause	Capture near source with proven time
Bad quality shown as normal	Lost protection/control issue hidden	Explicit invalid/stale presentation
Maintenance shelves indefinitely	Protection defect concealed	Expiry, audit and governed restoration
One-point FAT only	Flood/race/reset defects latent	Dynamic multi-event testing

17. Design-release checklist

All points classified status/event/alarm/trip/diagnostic?
Every alarm has cause, consequence, action, time and owner?
Priority rationalised and top classes limited?
Acknowledge, return, reset and lockout semantics explicit?
Latching/retention/power-cycle behaviour justified?
First-out boundary, resolution and simultaneous rule proven?
Delays/deadbands/chatter controls documented?
Flood suppression preserves root causes and current state?
Shelving/inhibit/out-of-service governed and visible?
Quality/time/protocol mappings maintain semantics?
Local/HMI/SCADA text and priorities consistent?
FAT/SAT includes races, flood, failure and restoration?

References and further reading

Engineering note: Priority examples are illustrative. Rationalise them with the site’s safety/process consequences, staffing and operating procedures.