Alert Triage
Alerts are ranked by how soon someone must act, so the one that matters isn't lost in a flood of equals.
Three Mile Island Unit 2
March 28, 1979 · Middletown, Pennsylvania
Just after 4 a.m., a valve stuck open in the cooling system of a nuclear reactor near Middletown, Pennsylvania, and water began to escape. Within minutes, more than a hundred alarms were sounding and flashing in the control room, each one looking as urgent as the next. The printer recording them fell more than two and a half hours behind. Amid the flood, the operators misread what was happening and cut back the emergency cooling the reactor needed, and about half the core melted. It was the worst accident in the history of US commercial nuclear power.2,3
Anti-pattern: Alarm Flood
Every alarm arrived as an equal, so the one that mattered looked like the hundred that didn't. Consequences of the stuck valve arrived as peers of their own cause, and the printed record fell so far behind that it stopped describing the present. One operator told the President's Commission he would have liked to throw the alarm panel away, because it gave no useful information.
Alert Triage
Therefore: Rank every alert by how soon someone must act, show the rank in color, position and sound, and group alerts that are only consequences under the fault that caused them.
Without
Control room alarm panel
Press to see what the control room saw. Simplified illustration, not real plant data.
With the pattern
Control room alarm panel
The same thirty events, ranked. Simplified illustration, not real plant data.
Rank is carried by the display itself, so the one alert that needs action now is distinguishable from the ninety-nine that are its consequences.
The mechanism
condition detected → link to the response
- 01Condition detectedSomething the operator may need to act on
- 02 · Key momentRank it by urgencyAct now, act soon, be aware
- 03Encode the rankColour, position and sound carry it
- 04Group consequences under their causeEffects of a fault, not new faults. Still available, one step away.
- 05Link to the responseThe alert carries its procedure
On this page
Design considerations
- Define levels by what the person must do. Warning: act now. Caution: act soon. Advisory: be aware.1
- Reserve the colors. Red and amber each mean one thing and are used for nothing else.1
- Use two senses for anything urgent. Above Advisory, pair the visual alert with sound or touch.1
- Group consequences under their cause. This is the step most often skipped, and it's the difference between a hundred alarms and one.
- Keep the record live. At Three Mile Island the alarm printer fell more than two and a half hours behind. A log that lags is history, not status.3
In the field
Observed · Industrial. Three Mile Island: a hundred alarms within minutes of the first, none of them ranked, and an operator who would have thrown the panel away.2
Observed · Aviation. The three-level flight crew alerting scheme — Warning, Caution, Advisory, with reserved colors and at least two senses for the top two — is a certification requirement for large airplanes.1
Related patterns
- Complements · 10Explainable FaultTriage decides which alert reaches the operator first; the other decides whether it names anything useful when it gets there. A ranked flood of error codes is still unreadable.
- In tension with · 03Graceful DegradationStepping down produces alerts by design, and each rung has consequences that look like faults. The ladder is only legible if the step-down is one event rather than fifty.
Sources
The aviation answer is worth borrowing because it's so unglamorous: three levels, colors that mean one thing, two senses for anything urgent. None of it is clever. It's a budget, spent in advance, on the assumption that attention is finite and the worst moment is when everything happens at once.