Building an alarm escalation model that actually reaches someone

In almost every incident review the measurement was correct and the alarm was raised. What failed was everything after that: the number belonged to someone who had left, the phone was on silent, the mail went to a shared inbox nobody reads at night, or the alarm was one of forty that day and lost its meaning. Resilience lives in the path between the reading and the person, not in the sensor.

• The contact list was correct two staff changes ago.
• One channel only: an e-mail, a text, or a light in a corridor nobody walks at night.
• No acknowledgement, so nobody knows whether the message landed.
• Alarm volume so high that a genuine excursion looks like the rest.
• No record of who was called, when, and what they did.

A limit should reflect what the stored material can survive, not what the equipment display shows. Use a pre-alarm well inside the tolerated band, an action limit at the edge of it, and a delay long enough to absorb normal operation (a door opening, a defrost cycle) but short enough to leave a usable window.

Write the ladder as a sequence of named people with times, not as a group. Group notification spreads responsibility until nobody owns it. Each step should change either the person or the channel, and every step needs an explicit time limit after which the alarm moves on.

• Step 1: the person on duty for that area, by phone call, acknowledgement required.
• Step 2 after a fixed interval: the second name on the on-call rota, on a different channel.
• Step 3: the departmental lead or facility duty officer.
• Step 4: a standing fallback that is always staffed, even in holiday weeks.
• Throughout: every attempt, acknowledgement and hand-over recorded with a timestamp.

Alarm fatigue is a design problem. If a person receives more alarms than they can meaningfully act on, they will start to filter, and the filter is not selective. Review the alarm log monthly, find the five sources that generate most of the traffic and fix the cause: a sensor in the wrong place, a limit set to the equipment rather than the product, a missing delay on a defrost cycle, or a unit that genuinely needs maintenance.

An auditor or an insurer will ask three questions: when did the deviation start, who was notified and when, and what was done. That means the alarm history, the notification attempts and the acknowledgements have to live in the same record as the measurement, be exportable, and be impossible to edit after the fact.

• Time-stamped measurement around the event, not just the excursion itself.
• Every notification attempt with channel, recipient and result.
• The acknowledgement, with the person who gave it.
• The action taken and the return to normal, recorded against the same event.