Alarm Settings vs. Operating Setpoints – Understanding the Difference

Accessing Alarm Settings

From the Alarm page on the HMI, the operator can press Alarm Settings.

A pop-up window will appear where any Alarm ID applicable to the system can be entered.

For the selected Alarm ID, it is possible to:

view alarm information
adjust trigger points
adjust alarm delay
change alarm criticality

Alarm criticality is defined as:

WARNING (non-critical) – system continues running
ALARM / CRITICAL – system stops automatically

Purpose of alarms – WARNING vs. CRITICAL

Alarms exist to protect equipment, process, and safety, but they serve different roles depending on severity.

WARNING (non-critical) alarms are intended to:

inform the operator that something requires attention
indicate that a condition is outside normal operation
allow corrective action before the situation escalates

CRITICAL (ALARM) alarms are intended to:

prevent equipment damage
prevent unsafe operation
stop the system when continued operation risks serious failure

In short:

Warnings alert and give time to react
Critical alarms intervene to prevent something from going seriously wrong

What Alarm Settings are used for

Alarm Settings define how and when the system reacts to a given condition.

They control:

when an alarm is triggered
how long a condition must persist (delay)
whether the system should stop automatically

Alarm Settings do not control normal system operation.

Operating setpoints – how the system is actually run

Operating setpoints define how the CF system is operated automatically during production.

They are adjusted to:

balance flows and levels
control recovery and pressures
manage TMP and fouling
optimize performance

Examples of operating setpoints include (non-exhaustive):

System Shared 1 (examples)

Feed flow [m³/h]
Total feed entering the CF system, split into permeate and retentate.
Inlet pressure [bar]
Pressure at suction side of the CF pump (measured by PT07).
Recovery [%]
Ratio between permeate flow and feed flow.
BW interval [min]
Time between consecutive backwashes.
BW TMP [bar]
TMP setpoint for initiating BW.
BW duration [s]
Duration of negative filtration flow during BW.
Minimum level to start BW [%]
Required permeate tank level before BW can start.
Maximal TMP [bar]
TMP limit where flow reduction starts to prevent further TMP increase.

System Shared 2 (examples)

Circulation speed [%]
CF pump load during filtration.
Manual permeate flow per housing [m³/h]
Individual housing permeate flow setpoint via FT/FCV PID.
Permeate tank level [%]
Normal operating level around which the tank is balanced.
Plug discharge recovery [%]
Recovery used during plug flow discharge mode.
Plug discharge volume [L]
Batch volume discharged from the CF loop.
BW CF speed [%]
CF pump load during BW.
Plug BW skip value
Number of plug discharges without immediate subsequent BW.

➡️ These settings directly influence system behavior during normal operation.

Why confusing these two causes problems

Adjusting operating setpoints is a normal and necessary part of running the system.

Adjusting alarm settings is fundamentally different.

Alarm Settings should only be adjusted if:

an issue cannot reasonably be controlled using operating setpoints, and
the consequences of the change are fully understood.

Changing alarm trigger points, delays, or criticality without proper understanding can cause issues to escalate into serious failures.

Example – Level control and protection of a permeate tank

The permeate tank illustrates how operating setpoints, alarms, and switches work together, but serve different purposes.

Operating setpoints (normal control)

Minimum level to start BW [%]
Ensures sufficient permeate volume is available before BW can start.
Permeate tank level [%]
Defines the normal operating level around which the tank is balanced during filtration and discharge.
Small fluctuations are expected due to PID control and changing operating conditions.

These settings control how the tank is used during normal operation.

Alarm settings (protection layers)

Low level alarm
Intended to trigger before the tank becomes empty, allowing intervention and preventing dry running.
High level alarm
Intended to trigger above normal operating level, warning or stopping the system before overflow risk increases.
High level switch
Acts as a final safety layer and is intended to trigger after the high level alarm if earlier protection does not resolve the situation.

Intended hierarchy (simplified)

In a typical design:

Low level alarm triggers before the tank is empty
Minimum level to start BW is higher than the low level alarm
Permeate tank level is higher than BW minimum level
High level alarm triggers above normal operating level
High level switch triggers after the high level alarm

Each layer has a distinct role:

operating setpoints control behavior
alarms provide early warning or intervention
switches provide last-resort protection

Examples of unintended consequences

Increasing alarm delay on a protection alarm intended to prevent dry running
→ may allow pump damage before the alarm reacts
Changing a high level switch from CRITICAL to WARNING
→ may allow continuous overflow instead of stopping the system
Relaxing alarm thresholds to avoid nuisance alarms
→ may delay operator awareness until damage or shutdown is unavoidable

Key takeaways

Operating setpoints control how the system runs
Alarm settings control how the system protects itself
WARNING alarms are meant to prompt action before escalation
CRITICAL alarms exist to stop the system before serious failure
Alarm settings must be handled with caution and intent