Alarm Fatigue: How Buildings Normalize Their Own Decline

There is a screen in almost every plant room that nobody looks at anymore. The BMS alarm page: 2,000 unacknowledged entries, red stacked on red, some years old. Chiller 2 throws its fault again and the technician waves a hand: "It always does that." Meanwhile the chilled-water delta-T, 5.5°C at commissioning, sits at 3°C today. It slid there over three years, in increments too small for any month to look different from the last. Nobody was negligent. Everybody was accustomed.

That distinction, negligent versus accustomed, has a name, and it comes from one of the worst mornings in American spaceflight. Alarm fatigue is the plant-room mechanism; the deeper pattern was mapped at Cape Canaveral.

The sociologist who read NASA's paperwork

When the sociologist Diane Vaughan published The Challenger Launch Decision in 1996, the accepted story was managerial recklessness. Vaughan went into the archive and found something more unsettling. O-ring erosion had been observed since 1981, five years before the disaster. Each time a shuttle came back safely, the anomaly was reviewed, documented, and reclassified as an acceptable risk. Each accepted anomaly became the new baseline for judging the next. By January 1986, flying with a known flaw was not a violation of the rules. It was the rules.

She called it the normalization of deviance, defined plainly in a 2008 interview: "people within the organization become so much accustomed to a deviant behavior that they don't consider it as deviant, despite the fact that they far exceed their own rules for the elementary safety."

The frightening part of Vaughan's account is that nobody broke procedure. Engineers followed the review process; managers followed the decision rules. Her conclusion: "What is important to remember from this case is not that individuals in organizations make mistakes, but that mistakes themselves are socially organized and systematically produced." She rejected the bad-apples reading entirely. Which is exactly what makes the 2,000 unacknowledged alarms worth taking seriously. Nobody in that plant room is lazy either.

Why do operators stop believing alarms?

Because the alarms taught them to. On 24 July 1994, an explosion at the Texaco refinery in Milford Haven injured 26 people. The HSE investigation found that in the 11 minutes before the blast, two control-room operators faced 275 alarms, one every two to three seconds, poorly prioritised, on displays that did not explain what was happening. No human can triage that. The industry's answer was EEMUA Publication 191, now the global benchmark for alarm management, with a steady-state target of roughly one alarm per ten minutes per operator. About six an hour. Count what your BMS produces in an hour and sit with that number.

Healthcare measured the psychology directly. The US Joint Commission's Sentinel Event Alert on alarm safety (2013) reported that 85 to 99 percent of clinical alarm signals require no intervention, and counted 98 alarm-related events over three and a half years, 80 fatal. A UCSF study logged 2.5 million alarms across five ICUs in one month; of over a million arrhythmia alarms, almost 89 percent were false. Those are clinical monitors, not BMS panels, so the figures transfer directionally, not literally. But the mechanism transfers exactly: alarm fatigue is not laziness. It is a rational adaptation to a system that cries wolf hundreds of times a day. Ignoring the alarm page is, statistically, almost always the correct call. Almost.

Buildings don't explode. They drift.

Here the metaphor needs honest handling, because a chiller plant is not a launch pad. Challenger killed seven people; a drifting delta-T mostly wastes kilowatt-hours and shortens equipment life. Buildings usually decay economically, not catastrophically, and borrowing disaster vocabulary without saying so would be fear-mongering.

But the shape of the failure is the same, and the plant-room version has its own literature. Steven Taylor's ASHRAE paper on degrading chilled-water delta-T (2002) documented low delta-T syndrome: fouled coils, oversized valves and setpoint drift pull return temperatures toward supply, forcing pumps and chillers to move ever more water for the same cooling. Taylor's point: some degradation is unavoidable, so it must be monitored, because it will not announce itself. A fixed threshold never fires on a slope. If the alarm is set at 2.8°C, the slide from 5.5 to 3 is three years of silence, every "normal" quietly worse than last year's. We've written about what delta-T does to kW/RT; the penalty compounds.

And the tune-out is documented in buildings too. A Siemens survey of facility managers found that while two-thirds received alerts from their BMS, only one-third reacted to them. In Malaysia the drift now carries a line item: under RP4, capacity and network charges are billed on every kW of your monthly peak, so a demand creep everyone has normalized is not an abstraction. It is a recurring invoice.

How do you fix alarm fatigue in a building?

Not with more alarms. Three things, in order.

Rationalize what exists. EEMUA 191 and ISA-18.2 converge on one test: every configured alarm must demand a defined operator response. If nobody can say what a human should do when it fires, it is noise, actively training your team to ignore the real ones. Most BMS alarm lists fail this test because alarms were enabled wholesale at commissioning and never reviewed.

Compute the baseline instead of remembering it. Normalization of deviance works because the reference point moves with the deviance. The countermeasure is a baseline that cannot drift silently: anomaly detection against the building's own history, rather than a static threshold someone set in 2019. This is the layer where we've placed CobiNeural, as an overlay on the existing BMS or SCADA rather than another alarm source: Insights→Energy tracks delta-T, EUI and maximum demand against modelled expectation; Insights→Equipment watches motor condition the same way. At sites like Mosca Malaysia, Kah Hwa Industries and PWO Industries, "what this plant should be doing" is a computed number, not a veteran technician's recollection.

Route the survivors somewhere humans actually look. The few alarms that survive rationalization should arrive where they will be read, which for a Malaysian FM team means WhatsApp, not row 2,001 of a wall of red. A channel that carries six messages a week gets believed. One that carries six hundred gets muted.

Where the metaphor ends

Two concessions, because these essays are only useful if they are honest. First, Vaughan's concept and alarm fatigue are not the same thing. Hers is a sociological account of how production pressure, hierarchy and culture make rule-bending look rational; alarm fatigue is a human-factors phenomenon, desensitization to signal floods. In a plant room they compound: the flood numbs the operators, and the numbness becomes the culture. Fatigue is the mechanism by which deviance gets normalized, not a synonym for it.

Second, tooling is not culture. Vaughan's conclusion was that structure and incentives produce mistakes systematically. Software can narrow the flood, hold the baseline still, and put the one alarm that matters in front of the one person who can act. It cannot make management fund the fix, or stop a production schedule from overruling a believed alarm. That was true at NASA and it is true in your plant room.

The goal is not more vigilance; vigilance against 2,000 reds is a wish, not a plan. The goal is fewer alarms that are believed. The day an alert from your building is once again news, something a person stops and reads, the building has stopped normalizing its own decline.