Control Room Alarm Management and Human Factors in Large Liquefied Natural Gas Facilities: A Comprehensive Review of Rationalization Frameworks, Operator Response, and the Elimination of Standing and Inhibited Alarms

is not current, is direct and is rarely drawn. Continuity across handovers is treated in the same literature as a design property rather than an individual responsibility (C. S. Asiedu & A. A. Asiedu, 2024a), which is the correct framing for the transfer of a standing alarm population between shifts, and comparison of alternatives with different reliability and cost profiles is a further method the process industries have not applied to alarm design (C. S. Asiedu & A. A. Asiedu, 2023a). A fourth observation is emerging as automated detection is introduced into clinical monitoring, that an automated classifier interposed between the measurement and the annunciation shifts rather than removes the threshold problem, since the classifier has its own false positive rate and its own effect on the credibility of the channel (Afrihyia, Akinse, & Ojukwu, 2023; Ilodigwe & Adesemoye, 2025a), and the organisational conditions under which such a change is absorbed rather than resisted are the same conditions identified in Section 4.2 (Ilodigwe & Adesemoye, 2025b). The aviation literature contributes the experimental work on alert reliability discussed above and, additionally, work on inattentional deafness, in which a critical auditory alert is not perceived under high cognitive load (Dehais, Causse, Vachon, Régis, Menant, & Tremblay, 2014). The implication for control room design is that auditory annunciation is not a guaranteed channel under precisely the load conditions in which it matters, which bears on the common assumption that adding an audible tone to a critical alarm secures attention. The aviation safety oversight literature contributes a second and less obvious element. Work on recurrent hazards at aerodromes shows that a hazard which annunciates reliably and is nonetheless not eliminated becomes, over time, a condition the organisation treats as background, and that the corrective mechanism has to be a structured root cause protocol rather than repeated reporting of the same observation (Adeyelu, 2021; Adeyelu & Dagodzo, 2024b). The parallel with a standing alarm accepted informally over successive shifts is close. Work on quantifying hazard risk in order to prioritise finite corrective resource is the counterpart of alarm prioritisation done against consequence rather than convention (Adeyelu, 2020), and the evidentiary framework developed for regulatory enforcement of a persistent physical non-conformance is the counterpart of the inhibited alarm register argued for below (Adeyelu, 2022). 3.11 Alarm Floods and Abnormal Situation Management An alarm flood is conventionally defined by a rate threshold sustained over a period, and its analysis has become a substantial subfield. The engineering work on detection, pattern matching and prediction is reviewed above. What deserves separate treatment is what an operator should be expected to do during one. The abnormal situation management tradition addresses this directly, treating the operator's task during an upset as management of an evolving situation rather than the servicing of a queue (Bullemer et al., 2008). Its practical proposals concern display design, procedural support and the organisation of the console rather than the alarm database alone. The emergency response literature developed for energy and process facilities treats the same transition, from routine monitoring to managed response, as a capability requiring definition, rehearsal and assessment rather than as an escalation that occurs automatically when conditions warrant it (Arumosoye & Obriki, 2023), and the evacuation and preparedness work makes the associated point that a response plan not exercised under representative load is a document rather than a capability (Obriki, Obogo, & Arumosoye, 2022b). Flood suppression by dynamic logic is the engineering response and its limitation is validation. An alternative response, less explored, is to accept that floods will occur and design the operator's support for them explicitly: a display presenting the initiating event rather than the queue, a procedural structure directing attention to the unit rather than the tag, and a division of labour assigning acknowledgement to one role and diagnosis to another. The last is practised informally in many control rooms and specified in almost none. Integrated safety management models developed for operations spanning several interacting zones supply a usable structure for such a specification, since they address precisely the allocation of monitoring and decision roles across a boundary during a disturbance affecting more than one area (Obogo, Ozobu, Sanusi, & Ajirotutu, 2025), and the risk pathway treatments of coordinated operations show how ambiguity in that allocation becomes consequential under time pressure (Arumosoye & Obriki, 2022). The visualisation literature contributes methods for presenting alarm and event data in forms supporting analysis rather than enumeration (Hu, Al-Dabbagh, Chen, & Shah, 2018b). These are analytical tools used after the event rather than operator support used during it, and translating the underlying representations into real-time displays is an obvious and largely unexploited opportunity. The general engineering of real-time monitoring and analytics platforms is well developed in other domains and offers usable patterns for that translation (Basnet, Oghenemaiga, & Anene, 2023), as does the work on performance intelligence systems that present an operational state rather than an event log (Adelanwa, Basnet, & Anene, 2024). 3.12 Display and Interface Design Alarm performance cannot be separated from the interface through which alarms are presented, and the interface literature bears on the problem in ways the alarm-specific standards address only partially. The guidance on control desk and human-computer interface design (Engineering Equipment and Materials Users Association, 2010) and the international standard for control centre ergonomic design (International Organization for Standardization, 2000) establish the physical and organisational requirements. The ecological interface design tradition (Vicente & Rasmussen, 1992; Burns & Hajdukiewicz, 2004) proposes that the display should make the constraints of the work domain visible rather than presenting measured variables, which for an alarm system implies presenting the state of the process relative to its limits rather than annunciating threshold crossings. The practical question of how alarm information is integrated with process displays has received less attention than the alarm list itself. An operator who must consult a separate alarm summary to learn what has annunciated, then navigate to a process display to interpret it, is performing an integration task the interface could perform. The cost is incurred repeatedly and is largest under flood conditions. Comparable integration problems have been addressed in asset monitoring, where the resolution has been to place the indication within a spatial representation of the asset rather than in a separate list requiring the operator to reconstruct the location (Dagodzo & Ahiaeke Patrick, 2021b, 2021a). The principle transfers to a process display: the annunciation should appear where the process is represented. Priority coding deserves specific comment. The standards specify priority distributions and the distributions are widely reported as performance indicators. The evidence that operators use priority as intended is weak, and the psychological literature on urgency in auditory and visual warnings suggests perceived urgency depends on signal characteristics in ways nominal priority assignment does not control. A priority scheme corrects in the database and not perceptible at the console has satisfied the audit and not the operator. The wider literature on cognitive bias in operational and audit judgement supports the caution, since it establishes that the weight actually given to an item of information is determined by its salience and framing rather than by the classification formally attached to it (Fobellah, 2025a). 4. Discussion 4.1 Measurement, Benchmarking and the Gaming Problem The metrics that have become standard, average annunciation rate per operator, peak rate in a ten- minute window, standing alarm count, top ten contributors, priority distribution and inhibited alarm count, are useful and are specified in the standards. Taken alone they are capable of producing a misleading picture in two directions. The design of indicator sets for management reporting is a developed field in its own right, and its central prescription, that an indicator be selected for its relationship to the decision it informs rather than for the ease with which it can be produced, applies without modification here (Edivri & Oteri, 2024). The security field has reached the same position in its move from counting deployed controls to reporting a measured posture (Adegbite, Adebayo, & Ahmed, 2025). The first distortion is the averaging problem already noted. A plant reporting an acceptable average may be experiencing floods during every upset, and the average conceals this precisely because upsets are infrequent. Reporting the distribution rather than the mean, and separately reporting rate during declared abnormal conditions, addresses the problem at the cost of a more complex report. The second distortion is more serious. Every metric in the standard set can be improved without improving the alarm system. Annunciation rate falls when alarms are inhibited. Standing count falls when standing alarms are shelved. Priority distribution can be brought into conformance by reassigning priorities without reconsidering the underlying alarms. Where metrics are reported upward as performance indicators and the reporting carries consequences, the incentive to improve the measure rather than the system is direct and is not hypothetical. The general form of this problem in organisational reward design is long established (Kerr, 1975). The compliance and assurance literature has developed the specific form of it, in which a control regime measured by conformance counts produces conformance counts, and the remedy proposed there is to move the assurance activity from the count to the underlying condition through analytics applied to the operational record (Akomolafe, Agu, & Bello, 2025; Akomolafe, Agu, & Bello, 2023a). The same difficulty is well documented for cross-border compliance frameworks in which the measure is common and the practice underlying it is not (Agu, Akomolafe, & Bello, 2023a). The countermeasure is paired reporting: inhibited count alongside annunciation rate, shelved count alongside standing count, so that improvement in one obtained at the cost of the other is visible on the face of the report. This is a small change in reporting practice and it is the single most useful measurement recommendation this review can offer. Where the historian supports it, the paired measures can be extended into a forecast of the population under management rather than a description of its current state, which is the direction taken in comparable risk reporting work (Agu, Akomolafe, & Bello, 2025), and the data integration required to support such reporting is itself the usual obstacle (Agu, Akomolafe, & Bello, 2023b). Process safety indicator practice supplies the wider framing. Guidance on leading and lagging indicators requires that indicators be selected for their relationship to the outcome rather than for availability (American Petroleum Institute, 2016; Health and Safety Executive, 2006). Alarm metrics are leading indicators of a protective layer's condition and should be selected on that basis, which favours measures of the alarm system's credibility to operators over measures of its statistical behaviour. The governance literature on integrated compliance and resilience reporting reaches a similar conclusion about the composition of an indicator set, holding that a set consisting only of outcome counts provides no basis for intervention before the outcome occurs (Akomolafe & Agu, 2019c), and the procurement and contractor risk literature extends the point to indicators that span organisational boundaries, which is the position of any alarm metric reported by a contractor-operated facility (Bello, Akomolafe, & Agu, 2023). 4.2 Governance, Management of Change and Audit The technical remedies for alarm degradation have been available for two decades and are not seriously disputed. The persistence of the problem is therefore an organisational fact, and the review would be incomplete without addressing it. Three organisational conditions recur in accounts of programmes that succeeded. The first is a written alarm philosophy with an identified owner, without which there is no basis on which a proposed deletion can be adjudicated and every rationalization decision becomes a negotiation. The second is management of change discipline applied to alarm configuration, since a rationalized database degrades at a rate determined by the number of unreviewed additions, and plants that rationalize without controlling addition return to their starting condition within a few years. The third is participation of experienced operators in the rationalization itself. A fourth condition, less often stated, is that the alarm programme be positioned within the management system that already carries operational discipline rather than established alongside it, since a parallel programme competes for the same attention and loses (Obogo, Arumosoye, & Obriki, 2024; Arumosoye, Obriki, & Ozobu, 2025). The counterpart observation is that alarm management is characteristically owned by a function without authority to enforce it. Where the control systems group owns the database and the operations group owns the consequence of its behaviour, neither has both the information and the authority required, and the programme depends on a cooperation with no structural support. Locating ownership with an operational role carrying both is the ordinary remedy, and the shift supervisor is often the only role that sees the alarm system as the operator experiences it while also possessing standing in the engineering process. The general problem, that accountability for an outcome and authority over the mechanism producing it sit in different functions, is treated directly in the literature on governance alignment across operator boundaries, and the remedy proposed there is an explicit allocation agreed in advance rather than a cooperation assumed (Eyetsemitan, Ambali, Oyeleye, & Fadayomi, 2020). Sustainability depends on monitoring that continues after the campaign ends. The lifecycle formulation in ISA-18.2 makes monitoring and assessment a permanent stage rather than a project closeout activity, and the distinction between a rationalization project and an alarm management programme lies principally in whether that stage is resourced after the project team disbands. The change adoption literature identifies the same discontinuity and locates the failure in the transition rather than in either state, on the reasoning that the implementing team holds knowledge which the receiving organisation has no mechanism to absorb (Eyetsemitan, Ambali, Oyeleye, & Fadayomi, 2023a), and the work on sustaining performance in high-demand technology programmes describes the ongoing arrangements that transition requires (Oteri & Edivri, 2024). The procedural literature supplies a caution applying to alarm philosophy documents as much as to operating procedures. Where the documented requirement exceeds what available time permits, compliance will be formal and adaptation substantive, and the adaptation will not appear in the compliance record (Hale & Borys, 2013; Dekker, 2003). An alarm philosophy specifying a review frequency the organisation will not resource has created a documented non-compliance rather than a control. The compliance workflow literature makes the same argument from the design side, holding that a requirement must be translated into a workflow with an owner and a defined periodicity before it can be said to exist operationally (Eyetsemitan, Ambali, Oyeleye, & Fadayomi, 2021), and the work on the unintended consequences of accumulating compliance obligation describes what happens when it is not (Fobellah, 2025c). 4.3 The Liquefaction Context Several features of large liquefaction facilities qualify the general guidance, and none has received substantial published treatment. The first is multi-train configuration with shared systems. A facility operating several trains from common utilities, a common feed supply and a common flare header will propagate a disturbance in one train into the alarm space of the others, and the design must distinguish the train in which a disturbance originated from those merely responding. The cascade analysis literature is directly applicable and has been developed predominantly on single unit data. The control architecture question this raises, whether monitoring and decision authority for a shared system should be centralised, distributed to the trains, or organised hierarchically, has been examined systematically in energy systems with comparable coupling, and no architecture dominates across operating conditions (Komi & Adamolekun, 2022). The associated proposal to place detection logic close to the source and to escalate only a summarised state is directly transferable to a shared flare header (Komi & Ganiu, 2023). The second is thermal inertia. Liquefaction trains have long time constants and a cool down or warm up transient extends over many hours. Thresholds appropriate to steady state are inapplicable across such a transient, and the choice is between state based configuration, which requires operating state to be declared reliably, and operator inhibition, which reintroduces the inhibition governance problem. State based alarming is correct in principle and requires state declaration infrastructure many plants do not possess. Tiered digital twin approaches offer one route to that infrastructure, in that a model maintained at a level of fidelity the site can sustain can supply an inferred operating state where an explicitly declared one is unavailable (Komi & Adeniji, 2023), and the interpretable failure prediction literature indicates the constraint such an inference must satisfy, namely that the operator be able to see why the state was inferred before acting on annunciation conditioned upon it (Komi & Adamolekun, 2021). The third is the character of the hazard. Cryogenic inventory released to atmosphere behaves differently from an ambient temperature hydrocarbon release, with implications for the detection layer and for time available to the operator. Response time assumptions embedded in crediting operator action as a protection layer should be examined specifically against liquefaction release scenarios rather than inherited from refining practice. The process context is set out in the standard technical treatments (Mokhatab, Mak, Valappil, & Wood, 2014; Lim, Choi, & Moon, 2013; Kidnay, Parrish, & McCartney, 2011), and sector reviews address the safety technologies deployed (Ozowe, Ukato, Jambol, & Daramola, 2024). Recent work on environmental risk control and reporting performance in process operations is the closest adjacent treatment of the sector context assumed here (Arumosoye, Obriki, & Ozobu, 2025), and the conceptual modelling of data-driven safety risk control in large-scale energy infrastructure supplies the method (Obriki & Arumosoye, 2018). The fourth concerns the flare system. Where the flare header is common and flaring carries both a direct hydrocarbon loss and a reported emissions consequence, the alarm system interacts with the operator's incentive structure. Alarms whose response involves routing material to flare will be handled differently from alarms whose response does not, and the alarm philosophy should