HMI Alarm-Flood Triage Lab
The screen lights up. Dozens of alarms in a minute — and only a few of them are the real developing upset. The rest are chattering transmitters, nuisance advisories, scheduled tests and decoy high-priority alarms injected to pull your eye away from the manipulation running underneath. Triage against the clock: act on what matters, dismiss the noise, and name the root cause. This is the EEMUA-191 / ISA-18.2 skill that keeps a flood from hiding an attack.
The real job. More noise, a tighter clock.
Incident
Treated-water chlorine is drifting high. Somewhere in the flood is a cyber-physical manipulation of the dosing system — and a lot of noise over the top of it.
Alarm summary (ACT on what matters, DISMISS the noise)
0 actedalarms flooding in…
Alarm rate
14 / 10 minEEMUA-191 calls more than 10 alarms in the 10 minutes after an upset a flood. A flood is where the real alarm hides.
Triage so far
0/4 real alarms acted · 0 noise chased. Name the root cause to submit.
Priority legend
HIGH · MED · LOW — but priority is not the same as importance. A decoy can be HIGH; the real attack indicator can be LOW.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based OT lab: an operator HMI floods with alarms during an incident and you triage them against the clock.
- Only a few alarms are the real developing upset / attack indicators (the root-cause chain); the rest are chattering, nuisance, standing or decoy alarms injected to hide it.
- ACT on what matters, DISMISS the noise, then name the initiating root cause — the EEMUA-191 / ISA-18.2 alarm-management discipline.
- The most important alarm is often MED or LOW priority, and attackers raise the alarm rate on purpose so a flooded operator chases the loud, harmless ones.
- Scored on true positives found vs. noise chased plus the correct root cause, with difficulty tiers that escalate the flood rate and subtlety, a speed bonus and an S–D grade.
Frequently asked questions
What is the HMI Alarm-Flood Triage Lab?
A free, in-browser exercise that recreates an alarm flood on an operator HMI during a process incident. A stream of alarms arrives with priority, tag, timestamp and text. A small number are the genuine developing upset — the root-cause chain — and the rest are chattering, nuisance, standing or decoy alarms. Under a timer you acknowledge (ACT on) the alarms that matter, dismiss the noise, and name the initiating root cause. You are scored on the real alarms you catch versus the noise you chase, plus getting the root cause right.
What is an alarm flood and why does it matter?
An alarm flood is more alarms arriving than an operator can process. EEMUA-191 and ANSI/ISA-18.2 define a flood as roughly more than 10 alarms in 10 minutes per operator (steady-state should be far lower). During a flood the one alarm that reveals the real problem is buried among dozens that do not need action, so the operator loses situational awareness exactly when it is most needed. Several major industrial incidents have alarm floods in their causal chain.
How do attackers use alarm floods?
A flood is cover. An adversary who has access to the control system can deliberately raise the alarm rate — spoofing nuisance and decoy alarms, including high-priority ones like fire-panel tests or network faults — so the operator spends their attention on loud, harmless alarms while the real manipulation runs underneath. The genuine attack indicator is often a quiet MED or LOW alarm. Alarm rationalisation — removing nuisance, standing and chattering alarms from the operator view — is both a safety practice and a security control.
What are EEMUA-191 and ISA-18.2?
They are the two leading alarm-management standards. EEMUA-191 (Engineering Equipment and Materials Users Association) and ANSI/ISA-18.2 describe the alarm lifecycle — rationalisation, prioritisation, shelving, flood suppression and performance metrics — so that every alarm presented to an operator is relevant, actionable and prioritised. This lab is a simplified teaching model of that discipline; the scenarios and alarms are invented.