An alarm display should answer where, what triggered it, and what to do first, all at once
Aliases: alarm localization · evidence · and response · diagnostic alarm
What it is
An effective alarm presentation answers three questions at the information level: where in the process the abnormal condition is located, what evidence triggered it, and what should be done first. "Cause" here must mean a verifiable triggering condition or an explicitly uncertain root-cause hypothesis, never a single sensor symptom dressed up as a settled causal conclusion. This leaf is about what three categories of content a message should contain; how sound and light should map onto priority, and how state should change after acknowledgement, belong to the other two leaves in this group.
Why it happens
Location lets the operator map an abstract alarm-list entry back onto a concrete process object; evidence lets the operator verify whether the alarm is genuine rather than simply accepting it; response guidance turns pure information into an action that can be executed immediately. Each solves a distinct cognitive problem, and missing any one produces its own kind of delay: without location, the operator spends time searching for the object; without evidence, causal reasoning is filled in by guesswork; without response guidance, the alarm stalls at "acknowledged but unclear what to do," never advancing to actual treatment.
Where it stops holding
Mobile equipment, purely software-based services, and cross-system cascading failures often have no single, fixed physical location to point to, and a complex incident may genuinely support several unresolved hypotheses at once rather than one answer. In both cases, presentation should shift to showing the affected scope, the current strength of evidence behind each hypothesis, and the concrete steps that would discriminate between them, letting the judgment update as new evidence arrives rather than forcing a single location or cause that does not actually exist yet.
Applying it
Co-locate asset identity, a spatial or topological entry point, the deviation and its timing, the confidence level behind any stated cause, and the first safe action in the same message, with the response guidance explicitly marked for the operating mode and authorization role it applies to — this prevents a correct action from being blindly copied by the wrong person under the wrong condition. Validate with test scenarios that deliberately include a misleading sensor reading or several plausible causes, and check whether operators verify the evidence chain rather than complying blindly with the suggested action.