How to Design an RECD Alarm Response Matrix for Operators

An alarm is only useful if the person who sees it knows what to do. On many sites, the Retrofit Emission Control Device controller is configured with the supplier’s default alarms and connected to the Building Management System. Then nobody writes down what each alarm means or how to respond. The first time “RECD HIGH DP” appears at 2 a.m. during a grid outage, the night-shift operator has to guess. Should the generator keep running? Call someone? Ignore it until morning?

An alarm response matrix removes the guesswork. It’s a single table that tells operators, for every RECD alarm, how urgent it is, what probably caused it, what to do first, how quickly, who to call, and whether the DG set can keep running.

This guide shows how to design one step by step, with a complete example matrix you can adapt.

Why RECD Alarms Need Special Thought

A DG set usually runs when something else has gone wrong, most often a grid failure. During those times, power continuity often matters more than anything else. An RECD alarm therefore raises a real dilemma: protect the engine and emission control, or keep critical loads supplied?

The matrix answers that dilemma in advance, calmly, with input from the RECD supplier, the DG maintainer and the site’s operations lead, instead of leaving it to an operator under pressure.

There’s a second reason. Poorly designed alarm systems produce alarm floods and nuisance alarms. Operators learn to acknowledge without reading. Established alarm management practice, such as the principles in ANSI/ISA-18.2 for alarm systems, holds that every alarm should require an operator action, have a defined priority and be reviewed over time. A small RECD alarm set is a good place to apply those principles properly.

Step 1: List Every Alarm the System Can Raise

Start with the facts. From the RECD controller manual, the register map and the BMS configuration, list every alarm and event that can appear. For a device with a controller and active regeneration, the list might include:

• High differential pressure (ΔP), warning level
• High ΔP, critical level
• Low ΔP (possible crack or bypass)
• High engine back-pressure
• High RECD outlet temperature
• Regeneration failed or incomplete
• Regeneration overdue
• Heater fault (if fitted)
• Sensor fault (open circuit, out of range)
• Controller fault or controller power loss
• Communication failure between controller and BMS

A simpler, passive RECD may only have a ΔP or back-pressure switch. That’s fine. The matrix is simply shorter.

Step 2: Decide Whether Each Alarm Deserves to Be an Alarm

For each item, ask: Does this require an operator to do something?

• If yes, it’s an alarm and goes in the matrix.
• If no, it should be an event (logged but not announced), or removed.

For example, “regeneration started” and “regeneration completed” are normal events. Logging them is valuable for diagnosis, but announcing them as alarms creates noise. “Regeneration failed” does need action, so it stays an alarm.

Step 3: Assign Priorities

Use a small number of priorities, consistent with the rest of your BMS. Three or four levels are usually enough.

Priority	Meaning	Typical response time
P1 – Critical	Risk to the engine, equipment or safety; immediate action needed	Immediately (minutes)
P2 – High	Problem that will become critical if ignored	Within the shift (hours)
P3 – Low	Maintenance needed; no immediate risk	Within days (work order)
System	Monitoring itself is impaired	Within the shift

Priority should reflect consequence and urgency, not how alarming the wording sounds. A “high temperature” alarm isn’t automatically P1. It depends on what the temperature means for this device.

Step 4: Work Out Probable Causes and Diagnostic Checks

For each alarm, list the two or three most likely causes, with a quick check that helps the operator distinguish between them. Get these from the RECD supplier and from your own site experience. For background on what ΔP and temperatures mean, see RECD testing during regeneration and can RECD efficiency change between new and aged conditions.

Step 5: Define First Actions an Operator Can Actually Do

First actions must be:

• Safe: no climbing onto hot exhaust, no opening the device
• Within the operator’s competence and authority
• Specific: “check load on BMS and note kW” rather than “investigate”
• Short: three to five steps at most

Anything beyond that belongs in the escalation step.

Step 6: Decide the Run/Stop Guidance

This is the hardest and most important column. For each alarm, state clearly whether the DG set may continue running, and under what conditions. Typical categories:

• Continue running; monitor. The alarm doesn’t threaten the engine or device in the short term.
• Continue running if supplying critical load; plan shutdown when load can be transferred. There’s a growing risk, but power continuity takes priority for now.
• Reduce load if possible. Lower load reduces back-pressure and exhaust flow.
• Stop when safe, and notify. Continued running risks damage, and the risk outweighs power needs except in defined emergencies.

Agree these with the DG maintainer and the engine maker’s guidance, especially for back-pressure limits. See how exhaust back-pressure affects a DG set. For critical sites, involve the people responsible for critical loads. See RECDs for hospitals and RECDs for data centres.

Step 7: Define Escalation

For each alarm, state who to call, by role, with names and numbers in a separate contact sheet that is kept up to date:

• Shift engineer or facility manager
• DG maintenance contractor or in-house technician
• RECD supplier service line (see RECD service response commitments)
• BMS contractor (for communication and system alarms)
• EHS lead (for anything with compliance implications)

Include a time limit: “If not resolved within X hours, escalate to Y.”

An Example RECD Alarm Response Matrix

The example below is illustrative. Thresholds, actions and run/stop guidance must be set for your specific device, engine and site, with your RECD supplier and DG maintainer.

Alarm	Priority	Likely causes	Operator first actions	Respond within	Run/stop guidance	Escalate to
High ΔP – warning	P3	Normal soot build-up; ash approaching cleaning interval; long light-load running	Note kW load and ΔP; check if regeneration is pending or running; log in shift report	Next working day	Continue running	Maintenance planner (work order); RECD supplier if repeated within a week
High ΔP – critical	P2	Regeneration not completing; heavy soot from engine problem; ash overdue for cleaning	Note load, ΔP, outlet temperature; check regeneration status; check for black smoke; reduce load if possible	Within 2 hours	Continue running for critical load; plan controlled shutdown and inspection when load can be transferred	Shift engineer; RECD supplier service
Low ΔP (unexpected)	P2	Cracked substrate; failed seal or gasket; bypass; sensor fault	Note load and ΔP; compare with reference at same load; look for visible smoke at stack; check for exhaust leaks or noise near RECD (from a safe distance)	Within shift	Continue running if needed; arrange inspection at next stop	RECD supplier; EHS lead (filtration may be compromised)
High engine back-pressure	P1	Blocked RECD; collapsed silencer; damaged pipework; excessive soot load	Note back-pressure and kW; reduce load if possible; check ΔP and outlet temperature	Immediately	Reduce load; stop when safe if back-pressure stays above engine maker’s limit, except in defined emergencies	Shift engineer immediately; DG maintainer; RECD supplier
High RECD outlet temperature	P1	Uncontrolled soot burn; heater stuck on; abnormal combustion	Do not approach the device; check controller for regeneration or heater status; check for fire or smoke in DG room	Immediately	Reduce load; stop if temperature keeps rising; follow site fire procedure if needed	Shift engineer immediately; RECD supplier; fire/safety team if required
Regeneration failed	P2	Exhaust too cool (light load); heater fault; controller fault	Note load and temperatures; if site procedure allows, increase load (e.g. via load bank) to support passive regeneration	Within shift	Continue running; monitor ΔP	RECD supplier if repeated
Regeneration overdue	P3	Long periods of light-load running	Log; plan a higher-load run or supplier-guided regeneration	Within days	Continue running	Maintenance planner
Heater fault	P2	Heater element failure; supply tripped; wiring fault	Check heater supply breaker status (do not reset repeatedly); note controller message	Within shift	Continue running; avoid long light-load operation	Electrician; RECD supplier
Sensor fault	P2	Disconnected or damaged sensor; cable heat damage	Note which sensor; check if values are frozen or out of range	Within shift	Continue running; treat related readings as unavailable	DG maintainer; RECD supplier
Controller fault / power loss	System	Supply failure; controller hardware fault	Check controller display and supply status; check whether hardwired common alarm is active	Within shift	Continue running; RECD filtration continues, but monitoring and regeneration control may be lost	Electrician; RECD supplier
Communication failure (BMS)	System	Cable fault; gateway fault; BMS configuration	Check local controller display to confirm RECD status; log local readings manually	Within shift	Continue running	BMS contractor

Walking Through One Alarm: A Night-Shift Example

The scenario is illustrative. It’s 01:40 during a grid outage. DG2 has been supplying a commercial building for three hours at about 55% load. The BMS raises “DG2 RECD HIGH DP – CRITICAL” (P2).

The operator opens the alarm, and the BMS help text shows the matrix row. Following it:

1. Note load, ΔP and outlet temperature. Load is 112 kW. ΔP is 82 mbar against a reference of 46 mbar at similar load. Outlet temperature is normal.
2. Check regeneration status. The controller shows “regeneration requested, not started” for the past 40 minutes.
3. Check for black smoke from the CCTV camera covering the stack. None visible.
4. Reduce load if possible. The building’s non-essential chillers are already shed, so no further reduction is possible.
5. Run/stop guidance says to continue running for critical load and plan a controlled shutdown and inspection when load can be transferred.
6. Escalate. The operator calls the shift engineer, who logs a service request with the RECD supplier.

At 04:15 the grid returns. The DG cools down and stops. In the morning, the supplier’s technician finds that the heater supply breaker had tripped, so active regeneration couldn’t start. The breaker is reset after checks, and a supervised regeneration brings ΔP back to normal.

Because the matrix existed, the operator didn’t shut down the DG unnecessarily during a critical outage, and didn’t ignore the alarm either. The heater supply problem was found within hours. It also prompted a review of RECD monitoring during a power failure, since the heater should be on a supply that stays live while the DG runs.

Writing Alarm Text That Operators Understand

The words on the alarm screen matter. Good alarm text:

• Names the equipment clearly: “DG2 RECD”, not a controller tag like “C2-AI-03”
• States the condition simply: “High differential pressure – critical”
• Avoids jargon and abbreviations that night-shift staff may not know
• Points to the response: “See matrix row 2”, or a linked help page
• Is consistent across all DG sets and RECDs on the site

Avoid vague alarm texts like “RECD FAULT” where a more specific message is available. A specific message saves diagnosis time.

Making the Matrix Usable at 2 a.m.

A matrix in a project file helps nobody during an outage. Make it practical:

• Post a laminated copy in the DG room and the BMS control room.
• Link each alarm on the BMS to its matrix row, through alarm help text or a linked document, so the operator sees the first actions on screen.
• Use plain language. “Do not approach the device” is clearer than “Maintain safe exclusion zone.”
• Keep a separate contact sheet with current names and phone numbers, reviewed monthly.
• Show reference values from the acceptance test, for example normal ΔP at 50% load, so operators can judge readings. See why RECD test results may differ from day-to-day site readings.

Setting Alarm Thresholds Sensibly

Thresholds should come from:

• Device design limits from the RECD supplier (maximum ΔP, maximum outlet temperature)
• Engine limits from the DG maker (maximum exhaust back-pressure)
• Acceptance-test reference values, so warnings sit at a meaningful distance above normal
• Site experience, refined after a few months of trends

Some practical points:

• Make thresholds load-aware where possible. ΔP and back-pressure rise with exhaust flow. A fixed high-ΔP alarm set for full load may never trigger at light load, while one set for light load may trigger falsely at full load. Some controllers support load-dependent limits. If yours doesn’t, choose limits carefully and use trends.
• Use delays (time-on filters) to avoid alarms on brief spikes, for example requiring a condition to persist for 60 seconds.
• Use deadbands (hysteresis) so an alarm doesn’t chatter on and off when a value hovers near the limit.
• Suppress alarms that only make sense when the DG is running. A ΔP alarm when the engine is stopped is noise.

Testing the Matrix: Alarm Drills

At handover, and then periodically, run drills:

1. Simulate or force each alarm where the controller allows, and confirm it appears correctly on the BMS with the right priority and help text.
2. Ask an operator to talk through the response using the matrix: what they would check, who they would call, and whether the DG would keep running.
3. Time the escalation: do the phone numbers work, and do people answer?
4. Record the drill and any changes needed.

Drills work well alongside other DG tests, such as monthly load runs. See the monthly maintenance checklist for diesel generators.

Reviewing and Improving Over Time

An alarm system should get better with use. Review RECD alarms at least every quarter:

• Which alarms occurred, and how often? Frequent alarms may mean a real problem, or a poorly set threshold.
• Were any alarms ignored or shelved? Find out why.
• Did any problem occur without an alarm? If so, a new alarm or a lower threshold may be needed.
• Did operators follow the matrix? Were the first actions practical?
• Were run/stop decisions appropriate?

Update the matrix after each review, record what changed, and retrain operators on the changes.

Shelving and Suppression: Use With Care

Sometimes an alarm needs to be temporarily silenced, for example during maintenance or while a known fault awaits parts. Allow this only:

• With a reason recorded
• For a limited time, with automatic reinstatement
• With approval from the shift engineer
• With the shelved alarm still visible in a shelved list

Never permanently disable an RECD alarm to stop nuisance alarms. Fix the threshold or the underlying cause instead.

Linking Alarms to Compliance

Some RECD alarms have compliance implications as well as technical ones. A low ΔP from a cracked substrate means the device may not be filtering as required. Long periods without functioning monitoring may raise questions during a Pollution Control Board inspection.

Include the EHS lead in escalation for these alarms, and keep alarm logs and responses with your compliance records. A clear record of alarms raised, actions taken and repairs made is good evidence that the device is actively managed.

Related Reading

• Integrating RECD monitoring with a building management system
• RECD Modbus data: units, scaling and register mapping explained
• Does an RECD need internet access to operate?
• RECD monitoring during a power failure: what should stay available?
• RECD maintenance guide

Frequently Asked Questions

Should an RECD alarm automatically shut down the DG set?

Usually not, except where an engine protection limit is involved and the engine maker requires it. For most RECD alarms, an automatic shutdown during a grid outage could cut power to critical loads. It’s generally better to alarm, guide the operator and leave the run/stop decision to defined procedures. Agree this with your DG maintainer and RECD supplier.

How many RECD alarms should there be?

As few as possible while still covering every condition that needs action. For many devices, eight to twelve alarms, including system alarms, are enough. More than that often means some should be events instead.

Does a simple passive RECD need an alarm matrix?

Yes, though it will be short. Even a passive device with only a differential pressure or back-pressure switch needs a clear instruction for what to do when that switch operates, and whether the DG may keep running.

Who owns the alarm response matrix?

The site’s operations or facility manager should own it, with technical input from the RECD supplier and DG maintainer. Ownership means keeping it current, reviewing alarm performance and approving changes.

Can operators reset RECD alarms themselves?

They can usually acknowledge alarms. Resetting a condition, such as restarting a failed regeneration or resetting a heater trip, should follow the supplier’s instructions, and repeated resets should trigger escalation, not more resets.

What should happen if the BMS link fails during a DG run?

The matrix should direct operators to the local RECD display and the hardwired common alarm, and to record readings manually until the link is restored. That’s why a hardwired alarm and a local display remain important even with a BMS connection.

Make Every RECD Alarm Mean Something

A short, well-designed alarm matrix turns an RECD controller from a source of confusing messages into a practical operating tool. Aceget supplies CPCB type-approved Retrofit Emission Control Devices for DG sets from 25 kVA to 2500 kVA. We can help you set thresholds and response guidance that fit your device, engine and site. See our certifications, read about DG set emission regulations, or contact our team.