Water alarms: who gets woken, and what happens if they do not answer
TL;DR. A water alarm that reaches a shared inbox at 3am has not alarmed anybody. Alarm handling has been studied properly in process safety, and the findings are blunt: EEMUA 191 records that more than one alarm a minute is very likely to be unacceptable, and that above a hundred alarms per operator people abandon the system altogether. The design problem is not detection. It is who is woken, in what order, and what happens if nobody answers.
Key takeaways
- EEMUA 191 records that fewer than one alarm per ten minutes in steady state is very likely to be acceptable.
- One per five minutes is considered manageable, one per two minutes likely to be over-demanding, and more than one per minute very likely to be unacceptable.
- In the first ten minutes after a major upset, under ten alarms per operator should be manageable.
- Twenty to a hundred alarms per operator is hard to cope with, and more than a hundred is very likely to lead to the operator abandoning the use of the system.
- An alarm with no named recipient and no timeout is a notification, not an alarm.
- Escalation is the part that decides whether a 3am detection becomes a 3am response.
Table of Contents
On this page
Last updated: 2 September 2026
What is the difference between a water alarm and a notification?
Ownership and a deadline. That is the whole of it. A notification is sent. A water alarm is assigned to a named person, with a defined time to acknowledge, and a defined thing that happens if they do not. Most systems sold as a water alarm are, on that definition, a notification with a red icon.
The water alarm distinction is not pedantic. It is the difference between a leak found at 03:14 and a leak found at 08:40, and on a building with a plant room above occupied space those five and a half hours are the whole loss.
How many alarms can one person actually handle?
Far fewer than most systems generate, and a water alarm is not exempt from the arithmetic. Process safety has measured this properly, and the figures are worth borrowing even though water monitoring is a gentler business than a chemical plant. EEMUA Publication 191, third edition, sets out benchmarks based on an inquiry at many control rooms.
In steady state, an average of less than one alarm per ten minutes was very likely to be acceptable, one per five minutes was considered manageable, one per two minutes likely to be over-demanding, and more than one per minute very likely to be unacceptable. Those thresholds are quoted from page 96 of the third edition in a technical paper on alarm system performance KPIs.
The upset figures matter more for a water alarm, because a burst is an upset. The same publication records that in the first ten minutes following a major plant upset, under ten alarms per operator should be manageable, twenty to a hundred is hard to cope with, and more than a hundred alarms per operator is excessive and very likely to lead to the operator abandoning the use of the system.
Abandoning the use of the system is the phrase to sit with. It is not that people miss an alarm when there are too many. It is that they stop treating the channel as meaningful at all, which is precisely what has happened on every site where the facilities inbox has a rule filing sensor emails into a folder.
What does a water alarm escalation chain look like?
A water alarm chain has four elements, and most deployments have one or two. A threshold that fires, a named first recipient, a timeout, and a defined next step. Miss any of them and the chain does not hold.
- Detection with a threshold that reflects the asset, not a factory default, so the alarm means something specific.
- A named first recipient by role and shift, not a distribution list, because a list is nobody. Naming an individual is the same instinct that runs through UK safety regimes, from the responsible person in the Regulatory Reform (Fire Safety) Order 2005 onwards.
- An acknowledgement window, after which the alarm escalates rather than waits.
- A second and third recipient, and a route out of hours that is different from the route in hours.
- Where the risk justifies it, an automatic action that does not depend on a person at all.
Point five is where a water alarm differs from most alarm domains. In many systems the only possible response is human. In water, closing a valve is a legitimate automatic action, which means the chain can have a floor beneath it that does not depend on anyone being awake.
How does AQUAIOT handle alerting?
Through multi-channel alerts and role-based routing rather than a single water alarm notification type. The Multifunction Water Leak Sensor detects via a Leak Sensing Membrane that triggers the moment water makes contact, runs on LoRaWAN Class A with battery life up to 10 years, and pairs with AQUAIOT gateways and the AQUAIOT Cloud for alerts by email, SMS and voice.
Voice is the underrated water alarm channel. Email and SMS both arrive silently on a phone that is face down on a bedside table. A voice call is the only common channel that reliably wakes somebody, which makes it the right final rung on an out-of-hours chain rather than the first rung on every alert.
On the flow side, the Clamp-on Ultrasonic Flow Meter gives the continuous signal that lets you alarm on a rising overnight baseline rather than only on catastrophic events. AQUAIOT’s leak detection service covers escalation rules, role-based routing and, in higher-risk configurations, automatic shut-off before damage spreads.
Frequently asked questions
How many water alarm alerts is too many?
EEMUA 191 puts steady-state acceptability at fewer than one alarm per ten minutes per operator, with one per two minutes likely to be over-demanding and more than one per minute very likely to be unacceptable. Water monitoring rarely approaches those rates, which means a site generating enough alerts to be ignored has a threshold problem rather than a volume problem.
Should every water alarm go to everybody?
No, and it is the most common design error. Sending to a group means no individual is accountable for acknowledging, and the predictable result is that each recipient assumes another has picked it up. A named first recipient by role, with escalation on a timeout, produces a response. A distribution list produces a record that everyone was told.
Is automatic shut-off always the right answer?
Not always, and it should be a deliberate decision per zone rather than a global setting. Isolating a supply has consequences of its own, including to fire systems, process equipment and anything that must not run dry. It suits high-risk zones where the cost of a false isolation is clearly lower than the cost of an unattended escape.
What should happen if nobody acknowledges?
Something, automatically, and that is the whole test of a water alarm escalation design. If the honest answer is that the alert sits unread until morning, the chain has one link. A working chain moves to a second named recipient, then to a different channel, then either to a duty holder or to an automatic action, each on its own timeout.
The test worth running
Take your current water alarm configuration and answer three questions on paper. Who is the named person for this alarm at 3am on a Sunday. How long do they have before it goes somewhere else. Where does it go. If any answer is a shrug or a mailbox name, the detection is fine and the water alarm is not.
Water safety regimes already work this way. HSE’s HSG274 Part 2 is built around a named duty holder and a written record rather than a general expectation that somebody will notice. An alarm chain deserves the same treatment, and it is a configuration problem rather than a hardware one, which makes it unusually cheap to fix. Speak to an AQUAIOT engineer about mapping your escalation chain before you add another sensor to it.
By GP, Digital and IoT lead at AQUAIOT.