Alarm limits vs acceptance limits: setting them correctly

Three sets of numbers are often confused. The storage condition (for example 2–8 °C) is the acceptance limit — the product requirement. The alarm limit is the value at which the monitoring system demands action; it should trigger before the product limit is breached. An alert or warning limit can sit inside the alarm limit to prompt a check without escalation.

Setting the gap

• Sensor uncertainty: if the monitoring sensor has U = 0.5 °C, an 8.0 °C reading may correspond to 8.5 °C at the product. Guard-band accordingly.
• Response time: a sensor in a metal block responds slowly; the air may already be out of range when it alarms.
• Time to act: the alarm must arrive early enough for someone to intervene.
• Product tolerance: brief excursions allowed by stability data can justify a delay — the justification must be written.

A common arrangement for a 2–8 °C room: alert at 2.5 / 7.5 °C, alarm at 2.0 / 8.0 °C with a short, justified delay, and no delay on the freezing side if the product must not freeze.

Sizing the gap

The gap between the acceptance limit and the alarm limit is not a round number chosen for neatness. It is the sum of three things, each of which can be estimated.

• Sensor uncertainty. If the monitoring probe carries U = 0.5 °C, a reading of 8.0 °C is consistent with 8.5 °C at the product. Pull the alarm in by at least U, which is the same guard-band logic that governs a calibration certificate.
• Response time. A buffered probe in a metal block lags the air by many minutes. By the time it reads 7.5 °C the air has been warmer for a while, and the product is somewhere between. A slow sensor needs a wider gap than a fast one.
• Time to act. The alarm exists so that somebody can intervene before the acceptance limit is reached. Work out how long intervention actually takes at 03:00 and how fast the room drifts, and make sure the gap buys at least that much time.

Persistence, and the side that gets none

A short alarm delay stops a routine door opening from paging someone at midnight, and it is legitimate — provided it is justified rather than tuned until the alarms stop. The justification is the product's own tolerance: if fifteen minutes above 8 °C is demonstrably harmless for everything stored there, a fifteen-minute persistence is defensible. If it is not, the delay is hiding excursions rather than filtering noise.

The freezing side usually gets no delay at all. Damage from freezing is irreversible for many biologicals and can happen quickly, so a low-temperature alarm is normally immediate even where the high-temperature side is delayed. Asymmetric settings are correct here, and a system configured symmetrically out of tidiness is quietly accepting the worse of the two risks.

Alert limits earn their keep only if someone reads them. An alert-limit breach that never escalated is the early warning the level exists to provide, and it is routinely ignored precisely because nothing happened.