Alerting and Triage UX

Turning anomaly detections, precursors, and interlock events into a ranked, deduplicated, actionable stream an operator can work top-down under pressure.

From detections to decisions

The lower layers emit many signals: L3 anomaly ensembles flag sub-threshold quench and disruption precursors, SCADA reports process excursions, L1 logs interlock events. Left raw, this is a flood. The alerting pipeline deduplicates, correlates, and ranks these into a single triage stream so an operator always knows the one thing that most needs attention now.

Ranking by expected consequence and lead time

Each alert carries a severity, a confidence from the detecting model, and — critically — a lead time: how long until the operator must act. A high-confidence disruption precursor with 40 ms of lead time outranks a low-confidence cryo drift with minutes of slack. Ranking blends these rather than sorting by raw severity, so a genuinely urgent, actionable item is never buried under chronic nuisances.

def triage_score(alert):
    # higher = surface sooner
    urgency   = 1.0 / max(alert.lead_time_s, 1e-3)   # less time -> more urgent
    stake     = alert.severity                        # potential consequence
    trust     = alert.model_confidence                # 0..1 from detector
    actionable= 1.0 if alert.has_recommended_action else 0.4
    return stake * urgency * trust * actionable

The triage card

Each alert renders as a card that answers four questions at a glance: what (the anomaly and where on the machine), how sure (model confidence and provenance), how long (lead time, counting down), and what now (the recommended response and who owns it). For the breeder a disruption-precursor card links straight to the disruption countdown; for the burner a plug-density excursion card links to the plug view.

• Deduplicate: many detections of one event collapse to one card
• Correlate: causally linked alerts group under a root-cause header
• Acknowledge: ack stops re-notification but keeps the card live until resolved
• Handoff: any card can be assigned, annotated, and carried across shifts

Nuisance suppression is governed by the alarm-management rules so triage never degrades into an ignored red wall — see alarm flood suppression. Every alert and action is recorded for incident replay.