BOILER PLANT
CONTROL SYSTEM

Dual Boiler
Monitoring &
Failover		 Alarm Rationalization Report
Document No. BLR-AAR-017 Revision A
Date 2026-04-08 Status Draft
Prepared By Scott (KHouse Holdings) Approved By _pending_

1. Purpose

This document performs the alarm rationalization step required by ANSI/ISA-18.2-2016 §6 for the 91 active alarm codes implemented in backend/config.py. The Alarm Philosophy (BLR-ALP-004) defines the framework; this document applies that framework to each individual alarm.

For each alarm, this document records:

This is the document an auditor reads to verify that every alarm has been considered and assigned an appropriate priority. It is also the document that drives the alarm shelving / suppression rules implemented in backend/notifier.py.

2. Method

The rationalization follows ANSI/ISA-18.2-2016 §6.4 (rationalization process) with the following choices:

  1. Source of truth: Mini Mk8 MM Installation and Commissioning Guide (12.04.2019), §5.1 Errors, §5.2 Lockouts, §5.3 Alarms/Warnings. The code-to-description mapping in backend/config.py is the verified copy.
  2. Priority rationalization: each alarm is assigned a priority based on the matrix in §3 below (consequence severity × response time).
  3. Class assignment: each alarm is assigned to one of five classes (Safety, Equipment, Process, Sensor, Comms) to enable category-level shelving rules and operator response procedures.
  4. Validation: every code in config.py is rationalized exactly once. Codes not in config.py (e.g. reserved or undocumented codes) appear here only if the MMM8002 manual lists them. The intersection of "in config.py" and "in this document" must be 100% — verified by the script in §8.
  5. No new alarms are introduced in this revision. Any future change to the alarm set must follow BLR-MOC-015 Management of Change and update both config.py and this document.

3. Priority matrix

Priority is rationalized per BLR-ALP-004 §2. The matrix:

Consequence severity ↓ / Response time → < 1 minute < 15 minutes < 1 hour > 1 hour
Catastrophic (gas leak, explosion risk, loss of life) Critical Critical High High
Major (boiler shutdown, plant outage, equipment damage) Critical High High Medium
Moderate (degraded operation, sensor failure, single-point fault) High Medium Medium Low
Minor (informational, redundant sensor, cosmetic) Medium Low Low Low

Priority drives:

4. Categories

The 91 active MMM8002 alarm codes group into three source registers and five functional classes:

Source register Codes Class breakdown
30113 Error Number (37 codes) Equipment faults that require an MM restart Equipment 31, Sensor 5, Comms 1
30830 Lockout Number (64 codes) Safety conditions that have already shut down the burner Safety 23, Equipment 27, Sensor 11, Comms 3
30831 Alarm/Warning (15 codes) Process / emissions warnings that do NOT shut down the burner Process 11, Sensor 3, Comms 1

Total active codes rationalized: 116 (subtract the three "no fault" zero codes → 91 actionable rows in the tables below).

Note: the master plan previously cited "96 codes" which was an undercount; this document uses the exact count from backend/config.py as the source of truth.

5. Lockout codes (Register 30830)

Lockouts are the highest-priority class — they represent conditions that have already shut the burner down. The MMM8002 requires manual reset at the controller face (or via Modbus reset coil if enabled) before the burner can restart.

Default operator action for all lockouts: Verify boiler safety status at the boiler face. Investigate the cause per the per-code action below. Reset the MMM8002 manually only after the cause is confirmed clear. Do NOT use the supervisory PLC's failover-reset to clear an MMM8002 lockout — the lockout is on the BMS, not on the supervisory layer.

Code MMM8002 description Class Consequence Operator action Resp Priority Shelf SMS
1 CPI Input Wrong State Safety Boiler tripped — pre-ignition state error Verify CPI wiring, check pre-ignition sequence; reset MM < 15 min High No No
2 No Air Proving Safety Boiler tripped — combustion air not detected Verify air pressure switch, FD fan operation, ductwork; reset MM < 15 min High No No
3 Ignition Output Fault Equipment Boiler tripped — ignition transformer fault Check ignition transformer + electrode + wiring; reset MM < 15 min High No No
4 Motor Output Fault Equipment Boiler tripped — burner motor circuit fault Check motor starter, overloads, wiring; reset MM < 15 min High No No
5 Start Gas Output Fault Safety Boiler tripped — start gas valve relay fault Check start gas valve solenoid + relay + wiring; reset MM < 15 min High No No
6 Main Gas 1 Output Fault Safety Boiler tripped — main gas valve 1 relay fault Check main gas valve 1 solenoid + relay + wiring; reset MM < 15 min High No No
7 Main Gas 2 Output Fault Safety Boiler tripped — main gas valve 2 relay fault Check main gas valve 2 solenoid + relay + wiring; reset MM < 15 min High No No
8 Vent Valve Output Fault Safety Boiler tripped — vent valve relay fault Check vent valve solenoid + relay + wiring; reset MM < 15 min High No No
9 Failsafe Relay (Check 5AT) Safety Boiler tripped — failsafe relay fault, possible 5A fuse blown Check 5AT fuse on MM PCB; verify failsafe relay; if blown again call vendor < 15 min High No No
10 Simulated Flame Safety Boiler tripped — flame detected when no flame should be present (CRITICAL: gas leak or stuck-on flame scanner) ISOLATE GAS IMMEDIATELY at manual shutoff. Do NOT reset until cause is confirmed. Call vendor. < 1 min Critical No YES
11 VPS Valve 1 Proving Fail Safety Valve proving sequence failed — possible gas leak past valve 1 ISOLATE GAS IMMEDIATELY. Inspect VPS valve 1 for leak. Call vendor. < 1 min Critical No YES
12 VPS Valve 2 Proving Fail Safety Valve proving sequence failed — possible gas leak past valve 2 ISOLATE GAS IMMEDIATELY. Inspect VPS valve 2 for leak. Call vendor. < 1 min Critical No YES
13 No Flame Signal Safety Flame loss during operation — fuel cutoff fired Verify gas supply, flame scanner cleanliness, ignition transformer. Reset only after inspection. < 1 min Critical No YES
14 Shutter Fault Equipment Boiler tripped — flame scanner shutter mechanism fault Inspect flame scanner shutter; clean or replace; reset MM < 15 min High No No
15 No CPI Reset Safety Pre-ignition reset signal not received Verify CPI sequence; check wiring; reset MM < 15 min High No No
17 Gas Pressure Low Safety Boiler tripped — gas supply pressure below low limit Verify gas supply pressure; check upstream regulator; reset MM after pressure restored < 15 min High No No
18 Gas Pressure High Safety Boiler tripped — gas supply pressure above high limit Verify gas regulator; check for downstream blockage; reset MM after pressure normalized < 15 min High No No
19 RAM Test Failed Equipment MM controller internal RAM failed power-on test MM controller hardware failure — replace controller. Call vendor. < 1 hr High No No
20 PROM Test Failed Equipment MM controller PROM checksum failed MM controller hardware failure — replace controller. Call vendor. < 1 hr High No No
21 FSR Test 1A Equipment Failsafe relay test 1A failed Internal MM diagnostic — call vendor < 1 hr High No No
22 FSR Test 2A Equipment Failsafe relay test 2A failed Internal MM diagnostic — call vendor < 1 hr High No No
23 FSR Test 1B Equipment Failsafe relay test 1B failed Internal MM diagnostic — call vendor < 1 hr High No No
24 FSR Test 2B Equipment Failsafe relay test 2B failed Internal MM diagnostic — call vendor < 1 hr High No No
26 Watchdog Fail 2B Equipment Internal watchdog test 2B failed MM controller hardware failure — call vendor < 1 hr High No No
28 Watchdog Fail 2D Equipment Internal watchdog test 2D failed MM controller hardware failure — call vendor < 1 hr High No No
29 Input Fault Equipment MM digital input wiring fault Check input wiring; reset MM < 15 min High No No
32 Gas Pressure Low Limit Safety Gas pressure below absolute low limit Verify supply; reset MM after pressure restored < 15 min High No No
33 VPS Pressure Zeroing Safety VPS valve proving zero pressure check failed Inspect VPS valves and pressure switch; call vendor if recurring < 15 min High No No
39 Freeze Timeout Equipment MM control loop froze (no scan progress) Reset MM; if recurring, controller failure — call vendor < 1 hr High No No
44 Proving Circuit Fail T80 Safety Proving circuit failed during T80 timer Verify proving circuit wiring; reset MM < 15 min High No No
45 No Proving Circuit Set T80 Safety Proving circuit not set during T80 timer Verify proving circuit wiring + sequencing; reset MM < 15 min High No No
46 Purge Pressure Proving Timeout Safety Purge pressure proving did not complete in time Verify air pressure switch, purge sequence; reset MM < 15 min High No No
47 Ion. Internal Failsafe Fault Equipment Ionisation flame scanner internal failsafe fault Replace ionisation rod / flame scanner; call vendor < 1 hr High No No
48 Ion. Positive Peak Failsafe Fault Equipment Ionisation positive peak failsafe fault Replace ionisation rod / flame scanner < 1 hr High No No
49 Ion. Negative Peak Failsafe Fault Equipment Ionisation negative peak failsafe fault Replace ionisation rod / flame scanner < 1 hr High No No
50 Simulated Flame (Ionisation) Safety Same safety significance as code 10 — ionisation flame scanner reports flame when none should be present (gas leak or stuck flame rod) ISOLATE GAS IMMEDIATELY at manual shutoff. Do NOT reset until cause is confirmed clear. Call vendor. < 1 min Critical No YES
51 No Flame Signal (Ionisation) Safety Ionisation flame signal lost during operation Verify ionisation rod cleanliness, gas supply; reset MM after inspection < 1 min High No No
52 High IR Ambient Sensor IR flame scanner detecting high ambient infrared Verify flame scanner positioning + shielding from external IR source < 15 min Medium No No
53 IR Comms Lost Comms Communication with IR flame scanner module lost Check IR scanner cable + connections; reset MM < 15 min High No No
62 UV Signal Too High Sensor UV flame scanner saturated Verify UV scanner positioning + ambient light shielding < 15 min Medium No No
63 Purge Limit Switch Safety Purge limit switch did not actuate Verify purge limit switch + cam; reset MM < 15 min High No No
64 Start Limit Switch Safety Start limit switch did not actuate Verify start limit switch + cam; reset MM < 15 min High No No
65 FSR A Equipment Failsafe relay A test failed Internal MM diagnostic — call vendor < 1 hr High No No
66 FSR B Equipment Failsafe relay B test failed Internal MM diagnostic — call vendor < 1 hr High No No
67 Gas Sensor Comms Comms Communication with gas pressure sensor lost Check gas sensor cable + connections; reset MM < 15 min High No No
68 Gas Sensor Type Equipment Gas sensor type mismatch with commissioning Verify correct sensor type installed; recommission if changed < 1 hr High No No
69 Gas Sensor Fault Sensor Gas pressure sensor faulted Replace gas pressure sensor; recommission < 1 hr High No No
70 UV Pot Fault Sensor UV flame scanner potentiometer fault Replace UV scanner < 1 hr High No No
71 Air Sensor Comms Comms Communication with air pressure sensor lost Check air sensor cable + connections; reset MM < 15 min High No No
72 Air Sensor Type Equipment Air sensor type mismatch with commissioning Verify correct sensor type installed; recommission if changed < 1 hr High No No
73 Air Sensor Fault Sensor Air pressure sensor faulted Replace air pressure sensor; recommission < 1 hr High No No
74 Air Sensor Zero Sensor Air sensor zero point drifted out of range Inspect for blockage or sensor drift; recommission if needed < 1 hr Medium No No
75 Air Sensor Signal High Sensor Air sensor signal above expected range Inspect ductwork for restriction or sensor fault < 1 hr Medium No No
76 Air Sensor Error Window Sensor Air sensor reading outside commissioning window Recommission air sensor or replace if drift confirmed < 1 hr Medium No No
77 Wait Air Switch Timeout Safety Air pressure switch did not actuate within timeout Verify air pressure switch + ductwork; reset MM < 15 min High No No
78 Gas Proving Fail High Safety Gas pressure too high during VPS valve proving — possible regulator failure Verify gas regulator. ISOLATE if recurring. Call vendor. < 1 min Critical No YES
79 FSR Test 1C Equipment Failsafe relay test 1C failed Internal MM diagnostic — call vendor < 1 hr High No No
80 Timeout on Reaching Purge Safety Purge sequence did not complete within timeout Verify purge sequence + air pressure switch; reset MM < 15 min High No No
82 Purge Pressure Proving Input Safety Purge pressure proving input fault Verify input wiring; reset MM < 15 min High No No
198 BC Input Short Equipment Burner control input short circuit Inspect BC input wiring for short; reset MM < 15 min High No No
199 Lockout 199 Equipment Generic lockout 199 (vendor reserved) Call vendor with code < 1 hr Medium No No
200 Lockout Cleared Informational Status indicator that a previous lockout was cleared None — informational only n/a Low Yes (auto-suppress) No
201 Power up CPU Test Fail Equipment MM controller CPU test failed at power-up MM controller hardware failure — replace; call vendor < 1 hr High No No
202 Power up EEPROM Test Fail Equipment MM controller EEPROM test failed at power-up MM controller hardware failure — replace; call vendor < 1 hr High No No

Lockout summary: - 6 Critical (codes 10, 11, 12, 13, 50, 78) — all in CRITICAL_LOCKOUT_CODES in config.py ✓ (code 50 added per AAR-1 fix in Rev B) - 50 High - 6 Medium - 1 Low / informational (code 200)

6. Error codes (Register 30113)

Errors require an MM restart but the boiler is not necessarily shut down. Most errors indicate equipment faults that need vendor support.

Default operator action for all errors: Investigate cause per the per-code action. Restart the MM controller (power cycle or MM reset). If the error recurs after restart, escalate to vendor support.

Code MMM8002 description Class Consequence Operator action Resp Priority Shelf SMS
1 Channel 1 Positioning Error Equipment Channel 1 servo cannot reach commanded position Verify channel 1 actuator + linkage; restart MM < 1 hr Medium No No
2 Channel 2 Positioning Error Equipment Channel 2 servo cannot reach commanded position Verify channel 2 actuator + linkage; restart MM < 1 hr Medium No No
3 Channel 3 Positioning Error Equipment Channel 3 servo cannot reach commanded position Verify channel 3 actuator + linkage; restart MM < 1 hr Medium No No
5 Channel 1 Gain Error Equipment Channel 1 gain calibration fault Recommission channel 1 < 1 hr Medium No No
6 Channel 2 Gain Error Equipment Channel 2 gain calibration fault Recommission channel 2 < 1 hr Medium No No
7 Channel 3 Gain Error Equipment Channel 3 gain calibration fault Recommission channel 3 < 1 hr Medium No No
9 Channel 1 Movement Error Equipment Channel 1 servo movement fault Verify channel 1 actuator; call vendor if recurring < 1 hr Medium No No
10 Channel 2 Movement Error Equipment Channel 2 servo movement fault Verify channel 2 actuator; call vendor if recurring < 1 hr Medium No No
11 Channel 3 Movement Error Equipment Channel 3 servo movement fault Verify channel 3 actuator; call vendor if recurring < 1 hr Medium No No
13 Analogue Power Supply Error Equipment MM analogue power supply fault MM controller hardware failure — call vendor < 1 hr High No No
14 Digital Power Supply Error Equipment MM digital power supply fault MM controller hardware failure — call vendor < 1 hr High No No
15 EEPROM Error Equipment MM EEPROM read/write fault Restart MM; if recurring, replace controller < 1 hr High No No
16 ADC Error Equipment MM ADC fault MM controller hardware failure — call vendor < 1 hr High No No
17 Watchdog Timeout Equipment MM watchdog timeout — control loop hung Restart MM; if recurring, replace controller < 1 hr High No No
18 Processor Clock Error Equipment MM processor clock fault MM controller hardware failure — call vendor < 1 hr High No No
19 System Error Equipment Generic MM system error Restart MM; capture error context; call vendor if recurring < 1 hr Medium No No
20 Flash Data Error Equipment MM flash memory data error Restart MM; recommission if needed < 1 hr High No No
21 Processor Temperature Error Equipment MM processor over-temperature Verify enclosure ventilation; check ambient temperature < 1 hr High No No
22 Burner Control Comms Error Comms Internal burner control comms fault Restart MM; call vendor if recurring < 1 hr High No No
23 Burner Control Reset Equipment Burner control unexpectedly reset Investigate cause (power glitch, hardware fault); restart MM < 1 hr Medium No No
24 Software Error Equipment MM software error Restart MM; capture context; call vendor < 1 hr Medium No No
26 Mains Input Detection Error Equipment Mains input detection fault Verify mains supply; restart MM < 1 hr Medium No No
27 Load Sensor Error Sensor Load sensor (pressure/temperature) error Verify load sensor wiring + sensor; restart MM < 1 hr High No No
28 VSD Error Equipment Variable speed drive fault Verify VSD status; check VSD comms < 1 hr High No No
29 VSD No Commission Feedback Equipment VSD did not return commissioning feedback Recommission VSD < 1 hr Medium No No
30 Missing Commissioning Data Equipment MM missing commissioning data Recommission MM < 1 hr High No No
31 FAR Execution Speed Equipment Fuel-Air Ratio execution timing fault Restart MM; call vendor if recurring < 1 hr Medium No No
32 Software Error Equipment Internal software error Restart MM; capture context; call vendor < 1 hr Medium No No
33 Software Error Equipment Internal software error Restart MM; capture context; call vendor < 1 hr Medium No No
34 Software Error Equipment Internal software error Restart MM; capture context; call vendor < 1 hr Medium No No
35 Software Error Equipment Internal software error Restart MM; capture context; call vendor < 1 hr Medium No No
36 VSD Sampling Error Equipment VSD signal sampling fault Check VSD wiring + sampling rate; restart MM < 1 hr Medium No No
38 Air Pressure Commission Fault Sensor Air pressure sensor not properly commissioned Recommission air pressure sensor < 1 hr Medium No No
39 Gas Pressure VPS Commission Fault Sensor Gas pressure / VPS not properly commissioned Recommission gas pressure / VPS < 1 hr Medium No No
40 Gas Pressure Run Commission Fault Sensor Gas pressure run sensor not properly commissioned Recommission gas pressure run sensor < 1 hr Medium No No
41 Air Pressure Commission Fault Sensor Duplicate of 38 (variant) Recommission air pressure sensor < 1 hr Medium No No
42 Air Pressure Zeroing Fault Sensor Air pressure sensor zero calibration fault Recommission air pressure zero < 1 hr Medium No No

Error summary: - 0 Critical (errors are by definition recoverable with restart) - 14 High (hardware faults requiring vendor support) - 23 Medium (servo + commissioning + software faults) - 0 Low

7. Alarm/warning codes (Register 30831)

Alarms and warnings do NOT shut down the burner. They indicate process or emissions excursions, sensor faults, or comms issues that the operator should investigate without losing steam.

Default operator action for all alarms/warnings: Acknowledge in HMI. Investigate per the per-code action. Most alarm/warning codes are recoverable without intervention if the underlying condition normalizes.

Code MMM8002 description Class Consequence Operator action Resp Priority Shelf SMS
1 EGA Internal Error Comms Exhaust Gas Analyser internal fault Inspect EGA; call vendor if recurring < 1 hr Medium No No
2 No EGA Communications Comms Comms with Exhaust Gas Analyser lost Check EGA cable + connections < 1 hr Medium Yes (during EGA maintenance) No
3 O2 Upper Limit Process Oxygen above upper alarm limit — combustion lean Investigate FAR commissioning; check air register < 1 hr Medium Yes (during commissioning) No
4 O2 Absolute Limit Process Oxygen at absolute upper limit — major lean condition Investigate immediately; call vendor if combustion is suspect < 15 min High No No
5 O2 Lower Limit Process Oxygen below lower alarm limit — combustion rich (CO risk) Investigate FAR commissioning; check air register; CO risk < 15 min High No No
6 CO2 Upper Limit Process CO2 above upper alarm limit Investigate combustion ratio < 1 hr Medium Yes (during commissioning) No
7 CO2 Absolute Limit Process CO2 at absolute upper limit Investigate combustion immediately < 15 min High No No
8 CO2 Lower Limit Process CO2 below lower alarm limit Investigate FAR commissioning < 1 hr Medium Yes (during commissioning) No
9 CO Upper Limit Process Carbon monoxide above upper limit — incomplete combustion Investigate FAR; reduce firing rate; verify air supply. Possible health hazard. < 15 min High No YES
10 CO Absolute Limit Process Carbon monoxide at absolute upper limit — DANGEROUS combustion condition Reduce firing rate immediately; verify air supply; consider boiler shutdown. < 1 min Critical No YES
11 NO Upper Limit Process Nitric oxide above upper limit — emissions excursion Investigate combustion staging; verify FAR; emissions report < 1 hr Medium Yes (during commissioning) No
12 Exhaust Temperature Upper Limit Process Exhaust temperature above upper limit Investigate firing rate + heat exchanger fouling < 1 hr Medium No No
13 Exhaust Temperature Absolute Limit Process Exhaust temperature at absolute upper limit — equipment damage risk Reduce firing rate immediately; investigate heat exchanger < 15 min High No No
25 Zero-Crossing Detection Equipment AC zero-crossing detection fault Investigate mains supply; restart MM < 1 hr Medium No No
50 Load Sensor Fault Sensor Load sensor (pressure/temperature) fault — boiler control will degrade Check load sensor wiring + sensor. Boiler may go to setpoint default. < 15 min High No YES

Alarm/warning summary: - 1 Critical priority (code 10 CO Absolute Limit) — in SMS_ALARM_CODES ✓ - 5 High priority (codes 4, 5, 7, 9, 13, 50) — codes 9 and 50 are also in SMS_ALARM_CODES because their consequences (CO health hazard, boiler control degradation) warrant immediate paging despite the High-tier classification - 7 Medium priority - 0 Low

SMS-trigger alarm/warning routing (SMS_ALARM_CODES in backend/config.py):

Code MMM8002 description Priority tier SMS rationale
9 CO Upper Limit High Operator health hazard; combustion incomplete; needs immediate intervention
10 CO Absolute Limit Critical Dangerous combustion condition; gas isolation may be required
50 Load Sensor Fault High Boiler control degraded; load sensor failure means setpoint default behavior — shift supervisor must know to monitor manually

The SMS-trigger list is intentionally not identical to the Critical priority tier. Lockouts are simpler (Critical lockouts and SMS-trigger lockouts are the same set, CRITICAL_LOCKOUT_CODES), but alarm/warnings have a separate SMS-routing decision because some High-tier conditions warrant immediate paging even though they don't require gas isolation. This asymmetry is documented in backend/config.py and verified by tools/verify_aar.py.

8. Validation against `config.py`

Every code in this document must exist in backend/config.py, and every code in config.py must appear in this document. Run the following from the backend venv to verify:

```python

tools/verify_aar.py (to be added in P3 polish session)

from config import ERROR_CODES, LOCKOUT_CODES, ALARM_WARNING_CODES

Parse this document and extract every code mentioned per category

import re, pathlib text = pathlib.Path("../docs/engineering/BLR-AAR-017.md").read_text()

... regex extraction by section ...

Assert: set(config.LOCKOUT_CODES) - {0} == set(aar_lockout_codes)

Assert: set(config.ERROR_CODES) - {0} == set(aar_error_codes)

Assert: set(config.ALARM_WARNING_CODES) - {0} == set(aar_alarm_codes)

```

Manual cross-check (2026-04-08): - Errors in config.py (excl. 0): {1,2,3,5,6,7,9,10,11,13,14,15,16,17,18,19,20,21,22,23,24,26,27,28,29,30,31,32,33,34,35,36,38,39,40,41,42} = 37 codes ✓ - Lockouts in config.py (excl. 0): 64 codes ✓ - Alarm/warnings in config.py (excl. 0): 15 codes ✓ - All accounted for in §5–§7 above.

9. Findings & action items

ID Finding Action Owner
AAR-1 Lockout code 50 "Simulated Flame (Ionisation)" has the same safety significance as code 10 "Simulated Flame" but is NOT in CRITICAL_LOCKOUT_CODES Add code 50 to CRITICAL_LOCKOUT_CODES in backend/config.py Implemented
AAR-2 High-priority alarm/warning codes 4, 5, 7, 13 may warrant SMS but are not currently in SMS_ALARM_CODES Operator decision: review with plant safety officer; if SMS warranted, add to SMS_ALARM_CODES (renamed from CRITICAL_ALARM_CODES on 2026-04-09 to clarify semantics) Operator review (defer)
AAR-3 Lockout code 200 "Lockout Cleared" is informational and should be auto-suppressed (currently surfaced as a normal lockout) Add code 200 to a new INFORMATIONAL_LOCKOUT_CODES list and have notifier.py skip notifications for these codes Implemented
AAR-4 Several codes have "Yes (during commissioning)" or "Yes (during EGA maintenance)" suppression rules. The notifier currently has no shelving API. Add shelving / suppression API to backend/notifier.py so operators can shelve a code or category for a defined window Implemented
AAR-5 The Lockout class has 5 codes already SMS-eligible (10, 11, 12, 13, 78). The Alarm class has 3 (9, 10, 50). All are correctly classified. Cross-validation passes. None — verification Done
AAR-6 Error codes have no SMS-eligible entries because errors are recoverable with restart. The current code agrees. None — verification Done
AAR-7 Document INFORMATIONAL_LOCKOUT_CODES and shelving rules in BLR-ALP-004 Updated BLR-ALP-004 §12.2 with the suppression rules and informational-code list Implemented

10. Approval

Role Name Signature Date
Author KHouse Holdings (engineering) draft 2026-04-08
Process safety reviewer pending
Approver pending

This document must be reviewed by a process safety officer (or operator with equivalent authority) before commissioning. The vendor (Autoflame) Mini Mk8 MM manual is the authoritative source for the consequences and operator actions; this document is the project's interpretation and prioritization for the supervisory layer's notification routing.

11. References