Right alarm, right person, right now.
Not every reading is an alarm, and not every alarm is a crisis. AERIEL sorts events into four tiers — Info, Watch, Warning, Critical — each with its own response target, its own audience, and a clear line between what NEREID may do alone and what a human must sign.
Alarm Escalation
The tiered alert system over the AquaLink Mesh and Sensing Array — severity tiers, routing, automated and human-required actions, de-escalation, and the authoritative alarm catalogue.
1. Severity Tiers
Four tiers govern response. Auto-responses are executed by NEREID within its authority; anything above Warning stages for human confirmation. Escalation timers start at acknowledgement-required and trigger the next notify tier if the alarm goes unacked.
| Tier | Meaning | Response Target | Routing | Escalate-If-Unacked |
|---|---|---|---|---|
| INFO | Routine logged event, in band | Record only | NEREID log | — |
| WATCH | Approaching a soft limit / single anomaly | Ack ≤ 30 min | Watch Desk | 30 min → Duty Lead |
| WARNING | Soft limit crossed, recoverable | Ack ≤ 10 min | Watch Desk + Zone Lead | 10 min → Duty Manager |
| CRITICAL | Stock / loop / containment at risk; security event | Ack ≤ 3 min | Duty Mgr + Husbandry Lead | 3 min → Admiralty (page) |
2. Escalation Ladder
An alarm climbs the ladder only as far as it must. Most never leave the first rung — NEREID acts, logs, and clears.
Logged
Spawn confirmations, completed water-change cycles, ROV recharges, satellite overpass logged. No action.
Watch Desk
NEREID acts within authority and posts to the board. Desk acknowledges; promotes to Duty Lead if unacked in 30 min.
Zone Lead
Auto-correction underway; the responsible Zone Lead is paged to confirm. Promotes to Duty Manager at 10 min.
Admiralty
Human sign-off required. Duty Manager + Husbandry Lead paged at once; Admiralty paged if unacked in 3 min.
3. Auto-Actions vs Human-Required
The line between machine and human authority is fixed and auditable. NEREID may stabilize; it may not, on its own, take an irreversible or escalatory action.
Automated
- Metered water change / dosing correction within envelope
- Mesh re-route and FRAM backfill on node loss
- Chiller / heater setpoint trim, pump VFD throttle
- Sonar throttle on marine-mammal mitigation interlock
- Auto-demote its own autonomy to advisory on low confidence
Confirmed
- Containment lockdown release on Abyssal Holding
- Interdiction tasking against a dark contact
- Cross-system isolation that takes a zone offline
- Any Critical-tier action affecting protected stock
- Man-overboard recovery command authority
4. Alarm Catalogue
| Condition | Trigger Threshold | Severity | Auto-Response | Notified | Escalate |
|---|---|---|---|---|---|
| Dissolved-oxygen crash | Station DO < 5.5 mg/L, falling > 0.4 mg/L / 10 min | CRITICAL | Aeration boost; metered water change; loop cross-feed | Husbandry Lead, Duty Mgr, Desk | 3 min |
| Chiller fault | Compressor trip or ΔT > 1.5 °C above setpoint | CRITICAL | Failover to backup chiller; load-shed non-critical loops | Facilities Eng, Duty Mgr, Desk | 3 min |
| Containment differential | Abyssal Holding Δp toward positive > −15 Pa for > 5 s | CRITICAL | Damper close, interlock lockdown (fail-safe), record | Incident Cmdr, Admiralty, Desk | Immediate page |
| Mesh node loss | Missed heartbeat > 90 s | WATCH | Mesh re-route; FRAM replay on return | Watch Desk | 30 min |
| Zone mesh dark | > 0.8% of a zone's nodes offline | WARNING | Bridge-node dispatch ticket; tighten neighbor sampling | Sensing Lead, Desk | 10 min |
| AIS-gap on target | Radar/acoustic contact, no AIS, inside protected zone | CRITICAL | Open evidence record; cue Sensing Array re-task | Dispatch, Duty Mgr, Desk | 3 min |
| Coral bleaching rising | Bleaching index ≥ 4 on a reef quadrat | WARNING | Targeted reef re-scan; SST-anomaly decline forecast | Marine Science, Desk | 10 min |
| Mesh strand failure | Link down; redundant paths < 3 | WARNING | Path re-route; bulk traffic pause | Platform Eng, Desk | 10 min |
| Power transfer event | Mains loss; on backup/generator | CRITICAL | Load-shed scavenger class; verify core/containment power | Facilities Eng, Duty Mgr, Desk | 3 min |
| Spoofed / invalid packet | Ed25519 signature mismatch | CRITICAL | Drop packet; quarantine node; security event | Security, Platform Eng, Desk | 3 min |
| Man-overboard | Fleet MOB beacon / acoustic trigger | CRITICAL | Mark position, cue nearest hull/ROV; alert bridge | Incident Cmdr, Fleet, Admiralty | Immediate page |
| NEREID confidence low | Decision score < 0.80 | WATCH | Auto-demote autonomy to advisory | Watch Desk | 30 min |
5. De-Escalation & Audit
- On trigger, NEREID executes the auto-response within authority and opens an alarm record on the command wall and monitoring board.
- First-notify roles receive an immediate page/console alert and must acknowledge within the tier's response target.
- If unacknowledged within the escalation window, the alarm promotes one notify tier and re-pages.
- An alarm de-escalates automatically only after the parameter holds in band for the tier's hysteresis window (Critical: 15 min sustained); the record stays open until a human closes it.
- Every alarm, acknowledgement, auto-action, and closure is written to the fabric's hash-chained audit log — tamper-evident and replayable.