Managing Alarms

Rule-based activation

An alarm is triggered when an event from an object—such as an input state change, a door opening, or an area mode change—matches a configured rule in PVC. The rule defines the conditions for raising an alarm and specifies the alarm kind.

Input categories and events

Input objects, such as motion detectors or door contacts, are assigned a category (for example, Normal, Tamper, or Burglary). You can create rules to raise an alarm when an event occurs for a specific category.

Example: If the input category “Burglary” becomes active, raise the “Burglar Alarm” kind.

Object-specific rules

You can create rules for individual objects such as a specific input, output, reader, or door. These rules generate alarms for one or more events related to that object.

Rule sets for efficiency

To simplify configuration in large deployments, multiple rules can be combined into a rule set. You can then assign the rule set to a site or an organization. This approach saves administrators from configuring each rule individually across multiple objects or sites.

Whether you use individual rules or rule sets, you must assign them to the S1000 controller or its associated organization. This ensures the hardware monitors and reports alarm conditions.

The standard alarm flow describes the journey of an alarm event from its trigger to its initial display in Sonitrol CORE.

1. Object event occurs - An action or state change happens on a physical device connected to an S1000 controller. For example, an input becomes active or a door contact is forced.

2. Rule condition evaluated - Depending on the rule type, either the S1000 or the Sonitrol CORE server checks if the event matches any conditions defined in an assigned rule.

3. Alarm generated - If the rule conditions are met, the S1000 generates an alarm signal.

4. Alarm transmitted to Sonitrol CORE server - The alarm signal is sent from the S1000 controller to the Sonitrol CORE server.

5. Alarm processed by Sonitrol CORE rules engine - The Sonitrol CORE server receives and processes the alarm, applying additional logic defined in the associated rule and its alarm kind.

6. Alarm assigned to an alarm kind - The alarm is categorized under its designated alarm kind and inherits its properties, such as priority.

7. Alarm displayed in Sonitrol CORE - The newly generated alarm appears on the Alarms screen, awaiting operator action.

8. Event logged without alarm - If no rule conditions are met, the event is logged for historical purposes, but no active alarm is generated.

Alarms are categorized into three primary active states: New, Acknowledged, and Suspended. After an alarm is resolved, it transitions to a Closed (History) state.

State	Definition	Behavior	Previous equivalent
New	Initial state for any alarm event generated by a controller and received by Sonitrol CORE. Alarms in this state are actively awaiting operator review and action.	New alarms are highlighted visually and may trigger audio notifications to draw immediate attention. They are a top priority for operators.	Replaces the Active alarm state from previous versions of Sonitrol CORE.
Acknowledged	An alarm enters this state when an operator manually takes ownership of it. Acknowledging an alarm means the operator is aware of the event and has started handling or investigating it.	Acknowledged alarms remain visible in the active interface. They indicate that the alarm is being managed but may still require further action or resolution.	This is a new state. Previous versions of Sonitrol CORE did not have an equivalent.
Suspended	An operator can place any new alarm in this state when active management needs to be temporarily paused. This state is useful during scheduled maintenance, investigations, or when waiting for external information.	Suspended alarms move to a dedicated list. They are removed from the new alarm queue but remain accessible for later review and reactivation.	This is not a new state. Previous versions of Sonitrol CORE included this state, and the functionality remains unchanged.
Closed	The final, resolved state for any alarm. An alarm moves to the Closed state when an operator confirms that the event has been fully addressed and no further action is required.	Closed alarms are archived in the system history. They are no longer visible in active lists but remain available for auditing and reporting.	This is not a new state. Previous versions of Sonitrol CORE included this state, and the functionality remains unchanged.