Auditory alarm signals
Sound is the only alarm channel that reaches a clinician who is not looking. It is also the only one that reaches the patient, their family, and everyone else on the ward — none of whom can interpret it and all of whom are affected by it.
The auditory signal characteristics in IEC 60601-1-8 are normative and dimensioned — pulse counts, fundamental frequencies, harmonic content, pulse and burst durations, rise and fall times, inter-burst intervals and repetition rates. They are in the standard, which is a paid document, and getting them right needs an audio engineer and measurement equipment rather than a design system.
What follows is an outline of the shape, so that a designer knows what constrains them, plus the decisions the standard deliberately leaves open. Those decisions are what this page is actually for. Paraphrase, not specification, and not legal advice.
Why this page exists at all
Four pages in this system already lean on an audible layer. Acknowledge & escalate tabulates a "priority tone" per alarm state and builds its entire audio-pause argument on one existing. Nothing anywhere said what a priority tone is, which made the visual half of this system rest on an unstated half.
This page does not fill that in with invented numbers. It states what the standard fixes, what it leaves to the manufacturer, and what this system has an opinion about — which is almost entirely the second category.
What the standard fixes, in outline
IEC 60601-1-8 encodes priority in the structure of the sound, not in its loudness or its pitch alone. Broadly:
| Priority | Shape of the signal | What it is telling the listener |
|---|---|---|
| High | A burst of five pulses, then a second burst, the pair repeating at a short interval | Respond immediately |
| Medium | A burst of three pulses, repeating less often | Respond promptly |
| Low | One or two pulses, optionally not repeating | Be aware |
Two consequences a designer should internalise even without the numbers. Pulse count and repetition rate are the message, so a "louder version of the same sound" does not raise priority and a quieter one does not lower it. And the encoding is learnable and cross-manufacturer — a clinician trained on one device should recognise urgency on another, which is exactly the argument Colour makes about the alarm hues, one sense across.
The standard also offers an optional set of melodic signals mapped to categories — general, cardiovascular, ventilation, oxygenation, temperature, drug delivery, perfusion, and equipment or supply failure. Adopting them is a real decision with a real trade: a clinician who knows the vocabulary learns what kind of thing is wrong before looking, and one who does not hears an additional arbitrary tune. Decide it deliberately, record the decision, and do not invent a private melodic vocabulary of your own — a category signal that means something different on your device than on the pump beside it is worse than no category signal.
Sound goes to everyone, and that is the whole difficulty
A visual alarm is addressed. It appears where the responsible clinician is looking, and nobody else need ever see it. An audible alarm has no address: it reaches the patient it concerns, the patient in the next bed, four relatives, and every clinician within earshot who is responsible for someone else.
Almost everything difficult about auditory alarms follows from that:
- The burden is per-ward, not per-patient. A rate that is reasonable for one bed is intolerable across twenty, and a design that sets its budget per device has not set a budget. Messaging asks every message class to state an expected rate; for audible alarms, state it per ward at occupancy.
- The patient hears their own alarms and cannot interpret them. They hear urgency, they cannot hear what it is about, and they cannot tell a technical alarm about a disconnected lead from a physiological one about their heart. Distress is the default reading and it is frequently wrong.
- An audible alarm discloses that something is wrong, to a corridor. That is a privacy consequence of a safety control, and it is not avoidable — but it is a reason not to spend sound on things that do not need it.
- Sleep disruption is clinical harm, not an amenity concern. Broken sleep is associated with delirium and slower recovery, and a ward that alarms all night is treating one risk by creating another.
This is the strongest argument in the system for suppression and smart limits: every alarm that should not have sounded was not merely ignored, it was inflicted on everyone present.
One fact, two channels
Acknowledge & escalate already requires that audio never be the sole channel. The general rule, and its converse:
- Every audible signal has an equivalent visual state, for clinicians who are deaf or hard of hearing, for noisy environments, and for the moment a speaker fails.
- Every alarm-condition visual state has an audible equivalent where audio is enabled, because a signal that is silent for some conditions teaches that silence means nothing is wrong.
- The two never carry different facts. Sound says an alarm exists and how urgent it is; the screen says what and who. Encoding anything in sound that is not on screen makes the interface unusable without hearing.
- Silence is never a state with meaning. Nothing is communicated by a tone stopping, because the listener cannot distinguish that from a speaker failure, a volume knob, or having stepped into the corridor.
That last one has teeth. It rules out the tempting design where a repeating tone slows as a parameter improves and stops when it is normal: the listener cannot tell "resolved" from "not working", and the second is the case where they need to know.
Volume
- Adjustable, with a floor. The minimum is set so the signal is audible above the ambient noise of the specified environment, and the user cannot go below it. A volume control that reaches zero is a mute control with a different label.
- The floor is a property of the environment, not the device. An ICU at night and an operating theatre with a saw running are different specifications, and a device used in both needs the louder one or a documented deployment setting — which then carries the blast radius of Safety configuration.
- The current volume is visible without listening, and stated as a value rather than a slider position, so a clinician arriving on shift can tell what the previous shift left it at.
- Loudness never substitutes for priority. Priority is in the pulse structure; making a medium-priority alarm louder produces a loud medium-priority alarm, and trains clinicians to read volume as urgency, which the next quiet high-priority alarm punishes.
Night, and why there is no night mode
The obvious response to overnight noise is a global quiet mode. This system does not provide one, for the same reason it has no bulk acknowledgement: the control cannot tell which alarm it is silencing.
What is available instead:
- Reducing the population of alarms, which is where the entire gain actually is — Suppression & alarm limits.
- A documented environmental volume setting per deployment, applied to the floor rather than removing it, and configured administratively rather than from a clinical screen.
- Time-boxed pause at the individual alarm, exactly as Acknowledge & escalate specifies: bounded, non-extendable, visible with time remaining, and never applied to a class.
- Delegation, below — moving the signal rather than removing it.
Sending the sound somewhere else
Routing alarms to a device carried by the responsible clinician solves the broadcast problem honestly: the person who needs to hear it does, and the ward does not. It also introduces failure modes the bedside speaker does not have, and every one of them is silent.
- The bedside signal is not removed because a remote one exists. A phone in a pocket is a supplement to the local alarm, never a replacement, and a system that turns the room silent on the assumption a notification arrived has made an assumption it cannot check.
- Delivery is confirmed, and non-delivery is an alarm in its own right. Flat battery, no signal, a device left in a locker — the failure is that nothing happens, which is indistinguishable from nothing being wrong. This is Unattended operation's problem, arriving by another route.
- The recipient is named and current. An alarm routed to whoever held the role at the start of the shift is routed to someone who went home.
- Escalation is time-based and automatic, per Acknowledge & escalate. A remote alarm nobody answers must reach a person, not a log.
Outcomes of use
What this contributes to, in the terms of Usability & context of use. These are attributes believed to contribute to an outcome; the outcome itself is settled by observing real use in a specified context, not by this page.
- Effectiveness — an alarm reaches a clinician who was not looking, and the urgency they hear is the urgency that exists. The failure being prevented is a learned association between a sound and a false positive.
- Efficiency — fewer interruptions per shift, achieved by not sounding rather than by sounding quietly.
- Satisfaction — for the clinician, and also for the patient, who is the only person in this system who hears every alarm and can act on none of them. That is not a comfort measure; sleep is part of the treatment.
Do's and don'ts
Priority in the pulse structure. Volume set for the room.
Urgency is learnable and carries across manufacturers, which is the whole point of standardising it.
One tone, louder for urgent things.
Teaches clinicians to read volume as urgency. The next quiet high-priority alarm — in a noisy bay, at a low setting — is then read as unimportant.
Volume 6 of 10 · minimum for this ward is 4
A stated value with a stated floor. An arriving clinician knows where it was left, and cannot silence it by dragging.
A volume slider that reaches zero.
A mute control wearing a volume control's label, reachable in one drag by anyone, with no record that it happened.
Alarm routed to A. Reyes · delivered 03:14
Delivery confirmed. The bedside signal is still sounding, because the phone might have been in a locker.
Alarm sent to the on-call phone. Room silenced.
Two assumptions nothing checked: that it arrived, and that someone is holding the phone. Both fail silently, which is the only way this can fail.
The tone continues until the condition resolves or a person acknowledges it.
Silence means one of two known things, both of which are also on screen.
The tone slows as the value improves, and stops when it is normal.
Silence now means resolved, or a failed speaker, or the corridor. The listener cannot tell, and the second is when they most need to.
Clinical safety notes
Trace these in your risk file (ISO 14971) and usability engineering file (IEC 62366-1). The signal characteristics themselves are a conformity matter under IEC 60601-1-8 and are verified by measurement, not by review.
- Priority is encoded in pulse structure, never in loudness. Mitigates: volume read as urgency, and a quiet high-priority alarm dismissed.
- Volume is adjustable above a floor that cannot be reached. Mitigates: a mute achieved with a volume control and no record.
- Every audible signal has a visual equivalent, and the reverse. Mitigates: an alarm inaudible to a deaf clinician or in a noisy bay, and silence read as reassurance.
- Silence is never a state with meaning. Mitigates: a failed speaker indistinguishable from a resolved condition.
- Rates are budgeted per ward at occupancy. Mitigates: alarm fatigue designed in per device and discovered per ward.
- No global quiet mode. Mitigates: a control that silences alarms it cannot identify — the same objection as bulk acknowledgement.
- Remote routing supplements the bedside signal and confirms delivery. Mitigates: an alarm that reached nobody, failing in the one way nothing observes.
- No private melodic vocabulary. Mitigates: a category signal meaning one thing on your device and another on the pump beside it.
Related
- Acknowledge & escalate — audio pause, which is not acknowledgement, and the alarm lifecycle this page supplies the sound for.
- Suppression & alarm limits — the only intervention that reduces noise without reducing signal.
- Messaging — the rate budget, of which this is the loudest instance.
- Colour — priority encoding in the other sense, and the same cross-manufacturer argument.
- Unattended operation — an alarm with nobody to hear it.
- Safety configuration — where the environmental volume floor is set, and its blast radius.