"First" Alarm Only

Hi-Been working on alarms and equipment downtime analysis, and one issue we commonly run into on existing equipment is that they may have multiple alarm states active at the same time; for example "Light Curtain Broken" and "Reset Emergency Stop System" or similar.
Is there a way that you have suppressed other alarms within a tree while that first one is active?
My issue is that from a time keeping perspective, if I have 2 alarms true for 5 minutes, it counts as 10 minutes of alarm time, vs the reality of 5 minutes.
Any suggestions?

I would create an expression tag, based on the other tags, and set the alarm on it

That is sort of what I have been thinking/have done so far, and just make that roll up alarm easy to query, I just wasn't sure if there was a better approach.
Thanks!

The "first-out" alarm (or stop reason / code) should really be determined on the PLC. Trying to determine externally which of a cascade of alarms actually caused the stop is going to be very error-prone as the alarms may arrive in the wrong sequence and with timestamps different to the actual event.

Totally agree regarding the PLC needing to determine the first event! I'm in a different position, of not caring what the first event was, but just trying to determine the real lost time, if that makes sense.

If there's a run-stop bit then you could create an expression tag to combine that with a general fault tag. Logging that might do the trick.