Stress-test a water system alarm by proving that each hold window and restore rule can place unanswered water alerts inside the planned lane, survive override pressure, and avoid trapping dialysis teams inside a green plant slide that hides long-lived soft holds.
Water system alarms often list a plant checklist while leaving restore behavior, override authority, and abort ownership implicit. Those edges decide whether a late alert stays inside the water packet or leaves a broken treatment path live under peak volume. The exercise should follow actual sensor inventories, plant maps, and escalation paths rather than a clean facilities deck.
Inventory before the drill
List every water alarm class with its response window, waive rule, override behavior, owners, and notification channels. Mark paths that cannot reverse without a manual amendment. Attach the last three water system alarm incidents with raw timelines and any waivers. Include the source of truth for open alert counts during the observation window.
Define the phases for detect, hold, divert, abort, and restore. Each phase needs an owner and an exit condition. Write the point after which a stuck alert would require a different procedure, then review whether that action is still permitted. Capture maximum acceptable dwell in measurable units, including which treatment modalities are excluded from the alarm path and why.
Include the calendar of known events for the next two quarters: plant maintenance blackouts, vendor delays, and census spikes that shrink the usable response window. A water budget that ignores those dates will look calm until the week they land.
Shortage scenarios worth timing
- A minority treatment bay keeps a side-channel while the aggregate water dashboard stays green.
- A restore has already left a plant without a trusted alert state.
- The primary water dashboard lags beyond the planned observation window.
- An operator skips an alarm gate because a shift cutoff is near.
- Automated and human divert messages collide under the new alarm rule.
- Abort authority is unclear at week end and the update lands on the wrong amendment.
For each scenario, identify detection time, plant impact, containment, and the authority to force a water system alarm rollback. Require commands and dashboard links in the runbook.
Ownership once the alarm window closes
Run the package in Pingpong with dialysis ops, facilities, biomedical engineering, and nursing seats. Ask dialysis ops which treatment decision becomes unsafe first if alerts still stick after the claimed window. Ask facilities whether plant macros can absorb a forced override. Ask owners to show the exact alarm version or export used as the exit condition.
Related reviews include the dialysis ops lead seat, a chair utilization freeze, an access infection ladder, and a reagent stockout stress test. Browse the war-game decisions hub for adjacent controls.
Authorize the published alarm path only after a timed drill restores usable hold hygiene inside the documented budget without an undocumented manual step.