Stress-test an oxygen bulk outage by proving that each hold window and restore rule can place bulk oxygen demand inside the planned supply lane, survive override pressure, and avoid trapping respiratory and plant teams inside a green tank slide that hides long-lived soft holds.
Oxygen bulk outages often list a tank checklist while leaving restore behavior, override authority, and abort ownership implicit. Those edges decide whether a late bulk delivery stays inside the respiratory packet or leaves a broken patient-oxygen path live under peak census. The exercise should follow actual bulk inventories, zone maps, and escalation paths rather than a clean tank dashboard.
Map the bulk-outage holds
List every oxygen bulk-outage class with its response window, waive rule, override behavior, owners, and notification channels. Mark paths that cannot reverse without a manual amendment. Attach the last three oxygen bulk-outage incidents with raw timelines and any waivers. Include the source of truth for open bulk counts during the observation window.
- A minority zone class keeps a side-channel while the aggregate oxygen dashboard stays green.
- A restore has already left a respiratory desk without a trusted bulk state.
- The primary bulk export lags beyond the planned observation window.
- An operator skips a bulk gate because a case cutoff is near.
- Automated and human divert messages collide under the new outage rule.
- Plant and respiratory claim different freeze owners for the same bulk class.
For each drill, identify detection time, unit impact, containment, and the authority to force an oxygen bulk-outage rollback. Require commands and dashboard links in the runbook.
Name detect and restore owners
Name detect, hold, divert, abort, and restore owners with exit conditions. Write the point after which a stuck bulk outage would require a different oxygen plan, then review whether that action is still permitted. Capture maximum acceptable dwell in measurable units, including which zone classes are excluded from the bulk-outage path and why.
Run the package in Pingpong with respiratory, plant, perioperative, and materials seats. Ask respiratory which patient decision becomes unsafe first if bulk holds still stick after the claimed window. Ask plant whether macros can absorb a forced override. Ask owners to show the exact bulk version or export used as the exit condition.
Related reviews include a medgas alarm rule, the plant ops lead seat, the materials ops lead seat, and a chiller failure drill. Browse the war-game decisions hub for adjacent controls.
Authorize the published bulk-outage path only after a timed drill restores usable hold hygiene inside the documented budget without an undocumented manual step.