War-game a chiller failure drill by proving each utility lane has a named owner, a measured age-out, and a reverse path before draft holds start governing every utility lane.
Chiller failure drills fail when "ready for restore" means a status without a decision artifact, when teams dual-count a draft hold as both aspirational and live, and when critical-temperature room families still pin to one thin plant desk because the lane inventory is incomplete. The review needs one written inventory of utility lanes, one owner who can deny a risky shortcut, and a documented consequence when a failed hold ages past the deadline.
Chiller break points
- A critical-temperature room class stays soft while the aggregate plant dashboard stays green.
- Two teams claim the same lane ownership and neither can force a freeze at week end.
- A restore has already left a building without a trusted hold state.
- The primary chiller export lags beyond the planned observation window.
- An operator skips a hold gate because a census cutoff is near.
For each break point, require detection time, unit impact, containment, and the authority to force a chiller failure drill rollback. Commands and export links belong in the runbook.
| Utility lane | Owner | Age-out | Reverse path |
|---|---|---|---|
| Primary chiller path | Named plant charge | Measured minutes | Documented hold |
| Redundant dual path | Plant ops | Measured minutes | Documented restore |
| OR temperature bridge | Facilities lead | Measured minutes | Documented re-route |
Fill every cell from stored exports. Empty cells block approval.
Lock one utility family before scale
State which chiller classes the drill covers, the effective date, which hold lanes change, how versions are stored, and what happens to buildings already in flight. Name the units that feel it first and the safety promises that depend on coherent plant handling. If the memo mixes a chiller failure drill with a water-system alarm and a room-turn SLA, split them.
Write the decision you will make if the war game finds nothing new. Also write the reverse criteria: the missed lane, temperature gap, or census deadline that would force a chiller failure drill rollback within a stated window.
Seat the utility package
Feed Pingpong the drill memo, the lane exhibits, and seating briefs for plant, facilities, perioperative, and infection control. First pass steelmans the drill. Later passes attack from those seats. Final pass turns surviving objections into phased lane rules, mitigations, or a changed recommendation. Agreement across passes is not proof. Keep the objections that still have evidence gaps.
Pair with the plant ops lead seat, the facilities ops lead seat, a water-system alarm stress test, and a room-turn SLA. More operating decisions live in the war-game decisions hub.
Ship the drill only when approved and blocked hold labels can be reproduced from stored chiller exports without a verbal override.