PLAYBOOK
Manual override procedure
A manual override that has never been rehearsed is a sentence in a document. This is the procedure, and the way to prove it.
Who may act
Name one accountable human and one substitute. If the answer is “whoever is on call”, you have a rota, not an owner.
Steps
- State the safe state. Not “off” — the condition in which the system is stopped without harm to people, data or dependent services.
- Reach the control. It must be reachable without the system: a physical switch, a bypass valve, a documented command on a machine independent of the vendor.
- Execute by hand. Ordered steps, with the tool named for each. If a step says “use the console” and the console is what failed, the step is fiction.
- Verify. Confirm the system stopped — not that it reported stopped.
- Handle dependents. Degrade deliberately; the cascade is what hurts people.
- Record. Time, actor, reason, state.
Rehearsal checks
| Test | Pass condition |
|---|---|
| Time to safe state | Under the agreed limit, without vendor help |
| Second person | Someone else completes it from the written procedure alone |
| Dependents | No unplanned outage beyond the agreed list |
| Restart | Back in service without reintroducing the fault |
Never rehearse on a medical device, a lift, gas equipment, or a live system that keeps someone alive or mobile.