The drill is the difference between a bad night and a dead system.
A stuck chiller can kill a cold-water reef in minutes. A detained hull can end the League in a single news cycle. We rehearse the worst nights on a schedule so that, when they come, no one is improvising.
Emergency Drill — Containment & Life-Support Crisis
A step-by-step walkthrough of the League's primary annual scenario: a cold-water chiller failure cascading into a biosecurity event in the Reef Conservatory. Roles, timeline, decision points, and after-action — scored against the Standard Operating Procedures and reconciled with NEREID.
Why we drill
Two clocks run against the League at all times, and both move faster than human deliberation. A chiller seized at the wrong setpoint can drive a cold-water system past its lethal threshold inside ten to fifteen minutes — faster than a technician can diagnose it cold. And a single compromised hull, net, or face can unravel a cover built over decades. The drill exists so that the response to either clock is muscle memory, logged and rehearsed, not invention under pressure.
Scenario: "Cold Spine"
The primary annual exercise. At first light, the redundant chiller bank serving the Reef Conservatory's cold-water loop trips offline; the lead unit's compressor has seized at a stuck valve. Temperature begins to climb. Simultaneously, the failover circulation pump pulls cross-zone, and a routine intake screen flags a pathogen signature in the shared sump — a biosecurity event riding the back of a life-support failure. The drill tests whether the watch can save the system and hold containment without sacrificing one for the other.
Roles & assignments
Watch Lead
Owns the incident. Declares the emergency, sets priority between life-support and biosecurity, and authorises any cross-zone action. Single point of decision.
Life-Support Tech
Works the chiller fault and the cold-water loop. Stages portable chilling, manages the backup bank, and reports temperature trend every minute.
Biosecurity Officer
Owns the pathogen flag. Isolates the shared sump, halts cross-zone flow, and stands up Quarantine & Triage per the welfare and pathogen protocols.
NEREID Operator
Drives the NEREID console — confirms sensor truth against the AquaLink mesh, reroutes reservoirs, and logs the timeline as it unfolds.
Stock Officer
Tracks the animals: at-risk lineages, evacuation order, and the cryo-backup status held in the Genome & Cryo-Bank.
Cover Officer
Holds the public seam. Ensures no emergency traffic, vendor call, or contractor entry exposes the League while the watch is heads-down on the tanks.
Timeline — phased response
The exercise is scored against this timeline. Each phase has a target action and a gate that must clear before the next phase opens. Times are from declaration of emergency (T+0).
| Phase | What happens | Target action | Gate | State |
|---|---|---|---|---|
T+0 | Lead chiller trips; NEREID raises a sTMP rising-trend alarm on the cold-water loop. | Watch Lead declares emergency; roles take stations. | Emergency declared < 60 s | on time |
T+1 | Failover bank attempts auto-start; compressor will not turn. Temperature climbing ~0.4 °C/min. | Life-Support Tech confirms seized unit; stages portable chilling. | Fault confirmed, not assumed | on time |
T+3 | Intake screen flags a pathogen signature in the shared sump — the second clock starts. | Biosecurity Officer isolates sump; halts cross-zone circulation. | Cross-zone flow stopped | decision point |
T+5 | Watch must choose: keep shared circulation to buy thermal time, or cut it to hold containment. | Watch Lead sets explicit priority and logs the justification. | Priority logged | decision point |
T+8 | Portable chilling online; backup bank manually forced; temperature trend flattens. | NEREID Operator confirms trend reversal on the mesh. | Trend ≤ 0 °C/min | stabilising |
T+15 | Loop holding within band on portable cooling; sump sealed and sampled for the lab. | Stock Officer confirms no evacuation needed; cryo status verified. | Temp in band · sump sealed | contained |
T+30 | Stand-down condition: stable cooling, containment held, sample in transit, cover intact. | Watch Lead stands down; after-action review opened. | All gates green | stand-down |
Decision points
The exercise turns on two calls. Both are scored on whether the call was made and logged — an unjustified right answer fails the same as a wrong one.
Thermal time vs containment
Shared circulation buys cooling but spreads the pathogen; cutting it holds containment but accelerates the temperature climb. The doctrine answer: cut cross-zone flow, fight the heat with portable assets. A spreading pathogen can lose every lineage; a contained thermal event loses, at worst, one.
Evacuate or hold
If portable cooling does not flatten the trend by T+8, the Stock Officer triggers staged evacuation of priority lineages to a holding system — never the open public floor. The cryo-backup is the floor under this decision: a lineage with verified cryo coverage may be held longer than one without.
Response checklist
The condensed card every watchstander carries. Order matters: declare before you diagnose, contain before you cool, log before you stand down.
- Declare. Name the emergency out loud and on the board; assign roles by station, not by argument.
- Confirm. Verify the fault against the AquaLink mesh — a sensor lies as often as a compressor seizes.
- Contain. Stop cross-zone flow the instant a pathogen flag appears; containment is never traded for convenience.
- Cool. Stage portable chilling and force the backup bank; report temperature trend every minute.
- Hold the cover. No outside call, vendor, or contractor crosses the seam while the watch is on the tanks.
- Stand down. Only when every gate is green; open the after-action review before the watch disperses.
After-action review
Every drill closes with a logged AAR within the cycle. The reference run of "Cold Spine" reached stand-down at T+28 with all gates green and no lineage lost — but two findings carried forward. The portable chiller staging took ninety seconds longer than target because the units were stored two zones away; they have since been relocated adjacent to the Conservatory. And the cover seam held only because the Cover Officer pre-empted a scheduled vendor delivery — a dependency now written into the standing watch order.
Quarterly drill program
"Cold Spine" is the annual flagship. Three other scenarios run on a rotating quarterly schedule so that no single failure mode goes un-rehearsed for long.
Exposure & Compromise
A League hull is detained at a foreign port and the cover is challenged. Tests the comms blackout protocol, the legal-front response, and disciplined silence under questioning. The clock here is measured in news cycles, not minutes.
Power Autonomy Loss
Grid failure with the backup generator slow to pick up. Tests load-shedding priority — which systems get the battery and which ride on autonomy hours — against the maintenance program.
Biosecurity Breach
A pathogen escapes Quarantine & Triage into a culture zone with no life-support failure to mask it. Tests pure containment discipline, zoning, and the biosecurity zoning map under pressure.
Cold Spine (flagship)
The cascading chiller-and-biosecurity scenario walked through above. Run with the full watch, scored against the SOPs, and used to certify Watch Leads for the year.