Loading module…
Loading module…
Module 1 of 11
Rung one · the lens — deciding when the clock is running
A crisis does not wait for the analysis to be finished. The river keeps rising while the call is being arranged; the rumour keeps spreading while the facts are being checked; the window in which a decision can still protect people closes whether or not anyone has decided. That is what separates crisis work from every other kind of intelligence and decision-making: the clock is running, the picture is incomplete, and people must decide, act and communicate anyway — and afterwards, if the organisation is serious, learn. This course teaches that discipline: crisis intelligence and decision-making under pressure, the ability to read a crisis fast enough and honestly enough to act inside the time it allows, and to learn from it without lying to yourself about what happened. The method rests on six elements. The threat is what is at stake, always in the same order: life first, then assets, operations and reputation. The clock is how fast the situation moves — specifically, the time available set against the time a response needs. The picture is the situational awareness, kept in three separate lanes: what is known, what is assumed and what is not known, because the most dangerous error under pressure is to let an assumption travel as a fact. The decision is the set of choices and, for each one, who owns it. The message is what is said, to whom and when. The lesson is what the system learns and changes, so that the next crisis finds it better prepared. Every read in the course answers four questions: what is happening? what will it become? what do we do now? what did we learn? One fictional crisis carries the whole course: the night the river Vey came over the flood wall of the Aldren plant of Kestrel Motion, the servo-motor and drive maker whose network you may have met in Course 007. This module lays out the crisis clock, the transformation the course produces and the thirteen-rung method, and it states the boundary up front. People first: life safety comes before assets and reputation, and emergency services are called first. The course is analytic and organisational: it never replaces emergency, medical, psychological or legal professionals, and what it says about stress and wellbeing is general and evidence-based, never clinical advice.
The six elements are the periodic table of this course — the complete alphabet from which every crisis read is built — and the crisis clock is those six elements drawn on a single time axis, because in a crisis time is the dimension that governs all the others. The mechanism the clock shows is the one every crisis shares. The threat sets a deadline the organisation does not choose: the water will reach the low bays when the gauge says it will, not when the meeting ends. Every protective response has a lead time — moving about 180 people out of a plant at night took some 40 minutes — so the real deadline for deciding is the threat's arrival minus the response's lead time. That gap is the decision window, and it has a brutal property: every minute spent waiting for certainty is subtracted from it. The picture is how the organisation knows where it stands in that window, and its three lanes exist because items move between them. A claim enters as not known or assumed; only verification promotes it to known; and a board that lets an assumption sit in the known lane — "the wall holds to its design height" — will steer every decision taken from it. Decisions are points on the clock with owners attached, and their quality depends on where they fall in the window as much as on what they choose. Messages are decisions too: what is said at T+5h shapes what staff, neighbours and customers do at T+6h. And the lesson is the only element that changes the next clock rather than this one. The completeness argument is simple: to act well in a crisis you must know what is at stake, how long you have, what you actually know, what you are choosing, what you are saying and what you will change — and every module of the course reads one of these on the clock. Module 3 lights the phases; Module 4 the flags before onset and the decision to declare; Module 5 the board's lanes; Module 6 the competing projections of where the crisis is heading; Module 7 the stress and fatigue that bend judgement along the timeline; Module 8 the decision diamonds and their windows; Module 9 the crisis organisation docked to the clock; Module 10 the message cadence; Module 11 the decisions rehearsed before onset; Module 12 the reconstructed timeline, with what was known then set against what is known now. What falls outside the clock — doing the work of the fire service, a doctor, a counsellor or a lawyer — is routed to those professionals by the gate in Module 2.
Traced instance: the Aldren flood. The Aldren plant employs about 1,100 staff in three shifts, about 180 of them on the night shift, on the floodplain of the Vey, behind a wall designed for about 4.2 m at the Aldren Bridge gauge (normal level about 1.2 m; the public flood-warning threshold is 3.0 m). The substation sits in the site's low north-east corner; the solvent and coolant store stands on a raised plinth. After a wet month, with soils saturated, the national weather service issues a heavy-rain watch for the Vey basin at T−72h (T0 is 02:00 on the night of the flood) and upgrades it to a warning at T−36h; at T−20h the operator of the upstream Harlow reservoir announces controlled releases. At T−12h the gauge reads 2.6 m and is rising about 10 cm an hour; Kestrel's duty manager notes it; the night shift is kept on and finished goods stay in the low bays — a cost-driven call that must be judged on what was known then (the gauge still below the warning line, the wall designed for 4.2 m), not on what the night became. At T−6h the gauge reads 3.1 m and the authority issues a public flood warning. At T−1h (01:00) the night-shift supervisor reports water seeping under the wall's low section near the substation; the report reaches the plant manager only at 01:50 — fifty minutes lost to unclear escalation criteria. At T0 the gauge reads 3.8 m and the plant manager declares an incident and takes command on site; at T+1h the crisis management team (CMT) convenes by call with the COO in the chair; at T+2h the plant manager, as on-site incident commander and backed on the CMT call, makes the two life-safety calls: evacuate the night shift — all about 180 are out by T+2h40, with one worker treated on site for a minor injury after a slip and no other injuries — and de-energise the substation. At T+3h the gauge reaches 4.3 m and the low section, which had settled about 15 cm, is overtopped; the low bays flood to about 0.6 m. At T+4h a social-media post shows a rainbow sheen on the floodwater with the claim "toxic chemicals leaking from Kestrel". Graded on the clock, the three parts of that post are different things: that the post exists is fact, graded high; that there is a sheen on the floodwater near the plant is fact, graded moderate (one photo, its location not independently checked); that toxic chemicals are leaking from Kestrel is , graded — an unverified claim. On the board, "solvent store intact" sits in the assumed lane as an , graded (the store stands on a raised plinth), and the source of the sheen is . At the company issues a holding statement: aware, checking, people safe, next update by 11:00. At , at the 4.5 m peak, the EHS manager and the fire service verify that the solvent store is intact and that the sheen came from a submerged forklift's diesel and a small amount of water-glycol coolant — now , graded because two independent parties confirmed it on site; the environment regulator is notified, as required, booms are placed and a verified update is published. At Orrin Automation, the largest customer, is told its motor deliveries are at risk. The water is off site at ; motor production restarts on with about 40% of work-in-progress damaged; and the review in finds a wall flagged in two inspections but left unrepaired as "not urgent", a flood playbook four years old, escalation criteria nobody could state, and a rumour answered in five hours but verified only in nine.
The gap between the two is the whole value of the course, and each of the reactor's habits spends the decision window in a different way. The first is to wait for certainty. A reactor in the plant manager's chair at 01:50 would ask for proof that the wall was failing before declaring anything — but by the time the failure is certain it has happened, and the forty minutes an evacuation needs are no longer there. The second is to decide by gut, or not at all: under pressure, an unstructured mind either seizes the first option that feels decisive or freezes, and both look like leadership from a distance. The third is false reassurance. Faced with the T+4h rumour, the reactor says "there is no leak, everything is under control" before anyone has looked — and if the sheen had turned out to be something worse, every later statement from Kestrel would have been disbelieved. The fourth is to let rumour lead: silence does not stop a story, it hands the story to whoever posts first. The fifth, after the event, is to blame an individual — the supervisor whose report took fifty minutes to arrive, or whoever decided at T−12h to keep the shift on (the record does not say who) — when the review shows that nobody had been given criteria for when to escalate. The crisis analyst replaces each habit with a discipline. The analyst declares on the seepage report and the gauge, because declaring early is cheap and declaring late is not. The analyst decides good-enough-now and reversible first: at T+2h, evacuation can be undone by bringing people back and a de-energised substation can be switched on again, but a live substation under water cannot be un-flooded and an injured worker cannot be un-injured. The analyst says what is known, what is not and when the next update comes — which is exactly what the T+5h holding statement did — and grades every claim high, moderate, low or not known, labelled fact, assessment or speculation with its source. The real world keeps teaching the same contrast. When US Airways Flight 1549 lost thrust in both engines after a bird strike in 2009, the crew had a window of a few minutes and used it to decide on the Hudson River landing, from which everyone on board survived — a decision taken inside the window, not after it (Module 8 dissects how experienced people decide that fast). And the 1982 Tylenol recall, in which Johnson & Johnson pulled the product nationwide after capsules were found to have been poisoned, is still taught as a classic of putting people before product and of speaking early and candidly (Module 10 returns to it). The analyst holds one more discipline the reactor lacks: , which is what makes learning possible without making it cruel.
The course is thirteen modules, and the structure follows the four questions. After this orientation, Module 2, The Analyst's Discipline & Boundary, installs the six commitments that govern everything else. Modules 3 and 4 ask what is happening and how to see it coming: Crisis Typology & Lifecycle teaches what makes a situation a crisis, the types crises come in, the arc they follow and how they cascade; Early Warning & the Onset Decision teaches weak signals, the normalisation of deviance, thresholds and triggers, and the hardest single call in the course — declaring the crisis. Modules 5 and 6 build the picture of what it is and what it will become: Collection & Situational Awareness covers the collapsed intelligence cycle, crisis sources, verification at speed and the known / assumed / not-known board; Sensemaking Under Uncertainty covers framing and reframing, competing explanations, short-horizon projection and the traps that capture minds under pressure. Modules 7 to 10 answer what do we do now: Cognitive Performance Under Stress explains what acute stress and fatigue do to thinking and which general, evidence-based supports help; Decision Frameworks for Time-Compressed Situations teaches recognition-primed decisions, satisficing, decision cycles and reversible, no-regret moves; Crisis Leadership & Coordination organises people, decision rights and the briefing rhythm; and Crisis Communication treats every message as part of the decision. Modules 11 to 13 answer what did we learn and carry it forward: Scenarios, Playbooks & Exercises prepares the organisation before the clock starts; Post-Crisis Analysis & Learning reconstructs the crisis honestly and turns lessons into tracked change; and the Capstone: One Crisis, End to End runs the whole method on the Aldren flood. Every module from 2 to 12 is built the same way — six atoms, the sub-techniques of its rung, each dissected through six fixed fields: What it is, its Structure (drawn on the crisis clock), the Technique as a numbered procedure, its Properties and failure modes, When to use it and when not, and it connects to the rest. The Aldren flood is traced through every atom. Its world is shared with other Tricellix courses — Kestrel Motion, its Aldren and Brask plants in the Meridian Union and its largest customer Orrin Automation come from Course 007, and Course 011 teaches the written products an analyst drafts under this kind of pressure — so the method stays concrete without borrowing anyone's real tragedy. The roles in it are named by role only: the COO, the plant manager, the EHS manager, the facilities engineer, the communications lead, the HR lead and the night-shift supervisor.
This is a dissection course, not a survey: every technique is broken down to its mechanism and its procedure, so you finish not with opinions about crises but with a repeatable method you can run on a real one. Three things to hold onto as you go. First, people first, always first: every read starts by asking who is in danger and whether the emergency services have been called, and assets, operations and reputation are protected only after that — a plan that saves the stock and endangers the night shift is a failed plan, however much it saves. Second, decide inside the window with the picture you have: in a crisis the perfect answer that arrives after the water does is worth less than a good-enough answer that arrives in time, so decide on a graded picture, prefer the moves you can undo, say plainly what you do not know, and keep adjusting as the lanes of the board change. Third, judge on what was known then: when you look back at the T−12h decision to keep the shift on or the fifty minutes before 01:50, reconstruct what the people in the room could see before you judge what they did — hindsight makes every warning look obvious, and an organisation that punishes people for hindsight teaches its staff to hide the next warning. One note on scope: Module 7 discusses stress, fatigue and wellbeing in general, evidence-based terms for the purpose of keeping judgement working; it is not clinical advice, and anyone affected by a crisis — including the people managing it — should be pointed to professional support. Hold those three and the rest is detailed machinery. Module 2 makes the discipline explicit first, because a method built for speed is only safe when it is held to a strict standard of honesty.
Before the first flag is read, the course installs the discipline that governs the whole method. Module 2 is the analyst's boundary: intelligence that serves a decision that cannot wait, which values a good-enough answer now over a perfect one too late; calibrated honesty under pressure, which grades every judgement and never offers false reassurance; fact, assessment and speculation with provenance, held firm even when a rumour is spreading faster than the checks; people first, which puts life safety before assets and reputation, calls the emergency services first and never replaces emergency, medical, psychological or legal professionals; lawful and ethical conduct under pressure, from required notifications to the privacy and dignity of the people affected; and learning without blame, which fixes systems while keeping accountability honest. The crisis clock is a powerful instrument; Module 2 is what keeps it accurate and humane.
The signature image of the course: the Aldren flood on one timeline, from the heavy-rain watch at T−72h to the post-crisis review in week 6. Phase bands run across it — warning, onset, escalation, peak, recovery, learning (the peak from about T+9h). Above it sits the situation board, with separate lanes for what is known, what is assumed and what is not known; on it, signal flags mark what the world was saying, diamonds mark the decisions and name their owners where the record does, and boxes mark the messages. The shaded band is the decision window, from the 01:00 seepage report to the overtopping about four hours later, with its first 50 minutes (the red bar) lost to unclear escalation. Below, the Vey gauge at Aldren Bridge climbs towards the wall's design line. Every later module lights one part of this clock.
The transformation the course produces. The reactor sees the crisis only once it is undeniable, waits for certainty, decides by gut or not at all, offers false reassurance and then has to correct it, lets the rumour set the story, and blames an individual afterwards. The crisis analyst reads weak signals and declares early on set criteria, builds a graded picture of what is known, assumed and not known, decides good-enough-now with reversible moves first, speaks first, right and credible on a cadence, protects people before assets, and learns by fixing the system. Same river, same night; the difference is where on the clock each one decides.
How the course is built. Phase 1 sets the lens and the discipline (Modules 1–2). Phase 2 asks what is happening and how to see it coming — typology, lifecycle and early warning (Modules 3–4). Phase 3 builds the picture of what the crisis is and what it will become — collection and sensemaking (Modules 5–6). Phase 4 asks what to do now — the mind under stress, the decision methods, the crisis organisation and communication (Modules 7–10). Phase 5 asks what was learned and carries it forward — rehearsal, the post-crisis review and the capstone (Modules 11–13). People first and learning without blame run under every rung.