Emergency Response · Controlled Procedure
VC-SOP-0409 — CHLORA Auto-Response Override & Manual Reversion
When and how to override CHLORA's automated containment and climate auto-responses, revert affected systems to manual control, and safely hand control back to automation — defining authority levels, two-person confirmation for high-tier overrides, and the logging that every override demands.
CHLORA is presumed correct. An override is a deliberate decision to substitute human judgement for an automated containment or climate action — log it, justify it, and own it. No override may leave a containment boundary in a less-safe state than CHLORA's auto-response would have held. High-tier overrides require two-person confirmation; a lone operator cannot disarm a Tier-3+ auto-response. Reversion to automation is itself a controlled step, never a default-on.
1. Purpose
To define the controlled procedure for overriding CHLORA's pre-authorized automated countermeasures — bulkhead seals, suppression, sterilization sweeps, climate setpoint slews — when a human operator has cause to substitute manual control, and to govern the safe, verified hand-back to automation. The objective is to preserve containment integrity while allowing necessary human intervention, with full traceability of who overrode what, when, and why.
2. Scope
Applies to all CHLORA automated containment and climate auto-responses across the four facility zones, and to every operator authorized to invoke an override. Breach response is governed by VC-SOP-0401; lockdown sealing by VC-SOP-0404; climate setpoint baselines by VC-SOP-0142. Live auto-response state and override events are surfaced on Monitoring Systems. Excludes routine operator setpoint adjustments within nominal bands, which are not overrides.
3. Definitions
| Term | Definition |
|---|---|
| Auto-Response | A pre-authorized automated CHLORA countermeasure (seal, suppress, sterilize, climate slew) armed or executed against a trigger. |
| Override | A deliberate human action to inhibit, hold, or reverse an armed or executing auto-response. |
| Manual Reversion | The state in which the affected system is under direct operator control with automation suspended for that system. |
| Two-Person Confirmation | Independent authorization by two qualified operators, neither able to complete the action alone, required for Level-3 and Level-4 overrides. |
| Hand-Back | The verified return of an overridden system to CHLORA automation after conditions are confirmed safe. |
| Override Window | The time-boxed duration an override remains valid before it auto-expires and CHLORA re-asserts the auto-response. |
4. Responsibilities
| Role | On Override |
|---|---|
| Watch Commander (Owner) | Authorizes Level-3 overrides; second-confirms Level-4; owns this SOP and the override log review. |
| Director of Ops | Sole authority for Level-4 override of a GCL-4 containment auto-response; notifies the CBO. |
| Console Operator | Invokes Level-1/2 overrides within authority; requests higher-level overrides; drives manual control during reversion. |
| Containment Officer | Required second person for any override touching a containment boundary (Level-3+). |
| CHLORA | Enforces authority gating; demands second-person confirmation at Level-3+; logs every override and hand-back; re-asserts the auto-response at window expiry unless extended. |
5. Equipment & Pre-Checks
- Authenticated operator credentials with current authority level on the override console
- Live auto-response state board readable on Monitoring Systems
- Second-person presence confirmed and credentialed for any anticipated Level-3+ action
- Manual control surfaces for the target system tested responsive within the shift
- Override window timer and audible expiry warning verified functional
- MDF override-log channel reachable and timestamping
6. Override Authority Levels
| Level | Auto-Response / Trigger | Who May Authorize | Confirmation | Reversion Requirement |
|---|---|---|---|---|
| L-1 | Climate setpoint slew, single zone, no containment effect | Console Operator | Single operator | Setpoint returned to baseline band (VC-SOP-0142) before hand-back |
| L-2 | Non-containment suppression / ventilation hold | Console Operator (logged) | Single operator | Conditions clean; window ≤ 30 min auto-expiry |
| L-3 | Containment bulkhead seal or sterilization sweep, GCL-1..3 | Watch Commander | Two-person (Watch Cmdr + Containment Officer) | Boundary integrity 100% verified before hand-back; window ≤ 15 min |
| L-4 | GCL-4 containment auto-response (seal / sterilize / Bio-Vault lock) | Director of Ops | Two-person (Director + Watch Cmdr) + CBO notice | CBO-acknowledged integrity verification; window ≤ 8 min, no auto-extend |
CHLORA standing authority holds. At a declared Tier-4 breach (VC-SOP-0401), CHLORA seals and sterilizes without waiting for human confirmation. An override does not erase that authority — it momentarily borrows it, under two-person control, and returns it. If the override window expires, CHLORA re-asserts the auto-response automatically.
7. Procedure
7.1 Justify & Classify the Override
- The requesting operator states the target auto-response, the override level (Section 6), and a one-line justification on the override console.
- CHLORA gates the request against the operator's authority; an under-authorized request is escalated, never silently granted.
- For Level-3+, CHLORA requires a credentialed second person physically present before the override arms.
7.2 Two-Person Confirmation (Level-3+)
- The authorizing role and the required second person each authenticate independently within a 20 s co-confirm window.
- For Level-4, the Director of Ops authorizes, the Watch Commander second-confirms, and CHLORA dispatches a CBO notice before the override takes effect.
- If either confirmation lapses, the override is denied and the auto-response remains in force.
7.3 Engage Manual Control
- On confirmation, CHLORA suspends the named auto-response for the target system only and opens the override window timer.
- The Console Operator assumes direct manual control; all other CHLORA automation outside the override scope continues unaffected.
- CHLORA displays a persistent override banner and counts down the window; an audible warning sounds at T-60 s to expiry.
7.4 Verify & Hand Back to Automation
- Before hand-back, confirm the system is in a safe state — climate within baseline band, containment boundary integrity at 100%.
- The operator initiates hand-back; for Level-3+ the same two persons co-confirm the return to automation.
- CHLORA re-arms the auto-response, closes the override window, and logs the hand-back. An expired window without hand-back triggers automatic re-assertion and a flagged log entry.
7.5 Quality Checkpoints
- Override level correctly classified against the authority table
- Two-person co-confirmation captured for every Level-3+ override
- CBO notice dispatched for every Level-4 override
- No system handed back outside its safe-state criteria
- Override window never silently extended at Level-4
- Every override and hand-back present in the CHLORA log with justification
8. Records
- CHLORA override log — request, level, authorizers, justification, window, hand-back (retained 10 years)
- Two-person confirmation record for Level-3+ events
- CBO notice acknowledgements (Level-4)
- Safe-state verification at hand-back
- Flagged auto-expiry / re-assertion events for review
9. References
- VC-SOP-0401 — Containment Breach Emergency Response
- VC-SOP-0404 — Facility Lockdown & Evacuation Routing
- VC-SOP-0142 — Climate Control Setpoint Baselines
- Monitoring Systems · Operational Metrics
10. Revision History
| Rev | Date | Author | Summary |
|---|---|---|---|
| A | 2088-07-21 | Watch Commander | Initial issue; override authority levels L-1..L-4 defined. |
| B | 2089-12-04 | Watch Commander | Override windows and auto-expiry re-assertion added. |
| C | 2090-11-30 | Watch Commander | Two-person confirmation hardened for L-3+; CBO notice on L-4; hand-back co-confirmation. CBO approval. |