Trigger, Propagation, and the Missing Barrier

Every outage has three parts, and separating them is the discipline that turns a scary story into a diagnosis. There is the trigger, the first thing that went wrong. There is propagation, the path by which that first failure spread. And there is the missing barrier, the defense that should have halted propagation and did not. Sloppy incident writeups blur all three into a single sentence. Your job as a reader is to pull them apart, because each carries a different lesson and each points at a different kind of decision.

Start with the trigger. Triggers cluster into a small number of families, and knowing the families lets you place any new incident quickly. There are electrical triggers: a utility feeder fault, a transformer failure, a breaker that trips on a fault it should have ridden through. There are mechanical and thermal triggers: a chilled-water pump that fails, a cooling loop that loses pressure, a heat-rejection system that cannot keep up on the hottest afternoon of the year. There are control and software triggers: a firmware update that bricks a fleet of power controllers, a building-management system that issues a bad command, a monitoring gap that let a slow drift go unnoticed until it became sudden. And there are human and procedural triggers: a mislabeled breaker opened during maintenance, a load-bank test connected to the wrong bus, a runbook step performed out of order. The trigger family matters because it tells you which part of the organization to interrogate. A recurring electrical trigger points at aging plant; a recurring procedural trigger points at training and change management.

Propagation is where the physics lives, and it is the part most readers skip. A failure spreads through whatever couplings exist between systems. Some couplings are obvious and intended, like the path from utility to transfer switch to distribution board. Others are hidden and unintended, and those are the ones that hurt. A classic hidden coupling is shared infrastructure that the redundancy diagram pretends is independent. Two power paths drawn as fully separate might in reality share a single conduit, a single cooling plant, a single control network, or a single earthing point. When the trigger hits that shared element, propagation jumps the gap that the design promised could never be crossed. Thermal propagation is especially cruel because it is fast and self-reinforcing: lose cooling in a dense hall and inlet temperatures can climb through safe limits within minutes, forcing servers to throttle or shut down and the whole hall to trip on over-temperature long before anyone can restore the chillers. Reading propagation means asking, at each step, what carried the failure forward, and whether that carrier was supposed to be there.

The missing barrier is the heart of the matter. Redundancy is a set of barriers, each meant to stop propagation at a defined point. Stored energy is a barrier meant to bridge the seconds between utility loss and generator load. A generator is a barrier meant to carry the facility for hours or days. An automatic transfer switch is a barrier meant to move load from a dead source to a live one without human intervention. A concurrently maintainable topology is a barrier meant to let any single element be serviced while the rest keep the load alive. When an outage reaches the customer, at least one of these barriers was absent or defeated, and the postmortem's real content is which one and why.

Barriers fail in recognizable ways, and cataloguing them sharpens your eye. A barrier can be depleted: stored energy that was sized for a few minutes but asked to hold for longer because a generator was slow to accept load. A barrier can be defeated by common cause: both redundant units disabled by the same underlying condition, such as two generators that will not start because both share a fuel-polishing system that clogged. A barrier can be mis-operated: a transfer switch that worked perfectly but transferred to a source that was itself already faulted. A barrier can be under maintenance, the redundancy spent in advance, which is why so many outages happen during planned work. And a barrier can be phantom, existing on the diagram but never actually commissioned or tested, discovered to be non-functional only at the moment it was needed.

Once you name the trigger family, trace the propagation path, and identify the specific way the barrier failed, you have read the outage. You can now say something an untrained reader cannot: not merely that the site went down, but that a common electrical disturbance found a shared conduit the design ignored and reached a load whose second barrier was already spent on maintenance. That sentence is a judgment. It tells you the operator underinvested in physical separation and scheduled risky work without a compensating control. Everything an investor or operator wants to know about a facility is encoded in sentences like that, and the trigger-propagation-barrier frame is how you learn to write them.