Single-Site Change Management Lab

A browser-based training lab where you act as the change manager for a fictional island packaging plant with an air-gapped network. Over three changes you classify the change, assess risk, choose approvers, plan testing, rollback, the window, communications and verification, and see a seeded outcome of what happened. It trains judgement about presence, timing and rollback, not tool syntax.

Every step, including the rollback, needs someone physically there. That changes what a good plan looks like: the fallback must be a device or a file on site that has already been proven, the window must put the right people on the island with margin before the last ferry, and the plan must survive weather that cancels travel.

On an air-gapped site there is no remote path, so a rollback that depends on connecting in from outside does not exist. In the switch change, rolling back "from the mainland" is the worst option, and a pre-staged spare with a proven configuration and a rehearsed swap is the best. The lab penalises a plan with no one on site to execute or undo the change.

A standard change is pre-authorised because its risk is understood, not because it can skip evidence. For offline media that means checking the vendor's signature and hash on a separate channel, scanning at the media kiosk and staging on a sacrificial HMI before the live panels. Air-gapped does not mean safe: media is a common way into an isolated network.

When there is active or imminent risk that cannot wait for the next board or the next maintenance day. A foreign USB stick on a workstation that can reprogram live PLCs qualifies. Emergency compresses the process, it does not remove testing, and the lab still expects approval on the fast path, a small safe step tonight, checks before reconnecting, and a review afterwards. An emergency can fall inside a freeze; a normal change cannot.

The night shift has no IT skills, so the safe step for them is small and rehearsed, such as unplugging a workstation under the runbook, while the skilled work waits for the first ferry. A plan that asks unskilled staff to do a skilled task by phone is penalised.

Each change hides a few risks, such as a bad flash, a missing device setting, a tampered file or a ferry cancellation. The seed fixes the dice. Tests, rollbacks, windows and approvers that address a risk make it much less likely to fire, and a good rollback or verification limits the damage if it does. The same seed, level and plan always give the same outcome.

Rookie shows a hint at each step and a "watch for" list of hidden dependencies, and has the lowest chance that an unmitigated risk fires. Pro hides the hints, but a good test plan reveals a hidden dependency as you choose it. Elite hides everything until the outcome and raises the chance that an unmitigated risk fires.

A Markdown change record per change, with type, risk, approvers, window, test, rollback, communications, verification, the simulated outcome and the process findings, and a CSV register of all three. Downloading and copying documents is Pro. You can read the same records on the debrief page.

No. Skerrow Packaging, its people, systems, ferry timetable and the skerrow.example domain are invented, and every outcome is simulated in your browser. Nothing here connects to a real controller or network.