Engineering Choices
  • Read the Book
  • Simulate
  • Learn
  • Chapters
  • About
Read the Book Simulate Learn Chapters About
Eight Lessons
©2026 Nelson de Sa e Silva • Engineering Choices • engineeringchoices.ai

Lesson 1 — The State Space and P

You are the director of an emergency department. Not a hypothetical one. One with a census board that updates every fifteen minutes, a charge nurse who knows things before the computers do, and a Thursday night that reliably becomes something you did not plan for.

At any given moment, your department is in a specific configuration. Call it a state.

The state is not one number. It is the combination of every variable that matters simultaneously: how many beds are open, how many nurses are on the floor, whether imaging is available, what the wait time looks like, whether you are on diversion, what your pharmacy turnaround is, how many critical patients are being held. All of it, taken together, is one state.

Change any one of those variables and you are in a different state. Not a modified version of the same state — a different state. The state where you have four open beds and CT available is not the same state as the state where you have four open beds and CT down. The difference matters. It changes what you can do next.

The collection of all possible states your department could occupy — every combination of every variable you manage — is the state space. Most of those combinations you will never be in. But they exist, and some of them are traps.

The transition matrix P.

From any state you are currently in, you can move to other states. A bed opens when a patient is discharged. A nurse calls out sick. The CT comes back online. The ambulance bay takes three arrivals in twelve minutes. Each of those events moves you from one state to another.

P is the map of all those possible moves and how likely each one is.

P(i,j) is a single number — the probability of moving from state i to state j in one step.

Three things to hold onto:

First — most entries are zero. You cannot go from a state where you are fully staffed to a state where you are simultaneously fully staffed and short three nurses. You cannot go on diversion and simultaneously be accepting patients. The zeros in P encode what is impossible.

Second — the non-zero entries are your actual options. A high probability means that transition happens routinely — a bed opens at a predictable rate based on your average length of stay. A low probability means it can happen but rarely does. These non-zero entries are the moves available to you from where you are standing right now.

Third — every row sums to 1. From any state, you must go somewhere. Even staying in roughly the same configuration is a transition — to a state that looks like the current one. The probabilities of all transitions out of state i add to 1.

Where do these numbers come from?

Your data. Six months of bed census logs. Staffing records. Imaging uptime reports. Diversion history. The numbers exist. You have been generating them every day without formalizing them. P makes them explicit.

Q1. What constitutes a 'state' in the emergency department context?

Q2. What do the zero entries in the transition matrix P represent for an emergency department?

Q3. Where do the probability values in P actually come from for a real emergency department?

©2026 Nelson de Sa e Silva • Engineering Choices • engineeringchoices.ai

Lesson 2 — Absorbing States

There is a state your department cannot leave.

Formally: an absorbing state is a state where P(i,i) = 1. The probability of transitioning from that state to itself is 1. Which means the probability of transitioning anywhere else is zero. Every row sums to 1 — so if P(i,i) = 1, nothing is left for any other transition. You are there. You stay there.

You know what this looks like in practice. Not the mathematical version — the human one.

The unit where every senior nurse has left. The one where the replacement staff cycle through every few weeks and leave. The one where the remaining experienced nurses are too stretched to orient the new ones properly, so errors increase, so morale drops further, so more experienced staff leave. No one decided to create this. Each individual decision that produced it was defensible. But the department is now in a configuration it cannot exit from within. Someone has to intervene from outside — bring in a crisis management team, restructure the unit, reassign leadership — to move the system to a different state.

That is an absorbing state. Or close enough to one that the distinction is academic.

Most organizations never hit a perfect absorbing state.

What they hit is a region that behaves like one — where the exit probabilities are so small they are functionally zero. P(i,i) = 0.94, with the remaining 0.06 distributed across transitions that require things not currently available: a sudden influx of experienced staff, a drop in patient volume, emergency capital for equipment that has been deferred for three budget cycles.

Technically not absorbing. Operationally absorbing.

This is why the framework uses a viability threshold θ — a floor below which a transition probability doesn't count as a real option. A transition with 0.3% probability is not an exit strategy. θ draws the line between theoretical exits and actual ones.

How does a department arrive here?

Almost never in one step. That is the insidious part.

The decision to not renew the float pool contract saves money — a defensible choice when the census is manageable. The decision to defer the CT maintenance saves more money — defensible when imaging needs are being met. The decision to reduce the travel nurse budget when utilization looks low — defensible when the current staff is covering. Each decision, evaluated locally and in the moment, passes review.

What no one is watching is the cumulative effect on P. Each decision modifies the transition matrix. Some exits become less probable. Some states become unreachable. The row that used to sum to 1 across many destinations now concentrates on fewer. The department is converging — not because anyone decided to converge it, but because no one was measuring what was happening to the available moves.

This is convergent optimization. Not negligence. Not incompetence. Rational local decisions producing an outcome no one intended.

Two kinds of zeros.

A structural zero is permanent. It is in the physics. You cannot go from a state where the CT is operational to a state where it is simultaneously operational and broken. That zero is fixed.

A convergent zero arrived because of decisions. The state where your float pool covers a short-staffed shift used to be reachable. After the contract cancellation, it is not. That zero was not always there. It is the result of a choice that looked reasonable at the time.

The convergent zeros are the dangerous ones. They are invisible until you are looking at P directly. And almost no department head looks at P directly — because until now, there was no way to.

Q1. Which of the following best describes a functional absorbing state in a hospital unit?

Q2. The decision not to renew the float pool contract is described as 'defensible.' What makes it dangerous in the framework's terms?

Q3. What is the difference between a structural zero and a convergent zero in the transition matrix?

©2026 Nelson de Sa e Silva • Engineering Choices • engineeringchoices.ai

Lesson 3 — Shannon Entropy

You are standing at the charge nurse station at the start of a shift. You have looked at the census board. You know your staffing. You have a sense of the department.

How do you describe that sense in a number?

Not your current volume — that is a census figure. Not your staffing ratio — that is a single variable. What you are actually sensing is something harder to name: the spread of what could happen next, and how many of those things you could handle.

That is entropy.

Claude Shannon was an engineer at Bell Labs in 1948. His problem had nothing to do with hospitals. He was trying to measure how much information a communication channel could carry. His insight was that information and uncertainty are the same thing measured from different directions. A message that tells you something you already knew contains no information. A message that surprises you contains a great deal.

He needed to measure uncertainty precisely. The formula he arrived at became the foundation of information theory. We are going to borrow it for a different purpose.

Start with a simple version.

From your current state, you can transition to several other states tomorrow. Suppose there are five: fully functional, short one nurse, short two nurses, CT down, and on diversion. If those five outcomes are roughly equally likely — each with about 20% probability — your uncertainty about tomorrow is high. You genuinely do not know which way things will go. Shannon entropy is at its maximum for five equally probable outcomes.

Now suppose you know your contract with a staffing agency guarantees full coverage tomorrow, imaging is freshly serviced, and your census is predictably low. One outcome dominates — fully functional, probability near 1.0. You have almost no uncertainty about tomorrow. Shannon entropy is near zero.

Now suppose your department is in the middle of a surge, three nurses have already called out, CT has been unreliable for two weeks, and you are holding twelve patients waiting for beds upstairs. One outcome dominates in the other direction — you are almost certainly going on diversion, probability near 1.0. Entropy is again near zero. But the certainty is the wrong kind.

This reveals something important. Low entropy means you know where you are going. But it says nothing about whether that destination is good or bad. High entropy means genuine uncertainty — which is the mathematical expression of having real options.

The formula.

H(i) = −Σⱼ P(i,j) log P(i,j)

Read it as: for every state j you could transition to from state i, multiply its probability by the log of its probability. Sum those products. Flip the sign.

When probabilities are spread evenly, each P(i,j) log P(i,j) term contributes meaningfully to the sum. Entropy is high.

When one probability dominates — say 0.95 — that term contributes nearly everything. The others contribute almost nothing. Entropy is low.

When one probability equals exactly 1.0, its log is 0. Every other probability is 0. Their logs are undefined, but the convention is that 0 · log(0) = 0. The sum is 0. Entropy is zero. You have no options.

Why log?

The logarithm compresses large differences and expands small ones. A transition with probability 0.01 and one with probability 0.001 are very different in absolute terms — one is ten times more likely. But in terms of what each contributes to your real optionality, the difference is smaller than it appears. The log captures that. It also ensures that the entropy of two independent uncertain situations adds correctly — a mathematical property that makes the formula work at scale.

What plain entropy does not capture.

It treats all destinations as equally desirable.

Being equally uncertain between "fully functional tomorrow" and "on diversion tomorrow" is not the same as being equally uncertain between two good outcomes. Shannon entropy in its plain form registers both as equivalent spreads. It measures how many options you have, but not how good they are.

That is the limitation H(i) hits. And it is what the next lesson fixes.

Q1. In the emergency department context, what does high Shannon entropy H(i) indicate?

Q2. A department in the middle of a crisis surge — nearly certain to go on diversion — has entropy near zero. What does this mean?

Q3. What is the key limitation of plain Shannon entropy H(i) that motivates H_w(i)?

©2026 Nelson de Sa e Silva • Engineering Choices • engineeringchoices.ai

Lesson 4 — H_w(i)

You are the ED director. It is Monday morning. You have reviewed your staffing for the week and checked your supply levels. From your current state, you can see six possible configurations for tomorrow — six states your department could plausibly be in.

Plain entropy says: six roughly equally probable destinations. High optionality. Good position.

But you look more carefully. Three of those six states involve being short-staffed. Two involve imaging being degraded. One is the state where everything is working and your department is operating at its designed capacity.

Shannon entropy sees six equally probable destinations and reports a high score. What it misses is that five of them are states you do not want to be in. You do not have six real options. You have one good option and five bad ones.

This is the gap H_w(i) closes. It measures not just how many options you have, but how good they are.

Enter V(j).

V(j) is a value weight — a number between 0 and 1 — assigned to each state j. It encodes how desirable that configuration is.

V(j) = 1.0 means the state is ideal: fully staffed, imaging up, inventory healthy, accepting patients, operating at designed capacity.

V(j) = 0.0 means the state is a trap or operationally impossible.

Everything else falls between. A state where you are short one nurse but otherwise functional might be V(j) = 0.7. A state where you are on diversion and holding eight patients might be V(j) = 0.2.

Who assigns these numbers?

Your organization does. The director of nursing, the medical director, the chief operating officer, the finance lead, the risk team — they sit down together and characterize what a good state looks like versus a bad one.

This is the most demanding step in the process. Not because the math is hard — it is not. Because the moment you assign V(j) values, you have made explicit what you are actually optimizing toward. Disagreements that have been papered over for years surface immediately.

Is a state where you are on diversion but your staff is at full strength better or worse than a state where you are accepting patients but running short? That is not a math question. It is a values question. The math forces you to answer it.

The formula.

H_w(i) = −Σⱼ P(i,j) · V(j) · log P(i,j)

Compare to plain entropy:

H(i) = −Σⱼ P(i,j) · log P(i,j)

The only difference is V(j) inserted between P(i,j) and log P(i,j).

What that insertion does: it scales each transition's contribution to entropy by how desirable its destination is. A transition to a high-value state — V(j) near 1 — contributes nearly its full weight. A transition to a low-value state — V(j) near 0 — contributes almost nothing. A transition to an impossible or catastrophic state — V(j) = 0 — contributes exactly nothing, regardless of its probability.

Back to your Monday morning.

Six transitions. Five toward degraded states with V(j) between 0.1 and 0.4. One toward the fully functional state with V(j) = 0.9.

Plain entropy H(i): high. Six equally probable destinations.

Weighted entropy H_w(i): much lower. Five of those destinations are heavily discounted by their V(j) values. The spread that looked reassuring is mostly spread toward places you do not want to be.

When your department signed the exclusive laundry contract last year, the day after signing, H_w(i) dropped. Not because you had fewer transitions — you still had the same number on paper. But some transitions that used to lead to high-value states — states with flexible linen supply and backup arrangements — now led to states with constrained options. Good transitions contracted. H_w(i) captured that. No one was looking at it.

What H_w(i) tells you.

A high H_w(i) means you have meaningful spread across desirable destinations. You are well-positioned right now.

A low H_w(i) means one of three things: you have few options regardless of quality, you have options but they are mostly bad, or both.

The number does not just tell you something is wrong. It lets you decompose which problem you have — which tells you where to intervene.

H_w(i) answers the question you are already asking every Monday morning. It just gives you the answer as a number.

Q1. On Monday morning the ED director sees six equally probable configurations for tomorrow. H(i) is high. But five of the six states involve degraded operations. What does H_w(i) show?

Q2. Why is the V(j) assignment conversation described as the most demanding step in the process?

Q3. The day after signing the exclusive laundry contract, the department's H_w(i) dropped. Why — no staff left, no equipment failed.

©2026 Nelson de Sa e Silva • Engineering Choices • engineeringchoices.ai

Lesson 5 — Matrix Exponentiation and D(i,n)

H_w(i) tells you how well-positioned you are right now.

It says nothing about next month.

You could have excellent immediate options — H_w(i) is high, the department is well-staffed, imaging is functional, census is manageable — and still be on a trajectory that will leave you with almost no options in ninety days. The good position you are in today is the result of decisions made months ago. The position you will be in ninety days from now is the result of decisions you are making today. H_w(i) cannot see that.

D(i,n) can.

D(i,n) counts how many viable states remain accessible to you at horizon n — at n steps into the future. It is a projection, not a snapshot.

To get there, we need one more mathematical tool: matrix exponentiation.

Pⁿ.

P is your transition matrix. P(i,j) is the probability of moving from state i to state j in one step.

Pⁿ is P multiplied by itself n times. P² = P × P. P³ = P² × P. And so on.

Pⁿ(i,j) is the probability of being in state j exactly n steps from now, starting from state i today.

Think of it as light spreading through your state space. Each multiplication of P propagates the probabilities one step further out. After one step, you see where you could be tomorrow. After thirty steps, you see where you could be in a month — accounting for every path of every length that connects your current state to each possible future state.

A concrete version.

Your department is in state i today. From here, in one step, you can reach fourteen states above your viability threshold — fourteen configurations that are genuinely operational. That is your D(i,1): the number of viable configurations accessible tomorrow.

Now look further out. At n = 30 — one month — Pⁿ(i,j) tells you the probability of being in each state j after thirty transitions. D(i,30) counts how many of those states are still reachable above the threshold θ. Suppose that number is nine.

At n = 90 — three months — D(i,90) = 4. Four viable configurations remain genuinely accessible.

The trajectory is: 14 → 9 → 4. You have options today. You have fewer in a month. You have very few in three months.

Nothing dramatic has happened. No crisis is visible. The department is running. But the state space is quietly contracting, and that contraction is now measurable.

The viability threshold θ.

A state reachable with 0.3% probability after ninety days is not a real option. You cannot plan around it. You cannot rely on it when the surge arrives at 2 AM.

θ is the floor. A state must have Pⁿ(i,j) > θ to count in D(i,n). Your department sets θ based on how conservative it needs to be. High-stakes, high-consequence environments — and an emergency department is exactly that — set θ higher. The threshold is a statement about what counts as a genuine move versus a theoretical possibility.

D(i,n) defined formally.

D(i,n) = |{j : Pⁿ(i,j) > θ}|

Count the states j where the probability of being there after n steps exceeds θ. That count is D(i,n).

The relationship between H_w(i) and D(i,n).

A department can have high H_w(i) and low D(i,90). This is the most dangerous combination — and the most common one before a crisis.

High H_w(i) means: good options right now. The department looks healthy. The metrics you review daily are fine.

Low D(i,90) means: in three months, very few viable configurations remain accessible. The trajectory is converging. The decisions being made today — the contract that was not renewed, the maintenance that was deferred, the position that was left vacant — are quietly closing off futures.

The gap between the two is where organizations are most exposed. The current health masks the deteriorating trajectory. Nothing triggers an alarm. And then the surge arrives.

Q1. What does D(i,30) = 9 tell the ED director?

Q2. A department has D(i,1) = 14, D(i,30) = 9, D(i,90) = 4. Nothing dramatic has happened. What should this trajectory signal to leadership?

Q3. Why is the combination of high H_w(i) and low D(i,90) described as 'the most dangerous' and 'most common' before a crisis?

©2026 Nelson de Sa e Silva • Engineering Choices • engineeringchoices.ai

Lesson 6 — ΔD and the Decay Signal

D(i,n) tells you how many viable options remain at your horizon. It is a count. It tells you where you are.

ΔD tells you how fast that count is changing. It tells you which direction you are moving and how quickly.

The formula.

ΔD(i,n) = D(i,n)ₜ − D(i,n)ₜ₋₁

D now minus D one period ago. The difference between where you are and where you were.

When ΔD is negative, your optionality is shrinking. When it is positive, you are gaining options. When it is zero, you are holding steady.

Two departments, same number.

Department A has D(i,90) = 4. It has been 4 for three years. The department operates within known constraints. Leadership has adapted protocols to a limited option set. They know which four configurations they can reach and they have built around that reality. Low D, but stable.

Department B has D(i,90) = 4. Six months ago it was 14. Three months ago it was 9. Last month it was 6. Now it is 4. It has the same D as Department A. But the trajectory is completely different. Something is actively consuming its optionality. The system is in motion toward a worse position and has not stopped moving.

If you only look at the level — D = 4 — the two departments look identical. If you look at ΔD, they are nothing alike. Department A is stable. Department B is in trouble and the current numbers do not show it yet.

ΔD is the earliest warning signal in the framework.

H_w(i) tells you about right now. D(i,n) tells you about your horizon. But by the time D(i,n) is visibly low, the trajectory has been running for months. The decisions that produced it are behind you. You are seeing their consequence, not their cause.

ΔD catches the trajectory while it is forming. A consistently negative ΔD — options shrinking period after period — is the signal that something structural is changing in your state space before the consequences arrive.

In the emergency department: the staffing decisions, the contract decisions, the deferred capital requests. Each one modifies P slightly. Each modification reduces D(i,n) slightly. ΔD goes negative — a little, then more. No alarm sounds. The metrics that are being watched all look fine. The metric that is not being watched is the one that matters.

Accelerating decay.

ΔD can be negative and stable — shrinking at a steady rate. Or it can be negative and accelerating — shrinking faster each period than the last.

Accelerating negative ΔD is the most urgent signal the framework produces. It means the rate of optionality loss is itself increasing. Not drifting — falling. The distance between you and an absorbing state is closing faster than it was before.

In the staffing spiral: lose two experienced nurses one quarter, three the next, five the quarter after. Each departure makes the remaining staff less sustainable. The exits from the spiral require things — experienced staff, stable orientation programs, manageable workloads — that the spiral itself is destroying. ΔD accelerates negatively. The absorbing state approaches.

The sign convention in Ω.

In the objective function you will see in the next lesson, the term appears as −ΔD. The negative of the decay rate.

When ΔD is negative — options shrinking — −ΔD is positive. That positive value increases its contribution to the objective function and pushes the system toward recommending transitions that arrest the decay.

When ΔD is positive — options growing — −ΔD is negative, which slightly reduces that term's weight. The system is not alarmed when you are gaining options. It responds urgently only when you are losing them.

The sign flip turns −ΔD into a warning signal. The worse the decay, the stronger the push toward corrective action.

Q1. Department A has had D(i,90) = 4 for three years. Department B had D(i,90) = 14 six months ago and now has D(i,90) = 4. Which department's leadership should be most concerned, and why?

Q2. In the staffing spiral — losing 2 nurses one quarter, 3 the next, 5 the quarter after — what is happening to ΔD?

Q3. Why does Ω use −ΔD rather than ΔD directly?

©2026 Nelson de Sa e Silva • Engineering Choices • engineeringchoices.ai

Lesson 7 — Ω and the Coefficients

You now have three instruments.

H_w(i) reads the quality and spread of your options right now — the immediate picture.

D(i,n) reads how many viable options remain at your planning horizon — the forward picture.

ΔD reads how fast your optionality is changing — the trajectory.

Each one tells you something the others cannot. None of them alone is sufficient. Together, they need to produce a decision.

Ω is where measurement becomes decision.

The formula.

Ω(i,n) = α · H_w(i) + β · D(i,n) + γ · (−ΔD(i,n))

Three terms. Three coefficients. One number.

At every decision point, the system calculates Ω for every state your department could transition to from its current state. The decision rule is:

i* = argmax_j [Ω(j,n)]

Move to the state with the highest Ω score. That is the recommendation.

The constraints.

Two rules. Both non-negotiable.

First: α, β, and γ must all be non-negative. You cannot have a negative coefficient. You cannot build a system that punishes good immediate options or rewards accelerating decay.

Second: α + β + γ = 1. They sum to one. Each is a share of the total weight the system places on the three measurements. Increasing one requires decreasing another. Every coefficient choice is a tradeoff.

What each coefficient encodes.

α is how much you care about right now. It weights H_w(i) — the quality and spread of your immediate options. A department running high α is optimizing for its current position. It will choose transitions that give it good options in the next step, even at the cost of longer-term flexibility.

In a stable environment, high α is reasonable. Your immediate metrics look good because you are maximizing them. The danger arrives when that stability ends. A high-α department has been optimizing for the world that was. When the world that arrives is different, the options it has been building toward may not be the ones it needs.

β is how much you care about your horizon. It weights D(i,n) — the count of viable states still accessible at n steps out. A high-β department will accept a worse immediate position in exchange for keeping more options open three months from now.

This is the posture of a department that has been through a real crisis and come out changed. The director who watched her unit deteriorate over six months because the decisions that looked efficient in January had closed every exit by June tends to raise β. She will maintain redundant staffing agreements and backup imaging contracts that look expensive in a quiet month, because she has seen what happens when they are gone.

γ is how much you care about trajectory. It weights −ΔD — the decay signal. A high-γ department is maximally sensitive to the rate at which optionality is eroding. The moment D starts declining, the system responds — not when D is already low, but at the first sign of movement in the wrong direction.

This is the most proactive posture. It will generate recommendations for investment in resilience at moments when nothing appears to be wrong. Explaining those recommendations to a budget committee when the department is running well is hard. This is where the coefficient conversation becomes a leadership conversation.

A worked example from the emergency department.

Two comparable departments in the same health system. Same staffing model. Same physical plant. Same patient population. Then a regional event — a large employer closes, altering the insurance mix, and census rises 18% over two months.

Department A had run α = 0.6, β = 0.2, γ = 0.2. High immediate weight. Over the preceding eighteen months, the system had recommended — and leadership had executed — transitions that concentrated staffing arrangements, reduced contract redundancy, and tightened supply agreements, because those transitions produced the highest H_w(i) scores in a stable environment.

Pre-event Ω = 1.84. Post-event Ω = 0.94. A 49% collapse. The event eliminated the operational efficiency that H_w(i) had been measuring. The department absorbed the initial shock by consuming its remaining optionality. By week three it was rationing beds and on intermittent diversion.

Department B had run α = 0.2, β = 0.2, γ = 0.6. High decay sensitivity. The system had been catching small negative ΔD signals for a year and recommending transitions that maintained staffing flexibility and supply redundancy, even when those recommendations looked inefficient against the current metrics.

Pre-event Ω = 1.76. Post-event Ω = 1.42. A 19% decline. Painful, but manageable. Options were there because they had been maintained before they were needed.

Department A's coefficient choices were not wrong for the environment it had been running in. They were wrong for the environment that arrived.

The coefficient conversation.

Setting α, β, and γ is not a math problem. It is a strategic statement. Someone in your department — and above it — has to say: we are α-dominant right now, or we are γ-dominant. That statement encodes the organization's theory of its own risk environment. It will be contested. Operations will have one view. Finance will have another. The director who lived through the last crisis will have a third.

The framework does not resolve that contest. It makes it explicit and forces it into a number that can be revisited, adjusted, and owned. That is more than most departments have.

Q1. Department A ran α = 0.6 and Department B ran γ = 0.6 before the same regional census surge. Department A's Ω dropped 49%; Department B's dropped 19%. What fundamentally explains the difference?

Q2. A director wants to set γ high — to be maximally sensitive to option decay. What is the practical challenge this creates?

Q3. The constraints on α, β, and γ are: all non-negative, and they sum to 1. What does the 'sum to 1' constraint mean operationally?

©2026 Nelson de Sa e Silva • Engineering Choices • engineeringchoices.ai

Lesson 8 — The Shock Operator

You have been measuring where you are, projecting where you are going, and tracking how fast the trajectory is moving.

The shock operator lets you ask a different question: what happens to your Ω if something specific breaks?

Before it breaks.

The basic idea.

The shock operator S simulates a disruption by modifying P. Specifically, it zeroes out transition probabilities. If your exclusive laundry provider fails, S sets P(i,j) = 0 for every state j that requires that provider. The modified matrix is P_S.

You recompute Ω under P_S.

The difference:

Ω − Ω_S = your quantitative exposure to that specific disruption.

That number is what the disruption costs you in optionality terms — before it happens.

Why this matters.

Every department does some version of scenario planning. The questions arise in staff meetings and budget cycles: what if our travel nurse vendor drops us? What if the CT goes down during a surge? What if two senior nurses leave in the same month?

The problem is that these conversations are qualitative. You end up with a ranked list of concerns, ordered by someone's intuition about severity. The ranking is contested. The mitigations are vague. The exercise is repeated annually without much connection to actual operational decisions.

The shock operator makes the conversation computable.

Run S for every scenario that concerns you. Each one produces a number. The numbers can be ranked objectively. The gap between Ω and Ω_S tells you precisely what each scenario costs you, so you can direct investment in resilience toward the exposures that matter most.

Three scenarios for your department.

You run S on the three situations your charge nurse has flagged as concerns.

S₁ — exclusive laundry provider failure. Ω − Ω_S₁ = 0.4. Significant. The exclusive contract removed so many linen-dependent transitions that P_S₁ looks very different from P. Whole categories of operational state — clean procedure rooms, adequate gown supply, functioning bed turnover — become unreachable. Your exposure to this failure is real and specific.

S₂ — CT down during a surge. Ω − Ω_S₂ = 0.6. Larger. Imaging is embedded in many high-value states. Losing it during a surge collapses D(i,n) sharply, because the states you most need to reach — the ones where you can manage complex presentations — require imaging. The exposure here is not just operational; it is clinical.

S₃ — two senior nurses leave in the same month. Ω − Ω_S₃ = 0.8. Largest. Experienced staff are the most load-bearing variable in your state space. Their departure does not just reduce immediate options. It accelerates ΔD, because the transitions you lose are the ones that connect to recovery states. The department that loses two senior nurses loses not just their labor but the institutional knowledge that makes adaptation possible.

Now you have a ranked list. Not a ranked list of fears — a ranked list of quantified exposures. The conversation with the CFO about travel nurse contracts, backup linen agreements, and CT maintenance schedules is no longer a conversation about risk tolerance. It is a conversation about specific numbers.

What the shock operator reveals about convergent zeros.

Run S on the exclusive laundry contract signed two years ago. P_S sets to zero the transitions that depended on flexible linen sourcing. Ω − Ω_S tells you what optionality you gave up when you signed it. You could not see that number at the time of signing. You can see it now.

This is retrospective shock analysis — running S on past decisions to understand their true cost in optionality terms. It is uncomfortable. It produces numbers that make past choices look more expensive than they seemed. But it is the only honest way to understand how your P has changed and where your accumulated exposure actually lives.

The complete framework.

You now have the full apparatus.

H_w(i) — quality and quantity of your options right now.

D(i,n) — how many viable options remain at your horizon.

ΔD(i,n) — how fast that count is changing.

Ω(i,n) — the weighted combination that produces the decision rule.

α, β, γ — the coefficients that encode your organization's risk posture and strategic priorities.

S — the shock operator that stress-tests your Ω before reality does it for you.

Together they form a complete system for measuring, tracking, and defending optionality. Not as a management philosophy. As arithmetic.

The last thing worth saying.

The math is tractable. The data exists — you have been generating it every shift for years. The organizational requirements are harder.

The hardest part is the V(j) conversation — getting the department, the system, and the finance team to agree on what a good state looks like versus a bad one. That conversation will surface disagreements that have been papered over. That is a feature, not a defect.

The second hardest part is setting α, β, and γ and owning that decision publicly. Choosing to be γ-dominant — to weight trajectory over current performance — means recommending investments in resilience at moments when nothing appears to be wrong. That requires a kind of institutional courage that the framework can support but cannot supply.

The Wright brothers did not attempt to cross the Atlantic on December 17, 1903. They flew 120 feet on a beach in North Carolina, examined what worked, and flew again.

Start with one unit. One data set. One honest attempt to characterize the state space. The rest follows.

Q1. The shock operator produces Ω − Ω_S = 0.8 for the scenario 'two senior nurses leave in the same month.' What does this number mean?

Q2. Running the shock operator retrospectively on the exclusive laundry contract signed two years ago produces a significant Ω − Ω_S. What does this reveal?

Q3. Of the three scenarios tested — laundry provider failure (0.4), CT down during surge (0.6), two senior nurses leave (0.8) — what should the shock analysis results drive?

© 2026 Nelson de Sa e Silva — All Rights Reserved — Independent work, unaffiliated with any employer or client organization.
This page accompanies Engineering Choices by Nelson de Sa e Silva. Available on Amazon