A Broadcast Fault Drill for Challenging AI’s Fluent Fault Diagnoses

By Elena Vasquez

A 40-minute tabletop exercise proposed by Gleb Tsipursky tests whether a novice engineer can challenge an AI-generated fault diagnosis before a live outage. Tsipursky is a behavioral scientist, CEO of Disaster Avoidance Experts and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026).

The scene is a control room before the evening newscast. An alarm flags the program output. An AI-generated summary blames a Precision Time Protocol (PTP) clock failure and recommends restarting equipment, but monitoring evidence does not support that diagnosis.

Tsipursky recommends locating the failed signal stage, establishing what remains on air and consulting the approved escalation procedure. “A confident explanation is no substitute for observing the plant,” he writes. TV Tech has described how AI-assisted documentation can amplify errors when data and oversight are weak.

What must a broadcaster verify after an incident?

An IT exercise may ask only whether a server returned. Broadcast recovery must establish whether the correct program reached the transmitted output, sound stayed synchronized, and captions and emergency alerts worked.

U.S. requirements for accessible emergency information make those checks relevant after the picture returns. Engineers must also account for the commercial log, remote contribution, streaming output and affected distribution partners.

With SMPTE ST 2110 carrying separate, synchronized video, audio and ancillary-data streams, a healthy multiviewer cannot prove the output chain works. The investigation may cover source and receiver status, PTP lock, routing, encode and decode stages, and off-air confidence monitoring, depending on architecture.

How do redundancy and control systems affect the diagnosis?

Cisco’s 2026 validated IP-media design specifies separate ST 2022-7 paths, redundant PTP infrastructure and testing of switch, link and clock failures. An amber alarm does not prove the whole program chain has failed if the blue path remains healthy.

Two green dashboards do not settle the case: downstream playout or transmission could still be faulty. AMWA’s NMOS IS-04 and IS-05 specifications separate discovery and registration from connection management. Control-interface faults need different evidence from a missing media stream; trainees should distinguish them, not guess from a screenshot.

Equipment redundancy cannot replace shared knowledge. One veteran may know which switch, vendor or workaround will restore service when nobody else does. A Radio World discussion of chief-engineer knowledge transfer supports written instructions that survive that person’s absence; drills should expose the gaps before the next incident.

How should a safe drill be built?

Start with a 40-minute tabletop exercise or an isolated, non-air environment. A senior engineer selects a plausible local fault: a missing receiver source, a stale route after maintenance or a disrupted contribution feed. No exercise should deliberately interrupt a live transmission or trigger an actual emergency alert.

The trainee receives:

• a mock event log;
• a simplified signal-flow diagram;
• an excerpt from the current approved runbook; and
• a polished AI-assisted report containing one unsupported diagnosis.

The report can allege that the PTP grandmaster has failed even though endpoint clock status stays healthy and a downstream output monitor shows the first loss. The trainee must identify three measurements that separate the candidate causes.

The method stays consistent: find the last known-good signal, locate the first confirmed failure, review related alarms and separate evidence from speculation. Each proposed action needs an expected observation and a reason.

NIST guidance on confident but erroneous generative-AI output supports that discipline. A fluent diagnosis can still be fabricated or incomplete. Requiring a telemetry value, approved diagram or witnessed test interrupts acceptance of the first coherent story.

A time-pressure decision follows. The primary playout chain is degraded and the backup is available, but nobody has verified its playlist and assets. The trainee must decide whether to cut over, identify who can authorize failover, which continuity checks matter and which team to notify.

Readiness with parallel cloud playout depends on backup schedules and media availability, not merely a second server. A dedicated disaster-recovery environment needs working integrations and alternate access paths when one outage could affect primary and backup services.

The final inject can leave captions or the emergency-alert chain unchecked after the picture returns. Under FCC rules on Emergency Alert System equipment readiness, covered stations must keep monitoring and transmitting functions available. Training should identify who verifies EAS status and how it is recorded, without generating a live alert. Actual incidents follow applicable operating and reporting procedures.

How should instructors judge performance?

Afterward, the senior engineer compares the trainee’s evidence trail with the expected safe sequence. The review asks whether the trainee found the first confirmed failure, checked an independent signal or log, challenged the AI report and stated remaining uncertainty. It also checks approval before disruptive change and verification after recovery.

Use a four-part scorecard:

• evidence quality;
• operational restraint;
• escalation; and
• restoration verification.

Tsipursky gives more credit to a trainee who says “I do not know yet” while narrowing a fault than to one recommending a core-device reboot. He presents this as an assessment of reasoning, not a promise of measured reliability gains.

One communication test belongs in the exercise: who informs master control, production, engineering leadership, affiliates or a service provider? Microsoft’s disaster-recovery guidance stresses activation authority, escalation paths, communications and failback criteria. These points matter when a live event, an ad break and a transmitter chain follow different clocks and deadlines.

The drill should also improve the controlled documentation. Record the incorrect hypothesis, the observation that disproved it, the correct escalation contact and the runbook passage needing clarification. TV Tech’s cloud-monitoring discussion supports current, connected diagnostic documentation over another isolated note future shifts cannot find.

Finally, repeat the exercise with another fault and engineer after updating the runbook. Scenarios can include a studio-to-transmitter outage, a remote-production feed loss or a backup playout mismatch, each tied to the facility’s signal path, staffing and escalation authority.

Broadcasters need equipment, documented procedures and people who can distinguish a plausible story from a verified fault. As AI makes plausible stories easier to generate, rehearse that distinction before it matters on air.