The Pilot That Earns the Second Project — and the Ledger That Funds It

Data-programme pilots fail in two symmetrical ways.

The ambitious one connects half the plant, installs a platform, and eighteen months later has produced a login page and a lessons-learned deck.

The trivial one connects three sensors on a test rig nobody cares about, works flawlessly, and proves nothing anyone will fund — the sensors were easy, the rig was unrepresentative, and no decision changed.

Between them sits the pilot that scales: one real decision on one line that matters, the full chain built thin — sensor to screen, every layer present, none of them gold-plated — with success criteria written before the first purchase order and a verdict scheduled on a calendar.

And one addition that most programmes discover too late. The pilot’s secret product is not the dashboard. It is the reusable spine.

Scoping: one decision, full chain, thin

The selection logic is the measurement portfolio, filtered by four pilot criteria.

A decision with a named owner who wants it. An enthusiastic customer beats a strategic one. The strategic sponsor will attend the verdict meeting; the enthusiastic owner will answer the phone at week nine when something does not work.

Value large enough to notice but not bet-the-plant. The verdict has to survive politics, and a pilot attached to a number too big to admit failing on will not be allowed to fail.

Assets representative of the estate. The patterns have to transfer. The exotic line teaches you about the exotic line.

Technical reach that exercises every layer at least once. This is the criterion most often quietly dropped, and dropping it is what produces a pilot that proves nothing about the architecture.

• → One retrofit or new sensor, selected against a duty rather than a datasheet.
• → One controller or device read, under a measured load statement, with the automation owner's ceiling agreed before design.
• → One governed protocol conversion — with a commissioning test that it does not re-stamp source time.
• → One edge buffer, sized against real outage history, with its overflow behaviour chosen deliberately.
• → One storage configuration with its compression and retention settings derived and recorded rather than defaulted.
• → One naming pass and one asset-model subtree, exercised hard enough to find the standard's gaps.
• → One data contract at one boundary — identity, semantics, shape, tempo, stewardship — enforced at entry.
• → One calculated KPI with its definition signed, one display per altitude that genuinely needs one, and one notification rule under notification discipline.
• → The security posture of the full architecture applied at pilot scale, and the chain's own health page — because a pilot that cannot see itself fail will report success regardless.

Thin is the discipline. One of each. No platform maximalism. Every component chosen as good enough to keep, or cheap enough to replace — because the real composition can be decided in wave one. The pilot’s job is to prove the shape.

Criteria before commitment

Before the first purchase, a one-page charter states: the decision served; the success criteria in numbers; the timebox; the budget; the named owner and the verdict jury; and the three permitted verdicts.

The criteria are worth stating in numbers rather than adjectives. The decision was made differently N times. Data was available X% of the occasions it was consulted. Chain health was green Y% of days. Value evidence of the defined kind exists.

The three verdicts are scale, fix-and-retest, and stop — with stop pre-declared as a respectable outcome.

That last clause is not sentimentality. Programmes die of pilots that cannot be allowed to fail, because a pilot whose only permitted outcome is success produces success by narrative, and the organisation learns that the evidence was never the point. Not demonstrated is a legitimate result. Declaring it in advance is what makes the other two verdicts mean anything.

The verdict meeting goes on the calendar before the kickoff does.

The second product: the spine

Run honestly, the pilot has two deliverables. The first is the verdict with its evidence. The second — and for the architecture, the greater — is the spine.

The naming standard, exercised and corrected, with its deviation register carrying its first real entries. The type templates for the asset classes touched. The first data contract, established as the house pattern. The load-statement and headroom method, proven against a real link. The security posture as a repeatable checklist. The calculation definitions with their signatures. The runbook for the chain operator role.

Each written as built, because later waves will stamp copies of exactly these artefacts — and an undocumented pilot is a pilot that must be excavated before it can be repeated.

At Meridian, the invented plant the underlying reference runs on, the illustrative twenty-week close reads: verdict scale, criteria met four out of five with one display altitude cut mid-pilot and recorded rather than hidden, spine documented, and the utilities engineer now the programme’s loudest advocate — which is worth more than the KPI.

The ledger finance can actually audit

Data-programme economics fail at the extremes. The enthusiast counts licences against a savings percentage and produces a payback measured in weeks, which finance discounts to zero on sight, correctly. The cynic counts every conceivable cost against no measured value and proves the programme can never pay. Both are unfalsifiable and both are useless.

The honest middle has two sides.

The cost stack has seven layers, and the budget failures live in the middle five. Hardware and installation, where the sensor is the cheap part and the penetration, the permit and the cable are the cost. Connectivity and infrastructure, including the load-statement engineering itself. Platform and licences, priced at scale — at one, five and ten times — before signature, because meters are where quiet multiplication lives. Integration and context, the reliably underbudgeted layer: connector configuration, naming and model population, contract authoring, calculation definitions. Operations, forever rather than year one. The people layer. And attention, listed even where the site declines to cost it.

Integration deserves its own method rather than a percentage picked from air: estimate it bottom-up from the pilot’s measured per-point and per-interface effort. That is the spine paying again.

The value side refuses aggregation until the end. Each line is one decision, with its baseline measured before, its result measured after, its counterfactual stated honestly, its attribution shared where it is shared, and its finance owner named.

That last row is the credibility mechanism, and it is worth being blunt about. Scenarios — the avoided callout, the outage that did not happen — get shown and never claimed. The ledger that pays without its scenarios is the ledger finance re-reads.

A smaller number that survives audit funds more than a big one that does not.

An exercise that costs an afternoon

Take the last data project your site completed — or abandoned — and write its charter retrospectively, as if before the fact.

The decision it served. The success criteria in numbers. The timebox. The named jury. The three verdicts.

Most projects cannot be reconstructed this way, and the specific place the reconstruction fails is the diagnosis. If the decision cannot be named, the pilot was a technology demonstration. If criteria cannot be recovered, the verdict was narrative. If no jury existed, nobody was ever going to say stop.

Then write the value line the project would have claimed, in the ledger format: one named decision, baseline before, measurement after, counterfactual flagged, attribution shared, finance owner named.

Two things usually happen.

The baseline turns out never to have been measured, which means the value was always going to be an assertion — and the fix costs a fortnight of measurement before the next project rather than a platform after it.

And the spine turns out not to exist. There is no naming standard with a deviation register, no house data contract, no load-statement method, no operator runbook. Which explains, precisely and without blame, why the next project is going to cost what the first one did.

What would your last data project’s verdict have been, if the criteria had been written down before it started?

The pilot scoping criteria, the pre-registered charter with its three verdicts, the reusable spine, the seven-layer cost stack and the named-decision value ledger are from Industrial IoT and Data Architecture: From Sensor to Historian to Dashboard (Part 8: The Implementation Playbook, sections 8.1 and 8.3).