ATTENTION, PEOPLE WHO HAVE SAID “WE’VE ALWAYS DONE IT THIS WAY” WITH GREAT CONFIDENCE!
PEOPLE WHO HEAR A STRANGE NOISE FROM A PROJECT AND TURN UP THE RADIO! PEOPLE WHO BELIEVE A POST-MORTEM IS SOMETHING THAT HAPPENS TO THE OTHER COMPANY, THE ONE WITH THE LOGO ON FIRE!
Are you tired of not having your name attached to a preventable failure?
Have you spent another productive afternoon selecting the familiar fix, admiring the familiar fix, and deploying the familiar fix directly into the problem it does not solve?
Then congratulations.
You qualify for the Five Number One Rules of Learning From Failure Before It Has Your Name on It — five Number Ones, zero commemorative plaques, and no requirement to become an industry cautionary tale first.
“Wait,” you’re shouting at the screen, “they can’t all be Number One!”
That’s exactly what Big Numbering wants, while it sells one excellent habit as a coupon good for every other habit.
Failures are specialists.
Naming escalation of commitment won’t keep machinery from re-energising.
A lock won’t tell a team when to stop.
A stop rule won’t create an independent observer.
And an observer who spots a near miss and writes nothing down has saved the afternoon while teaching the organisation nothing at all.
Occupations with unforgiving physics learned this the expensive way, one accident at a time. Lockout treats an off switch as insufficient. Sterile-cockpit rules protect defined phases of flight. Surgical time-outs protect the last moment before something becomes irreversible.
Different defences. Different failures. None of them interchangeable.
So here they are.
Five rules.
Five Number Ones.
No substitutions. No “we meant well.” No putting a motivational poster between an error and a consequence and calling it engineering.
RULE #1: NAME THE FAILURE MODE BEFORE THE FIX
Introducing FIX-FIRST FANTASIA™, the thrilling system that ships the first solution anybody recognises, before the problem has been described in a complete sentence.
Start a pre-mortem with a concrete loss. The wrong release goes live. The load drops. The deadline is missed. The budget becomes a historical artifact.
Then work backwards. What decision starts that path? What information gets ignored along it? What condition removes the last chance to stop?
And crucially: which named failure mode makes the path feel sensible while it’s happening? Because it always does.
Escalation of commitment is one answer, and the evidence is unusually clean. In Staw’s 1976 experiment, subjects who had made the original funding choice allocated markedly more additional resources after negative feedback than subjects evaluating an identical choice made by somebody else.
Same information. Same numbers. Different behaviour, entirely because of who chose first.
That’s not ordinary persistence. It’s self-justification — the champion’s reputation has quietly become part of the investment, so continuing feels personally rational long after it has stopped being collectively rational.
Berlin Brandenburg Airport opened roughly €6.5 billion over budget and about ten years late. Denver International’s automated baggage system ran two years late and about $2 billion over.
Nobody involved was stupid. Everybody involved had already chosen.
So set the exit test before sunk cost starts making its case: what evidence would make continuation wrong, and who is allowed to say so out loud?
The golden hammer is a different failure with a different fix — the learning cost of one familiar tool gets mistaken for evidence that it fits this problem.
And the labels only matter if they change what you build. Uncontrolled scope expansion needs change control. Builder-added extras are gold-plating, which is a different disease. A symptom that keeps returning needs its system traced, not another patch.
A named failure mode is a diagnosis, not a defense.
The first tool in the box isn’t the hammer. It’s the sentence saying what the hammer would be for.
RULE #1: PUT A BARRIER BETWEEN ERROR AND HARM
NOW PRESENTING REMEMBER-BETTER PRO™: one sticker, one sigh, and one heroic plan for every human being to remain alert forever.
Batteries not included. Human fallibility very much included.
A warning says the bad thing shouldn’t happen.
A barrier changes the system so the bad thing has a harder time reaching harm.
That distinction is the entire sale, and almost every organisation buys the wrong one because it’s cheaper.
OSHA’s Control of Hazardous Energy standard requires machinery to be de-energised and physically locked before service. It followed injuries from unexpected re-energising and stored-energy release.
Switched off can be reversed by anybody who walks past. Locked out cannot. OSHA estimates the standard prevents roughly 120 fatalities and 50,000 injuries annually.
Construction has the same logic in a machine that refuses to negotiate. Two-blocking happens when a crane’s hook assembly reaches the boom tip, potentially shearing the hoist line and dropping the load. Newer cranes are required to carry an automatic prevention device.
Note what that device is not. It is not a more enthusiastic warning, or a louder alarm, or better training about two-blocking.
It stops the contact.
Older cranes were permitted an operator-warning-only option, which tells you exactly how the industry ranked those two things once it had the choice.
And the electrical rules aren’t substitutes for each other either. Lockout excludes energy before service. Arc-flash protection covers work that has to stay energised — a completely different problem, requiring task-rated protective equipment rather than a locked switch.
A locked switch cannot protect somebody standing near an energised conductor when it fails.
A warning asks for perfect behaviour. A barrier makes imperfect behaviour less final.
If one missed reminder can become harm, the system is selling memory where it needed to sell distance.
RULE #1: MAKE THE STOP CONDITION EXPLICIT
From the makers of “USE YOUR JUDGMENT” comes VAGUE-STOP 8000™ — the product that announces a critical moment and then hands everyone a fog machine.
A stop condition names the observable event that pauses a critical step.
It doesn’t ask anybody to feel vaguely uneasy at precisely the right moment, which is a thing humans are famously unable to schedule.
It says: during this phase, this conversation stops. When this condition appears, this work stops. Before this irreversible act, these checks happen.
The sterile-cockpit rule protects a defined interval — no non-essential duties or conversation during taxi, takeoff, landing, and operations below 10,000 feet.
That boundary came from a crash. In September 1974, Eastern Air Lines Flight 212 went down near Charlotte, killing 72, after conversation displaced altitude awareness. The NTSB recommendation came that year; the FAA finalised the rule in 1981.
Critical attention got a boundary. Not a pep talk about focus.
The surgical version protects a different moment: verification, site marking, and a final team time-out before an invasive procedure — the point at which correction stops being cheap.
Then make your own trigger local and legible.
“Stop when the plan no longer matches the work.”
“Stop when an assumption has no owner.”
“Stop when the sign-off is missing.”
The specific trigger depends entirely on your hazard. The architecture doesn’t: define the condition, define who can halt the step, and define what has to be true before it restarts.
A stop rule converts concern into an action before urgency converts action into regret.
The worst time to discover nobody knows when to stop is while everybody is moving faster.
RULE #1: KEEP A SECOND PAIR OF EYES FOR THE IRREVERSIBLE STEP
BEHOLD SOLO-APPROVAL SUPREME™: one person, one signature, and one magnificent opportunity for every unnoticed assumption to enjoy a long private career.
Independent review is not a second person standing nearby, agreeing, because the first person is persuasive.
It’s a separate role, with a view of the condition, and the authority to interrupt.
Confined-space entry makes the design unusually visible. The rules define an entrant, an attendant, and an entry supervisor. The attendant stays outside for the entire entry, monitors conditions, and is authorised to order evacuation.
Both parts matter. The location, and the authority.
And here is why they matter that much: a 1986 NIOSH alert found more than 60% of confined-space fatalities were would-be rescuers who went in after the first person went down.
A crowd of brave people without an independent hazard assessment isn’t a rescue plan. It’s a cascade.
Commercial diving builds the same thing differently — scuba divers in continuous visual contact or joined by a physical buddy line. An independent response path, for the moment the first diver can’t supply one.
Apply the same discipline to a decision. Before the irreversible step, identify the reviewer, the specific item to be checked, what evidence counts, and the reviewer’s authority to halt the work.
That role doesn’t need to be another department wearing ceremonial suspicion goggles. It does need independence from whatever pressure made the original decision attractive.
A second pair of eyes matters only when the second pair is allowed to blink “stop.”
Review that cannot interrupt is decoration with a calendar invite.
RULE #1: TREAT A NEAR MISS AS DATA, NOT GOOD LUCK
AND NOW, NOTHING-HAPPENED-NOW™ — the premium service converting every recovered error into fresh proof that the system is flawless.
Available until the next attempt succeeds.
A near miss is a gift in terrible packaging.
Something travelled far enough down the failure path to prove the path exists. Then a barrier, a person, the timing, or plain luck stopped it before the harm.
The correct response is not a victory lap. It’s a record.
Write down what nearly happened. The conditions present. The decision that started the path. The barrier that held or failed. The stop condition that worked or was missing. The review role that noticed, or didn’t.
Start with the system before assigning blame — otherwise the review discovers only that a person was present, which is nearly always true and nearly never sufficient.
And note that a rule existing doesn’t close the loop. Air Florida Flight 90 crashed into the Potomac in January 1982 — after the sterile-cockpit recommendation — and the NTSB found the crew hadn’t enforced that discipline during a delayed, ice-affected preflight.
A numbered rule can still fail at the point of use. Which is exactly what a near miss is trying to tell you, in advance, for free.
Rules come from single disasters and from accumulated patterns both. Sago Mine killed 12 of 13 trapped miners in January 2006; Darby Mine killed five more within weeks. An emergency standard followed in March, requiring additional self-rescuers, lifelines, and quarterly drills. Lockout and fall protection grew from repeated patterns instead.
Same loop either way: reveal a mechanism, then change the path.
Just don’t mistake a near-miss review for whack-a-mole. Patching the loudest symptom, then producing the identical failure elsewhere, isn’t learning.
And don’t cargo cult. Copying another industry’s visible safety ritual, without understanding the hazard it controls, gets you the costume and none of the protection.
Luck that is not recorded becomes policy by accident.
The absence of harm isn’t evidence the path was safe. It may only be evidence the path was unfinished.
BUT WAIT, THERE’S MORE!
“What if the work is software?”
Same rules. Name the failure mode — scope creep, golden hammer, escalation. Put a barrier between error and release. Define the deployment stop. Give somebody authority to block it. Record the near miss.
“What if we’re a small team with no safety officer?”
Same rules. The roles can be small. The authority cannot be imaginary — somebody outside the action needs a clear condition and permission to use it.
“What if it’s an emergency?”
Same rules. The point was never ritual length. A short barrier check, one concrete trigger, and one independent look still protect the critical step.
“What if another industry has a beautiful checklist?”
Same rules. Take the mechanism, not the costume. A buddy line, a surgical time-out, and a crane device address entirely different hazards.
The details change.
The architecture doesn’t.
THE FIVE, WITHOUT THE COMMEMORATIVE PLAQUE
Name the failure mode before selecting a fix. Write the pre-mortem around a concrete loss and identify what makes the path feel reasonable.
Put a barrier between error and harm. A warning depends on memory; a barrier changes what can happen.
Make the stop condition explicit: what pauses the step, who can halt it, what permits restart.
Keep a second pair of eyes on the irreversible step — with a distinct role and real authority.
Treat a near miss as data. Record the path, the defences, and the recovery before it recurs.
DO THIS TONIGHT
Pick one piece of work already moving. A purchase, a release, a hiring decision, a repair, a budget request — or any project whose status is described as “basically done” in the tone normally reserved for unexploded fireworks.
Write the loss that would make tomorrow embarrassing or harmful.
Then work backwards and name the failure mode. Defended old choice. Familiar tool. Uncontrolled scope. The diagnosis is what tells the solution where to attach.
Add one barrier. Not a reminder — a barrier. Something that changes what’s possible rather than what’s advisable.
Write one stop trigger, in observable terms.
Identify one irreversible step, and one person who can review it independently and stop it.
Finally, make the near-miss record before the near miss. Event, conditions, path, barrier, stop condition, reviewer, recovery, follow-up.
Fill it in the moment something nearly goes wrong — before the story quietly becomes “nothing happened,” which is the form all the useful information gets destroyed in.
For the low, low price of facing a boring possibility while it’s still hypothetical, the complete Five Number One system is yours.
No commemorative inquiry. No new company nickname. No documentary voice-over asking why nobody saw it coming.
And if you act now, we’ll include the most useful thing in the box at no additional charge:
the chance to be wrong safely, early, and only once.
Operators are no longer standing by.
The operator is whoever is still holding the work.