Series
Engineered to Fail: Testing Six Claims About Defence Capability and the Human
Six articles, one claim each, published ahead of Land Forces 2026. Every piece opens on a land case and uses an air or maritime case as proof, and every fact is taken from a primary source read in full.
Engineered to Fail is a six part series testing the central argument of a book of the same name: that the human is the highest-consequence system in a Defence capability and the one most reliably left unengineered. The six claims under test are that assurance writes the human in as a condition of use, that tolerance limits are known and deferred, that reversion is a disclosure, that crewing is left to trend lines, that investigations decide whether a design failure stays one, and that durable fixes are institutional.
What claim does each article test?
| Part | Mechanism | Claim under test | Land lead | Cross-domain proof |
|---|---|---|---|---|
| 1 | Premise | Defence assurance writes the human in as a condition of use, not a system to design for | Ajax | F-35A seat weight restriction |
| 2 | Tolerance | The body's limits are usually known and deferred, and the action comes from below | UK servicewomen's body armour | US Navy T-45 instructor refusal |
| 3 | Workflow | Reversion to older equipment discloses that the workflow was never designed | Puma at Munster, December 2022 | USS John S. McCain helm |
| 4 | Crewing | Capability is sized in platforms and budgets; crewing is left to trend lines | Bundeswehr | US Navy crew sizing (GAO); Collins shortfall (ANAO) |
| 5 | Blame the operator | The investigation decides whether a design failure stays a design failure | Patriot and Tornado ZG710 | Chinook ZD576 against Nimrod XV230 |
| 6 | The fix | Durable fixes are institutional, and the land domain was told it needs an MAA standard regulator | Ajax Review, Recommendation 15 | Nimrod to the Military Aviation Authority |
Where do I read each article?
- Defence Safety Cases and the Human Operator: When Safe, Provided Becomes a Condition of Use
A safety case certifies a machine against its design envelope. When the operator enters that case as a condition of use, any injury can be reclassified as a failure to comply, and the documentation stays correct while people are hurt. - Known Human Limits in Capability Programmes: Why the Action Comes From Below
Tolerance failures in Defence are rarely discovered. They are recorded, published, given a delivery date, and then deferred. What changes the outcome is usually pressure from the people carrying the risk. - Human Machine Interface Failure in Defence: What Reverting to Old Equipment Tells You
Reversion is a disclosure. When an institution quietly goes back to the equipment it was replacing, it is telling you where the designed workflow stopped matching the work that has to be done. - Crewing Feasibility in Capability Planning: Sized in Platforms, Left to Trend Lines
Platforms are counted in units, delivery dates and dollars. The people who will crew, maintain and sustain them are usually carried as a trend line, and the gap becomes structural before anyone measures it. - Accident Investigation and Design Failure: How the Frame Decides the Finding
When a system fails and people die, an investigation decides who failed. That decision either keeps a design failure visible or converts it into a personnel failure. - A Land Systems Safety Regulator: What the Nimrod Loss Taught the Air Domain
Durable fixes to the human problem in capability come from an independent authority with power over design approval and release. They rarely come from a better programme.
How is the argument being tested?
Each article states its claim in plain terms and names the kind of evidence that would weaken it. Objections and counter-examples are recorded against the claim they address, with the role and sector of the person raising them, and that record becomes the book’s evidence of which claims held. The standing sourcing rule is that a fact goes in only if its exact wording has been read in the primary source, which is why several quotations that circulate widely in press reporting do not appear here.
Frequently asked questions
What is the Engineered to Fail series about?
It is a six part series testing one claim per article from the book Engineered to Fail, on how Defence capability development treats the human operator. Each article opens on a land case and uses an air or maritime case as cross-domain proof, and every fact is drawn from a primary source.
Why publish the argument before the book?
Because the purpose is to find the evidence that weakens each claim while the book can still change. Every article states the claim under test and names the kind of example that would count against it, and the responses are logged against the claim they address.
What are the six claims under test?
That Defence assurance writes the human in as a condition of use rather than a system to design for; that tolerance limits are known and deferred; that reversion to older equipment discloses a workflow that was never designed; that capability is sized in platforms while crewing is left to trend lines; that the investigation decides whether a design failure stays one; and that durable fixes are institutional.
What sourcing standard does the series use?
A fact goes in only if its exact wording has been read in the primary source. Quotations sourced only to press reporting are excluded, German sources are quoted in the original with the English rendering marked as a translation, and each article carries its full source list.
Where does the human sit in your capability’s assurance?
If the answer is a limitation on use, the exposure sits with the people inside the system. The Crucible Method locates where human performance and tolerance enter your assurance argument and tests whether that position holds.
Book a strategy callOr start with the Seven HSI Red Flags checklist.