Design & Systems

Attractive interfaces are judged easier to use and their usability problems are tolerated longer.

Kurosu and Kashimura found Japanese ATM users rated better-looking layouts as easier to use, independent of actual usability. In testing this masks defects — users forgive an attractive interface long enough that the problem never surfaces.

In practice

• A dashboard with careful typography survives three rounds of user testing despite a broken filter, because testers blame themselves for the failure.
• A well-designed thermostat app is rated highly by owners who have never successfully programmed a schedule on it.

Attributed to

Kurosu & Kashimura

Standing

Cuts both ways: it also hides real usability defects during testing.

Further reading

Wikipedia

Page for this entry

A controller can regulate a system only if it commands at least as much variety as the disturbances it must absorb.

A thermostat handling one variable cannot regulate a system with three independent disturbances. It is the formal reason simplified management dashboards fail to control complex operations.

In practice

• A support desk with one script cannot handle callers with four kinds of problem, and the queue is the visible symptom.
• A performance review with three ratings cannot distinguish six meaningfully different kinds of contribution, so it stops carrying information.

Attributed to

W. Ross Ashby

Also called

Law of requisite variety

Page for this entry

Small changes in end demand amplify into large swings further up a supply chain.

Small retail fluctuations become large factory swings because each tier orders extra to cover its own uncertainty. The MIT Beer Game was built in the 1960s to demonstrate it, and players reproduce it reliably.

In practice

• A retailer's 5% dip in weekly sales becomes a 15% cut in orders, a 30% cut at the distributor and an idle production line.
• A team's slightly reduced hiring plan reaches the recruitment agency as a freeze and the agency stops sourcing entirely.

Attributed to

Forrester; Lee, Padmanabhan & Whang

Also called

Forrester effect; whiplash effect

Further reading

Wikipedia

Page for this entry

A system's performance cannot exceed the quality of the model of that system held by whoever controls it.

Conant and Ashby's 1970 result: every good regulator of a system must contain a model of it. It is the formal reason a manager cannot control what they do not understand, however much authority they hold.

In practice

• A regulator without a working model of how the firms make money writes rules the firms restructure around within a quarter.
• A parent who does not understand what the child is doing online cannot set a rule that constrains it, however firmly stated.

Attributed to

Conant & Ashby

Also called

Good regulator theorem

Page for this entry

Productivity rises sharply when system response drops below about 400 milliseconds, because the user stops waiting and starts flowing.

Doherty and Thadani's 1982 IBM study found the productivity gain from sub-400ms response paid for the hardware many times over. It is why perceived latency is treated as a feature rather than an optimisation.

In practice

• A search interface that returns results in 200ms is used exploratorily; the same interface at 1.5 seconds is used only when the user already knows what they want.
• A build that takes eight seconds gets run constantly; the same build at ninety seconds gets run when someone is confident.

Attributed to

Doherty & Thadani

Page for this entry

Time to acquire a target is a function of distance to and size of the target.

Fitts's 1954 law is why screen corners and edges are valuable: they have effectively infinite size in one dimension, since the pointer cannot overshoot them.

In practice

• A "delete account" button placed beside "save changes" is pressed by accident far more often than one in a settings submenu.
• A shop that puts its impulse items at the till has put them where the hand already is.

Attributed to

Paul Fitts

Further reading

Wikipedia

Page for this entry

A complex system that works evolved from a simple system that worked.

Gall's 1975 statement, and the corollary is the part usually ignored: a complex system designed from scratch never works and cannot be patched into working. Start over from a simple system that does.

In practice

• A payments system that began as a single script and grew works; one designed as a complete platform and built for two years does not.
• A neighbourhood scheme that started with three streets and expanded outlives the one designed from the start to cover the borough.

Attributed to

John Gall

Page for this entry

Decision time increases logarithmically with the number of equally likely choices.

Hick and Hyman's 1952-53 work. Because the growth is logarithmic, adding options is cheap up to a point and menu depth matters less than menu organisation.

In practice

• A menu of six dishes is chosen from quickly; one of sixty takes barely twice as long, and the difficulty is in the organisation rather than the count.
• A settings screen with forty options grouped into five sections is navigated faster than twelve options in no order.

Attributed to

William Hick & Ray Hyman

Also called

Hick's Law

Page for this entry

Actions always have effects that are unanticipated or unintended.

Merton's 1936 paper. His categories still hold: ignorance, error, immediate interest overriding long-term, basic values, and self-defeating prediction. The last is the most interesting and the least discussed.

In practice

• A subsidy for domestic manufacturing raises input costs for domestic manufacturers who buy the subsidised good.
• A rule requiring three quotes for every purchase costs more in staff time than it saves on small items, and nobody intended that.

Attributed to

Robert K. Merton

Page for this entry

Average items in a system equal arrival rate times average time in it, so at fixed throughput less work in progress means shorter lead time.

Little's 1961 theorem holds in a stable system regardless of distribution or scheduling discipline: average work in process equals throughput times average time in system. At fixed throughput, reducing average work in progress reduces average lead time.

In practice

• A team with sixty tickets in progress and four finished a week has a fifteen-week lead time, whatever anyone plans.
• A clinic that books forty patients into a queue with a two-a-day discharge rate has a twenty-day wait by arithmetic alone.

Attributed to

John Little

Further reading

Wikipedia

Page for this entry

Users never read the manual because they are impatient to start, and so stay permanently less efficient than the manual would have made them.

Carroll and Rosson described it in 1987 from studies of people learning software. The impatience is rational in the short run, because reading has a certain cost and an uncertain benefit, and expensive in the long run, because the method learned in the first hour is the one kept for years. The design response was to stop writing manuals nobody opens and to put the instruction into the interface.

In practice

• A team works for three years with the process it invented on its first afternoon, until a new colleague points at a menu item that removes half of it.
• A driver keeps a habit learned in the first week of a new car, unaware that the car has a setting for it.

Attributed to

John Carroll & Mary Beth Rosson

Standing

Documented in usability research rather than measured across populations. Compare the competency trap and the illusion of fluency.

Page for this entry

Affinity rises with human likeness until near-likeness triggers revulsion, then recovers only at full likeness.

Mori's 1970 observation. The dip is real and its cause is disputed, with category ambiguity the leading explanation — the figure is hard to classify as person or object, and the difficulty registers as unease.

In practice

• A cartoon face with two dots for eyes is likeable; the same character rendered with real skin and slightly wrong eyes is not.
• A near-human interface is harder to trust than an obviously mechanical one, which is why voice assistants that sound almost human are found unsettling.

Attributed to

Masahiro Mori

Possible explanations

The leading explanation is category ambiguity: a figure that is hard to classify as person or machine is costly to process, and the difficulty registers as unease. Others are pathogen avoidance, since near-human faces can resemble illness, and mismatch, where a realistic face moves wrongly.

In its favour

Designers report the dip consistently, and several experiments find reduced liking at high but imperfect human likeness.

Against it

Measured curves vary with the stimuli and the rating scale, and a number of studies find no dip at all, so the shape may depend on which faces are chosen.

Standing

The dip is real but its cause is disputed; category ambiguity is the leading explanation.

Further reading

Wikipedia

Page for this entry

System-level properties arise from interaction and are not present in, or predictable from, the parts.

Wetness is not a property of hydrogen or oxygen. The institutional version matters more: culture, morale and reputation exist at the level of the organisation and cannot be assigned to any member.

In practice

• A team of six competent engineers has a communication culture that none of them individually possesses and neither the best nor the worst determines.
• A restaurant's atmosphere is not attributable to any dish, table or member of staff, and closing the room ends it.

Attributed to

Systems theory; G. H. Lewes

Further reading

Wikipedia

Page for this entry

A remedy that relieves the symptom quickly often worsens the cause, prompting more of the same remedy.

Senge's archetype. Painkillers for back pain, overdraft facilities for cash-flow gaps, and hiring contractors to clear a backlog all relieve the symptom while making the underlying condition more likely to recur.

In practice

• A team clears a backlog with a weekend push, which conceals the intake problem and guarantees the next backlog.
• A council fills potholes on a road whose drainage is the cause, and returns each winter with a larger repair.

Attributed to

Peter Senge

Further reading

Wikipedia

Page for this entry

Queue waiting time explodes non-linearly as utilisation approaches capacity, and variability magnifies the effect.

Kingman's 1961 approximation puts mean queueing time at the utilisation factor, times the average of the squared coefficients of variation of arrivals and service, times mean service time. Where that variability factor is 1, 90% utilisation gives about nine service times of queueing and 95% about nineteen. Running an emergency department or a road network near full capacity is what produces the queue.

In practice

• An emergency department running at 85% of capacity has short waits; at 96% the same department has four-hour waits with the same staff.
• A team where every engineer is fully allocated cannot absorb one sick day, and a fortnight of slippage follows.

Attributed to

John Kingman

Also called

VUT equation

Further reading

Wikipedia

Page for this entry

Intervening in a system's goals, rules, and paradigms changes far more than adjusting its parameters.

Meadows's 1999 list ranks twelve leverage points, with parameters weakest and paradigms strongest. Her point is that everyone intervenes at the weak end because that is where the levers are visible.

In practice

• A charity that changes its funding formula changes more than one that doubles its budget.
• A team that changes what counts as done changes more than one that adds two engineers.

Attributed to

Donella Meadows

Further reading

Wikipedia

Page for this entry

An early and possibly inferior standard becomes entrenched because switching cost rises with adoption.

David's 1985 article became the canonical illustration of path dependence, but the empirical claim that QWERTY is an inferior standard locked in by historical accident is disputed. Switching costs and coordination effects are real mechanisms; QWERTY is not an uncontested proof of inefficient lock-in.

In practice

• A country's rail gauge, a keyboard layout and a date format all persist because switching costs rise with adoption.
• An organisation's file-naming convention is agreed badly in year one and is unchangeable by year five, though nobody defends it.

Attributed to

Paul David

Also called

QWERTY effect; standards lock-in

Possible explanations

The explanation is increasing returns to adoption: as users learn a standard, the cost of switching rises for everyone, so an early lead can become permanent regardless of merit.

In its favour

The mechanism is not in doubt and is well modelled, with clearer cases than the typewriter, including electrical standards and file formats.

Against it

The founding illustration is disputed: the evidence that QWERTY is meaningfully inferior to alternatives is weak, and critics argue that markets have in fact switched standards when the gain was large enough.

Standing

The mechanism is not in doubt; the claim that QWERTY is an inferior standard locked in by accident is disputed.

Page for this entry

Complex systems that persist are organised as loosely coupled hierarchies of tightly coupled parts.

Simon's 1962 argument in The Architecture of Complexity, illustrated by two watchmakers: the one assembling in subunits recovers from interruption, the one assembling serially does not.

In practice

• An organisation of ten tight teams with clean interfaces survives a failure in one; one where everything talks to everything does not.
• A city with distinct neighbourhoods absorbs a local shock; one with a single integrated transport dependency does not.

Attributed to

Herbert Simon

Page for this entry

A loop that counteracts deviation stabilises a system and resists outside intervention.

The thermostat, the central bank and the disciplinary process are all balancing loops. The awkward property is that they resist intervention as vigorously as they resist disturbance.

In practice

• A performance management process resists improvement as vigorously as it resists neglect, because both are deviations.
• A budget process that returns to the same allocation each year is not failing; it is doing what a balancing loop does.

Attributed to

Norbert Wiener

Also called

Balancing loop

Further reading

Wikipedia

Page for this entry

Past decisions constrain future options, even when better alternatives exist.

David's and Arthur's work. The QWERTY keyboard, the 4-foot-8.5-inch rail gauge and the QWERTY-derived phone keypad all persist because coordination benefits exceed any improvement from switching.

In practice

• A city whose tram gauge was fixed by one nineteenth-century contractor is buying rolling stock to that gauge in 2024.
• A company that chose a database in year one has an architecture organised around it by year six, and the choice is no longer reversible on the merits.

Attributed to

Paul David; W. Brian Arthur

Further reading

Wikipedia

Page for this entry

Recurring design problems have named, combinable solutions that can be composed at many scales, from a doorway to a region.

Alexander's 1977 book gives 253 patterns from regional planning down to window seats. It is the direct ancestor of software design patterns and of the modern design-system idea.

In practice

• A street of houses built to no common plan still reads as a street, because the builders reused the same handful of arrangements for doors, windows and setbacks.
• A design system with named, combinable components is the same idea: the value is that a team can compose without redesigning, which is why software borrowed it directly.

Attributed to

Christopher Alexander

Standing

The direct ancestor of software design patterns and of the design-system idea.

Further reading

Wikipedia

Page for this entry

When actors pull a system towards conflicting goals, an intervention on one goal is absorbed and the system snaps back.

Meadows's term. Rent control, drug enforcement and traffic engineering all show it: the system contains actors pulling toward other goals, and the intervention is absorbed rather than resisted openly.

In practice

• Rent control caps rents and reduces supply, so the average tenant's cost is unchanged and the queue is longer.
• A firm that caps its support headcount finds the ticket backlog restores the same waiting time it had before the cap.

Attributed to

Donella Meadows

Page for this entry

Changes amplify themselves; success breeds more success.

The bank run, the arms race and the viral post are all reinforcing loops. The design consequence is that they must be bounded by something external, since nothing internal will stop them.

In practice

• A rumour about a supplier's solvency prompts buyers to demand shorter payment terms, which strains the cash the rumour was about.
• A hiring reputation that attracts strong candidates produces strong hires, which improves the reputation, and the initial advantage was small.

Attributed to

Cybernetics, Norbert Wiener

Also called

Reinforcing loop; virtuous or vicious circle

Further reading

Wikipedia

Page for this entry

Optimising a system for expected conditions makes it fragile to conditions outside them.

Carlson and Doyle's term. The mechanism is that optimisation spends the margin: a supply chain tuned for cost has no slack, which is exactly what absorbs an unexpected disruption.

In practice

• An airline that cuts turnarounds to the minute runs to schedule all summer and loses a day's flying to one thunderstorm.
• A hospital optimised for bed occupancy has no capacity for a bad week, and a bad week arrives annually.

Attributed to

Carlson & Doyle

Also called

Robust yet fragile

Page for this entry

Relying on an outside intervener erodes the system's own capacity, which deepens the dependence.

Senge's archetype. Painkillers, consultants, and foreign aid all show it: the intervener's capability substitutes for the system's own, which then atrophies, which increases the reliance.

In practice

• A parent who does the homework to end the argument finds the argument arriving earlier each evening.
• A department that outsources its analysis loses the ability to specify what it wants analysed, and the dependence deepens each year.

Attributed to

Peter Senge

Page for this entry

Complex functioning order can arise from many local adjustments without design, and often outperforms designed alternatives.

Hayek's 1960 argument. Language, common law and prices are his examples: all are highly ordered, and none was designed. Compare Gall's law, which makes a structurally similar claim about engineered systems.

In practice

• A market town's Saturday stalls occupy the same pitches every week, and no register of pitches exists.
• A neighbourhood's informal parking convention works better than the signage that replaces it, and nobody could write down the rule.

Attributed to

Friedrich Hayek

Also called

Catallaxy; cosmos versus taxis

Standing

Compare Gall's law, which makes a structurally similar claim about engineered systems.

Further reading

Wikipedia

Page for this entry

Throughput is set by one binding constraint; improvement anywhere else is illusory.

Goldratt's 1984 argument. The counterintuitive consequence is that improving a non-bottleneck raises inventory and costs without raising throughput, so local efficiency measures actively mislead.

In practice

• A factory that buys a faster cutting machine finds the paint shop still sets the output, and now has more part-finished stock waiting for it.
• A team that speeds up the stage before the review queue produces a longer review queue, and the local efficiency metric improves.

Attributed to

Eliyahu Goldratt

Also called

TOC; drum-buffer-rope

Further reading

Wikipedia

Page for this entry

Some problems have no definitive formulation, no stopping rule, and no test of the solution, so every attempt is consequential and unrepeatable.

Rittel and Webber's 1973 paper. Their list is the useful part: no stopping rule, no test of the solution, every attempt consequential, and no opportunity to learn by trial and error.

In practice

• A team asked to fix declining trust cannot say what finished looks like, and every intervention changes the thing it was measuring.
• A homelessness strategy cannot be piloted, reversed or scored, which is why importing project management from engineering fails on it.

Attributed to

Rittel & Webber

Further reading

Wikipedia

Page for this entry

Users spend most of their time on other products, so they expect yours to work the way those do.

Nielsen's 2000 rule, and the reason interface novelty is usually a cost. It is the interface case of the principle of least astonishment, and it argues against distinctiveness for its own sake.

In practice

• A banking app that puts the balance where every other banking app puts it is used correctly; the one that innovates is not.
• A checkout that asks for the card number before the address is abandoned more often, because every other checkout asks in the other order.

Attributed to

Jakob Nielsen

Standing

The interface case of the principle of least astonishment.

Page for this entry

Three distinct wastes — futile work, uneven flow and overburden — where removing one can create another.

Toyota's practice separates what Western efficiency drives usually merge. Muda is work that adds nothing; mura is variation in flow; muri is loading people or machines beyond capacity. The three interact: cutting muda by removing slack raises muri, and levelling mura is what makes the reduction hold.

In practice

• A team that removes its buffer hits every target for a quarter and loses two people in the fourth.
• A clinic that smooths its appointment book treats the same number of patients with less overtime.

Attributed to

Toyota Production System

Also called

The three Ms; waste, unevenness, overburden

Page for this entry

Reform should proceed by small correctable steps, because large designs cannot be tested and their failures cannot be undone.

Popper's 1945 argument, and the methodological complement of falsificationism. Close kin to Lindblom's muddling through, from an entirely different political starting point.

In practice

• A council that pilots a scheme in two wards before a borough rollout can reverse it; one that launches everywhere cannot.
• A team that changes one variable per release can attribute the effect; one that ships a redesign cannot say which part worked.

Attributed to

Karl Popper

Standing

The methodological complement of falsificationism, and close kin to Lindblom's muddling through.

Page for this entry

Design so that the wrong action is physically impossible, rather than discouraged by training or attention.

Shingo's principle, developed on Toyota lines: a fixture that will not close unless the part is the right way round removes a class of defect entirely, where a warning sign only reduces it. The design question is not how to make people careful but how to make carelessness harmless.

In practice

• A connector that only fits one way ends a fault the training slide had failed to end for six years.
• A form that cannot be submitted with the date field empty removes the query the helpdesk raised weekly.

Attributed to

Shigeo Shingo

Also called

Mistake-proofing; error-proofing

Further reading

Wikipedia

Page for this entry

The purpose of a system is what it does, not what its designers say it is meant to do.

Beer's dictum. Its value is as a refusal to accept stated purpose: a system that reliably produces an outcome has that outcome as its purpose, whatever the mission statement says.

In practice

• A complaints procedure that resolves four cases a year in a service with nine thousand users is doing what it does, and its stated purpose is not it.
• A grant process that funds the same six organisations every year has funding those six as its purpose, and the criteria are downstream of that.

Attributed to

Stafford Beer

Also called

The purpose of a system is what it does

Page for this entry

Be conservative in what you send, liberal in what you accept.

Postel's 1980 rule from TCP specification. Now contested in protocol design: leniency in what you accept entrenches other people's bugs, so the standard drifts toward whatever implementations happen to do.

In practice

• A payments gateway that quietly accepts dates in three formats is receiving all three from its clients within a year, and can never drop any of them.
• A parser that tolerates malformed input finds every producer relying on the tolerance, and the specification is now whatever the parser does.

Attributed to

Jon Postel

Also called

Be conservative in what you send, liberal in what you accept

Possible explanations

The explanation is interoperability under imperfect implementation: accepting sloppy input lets a network grow when not everyone implements the standard correctly.

In its favour

It worked as intended in the early internet, where strict rejection would have prevented adoption, and it remains sound advice where the sender cannot be fixed.

Against it

It is now contested in protocol design, since leniency entrenches other people's bugs, the de facto standard drifts towards whatever the most popular implementation accepts, and security flaws follow from parsing input that should have been rejected.

Standing

Now contested in protocol design, where leniency is argued to entrench bugs.

Page for this entry

A component should behave as its users already expect, not as its author finds most elegant.

Software design folklore. It argues against cleverness in interfaces: a function that does something surprising but better is a defect, because callers reason from expectation rather than documentation.

In practice

• A function named "save" that also sends an email is a defect, however useful the email.
• A door handle that must be pushed where every other handle in the building is pulled will be pulled, and the labelling will not help.

Attributed to

Software design folklore

Also called

Principle of least surprise

Further reading

Wikipedia

Page for this entry

Every application has inherent complexity that cannot be removed, only shifted.

Tesler's insight from Xerox PARC: complexity moves between the user and the developer but does not vanish. Every simplification a user enjoys was absorbed by someone building it.

In practice

• A payroll system with one button for the user has a rules engine of four hundred conditions maintained by two people.
• A restaurant with a single-page menu has a prep list that starts at six in the morning.

Attributed to

Larry Tesler

Also called

Waterbed theory

Page for this entry

Allow none, one, or infinite; anything in between lacks rationale.

Van der Poel's rule. Any fixed limit other than none or unlimited encodes an assumption that will be wrong, which is why arbitrary caps are the most common source of later rewrites.

In practice

• A database field allowing exactly two directors meets its first company with three, and the change touches every screen that reads it.
• A form that allows exactly three phone numbers will meet its first four-number case within a year, and the rewrite costs more than the generality would have.

Attributed to

Willem van der Poel

Further reading

Wikipedia

Page for this entry

Engineering is done with numbers; analysis without numbers is only an opinion.

Akin's rules were written for spacecraft engineers but travel well: any proposal without numbers attached is a preference wearing technical clothing.

In practice

• A proposal claims the migration will "significantly reduce" support load; asked for a figure, nobody has one, and the estimate turns out to be a hope.
• A safety case that says a component is "highly reliable" without a failure rate is a preference in engineering vocabulary.

Attributed to

David Akin

Page for this entry

Possessing every component and none of the ordering, which is the characteristic form of failed execution.

Morecambe's defence, when told he was playing the wrong notes, was that he was playing all the right notes but not necessarily in the right order. The joke names a failure that is easy to miss: an organisation or a design may hold every necessary element and be worthless because sequence, dependency and timing carry most of the value.

In practice

• A project with every workstream staffed and none sequenced delivers nothing for a year and can account for every hour.
• A recipe followed with the steps reordered produces something that contained the right ingredients.

Attributed to

Eric Morecambe

Also called

Not necessarily in the right order

Page for this entry

An unearned external resolution that discharges a problem the situation could not have solved.

From Greek theatre, where a crane lowered a god to resolve the plot. Bailouts, reorganisations and emergency funding are the institutional version: the problem is discharged, and the structure that generated it is untouched.

In practice

• A failing programme is rescued by an unexpected central grant, and the causes of the failure survive intact.
• A company avoids a difficult decision when an acquirer appears, and the acquirer inherits the decision.

Attributed to

Greek theatre

Standing

Used of bailouts, reorganisations, and any rescue that leaves the underlying structure intact.

Further reading

Wikipedia

Page for this entry

Improvised sufficiency under constraint: a working solution assembled from what is available, at a cost in safety and durability.

The word covers everything from a diesel pump mounted on a cart as improvised transport to a hospital reusing equipment past its rating. It is genuinely a capability, and it is also what a system produces when the proper part cannot be got, which is why the same example is offered as inspiration and as indictment.

In practice

• A team ships on time using a script nobody documented, and pays for it at every subsequent change.
• A ward that improvises a fitting keeps the machine running, and the improvisation is invisible in the incident report.

Attributed to

Indian and South Asian practice

Also called

Frugal innovation; the workaround

Possible explanations

One explanation is scarcity: where parts, capital and permission are short, an improvised fix is the only available one. Another is institutional, since rules that cannot be met are routed around rather than changed.

In its favour

It names a real capability, and management research on frugal innovation documents products designed for constrained markets that work where imported designs do not.

Against it

Indian critics argue the same word normalises unsafe workarounds and substitutes for fixing the conditions that require them, and the safety costs fall on the people using the improvised version.

Standing

Celebrated in management writing as frugal innovation and criticised within India for normalising unsafe workarounds. Both readings describe the same practice; the disagreement is about when the trade is worth making.

Further reading

Wikipedia

Page for this entry

Systems counteract disturbances—institutions resist change.

Borrowed from chemistry, and the borrowing is metaphor rather than derivation. The institutional observation it names is real; the chemical law provides no warrant for it.

In practice

• A tax on one form of income raises receipts for a year, and the income reappears in a form the tax does not name.
• A department reorganised to reduce a bottleneck finds the bottleneck reappearing at the next stage within two quarters, which the analogy names and does not explain.

Attributed to

Henry Louis Le Chatelier

Standing

Borrowed from chemistry; the social reading is metaphor, not derivation.

Page for this entry