The wrong bottleneck.

How a rocket sled, a mis-wired sensor, and a misunderstood law explain why most innovation aims at the wrong subsystem.

On 10 December 1954 John Stapp took 46.2 G to prove aviation had blamed the wrong component: the body was fine, the seat was the constraint. The same misidentification, the wrong bottleneck, is the most expensive recurring error in innovation, and Murphy’s Law and poka-yoke are its two forgotten correctives.

On 10 December 1954, at Holloman Air Force Base in New Mexico, an Air Force physician named John Paul Stapp strapped himself into a rocket sled called Sonic Wind I and accelerated to 632 miles per hour (roughly 1,017 km/h) in a few seconds, faster than a .45 calibre bullet.

Then he stopped. In 1.4 seconds.

The deceleration hit him with a peak force of 46.2 G. The capillaries in both eyes burst; his eyes flooded with blood. On the way to the hospital he lay convinced that one or both retinas had detached and that he would be blind for the rest of his life. By the following day he had recovered enough vision to be discharged. His eyesight never fully returned.

Stapp was not a daredevil, and the experiment was not about speed. He was trying to settle an argument about where a problem was located, and the answer he produced is one of the cleanest demonstrations in engineering history of a specific, recurring, expensive mistake.

The industry was optimising the wrong subsystem.

The verified numbers, in one place.

I. The orthodoxy

Why were pilots dying in crashes they should have survived?

Before Stapp, the working assumption in aviation was that the human body could survive only a modest deceleration, a limit low enough that aircraft seats and restraints were engineered to match it. The number was treated as a fact about biology.

Everything downstream followed from it. If the body gives out at a given load, there is no point building a seat that survives more. So seats were built to that specification, and in higher-energy crashes the seat tore free of its mounting and the pilot died, not from the deceleration itself, but from striking the instrument panel.

Read that sequence again, because it is the whole argument. Pilots were dying from an engineering failure that the industry had classified as a biological limit. The seat was the thing that broke. But the seat was never examined, because the body had already been named as the constraint.

This is not a story about insufficient care. Everyone involved was competent and working hard. They were working hard on the wrong component.

II. The reverse salient, correctly identified

What is a reverse salient?

The historian of technology Thomas P. Hughes gave this failure mode its name. Studying how large technological systems actually evolve, he borrowed a term from military history: the reverse salient, the section of an advancing front that lags behind the rest, and which therefore governs how fast the entire line can move.

The insight is uncomfortable and useful in equal measure. A system’s performance is capped by its laggard, not lifted by its leader. Improve anything other than the reverse salient and you have spent real money to move nothing. Worse, the improvement will feel like progress, because something measurably got better.

Which makes correct identification of the lagging component the highest-leverage act available to anyone working on a complex system, and misidentification the most expensive error, because it is invisible from the inside. A team optimising the wrong subsystem looks exactly like a team doing good work.

Aviation had named the human body as its reverse salient. Stapp’s sled runs demonstrated that the body would tolerate far more than doctrine allowed. The real lagging component was the seat, the harness, and the mounting structure: ordinary mechanical engineering, entirely within the industry’s power to fix, and untouched for years because it had been reasoned out of the problem.

Stapp did not discover a new fact about human physiology so much as relocate a bottleneck. That relocation is the innovation.

A team optimising the wrong subsystem looks exactly like a team doing good work.

III. Murphy’s Law, before it became a joke

What did Murphy’s Law originally mean?

Five years earlier and a state away, at Muroc Army Air Field in California, later Edwards Air Force Base, the same research programme produced a phrase that has been misunderstood ever since.

Project MX-981 was running deceleration tests. On one run the sled performed correctly but the instrumentation recorded nothing. A development engineer named Edward A. Murphy Jr., who had designed the strain-gauge sensors, examined the assembly and found that the sensors had been installed the wrong way round.

What Murphy said next is not preserved in any contemporaneous record, and the reconstructions differ. But the engineering conclusion the team drew from it is well attested, and it is the opposite of the fatalism the phrase now carries:

If a component can be assembled incorrectly, eventually someone will assemble it incorrectly. Therefore the engineer’s job is not to ask for more care. It is to make the incorrect assembly physically impossible.

That is a design specification, not a lament. It contains an instruction, a test, and an acceptance criterion. It says: do not put a human being in a position where their attention is the only thing standing between the system and failure, because attention is not a control.

The modern usage, the sigh when the toast lands butter-side down, the shrug when the bus arrives the moment you light a cigarette, inverts it completely. The pop version asks nothing of you and prevents nothing. The engineering version asks the only question that matters: where can this fail, and how do I make that failure structurally unavailable?

The corrective is physical. Make the connector pins different sizes. Make the plug asymmetric. Let the geometry of the part refuse the error, so that no amount of fatigue, pressure, or bad light on a Friday afternoon can produce it.

IV. What we actually know about the name

Who actually coined Murphy’s Law?

The provenance is genuinely unresolved, and it is more interesting unresolved than it would be settled.

George Nichols, who led the project, maintained that Murphy received too much credit: that Murphy had complained about a technician, and that it was Nichols and the team who distilled the complaint into a usable engineering rule. Murphy’s side held that the law had been misappropriated and inverted into a joke at his expense. The dispute ran for decades. The definitive account is Nick T. Spark’s A History of Murphy’s Law; notably, Stapp’s own New York Times obituary gives a version of Murphy’s role almost backwards from other tellings.

Then the record complicates further. The earliest certain appearance of the phrase in print is not military at all. It is in a psychologist’s research paper: Anne Roe, “A Psychological Study of Physical Scientists,” Genetic Psychology Monographs, vol. 43, no. 2 (May 1951), p. 204. Roe recorded a physicist stating the principle (if anything can go wrong it will) and naming it Murphy’s law. Her interviews were conducted around 1949, the same period as MX-981.

And the physicist did not attribute it to the Air Force. He said he had been told it by an architect.

The first sustained printed attributions to Stapp’s team come later: Lloyd Mallan’s Men, Rockets and Space Rats(1955), the MATS Flyer in January 1956, the New York Times on 22 January 1956, and the U.S. Navy’s Approach magazine from April 1956.

So the honest position is this: a design principle about the inevitability of assembly error was circulating among people who build things, in at least two professions, at roughly the same moment. Whether the desert team coined it or caught it, they are the ones who sharpened it into a rule and put it to work. That is a more accurate story than a single origin, and a better one, because it suggests the principle was not invented but found, by more than one set of people who had been burned by the same class of failure.

V. Convergence, not lineage

What is poka-yoke, and why does independent convergence matter?

A decade later and an ocean away, Shigeo Shingo, working within Toyota’s production system, arrived at the same conclusion and gave it a name: poka-yoke, “mistake-proofing.” Design the jig so the part cannot seat backwards. Design the fixture so a missing step halts the line. Never rely on the operator noticing.

There is no documented influence running from a New Mexico test range to a Japanese assembly plant. These are independent discoveries, and that independence is the strongest available evidence for the principle. Two engineering cultures, separated by a decade, a language, and an industry, examined recurring human error and drew the same structural conclusion: the fix belongs in the artefact, not in the operator’s vigilance.

When two traditions converge on an answer without contact, the answer is usually about the shape of the problem rather than the taste of the people solving it.

VI. The second reframe

How did John Stapp reframe automobile safety?

Stapp’s more consequential work came after the sled.

He observed that Americans were not dying in aircraft in significant numbers. They were dying in cars, tens of thousands a year through the 1950s and 60s and past fifty thousand a year by the mid-1960s, at speeds a fraction of what he had personally survived. The manufacturers’ position was that accidents happen and death in a crash is not preventable.

Stapp’s intervention was not a safety argument. It was a problem-definition argument, and it is worth separating the two.

A safety argument says this is dangerous, please be careful. A problem-definition argument says you have named the wrong thing as the cause. The industry had located the problem in the collision. Stapp relocated it to the passenger compartment: the crash is the given, the survivable-volume design is the variable. That is the same move he had already made in aviation: take the thing everyone treats as fixed, demonstrate it is not the binding constraint, and redirect effort to the component that actually caps performance.

He also did something less cinematic and more durable. In 1955 he founded what became the Stapp Automobile Safety Conference, an annual symposium for sharing crash-protection data. Testimony persuades a committee once. An institution that makes findings shareable compounds for decades. For anyone interested in how methodology actually propagates, the conference is the more instructive achievement.

The legislative outcome followed. President Lyndon Johnson signed the Highway Safety Act of 1966 with Stapp present; federal standards required seat belts in new cars sold in the United States from 1968. The Department of Transportation Act was signed on 15 October 1966, and the department began operations on 1 April 1967.

VII. What the methodology graph holds

What does the methodology graph know, and what is it missing?

This article was built against a live knowledge graph of the Problems Worth Solving methodology, 29,055 nodes, and the query is itself informative. (Every node name below was verified against the graph on 2026-08-19; so was the absence.)

Present, and richly so:

• Reverse Salient, carrying Reverse Salient Correction Framework, Identify the reverse salient, Correcting reverse salients by solving critical problems, A Sequence of Reverse Salients, and Reverse Salients Introduction: Spot systemic bottlenecks
• Assumption Challenging, held as a Technique, alongside Riskiest Assumption Test and Challenge Existing Assumptions and Paradigms
• Ill-defined Problems: Challenging Orthodoxies, held as a Course

Those three cover the Stapp story almost completely. The 18-G doctrine is an orthodoxy that went unchallenged because it was never framed as an assumption. The seat was a reverse salient that went uncorrected because the body had been named in its place. The methodology already has vocabulary for both failures.

Absent entirely:

• Poka-Yoke: no node, no alias, no edge.

The graph knows how to find the lagging component and how to challenge the assumption that hides it. It has no formal representation of the corrective move, the design decision that removes the error from the space of possible outcomes rather than asking humans to avoid it.

That gap is worth closing, because the two halves are not the same skill. Identifying a reverse salient is diagnostic. Mistake-proofing is prescriptive. A methodology strong on diagnosis and silent on the corrective will reliably produce teams who can name their bottleneck and then reach for the oldest and worst intervention available: tell people to be more careful.

VIII. The argument

Why does the demotion of Murphy’s Law matter?

Murphy’s Law is a problem-definition instrument that was demoted into a shrug.

In its original form it asks a question with a testable answer (where can this fail, and how do I make that failure impossible?) and it locates responsibility in the design rather than the operator. In its popular form it asks nothing, tests nothing, and licenses inaction. The degradation is not merely a loss of nuance. It is a reversal: a tool for assigning engineering responsibility became a phrase for declining it.

And the failure mode it warns against is the one that killed those pilots. A culture that responds to recurring error with be more careful has accepted a wrong problem definition, precisely the error of designing seats to a limit that was never the real constraint. In both cases the work is sincere, the effort is real, and the improvement is aimed at a subsystem that was not holding anything back.

Stapp’s answer, delivered at 46.2 G with his eyes full of blood, was that the body was not the problem.

The question worth carrying out of it is the one his team wrote down in the desert and the one Toyota rediscovered on the line: not “who made the mistake,” but “what made the mistake possible,” and can it be made impossible?

The four questions people actually search.

Copy the question. Fill in your system.

We have a system that is not improving no matter how much we invest, and I suspect we have named the wrong bottleneck.

The system: [DESCRIBE IT IN TWO OR THREE LINES - the product, process, or research program, and the component everyone agrees is the limiting factor].

Here is what makes me suspicious. The official constraint has been the official constraint for years. Everything around it keeps getting better, and the system's overall performance barely moves. When a failure happens, we explain it with the official constraint and move on. Nobody has recently tested whether the named limit is real, and the component that actually breaks first is not the one in the story we tell.

Do not accept my framing. Find the reverse salient: the component that is actually holding the line back. Then stress-test the assumption that named the current constraint, and tell me what it would take to make the failure impossible rather than merely less likely.