Design Review¶
Design-gate ritual — instantiates Failure Mode Anticipation
A milestone gate where a proposed design is presented and challenged for failure paths, and cleared to proceed only once each serious weakness carries an assigned, owned mitigation that changes the design.
A Design Review is the scheduled, facilitated event at which a proposed design is put in front of people with the authority to stop it, held against the requirements it promised to meet, and searched for the ways it could fail. Its distinguishing move among its siblings is not analysis but convening and consequence: it is a milestone gate with the power to withhold approval, and its whole job is to convert whatever failure paths surface into assigned, owned actions that must change the design before it passes. The analytical techniques — a table, a scenario walk, a fault tree — are things a review hosts; what only the review does is hold the design to its stated function, demand a fix with a name against it for every serious weakness, and refuse to sign off until those fixes exist. Strip that gate authority away and you have a status meeting; keep it and the anticipation actually bites the design.
Example¶
An engineering firm reaches the Critical Design Review milestone[n1] for a new pedestrian footbridge over a rail line. The design is presented against its stated requirements: carry the specified crowd load, clear the rail envelope, drain in a hundred-year storm, be maintainable without closing the line. A cross-discipline panel — structural, geotechnical, the eventual maintenance crew, an independent chair — works down the requirements looking for failure paths. Someone notes the drainage scuppers sit exactly where winter grit will pack them solid, and nobody owns clearing them once the contractor leaves. That is not filed as a "risk"; it leaves the room as an action — relocate the scuppers and name the council's highways team as the maintenance owner — with a person responsible and a due date before fabrication. The review's verdict is not "looks good"; it is "conditionally approved, proceeds to fabrication once the six owned actions close." The bridge changes because the gate would not open otherwise.
How it works¶
The review's distinct machinery is the gate, not the technique it runs inside it:
- Open against the requirements. The design is measured against the function it promised to deliver, so the challenge has a fixed reference rather than drifting into general worry.
- Search with authority in the room. Reviewers include people who can block, plus the operators and maintainers who see the failure paths designers miss.
- Convert every finding into an owned action. A surfaced weakness is not recorded as a concern; it becomes a mitigation with a named owner who has the authority and capacity to close it.
- Gate on closure. The design proceeds only when no high-priority failure path is left without an owned action — the review's exit condition is a changed design, not an approved document.
Tuning parameters¶
- Gate strictness — advisory review versus a hard block that cannot be overridden by the sponsor. A real block forces change but slows the schedule and invites pressure to weaken the gate.
- Panel breadth and independence — the design team alone versus an independent chair plus operators and maintainers. Breadth catches more paths but costs coordination and can sprawl.
- Which milestones get one — every stage gate versus only the irreversible ones. More gates catch problems earlier but tax momentum.
- Action-closure rule — must close before proceeding versus tracked-open-with-a-date. Hard closure is safer; tracked-open keeps schedule but risks quiet slippage.
- Formality of the record — a verbal sign-off versus a logged action list with owners and dates. Formality is what stops the review decaying into a rubber stamp.
When it helps, and when it misleads¶
Its strength is that it is a forcing function with teeth: a scheduled event, on the critical path, where the design cannot advance until its serious failure paths have owned fixes. That is what turns anticipation from a good intention into a design change with a name attached.
Its signature failure mode is the rubber-stamp review — the meeting is held, the deck is walked, everyone nods, and nothing in the design changes, because the reviewers lack the authority to block or the assigned actions are never tracked to closure. A classic misuse is holding the review after commitment is effectively locked, when the gate has no power left to move anything. The guarding discipline is to give the gate real stop authority, to require a named owner with actual capacity for every action rather than a team or a "TBD," and to hold the review while change is still cheap — then verify closure before the design proceeds.
How it implements the components¶
function_or_requirement— the review opens by holding the design against the function it promised to deliver; that requirement is the fixed reference the whole failure search is measured against.mitigation_action— its output is a list of concrete actions that must change the design or its operating plan, not a list of noted concerns.failure_owner— every action leaves the room attached to a named person with the authority and capacity to close it before the gate opens.
It does not rank or score the failures it finds (risk_priority, severity_scale) — that quantified triage is Failure Modes and Effects Analysis — and it does not build the argument that the leftover risk is acceptable (residual_risk_decision), which is the Safety Case; the review assigns the fix, it does not certify the remainder.
Related¶
- Instantiates: Failure Mode Anticipation — the review is the gate that turns anticipated failure into an owned, design-changing action before the design proceeds.
- Consumes: Failure Modes and Effects Analysis, Failure Scenario Review, and Incident Pattern Review supply the failure findings the review acts on.
- Sibling mechanisms: Failure Modes and Effects Analysis · Failure Scenario Review · Incident Pattern Review · Safety Case · Fault Tree Analysis · Hazard Analysis · Premortem Workshop · Risk Register
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Design Review operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it a milestone gate where a proposed design is presented and challenged for failure paths, and cleared to proceed only once each serious weakness carries an assigned, owned mitigation that changes the design.
Independent corroboration: The frozen evidence defines Design Review as 'A milestone gate where a proposed design is presented and challenged for failure paths, and cleared to proceed only once each serious weakness carries an assigned, owned mitigation that changes the design', so its operative form is Assessment, Review & Assurance.
Nearest alternative: Decision, Gate & Allocation — The gate evaluates a proposed design against requirements and mitigation evidence before any clearance disposition.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Single lineage
Present-day reach: Multi-domain
Rationale: Systems engineering cohered milestone design reviews with authority to withhold approval until failure paths have owned mitigations.
Related originating lineages:
- Aviation & Aeronautics — Aerospace programs institutionalized formal preliminary and critical design review gates.
- Organizational & Management Science — Product governance supplied cross-functional sign-off and action ownership.
Review resolution: Systems engineering cohered milestone design reviews with authority to withhold approval until failure paths have owned mitigations. The retained alternate lineages materially shaped the mechanism's form.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
The design review is easy to confuse with the Premortem Workshop, another convening ritual — but they run in opposite directions. A premortem imagines the plan has already failed and works backward to recalibrate the team's confidence; a design review holds a concrete design against its requirements at a milestone and blocks it until the fixes are owned. One shifts a belief; the other gates an artifact.
[n1] A Critical Design Review (CDR) is the standard systems-engineering gate at which a design's maturity is judged sufficient to proceed to fabrication or build. Its defining feature is exactly the one that matters here: it is a decision point with authority to withhold approval, not merely a discussion. ↩