An engineer runs her hand along the housing — not out of doubt, but because she already knows there’s a second one just like it, waiting on the other wing.
For fifteen years, I spent my days in an environment where complex systems weren’t allowed to have a single point of failure. In my work, one principle was absolute: no critical component could rely on a single element that, if it broke, would take everything down with it. Then I got sick, and for years I went from one specialist to another without anyone managing to put a name to what I was living through. I found out, with even more clarity, that in real life, no one applies that principle to themselves. Me least of all.
When a rheumatologist finally gave me a diagnosis and a treatment plan, I told him I was about to leave on a trip: six months toward the North Cape, four years in the planning, the dream we’d been building since before my husband retired. “Go ahead, don’t worry,” he said, smiling. “Take this beautiful trip, and if anything comes up, just write to me.” I trusted him. I thought I had a doctor on my side, ready to support me even from a distance.
I was wrong.
The medication started making me feel worse. We were in Germany, traveling in Romeo, our camper truck, at the start of those six months. I wrote to the doctor, exactly like he’d told me to. One email. Two. I called him. Once, twice, three times. No one ever answered. The doctor who’d said “write to me if anything comes up” vanished into thin air. It was a private clinic in Germany, not him, that told me to stop the medication immediately.
That was the moment I understood that, fundamentally, I was alone. Medicine had given my condition a name, wished me a wonderful trip, and then left me hanging in a void of silence. Not a single point of failure — the single point, plain and simple. I had entrusted the most critical part of my existence to one doctor, in one moment of trust, with no backup system at all — exactly the mistake I would never have let happen in my own work.
In aviation there’s a non-negotiable principle: no critical system is allowed a “single point of failure” — one component that, if it breaks, takes everything else down with it. Not because engineers don’t trust the primary system, but because they start from a realistic assumption: systems don’t fail because they’re badly designed — they fail because complexity makes breakdown statistically inevitable over time. That’s why an aircraft has two engines, redundant hydraulic systems, backup batteries — not bolted on after an accident, but built into the structure from the very beginning, before they’re ever needed.
Safety engineer Nancy Leveson has a line that sums it up: “Safety is not the absence of accidents, but the presence of defenses.”
But there’s a technical detail almost no one outside engineering knows — and it’s exactly what makes real redundancy harder to build than it looks: two backup systems aren’t enough if they share the same cause of failure. In aviation, it’s called a common mode failure. If two engines are fed by the same fuel pump, they’re not redundant — they’re the exact same point of failure, just wearing two different numbers on the dashboard. When that pump goes, you lose both of them, at the same instant, together.
For fifteen years I worked in an environment where this principle was absolute — and yet I’d never applied it to myself. I had entrusted myself to a single doctor as if he were the only engine on a plane. Surprise: when that engine stopped, I went down.
Here’s something anyone who designs complex systems knows, and most people don’t: redundancy isn’t a cost — it’s the only rational way to manage a risk you know for certain will come around again. A plane doesn’t install a second engine because it expects the first one to be faulty. It installs one because the sheer physics of complexity guarantees that, over enough flights, something eventually gives out. That’s not pessimism. It’s the only kind of realism compatible with survival.
For years I applied this principle everywhere except my own private life. At work, no serious project gets built around the availability of one key person — there’s always a plan B, someone who can step in. And yet when it came to my own care, I did the exact opposite: I treated a single doctor as if he were the only engine on a plane, with no backup system whatsoever.
But here’s the part almost no one stops to consider, and it’s the part that separates real redundancy from an illusion of safety: adding a second doctor, a second friendship, a second routine isn’t enough on its own. If the second doctor has the same training, the same tendency to minimize pain that leaves no visible trace, he’s running off the same “fuel pump” as the first — and he’ll go down at the same moment, for the same reason. If the two people you trust with your deepest truth both draw their judgment from the same culture that treats invisible illness as exaggeration, you don’t have two points of support. You have one, wearing two faces. Doing Sustain right means building supports that can fail for different reasons — not just building more of them.
In the method I’ve built over these years — The 4S Method of Adaptive Intelligence™ — this step has a precise name, the last of the four pillars: Sustain. It doesn’t mean “find someone to save you” — that’s still single-engine logic, just wearing a gentler name. And it doesn’t mean simply multiplying your points of support if they all share the same hidden vulnerability underneath. It means identifying which areas of your life are flight-critical, and designing real redundancy for those — components that can only fail for causes independent of one another. Health is flight-critical. Work often is too. So is a relationship your sense of being understood depends on. And every flight-critical area deserves more than one component holding it up, as long as those components don’t share the same weak point.
I haven’t stopped needing help. I’ve stopped designing the most critical parts of my life as if they could never fail — and I’ve stopped fooling myself that stacking up backups was enough, when they were all wired to the same pump.
An engineer doesn’t wait for an engine to fail before designing the second one. Not out of distrust — out of respect for complexity: they know the system will eventually be put to the test, and they want it to hold even when one piece gives out. They also know the second engine has to be genuinely independent from the first, not just a duplicate wearing a different name. I spent fifteen years trusting this principle applied to aircraft, and then I spent just as many years systematically breaking it in my own life.
I’m no longer waiting for a single doctor, a single friendship, a single routine to be enough to hold everything up. I’ve learned to ask myself, before something gives out: if this piece stopped tomorrow, what would replace it — and does that replacement share the same vulnerability as the original, or is it genuinely independent? If the answer to the first question is “nothing,” that’s where redundancy needs to be built. If the answer to the second is “yes, it shares it,” that redundancy is just an illusion.
If you’ve built an important part of your life around a single point of support — or around several points that actually all rest on the same fragile foundation — noticing that isn’t weakness. It’s the beginning of better design. Ask yourself which parts of your life are truly flight-critical, and start building, one piece at a time, a second engine that’s actually a second engine — not just a copy of the first.
Sources
Nancy Leveson, “Safety is not the absence of accidents, but the presence of defenses” — Engineering a Safer World: Systems Thinking Applied to Safety, MIT Press: https://mitpress.mit.edu/9780262533690/engineering-a-safer-world/
Single point of failure / redundant design principles in aviation safety engineering — LSE Research Online, “Applying Systems Thinking to Analyze and Learn from Accidents”: https://eprints.lse.ac.uk/36537/1/Disspaper53.pdf
Stay in The Loop
Follow the WhatsApp Channel: It’s free, and that’s where I share articles as soon as they’re out — [Link Here]