Six minutes before the end of a night shift, someone asks whether the gas test really needs redoing. It was clear an hour ago. The permit's already signed off. Everyone wants to go home. Nobody says the words out loud, but the room has already decided: it'll be fine.
It is fine. It's fine the time after that, and the eleven times after that — until, on some ordinary shift with nothing unusual about it at all, it isn't.
That gap — between the ten times you got away with it and the eleventh time you didn't — is where this piece lives. It doesn't announce itself with an alarm. It doesn't have an obvious cause. Until 1996, it didn't even have a name.
That year, the sociologist Diane Vaughan published her account of how NASA came to launch the Space Shuttle Challenger despite years of internal data showing its O-rings could fail in exactly the cold-weather conditions that destroyed it. Her conclusion wasn't incompetence, and it wasn't a single reckless decision. It was slower and more ordinary than either. She called it the normalization of deviance: a signal that should stop the operation gets observed, discussed, tolerated, and quietly re-filed as acceptable — not because anyone decided it was safe, but because nothing went wrong last time. Each successful flight didn't fail to raise the alarm. It lowered what counted as one.
Here is the part that makes the pattern so hard to break, and the part most re-tellings skip: "it'll probably be fine" is usually correct. That's not a flaw in the argument. It's the entire mechanism. If shortcuts failed most of the time, nobody would take them twice. They survive, and spread, precisely because they work almost every time — and "almost" is a word that only shows you its price after the fact.
From the outside, and often from the inside too, a system running on genuine control and a system running on accumulated luck produce identical results, for exactly as long as the luck holds. Nobody gets shown the counterfactual. A control that worked leaves no trace of having been needed. A gap nobody's found yet leaves no trace either. Outcome and cause quietly come apart — and in that gap, luck does the one thing it does best: it impersonates competence for as long as it takes everyone to stop checking.
This is why the sites running on luck often feel calmer than the ones running on discipline, right up until they don't. Fewer near-miss reports read as fewer near misses, not as fewer people looking. A relaxed toolbox talk reads as a confident crew, not an assumption nobody's tested lately. The only question that tells you anything real is the counterfactual one: would this have held if the lucky break hadn't turned up today? If the answer changes depending on who's on shift, that isn't a safety culture holding. That's a streak — and streaks are, by definition, borrowed time with good manners.
What replaces it is almost embarrassingly unglamorous. Redoing the gas test anyway, six minutes from the end of a shift, because six minutes never used to matter until the one time it did. Saying the same thing in the toolbox talk you've said fifty times, because the fifty-first person hasn't heard it yet. Logging the near miss as data instead of retelling it afterwards as the story where nothing happened. None of it produces a dramatic moment. All of it is the actual, unremarkable difference between a system built to hold and one that simply hasn't yet met the day its luck ran out.
Six minutes before the end of a shift, the gas test gets redone anyway. Nobody claps. Nobody even notices. That's exactly what it looks like when it's working.
First published on the Hartfell Safety LinkedIn page, 13 July 2026.