One bus shelter, twenty-two design methods

What it believes. A design is one choice per function. List the functions, list the options, and the whole space of designs is laid out in front of you.

Where it breaks. The chart assumes the rows are independent. A hedge windbreak and a mains-powered display are not independent of the roof, and nothing in the chart tells you which of the hundreds of combinations is any good.

What it believes. Design is a sequence of stages with a checkable output at each one. Analysis comes before ideas, and a written performance specification is the contract.

Where it breaks. You cannot write P1 until someone has already half-imagined a shelter with a seat in it. The specification smuggles in a solution, which is what Archer himself later conceded.

What it believes. List every way the form could fail to fit its context. Link the requirements that interact. Then cut the graph where the links are fewest, and solve each piece with its own diagram.

Where it breaks. The three dashed links are the ones the method throws away, and the first of them, seeing against sheltering, is the entire brief. Alexander made this objection himself a year later in "A City Is Not a Tree".

What it believes. Design is search through a space of alternatives. You cannot look at them all, so set aspiration levels and stop at the first candidate that clears every one.

Where it breaks. Everything interesting happened before the search started: someone chose these three measures and this order of generation. Sightlines are not a column, so no setting of the sliders can find the answer to the brief.

What it believes. There is no correct shelter, only positions that people argue for. Record the issues, the positions taken on them, and the arguments, and the design is whatever survives.

Where it breaks. The map grows faster than anyone can read it, and the third issue shows why: every problem turns out to be a symptom of another one. Keeping it tidy takes a trained facilitator, and the people who pay that cost are not the ones who benefit later.

What it believes. Good places resolve recurring conflicts between human forces. Name the conflict, state the resolving arrangement loosely enough that it never comes out the same way twice, and link it to the patterns above and below it.

Where it breaks. A pattern is only as good as the claim that the conflict is real and recurring, and Alexander's test for that was whether the place feels alive. Architects found the test unscientific. Programmers dropped it.

What it believes. Designers do not solve a given problem. They make a move, the situation talks back, and the problem gets renamed. The method is that conversation.

Where it breaks. It describes what skilled designers do and gives a beginner nothing to follow. It cannot be audited, scheduled, or handed to a committee.

What it believes. Diverge before you converge, twice: once to find the right problem, once to find the right answer. Anyone can do it with real users and a wall of notes.

Where it breaks. The diagram is true of nearly any project in hindsight and tells you little in advance. Run as a workshop, it produces a wall of notes and a prototype nobody has budget to build.

What it believes. Nobody will maintain a map of the whole argument. One short note per decision, written by the person who decided, kept beside the thing it describes, will actually get written.

Where it breaks. It records the winning position and its consequences, and loses the positions that lost. Rittel would say the argument is the part worth keeping.

What it believes. Do not draw the form. State the loads, the limits and the objective, and let an optimiser remove every bit of material that is not doing work.

Where it breaks. The result is optimal for the two load cases in the table and for nothing else. A child swinging on the tip is not a load case. Neither is the fabricator, who has to cut that shape, unless you add manufacturability as a limit. And nothing here asks whether a cantilever was the right roof.

What it believes. Picking one design early and iterating on it is the slow way. Carry whole sets of options forward. Let each specialty strike out only what it cannot live with. Decide at the last responsible gate, and never reopen a gate.

The point-based alternative would have chosen a steel cantilever with an LED sign in week one, and met the December power problem in week nine with the steelwork already ordered.

Where it breaks. Carrying several options costs real money until the last gate, so it needs an organisation patient enough to pay for prototypes it will throw away. It also only narrows the sets you started with. An option nobody listed in week one never appears.

What it believes. A design is acceptable when you can lay out the argument for it, from top claim down to evidence someone can inspect. Every goal is either broken into sub-goals by a stated strategy, or closed by a piece of evidence. Anything else is marked as undeveloped.

Where it breaks. You build the case for the conclusion you already want, so it invites confirmation bias. The whole structure also hangs from assumption A1. If a hazard is missing from the log, the argument is complete, well evidenced, and wrong.

What it believes. Before building, write down what must always be true. Then let a machine try every sequence of events it can find to break that statement. The bugs worth finding live in orderings no person would think to try.

VARIABLES clock, fetchedAt, mode, trueAge

FetchOk  == /\ fetchedAt' = clock
            /\ trueAge'   = 0
            /\ mode'      = "live"
            /\ UNCHANGED clock

Tick     == /\ clock'   = clock + 1
            /\ trueAge' = trueAge + 1
            /\ mode'    = IF clock' - fetchedAt > 90
                          THEN "timetable" ELSE mode
            /\ UNCHANGED fetchedAt

Brownout == /\ clock' = 0      \* the panel loses power at dusk
            /\ UNCHANGED <<fetchedAt, mode, trueAge>>

NeverLie == mode = "live" => trueAge <= 90

@given(lists(one_of(tick(), fetch_ok(), fetch_fail(), brownout())))
def test_never_shows_stale_as_live(events):
    d = Display()
    for e in events:
        d.apply(e)
    assert not (d.mode == "live" and d.true_age() > 90)

# Falsifying example, shrunk:
#   [fetch_ok(), brownout(), tick(91)]

Where it breaks. The checker proves things about the model, and the model is whatever you thought to write down. Brownout is in this one only because somebody had seen a panel fail at dusk. And the property that matters most on Mill Street, that a seated rider can see the bus, cannot be stated in this language at all.

What it believes. Accidents are rarely a broken part. They are a control problem: someone issued the wrong action, or the right one at the wrong time, because their picture of the situation was wrong. So draw who controls what, then interrogate every control action four ways.

Where it breaks. It is slow and it is thorough, and the output is a long flat list of requirements with no ranking and no budget attached. It also takes the control structure as given. If the diagram leaves out the dispatcher who tells drivers to skip stops when running late, so does the analysis.

What it believes. Design the rule for choosing, and good choices follow. One person, one vote hides how much each person cares. Give everyone the same budget of credits and charge the square of the votes cast on any one item, so that caring a lot is allowed but expensive.

Where it breaks. Two neighbours who split their votes between them pay less than one person casting the same total, so the rule is only as strong as the check that each ballot is one real person. And someone still wrote the four items on the ballot. Moving the route off Mill Street is not among them.

What it believes. A thousand people cannot hold a debate, but they can each write a sentence and tap agree, disagree or pass on other people's sentences. Group people by how they voted. Then look for the statements that every group supports, and start there.

Where it breaks. It tells you where agreement lies and stops there. Somebody still has to turn "I would sit down if I knew" into a shelter, and somebody with a budget has to have promised in advance to act on the result. Without that promise it is a survey.

What it believes. The people who understand a business never share one room or one vocabulary. Put them at a long wall with sticky notes. Start with events only, written in the past tense, in time order. Arguments about wording are the point, and each unresolved one gets a red note.

Where it breaks. The wall records one afternoon and the people who came. A dispatcher, an engineer and a planner produced this one, and no rider did, so the timeline ends when the bus departs and says nothing about the person left on the bench. It is also tempting to treat the notes as a design and code them directly.

What it believes. Teams jump from a target straight to a feature. Force a layer in between: the needs you heard in interviews, in the customer's words. Compare several solutions under one need, and test the assumption each one rests on before building any of them.

Where it breaks. The outcome at the root came from the transit authority and the tree has no way to question it. The opportunities come only from people you could interview, which means people still standing at the stop. Those who gave up and now drive are not on the tree.

What it believes. Estimates are fiction. Fix the time you are willing to spend, called the appetite, and let the scope move. A senior person shapes the work first: rough enough to leave room, solved enough that the known traps are marked. Then a small team gets six uninterrupted weeks.

Where it breaks. Everything depends on the shaper, who must already understand the problem well enough to mark the traps. The method says little about how they got there. It also assumes you own your roadmap. A contractor with a signed specification cannot let scope move.

What it believes. When a model can produce forty candidate designs in a minute, drawing one carefully is the wrong use of a person. Write the checks a good design must pass. The checks are the specification, and the design is whatever survives them.

task: display layout, 800 x 480, one colour
generate: 40 candidates

checks:
  - glyph_height_mm >= 40        # legible from the seat
  - arrivals_shown >= 3
  - shows_data_age == true
  - contrast_ratio >= 7
  - render_ms <= 50              # on the shelter's own hardware
  - judge: "Would a first-time rider know when the
            next bus to the clinic comes? Answer yes or no."

Where it breaks. Candidates drift toward whatever the checks reward: forty-millimetre numerals with everything else unreadable. The model judge is a stand-in for a rider and has never waited in the rain. And the old question returns in a new place. Whoever writes the checks is the designer, and holds the authority.

What it believes. Nobody would keep the argument map because keeping it was a job. Let a model listen to the meeting, file each remark as an issue, position or argument, link it to the line where it was said, and point out what is missing.

Where it breaks. The model files what was said. The person who sat silent through the meeting, and the objection made afterwards in the car park, are not in the map. A map that cost nobody any effort is also a map nobody feels they own, and its errors are plausible enough to go unread.

What it believes. The people who live with a tool know what is wrong with it and have never been able to change it. Keep a fixed core that must not break. Let everything else be reshaped by its users, in plain words, with a model doing the construction.

Where it breaks. It reopens the oldest question on this page. A display on a public street has many users, and the method does not say which of them may change it, or who removes the shop owner's line when the shop closes. The line between core and open is also drawn by whoever built it.