True, and I'm all for that kind of thinking in addition to common sense precautions. Maybe that was the case and there were huge signs and training manuals and off buttons all over the place but coderr's scenario sounds more likely.

My larger point is that failure analysis is complicated and full of red herrings. Simplifying it to "five whys" (or four, or six) only creates false security.