SAFETY: What energy, motion, pressure, heat, or stored force exists? What procedure applies to the next action?
PRESERVE EVIDENCE: Record alarms, LEDs, positions, sounds, smells, pressures, fault histories, and what happened immediately before the stop.
DEFINE THE SYMPTOM: Write one neutral sentence describing what should happen and what actually happens.
CHECK RECENT CHANGES: Maintenance, cleaning, recipe, changeover, parameter, tooling, product, software, utility, or environmental change?
CLASSIFY THE LAYER: Power, safety, control, logic, network, actuator, feedback, mechanical, pneumatic/hydraulic, or process?
FIND THE FIRST MISMATCH: Follow the sequence until expected and actual state diverge.
TEST A BOUNDARY: Choose a measurement that can eliminate a large part of the system.
ONE CHANGE AT A TIME: Record what you change and the result.
COMMUNICATE: Facts, hypothesis, next action, and next update time.
ESCALATE WHEN NEEDED: Safety, authorization, specialized system, stalled evidence, or missing resources.
RESTART DELIBERATELY: Restore guards/forces/parameters, clear personnel, test under realistic conditions, check quality and load.
DOCUMENT: Cause, correction, measurements, verification, temporary conditions, and follow-up.
POCKET VERSION: SAFE -> SEE -> STATE -> SPLIT -> TEST -> VERIFY -> TELL -> LEARN. Safe state. See the evidence. State the symptom. Split the system. Test one boundary. Verify the repair. Tell the next person. Learn from the event.