Building Safer Technology: A Field Guide to Failing Well

4 Responding to Failures

When you plan for a potential failure, you put in place various procedures or mechanisms to manage its impact, so that the cost of the complete event—the failure plus its responses—is something that you consider acceptable to happen at the anticipated frequency of the failure.¹ For example, if you know that a car’s engine sometimes stops when at a stoplight, and the response procedure is simply to restart the engine, then the net cost of the failure is the annoyance to the driver plus the slight reduction in fuel efficiency. How often you are willing to allow this behavior to happen, as a car manufacturer, depends on your sense of how much annoyance your customers will accept. However, if the car’s engine sometimes ...