Overview

All too often, people think it is as easy to deal with failures after they happen as it is to prevent them. These are typically not the people who have to don the bunker gear and fight the fires. Failures follow their own chosen path and, while valiant, our failure modes and effects analyses are frequently only feeble attempts at describing the full extent of reality. We can only guess at second- or third-order effects. If a failure is allowed to occur, nature will make the final choice where things will end.

You tend to learn about defects when the defect chooses to make its presence felt. And defects always like to make their presence felt at the least convenient times. So the system we devise needs to account for the fact that failure causing defects are inconsiderate little buggers.

The first thing about a failure-causing defect is that it usually announces its presence to the least- articulate member of any organization. As a result, the failure description is likely to be difficult to understand and most likely inconsistent with any other failure that has ever happened in the past. Left to his (or her) own devices, the description of the resulting malfunction will be unlike all other reports and will be impossible to file or categorize.

The most important point made in the previous...