> For very fast failures, within a few seconds (e.g. pressurized water nuclear reactor rather than an aircraft), when there is no warning from prior changes so

> For very fast failures, within a few seconds (e.g. pressurized water nuclear reactor rather than an aircraft), when there is no warning from prior changes so that on-line working storage would also be useless, then reliable automatic response is necessary, whatever the investment needed, and if this is not possible then the process should not be built if the costs of failure are unacceptable. This excerpt from the article's section 2.2 really struck me. I have seen a lot of software projects that were built, became mission critical, and only then experienced their first significant downtime. I have rarely seen organizations tackle the threat of failure first and design the system from that point of view.