In that plane analogy, assuming the plane's design load capacity requires all 4 engines to be fully functioning, a fully loaded plane suffering a failure of 1 o

In that plane analogy, assuming the plane's design load capacity requires all 4 engines to be fully functioning, a fully loaded plane suffering a failure of 1 out of 4 engines is dealing with a "degradation scenario". It will have to jettison some amount of load (proportional to loss of one engine) to save the rest of the load or it risks losing the entire plane. This is a fault-tolerant system with degradation possibilities. If this degradation possibility isn't acceptable, then the plane's design load has to be reduced. Plane will carry only so much load that can be safely flown with minimum surviving engines (say, 3 out of 4, or 2 out of 4 or even 1 out of 4). When the plane is operating in this configuration with redundant online engines, there are interesting challenges w.r.t efficiency of the engines. These 4 engines will now have to be at their best efficiency when loaded only 2/3 or 1/2 or 1/4 of their load capacity. Because that is expected to be their normal operating condition. And they should be able to operate under higher load condition (which may not be efficient, and stressful) for a sustained duration that is desired for the plane to land safely. Obviously, the plane that has to operate with spare engine capacity is more expensive. It is worth deploying such a solution only if the cargo being carried is more expensive even when adjusted by the probability of occurrence of this scenario. These exact same trade-off scenarios exist for design of distributed software systems that have to tolerate machine component failures.