Rely on several independent barriers so that no single failure can reach the harm.
The submarine's watertight compartments are the mechanical case: any single breach is survivable because no single breach reaches everything. It fails when the layers share a cause.
In practice
- An aircraft has independent hydraulic systems, a mechanical reversion mode and a checklist, so that no single failure reaches the ground.
- A finance process has a preparer, a reviewer and an external audit, and the fraud that succeeds is the one that crosses all three.
- Further reading
- Wikipedia
- Subject
- Risk & Reliability
- Essay
- How much caution, and the jokes about its limits