Principle
Design recovery for the error you cannot prevent
Some resilience belongs after the mistake, not only before it.
When it fits
- The team keeps trying to eliminate every possible human or system error before release.
When to avoid it
- Recovery design does not excuse avoidable unsafe actions; use prevention where it is stronger and cheaper.
Why it matters
For plausible residual errors, design fast detection, bounded impact and a clear recovery path. Ask how the system notices the wrong state, how far it can spread, and how to restore a known-good state. Prevention and recovery should be reviewed together.
An example
A bulk update has post-write reconciliation, batch limits and a replayable correction file in addition to pre-write validation.
Check your result
A plausible residual error has a defined detection and recovery path instead of requiring perfection.
Keep this limit in mind
- Recovery design does not excuse avoidable unsafe actions; use prevention where it is stronger and cheaper.
Evidence and sources
Supports
Human-factors engineering includes resilience: detecting and mitigating unexpected events before they worsen rather than assuming every error can be prevented.
Recovery mechanisms complement prevention; they do not justify avoidable unsafe design.
Human Factors Engineering · Resiliency efforts