Abstract
Summary form only given. In the early days of computing, when system components included relays and vacuum tubes, failures would occur as often as once every million cycles. In those days, hardware was considered to be the primary locus of undependability. Later, following many innovative, faulttolerance solutions for hardware problems, software became the dominant contributor to undependability. As fault tolerance expanded its scope to cover software issues, other assaults on dependability began to appear, one of which remains largely unaddressed: errors at the userinterface.