> Every part in the system is not "how can we make this part never fail" but "assume it failed. How does the airplane survive?"

This is also the principle behind Qubes OS, security-oriented OS based on security through isolation.