Margin of Safety¶
Core Idea¶
Margin of Safety is a design quantity characterized by (1) the explicit reservation of capacity, time, budget, or quality between nominal expected demands on a system and the system's maximum permissible limit, (2) the quantitative commitment to absorb variation between modeled and actual operating conditions without crossing the failure threshold, (3) a ratio (safety factor), percentage (buffer size), or absolute quantity (clearance) calibrated to both the uncertainty in demand estimation and the consequences of failure, and (4) the central quantitative realization of the broader Robustness commitment, rendering the designer's uncertainty about operating conditions as explicit design margin rather than implicit optimism. The deeper insight is that every system's nominal specification embeds error — the real operating load is unknown, the material properties deviate from book values, the environmental conditions exceed the historical record — and that the disciplined design response is not to pretend perfect foresight is achievable but to explicitly over-provision capacity, with the size of over-provisioning sized rationally to the quantified uncertainty and the catastrophe-cost of underestimation. This converts an epistemological problem (we cannot perfectly predict operating conditions) into a tractable engineering problem (reserve how much capacity is appropriate?). The practice originated in structural engineering in the 18th-19th centuries as the empirical observation that structures designed to nominal load failed under ordinary service, driving the deliberate shift to "safety factors" — multiples of expected load for design purposes. Modern incarnations span every domain where designer uncertainty confronts real-world consequences: from aeronautical structure (1.5× ultimate load design), to pharmaceutical dosing (therapeutic index as margin between effective and toxic dose), to project management (contingency buffers for schedule and cost), to cybersecurity (defense-in-depth depth assumptions: detection must occur faster than attack execution time). The mechanism works because it is honest about ignorance: the system is not designed to barely survive expected conditions but to survive worse-than-expected ones[1].
How would you explain it like I'm…
Leave Extra Room
Build In Extra Just In Case
Reserve Capacity For Uncertainty
Structural Signature¶
- The explicit reservation of capacity above the nominal expected demand [2]
- The quantification of uncertainty in demand estimation as a statistical or empirical model [2]
- The failure-consequence analysis that calibrates margin size to damage-cost or catastrophe-risk [3]
- The trade-off function between safety-margin size and resource cost (material, capital, time, complexity) [2]
- The distinction between over-provisioning via margin and over-provisioning via redundancy [2]
- The role of margin as a design variable subject to post-hoc audit and sensitivity analysis [2]
What It Is Not¶
-
Not the same as Robustness. Robustness is the functional property — the system performs across varied conditions; Margin of Safety is the quantitative design variable that produces robustness. A robust system might achieve robustness through redundancy, through active control, through fundamental design insensitivity, or through margin; margin is one mechanism among several.
-
Not the same as Redundancy. Redundancy duplicates critical capability so that failure of one component is absorbed by others; Margin of Safety scales up capability to absorb demand variation. Both contribute to system robustness but via mechanistically different paths. A system can be heavily margined but non-redundant (a single bridge beam overdesigned for 2× expected load) or highly redundant but minimally margined (three circuits, each designed to nominal demand).
-
Not the same as Engineering Tolerances. Tolerances specify allowable variation in component dimensions, material properties, or input specifications — the range of "acceptable" deviation from nominal at the component level. Margin of Safety is the reserved capacity at the system level above nominal operating demand. Tolerances address input variation; margin addresses demand variation and load uncertainty. Both coexist in engineered systems but answer different design questions.
-
Not a substitute for accurate modeling. Margin compensates for residual uncertainty after the best available modeling has been applied, not for modeling neglected or deferred. A system with poor demand models cannot be salvaged by adding arbitrary margin; the margin must be calibrated to quantified uncertainty. Over-margining without understanding the underlying uncertainty is waste; under-margining despite known uncertainty is negligence.
-
Not free. Larger margins cost more — more material, more capital reserve, more time budget, more operational overhead. Margin sizing is a trade-off optimization problem: the cost of over-provisioning (capital, complexity) against the cost of failure (catastrophe, loss, liability, redesign). This trade-off is often made implicitly in practice, leading to designs that are either wastefully over-margined or insufficiently margined for their actual risk.
-
Not universal to all design. Some systems are designed to point-estimate (tournaments, fixed-resource environments where total demand is known in advance); others are designed to uncertain demand (buildings, aircraft, medications where the actual operating load is unknowable at design time). The applicability of margin depends on the epistemological structure of the design problem.
Broad Use¶
Structural engineering (safety factor in beam, column, and joint design; ultimate-strength versus working-stress design philosophies; the classic 1.5× to 2.0× factor of safety in civil structures), mechanical engineering (shaft, bearing, fastener, and weld design margins; pressure vessel design with 3-4× margin on ultimate strength), aerospace (load-factor margins on airframe structure, fuel reserves for headwind and diversion, certification margins on engine thrust), chemical process engineering (relief-valve sizing for pressure excursions, equipment pressure ratings 1.5-2.0× above operating pressure, emergency vent capacity), civil engineering (stormwater system capacity margins to accommodate 50-100 year flood, seismic design margins accounting for ground-motion uncertainty), Graham-Dodd value investing (margin of safety as discount to intrinsic value, requiring purchase price substantially below calculated fundamental value), project management (schedule contingency buffers, budget reserves, "burn rate" uncertainty in startup planning), clinical pharmacology (therapeutic index as ratio of toxic dose to minimally effective dose, guiding safe dosing margins), cybersecurity (defense-in-depth assumption that detection must complete before attack; assume attacker has 10 minutes, deploy detection that activates in 5 minutes), quality engineering (process capability studies requiring Cpk ≥ 1.33, representing minimum 4-sigma margin between process mean and specification limits), and financial reserve requirements (banking capital adequacy ratios, insurance reserve margins, central-bank foreign-exchange reserves).
Clarity¶
Naming Margin of Safety explicitly makes the design choice visible: what uncertainty is being acknowledged, with how much over-provisioning, at what cost. An implicit practice — designing to expected demand without explicit margin discussion — tends to under-provision capacity and produce predictable failures at the first real-world excursion beyond the nominal estimate. An explicit practice forces the specification of (1) the demand distribution or uncertainty model, (2) the margin size and justification, and (3) the cost-benefit trade-off. This surfaces for review and calibration what implicit practices obscure. The clarity also prevents a common failure mode: post-hoc rationalization of designs that happened to survive as "well-designed" when in fact they succeeded through accident, not through disciplined margin allocation.
Manages Complexity¶
Perfectly characterizing the operating demands on a system is usually impossible at design time — the actual loading spectrum, environmental conditions, material property variations, and usage patterns are not fully knowable. Attempting to manage uncertainty through exhaustive modeling leads to ever-expanding analysis and never-ending scope creep. Margin of Safety instead absorbs residual uncertainty through over-provisioning, which is simple and auditable: the design is for 1.5× expected load, or has a 30-day schedule buffer, or carries 20% capital reserve. This simplification is not intellectual laziness; it is a pragmatic acknowledgment that the cost and schedule of perfect prediction exceed the benefit of perfect prediction. Complexity is managed by replacing "predict all variation" with "provision for quantified representative variation," which is both simpler to specify and easier to defend. For interconnected systems (assemblies with multiple components, or supply chains), margin also provides a structured way to handle tolerance stack-up: each component has a margin; combined margins at the system level absorb the aggregate effect of component-level variations without requiring exhaustive worst-case analysis at every interface.
Abstract Reasoning¶
The analyst asks: What is the uncertainty in the demand or load estimate? Is it captured in a distribution (statistical), or represented as a scenario range (deterministic worst-case)? What are the consequences of underestimation — catastrophe (life safety), major cost (schedule overrun, equipment replacement), or minor inconvenience (small delay)? How does the catastrophe cost scale with the magnitude of underestimation? Given the uncertainty distribution and the consequence scaling, what margin size is rational? What does the system cost if margined at 1.5× vs 1.0× vs 2.0× the nominal? After selecting a margin size, what is the sensitivity to that choice — if actual demand turns out to be higher or lower than expected, how much buffer remains? For systems with tolerance stack-up (multiple components feeding into a system-level requirement), how do component-level margins combine into system-level margin? Is a uniform margin across components rational, or should margins be allocated more to high-consequence components and less to low-consequence ones? The most mature practice recognizes that margin is not a mystical safety number but an explicit design variable: it should be computed, justified, documented, and revisited when new information arrives about demand distribution or failure consequences.
Knowledge Transfer¶
| Domain | Demand uncertainty | Typical margin size | Margin mechanism |
|---|---|---|---|
| Structural engineering (buildings) | Historical load data + growth uncertainty | 1.5–2.0× | Safety factor on computed load |
| Aerospace structure | Certification loads + uncertainty | 1.5× ultimate or 2.5× yield | Load-case envelope + margin |
| Pharmaceutical dosing | Population pharmacokinetics + variability | 10–100× (ED50 to TD50) | Therapeutic index |
| Project scheduling | Historical analogues + scope uncertainty | 20–40% | Schedule buffers + contingency |
| Supply-chain procurement | Demand forecast + variability | Inventory safety stock | Statistical demand distribution |
| Bank capital adequacy | Market stress scenarios + tail risk | ≥10% (Basel III) | Capital ratio against risky assets |
| Cybersecurity | Attacker capability + detection latency | Detection latency << attack time | Assume worst-case attacker speed |
| Database replication | Consistency guarantee + latency tolerance | Depends on consistency model | Replication lag tolerance window |
Transfer principle: the same analytical structure (quantify uncertainty, map to consequence, set margin to absorb both) applies across domains. An aerospace engineer designing structure, a pharmacist dosing medications, a project manager estimating schedule, and a database architect designing replication all perform the same analytical work under different variable names.
Examples¶
Formal/abstract¶
Petroski's To Engineer Is Human (1985) documents the structural-engineering evolution of safety-factor practice. The Tacoma Narrows Bridge (1940) collapsed under wind-induced oscillation at 42 mph, demonstrating that nominal load analysis was insufficient — wind loading was not well understood, material damping was lower than expected, and the resonant frequency happened to match gusts. The original design assumed bridge weight would provide stability; aerodynamic effects were not margined. Post-collapse analysis identified the oversight and shifted structural design to explicitly margin against poorly-understood loads. Modern bridge design (post-1950s) incorporates explicit wind-load margins, seismic margins, and temperature-expansion margins. Petroski traces how each major bridge failure (Niagara Railway Suspension, Quebec Bridge, Tacoma) drove design communities to enlarge margins and improve load models. The deeper insight: each failure revealed that the engineer's mental model of "what was uncertain" was incomplete; margin size grew not just because designers became more risk-averse but because they discovered new classes of uncertainty (aerodynamic instability, brittle fracture at temperature, connection-fatigue failures) that previous margin philosophy did not address. Modern factor-of-safety practice (e.g., AISC Load and Resistance Factor Design — LRFD — vs older Allowable Stress Design) explicitly separates load factors (how much larger might actual loads be than estimated?) from resistance factors (how much lower might actual material strength be than book values?), allowing designers to allocate margin differentially to load and strength uncertainty[1].
Mapped back: This instantiates the signature directly — uncertainty in load estimation drives the explicit margin (D34-002), failure consequence (collapse) calibrates the margin size (D34-004), the margin is managed as an engineering variable subject to revision as uncertainty models improve (D34-007), and the trade-off between over-provisioning and cost is visible in the evolution from over-safe (Tacoma post-1940 designs) to under-safe (mid-20th-century minimalist designs) to deliberately calibrated (modern LRFD).
Applied/industry¶
An electronics manufacturer designs a power supply for a medical infusion pump. The nominal requirement is +12 V output with less than 2% ripple. The design engineer models the voltage regulator output under nominal load (500 mA) and finds stable performance at 12.0 V with 1.5% ripple. However, the engineer recognizes several sources of demand uncertainty: (1) the load current may vary by ±20% due to component tolerance in pump drive circuitry; (2) line voltage may range 100-240 VAC (worldwide input); (3) the regulator IC has temperature coefficient and aging effects of ±5%; (4) capacitor ESR varies with temperature and frequency. Rather than design the regulator to barely meet 12 V and 2% ripple at nominal conditions (which would fail if any parameter drifts), the engineer explicitly margins the design: (1) select a regulator topology with load regulation that keeps output stable within ±8 V even at ±20% load variation; (2) design the feedback network to target 11.95 V nominal (not 12.0 V), creating a downward margin; (3) select high-stability capacitors to limit aging drift to ±1%; (4) validate the design across 0–50°C temperature range, ensuring ripple remains below 1.0% (vs the 2.0% requirement). The design margins — downward voltage margin, ripple margin, temperature margin — collectively ensure the power supply meets specifications across the range of anticipated variation in component tolerance, environmental conditions, and load. The design costs more (higher-quality capacitors, tighter feedback network tolerances, more thermal design) than a minimally-compliant design, but it reliably passes acceptance testing and field operation across international markets without failures or returns. Post-production, if a manufacturing defect or field discovery reveals a new source of variation (e.g., capacitor aging is worse than 1% in high-heat climates), the margin provides cushion: the system fails gracefully into the upper ripple limit rather than catastrophically[3].
Mapped back: Shows margin as an explicit design variable (D34-002: reserved capacity in feedback voltage targeting), uncertainty quantified (D34-003: ±20% load, ±5% IC drift, capacitor aging), consequence-driven sizing (D34-004: medical-device failure is high-consequence, justifying larger margin), cost-trade-off (D34-005: quality component selection and validation cost), and sensitivity to discovery of new uncertainty classes (D34-007: margin provides audit and buffer against surprise).
Structural Tensions¶
-
T1: Margin size versus cost. Larger margins absorb more uncertainty but require more resources — more material, more capital, more complexity. A bridge margined at 5× expected load is vastly safer than one margined at 1.5×, but costs proportionally more. The tension is not resolvable by choosing more margin — you must quantify the uncertainty (how large might demand really be?) and the consequence (what is failure worth?), then optimize. A common failure is setting margins by convention or fear rather than by analysis, leading to either wasteful over-provisioning or insufficient margin for the actual risk[2].
-
T2: Known uncertainty versus unknown unknowns. Analysis can quantify known sources of variation (load range, material property tolerance); it cannot foresee unknown failure modes (aerodynamic instability, brittle fracture at cold temperature, fatigue at a resonance frequency not predicted). Margin is calibrated to known uncertainty; unknown unknowns are managed through design reviews, testing, and conservative practice (avoid novel configurations, use proven materials). A common failure is assuming margin size A will cover uncertainty B when A was computed for uncertainty X; unknown-unknown discovery then produces failure[1].
-
T3: Uniform margin versus risk-proportional allocation. Uniform safety factors (all components to 2× nominal load) are simple to specify and manage but may wastefully over-margin low-consequence components while under-margining high-consequence ones. Risk-proportional allocation — large margins on critical components, smaller margins on non-critical — is more efficient but requires component-level failure-mode analysis. A common failure is defaulting to uniform margins when the cost or safety implications would justify allocation, leaving efficiency on the table[3].
-
T4: Design-time margin versus operational monitoring. Margin is set at design time based on expected-case uncertainty; real operating conditions may exceed or underestimate the expected distribution. Operational monitoring — measuring actual load, aging, drift — can inform whether the margin is adequate or excessive. But operational data lags behind design by years; by then the system is built. The trade-off: design conservatively (larger margin) to account for uncertainty about uncertainty, or design nominally and invest in monitoring to catch margin erosion. A mature approach combines both[2].
-
T5: Margin accounting versus margin consumption. Once a margin is allocated (a bridge designed for 2× load), the margin is only consumed when operating conditions exceed nominal. But non-linearities, stochastic variability, and correlated stressors (a heavy truck in a windstorm) can consume margin faster than the design envelope predicted. The tension is between designing for representative worst-case (a 100-year flood, a design-basis earthquake) and designing for truly adversarial conditions. The cost of covering truly adversarial cases (1,000-year floods, beyond-design-basis earthquakes) is often considered economically unjustifiable, but the consequence of margin depletion under those conditions is catastrophe[2].
-
T6: Transparency versus simplification. Explicit margin calculation requires documenting the demand model, the uncertainty distribution, the consequence scaling, and the chosen margin size. This is the honest engineering practice. However, the documentation itself becomes complex and difficult for stakeholders (clients, regulators, operators) to understand. The temptation is to hide margins under simplifications ("we design to code" or "we use safety factor 2.0") without explaining why. A common failure is simplifying so much that stakeholders do not understand what uncertainties are actually covered, leading to over-confidence or, conversely, spurious skepticism about the design[2].
Structural–Framed Character¶
Margin of Safety is a hybrid on the structural–framed spectrum. Part of it is a bare pattern that means the same thing in any field — a deliberate reserve of capacity held between expected demand and the limit at which a system fails; part of it is a frame, a vocabulary of design, failure, and acceptable risk, inherited from engineering.
The structural core is portable and quantitative: a buffer calibrated to the uncertainty in demand and the cost of failure shows up as a safety factor in a bridge, a cash reserve in a budget, slack in a project schedule, or a discount in a value investment, and the abstract idea of reserving headroom transfers across all of them. But the prime carries a real engineering frame. Its native terms — failure threshold, safety factor, permissible limit, failure-consequence analysis — come from the design of physical structures, and it is laden with a prudential, normative weight: leaving a margin is responsible, omitting one is dangerous. Its origin lies in engineering practice and judgments about tolerable risk, not in a purely formal relation, and applying it imports that risk-management stance. With a clear quantitative core but a substantial design-and-safety frame, it sits near the middle of the spectrum.
Substrate Independence¶
Margin of Safety is a highly substrate-independent prime — composite 4 / 5 on the substrate-independence scale. Its structural signature — explicitly reserving capacity, quantifying uncertainty, weighing the consequences of failure, and trading safety off against cost — is substrate-agnostic and is documented from the Tacoma Narrows bridge to power-supply design for medical devices. The transfer into finance and project management is clear, so the pattern is solidly multi-domain rather than confined to one discipline. What holds it below the ceiling is that the examples concentrate in engineering and risk domains, leaving its reach into biological or social substrates less demonstrated.
- Composite substrate independence — 4 / 5
- Domain breadth — 4 / 5
- Structural abstraction — 4 / 5
- Transfer evidence — 4 / 5
Relationships to Other Primes¶
Parents (1) — more general patterns this builds on
-
Margin of Safety is a kind of Reserve
Margin of safety is a specialization of reserve in which the surplus is the explicit, quantified gap between the system's nominal expected demand and its maximum permissible limit, sized to absorb modeling uncertainty without crossing the failure threshold. It inherits reserve's general structure of deliberately held capacity available for variation or shock, and specializes by fixing the form to an engineered ratio, percentage, or absolute clearance and the justification to the consequences of failure. It renders designer uncertainty as explicit margin rather than implicit optimism, making robustness a quantitative design parameter.
Path to root: Margin of Safety → Reserve
Neighborhood in Abstraction Space¶
Margin of Safety sits in a sparse region of abstraction space (77th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely rather than landing on a neighbor.
Family — Capacity, Adaptation & Slack (15 primes)
Nearest neighbors
- Adaptive Capacity — 0.78
- Complexity (Time/Space) — 0.78
- Distributional Assumption — 0.76
- Reserve — 0.76
- Deadweight Loss — 0.75
Computed from structural-signature embeddings · 2026-05-29
Not to Be Confused With¶
Margin of Safety must be distinguished from Engineering Tolerances, its closest neighbor in design practice, but they operate at fundamentally different scales and answer different design questions. Engineering Tolerances define the acceptable range of component-level variation — the range within which a part's manufactured dimensions, material properties, or electrical characteristics can deviate from nominal and still be acceptable. A shaft might be toleranced to ±0.01 mm in diameter, or a resistor to ±5% in resistance value. Tolerances are about input variation: how much can components vary and still be assembled and function? Margin of Safety, by contrast, operates at the system level and absorbs the effect of component-level variation and operating uncertainty through over-provisioning of capacity. Where a tolerance says "this part will vary between 95% and 105% of nominal," margin of safety says "we will design the system for 1.5× the expected load so that even if components underperform and loads exceed predictions, the system still survives." A bridge's tolerance stack-up (each joint can deviate by X mm) is independent of the bridge's margin of safety (designed for 1.5× expected live load). Both coexist in mature engineering: tolerances constrain component variation; margins absorb the system-level effect of that variation plus demand uncertainty. A designer ignoring tolerances produces inconsistent components that fail assembly; a designer ignoring margin produces systems that fail under real-world loads even with tight tolerances. Margin of Safety is also distinct from Fail-Safe, though both are safety strategies. Fail-Safe describes a system architecture where failure is designed to result in a safe state — the system explicitly anticipates failure modes and ensures that when failures occur, they do not cascade into catastrophe. A hydraulic brake system with dual independent brakes is fail-safe: if one circuit fails, the other remains functional. A pharmaceutical packaging with a child-resistant cap that cannot be accidentally overridden is fail-safe by design — failure (broken cap, child's attempt to open) is anticipated. Fail-Safe asks: "When this component fails, what happens next? Can we design the system so failure results in a safe, benign state?" Margin of Safety, by contrast, is a strategy to prevent failure from occurring in the first place by over-provisioning capacity. A structure designed with 2× margin is not expected to fail; the extra capacity is cushion against demand underestimation, not accommodation of failure. Fail-Safe and Margin of Safety are complementary but distinct: margin of safety tries to ensure failure never happens; fail-safe ensures that if it does, the outcome is managed. A space capsule uses both: its structure is heavily margined to prevent failure under normal and off-nominal conditions, and it also incorporates fail-safe features (redundant parachutes, abort systems) so that if failure does occur, the crew is protected. The difference is one of prevention versus mitigation. Finally, Margin of Safety is not the same as Robustness, though margin is one mechanism for achieving robustness. Robustness is the functional property of a system — it maintains performance across varied, stressful, or unexpected operating conditions. Robustness can be achieved through multiple mechanisms: through fundamental design insensitivity (a system built to inherently resist perturbations), through active control (a system that continuously adjusts to maintain equilibrium), through redundancy (backup components that maintain function when primary ones fail), or through margin (over-provisioned capacity to absorb variation without failure). A robust bridge maintains structural integrity under wind, earthquakes, and heavy loads — this robustness might be achieved through a massive, stiff design (margin-based), through a light, flexible design with aerodynamic shaping (insensitivity-based), or through active dampers that sense motion and counteract it (control-based). All three designs are robust; they achieve robustness through different structural paths. Margin of Safety is the mechanism of "build stronger"; robustness is the property of "survives stress." Many systems achieve robustness without significant margin — a Tacoma Narrows Bridge replacement design (post-1950) achieves robustness partly through deliberate aerodynamic insensitivity, not primarily through over-margining the structure. Conversely, a system can have large margin and still fail to be robust if the margin does not address the actual failure mode (a bridge over-margined in vertical bending but under-margined against torsional oscillation).
Solution Archetypes¶
Solution archetypes in the catalog that build on this prime — directly (this prime is a source ingredient) or as a related prime.
Built directly on this prime (6)
- Capacity Reservation
- Constraint Envelope Adjustment
- Over-Scaling Guardrail
- Robustness Margin Design
- Safety Margin Design
- Therapeutic Window Management
Also a related prime in 23 archetypes
- Adaptive Threshold Recalibration
- Bioaccumulation Prevention
- Controlled Reentry
- Correlation Structure Analysis for Pooling Effectiveness
- Inline vs. Offline Inspection Trade-Off
- Liquidity Reserve
- Load Leveling / Demand Smoothing
- Operational Context Validation Testing
- Overcommitment Prevention
- Overoptimization Guardrail
Notes¶
Margin of Safety originates in 18th-19th century structural engineering (Galileo's beam analogy, Maxwell's reciprocal theorem applications, Castigliano's energy methods providing the mathematical tools for computing stress under load). The formalization as "safety factor" is due to empirical observation that structures designed to nominal load failed in service; explicit over-provisioning followed. The term "margin of safety" gained explicit recognition through Petroski's historical work and through financial applications (Graham and Dodd 1934, Security Analysis, introduced "margin of safety" to investment decision-making). Modern formulations distinguish between safety factors (simple multipliers), probabilistic approaches (designing for a confidence level in the uncertainty distribution), and risk-based approaches (explicitly trading off failure cost against design cost). The concept interfaces with Robustness (#282) as the quantitative mechanism, with Redundancy (#287) as an alternative robustness strategy, with Engineering Tolerances (#290) as the component-level specification of acceptable variation, and with Risk Management (#341) as the broader framework for uncertainty quantification and decision-making.
The connection to robust-design optimization (Taguchi 1986, Phadke 1989) is structural: margin of safety is the system-level reserve absorbing residual uncertainty after Taguchi's noise-factor analysis has minimized variance — the two disciplines are complementary, not redundant. Reason 1990 and Leveson 2011 frame consequence-driven margin-sizing within broader system-safety analysis, making margin allocation a system-safety design decision, not purely an engineering optimization.
References¶
[1] Petroski, H. (1985). To Engineer Is Human: The Role of Failure in Successful Design. St. Martin's Press. Develops the engineering safety factor as the ratio of ultimate to designed load, with explicit discussion of the historical cycle in which margins are raised after failures and lowered when structures appear over-built — the quantified structural-engineering instance of reserve. ↩
[2] Pugh, S. (1991). Total Design: Integrated Methods for Successful Product Engineering. Addison-Wesley. ↩
[3] Hammer, W. (1972). Product Liability: Prevention Through Design. Hanser Publishers. ↩
[4] Petroski, H. (1992). The Evolution of Useful Things. Knopf.
[5] Castigliano, C. A. P. (1879). Théorie de l'équilibre des systèmes élastiques et ses applications. Turin: Negro.
[6] Maxwell, J. C. (1870). "On reciprocal figures and diagrams of forces." Philosophical Magazine, 4(27), 250–261.
[7] Graham, B., & Dodd, D. L. (1934). Security Analysis: Principles and Technique. McGraw-Hill.
[8] American Institute of Steel Construction. (2010). Steel Construction Manual (14th ed.). AISC.