Tales of the unexpected

There are two strategies for safety. The first is to minimise the likelihood of failure, and the second to achieve resilience and minimise the consequences of failure should it occur. Failure is unexpected by those involved: it comes as a surprise. Surprise relates the probability of an event to the weight we give it or the degree of interest we have in it, which should be interest in whatever it is that causes failure. Many, possibly most, failures stem from the models used by engineers. To better understand models and their potential problems, a taxonomy of models is proposed, and examples of failure are given for different model types. A list of principles is given for good modelling practice which, if followed, would reduce the likelihood of failure and of being surprised. The approach has relevance to engineering education as well as practice.