Designing Products for Resilience & Graceful Failure

Welcome to a six post series on the Calm Tech Institute’s certification standards! In today’s post, we’ll focus on Part 3: Resilience, or Section 3 of our Calm Tech Certification program.

Anyone with a pet knows the stress of leaving a furry family member at the house during a long trip — especially when relying on an automatic pet feeder to keep them fed while away. In 2020, thousands of pet owners were made even more anxious, as their pet feeders failed them while they were traveling, some of them hundreds of miles from home.

PetNet's automated feeders had remote-based feeding schedules, stranding dogs and cats during server outages.

PetNet was a well-funded startup backed by Amazon which created an Internet-connected, smartphone-controlled automated pet feeder which promised convenience and reliability while pet owners were away. Its entire system relied on a third party server which hosted the devices’ feeding schedules. 

For those who came of age in the smartphone era, when Internet connectivity feels ubiquitous, this set–up may have seemed like the most obvious, common sense way to support an automated pet feeder

But when that server went down temporarily – as all servers inevitably do, on occasion — the pet schedules went down too. Consequently, many pets were left starving, while their traveling owners frantically tried to contact PetNet support. (Or more likely, try and contact a reliable friend/neighbor, to care for their hungry pet.) 

Appifying ourselves into anxiety

We have seen a noticeable decline in design resilience in the smartphone era, even within the largest, most respected companies. 

Tesla owners have found themselves themselves stranded in the wilderness because their car model they’ve walked out of range of any cellphone network because their car fob didn’t come with physical keys (or they removed it for budgetary reasons), and  — making the Tesla app they need for the simple act of unlocking their car unusable. 

Just because the iPhone itself is well-designed does not mean every app on it gets to bask in that halo. But misunderstanding this has led to countless cases of consumer anxiety, due to non-resilient, app–dependent systems: A popular door system lock that no longer works with its app, if the device runs out of batteries; a hotel that locks everyone out of their app-based “keychain”, after a hacker compromises its servers.  

All of us have probably experienced similarly aggravating (if not life-threatening) instances of non-resilient systems over the years. But if we go back in time, there’s a better way of designing products.

Learning to fail gracefully 

One model for thinking about design resilience is graceful failure, a feature that incorporates a backup to foreseeable mishaps— or even offers an alternative that’s delightful. A canonical example here is the standard escalator: During power outages, the escalator doesn’t stop “working”, instead, it becomes stairs. 

Having a human fallback is another great way for products to fail gracefully. Japanese train stations have Help buttons that summon a staff members through hidden doors in ticket machine walls. Imagine how relieved and joyful someone in need becomes when suddenly seeing a helpful face appear!

https://youtu.be/SWf2xGqaH8U?si=u6xiQKV2AT2RjkbW&t=20

Train stations in Japan have extremely human customer service—extremely helpful for visitors trying to use their ticket machines.

Graceful failure is overlooked in many products and services and is becoming an incresasingly important differentiator.

Online shoe ordering company, Zappos.com, developed a reputation for great customer service early on by designing for failure—i.e. they made it possible for customers to easily return ill-fitting shoes. The company made the process of sending the wrong shoes back so fun and easy, that people almost enjoyed returning them, (it's no surprise that Amazon eventually acquired the company).

As for PetNet, a resilient solution would have involved designing the system to work at varying levels of complexity, then defaulting to the next level down in the case of an emergency. The feeder would be designed to always work offline first, with a battery backup for an electrical outage.

When conditions are right (remote connection and power) different levels of features could become available, but the base case would always work – keep pets fed and keep the feeder working at all costs. And, in-app, a notification would always vbe delivered to customers – “the connection has been lost. Your feeder will work for X hours or days without connectivity. Or “we’ve detected an electrical outage – switching into battery power – your pet feeder will work as usual for the next 72 hours”. Without anything like that prepared in advance, the startup shut down within several months of a prolonged service outage. 

Designing products for resilience not only makes them more calm for consumers—it helps make an entire company more resilient, too.  

---

Amber Case is the founder of the Calm Tech Institute. Her goal is to help companies design products and environments that work with human attention, instead of against it. Do you have a product that you’re interested in getting feedback on? Reach out to Amber Case. 

---

Read the rest of this series:

Part 1: When 10 Seconds Means 23 Minutes: The Attention Costs of Bad Design

Part 2: Your Hands Have Eyes, Too! Engaging Peripheral Attention