This article contributes the model, identifies dangerous services, and observes a number of tradeoffs that can be made to reduce the probability of failure.