Overall, the philosophy is to attack the availability problem from two
complementary directions: to reduce the number of software errors through
rigorous testing of running systems, and to reduce the effect of the remaining
errors by providing for recovery from them. An interesting footnote to this
design is that now a system failure can usually be considered to be the
result of two program errors: the first, in the program that started the
problem; the second, in the recovery routine that could not protect the
system.
-- A.L. Scherr, "Functional Structure of IBM Virtual Storage
Operating Systems, Part II: OS/VS-2 Concepts and
Philosophies," IBM Systems Journal, Vol. 12, No. 4.

I've already told you more than I know.