Error-first thinking in function design