defensive error handling