In a previous version of the document we used FATAL_FAILURE instead of
SHUTDOWN. This was changed when there was no case that would cause a
fatal failure other than shutdown. However, one reference to the old
name was missed.