While I like James Reason's book and I find its discussion of mental models instructive in my code and in my life, I do have to break with him on his conclusion

While I like James Reason's book and I find its discussion of mental models instructive in my code and in my life, I do have to break with him on his conclusions, which chiefly amount to the takeaway that systems at the level of complexity we're building today are impossible to run safely, and we should shut them all down. (I exaggerate, but only a little.) A book I like which responds to Reason's is Nancy Leveson's Engineering a Safer World (free PDF from the MIT Press, even! https://mitpress.mit.edu/books/engineering-safer-world https://mitpress.mit.edu/books/engineering-safer-world) which says, okay, if we don't want to shut these systems (like the Internet) down, how can we run them safely, and provides some guidance. I gave a short talk about it at Facebook's most recent Security@Scale conference in Boston a couple weeks ago, the video of which is here: https://www.youtube.com/watch?v=e_-n5wX8okQ https://www.youtube.com/watch?v=e_-n5wX8okQ Edit: To tie this back to the OP, I think while it's desireable for software to be as simple as is reasonable given constraints, it's decreasingly possible to say that all software can be built so simply that analytic reduction works, and we need tools to help us cope with software systems which exhibit emergent complexity.