Another view which addresses the complexity is STAMP (Systems-Theoretic Accident Model and. Processes) by Nancy Leveson. Rather than look at scenarios she sees

Another view which addresses the complexity is STAMP (Systems-Theoretic Accident Model and. Processes) by Nancy Leveson. Rather than look at scenarios she sees a system as a set of nested control loops, where each loop involves two-way information flow between a system and a controller. STAMP analyses the information flow looking for messages which might cause erroneous behaviour if they are wrong. This is based on the observation that in many system failures every component is found to have operated within its specification, but the system still failed. The 737-MAX is a good example; the MCAS did exactly what it was supposed to, given its inputs. Even the failed sensor was within spec, in the sense that the fleet-wide sensor failure rate no higher than expected. The problem wasn't a component failure, it was the interaction between a system (the airframe) and a controller (MCAS) once erroneous information started to flow. This was then exacerbated by the next control level up, where information about the MCAS failed to flow to the pilot who was controlling it.