Discussion here reminds me of Rule #3 in Richard Cook's classic "How Complex Systems Fail": Catastrophe requires multiple failures – single point failures are not enough. http://web.mit.edu/2.75/resources/random/How%20Complex%20Sys...