Mental Models

Complexity, especially the accidental complexity we introduce ourselves, is the dominant source of difficulty in software, so the highest leverage work is relentlessly reducing it. The enemy is not lines of code or scale but the loss of understandability as a system grows. Com...

Complexity is inevitable, but it should be concealed behind simple interfaces and pushed down and inward, so that most people most of the time never have to confront it. The quality of a design is measured by how little complexity it exposes, not by how clever its internals ar...

Every system's output is limited by a small number of constraints. Performance is set by them, so improvement comes from finding and strengthening the binding constraint, while effort spent anywhere else produces little or no gain. Bottlenecks — the constraint that caps the th...

A good design reveals how it works. Whether the artifact is code or a physical object, understanding should come from the thing itself rather than from external explanation. The burden is on the designer to communicate, and confusion is the designer's failure, not the user's....

Deliberate effort spent on design up front is an investment that pays back by reducing future complexity and rework. Treating design as a cost to be minimized for short term speed accrues a debt that compounds. Strategic vs Tactical Programming — invest a small, continuous sha...

When a person makes an error, the fault usually lies in a design that made the error easy to commit and hard to recover from. The remedy is to design so errors cannot happen, or are caught and reversible, rather than to blame the operator. Define Errors Out of Existence — rede...

There are no universally correct choices in engineering, only tradeoffs that depend on context. Whatever structure, technology, or guarantee you gain costs something elsewhere, so the work is not to find the single best option but to make the tradeoff explicit and choose delib...

Failure is not an anomaly to be eliminated but a permanent, normal property of complex and distributed systems. Robust design assumes things are always partly broken and focuses on containing faults and degrading gracefully, rather than chasing a flawless state that does not e...

Human judgment runs on limited information and fast, automatic heuristics, producing errors that are systematic and predictable rather than random. Robust systems and decisions are designed to account for bounded, biased judgment instead of assuming rational actors. Bounded Ra...

Good design preserves the freedom to change course. Because requirements, technologies, and understanding all change, the valuable property is not forecasting the future correctly but keeping decisions cheap to revise: defer commitment until the last responsible moment, and is...

The performance of a system comes from how its parts work together, not from each part maximizing its own output. Optimizing a subsystem in isolation usually degrades the whole; the goal is fast, smooth flow through the entire system. Four Fundamental Team Types and Team Inter...

Good products and designs begin from the needs of the people who will use them and reason backward to the solution, rather than starting from the technology, the implementation, or internal convenience. The user's experience is the fixed point; everything else is negotiable in...

A system's behavior is produced by its structure, the way its parts and flows are arranged, not by the intentions or quality of the people inside it. To change the behavior, change the structure. Conway's Law is a special case: an organization's communication structure shapes...

The durable difficulty in software was never typing the code; it was deciding what the code should do and establishing that it actually does it. Producing an implementation is the cheap, fast part; specifying intent precisely and verifying correctness is the scarce, hard, last...