For `mixed-criticality' systems that have both critical and non-critical functions, the greatest leverage on dependability may be at the design level. By designing so that each critical requirement has a small trusted base, the cost of the analysis required for a dependability case might be dramatically reduced. An implication of this approach is that conventional object-oriented design may be a liability, because it leads to `entanglement', and an approach based on separating services may be preferable. Categories and Subject Descriptors D.2.2 [Software Engineering]: Design Tools and Techniques; D.2.4 Software/Program Verification; D.2.10 Design. General Terms Design, Reliability, Languages, eory, Verification. Keywords Dependability, software design, separation of concerns, object-orientation, formal methods, trusted bases, decoupling, entanglement, mixed-criticality systems.