“The most common accident causality models assume that accidents are caused by component failure and that making system components highly reliable or planning for their failure will prevent accidents. While this assumption is true in the relatively simple electromechanical systems… — Nancy G. Leveson Copy Share Image
“Insisting that operators always follow procedures does not guarantee safety although it does usually guarantee that there is someone to blame-either for following the… — Nancy G. Leveson Copy Share Image
“It seems to be common, judging from the number of incidents and accidents that have resulted, for software designers to forget that the world… — Nancy G. Leveson Copy Share Image
“Large-scale engineered systems are more than just a collection of technological artifacts: They are a reflection of the structure, management, procedures, and culture of… — Nancy G. Leveson Copy Share Image
“Safety is a system property, not a component property, and must be controlled at the system level, not the component level.” — Nancy G. Leveson Copy Share Image
“The goal then is to understand why people did not or could not act differently. People acted the way they did for very good… — Nancy G. Leveson Copy Share Image
“The most common accident causality models assume that accidents are caused by component failure and that making system components highly reliable or planning for… — Nancy G. Leveson Copy Share Image
“A basic principle of system theory is that no control system will perform better than its measuring channel.” — Nancy G. Leveson Copy Share Image
“In highly automated systems, the operator is often at the mercy of the system design and operational procedures.” — Nancy G. Leveson Copy Share Image
“Safety starts with management leadership and commitment. Without these, the efforts of others in the organization are almost doomed to failure. Leadership creates culture,… — Nancy G. Leveson Copy Share Image
“Human error is not random. It results from basic human mental abilities and physical skills combined with the features of the tools being used,… — Nancy G. Leveson Copy Share Image
“Hindsight bias and focusing only on the operator's role in accidents prevents us from fully learning from accidents and making significant progress in improving… — Nancy G. Leveson Copy Share Image
“When operators receive input about the state of the system being controlled, they will first try to fit that information into their current mental… — Nancy G. Leveson Copy Share Image
