“The goal then is to understand why people did not or could not act differently. People acted the way they did for very good reasons; we need to understand why the behavior of the people involved made sense to them… — Nancy G. Leveson Copy Share Image
“Insisting that operators always follow procedures does not guarantee safety although it does usually guarantee that there is someone to blame-either for following the… — Nancy G. Leveson Copy Share Image
“It seems to be common, judging from the number of incidents and accidents that have resulted, for software designers to forget that the world… — Nancy G. Leveson Copy Share Image
“Large-scale engineered systems are more than just a collection of technological artifacts: They are a reflection of the structure, management, procedures, and culture of… — Nancy G. Leveson Copy Share Image
“Safety is a system property, not a component property, and must be controlled at the system level, not the component level.” — Nancy G. Leveson Copy Share Image
“The goal then is to understand why people did not or could not act differently. People acted the way they did for very good… — Nancy G. Leveson Copy Share Image
“The most common accident causality models assume that accidents are caused by component failure and that making system components highly reliable or planning for… — Nancy G. Leveson Copy Share Image
“A basic principle of system theory is that no control system will perform better than its measuring channel.” — Nancy G. Leveson Copy Share Image
“In highly automated systems, the operator is often at the mercy of the system design and operational procedures.” — Nancy G. Leveson Copy Share Image
“Safety starts with management leadership and commitment. Without these, the efforts of others in the organization are almost doomed to failure. Leadership creates culture,… — Nancy G. Leveson Copy Share Image
“Human error is not random. It results from basic human mental abilities and physical skills combined with the features of the tools being used,… — Nancy G. Leveson Copy Share Image
“Hindsight bias and focusing only on the operator's role in accidents prevents us from fully learning from accidents and making significant progress in improving… — Nancy G. Leveson Copy Share Image
“When operators receive input about the state of the system being controlled, they will first try to fit that information into their current mental… — Nancy G. Leveson Copy Share Image
“Virtually all systems contain humans, but engineers are often not taught much about human factors and draw convenient boundaries around the technical components, focusing… — Nancy G. Leveson Copy Share Image
“viewing accidents as chains of events and conditions may limit understanding and learning from the loss and omit causal factors that cannot be included… — Nancy G. Leveson Copy Share Image
“Making all the components highly reliable will not necessarily make the system safe.” — Nancy G. Leveson Copy Share Image
