What [software] must not do is not the inverse of what it must do. . — Nancy Leveson Copy Share Image
Requirement completeness: Requirements are sufficient to distinguish the desired behavior of the software from that of any other undesired program that might be designed. . — Nancy Leveson Copy Share Image
Safety is an emergent property of systems, not a component property. — Nancy Leveson Copy Share Image
What [software] must not do is not the inverse of what it must do. . — Nancy Leveson Copy Share Image
Software−related accidents are usually caused by flawed requirements. — Nancy Leveson Copy Share Image
Reliability engineers often assume that reliability and safety are synonymous, but this assumption is true only in special cases. — Nancy Leveson Copy Share Image
![“What [software] must not do is not the inverse of what it must do. .” quote by Nancy Leveson](https://sms4smile.com/quotes/img-quotes/cf5/nancy-leveson-56176_inverse_what-software-must-not-do-is-not-the-inv_1537245.jpg)
