“Insisting that operators always follow procedures does not guarantee safety although it does usually guarantee that there is someone to blame-either for… — Nancy G. Leveson Safety Copy Share Image
“It seems to be common, judging from the number of incidents and accidents that have resulted, for software designers to forget that… — Nancy G. Leveson Programming Copy Share Image
“Large-scale engineered systems are more than just a collection of technological artifacts: They are a reflection of the structure, management, procedures, and… — Nancy G. Leveson Architecture Copy Share Image
“Safety is a system property, not a component property, and must be controlled at the system level, not the component level.” — Nancy G. Leveson Copy Share Image
“The goal then is to understand why people did not or could not act differently. People acted the way they did for… — Nancy G. Leveson Goals Copy Share Image
“The most common accident causality models assume that accidents are caused by component failure and that making system components highly reliable or… — Nancy G. Leveson Copy Share Image
“A basic principle of system theory is that no control system will perform better than its measuring channel.” — Nancy G. Leveson Copy Share Image
“In highly automated systems, the operator is often at the mercy of the system design and operational procedures.” — Nancy G. Leveson Compassion Copy Share Image
“Safety starts with management leadership and commitment. Without these, the efforts of others in the organization are almost doomed to failure. Leadership… — Nancy G. Leveson Failure Copy Share Image
“Human error is not random. It results from basic human mental abilities and physical skills combined with the features of the tools… — Nancy G. Leveson Copy Share Image
“Hindsight bias and focusing only on the operator's role in accidents prevents us from fully learning from accidents and making significant progress… — Nancy G. Leveson Safety Copy Share Image
“When operators receive input about the state of the system being controlled, they will first try to fit that information into their… — Nancy G. Leveson Copy Share Image
“Virtually all systems contain humans, but engineers are often not taught much about human factors and draw convenient boundaries around the technical… — Nancy G. Leveson Engineering Copy Share Image
“viewing accidents as chains of events and conditions may limit understanding and learning from the loss and omit causal factors that cannot… — Nancy G. Leveson Learning Copy Share Image
“Making all the components highly reliable will not necessarily make the system safe.” — Nancy G. Leveson Copy Share Image
“identifying only operator error or sabotage as the root cause of the accident ignores most of the opportunities for the prevention of… — Nancy G. Leveson Root cause Copy Share Image
