Paper by Nancy G. Leveson.

Abstract

Major accidents keep occurring that seem preventable and that have similar systemic causes. Too often, we fail to learn from the past and make inadequate changes in response to losses. Examining the assumptions and paradigms underlying safety engineering may help identify the problem. The assumptions questioned in this paper involve four different areas: definitions of safety and its relationship to reliability, accident causality models, retrospective vs. prospective analysis, and operator error. Alternatives based on systems thinking are proposed.