What [software] must not do is not the inverse of what it must do. . Nancy Leveson More Quotes by Nancy Leveson More Quotes From Nancy Leveson Safety is an emergent property of systems, not a component property. Nancy Leveson components property safety Reliability engineers often assume that reliability and safety are synonymous, but this assumption is true only in special cases. Nancy Leveson reliability safety special Software−related accidents are usually caused by flawed requirements. Nancy Leveson flawed requirements software Highly reliable components are not necessarily safe. . Nancy Leveson components safe Requirement completeness: Requirements are sufficient to distinguish the desired behavior of the software from that of any other undesired program that might be designed. . Nancy Leveson requirements behavior might
![What [software] must not do is not the inverse of what it must do... by Nancy Leveson](https://whatsmyquote.com/images/quote-medium-quote-4c1ee5ddebe91f511869311c7ac4181f.jpg)
