Engineering has experienced a technological revolution, but the basic engineeringtechniques applied in safety and reliability engineering, created in a simpler, analog world, havechanged very little over the years. In this groundbreaking book, Nancy Leveson proposes a newapproach to safety--more suited to today's complex, sociotechnical, software-intensive world--basedon modern systems thinking and systems theory. Revisiting and updating ideas pioneered by 1950saerospace engineers in their System Safety concept, and testing her new model extensively onreal-world examples, Leveson has created a new approach to safety that is more effective, lessexpensive, and easier to use than current techniques. Arguing that traditional models of causalityare inadequate, Leveson presents a new, extended model of causation (Systems-Theoretic AccidentModel and Processes, or STAMP), then then shows how the new model can be used to create techniquesfor system safety engineering, including accident analysis, hazard analysis, system design, safetyin operations, and management of safety-critical systems. She applies the new techniques toreal-world events including the friendly-fire loss of a U.S. Blackhawk helicopter in the first GulfWar; the Vioxx recall; the U.S. Navy SUBSAFE program; and the bacterial contamination of a publicwater supply in a Canadian town. Leveson's approach is relevant even beyond safety engineering, offering techniques for "reengineering" any large sociotechnical system to improve safetyand manage risk.