book
Engineering a Safer World: Systems Thinking Applied
Leveson, Nancy G. Engineering a Safer World: Systems Thinking Applied to Safety. Cambridge, MA: MIT Press, 2011.
Related concepts6 concepts
Concept
Consequence Architecture
Consequence architecture names professional literacy for systems where generation or scale outruns informal caution. It becomes important when guardrails exist on paper but production paths bypass them, or when postmortems produce action items detached from redesign authority. It helps preserve corrigibility under acceleration, but can fail when organizations prove they cared while the same failure class repeats. It differs from coupling because consequence-architecture is designed structure; coupling is the resulting attachment strength. It differs from cohesion because architecture designs the whole path; cohesion names ownership clarity within one boundary.
View Concept →
Concept
Coupling
Coupling names the strength of the link between what was decided and what later arrives. It becomes important when scale, abstraction, or delay lengthen the chain between decision and lived harm. It helps preserve learning and legitimacy, but can fail when dashboards stay green while frontline frustration grows. It differs from cohesion because coupling tracks action-to-effect attachment; cohesion tracks whether responsibility is clearly held. It differs from consequence-architecture because coupling describes the attachment; consequence-architecture describes intentional design of boundaries, feedback, and escalation.
View Concept →
Concept
Feedback
Feedback names how systems stay in contact with their own effects. It becomes important whenever action and consequence are separated by time, scale, or abstraction. It helps preserve learning, correction, and trust in ongoing coordination, but can fail when dashboards stay green while lived harm accumulates off the ledger. It differs from trust because feedback is the returning signal itself; trust is the bridge that lets people act before every signal arrives. It differs from correction because feedback is what returns; correction is the work of updating in response.
View Concept →
Concept
Harm
Harm names where cost lands when influence is exercised—who absorbs it, who is kept in view, and what displacement is treated as acceptable. It marks the lived consequence of action, authority, design, or coordination. The visibility dimension matters—who is harmed in particular, not on average? Can they name it? Can they respond? Does the system register it or treat it as acceptable loss? Harm continues while interpretation expands, briefings make harm legible without smaller, people can still tell when something is doing harm. The question harm raises—is harm unchanged outside while we analyze inside? When does naming harm substitute for reducing it? The failure mode—harm persists while moral work feels complete, delays continue after excellent postmortems, harm becomes statistical at scale. The restoration path—return to particular harms and people, check effects outside the room after briefings, stop when outcomes for people are unchanged, pair analysis with named remedy attempts, accept harm as inevitable without abandoning response.
View Concept →
Concept
Responsibility
Responsibility names what continues after action—the obligation to remain responsive to what one's choices set in motion. It becomes important when systems scale beyond any one person's control but moral weight still accumulates. It helps preserve sustained answerability, but can fail when responsibility collapses into futility or when symbolic gestures replace contact with effects. It differs from accountability because responsibility names the enduring relation; accountability names whether consequence still reaches those who can respond.
View Concept →
Concept
System
A system is an organized set of people, processes, rules, and structures that produces repeatable outcomes over time. The term applies across domains: software architectures, teams, firms, agencies, governance structures, and media institutions. The shared criterion is not technology; it is patterned behavior under constraints, incentives, and feedback.
View Concept →
