Nancy G. Leveson’s An Introduction to System Safety Engineering does two things unusually well. It gives a systematic account of the foundations of classical safety engineering, and it uses systems thinking to address the new problems created by software, automation, complex systems, and organizations.
The Chinese edition, 《系统安全工程导论》, was translated jointly by two teams led by Professor Hong Wang and me.
Many readers may know Leveson first through STPA, System-Theoretic Process Analysis. STPA has been applied to software-intensive, human-interactive, safety-critical systems in fields including aviation, space, nuclear power, and process industries. In recent years, it has also attracted growing attention in the automotive sector, especially for automated-driving systems.
SAE J3187 provides recommended practices for applying STPA in safety-critical evaluations. In China, a national-standard project titled Road Vehicles—System Theoretic Process Safety Analysis Methods is also under development.
But STPA is only a small part of this book.
The deeper question is more fundamental: what core capabilities should a safety engineer develop today that will not quickly become obsolete?
First, it is a textbook for building solid foundations
MIT Press describes the original book as a comprehensive and up-to-date introduction to classical safety engineering that also prepares readers for future safety challenges. That is an accurate summary.
The book begins with basic concepts such as safety, risk, and hazards, then systematically covers accident analysis, hazard analysis, designing for safety, software safety, human factors, safety assurance, management, and operations.
FMEA, fault-tree analysis, event-tree analysis, HAZOP, and STPA are all included. None is presented as a universal answer.
Instead, the book asks better questions: What accident model underlies each method? What kind of problem can it address? Where are its limits?
Knowing how to run an analysis or complete a familiar worksheet is not the same as knowing how to create safety.
The real skill is being able to face a new system and still judge what to examine, what to ask, and whether the available evidence is actually sufficient.
Second, it is a monograph for the complex systems ahead
Today’s systems are far more complex than those of the past.
Software carries an increasing share of control functions. Humans and automation are continually redistributing responsibility. Design, operation, maintenance, and management interact with one another. An accident does not have to begin with the failure of a component; it may emerge from unsafe interactions among components that are each behaving “normally.”
The book therefore preserves the foundations of classical safety engineering while introducing systems thinking and systems theory. It discusses complexity, control, feedback, organizations, policy, and ethics.
This is one of its greatest strengths. It does not rush to declare old methods obsolete, and it does not market new methods as magic. It places both on the same map.
The book also examines major historical accidents, including Challenger, Columbia, Chernobyl, and Fukushima.
Healthcare, aerospace, petrochemicals, and nuclear power may seem distant from the automotive industry. Yet the patterns behind their accidents are familiar: flawed assumptions, inadequate feedback, organizational communication failures, and overconfidence in automation.
The accidents differ. The engineering lessons can travel.
Why is this book worth recommending?
It works for students encountering safety engineering for the first time, and for engineers who have already spent years delivering real projects.
Students can use it to build a complete knowledge map before becoming locked into one favored method.
Practitioners can use it to recalibrate familiar tools: Which problems have we actually covered? Which risks remain hidden in interfaces, operational scenarios, or organizational arrangements?
Managers can use it to understand that safety is not a stack of documents produced by the safety department. It is a system property created jointly through design, verification, operation, and management.
For the automotive industry, the book cannot replace ISO 26262 or ISO 21448, nor will it tell you exactly how to complete a particular form. Its value is more foundational: it explains why the work matters and what questions remain after process compliance has been demonstrated.
AI is now widely used in assisted and automated driving. The safe operation of Level 3 and Level 4 systems depends on a broad network of stakeholders, as the figure below illustrates. Strong systems thinking and a solid foundation in system safety engineering will help us deal more effectively with the safety problems of future complex systems.
Figure: Stakeholders and feedback relationships around a safety-critical system, adapted in the Chinese edition from Figure 3.10 of the original book.
About the Chinese edition
The Chinese edition was translated collaboratively by the Jilin University Joint Laboratory for Autonomous Driving Safety and Tsinghua University’s Intelligent Vehicle Design and Safety Research Center. Many faculty members and students contributed. Academician Jun Li and Professor Yongjun Wang served as chief reviewers.
If you are studying safety engineering, or working on safety in automotive, aerospace, rail, energy, medical devices, or another safety-critical field, this is a book worth keeping close at hand. Read it first to build the map; return to it later when a specific problem demands closer study.
Tools will change. Systems will continue to grow more complex.
What endures is the ability to understand why accidents occur—and how to prevent them through design.
Further reading in Chinese: China Machine Press, Daily Book Recommendation: An Introduction to System Safety Engineering.
This article was originally published in Chinese on the WeChat channel “张玉新-AutoZYX”. This blog edition includes light updates to the standard status and reference links.