SOFTWARE SYSTEM SAFETY 
               Leveson, N.G. and P.R. Harvey. ``Analyzing Software Safety,'' IEEE
               Transactions on Software Engineering, vol. SE-9, no. 5, 1983. 
               Leveson, N.G. and Stolzy, J.L. ``Safety Analysis Using Petri Nets,'' IEEE Trans.
               on Software Engineering, Vol. SE-13, No. 3, March 1987, pp. 386-397. 
               Leveson, N.G. ``Software Safety: Why, What, and How,'' ACM Computing
               Surveys, Vol. 18, No. 2, June 1986, pp. 125-163. 
               Leveson, N.G. ``Software Safety in Embedded Computer Systems,''
               Communications of the ACM, February, 1991. 
               Jaffe, M.S., Leveson, N.G., Heimdahl, M., and Melhart, B. ``Software
               Requirements Analysis for Real-Time Process-Control Software,'' IEEE Trans.
               on Software Engineering, March 1991. 
               Leveson, N.G., Cha, S.S., Shimeall, T.J. ``Safety Verification of Ada Programs
               using Software Fault Trees,'' IEEE Software, July 1991. 
               Leveson, N.G. and Turner, C.L. ``An Investigation of the Therac-25 Accidents,''
               IEEE Computer, July 1993. 
               Leveson, N.G., Heimdahl, M.P.E., Hildreth, H., and Reese, J.D. ``Requirements
               Specification for Process-Control Systems,'' IEEE Transactions  on Software
               Engineering, September, 1994. 
               Leveson, N.G. Safeware: System Safety in the Computer Age,
               Addison-Wesley Publishing Company, Spring 1995 (in press). 
SOFTWARE FAULT TOLERANCE 
               Knight, J.C. and Leveson, N.G. ``An Experimental Evaluation of the Assumption
               of Independence in Multi-Version Programming,'' IEEE Transactions on
               Software Engineering, Vol. SE-12, No. 1, January 1986, pp. 96-109. 
               Brilliant, S., Knight, J.C., and Leveson, N.G. ``The Consistent Comparison
               Problem in N-Version Programming,'' IEEE Trans. on Software Engineering,
               Vol. SE-15, No. 11, November 1989. 
               Brilliant, S.S., Knight, J.C., and Leveson, N.G. ``Analysis of Faults in an
               N-Version Software Experiment,'' IEEE Trans. on Software Engineering, Vol.
               SE-16, No. 2, February 1990. 
               Leveson, N.G., Cha, S.S., Knight, J.C., and Shimeall, T.J. ``The Use of Self
               Checks and Voting in Software Error Detections: An Empirical Study,'' IEEE
               Trans. on Software Engineering, Vol. SE-16, No. 4, April, 1990. 
               Shimeall, T., Leveson, N.G. ``An Empirical Comparison of Software Fault
               Tolerance and Fault Elimination,'' IEEE Trans. on Software Engineering, Vol.
               SE-17, No. 2, February 1991, pp. 173-183. 
               Knight, J.C. and Leveson, N.G., ``A Reply to the Criticisms of the Knight and
               Leveson Experiment,'' ACM Software Engineering Notes, January 1990.