"Operator error is a symptom, not a cause."
Ms. Leveson's book "Engineering a Safer World" has a free PDF download at http://sunnyday.mit.edu/safer-world.pdf