First, we must define and state clearly and explicitly the safety requirements of our system. Second, we must design and build the safe system—this, after all, is our primary task.