The Design of Everyday Things — Chapter-by-Chapter Outline

Author: Don Norman
First published: 1988, originally as The Psychology of Everyday Things
Edition covered: 2013 Basic Books revised and expanded edition, ISBN 9780465050659, with the matching 2014 MIT Press UK/Ireland paperback, ISBN 9780262525671. The verified structure contains a preface to the revised edition, seven numbered chapters, acknowledgments, readings and notes, references, and an index. This outline covers the seven numbered chapters; the preface is folded into the edition note and central thesis. The skeleton was cross-checked against Don Norman's official JND.org table of contents and Open Library's 2013 edition record. In the 2013 revision Norman adds signifiers, updates many examples, revises the treatment of error, adds material on emotion and culture, and replaces the older final chapters with two new chapters: Design Thinking and Design in the World of Business.

Central thesis

The Design of Everyday Things argues that everyday frustration is usually not evidence of user stupidity. It is evidence of a communication failure between the designed object and the person trying to use it. Good design makes possible actions discoverable, makes the relation between controls and results understandable, gives timely feedback, and builds a usable conceptual model in the user's mind. Bad design hides possibilities, creates arbitrary mappings, asks people to memorize what could have been made visible, and then lets institutions blame the person who failed.

Norman's deeper claim is that design is applied psychology. People act through goals, interpretations, memories, emotions, cultural expectations, habits, and errors. Products and systems should therefore be shaped around real human behavior, not around idealized operators who remember everything, notice every mode, and never get interrupted. Human-centered design is the process discipline that follows from this: observe people, understand the real problem, prototype, test, iterate, and accept that business, standards, technology, and ethics all constrain the finished thing.

The book's 2013 revision keeps the psychological principles stable while moving the examples into a world of digital devices, services, automation, and business pressure. Its core question is:

How can designed things tell people what they are, what actions are possible, what is happening, and how to recover when something goes wrong?

Chapter 1 — The Psychopathology of Everyday Things

Edition note

The revised edition expands this chapter's treatment of signifiers, clarifies the difference between affordances and perceived affordances, and introduces human-centered design as the frame for the rest of the book.

Central question

Why do ordinary objects so often make competent people feel incompetent, and what does that reveal about design?

Main argument

Bad design is failed communication. Norman opens with familiar objects that are hard to use: doors that do not reveal whether to push or pull, light switches that do not map to the lights they control, refrigerators whose controls imply a false internal model, and devices whose labels come only after the underlying design has already failed. The point is not that these objects are trivial. They show the same pattern that appears in software, vehicles, medical devices, and industrial systems: the user must infer the designer's intent from the object itself.

The system image carries the design. The designer has a conceptual model of how the device works, and the user forms a mental model while trying to use it. Because the designer and user usually never meet, communication happens through the system image: the visible structure, labels, sounds, behavior, documentation, and prior conventions surrounding the object. When the system image is poor, the user's model is poor even if the engineering is sound.

The first vocabulary of usable things. The chapter introduces the book's core design vocabulary. Affordances are the possible interactions between a person and an object; signifiers are perceivable cues that indicate where and how to act; mapping is the relationship between controls and effects; feedback tells the user what happened; conceptual models let the user predict the system. Good design aligns these elements so that the next action is evident without heavy instruction.

The paradox of technology. Technology can simplify life by adding capability, but each new capability can add controls, modes, and hidden states. More function can therefore make a product harder to understand. The design challenge is not to remove power, but to make increasing power legible.

Key ideas

• Everyday failures often come from poor discoverability and poor understanding, not user ignorance.
• Designers communicate through the product's system image, which includes appearance, behavior, labels, and conventions.
• Affordances make action possible; signifiers make possible action discoverable.
• Mapping and feedback reduce the effort required to choose an action and interpret its result.
• Good conceptual models let people predict what a thing will do before they act.
• Added functionality creates design pressure because power and understandability can pull against each other.
• Human-centered design begins by treating confusion as design evidence rather than as user defect.

Key takeaway

Usable objects explain themselves through their form, behavior, constraints, and feedback; confusing objects force users to guess and then blame themselves.

Chapter 2 — The Psychology of Everyday Actions

Edition note

The revised edition adds a stronger role for emotion, especially Norman's three processing levels: visceral, behavioral, and reflective.

Central question

What psychological sequence do people move through when they act, and how can design support that sequence?

Main argument

Action has two gulfs. When people use a thing, they must cross the gulf of execution and the gulf of evaluation. The gulf of execution is the gap between the user's goal and the actions the system appears to allow. The gulf of evaluation is the gap between the system's state and the user's ability to tell what happened. Bad design widens both: the person cannot tell what to do, then cannot tell whether the action worked.

The seven stages of action. Norman breaks action into a cycle: form a goal, plan an action, specify the action sequence, perform it, perceive the state of the world, interpret that state, and compare the outcome with the goal. The model is not meant to imply that people consciously deliberate through every step. It is a diagnostic checklist for designers. If a product fails, ask which stage is unsupported.

Emotion is part of cognition. The chapter links action to three levels of processing. The visceral level responds quickly to appearance and sensation. The behavioral level governs skilled performance and usability during action. The reflective level interprets meaning, memory, identity, and story. A product can be attractive at one level and poor at another; for example, an elegant device can still fail behaviorally if it hides its controls.

People explain, then blame. People are storytellers. When something happens, they build explanations from partial evidence. This helps everyday life proceed, but it also produces wrong blame. Users may blame themselves for a poorly mapped stove or a confusing thermostat, eventually developing learned helplessness around devices that were badly designed.

Seven design principles follow from the stages. Norman turns the action cycle into design guidance: provide discoverability, feedback, a good conceptual model, affordances, signifiers, mappings, and constraints. These principles bridge the two gulfs by showing what can be done and what happened after it was done.

Key ideas

• Execution asks, "How do I do it?"; evaluation asks, "What happened, and did it satisfy my goal?"
• The seven-stage action cycle provides a practical way to diagnose where interaction breaks down.
• Feedback and conceptual models are especially important because they support interpretation after action.
• Emotion is not decoration; visceral, behavioral, and reflective processing shape whether products feel understandable and satisfying.
• People often create plausible but false explanations when systems hide their actual state.
• Repeated design failure can teach users that they are incapable, even when the design is the real source of difficulty.
• The seven design principles convert psychology into a checklist for interaction design.

Key takeaway

Design should support the full action cycle: help people form intentions, execute actions, perceive results, interpret them, and recover their sense of control.

Chapter 3 — Knowledge in the Head and in the World

Edition note

The revised edition updates examples and adds more explicit attention to culture, especially how natural mappings vary across communities.

Central question

How much should people have to remember, and how much should the world itself show them?

Main argument

Precise behavior can come from imprecise knowledge. People often act successfully without holding exact information in memory. They recognize coins without being able to draw them accurately, remember songs through cues, and use devices by combining habit with visible clues. This matters for design because the world can carry some of the cognitive burden. If the needed information is present at the moment of action, the user need not memorize it.

Memory has limits and strengths. Norman distinguishes knowledge in the head from knowledge in the world. Working memory is limited and fragile; long-term memory is powerful but depends on meaning, structure, and retrieval cues. Arbitrary details are hard to remember, while meaningful structure is easier. Design should therefore avoid needless memorization, especially for arbitrary codes, modes, or command sequences.

The tradeoff is speed versus learnability. Knowledge in the world makes first use easier because clues are visible. Knowledge in the head can make expert performance faster because the user no longer has to inspect every cue. Good systems support both paths: they are discoverable for newcomers and efficient for practiced users.

Distributed memory is normal. People remember through notes, calendars, labels, other people, devices, and environmental arrangements. Pilots repeat air-traffic instructions, people leave objects by the door as reminders, and teams divide memory across roles. This is not a weakness; it is how human cognition works in practice. Design should exploit external memory rather than requiring private recall.

Natural mapping reduces memory load. A mapping feels natural when the relation between control and result follows spatial, cultural, or analogical structure: a burner control laid out like the stovetop, a row of switches corresponding to a row of lights, or a steering action matching the direction of motion. But "natural" is not universal. Reading direction, traffic conventions, and cultural habits shape what feels obvious.

Key ideas

• People do not need complete internal knowledge when the environment supplies useful cues.
• Working memory is fragile, so designs that require users to retain arbitrary steps are brittle.
• External memory aids are legitimate design resources, not compensations for bad users.
• Visible structure improves learnability; internalized skill improves speed.
• Natural mapping turns relationships into perception instead of memory.
• Cultural conventions can make a mapping seem obvious to one group and confusing to another.
• Good design balances knowledge in the head and knowledge in the world for the intended activity.

Key takeaway

The most usable systems put the right knowledge in the world at the right moment while allowing practiced users to internalize shortcuts over time.

Chapter 4 — Knowing What to Do: Constraints, Discoverability, and Feedback

Edition note

The revised edition expands the treatment of lock-ins and lock-outs, updates examples such as destination-control elevators, and gives sound a larger role as a signifier and feedback channel.

Central question

How can design guide people toward the right action without requiring instructions?

Main argument

Constraints narrow the search space. Norman identifies four kinds of constraints. Physical constraints make some actions impossible. Cultural constraints rely on learned conventions. Semantic constraints rely on the meaning of the situation. Logical constraints use relationships among parts to determine what must go where. The classic example is assembling a simple model, where shape, meaning, and remaining unmatched parts jointly reveal the correct placement.

Doors, switches, and controls expose weak signification. A door may afford both pushing and pulling, but the plate, handle, hinge visibility, and motion should signify the intended action. Switches and stove controls need mappings that show which control affects which target. When a system requires labels to rescue it, the designer may have missed a chance to make the relation visible.

Forcing functions prevent dangerous action. Some constraints are deliberately coercive. An interlock prevents an operation unless conditions are safe, such as a microwave that will not run with the door open. A lock-in keeps an operation active until a required step is complete. A lock-out prevents entry into a dangerous state. These mechanisms matter when feedback alone would arrive too late.

Conventions are powerful but fragile. Cultural conventions make many interactions easy: red means stop in some contexts, scrolling has learned patterns, and elevator controls follow expected sequences. But new systems can violate old conventions. Destination-control elevators, for example, change the old pattern of entering an elevator and then choosing a floor; users must learn to choose before entering. The design problem is adoption as much as mechanism.

Feedback closes the loop. Discoverability helps the user act; feedback helps the user know what the action did. Sound can be feedback, signifier, warning, or nuisance. The design problem is to make feedback timely, informative, and proportional, without creating alarm fatigue or meaningless noise.

Key ideas

• Constraints guide action by reducing what the user has to consider.
• Physical, cultural, semantic, and logical constraints often work together.
• Signifiers are especially important when affordances are ambiguous or hidden.
• Forcing functions are appropriate when the cost of error is high.
• New interaction conventions require careful transition design because learned behavior is persistent.
• Feedback must be perceivable and interpretable, not merely present.
• The goal is not to eliminate learning but to make the right action discoverable in context.

Key takeaway

Design can teach action through constraints, signifiers, mappings, and feedback so that users can discover what to do before error becomes the teacher.

Chapter 5 — Human Error? No, Bad Design

Edition note

The revised edition substantially updates the classification of errors, connects slips and mistakes to the seven-stage action cycle, and adds discussions of automation, resilience engineering, and modern safety thinking.

Central question

When something goes wrong, why is "human error" usually the wrong stopping point for explanation?

Main argument

Error is a system symptom. Norman argues that investigations too often stop at the person closest to the failure. If a nurse selects the wrong setting, a pilot misses a mode, or a driver turns onto the wrong road, blame may feel satisfying but it does not explain why the system made that action plausible. A better inquiry asks what conditions, cues, incentives, interruptions, and design decisions made the error likely.

Root causes require repeated why. The chapter uses root cause analysis and the Five Whys as tools for moving past immediate blame. The point is not that there is always one true root. It is that the first answer is usually shallow. "The operator forgot" leads to better questions: Why was memory required? Why was there no reminder? Why was the display ambiguous? Why did the organization accept that ambiguity?

Slips and mistakes differ. A slip occurs when the goal is right but the action goes wrong; a mistake occurs when the plan or goal is wrong. Norman classifies slips into action-based slips and memory-lapse slips, including capture slips, description-similarity slips, and mode errors. Mistakes include rule-based mistakes, knowledge-based mistakes, and memory-lapse mistakes. This taxonomy matters because each error type calls for a different design response.

Social pressure creates unsafe behavior. Errors are not only cognitive. Institutions create time pressure, production pressure, fear of reporting, and incentives to work around inconvenient safeguards. Deliberate violations can become normal when the system rewards speed over safety. A design that ignores organizational reality is incomplete.

Reporting and recovery are design problems. Norman points to checklists, Toyota's jidoka and poka-yoke practices, NASA's Aviation Safety Reporting System, undo, confirmation, sensibility checks, constraints, and the Swiss Cheese model as ways to catch or absorb error. The recurring theme is layered defense: assume people will err, then design systems that make errors visible, reversible, or harmless.

Automation changes the error landscape. Automation can remove routine burden, but it can also create complacency, mode confusion, and skill decay. The paradox of automation is that the more reliable the automation, the less practiced people become at intervening when it fails. Resilience requires systems that support adaptation, not just systems that prevent deviation.

Key ideas

• "Human error" names the event but often hides the design and organizational causes.
• Root cause analysis should continue past the person who touched the system last.
• Slips, mistakes, and memory lapses arise at different points in the action cycle.
• Mode errors are especially dangerous because the same action has different meanings in different states.
• Reporting systems must reduce blame if organizations want to learn from near misses.
• Undo, constraints, interlocks, checklists, and sensibility checks help users detect and recover from error.
• Automation must be designed for monitoring, takeover, and graceful failure.

Key takeaway

Error-tolerant design assumes that people will be interrupted, pressured, tired, creative, and fallible, then builds systems that help them succeed anyway.

Chapter 6 — Design Thinking

Edition note

This chapter is new in the revised and expanded edition.

Central question

How does human-centered design move from a stated problem to a useful solution in real organizations?

Main argument

The stated problem is often not the real problem. Norman argues that a good solution to the wrong problem can be worse than no solution because it consumes resources and strengthens the wrong framing. Designers should treat the initial brief as a hypothesis. The first task is to understand the activity, people, context, and constraints well enough to redefine the problem.

The Double Diamond separates problem finding from solution finding. The chapter presents the British Design Council's Double Diamond: diverge to explore the problem, converge to define it, diverge again to explore solutions, converge again to deliver one. The model matters because teams often converge too early, choosing a solution before they understand the need.

Human-centered design is iterative. Norman summarizes the HCD cycle as observation, idea generation, prototyping, testing, and iteration. Observation means watching people in their actual settings, not merely asking them what they want. Prototypes make ideas concrete enough to test. Testing exposes mismatches between designer assumptions and user behavior. Iteration turns those mismatches into design knowledge.

Activities are broader than tasks. The chapter distinguishes task-centered design from activity-centered design. A task is a specific action; an activity is the larger human purpose and context. Designing only for tasks can optimize fragments while missing the real goal. Human-centered design must understand why the activity matters and how it fits into everyday life.

Real development is messier than the diagram. Norman's practical warning is that linear stage-gate processes, budgets, schedules, stakeholder politics, and late discoveries all constrain design. "Norman's theorem of product development" is that projects tend to be behind schedule and over budget around the time they are supposed to finish. The point is not cynicism; it is that design methods must survive contact with production.

Complexity is not the enemy; confusion is. Some products are necessarily complex because the activities they support are complex. The designer's job is not always to make the system simple, but to make its structure understandable. Standards, conventions, and deliberate difficulty also have roles: standardization can make complex systems learnable, and some systems should be difficult when the action is dangerous or consequential.

Key ideas

• Problem framing is part of design, not a prelude to it.
• Divergence and convergence are needed for both problem discovery and solution development.
• Observation of real behavior often reveals needs that interviews and surveys miss.
• Prototypes are thinking tools because they make assumptions testable.
• Activity-centered design prevents teams from over-optimizing isolated tasks.
• Business constraints shape what can be built, so design process must account for them.
• Complexity can be acceptable when the conceptual model, feedback, and structure are clear.

Key takeaway

Design thinking is an iterative discipline for discovering the right problem, testing possible solutions, and shaping complexity into understandable use.

Chapter 7 — Design in the World of Business

Edition note

This chapter is new in the revised and expanded edition.

Central question

What happens to human-centered design when products must survive competition, technology change, schedules, costs, and ethical consequences?

Main argument

Business pressure pushes against usability. Companies compete on price, features, speed, compatibility, distribution, and visible novelty. These pressures can produce featuritis: the gradual accumulation of capabilities that makes a product harder to understand. A feature that helps a sales comparison may hurt the coherence of the product.

Technology changes faster than human psychology. Norman uses examples such as the long history of the videophone and the QWERTY keyboard to show that invention, adoption, infrastructure, standards, and habit are different timelines. A technology can be technically possible long before it becomes socially and economically workable.

Incremental and radical innovation behave differently. Human-centered design is especially strong for incremental innovation because it improves fit between people, activities, and existing product categories. Radical innovation is rarer, riskier, and often not produced by asking current users what they want. Even when radical ideas succeed, they may need decades of supporting changes before they become ordinary.

Standards are slow but valuable. Standards can frustrate innovators, but they also reduce memory load, training cost, and incompatibility. Once a standard is learned, it becomes knowledge in the head and in the culture. The difficulty is timing: standardize too soon and you freeze a bad solution; standardize too late and users suffer fragmentation.

Design has moral obligations. Norman closes by widening the design frame beyond usability. Needless features, wasteful production, confusing models, and short product cycles can create environmental and social costs. Designers and companies are responsible not only for making products usable, but also for considering the consequences of what they make easier, harder, disposable, or durable.

The rise of the small changes who can design. New tools, platforms, and maker practices let small teams prototype and distribute ideas that once required large companies. This does not eliminate business constraints, but it changes who can participate in design and how quickly ideas can be tested.

Key ideas

• Feature competition can make products more marketable and less usable at the same time.
• New technologies require ecosystems, standards, and social adoption, not just invention.
• Incremental innovation and radical innovation need different design expectations.
• HCD improves known activities better than it predicts entirely new categories.
• Standards can reduce complexity once a field stabilizes.
• Designers have ethical responsibilities for environmental impact, needless complexity, and social consequences.
• Smaller makers and teams can now participate in product development, but they inherit the same human-centered responsibilities.

Key takeaway

Good design must survive the business world without surrendering to it: usability, innovation, standards, and ethics all have to be negotiated together.

The book's overall argument

1. Chapter 1 (The Psychopathology of Everyday Things) — Everyday confusion reveals design failures in discoverability, signification, mapping, feedback, and conceptual modeling.
2. Chapter 2 (The Psychology of Everyday Actions) — Those design failures matter because people act through a seven-stage cycle and must cross gulfs of execution and evaluation.
3. Chapter 3 (Knowledge in the Head and in the World) — Because human memory is limited and contextual, good design distributes knowledge between people, objects, environments, and culture.
4. Chapter 4 (Knowing What to Do: Constraints, Discoverability, and Feedback) — Designers can guide action by using constraints, signifiers, forcing functions, conventions, and feedback.
5. Chapter 5 (Human Error? No, Bad Design) — When action still goes wrong, the design response is not blame but error-tolerant systems, reporting, recovery, and resilience.
6. Chapter 6 (Design Thinking) — Creating such systems requires iterative human-centered design that discovers the real problem before converging on solutions.
7. Chapter 7 (Design in the World of Business) — Human-centered design must then contend with competition, standards, innovation timelines, environmental costs, and moral responsibility.

Common misunderstandings

Misunderstanding: The book is mainly about making objects look intuitive.

Norman's argument is broader than appearance. Visual form matters, but only as part of a system of affordances, signifiers, mapping, constraints, feedback, conceptual models, and cultural conventions.

Misunderstanding: Users should never have to learn anything.

The book does not reject learning. It argues that learning should be supported by visible structure, meaningful mapping, feedback, standards, and progressive internalization rather than by arbitrary memorization.

Misunderstanding: Affordances and signifiers are the same thing.

Affordances are possible actions relative to an actor. Signifiers are perceivable cues that tell people what actions are possible or expected. Designers usually have more direct control over signifiers.

Misunderstanding: Human-centered design means asking users what features they want.

Norman emphasizes observation, activity analysis, prototyping, and testing. Users may not be able to state the root problem or invent the best solution, but their behavior reveals constraints and needs.

Misunderstanding: Error prevention is mainly training and discipline.

Training matters, but the book treats error as a systems issue. Better design reduces memory burden, blocks dangerous actions, supports recovery, and creates reporting cultures that let organizations learn.

Misunderstanding: Business constraints are excuses for bad design.

Norman takes cost, schedules, standards, competition, and product cycles seriously. He does not let them erase design responsibility; he treats them as part of the design problem.

Central paradox / key insight

The book's central paradox is that good design often disappears from attention, while bad design makes itself visible by making users feel at fault. A door that clearly says "push" through its plate, motion, and placement feels ordinary. A door that affords pulling but must be pushed creates a small crisis of interpretation. The better the system image, the less the user has to think about the system at all.

The key insight is that usability is not simplicity alone. Some activities are complex, some standards must be learned, and some actions should be hard. Good design makes the structure of action visible enough that people can form the right goal, choose the right action, understand the result, and recover from error without private humiliation or institutional blame.

Important concepts

Human-centered design

A design philosophy and process that begins with human needs, capabilities, contexts, and limitations, then iterates through observation, ideation, prototyping, testing, and refinement.

Affordance

The possible interaction between an actor and an object or environment. An affordance exists relative to the actor's body, abilities, tools, and context.

Signifier

A perceivable cue that communicates where action should take place or how an object should be interpreted. Labels, plates, handles, lights, sounds, layout, and even absence can function as signifiers.

Mapping

The relationship between controls and their effects. A good mapping makes the relation visible or predictable, reducing the need for memory.

Feedback

Information returned to the user after an action. Feedback should be timely, perceptible, interpretable, and proportional to the importance of the event.

Conceptual model

The user's working explanation of how a thing operates. It does not need to be technically complete; it needs to support accurate prediction and action.

System image

The full set of cues through which a product communicates: physical form, interface, labels, sounds, documentation, behavior, and cultural expectations.

Discoverability

The degree to which a person can determine what actions are possible and how to perform them.

Gulf of execution

The gap between what a person wants to do and the actions the system appears to make available.

Gulf of evaluation

The gap between the system's actual state and the person's ability to perceive, interpret, and evaluate that state.

Seven stages of action

Norman's action cycle: goal, plan, specify, perform, perceive, interpret, and compare. It is a diagnostic model for interaction failures.

Knowledge in the head

Information stored in memory, skill, habit, and cultural learning.

Knowledge in the world

Information made available externally through signs, structure, placement, constraints, reminders, other people, and devices.

Constraints

Limits that guide behavior by reducing possible actions. Norman distinguishes physical, cultural, semantic, and logical constraints.

Forcing function

A design feature that prevents or requires an action in order to avoid error, including interlocks, lock-ins, and lock-outs.

Slip

An error in which the goal or plan is appropriate but the performed action goes wrong.

Mistake

An error in which the goal, interpretation, rule, or plan is wrong.

Root cause analysis

An investigative approach that asks why a failure occurred beyond the immediate human action, often using repeated "why" questions to uncover design and system causes.

Swiss Cheese model

James Reason's safety model in which accidents occur when weaknesses in multiple layers of defense align, letting a hazard pass through the system.

Automation paradox

The problem that reliable automation can reduce human practice and attention, making people less prepared to intervene when automation fails.

Double Diamond

The Design Council's model of divergent and convergent design work: discover and define the problem, then develop and deliver the solution.

Featuritis

The tendency for products to accumulate features in response to competition, comparison, and stakeholder pressure, often at the expense of coherence and usability.

References and Web Links

Primary book and edition information

• Don Norman. The Design of Everyday Things: Revised and Expanded Edition. Basic Books, 2013.
  • Hachette/Basic Books publisher page for the 2013 revised trade paperback
  • Don Norman's official JND.org book page with chapter list and full table of contents
  • Don Norman's preface to the revised edition, describing chapter-by-chapter changes
  • Open Library 2013 revised and expanded edition record with table of contents
  • Google Books record for the revised and expanded edition
  • MIT Press UK/Ireland revised and expanded edition record

Background and overview

• Nielsen Norman Group book page for the revised edition
• Wikipedia overview of The Design of Everyday Things
• Don Norman's JND.org page for the "Norman doors" video

Affordances, signifiers, and interaction concepts

• Don Norman. "Affordances and Design." JND.org.
  • Affordances and Design
• Don Norman. "Signifiers, not affordances." JND.org / ACM Interactions author version.
  • Signifiers, not affordances
• James J. Gibson. The Ecological Approach to Visual Perception. Originally 1979; classic edition.
  • Taylor & Francis book page

Design thinking and safety systems

• Design Council. "The Double Diamond."
  • The Double Diamond
• NASA Aviation Safety Reporting System.
  • ASRS official site
• Toyota Motor Corporation. "Toyota Production System."
  • Toyota Production System virtual plant tour
• Erik Hollnagel, David D. Woods, and Nancy Leveson, eds. Resilience Engineering: Concepts and Precepts. CRC Press, 2006.
  • Routledge book page
• SKYbrary Aviation Safety. "James Reason HF Model."
  • Swiss Cheese model overview

Additional chapter summaries and study resources

These are secondary summaries and should be used alongside, rather than instead of, the original book.

• SuperSummary study guide overview using the 2013 revised edition
• SuperSummary Chapter 5 summary and analysis
• SuperSummary Chapter 6 summary and analysis
• SuperSummary Chapter 7 summary and analysis
• René Capella's Medium/Bootcamp chapter-summary series, Chapter 1 entry
• Readingraphics summary and chapter listing
• Shortform public summary
• Melissa Du's summary and notes