“Safety is a system property, not a component property, and must be controlled at the system level, not the component level.”