Systems-Theoretic Accident Model Research Articles

A systems thinking approach to safety in Norwegian avalanche rescue operations

Snow avalanches crossing roads constitute a major safety challenge to both road users and avalanche rescuers in Norway. In this paper, we reassess the current emergency response situation by using systems safety theory. The rescue system is regulated and operated through instructions and guidelines that are based on critical assumptions. We designed the study to challenge critical assumptions in the organized complex rescue system using experiences from operational experts. In two seminars the experts conducted a systemic safety analysis based on the “Systems-Theoretic Accident Model and Processes” (STAMP) approach and the “Systems-Theoretic Process Analysis” (STPA) technique, deriving goals, hazards, requirements, constraints, a safety control structure and unsafe control actions. The gap analysis revealed that both dispatchers and emergency services are commonly not provided with the recommended training and basic avalanche safety equipment. The causal analysis provided common explanations of recurrent unsafe control actions, allowing plausible accident scenarios to be identified. This study supports a recommendation that the safety control structure of the Norwegian avalanche rescue service should be operationalized in accordance with assumptions and requirements. Contrary to critics, the STAMP/STPA systemic safety analysis proved manageable and productive, as it unceasingly directed the analyst’s attention towards organizational challenges at the blunt end.

‘Over to you’: using a STAMP control structure analysis to probe deeper into the control of UK road safety at a municipal level – the case of Cambridgeshire

The UK has seen little progress in reducing road death over the last decade and as a result, the government has been criticised by industry stakeholders for a lack of leadership, including the removal of national targets in 2011 and the devolution of powers to a municipal level. The aim of this paper is to understand how decision-making at a municipal level takes place from a systems perspective, using the case study of Cambridgeshire. Actors involved were mapped using a STAMP control structure analysis and highlighted a key role for formal and informal partnerships between local and national government agencies and non-government organisations at the same level in the control structure. The changing international context of the model for the UK is also discussed in relation to the UK’s withdrawal from the European Union and provides a useful tool for future analysis of its effect on policy and decision-making. Practitioner summary: This paper uses a STAMP control structure analysis to understand how decision-making at a municipal level takes place from a systems perspective, using the case study of Cambridgeshire. It highlights a key role for formal and informal partnerships between organisations at the same level in the control structure. Abbreviations: STAMP: System Theoretic Accident Model and Processes; STAMP-CAST: Systems-Theoretic Accident Model and Processes – Causal Analysis using Systems Theory; FRAM: Functional Resonance Analysis Method; HFACS: Human Factors Analysis and Classification Scheme; NGO: Non-Government organisation; iRAP: International Road Assessment Programme; EuroRAP: European Road Assessment Programme; NCAP: New Car Assessment Programme; CCG: Clinical Commissioning Group; GP: General Practitioner; PPE: Personal Protective Equipment; SD: standard deviation; Beds: Bedfordshire; Cambs: Cambridgeshire; Herts: Hertfordshire; Pboro: Peterborough.

Prospective risk assessments of patient safety events related to drug shortages in hospitals: Three actor-level perspectives

Background: The increasing number of drug shortages (DSs) worldwide calls for more proactive solutions to prevent the negative impacts of DSs on patient care. Such solutions require in-depth knowledge about potential patient safety risks related to DSs, the processes of recognizing and managing DSs, the contextual setting in which DSs occur, and the actors involved.Objective: The aim of the study is to use prospective risk assessment to identify patient safety risks in hospitals associated with the management of DSs among actors at national, regional and local level in Denmark.Methods: Healthcare Failure Mode and Effect Analysis (HFMEA) was employed in composition with elements from the Systematic Human Error Reduction and Prediction Approach (SHERPA) and the Systems-Theoretic Accident Model and Processes (STAMP). Potential risks related to DS management across three actor levels (national, regional and local) in the Danish healthcare system were described. Each actor level consisted of six participants that were identified using a purposive sampling strategy. Processes and sub-processes related to managing critical DSs were outlined and the actors identified, prioritized and rated potential failure modes, causes and consequences related to the processes. Recommendations to mitigate failures were proposed for high risk failures modes.Results: Overall, a total of 167 failure modes were identified across the three actor levels. At the national level, the process of DS management consisted of 17 sub-processes, from which 71 failure modes were identified. Nine of them were rated as high risk. At regional level, 7 sub-processes and 33 failure modes were identified, of which 9 were rated as high risk. At local level, 14 sub-processes and 63 failure modes were identified, of which 32 were rated as high risk. The high-risk failures were related to a lack of IT support in the medication modules, underestimation of patient safety aspects, and insufficient personnel training and patient information.Conclusion: Exploring DS management failure modes across actor levels provided an overview of interrelated failures. Potential solutions related to high risk failures were developed to ensure that actors ensure patient safety related to DS in healthcare.

Passenger rail station safety improvement and analysis of end-of-track collisions based on systems-theoretic accident modeling and processes (STAMP)

Purpose At the US passenger stations, train operations approaching terminating tracks rely on the engineer’s compliant behavior to safely stop before the end of the tracks. Noncompliance actions from the disengaged or inattentive engineers would result in hazards to train passengers, train crewmembers and bystanders at passenger stations. Over the past decade, a series of end-of-track collisions occurred at passenger stations with substantial property damage and casualties. This study’s developed systemic model and discussions present policymakers, railway practitioners and academic researchers with a flexible approach for qualitatively assessing railroad safety. Design/methodology/approach To achieve a system-based, micro-level analysis of end-of-track accidents and eventually promote the safety level of passenger stations, the systems-theoretic accident modeling and processes (STAMP), as a practical systematic accident model widely used in the complex systems, is developed in view of environmental factors, human errors, organizational factors and mechanical failures in this complex socio-technical system. Findings The developed STAMP accident model and analytical results qualitatively provide an explicit understanding of the system hazards, constraints and hierarchical control structure of train operations on terminating tracks in the US passenger stations. Furthermore, the safety recommendations and practical options related to obstructive sleep apnea screening, positive train control-based collision avoidance mechanisms, robust system safety program plans and bumping posts are proposed and evaluated using the STAMP approach. Originality/value The findings from STAMP-based analysis can serve as valid references for policymakers, government accident investigators, railway practitioners and academic researchers. Ultimately, they can contribute to establishing effective emergent measures for train operations at passenger stations and promote the level of safety necessary to protect the public. The STAMP approach could be adapted to analyze various other rail safety systems that aim to ultimately improve the safety level of railroad systems.

A systems-theoretic approach for two-stage emergency risk analysis

Coronavirus disease (COVID-19) is an infectious disease that has dramatically spread worldwide. Regarding the safety issues of industries, there is a requirement of dealing with the emergency risk in the period of urgent situations. In this work, we proposed a systems-theoretic approach of the two-stage emergency risk analysis (ERA) based on the systems theory, that is the System-Theoretic Accident Model and Processes (STAMP). The two-stage ERA includes the normal to emergency risk analysis (N2E-RA) and emergency to normal risk analysis (E2N-RA). Besides N2E-RA, we advocate that E2N-RA is also an important and indispensable part of ERA. We elaborated the characteristics of N2E-RA and E2N-RA, separately. Eventually, based on our analysis, we provided recommendations for decision makers in preventing and controlling industrial accidents in the period of COVID-19.

Safety assessment of the film boiling chemical vapor infiltration (FB-CVI) process through a system-theoretic accident model and process (STAMP)

Film boiling chemical vapor infiltration (FB-CVI) is considered as one of the fastest process methodologies for manufacturing carbon-carbon (C–C) composite products and possesses various advantages compared to conventional methodologies. However, there are safety concerns associated with this process for large-scale manufacturing, mainly owing to the intrinsic nature of the precursor and the process conditions. Considering the multifunctional interactions of the various systems during the process, a system-theoretic process analysis (STPA)/system theoretic accident model and process (STAMP) model is used to perform a safety analysis of the hazardous states of the FB-CVI process at the system level. As a case study, the FB-CVI process equipment employed for the manufacturing of C–C composites is considered. The safety constraints present in the system are assessed for adequacy through a hazard analysis by STPA/STAMP. The analysis through STPA/STAMP demonstrated the capability to create proactive strategies for the design and realization of process equipment that can be employed to manufacture C–C composite products through the FB-CVI process.

STAMP-Based Analysis on the Safety Management System of Bus Operators


 
 
 Road accidents involving commercial vehicles are showing an alarming trend from year to year. Ironically the accidents involving heavy vehicles would involve the third party such as cars, motorcycles and other vehicles; due to several factors such as fatigue, speeding, tire defect, road defect, road design issue and risky driving. When occurred, it normally involved higher number of fatalities. Therefore, in order to improve the situation with regards to road accidents involving heavy vehicles, especially buses, a holistic road safety strategy is necessary and vital towards better road safety in the future. This paper aims to understand Safety Management System of bus operators using Systems-Theoretic Accident Model and Processes (STAMP) by analysing three case studies namely Genting, Tapah and Pagoh bus crashes in 2013, 2015 and 2016, respectively. Hazard analysis and causal factors were carried out on the bus operators' Safety Management System by using STPA (Systems- Theoretic Process Analysis) and CAST (Causal Analysis based on STAMP). The results of the analyses showed that the operating process could be revised or redesigned to improve the existing safety system. Moreover, STAMP could be a very useful approach to understand the whole safety system that may involve several complex factors.
 
 

Implications of STAMP for Warhead Safety at AWE

STAMP (System-Theoretic Accident Model and Processes) is a relatively new approach to safety assessment methodology and post-accident cause analysis; its prime developer is Nancy Leveson of MIT. STAMP is a holistic system-level approach to overall organizational structure and to technical operations and design. It takes a comprehensive look at all possible organizational and technical system influences that can ultimately affect the safety of technical processes and product designs in whatever scenarios or environments in which they operate or to which they are subjected. Of course, the process can be applied equally to both reliability of performance and security, in addition to safety.

Resolving the differences between system development and system operation using STAMP: a road safety case study in a low-income setting

Road safety strategies adopted worldwide have made significant progress in reducing road trauma, but have stagnated more recently. The situation in low- and middle-income countries is even worse with no significant decrease in fatality rates. Safety researchers have argued that adopting sociotechnical systems approach is necessary to make significant advancements and improvements. The aim of this study was to develop a control structure model of the Bangladesh road safety system by identifying the actors and organisations involved across the system. Expert stakeholders were identified and interviewed, and relevant information was gathered in order to generate the Systems Theoretic Accident Model and Process control structure model. Throughout the analysis of this model, differences in the control and feedback mechanisms of the system were identified, and road safety intervention recommendations were made. Future research should also predict potential risks within the system and propose proactive and preventative countermeasures. Practitioner summary: In this article, a Systems Theoretic Accident Model and Process control structure model of the Bangladesh road safety system is developed, and the involved actors are identified. Based on interviews and workshops with expert stakeholders, differences in the controls and feedback mechanisms in the system were identified, and road safety intervention recommendations were made. Abbreviations: BUET: Bangladesh University of Engineering and Technology

Surveying work-as-done in post-operative delirium risk factors collection and diagnosis monitoring

Post-operative delirium (POD) is a health hazard condition for the patients and it is associated with increased costs for the healthcare system. Following a system-theoretic approach, firstly a model, then a questionnaire, have been designed to probe the collective awareness about POD throughout the entire patient's perioperative pathway. The 58 reported answers pointed out that most of the information, specifically associated with POD, are routinely recorded but not used to stratify the patients' individual risk to develop POD. The results suggest the need for design a new socio-technical role within modern health care systems: the POD analyst. A Systems-Theoretic Accident Model and Processes (STAMP) model is proposed both to propel the awareness about POD and as a template for future POD risk factors collections.

Safety Analysis and Simulation Validation of Hose Whipping Phenomenon in Air Refueling

This paper aims to identify the main cause of the hose whipping phenomenon (HWP) in air refueling, and come up with effective preventive measures. The system-theoretic accident model and process (STAMP), i.e., the system-theoretic process analysis (STPA), was adopted to evaluate the safety of air refueling. Then, the evaluation results were verified with a self-designed simulation validation model. The results show that the HWP is controlled by the docking speed, reel mechanism, and designed hose length; the swing range and tension change of the hose increased under inappropriate speed control; reel control could end the hazardous state of the hose within 50s after docking; the HWP occurred after the hose length was shortened from 22m to 14m. The research findings provide a reference for the prevention of the HWP.

The phased application of STAMP, FRAM and RAG as a strategy to improve complex sociotechnical system safety

Systemic approaches and methods have been developed to adequately deal with the challenge of managing complex sociotechnical system safety (Yousefi et al., 2019). This work analyses a well-documented and significant accident from a systemic perspective. Former uses of the System-Theoretic Accident Model and Process (STAMP) and the Functional Resonance Analysis Method (FRAM) are compared with an analysis performed employing the Resilience Assessment Grid (RAG). The results point that these three approaches may be used together in a phased manner throughout the life cycle of complex sociotechnical systems, in order to maximize the potentials of each one in addressing technical and management aspects.

Learning from non-failure of Onagawa nuclear power station: an accident investigation over its life cycle

This article investigates the successful survival of the Onagawa nuclear power station during and after the 2011 Tohoku earthquake and tsunami. As a research method, a system approach investigation and analysis— CAST (Causal Analysis based on Systems Theoretic Accident Model and Processes)—is applied over the life cycle of Onagawa. The main aim of this study is to identify how seismic and tsunami disaster risk reduction was implemented in different stages of the Onagawa nuclear power station’s life cycle. It is found that three safety cultures were built and developed over its life cycle: a nuclear safety culture, an earthquake safety culture, and a tsunami safety culture. These three safety cultures played important roles in the non-failure and success of Onagawa in 2011. Furthermore, the operator of Onagawa, Tohoku EPCo has a dynamic approach and a strong leadership towards earthquake and tsunami risk mitigation in all life cycle stages; flexibility and voluntary safety actions have been in place at Tohoku EPCo and Onagawa . Nevertheless, the 2011 events strongly influenced the decision to decommission the Onagawa Unit 1 early, brought to attention the length of the decommissioning process (which will surpass the operation stage), the high costs involved, and tremendous challenges linked to the permanent storage of radioactive waste. The successful survival of the Onagawa emphasizes that in order to achieve energy security through the nuclear energy in Japan and elsewhere in the world, safety always needs to come first. Furthermore, it supports dynamic learning not only for the nuclear industry, but also for the oil and gas and maritime industries; particularly, those situated in earthquake and tsunami risk areas.

STAMPing out MRI Simulation Hazards with a System-Theoretic Accident Model and Processes Approach to Proactive Hazard Assessment

Current approaches to MRI safety include 1) implementation of local policies that comply with national guidelines, and 2) utilization of failure mode and effects analysis to proactively identify hazards. Both approaches focus on the frontline clinical workflow, which is important for daily practice, but neglect the wider system. System-Theoretic Accident Model and Processes (STAMP) is a systems theory-based paradigm that has been successfully applied to other industries to study the safety of complex systems. We explored if STAMP-based techniques can be applied to the system of MRI simulator use in radiation oncology to develop a generalizable system model for use in a proactive hazard assessment. We hypothesized that taking this approach would proactively identify safety hazards beyond the frontline. The system surrounding a 3-Tesla MRI simulator was considered prior to clinical implementation of this technology in radiation oncology at a single institution in the United States. Utilizing a STAMP-based tool, System-Theoretic Process Analysis (STPA), the system was modeled at multiple levels of abstraction. Interactions between system components were modeled as control loops. The analysis was conducted by a multidisciplinary team with expertise in systems engineering, medical physics, MR physics, and clinical radiation oncology. A high-level system model in the form of a safety control structure (SCS) to enable MRI simulation was developed. Areas of inadequate control and feedback were identified at multiple levels (Table 1), including those beyond the frontline. 317 unsafe control actions (UCAs) were identified. The development of a SCS revealed areas of inadequate feedback and enabled the identification of over 300 UCAs, highlighting the complexity of the sociotechnical system surrounding MRI simulation. The majority of UCAs surrounded RT simulation and planning, aspects of the system with greater complexity. By identifying UCAs prior to clinical implementation, this analysis enabled a proactive approach to MRI safety. By utilizing abstraction, the model can be applied to other centers. Future work is needed to mitigate circumstances leading to UCAs.Abstract 2459; TableIdentified control actions and unsafe control actionsControllerControl actionsUnsafe control actionsDevice manufacturers5 (e.g., “Install MRI”, “Refill helium”)24Executive, Management15 (e.g., “Approve hiring”, “Approve access”)94Radiotherapy (RT) simulation, planning37 (e.g., “Immobilize”, “Apply RF coil”)199 Open table in a new tab

A Delphi study of human factors methods for the evaluation of adaptation in safety-related organisations

Advances in safety science point towards an approach to the management of safety-related risks within complex sociotechnical systems that focuses on the understanding of adaptation. The study of adaptation would benefit from the use of structured and formalised approaches at, and across, all levels of the organisational hierarchy (individual, team and organisation). However, with a large number of potential Human Factors methods available to the safety practitioner, it is unclear which methods are most appropriate for an exploration of this important tenet of systems thinking. A 3-round ranking Delphi study has been conducted to survey the range of methods to determine a soft consensus amongst subject matter experts. In each of the three rounds the list was successively refined. Cognitive Work Analysis (CWA) and Critical Decision Method (CDM) were recommended for the micro level (which could be complemented by HTA). At the meso level, CDM and CWA together with complementary methods, such as Systems Theoretic Accident Modelling and Processes (STAMP), Functional Resonance Analysis Method (FRAM) and the Event Analysis for Systemic Teamwork (EAST) method. STAMP and FRAM were recommended at the macro level, which could be complemented with Hierarchical Task Analysis (HTA), Ethnographic Analysis, EAST and the Human Factors Analysis and Classification System (HFACS). The methods, taken together, should provide a means of exploring adaptation at all of the sociotechnical system levels. This work provides safety practitioners with consolidated guidance on the methods that could be used to explore adaptation as a source of safety in complex sociotechnical systems.

Out of control? Using STAMP to model the control and feedback mechanisms surrounding identity crime in darknet marketplaces

Darknet marketplaces have emerged as a facilitator of identity crime and trading. This study aimed to (1) understand the entities and control and feedback mechanisms that influence identity crime prevention and occurrence on the darknet in the Australian system and to (2) comprehensively identify the implications of control failures across all system levels. The Systems-Theoretic Accident Model and Processes (STAMP) was used to develop an identity crime control structure in consultation with subject matter experts and then the Systems-Theoretic Process Analysis (STPA) was applied. The STPA identified 310 risk states, resulting from control failures and which were associated with the range of agencies, organisations, and individuals present across system levels. As darknet marketplaces rapidly evolve, alignment between these entities is necessary to enable agile system responses. STAMP and STPA have promise in understanding the potential for intervention across all system levels in preventing societal issues such as identity crime.

Organizational and institutional factors affecting high-speed rail safety in Japan

The Japanese High-Speed Railway (HSR), is renowned for its impeccable safety record of zero passenger fatalities. However, a limited academic discussion has taken place on the organizational and institutional factors affecting HSR safety in Japan, as opposed to technological solutions. A recent series of HSR accidents in Japan have also warranted attention on organizational and institutional factors affecting HSR safety. The objective of the present study is to utilize systems approach to highlight the current organizational and institutional safety issues within Japanese HSR, and to provide a discussion on improving current practices. First, the study develops a taxonomy of accident causes in Japanese HSR, using previously unanalyzed official accident reports available only in Japanese. The taxonomy analysis reveals common accident causal factors, including the failure to sense degradation in procedures, and the failure to establish knowledge-based on thorough risk assessments. The paper then presents an in-depth analysis of the only “Serious Accident” in Japanese HSR. Information on the serious accident obtained through official accident reports and expert interviews is combined using a System-Theoretic Accident Model and Process (STAMP) analysis, which reveal a new accident archetype at the organizational and institutional level. The archetype demonstrates the common failure causes for the operator and the regulator, thereby making their apparent redundancy ineffective. The archetype is helpful in identifying theoretical improvements in current safety practices. The study also concludes that the adoption of a systematic risk-assessment approach is necessary to enable proactive safety management in complex ultra-safe systems like the Japanese HSR.

Safety analysis on typical scenarios of GTCS based on STAMP and STPA

As the rapid development of the urbanization, solutions to solving the traffic congestion have become a hotspot. In this case, the Guided Transportation System (GTS) has been developed, which has the potential to release the traffic jam due to the advantages of short construction period and low cost. Safety analysis on the new transportation tool is essential to keep its operation and passengers safe. Based on the STAMP (Systems-theoretic Accident Modeling and Processes) model and the STPA method (System-theory Process Analysis), this paper constructs a safety analysis framework for the typical operating scenarios of the Guided Transportation Control System (GTCS). Aimed at typical scenarios of vehicle tracking, the corresponding hierarchical control structure models are established. Then, the hazard causes are analyzed. And corresponding safety constraints are put forward to handle the hazard causes, which can provide supports for improving the system design of the GTCS.

HUMAN FACTOR AND AUTOMATION: A STPA APPROACH TO ENHANCE SHIP SAFETY

Ships complexity is continuously increasing and lots of action controls, traditionally carried out by crew members, are now managed and executed by the on-board automation systems. The relation among humans and automation system shall be studied with specific attention to their mutual interface and interaction issues, in order to better pursue safety. The STAMP (System-Theoretic Accident Model and Processes)-based tool named STPA (System Theoretic Process Analysis) consists the following steps: identify system hazards; draw functional control structure; identify unsafe control actions (UCAs); identify accident scenarios; formulate decisions and recommendations. In this paper an approach to model the relations among human operator and automation, based on STPA, will be proposed. An application case will be developed considering a large passenger ship and the specific hazard of dead ship condition (energy black-out). In case of navigation close to the shore and heavy weather condition, this situation can rapidly evolve into a ship loss.

Study on Safety Analysis Method to Task Process of Civil Aircraft Weather Radar System

To solve the task-process-safety problem of airborne weather radar system, a set of case-inspired safety analysis method is proposed based on the STAMP(Systems-Theoretic Accident Model and Process). Taking weather radar system's task process in approaching stage as an example, a hierarchical control structure is constructed to identify unsafe control actions during the task process, and analyze the potential hazard causes associating with unsafe control actions. Then a safe flight control structure model is constructed and the accident case of Delta Airlines is analyzed to optimize the model. The safety of system task process is improved through putting forward the safe constraints which can control the propagation mechanism of accident. It is indicated through the above analysis that the method can comprehensively identify the potential hazard causes of system, and provide technical support for the safety design of airborne weather radar system.