Systems-Theoretic Accident Model And Processes Research Articles

Mapping Risk Models/Methods onto a Complexity Spectrum

Abstract The rate at which accidents/incidents occur within the Air Transport System (ATS) has remained consistent over the past two decades (European Commission, 2016). If such a rate is maintained and the ATS grows as expected (AirBus, 2013; Boeing, 2013), then the ATS may no longer be able to be considered ultra-safe. The purpose of this work is to develop a framework by a set of defining system complexity parameters that allow mapping of conceptual safety models and risk analysis methods in relation to their complexity domain analysis range. The study asks: What is the complexity domain range for commonly used models/methods? To answer this question the following models and methods are described and analyzed: Domino model, Swiss Cheese model, Bow-Tie model, Functional Resonance Analysis Method (FRAM), Systems-Theoretic Accident Model and Processes (STAMP). The Cynefin framework uses four domains to represent the system complexity spectrum. In combination with the Cynefin domains, the following system complexity parameters are used for the analysis: Coupling - the ability to represent a loosely coupled system, Linearity- the ability to represent non-linear relationships, and Dynamics - the ability to represent a system through time. The obvious/simple domain of the Cynefin framework requires only that a model/method be able to represent tightly coupled, linear, static systems. While the complicated domain requires that a model/method be able to represent a moderately loose level of coupling, a degree of non-linearities among system actors/elements, and at least a moderate ability to dynamically represent the system. The complex domain requires a model/method to be able to represent a very loosely coupled system, with many non-linear relationships, in a highly dynamic manor. The results of this analysis showed that the FRAM method, Bridge model, and RMF are the most capable when assessing complicated highly interconnected systems (such as the ATS). However, it was also concluded that while when the ATS is operating within a normal range these models/methods may be sufficient, they are not able to effectively inform decision makers when on rare occasions the system shifts into the complicated domain. Therefore, since the ATS represents a common system type (having a large number of actors/elements that are very intertwined, and dependent upon the skills of their operators) a new term is coined – Highly Complicated and Occasionally Complex (HCOC) systems. An HCOC system is one that predominantly follows the same pattern of rules for the majority of its operations, however when occupational novel conditions are encountered which cause the system to shift to the complex domain and thus the underlying analysis methods are no longer sufficient.

Uncertainty treatment in risk analysis of complex systems: The cases of STAMP and FRAM

Several approaches to systems thinking have been proposed to understand and model complex socio-technical systems and potential accidents, including the System-Theoretic Accident Model and Processes (STAMP) with the associated hazard analysis method System Theoretic Process Analysis (STPA), and the Functional Resonance Analysis Method (FRAM). It is argued that these approaches are suitable for the risk analysis of complex socio-technical systems. The purpose of this paper is to look more closely into this thesis, with a special focus on the treatment of uncertainty and potential surprises linked to the operation of such systems. A key finding is that these approaches may, indeed, reduce the potential for surprises by increasing the system and risk understanding but need to be supplemented with other approaches to adequately support the decision-making on risk issues.

Meeting Report

Traditional system safety approaches are being challenged by the introduction of new technology and the increasing complexity of the systems we build and operate. System Theoretic Accident Model and Processes (STAMP) is a new systems thinking approach that w as introduced in Nancy Leveson’s book “Engineering a Safer World” (MIT Press, 2012). While relatively new, the STAMP approach and its respective tools and methods are already being used in many industry sectors such as space, aviation, automotive, software, security medical, defence and nuclear. In more than 150 published articles, the potential of the STAMP family of tools to identify more hazards and causal factors than traditional tools (e.g, FTA, HAZOP, FMEA) has been demonstrated...

Application of systems and control theory-based hazard analysis to radiation oncology.

Both humans and software are notoriously challenging to account for in traditional hazard analysis models. The purpose of this work is to investigate and demonstrate the application of a new, extended accident causality model, called systems theoretic accident model and processes (STAMP), to radiation oncology. Specifically, a hazard analysis technique based on STAMP, system-theoretic process analysis (STPA), is used to perform a hazard analysis. The STPA procedure starts with the definition of high-level accidents for radiation oncology at the medical center and the hazards leading to those accidents. From there, the hierarchical safety control structure of the radiation oncology clinic is modeled, i.e., the controls that are used to prevent accidents and provide effective treatment. Using STPA, unsafe control actions (behaviors) are identified that can lead to the hazards as well as causal scenarios that can lead to the identified unsafe control. This information can be used to eliminate or mitigate potential hazards. The STPA procedure is demonstrated on a new online adaptive cranial radiosurgery procedure that omits the CT simulation step and uses CBCT for localization, planning, and surface imaging system during treatment. The STPA procedure generated a comprehensive set of causal scenarios that are traced back to system hazards and accidents. Ten control loops were created for the new SRS procedure, which covered the areas of hospital and department management, treatment design and delivery, and vendor service. Eighty three unsafe control actions were identified as well as 472 causal scenarios that could lead to those unsafe control actions. STPA provides a method for understanding the role of management decisions and hospital operations on system safety and generating process design requirements to prevent hazards and accidents. The interaction of people, hardware, and software is highlighted. The method of STPA produces results that can be used to improve safety and prevent accidents and warrants further investigation.

A STAMP-based causal analysis of the Korean Sewol ferry accident

The increased complexity of socio-technical systems has revealed the limited contributions of existing event-based accident analysis methods on sustainable safety improvements. Systems-Theoretic Accident Model and Processes (STAMP) – constructed upon Systems Theory – deploys a holistic approach to safety and provides broad insights into accident causality via the integration of the analysis from both direct and indirect factors involved. A dedicated STAMP-based analysis is conducted in this paper by taking the recent Sewol ferry tragedy as an example, to illustrate the utility of applying the STAMP-Model to the maritime transportation domain and to stimulate a broader view of accident mechanisms that expands casual analysis beyond immediate physical failures to a systemic view. Some recommendations are developed for continuous improvements and corrective actions to prevent such catastrophic accident from future occurrences.

Beyond a series of security nets: applying STAMP & STPA to port security

Port security is an increasing concern given the significant role of ports in global commerce and today’s increasingly complex threat environment. Current approaches to port security mirror traditional models of accident causality – ‘a series of security nets’ based on component reliability and probabilistic assumptions. Traditional port security frameworks result in isolated and inconsistent improvement strategies. Recent work in engineered safety combines the ideas of hierarchy, emergence, control and communication into a new paradigm for understanding port security as an emergent complex system property. The ‘System-Theoretic Accident Model and Process (STAMP)’ is a new model of causality based on systems and control theory. The associated analysis process – System Theoretic Process Analysis (STPA) – identifies specific technical or procedural security requirements designed to work in coordination with (and be traceable to) overall port objectives. This process yields port security design specifications that can mitigate (if not eliminate) port security vulnerabilities related to an emphasis on component reliability, lack of coordination between port security stakeholders or economic pressures endemic in the maritime industry. This article aims to demonstrate how STAMP’s broader view of causality and complexity can better address the dynamic and interactive behaviors of social, organizational and technical components of port security.

Integrating Systems Safety into Systems Engineering during Concept Development

AbstractSafety should be designed into systems from their very conception, which can be achieved by integrating powerful hazard analysis techniques into the general systems engineering process. The primary barrier to achieving this objective is the lack of effectiveness of the existing analytical tools during early concept development.This paper introduces a new technique, which is based on a more powerful model of accident causality—called systems‐theoretic accident model and process (STAMP)—that can capture behaviors that are prevalent in these complex, software‐intensive systems. The goals are to (1) develop rigorous, systematic tools for the analysis of future concepts in order to identify potentially hazardous scenarios and undocumented assumptions, and (2) extend these tools to assist stakeholders in the development of concepts using a safety‐driven approach.

A systems approach to risk management through leading safety indicators

The goal of leading indicators for safety is to identify the potential for an accident before it occurs. Past efforts have focused on identifying general leading indicators, such as maintenance backlog, that apply widely in an industry or even across industries. Other recommendations produce more system-specific leading indicators, but start from system hazard analysis and thus are limited by the causes considered by the traditional hazard analysis techniques. Most rely on quantitative metrics, often based on probabilistic risk assessments. This paper describes a new and different approach to identifying system-specific leading indicators and provides guidance in designing a risk management structure to generate, monitor and use the results. The approach is based on the STAMP (System-Theoretic Accident Model and Processes) model of accident causation and tools that have been designed to build on that model. STAMP extends current accident causality to include more complex causes than simply component failures and chains of failure events or deviations from operational expectations. It incorporates basic principles of systems thinking and is based on systems theory rather than traditional reliability theory.

STAMP-Based HRA Considering Causality Within a Sociotechnical System: A Case of Minuteman III Missile Accident.

The study contributes to human reliability analysis (HRA) by proposing a method that focuses more on human error causality within a sociotechnical system, illustrating its rationality and feasibility by using a case of the Minuteman (MM) III missile accident. Due to the complexity and dynamics within a sociotechnical system, previous analyses of accidents involving human and organizational factors clearly demonstrated that the methods using a sequential accident model are inadequate to analyze human error within a sociotechnical system. System-theoretic accident model and processes (STAMP) was used to develop a universal framework of human error causal analysis. To elaborate the causal relationships and demonstrate the dynamics of human error, system dynamics (SD) modeling was conducted based on the framework. A total of 41 contributing factors, categorized into four types of human error, were identified through the STAMP-based analysis. All factors are related to a broad view of sociotechnical systems, and more comprehensive than the causation presented in the accident investigation report issued officially. Recommendations regarding both technical and managerial improvement for a lower risk of the accident are proposed. The interests of an interdisciplinary approach provide complementary support between system safety and human factors. The integrated method based on STAMP and SD model contributes to HRA effectively. The proposed method will be beneficial to HRA, risk assessment, and control of the MM III operating process, as well as other sociotechnical systems.

Effectiveness of accident models: system theoretic model vs. the Swiss Cheese model: a case study of a US Coast Guard aviation mishap

Over the last several years, the US Coast Guard (CG) experienced an unusually high number of major aviation accidents. Following each major accident, the CG conducted mishap analysis board (MAB) – investigations based on the Swiss Cheese accident causality model. However, these investigations were not able to identify common contributing factors that may be causing systemic failures within the CG aviation system. This paper applies the Systems Theoretic Accident Model and Processes (STAMP) model to one of the CGs major aviation mishaps in order to more fully examine the CGs aviation system for potential systemic sources of safety hazards. This analysis identified enhancements to CG aviation system controls that were not expressly identified by MABs. It demonstrates that STAMP is a more effective model than the Swiss Cheese model in determining accident causality.

Systems Engineering for the Design of a Smart Energy Box

AbstractThis paper illustrates that the inclusion of system‐level safety analysis, in this case Systems Theoretic Accident Model and Processes (STAMP)‐based Process Analysis (STPA), in conjunction with systems engineering tools, such as Axiomatic Design, in the conceptual design phase of complex socio‐technical systems is critical to capturing key functional and non‐functional requirements early in the development lifecycle. In particular, capturing safety‐related non‐functional requirements during the conceptual design phase can help avoid operational scenarios that result in conditions hazardous to life and property. In addition, such an approach prevents costly “add‐ons” later in the design and implementation phases of the system life cycle. We illustrate this through the design of a “smart box” that enables large‐scale integration of distributed Renewable Energy Systems (RES) into the electrical power grid to more effectively and efficiently manage overall power demands across the grid. In the conceptual design of this system we arrive at a first set of functional requirements using stakeholder interviews and the Axiomatic Design approach. We then present a detailed discussion of the STPA tool and its application to our “smart box” concept, to arrive at unique safety‐related requirements identified through application of the STPA.

A systemic analysis of patterns of organizational breakdowns in accidents: A case from Helicopter Emergency Medical Service (HEMS) operations

In recent years, many accident models and techniques have shifted their focus from shortfalls in the actions of practitioners to systemic causes in the organization. Accident investigation techniques (e.g., STAMP) have been developed that looked into the flaws of control processes in the organization. Organizational models have looked into general patterns of breakdown related to structural vulnerabilities and gradual degradation of performance. Although some degree of cross-fertilization has been developed between these two trends, safety analysts are left on their own to integrate this gap between control flaws and patterns of organizational breakdown in accident investigation. This article attempts to elaborate the control dynamics of the Systems Theoretic Accident Model and Process (STAMP) technique on the basis of a theoretical model of organizational viability (i.e., the Viable Systems Model). The joint STAMP–VSM framework is applied to an accident from a Helicopter Emergency Medical Service (HEMS) organization to help analysts progress from the analysis of control flaws to the underlying patterns of breakdown. The joint framework may help analysts to rethink the safety organization, model new information loops and constraints, look at the adaptation and steering functions of the organization and finally, develop high leverage interventions.