The Field Guide › Paper
Leveson's paper introduced STAMP, the Systems-Theoretic Accident Model and Processes, and with it the most thoroughgoing structural reframing of accident causation in modern safety science. Her starting point is that the traditional event-chain model, in which an accident is a sequence of failures running backwards from the outcome to a root cause, no longer fits the systems we actually build. Event chains are inherently subjective (where you stop tracing back is a choice, and usually a convenient one), they handle component failure well but not the accidents that arise from interactions between components that all worked as designed, and they are poor at accommodating software, human adaptation, management decisions and culture, which have no natural place in a chain of broken parts. In their place she proposes to treat safety as a control problem rather than a reliability problem. The central concept is not the event but the constraint: accidents happen when the constraints necessary to keep behaviour safe are inadequately enforced, and the organisation is modelled as a hierarchical control structure in which every level, from the regulator and the board down through management to the operator and the equipment, is issuing control actions and receiving feedback. Accidents follow when that control structure degrades, when feedback loops are missing or ignored, when the mental models held by controllers drift away from the actual state of the process, or when constraints erode under pressure. Safety, on this account, is an emergent property of the whole system, and cannot be established by making each component more reliable. For this map the significance is twofold. Leveson gives a rigorous engineering foundation to the claim that runs through the safety and complexity clusters, that individual error is the wrong unit of analysis; and her insistence on feedback makes psychological safety structurally necessary rather than merely desirable, since a control structure whose upward feedback is suppressed by fear is, in her own terms, a control structure that has already failed. Its limits are that STAMP is demanding to apply, requiring the analyst to model an entire sociotechnical control structure, and that its engineering formalism can sit awkwardly with the messier, interpretive accounts of culture and power found elsewhere in this corpus. (Text drawn from the 2004 Safety Science paper, 42(4), pp. 237-270.)