1. SYSTEMS-THEORETIC ACCIDENT MODEL AND PROCESSES (STAMP) APPLIED TO DESIGN A SAFETY-DRIVEN CONCEPT OF AN AIR NAVIGATION SERVICE PROVIDER (ANSP)

2. A bit of the History of
Accident Prevention in Complex Systems

3. NAT – Normal Accident Theory
HRO – High Reliable Organizations
NAT+HRO - Mixed

4. NAT
Interactive complexity and tight coupling in some technological systems, such as nuclear power plants, leads to unpredictability of interactions and hence system accidents that are inevitable or “normal” [Perrow 1999]

5. HRO
Preoccupation with failure, Reluctance to Simplify interpretations, Sensitivity to operations, Commitment to resilience, and Deference to experience. [Weick, 1999]

6. Does a plane crash mean that NAT is right or does the reduction in plane crashes over time mean that HRO is right? [Leveson 2008]

7. NAT + HRO
Complexity and Tight Coupling +
Redundancy and Descentralized Decisions

8. Both groups assume accidents are caused by component failures
Both groups assume accidents are caused by component failures. This confusion of component reliability with system safety leads to a focus on redundancy as a way to enhance reliability, without considering other ways to enhance safety.
[Leveson, 2008]

9. Common assumptions (myths) about “safety”
That if each person and component in the system operates reliably, there will be no accidents
Increasing protection will increase safety
Human error is the largest single cause of accidents and incidents
System will be safe if people comply with the procedures they have been given
Accident analysis can identify root causes (the ‘truth’) of why the accident happened
Accident investigation is the logical and rational identification of causes based on facts
Retrospective analysis of adverse events is required and perhaps the best way to improve safety

10. Detected procedures in accident investigation

11. Contemporary theories concerning
Accident Prevention in Complex Systems

12. Resilience Engineering (RE)

13. SAFETY II SAFETY I Focus on what goes right: Dedalus (e.g.: RE)
(e.g.: SMS)
Focus on what went wrong: Icarus

14. SAFETY I
SAFETY II

15. ETTO – FRAM
Accident Analysis

17. STAMP
Systems-Theoretic Accident Model And Processes

18. STAMP (Systems-Theoretic Accident Modeling and Processes) is expected to allow managers to more effectively detect hazards within the organization from the early design stage.

19. STAMP

20. STAMP

21. STAMP

22. STAMP

23. STAMP

24. STAMP/CAST
Causal Analysis based on STAMP

25. STAMP/STPA
Systems-Theoretic Process Analysis

26. STPA

27. STPA

28. STPA

29. Example of a
Safety
Control
Structure

30. Example of a
Safety
Control
Structure

31. ANSP

32. ANSP
Safety
Control
Structure

33. ANSP
Safety
Control
Structure
(CBO analysis)

34. ANSP
Safety
Control
Structure
(CBO and TBO analysis)

35. ?

36. Successful cases of using STAMP/STPA
in industry

40. FAA

41. Thank You!!!