<Please insert name>
<Please insert name of university>
Abstract
System theory forms the basis for the Systems-Theoretic Accident Model and Processes (STAMP) (Leveson 2011), and other Accident Causation Models, such as the Accident Causation Management System discussed in Kwon et al. 2006, and the Construction Accident Causation Model discussed in Mitropoulos et al. 2005. These models are compared and contrasted especially with respect to how human behavior is accounted for in each. In addition, a case study is discussed using the STAMP method to demonstrate the basic principles of STAMP. Due to a recent accident and much discussion in the press, this case study is centered around accidents at zoos which have resulted in the death or injury of children and/or the zoo animals, or both. Three accidents are presented, and the STAMP method applied to these scenarios. Specifically, the STAMP method is used to evaluate zoo enclosure designs to determine how these accidents might be prevented in the future.
STAMP vs. Other Accident Causation Models
System theory forms the basis for Systems-Theoretic Accident Model and Processes (STAMP) (Leveson 2011), and other Accident Causation Models, such as the Accident Causation Management System discussed in Kwon et al. 2006, and the Construction Accident Causation Model discussed in Mitropoulos et al. 2005. All three of these models evaluate the system as a whole to identify the potential causes of accidents and to take steps to prevent them. Each model tries to “control the controllable,” where possible, including human behavior (Leveson 2011, Kwon et al. 2006, Mitropoulos et al. 2005). However, each model differs in important ways as discussed below, especially in how human behavior is accounted for.
In the Accident Causation Management System (Kwon et al. 2006), detailed data on the actual human behavior of the human controllers involved in the system were collected, and their behaviors were categorized in terms of their potential risk of making a human error with the system in general. In STAMP, the potential for human error is also accounted for, but in a very different way. Under the Accident Causation Management System, the detailed data on human behavior is collected, but only evaluated to determine the impact of human behavior on the system process, in general. The effect of human behavior at each step in the system process is not evaluated, and therefore, not corrected. In the end, managers are simply given the results of the human behavior analysis of his/her human controllers and “advised to rectify any weaknesses” (Kwon et al. 2006). Therefore, the data that are collected are used too broadly, and system safety constraints and control structures are not necessarily put in place to address the impact of human error on each step in the process. This method of addressing human error also tends to focus an accident analysis on “assigning blame” as opposed to determining whether the system is under adequate control.
In STAMP, worst-case human behavior is assumed, and at each step in the system process, in order to adjust the design and/or apply a system safety constraint, and apply appropriate hierarchical control structures, to address each hazard in the process. In this way, human error is actually managed, rather than simply elucidated. In STAMP, the focus of the investigation is not to engage in a “blame game,” but rather to determine how to better control the system.
Detailed human behavior scenarios are also developed in the Construction Accident Causation Model (Mitropoulos et al. 2005), but based upon “normal” human behavior, rather than actual data from the human controllers. In general, in this model, the effects of human behavior on the system is evaluated more thoroughly than the Accident Causation Management System, but still not as thoroughly as in STAMP. In this model, the effect of different human behaviors is still not evaluated at each step in the system process, and “work system factors and their interactions are ignored” in this model (Mitropoulos et al. 2005). As a result, this model still does not identify the complete effect of human error on the system in an integral way. Therefore, this model falls short of being able to fully manage for human behavior in a system.
STAMP addresses the interface of humans with the system more completely and holistically, by evaluating the effect of human behavior at each step in the system process, and considering human behavior along with work system factors and their interactions. A case study for how STAMP can account for human behavior is discussed in more detail below.
The most recent accident involved a 3-year old boy who managed to get into a gorilla enclosure (Dodley et al. 2016). In this instance, the boy was not killed or injured seriously, but the gorilla was killed. Only 4 years earlier, in 2012, a 2-year old boy was killed after falling into an enclosure for African painted dogs (Muller and Newcomb 2012). In 1987, an 11-year old boy was killed after entering a polar bear enclosure (Barron 1987).
In all three instances (and there are likely other instances), human behavior was not adequately accounted for when designing the zoo enclosure, nor behavior of the animals for that matter. Had human behavior of humans at all ages been factored into the design, the enclosures may have been designed to eliminate the ability of humans to enter the enclosures. In all three instances, each boy was able to go over, under, or around the enclosure either unaided, or aided with another human. In this instance, the physical ability of not just one human should have been considered, but the scenario where one human would aid another should be factored in as well. This is a difficult scenario to imagine, however, if one were to consider the age of the humans involved, it is not out of the realm of possibilities.
Additional system safety constraints could be applied to address the hazard of falling into an enclosure as well. For example, additional constraints could be added to prevent any potential contact between the humans and animals, such as a solid plexiglass wall between the viewing area and enclosure. How many zoo exhibits do we still see without this constraint?
Finally, better hierarchical controls could be used to further reduce the risk of this type of accident from reoccurring. Warning signs should be posted prominently in front of each exhibit, similar to hazard placards in the workplace, to warn patrons of the risk. A “safety talk” or safety introduction by zoo staff to all patrons when they enter the zoo, or at each exhibit, may also help reduce this type of accident. This level of control is similar to safety precautions taken at amusement parks with rides, where there are a large number of attendants at each ride, safety warnings posted prominently everywhere, and safety announcements continually being announced over a PA system at each ride.
Because each animal (i.e., system component) has different physical abilities, each animal enclosure should be evaluated separately while considering each of these factors using the STAMP method. A hazard analysis using STPA (System-Theoretic Process Analysis) is recommended in the system-guided design process for each animal enclosure, along with other factors that are considered in the design to maximize animal health and education and outreach to the public.
Finally, interactions between each enclosure, and how human behavior might affect those interactions, are recommended. In the event that access to all individual enclosures cannot be controlled completely, then the potential for humans to enter one enclosure to access another, should also be considered. For example, can humans enter an enclosure of a docile animal, to then access another enclosure that is more dangerous from there? Again, it is difficult to understand how any human would want to do this, but with young adults or teenagers, anything is possible.
References
Barron, J. (1987, May 20). Polar bears kill a child at Prospect Park Zoo. The New York Times. Retrieved from http://www.nytimes.com/1987/05/20/nyregion/polar-bears-kill-a-child-at-prospect-park-zoo.html.
Dodley, D., S. Jorgensen, and S. Visser. (2016, June 2). Cincinnati gorilla incident: police investigating boy’s family. CNN. Retrieved from http://www.cnn.com/2016/05/31/us/gorilla-shot-harambe/index.html.
Kwon, H., H. Yoon, and I. Moon. (2006). Industrial applications of Accident Causation Management System. Chem. Eng. Comm., 193: 1024-1037.
Leveson, N.G. (2011). Engineering a safer world: systems thinking applied to safety. Massachusetts Institute of Technology. The MIT Press, Cambridge, Massachusetts and London, England.
Mitropoulos, P., T.S. Abdelhamid, and G.A. Howell. (2005). Systems model of construction accident causation. Journal of Construction Engineering and Management, 131(7): 816-825.
Muller, J. and A. Newcomb. (2012, November 5). Boy, 2, dead after mauling at Pittsburg Zoo. ABC News. Retrieved from http://abcnews.go.com/US/boy-dead-mauling-pittsburgh-zoo/story?id=17639547.
