Compendium of Nancy Leveson: STAMP, STPA, CAST and Systems Thinking

Although I don’t often mention or post about Leveson’s work, she’s probably been the most influential thinker on my approach after Barry Turner.

So here is a mini-compendium covering some of Leveson’s work.

Feel free to shout a coffee if you’d like to support the growth of my site:

https://buymeacoffee.com/benhutchinson

https://direct.mit.edu/books/oa-monograph/2908/Engineering-a-Safer-WorldSystems-Thinking-Applied

https://dspace.mit.edu/bitstream/handle/1721.1/102747/esd-wp-2003-01.19.pdf?sequence=1&isAllowed=y

https://dspace.mit.edu/bitstream/handle/1721.1/108102/Leveson_Applying%20systems.pdf?sequence=2&isAllowed=y

https://escholarship.org/content/qt5dr206s3/qt5dr206s3_noSplash_4453efa62859a16d187fa5e66d414ac2.pdf

https://escholarship.org/content/qt8dg859ns/qt8dg859ns_noSplash_e67040b78c1ff72e51b682bb23d8628a.pdf

https://doi.org/10.1177/0170840608101478

https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=b2107d4823fa8b3eb83ecc8db006e8aecfe2994a

https://doi.org/10.1145/7474.7528

http://therm.ward.bay.wiki.org/assets/pages/documents-archived/safety-3.pdf

https://books.google.com/books?hl=en&lr=&id=2qwmAQAAIAAJ&oi=fnd&pg=PA177&dq=nancy+leveson&ots=uwtXVFUky7&sig=6P-5cOxcra9-3pcFBLYgYPeq5KQ

https://dspace.mit.edu/bitstream/handle/1721.1/108601/Leveson_A%20systems%20approach.pdf

https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=57bd4861d6819bdd6543e3a8ca841aa0b98bbe5a

http://sunnyday.mit.edu/papers/Rasmussen-Legacy.pdf

https://www.tandfonline.com/doi/pdf/10.1080/00140139.2015.1015623

https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=08434b0b1eba947fb7251be7daba9c50eab2e8d2

http://sunnyday.mit.edu/papers/issc03-stpa.doc

https://dspace.mit.edu/bitstream/handle/1721.1/92371/Leveson-Stephanopoulos%20final%20copy.pdf?sequence=1

https://dspace.mit.edu/bitstream/handle/1721.1/92371/Leveson-Stephanopoulos%20final%20copy.pdf?sequence=1&isAllowed=y

https://doi.org/10.1016/j.ssci.2018.07.028

http://sunnyday.mit.edu/shell-moerdijk-cast.pdf

http://sunnyday.mit.edu/CAST-Handbook.pdf

https://psas.scripts.mit.edu/home/get_file.php?name=STPA_Handbook.pdf

https://psas.scripts.mit.edu/home/wp-content/uploads/2020/07/JThomas-STPA-Introduction.pdf

https://cris.vtt.fi/ws/portalfiles/portal/98296189/Complete_with_DocuSign_2024-1-2_STPA_guide_F.pdf

https://dspace.mit.edu/bitstream/handle/1721.1/79639/Leveson_Modeling%20and%20hazard.pdf?sequence=2&isAllowed=y

https://dspace.mit.edu/bitstream/handle/1721.1/116713/INCOSE2017_Yisug%20Kwon_no%20UTC%20info.pdf?sequence=1

http://sunnyday.mit.edu/UPS-CAST-Final.pdf

https://doi.org/10.1016/j.trip.2023.100912

https://dspace.mit.edu/bitstream/handle/1721.1/107502/974705860-MIT.pdf?sequence=1

https://www.researchgate.net/profile/Nektarios-Karanikas/publication/356085051_The_past_and_present_of_System-Theoretic_Accident_Model_And_Processes_STAMP_and_its_associated_techniques_A_scoping_review/links/6191925ad7d1af224bef6b04/The-past-and-present-of-System-Theoretic-Accident-Model-And-Processes-STAMP-and-its-associated-techniques-A-scoping-review.pdf

https://proceedings.systemdynamics.org/2007/proceed/papers/DULAC552.pdf

http://sunnyday.mit.edu/nasa-class/jsr-final.pdf

https://dl.acm.org/doi/pdf/10.1145/2556938

https://www.tandfonline.com/doi/pdf/10.1080/00140139.2015.1015623

https://dspace.mit.edu/bitstream/handle/1721.1/102833/esd-wp-2011-13.pdf?sequence=1&isAllowed=y

https://dspace.mit.edu/bitstream/handle/1721.1/79639/Leveson_Modeling%20and%20hazard.pdf?sequence=2&isAllowed=y

https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=3a04c89efd23efda86f134e0e2f0683394a181c6

https://www.sciencedirect.com/science/article/pii/S1877705815038588/pdf?md5=78fccb436abe513b814fb520d01e209e&pid=1-s2.0-S1877705815038588-main.pdf

https://academic.oup.com/jamia/article-abstract/15/3/272/727503?redirectedFrom=PDF

https://dspace.mit.edu/bitstream/handle/1721.1/115366/16-1-18%20J%20Pt%20Safety%20Leveson%20%26%20Raman%20CAST_Checklist_JPtSafety2016%20%281%29.pdf?sequence=1&isAllowed=y

https://dspace.mit.edu/bitstream/handle/1721.1/106665/Leveson_Application%20of%20systems.pdf?sequence=1&isAllowed=y

https://www.academia.edu/29657886/The_systems_approach_to_medicine_controversy_and_misconceptions

https://dl.acm.org/doi/pdf/10.1145/3376127

https://www.sciencedirect.com/science/article/pii/S0022522316000702

http://sunnyday.mit.edu/caib/issc-bl-2.pdf

http://sunnyday.mit.edu/papers/ARP4761-Comparison-Report-final-1.pdf

https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=8102762

https://www.tandfonline.com/doi/pdf/10.1080/00140139.2015.1011241

https://onlinelibrary.wiley.com/doi/pdf/10.1260/2040-2295.3.3.391

https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=d39a0850269262753d27f659243de73eb8bc8e13

https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=7e822452213a80be9bc7a5a7f5c13032c6fdd60f

https://library.oapen.org/bitstream/handle/20.500.12657/41716/978-3-030-47229-0.pdf?sequence=1#page=25

https://maritimesafetyinnovationlab.org/wp-content/uploads/2024/10/White-Paper-on-Approaches-to-Safety-Engineering-Leveson-2003.pdf

https://www.researchgate.net/publication/221526167_Using_System_Dynamics_for_Safety_and_Risk_Management_in_Complex_Engineering_Systems

http://sunnyday.mit.edu/papers/incose-04.pdf

https://core.ac.uk/download/pdf/78070242.pdf

https://dspace.mit.edu/bitstream/handle/1721.1/102767/esd-wp-2004-08.pdf?sequence=1&isAllowed=y

https://dspace.mit.edu/bitstream/handle/1721.1/59813/leveson_The%20Need%20for%20New.pdf?sequence=2&isAllowed=y

https://www.tandfonline.com/doi/pdf/10.1080/00140139.2014.1001445

https://ntrs.nasa.gov/api/citations/20230017753/downloads/Kopeikin_AIAA_UnsafeCollabControl_v5.pdf

http://sunnyday.mit.edu/accidents/space2001-version2.pdf

https://dspace.mit.edu/bitstream/handle/1721.1/90801/891583966-MIT.pdf?sequence=2&isAllowed=y

http://sunnyday.mit.edu/Bow-tie-final.pdf

https://cs.emis.de/LNI/Proceedings/Proceedings232/597.pdf

https://a3e.com/wp-content/uploads/2021/03/Risk-Matrix.pdf

https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=a6b1e3482543a0116a5666e22956e773e953d682

https://journals.sagepub.com/doi/pdf/10.1177/21695067231192457

https://jsystemsafety.com/index.php/jss/article/download/44/41

http://sunnyday.mit.edu/compliance-with-882.pdf

https://www.researchgate.net/profile/Edward-Bachelder-3/publication/245875378_Describing_and_Probing_Complex_System_Behavior_A_Graphical_Approach/links/61f349978d338833e39cedfc/Describing-and-Probing-Complex-System-Behavior-A-Graphical-Approach.pdf

https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=a17b2fa804e0f3e281dc88e959be9216328ae6cc#page=290

https://www.researchgate.net/profile/Earl-Hunt/publication/23920138_Demonstration_of_a_Safety_Analysis_on_a_Complex_System/links/561ea59908aecade1acce7ca/Demonstration-of-a-Safety-Analysis-on-a-Complex-System.pdf

https://meridian.allenpress.com/bit/article-pdf/47/2/115/1488089/0899-8205-47_2_115.pdf

LinkedIn post:

#CAST #disaster #nancyLeveson #resilienceEngineering #risk #safetyScience #safetyIi #safety2 #safetyii #stamp #stpa #systemSafety #systemsEngineering #systemsSafety #systemsThinking

I wouldn't want to be among the people who now need to explain why there is a single-point-of-failure for critical infrastructure. It might have looked like an acceptable risk at the time. After the fact it looks like a foolish decision.

I'd expect that other subsystems will be scrutinized as well. This looks like a higher level problem.

#heathrow #SystemsSafety

https://www.theguardian.com/uk-news/live/2025/mar/22/heathrow-airport-closure-fire-reopens-london-travel-flight-information-latest-news-updates

Energy secretary orders investigation into Heathrow disruption – as it happened

Miliband said he wanted ‘to understand any wider lessons to be learned on energy resilience for critical national infrastructure’

the Guardian

As a reminder: don't let LLMs handle anything in the political sphere unless you have RLHF (Reinforcement Learning from Human Feedback) active before you show the result to anyone*. Also think of automation risks and human factors (HF). That's "Good Old Systems Safety".

*) ... or unless your goal is to damage a 3rd party's reputation (fake news style).

#llm #ai #rlhf #automationrisks #SystemsSafety

https://www.theregister.com/2024/12/20/apple_ai_headline_summaries/?td=rt-3a

Apple called on to ditch AI headline summaries after BBC debacle

'Facts can't be decided by a roll of the dice'

The Register

Now, let’s look at the underlying #SystemsSafety part.

#Autopilot and #FSDBeta-equipped vehicles are Level 2-capable vehicles - with the exact same *limitations* as many other vehicles on the market today.

Namely, the key limitation is that the human driver must remain the fallback for any dynamic driving task or vehicle failures at all times and under all conditions.

Effectively, that means that the human has the exact same control responsibilities between the two vehicles shown below.

#SystemsSafety has an odd power.

People today cannot really remember a time when everyday products would readily kill or maim. So, having lost those experiences over the decades, Silicon Valley increasingly saw a business opportunity.

But modern society is grounded on the public’s trust and, given enough critical mass, trust can be virtually lost overnight.

Quite literally.

That is Great Depression stuff right there, folks.

@CrackedWindscreen Tragic.

Really.

Indeed. These incidents require an exhaustive root cause analysis... which is, as you know, very rarely performed.

But the knee-jerk "just sprinkle a little automation on it" is a absolute Cancer of Simplicity that has zero #SystemsSafety foundation.

There are immense downsides to automation that are very vague.

Let's talk about #Mercedes vehicles equipped with #DrivePilot a bit - a Level 3-capable vehicle that has been recently "approved" in a handful of US states.

This article almost entirely focuses on the legal dynamics of consumer liability should this vehicle create a direct (or, presumably, an indirect) incident.

But, as always, I want to talk about what I feel are the #SystemsSafety realities at work here and the many foot-guns that are associated with that.

#cars

https://www.autonews.com/mobility-report/mercedes-drive-pilot-automated-system-poses-legal-questions

🧵👇

Mercedes-Benz addresses Level 3 legalities; lawyers say uncertainty lingers

Mercedes-Benz says "well-established legal systems" should determine whether the company is liable for crashes and other incidents that may arise from use of its Drive Pilot system. Whether human drivers bear some liability remains a key legal question.

Automotive News

@lolgop Constantly. Constantly this is done.

It is beyond exhausting.

And it has actually proved to be extraordinarily dangerous when #Musk lies about the capabilities and availability of #Tesla's #FSDBeta product, in particular.

The press often allows Wall Street analysts, that are not competent in #SafetyCritical systems, to advance Musk's dangerous lies.

The #SystemsSafety community has been battling this for years.

I suppose that I should also note that no system can ever be "perfectly safe".

That is not possible

And the concept of "perfection" is not relevant to systems safety.

Ross submits that "at no time was anybody at any risk of crashing".

No.

There is **always** risk!

#SystemsSafety is about maintaining processes such that always-present, finite risk is continuously and exhaustively identified and managed.

It is about appreciating that risk exists - the opposite of what Ross submits.

#Tesla

I was at #Chicago Pride all weekend while visiting with my wife (videos and photos soon!), so I missed this #Tesla Drama concerning #FSDBeta that erupted.

Ok.

Let us, again, all put on our #SystemsSafety hats and take a look at the situation here as I understand it.

Below is the video that kicked the beehive between Tesla defenders and detractors on "what really happened?".

This clearly chaotic video was taken from a larger drive sequence in which FSD Beta was active.

🧵👇