Safety Science 82 (2016) 129–143

Contents lists available at ScienceDirect

Safety Science
journal homepage: www.elsevier.com/locate/ssci

‘Accident investigation in the wild’ – A small-scale, field-based

evaluation of the STAMP method for accident analysis
Peter Underwood a,⇑, Patrick Waterson b, Graham Braithwaite c
a
DCA Design International Ltd, 19 Church Street, Warwick CV34 4AB, UK
b
Human Factors and Complex Systems Group, Loughborough Design School, Loughborough University, Loughborough LE11 3TU, UK
c
Cranfield Safety and Accident Investigation Centre, Cranfield University, Martell House, University Way, Cranfield MK43 0TR, UK

a r t i c l e i n f o a b s t r a c t

Article history: Little information is currently available about the application of systemic accident analysis methods by
Received 23 December 2014 practitioners and whether their analysis needs are met. This study provides an insight into this issue
Received in revised form 14 July 2015 by obtaining a practitioner evaluation of STAMP and understanding how the method’s usage character-
Accepted 26 August 2015
istics affect its use in a live investigation scenario. Six participants took part in a workshop to analyse data
collected during a (high-fidelity, partly field-based) simulated investigation exercise using STAMP. The
analysis outputs were assessed, along with the participants’ questionnaire and focus group responses
Keywords:
pertaining to their experiences of using the method. When combining the mixed methods data generated
Systems approach
Research-practice gap
during the study, a number of observations regarding the participants’ experiences of using STAMP were
Accident analysis made. However, improving the method’s usability and graphical output were highlighted as key develop-
STAMP ments that may improve its acceptance by practitioners.
Scenario-based training Ó 2015 Elsevier Ltd. All rights reserved.

1. Introduction accident recurrence. The use of the systems approach, via systemic
accident analysis, tries to avoid these limitations. It has been used
Use of the systems approach to understand accident causation as the conceptual foundation for various accident analysis tech-
and improve system safety is commonplace within the research niques, of which STAMP (Leveson, 2004, 2012), FRAM (Hollnagel,
community (e.g. Asadzadeh and Azadeh, 2014; Kazaras et al., 2004, 2012) and AcciMap (Rasmussen, 1997) are the most popular
2014; Leveson and Stephanopoulos, 2014). Utilising concepts of within the research community (Underwood and Waterson, 2012).
systems theory, it views accidents as the result of unexpected,
uncontrolled relationships between a system’s constituent parts. 1.1. The systemic accident analysis research-practice gap
Systems must, therefore, be analysed holistically as whole entities,
rather than considering their parts in isolation. Traditional theories Despite the proposed advantages of the systems approach,
of accident causation suggest that complex systems accidents are there is evidence within the scientific literature which suggests
caused by sequences of causal events which are initiated by a single that methods and tools employing a systemic perspective are not
‘root cause’ event, such as catastrophic equipment failure or an being adopted in practice. In other words, a research-practice gap
unsafe human action. However, as system complexity has increased exists. Some researchers (e.g. Carhart and Yearworth, 2010; Dien
over time, many accidents (e.g. space shuttle Columbia; Comair et al., 2012; Leveson, 2012) comment that the most commonly
flight 5191) have not simply resulted from such trigger events. used tools for accident analysis are based on linear, reductionist
Instead these accidents emerge as complex phenomena within models of systems and causality. Furthermore, other researchers
the normal operational variability of a system (de Carvalho, 2011). note that systemic accident analysis and its related techniques,
Describing accidents in a sequential (cause–effect) fashion is, e.g. STAMP, are yet to gain acceptance outside of the research com-
therefore, arguably inadequate. It can also lead to equipment or munity (e.g. Hollnagel et al., 2008; Okstad et al., 2012; Read et al.,
humans at the ‘sharp end’ of a system being incorrectly blamed 2013; Salmon et al., 2012a,b). These observations are supported by
for an accident. This represents a missed opportunity to learn the sequential understanding of accident causation presented
important lessons about system safety and how to prevent within various elements of the practitioner-focused safety litera-
ture (e.g. Energy Institute, 2008; Health and Safety Executive,
2004; Rail Safety and Standards Board, 2011) and the focus on
⇑ Corresponding author. Tel.: +44 (0)1926 478 067. ‘sharp end’ factors within investigation reports (e.g. Cedergren
E-mail address: pete.underwood@dca-design.com (P. Underwood). and Petersen, 2011; Schröder-Hinrichs et al., 2011).

http://dx.doi.org/10.1016/j.ssci.2015.08.014
0925-7535/Ó 2015 Elsevier Ltd. All rights reserved.
130 P. Underwood et al. / Safety Science 82 (2016) 129–143

Along with a number of researchers, the authors of this study most frequently cited systemic analysis technique. It was previ-
have previously suggested that the research-practice gap should ously used by the authors (see Underwood and Waterson, 2014)
be bridged, where possible, as the systems approach can provide and would, therefore, allow a comparison between its use in the
a better understanding of accidents (e.g. Underwood, 2013; research and practice contexts. Finally, detailed guidance about
Underwood and Waterson, 2013). the application of the technique is available (see Leveson, 2012),
thereby facilitating the training of participants in the use of STAMP.
1.2. Bridging the research-practice gap STAMP focuses on safety as a control problem, i.e. emergent
system properties (e.g. safety) are controlled by imposing con-
A key method for bridging the gap is ensuring that systemic straints on the behaviour and interaction of system components
accident analysis techniques are suitable for use by practitioners (Leveson, 2012). Hierarchical safety control structures are used
(Underwood and Waterson, 2013). The use of systemic methods by STAMP to describe the composition of systems. Control (two-
to analyse accidents has predominantly existed within research way communication) processes operate between system levels to
and very little is known about their application by practitioners. enforce the safety constraints. Accidents are consequently seen
Therefore, in order to understand if the systemic techniques meet as a result of a lack of control over the safety constraints.
the needs of practitioners, it must be established how these meth- The process of using STAMP to analyse an accident consists of
ods cope with the demands of live investigations. Recruiting prac- nine stages and is defined by Leveson (2012 p. 349) as the Causal
titioners to apply and evaluate the systemic analysis methods Analysis based on STAMP (CAST) approach. The stages of CAST
would be a useful start towards achieving this goal. are summarised below:
From a research perspective, it would be favourable to collect
method usage data within a live investigation. However, there 1. Identify the system(s) and hazard(s) involved in the loss.
may be reluctance to trial new analysis techniques in an investiga- 2. Identify the system safety constraints and system requirements
tion. Furthermore, this goal may be practicably difficult to achieve associated with the hazard.
for a number of reasons, such as: the unpredictable schedule of 3. Document the control structure in place to control the hazard
accident investigations, the expense of extended field-based and enforce the safety constraints.
research and gaining access to sensitive information. There is also 4. Determine the proximal events leading to the loss.
the ethical issue that if a method is trialled in this way and fails, the 5. Analyse the loss at the physical system level.
investigation and the agency conducting it may be damaged and 6. Analyse the higher levels of the control structure.
affected parties (e.g. those involved or perhaps family members 7. Examine the overall coordination and communication contribu-
of injured/deceased) may not receive timely feedback. Anecdotally, tors to the loss.
this is often suggested as a reason why investigation agencies are 8. Determine the dynamics and changes to the system and its con-
reluctant to try new methods in a live investigation. trol structure over time.
The use of simulated accident scenarios offers a solution to 9. Generate recommendations.
these problems and balances the realism of an investigation with
the theoretical and practical needs of researchers. For example, 2.2. Sampling strategy
previous work by Woodcock et al. (2005) demonstrated that the
investigation of simulated accidents is suitable for analysis method A combination of the stratified purposive and convenience sam-
evaluation. However, participants (accident investigators) of their pling strategies, as defined by Miles and Huberman (1994), was
laboratory-based study commented that a lack of site visits limited employed in this study. The objectives of the study necessitated
the realism of the exercise. Therefore, the preferred format for an the recruitment of a particular group of individuals, i.e. practition-
accident simulation should involve field-based elements. ers employed (on a full- or part-time basis) as accident/incident
investigators. However, due to their unpredictable working pat-
1.3. Study aims terns, the recruitment of experienced investigators was considered
unfeasible. Therefore, participants were recruited from a group of
The principle aim of this small scale, exploratory study was to individuals that were training to be full-time aviation accident
provide an initial insight into the use of a systemic accident anal- investigators or aviation safety professionals (e.g. safety managers)
ysis method within the context of accident investigation. In order with a part-time responsibility for accident investigation. How-
to achieve this aim, the study had two main objectives: ever, as only aviation practitioners were available for recruitment,
a degree of convenience sampling was utilised.
 Obtain a practitioner evaluation of a systemic accident analysis
method, based on their experience of using it in a (high-fidelity, 2.3. Participants
partly field-based) simulated investigation.
 Understand how the usage characteristics of the method affect Six participants (mean age: 43.8 years) were recruited for the
its use in a live investigation scenario. study. A summary of the participants’ backgrounds and analysis
experience is provided in Table 1.
By conducting this study, it was hoped that a greater under- None of the participants were aware of STAMP before attending
standing of the extent of the systemic accident analysis research- the training course, which offered a degree of control over the
practice gap could be achieved. experimental bias associated with the previous experiences of
the participants.
2. Methods
2.4. Training provided
2.1. Accident analysis method selection
The participants were enrolled on a six-week training course
The Systems Theoretic Accident Modelling and Processes (run by the Cranfield Safety and Accident Investigation Centre at
(STAMP) method was chosen for evaluation for a number of rea- Cranfield University) which covered fundamental aspects of the
sons. As identified by Underwood and Waterson (2012), it is the investigation process, such as pre-deployment planning, on-site
 P. Underwood et al. / Safety Science 82 (2016) 129–143 131

Table 1
Participant information.

Participant Age Country Industry Role % of time spent Experience in Number of accidents Type of accidents and/or
analysing accidents/ analysing accidents/ (incidents) analysed incidents analysed
incidents incidents (years)
1 35 Canada Military Accident 25 1 2 (0) Aircraft fell off jack, nose
aviation investigator wheel failure on landing
2 45 Australia Military Accident 50 0 as investigator 1 (6) Ejection from fixed-wing
aviation investigator (spent 2 years as aircraft, smoke and fumes in
flight/voice data helicopter
analyst)
3 46 Australia Military Aviation Unknown Unknown Unknown Various maintenance related
aviation maintenance issues
support
4 53 UK Military Accident 60 >20 >20 (>100) Rotary wing aviation (military
aviation investigator and commercial)
5 40 Nigeria Military Wing Unknown 3 3 (4) Flight into terrain, airborne
aviation commander near misses, hard landing,
hydraulics failure
6 44 Japan Civil Accident 60 2 2 (0) Flight into terrain
aviation investigator

risk management, stakeholder engagement, evidence collection During various stages of the first day, each IIC was telephoned
and human factors issues. by the NIA duty coordinator, provided with initial details of the
The participants (and all of the training course delegates) were collision and told to deploy their team to the accident site. The
provided with classroom- and field-based accident analysis train- deployments were staggered to ensure that each team had sole
ing. The classroom training was delivered over three days and access to the site for a given period of time. Each IIC was responsi-
was divided into five components: ble for allocating roles to their team members and assigning tasks
based on the needs of the investigation. Typical duties involved
1. The philosophy of investigative analysis was introduced in a documenting evidence, mapping the accident site and interviewing
1.5 h presentation. witnesses. Each team was provided with a location to hold meet-
2. An accident analysis case study was presented (Herald of Free ings/conduct interviews (a spare carriage on a train not involved
Enterprise). in the accident) and a supply of evidence collection/documenta-
3. The researcher (Underwood) delivered a 1.5 h presentation on tion, personal protection and communications equipment.
accident analysis theory and methods, including an introduc- The teams were given 1.75 h for site examination and a further
tion to STAMP. 1.75 h to conduct several planned witness interviews, e.g. with the
4. A 3.25 h group-based case study analysis workshop was surviving maintenance engineer. Several unplanned witness inter-
conducted. views also took place during the site examination as various ‘wit-
5. The researcher delivered a one-hour STAMP analysis presenta- nesses’, e.g. a passing member of the public, were introduced into
tion. The theory, application process (as per Leveson, 2012 p. the scenario. During the subsequent analysis phase, the teams
349) and a worked example of the method was provided. were able to request additional evidence as they discovered/ex-
plored lines of enquiry. If available, this extra information was pro-
The content of the final presentation was deliberately focused vided verbally or in the form of documentation, e.g. maintenance
on the theory and application of STAMP so that the participants manuals. Two teams opted to use the Australian Transport Safety
received the maximum amount of STAMP training possible. This Bureau (ATSB) model to guide their analysis, whereas the other
step was taken to improve the validity of the findings of the STAMP teams used STAMP.
analysis workshop (described in Section 2.6.1). The different evidence collection approaches taken by the teams
Details of the field-based simulated accident investigation are resulted in each group collecting slightly different factual informa-
provided in Section 2.4.1. tion about the accident. This, in turn, resulted in each team present-
ing different factual and analysis findings. Therefore, as may be
2.4.1. Investigation of simulated accident expected when different groups are faced with the same accident
The investigation exercise centred on a rail-based accident sce- site and witnesses, no single description of the accident was avail-
nario which involved a train colliding with two track maintenance able, however, a general synopsis is provided in Section 2.5.
engineers, fatally injuring one of them. The exercise took place over
three days; the first day consisted of field-based evidence gather- 2.5. Accident synopsis
ing, the second day was dedicated to the analysis phase of the
investigation and the remaining time was allocated to the presenta- The accident scenario was devised and run by staff members of
tion of the teams’ findings and development of recommendations. Cranfield University, with volunteers playing the roles of various
The 34 course delegates were divided into four teams with each stakeholders, e.g. eye witnesses and members of the emergency
team having a nominated Investigator In Charge (IIC), i.e. a team services.
leader. Each group received a pre-exercise brief detailing the learn- The simulated accident ‘occurred’ on the 25th January 2013 on a
ing objectives and site-safety instructions. The delegates were also bridge located south of the Pitsford and Brampton station in
provided with contextual information to increase the realism of Northamptonshire, UK (see Fig. 1).
the exercise, i.e. each team was formed of newly qualified ‘National The section of track on which the accident occurred had been
Investigation Agency’ (NIA) investigators who were at the top of subject to a temporary 50 miles per hour (mph) speed restriction.
the call-out duty roster. However, no details were provided as to The restriction was in place due to reported ‘rough running’ over
the mode of transport, location or stakeholders involved in the the bridge caused by uneven track geometry which, in turn, was
accident. Again, this was to maximise the realism of the exercise. caused by dislodged ballast. The restriction was established
132 P. Underwood et al. / Safety Science 82 (2016) 129–143

between the Boughton signal box to the south of the accident site zone and conducting their inspection at approximately 06:35, the
and the Pitsford and Brampton station (see Fig. 2). maintenance crew decided to undertake some unscheduled (and
A track maintenance crew, consisting of two maintenance engi- unauthorised) repairs to the track. This decision was taken based
neers and a lookout (flag man), were called to perform an inspection on the fact that the next train was not due to arrive until 07:40.
of the affected section of track at 00:30 on the 25th January 2013. However, at approximately 06:50 an unscheduled train passed
After setting up the required 20 mph emergency speed restriction the Boughton signal box travelling northbound. The train slowed
to 50 mph as required. However, the train drivers were unaware
of the 20 mph emergency restriction in place, as the speed restric-
tion signage and warning lights had fallen over (unbeknownst to
the maintenance crew). The flagman saw the approaching train
but was unsuccessful in his attempts to warn the maintenance
engineers. The train drivers observed the engineers on the bridge
and applied the train’s emergency brakes. However, the engineers
were unable evacuate the area in time and were struck by the train.
The lead engineer was fatally injured in the collision and his assis-
tant sustained head and leg injuries. The assistant engineer was
attended to initially by the second train driver before he was evac-
uated to hospital by the emergency services.
Conducting an inspection without gaining authorisation was a
common procedural violation that occurred within the track
maintenance company, due to pressure within the organisation to
deliver a timely maintenance service. Furthermore, the communi-
cation procedures for sharing train scheduling information
between the track maintenance and train operating companies
were not sufficient to effectively inform maintenance crews of all
train movements. These issues were indicative of problems which
Fig. 1. Section of the simulated accident site.
existed in the higher control levels of the system.

Fig. 2. Map of accident site.

 P. Underwood et al. / Safety Science 82 (2016) 129–143 133

The control structure that existed at the time of the accident is analysis. The participants were instructed to exclude the fourth
shown in Fig. 3. step of the CAST process, i.e. defining the proximal event timeline.
This instruction was given to maximise the time available for the
2.6. Data collection other stages of the CAST process, as the four teams had all created
detailed timelines during the investigation exercise and were
2.6.1. STAMP analysis workshop familiar to the participants.
The use of a workshop was judged to be the most appropriate An audio recording of the workshop was taken to identify any
environment for the participants to conduct a STAMP analysis. This issues/questions raised by the participants, in order to understand
decision was taken to maximise the level of control over the study how these factors may have influenced the participants’ analyses.
conditions (e.g. each individual would be furnished with the same
amount of time to complete the analysis and have access to sup- 2.6.2. STAMP evaluation questionnaire
port from the researcher) and minimise the required time for data Upon the completion of the workshop, each participant com-
collection. pleted an evaluation questionnaire (see Appendix A). The question-
The duration of the workshop was two hours and began with a naire was designed to understand how the participants viewed
15 min briefing, covering a number of topics. Firstly, the partici- different issues surrounding the validity and usability of STAMP
pants were informed of the format and the overarching aim of by asking them to state their level of agreement with a number
the workshop, i.e. performing a STAMP analysis of the data col- of statements.
lected during the simulated investigation and providing feedback Due to the number of evaluation topics, it was considered that a
on their experiences of using the method. Secondly, the group questionnaire would provide the most efficient means of collecting
was given instructions designed to minimise the affect they each the resultant large quantity of data. In addition, it would generate
had on the other participants’ experience of using STAMP, e.g. quantitative data that could be used to make a statistical compar-
queries about the application of STAMP should be directed to the ison of the participants’ usage experience. The questionnaire was
researcher. Guidance on using STAMP was provided by the reviewed by a senior human factors researcher and minor amend-
researcher throughout the workshop. Although this influenced ments to the formatting were made before the start of the study.
the participants’ usage of the method it was deemed necessary to
facilitate data generation. Finally, the participants were provided 2.6.3. Focus group
with a recap of STAMP and its application process, in order to Subsequent to the completion of the evaluation questionnaire,
prime them to conduct the analysis. Upon completion of the brief- four of the participants took part in a focus group. The objective
ing, the remaining time was dedicated to the STAMP analysis. All of the session was to understand the participants’ overall impres-
but one of the participants were able to complete their analysis sion of STAMP. A number of questions were developed to gather
within the permitted time. this information:
Each participant was provided with a range of material to help
them complete their analysis, i.e. a summary of the CAST process,  What are the benefits of using STAMP?
an example control hierarchy and worksheets (based on the vari-  What are the disadvantages of using STAMP?
ous stages of CAST) on which the participants could record their  How would you improve STAMP?

Regulator

Cranfield Train Cranfield Railway

Operating Infrastructure
Company Company

Lead
Driver 1 Signalman
engineer

Second
Driver 2 Flag man
engineer

Maintenance
Train Signals
equipment

Rail track

Fig. 3. Accident scenario control hierarchy.

134 P. Underwood et al. / Safety Science 82 (2016) 129–143

 Would you use STAMP in future investigations?

These questions were not incorporated into the STAMP evalua-

tion questionnaire so that points of interest could be explored fur-
ther and thus increase the breadth and depth of the data collected.
The duration of the focus group was limited to 20 min due to the
availability of the participants.

2.7. Data analysis

2.7.1. Initial analysis

The different data sources were initially analysed separately.
The analysis outputs created by the participants were converted
into electronic documents and imported into NVivo 9. The docu-
ments were subsequently compared using an inductive analysis
approach and any similarities/differences were coded in NVivo 9.
This comparison was made to assess the different approaches of
the participants, rather than make a judgement on the accuracy
of the analyses or the reliability of STAMP (which was not possible
given that the whole group was not using an identical set of evi-
dence). The study was not designed to formally test the validity
and reliability of the method for a number of reasons: (1) the par-
ticipants were first-time users of STAMP and, therefore, may not be
expected to produce accurate analysis results; (2) the sample was
formed of individuals from different investigation exercise teams
whom had access to differing amounts of evidence; (3) as investi-
Fig. 4. Evaluation framework.
gators in training, the participants’ lack of evidence collection
experience may have also contributed to the variation in evidence
between the investigation teams and (4) a complete description of to the accident. This is evidenced by, for example, the range of sys-
the accident was not available to compare the workshop analysis tem safety constraints identified by the participants (see Fig. 5).
outputs against. Variation also existed amongst participants with regards to the
Data from the STAMP evaluation questionnaire were analysed number of system safety constraints they identified, with Partici-
with SPSS 20 in order to provide some descriptive statistics regard- pants 1 and 2 listing the greatest number (seven constraints) and
ing the participants’ level of agreement with the various questions. Participant 6 documenting the least (one constraint). Of the total
The audio recordings of the analysis workshop and focus group number of constraints identified, 86% were recorded by four of
were transcribed, imported into NVivo 9 and analysed inductively. the participants.
Topics of interest were coded and grouped as appropriate. Differences in how the participants interpreted the evidence
were also observed. For example, when asked to provide a descrip-
tion of the controls available to the various physical system com-
2.7.2. Data integration
ponents, the majority of the controls listed referred instead to
The findings from the first stage of analysis were subsequently
items of physical equipment. Furthermore, when describing how
integrated for a second analysis phase in order to identify instances
the physical system components failed or how the controls were
of data corroboration, elaboration, complementarity and contra-
inadequate, participants listed as many personnel-related issues
diction, as defined by Brannen (2005 p. 176). This analysis was per-
as physical equipment problems. These personnel-related issues
formed deductively, using an evaluation framework as a coding
seemed linked to the analysis of higher-level system components.
template (see Fig. 4). The evaluation framework was based on
Additionally explicit descriptions of the physical and higher sys-
characteristics that that were identified by the authors as key to
tem level components were not provided by two and one partici-
the usage experience of an accident analysis method (see
pants respectively. However, various types of component could
Underwood and Waterson, 2013, 2014).
be inferred from the list of physical controls, safety-related respon-
sibilities and violated safety constraints which they provided, as
3. Findings exemplified in Table 2.
A level of consistency was seen amongst the participants,
The individual sets of data, collected via the methods described however, in how they focussed their analysis at the frontline staff
in Section 2.6, are presented in this section. For conciseness, the individuals and teams when examining the higher level system
findings have been summarised. However, full details are available components, where the majority (76%) of components were identi-
in Underwood (2013). The integration of the data is discussed fied as such. Only Participant 5 listed system components from
under the various headings of the evaluation framework in higher levels of the control structure, i.e. the company management.
Section 4. However, these components were not analysed by the participant.
Due to the preliminary nature of the study, the findings should Only five of the participants documented the control structure
be considered tentatively. hierarchy; Participant 6 did not attempt to define the control struc-
ture as they were struggling to complete the rest of the analysis.
3.1. STAMP analysis outputs Examples of the control structure diagrams produced by the
participants can be seen in Figs. 6 and 7. All of the participants
The analysis outputs showed that considerable variation existed who created diagrams of the system control structure utilised
between the participants in terms of the quantity and nature of the the format described by (Leveson, 2012 p. 82), with four individu-
system components and factors that were identified as contributing als describing control/feedback problems with dashed lines.
 P. Underwood et al. / Safety Science 82 (2016) 129–143 135

Fig. 5. System safety constraints identified during analysis (numbers in brackets = number of system safety constraints related to a given topic).

As a result of the workshop time constraints, only three of the encountered by the group included: (1) difficulty in drawing the
participants completed the final stage of the analysis, i.e. examining system control structure; (2) classifying the dysfunctional interac-
the system changes over time. The majority of the identified issues tions of system components; (3) analysing the physical equipment
reflect a normalisation of the risk associated with performing ad and (4) a general uncertainty of how to proceed with the analysis,
hoc maintenance work. However, Participant 3 also commented e.g.:
that no significant changes in the system over time were noted.
‘‘I think that’s what I have a lot of difficulty with, i.e. putting all of
3.2. Workshop audio recording this in a picture. It took me three attempts to even draw it [the con-
trol structure].” (Participant 1)
The questions and comments raised by participants during the ‘‘I’m not sure what I should be doing. What should I write?” (Par-
workshop related to three general issues. Firstly, some individuals ticipant 6)
had difficulty in understanding the concepts of STAMP. For exam-
ple, two participants required clarification about the meaning of Finally, four of the individuals had difficulty recalling informa-
the control and feedback arrows used in the control structure dia- tion they collected during the evidence gathering phase of the sim-
gram, whereas other individuals had difficulty understanding ulation and had to discuss the investigation with the other
aspects of the STAMP terminology: participants.
In addition, two participants commented on the effectiveness of
‘‘What do you mean by dysfunctional interactions?” (Participant 3) STAMP in presenting the findings of the analysis and describing the
‘‘System component description; is that a person?” (Participant 2) analysis process itself:

Secondly, the participants struggled to apply STAMP, e.g. every ‘‘I tried to draw the control structure, as per the instructions, and
participant had trouble defining the system hazards. Other issues then put dotted lines where it kind of falls down but then in the

Table 2
Physical system component description (yellow colour of cells used to highlight a non-zero value).
136 P. Underwood et al. / Safety Science 82 (2016) 129–143

Regulator

Cranfield
Cranfield Train
Railway
Operating
Infrastructure
Company
Company

Train driver Signal man Form 181 Lead engineer

Flag man 2nd engineer

Train Signals Flag signs Automatic Trolley

Warning
System

Track
Driving train Track repair
inspection

Fig. 6. Participant 2 control structure diagram (dashed lines represent dysfunctional interactions).

end what is this picture saying to somebody? You have to under- higher levels of a system, graphically describe a complex accident
stand STAMP to understand this picture and what’s going on.” and visually communicate the findings of an analysis to senior
(Participant 2) management in an effective manner, e.g.:

3.3. STAMP evaluation questionnaire ‘‘I think the pros would be that, if you had a very complex accident,
I think you would be able to represent it graphically with the
The answers to the method evaluation questions are presented STAMP method.” (Participant 1)
in Table 3. Examining the participants’ questionnaire responses ‘‘It’s great for looking at the overarching stuff [and] it was useful for
reveals a number of noteworthy issues. As a group, the participants [defining the] lines of responsibility trees and communication
slightly agreed that STAMP is a suitable method for analysing acci- trees.” (Participant 4)
dents, albeit that there was a wide range of opinion, and that it cor-
rectly identifies the causes of an accident. Specifically, the 3.4.2. Disadvantages of STAMP
participants agreed that STAMP effectively analyses the contribu- Conversely, the group mentioned a number of disadvantages
tion to an accident from human factors and organisational issues associated with the analytical and graphical representation capa-
and that it effectively represents system component relationships. bilities of STAMP. For example, Participants 1 and 4 felt that STAMP
Furthermore, they also agreed that it was easy to describe the dys- did not facilitate an effective analysis of issues, e.g. human factors,
functional interactions of system components. However, the group at the lower system levels. Participant 4 also mentioned that the
slightly disagreed that the accident event timeline was effectively lack of an accident trending capability, due to the absence of a tax-
described by the method (five of the participants either slightly onomy, represented an analysis limitation. Furthermore, three of
disagreed or disagreed with the statement). the participants remarked that the CAST process seemed too pre-
Collectively, the participants disagreed that STAMP was easy to scriptive, e.g.:
understand and slightly disagreed that it was easy to use. In each
case, only one participant agreed with the statement. However, four ‘‘I felt as if the analysis was driving the evidence.” (Participant 2)
of the participants either slightly disagreed or disagreed that they
had received enough training to effectively use the method. There The issues raised by the group, in relation to STAMP’s graphical
was also a wide range of opinion amongst the group as to whether representation of an accident, related to how effectively it commu-
the participants could easily become skilled at using STAMP. nicates the findings of an analysis. The control structure diagram
was described as visually confusing by two participants and all
3.4. Focus group four members of the focus group commented that the inability of
the method to chart the timeline of an accident posed an important
3.4.1. Benefits of STAMP limitation, e.g.:
When asked, three participants provided examples of the bene-
fits of using STAMP. These advantages related to the method’s abil- ‘‘STAMP definitely needs a timeline somewhere in there to give you
ity to provide insights into the contribution to an accident from the presentational stuff.” (Participant 4)
 P. Underwood et al. / Safety Science 82 (2016) 129–143 137

Office of Rail
and Road
(regulator)

Regulation
Cranfield Railway
Infrastructure Company

Cranfield Train
CTOC Operating Company
operational (CTOC)
procedures

General
Provision of
manager
Operational safety equipment
procedure No. 36

Operational
process
Train driver Form 181

Functional Lead engineer Signal man

Not good

Flag man 2nd engineer ?

Automatic
Warning Track work
System

Track
Emergency
inspection
Restriction of
Speed

Carry-on Trolley
Signs equipment

Flag
Ballast tools

Whistle

Train

Fig. 7. Participant 4 control structure diagram (dashed lines represent dysfunctional interactions, related items are grouped with dotted lines).

Other drawbacks of STAMP were associated with its usability, mentioned that their ease of using and understanding STAMP
e.g. that the method was hard to understand, due to the was influenced by the level of training that they had received,
complicated analysis process. However, the participants also e.g.:
138 P. Underwood et al. / Safety Science 82 (2016) 129–143

‘‘I did find it complicated at first and that’s because it’s brand new researchers (Johnson and Holloway, 2003 p. 8; Salmon et al.,
and we didn’t understand it that well.” (Participant 4) 2012a p. 1168). This suggests that more detailed usage guidance
regarding the treatment of evidence may be required to facilitate
3.4.3. Improvements to STAMP the analysis. However, these difficulties may also be indicative of
The only improvement mentioned by the whole group referred the participants’ lack of experience in using STAMP. Regardless,
to the inclusion of a timeline within the graphical output of the the problems encountered by the participants seem to result from
analysis, i.e. the system control structure diagram, despite being usability issues associated with the method, rather than a funda-
reminded that the creation of a timeline is a defined stage of the mental restriction on the type of data it can analyse.
CAST process, e.g.: The information that a method requires to produce a thorough
analysis can impact on the evidence collection process in an inves-
‘‘An event-based timeline is the starting point [to improve the tigation. However, none of the teams based their evidence collec-
method].” (Participant 3) tion on the needs of any analysis model, i.e. the selection of
‘‘[I would] put a timeline at the start.” (Participant 2) analysis method was made after the evidence collection phase of
the investigation exercise. Therefore it is not possible to evaluate
The participants subsequently discussed possible alterations to whether STAMP aided the collection of data. However, it does offer
the STAMP control structure format which would enable the inte- a possible explanation as to why some of the participants felt that
gration of a timeline, such as drawing an event timeline and then the CAST process was overly prescriptive (see Section 3.4.2). In
use the standard control structure format to link relevant system other words, the perception that the participants were ‘force fit-
components to the various events (i.e. have instantiations of the ting’ some of data into the STAMP analysis may have been lessened
control structure arranged along a timeline). if the requirements of the method had guided their data collection.
The output of an analysis will always be limited by the amount
3.4.4. Use of STAMP in future investigations and quality of the evidence gathered by investigators. The evidence
Participant 2 indicated that they may use the control structure collected by the teams did not relate to many organisational issues
diagram in future investigations, as a means of understanding the which explains why the participants did not perform a thorough
communication between system components. Conversely, Partici- analysis of the higher system levels. Therefore, the participant
pants 3 and 4 explicitly stated that would not be inclined to use observations and questionnaire responses which suggest that
STAMP in the future. A number of reasons were cited for this deci- STAMP is effective at analysing organisational issues seem to be
sion: (1) a preference for using a multi-method hybrid approach; based on the perceptions of the participants, rather than on
(2) being mandated to use a different method; (3) the resource their experience of using the method. Consequently, it is difficult
requirements of STAMP are too high; (4) a reluctance to trial a to determine whether, in practice, STAMP facilitates the analysis
new method in a live investigation and (5) reverting to methods of higher system level information collected during an
used before. investigation.
Furthermore, the group commented on the need to select a
method that meets the needs of the analysis, rather than dogmat-
ically applying one technique: 4.1.2. Validity
As explained in Section 2.7.1, the validity of STAMP was not for-
‘‘I don’t think there’s any one key method that you can really lock mally tested. However, the questionnaire and focus group data
down because it’s the evidence that’s driving the analysis.” suggest that the participants’ consider the method to have a degree
(Participant 3) of face validity. For example, the questionnaire responses of the
‘‘There’s no one model that’s perfect.” (Participant 1) participants reveal that, as a group, they slightly agreed that
STAMP is a suitable method for accident analysis and that it cor-
4. Discussion rectly identifies the causes of an accident. Furthermore, the partic-
ipants’ agreed that STAMP is effective at analysing organisational/
4.1. Model usage characteristics higher system level issues. However, it is unclear whether the
group agreed that STAMP could effectively analyse lower system
4.1.1. Data requirements level factors, as their questionnaire responses conflict with various
The evaluation of STAMP by Underwood and Waterson (2014) comments made during the focus group. Also, five of the partici-
suggested that the type of information which can be analysed by pants at least slightly disagreed that STAMP effectively describes
the method is not restricted by the original format of the data. the accident event timeline. This opinion was subsequently elabo-
Some of the participants remarked, during the focus group, that rated on by the members of the focus group, who suggested that
STAMP was not effective at analysing information pertinent to the lack of a timeline within the control structure diagram was a
lower system level components. While this indicates variability drawback of the method.
in how STAMP analyses and incorporates data, the comments were Whilst STAMP appears to offer the practitioners a valid tech-
contradicted by the evaluation questionnaire data, which showed nique for analysis, this statement could be made with more confi-
that each participant at least slightly agreed that such information dence if: the participants gained more experience of using the
was effectively analysed. However, the participants did encounter method to thoroughly analyse each level of a system; improve-
some difficulties when trying to analyse and incorporate the evi- ments to the method were made, e.g. incorporating the event time-
dence they had collected during the investigation exercise. For line into the control structure diagram. Therefore, although this
example, a degree of confusion existed over how some of the infor- apparent degree of face validity may start the process of building
mation should be processed. This was evidenced by the questions trust in the method, it seems that further work to develop and
and comments raised during the workshop and the association of evaluate the method may be needed in order for it to gain accep-
actions and decisions of personnel to the failures of the physical tance by practitioners. This is supported by the findings of
system components. The difficulties of classifying data and incor- Underwood and Waterson (2013 p. 159) and the work of
porating it into the analysis were similar to those experienced by Johansson and Lindgren (2008), which suggest that practitioners
Underwood and Waterson (2014) when applying STAMP to the require a method to have received empirical validation before they
Grayrigg train derailment and those encountered by other will adopt it.
 P. Underwood et al. / Safety Science 82 (2016) 129–143 139

4.1.3. Usability analysis methods utilise a diagram to summarise the findings of

The various sources of data collected during the study clearly an investigation. However, STAMP does not lend itself to a simple
reveal that the participants found it hard to understand STAMP. graphical representation of an accident, as its outputs are spread
Not only did some of the participants comment on the difficulties over several documents, some of which are mainly text-based
they experienced in understanding the method during the work- (Leveson, 2012 p.91). Therefore, it does seem that there could be
shop but, as a group, their questionnaire responses show that they a mismatch between STAMP’s outputs and the graphical needs that
slightly disagreed that the method was easy to understand. Fur- practitioners have of their analysis methods.
thermore, the comments raised by some of the participants during The participants’ idea of incorporating a timeline into the con-
the focus group indicate that understanding the method was prob- trol structure diagram may be a possible solution which better
lematic. As described in Section 3.4.2, such difficulties may be suits the needs of investigators. This would likely necessitate
indicative of insufficient training and/or analyst bias. However, showing how control flaws contributed to the accident, in a
these findings do suggest that learning about STAMP and its appli- chronological order, as well as the system components that expe-
cation is not a quick process and that the participants would rienced the flaws. However, it is difficult to envisage how such a
require multiple attempts at using the method before achieving a diagram could be created without it becoming unwieldy or morph-
sufficient level of understanding. This highlights the resource ing into a format that loses information about the control relation-
implications of learning and using more complicated methods, ships between the system components. This possibly explains why
such as the systemic accident analysis techniques; a point which STAMP takes its current form and why other methods, e.g. Acci-
is raised by various authors, such as Johansson and Lindgren Map, separate the timeline of events from the actors involved.
(2008) and Salmon et al. (2012a). Given that no single model can capture all of a system’s complex-
In addition to the difficulties the participants experienced in ity, it may not be possible to fully resolve the issue of graphically
understanding STAMP, the questions and comments raised during incorporating a timeline into STAMP’s control structure.
the workshop revealed that the group found that the method was A summary of the model usage characteristics discussion is pro-
not easy to use. Remarks made by the participants during the vided in Table 4.
workshop and in the focus group suggest that these usage difficul-
ties are, in part, related to an inadequate understanding of the
4.2. Implications for the adoption of STAMP
method. The evaluation questionnaire also revealed that the par-
ticipants slightly disagreed that STAMP was easy to use. However,
When examining the integrated study data, it appears that the
other questionnaire responses did not reflect the usage problems
usability of STAMP and its graphical output were the key concerns
encountered during the workshop. The responses for Q13-16b
of the participants. In particular, the ease of understanding and
suggest that the group at least slightly agreed that it was easy to
using of the method (and the subsequent need for extra training)
perform various aspects of the CAST process (see Table 3). This con-
and the lack of an event timeline in the control structure diagram
tradiction in the data cannot be explained by inter-participant
were highlighted as problems. Based on the findings of Underwood
variation in responses, i.e. individual participants contradicted
and Waterson (2013), these issues suggest that two of the main
themselves rather than consistently holding an opinion about the
requirements of an analysis model are not being met, i.e. accept-
ease of using STAMP. Furthermore, no other reason for this conflict
able usability and the usefulness of the method’s output format.
could be deduced from the data. Therefore, it is not certain from
Therefore, unless these issues are addressed, it is possible that
the findings of this study how the usability of STAMP would affect
STAMP will struggle to gain widespread acceptance within the
its use during an investigation.
practitioner community. However, a number of study limitations
Despite this issue, the majority of the data gathered during this
exist which mean that these findings should be considered tenta-
study does indicate that improvements to STAMP’s usability are
tively. These limitations are considered in the following section.
required, if the method is to be learnt more easily and with fewer
resources.
5. Study limitations
4.1.4. Graphical representation of the accident
As with aspects of STAMP’s usability, contradictions were found A number of limitations were placed on this study which relate
across the sources of data with regards to the creation and useful- to the use of a simulated investigation scenario and the selection of
ness of the graphical output of the method. Comments made dur- participants. The use of a simulated accident cannot exactly recre-
ing the focus group suggested that the control structure diagram ate the experience of conducting a live investigation. Therefore, the
effectively represents the complexity of an accident and that it participants’ experience of using STAMP may have been affected by
would successfully communicate analysis findings to senior man- using it within this simulated context. However, the fidelity of the
agement individuals. The effectiveness of STAMP as a communica- simulation was considered to be sufficiently high as to provide
tion device was also reflected in the group’s questionnaire the participants with a representative experience of accident
responses, i.e. their slight agreement that the STAMP diagram is investigation.
a useful communications tool. However, remarks made by some The amount of training given to the participants appears to be
of the participants, during the workshop and focus group, suggest insufficient, as evidenced by the usability feedback discussed in
that the control structure did not facilitate the analysis process, e.g. Section 4.1.3. As much STAMP training as possible was delivered,
identify gaps in the analysis, nor was it easy to understand. Fur- however, the findings of the study suggest that effective STAMP
thermore, there was a clear need identified, during the focus group, training cannot be provided in a short training course.
for STAMP to graphically incorporate an event timeline. Again, it The small sample size limits the generalisation and validity of
was not possible to explain this contradiction with the available the findings, as alluded to in Section 4. However, only 10
data. individuals were eligible to participate in the study, which high-
Interestingly, the majority of the participant responses concern- lights the practical difficulties in recruiting accident investigation
ing the graphical representation of the accident referred to the con- professionals, even within a dedicated training environment.
trol structure diagram. This suggests that the participants Furthermore, to the authors’ knowledge, field-based simulated
considered this diagram as the focal point of the analysis accident scenarios have not been utilised to perform systemic
documentation. This is arguably unsurprising, as many accident accident analysis method evaluations. Therefore, while this study
140 P. Underwood et al. / Safety Science 82 (2016) 129–143

Table 3 Table 4
SD, Min and Max columns present ±1 standard deviation, minimum and maximum Summary of model usage characteristics discussion.
values respectively.
Usage characteristic Discussion points
Question Mean SD Min Max
Data requirements  STAMP analysis theoretically capable of incor-
4 STAMP is a suitable method for analysing 4.0 1.41 2 6 porating any type of data throughout the sys-
accidents tem hierarchy
5 STAMP effectively describes the event 2.5 1.76 1 6  Participants provided contradictory opinions
timeline of an accident about the ability of STAMP to incorporate
6a STAMP effectively analyses the 4.2 1.17 3 6 lower-level component data
contribution to an accident from  Usability of method/experience of participants
technical components seemingly had more impact on the analysis of
6b STAMP effectively analyses the 5.0 0.63 4 6 different sources of data
contribution to an accident from human Validity  Participants considered STAMP to have a
factors issues degree of face validity
6c STAMP effectively analyses the 5.0 1.10 3 6  Unclear whether the group agreed that STAMP
contribution to an accident from could effectively analyse lower system level
organisational issues factors
6d STAMP effectively analyses the 3.3 1.03 2 5  Five participants at least slightly disagreed
contribution to an accident from that STAMP effectively describes the accident
environmental issues event timeline
7 STAMP provides a comprehensive 3.5 1.05 2 5 Usability  Participants found it hard to understand
description of an accident STAMP
8 STAMP effectively represents the 5.0 1.26 3 6  Conflicting evidence provided by participants
relationships between system about STAMP’s ease of use
components Graphical  Participants opinions on the usefulness of
9 STAMP correctly identifies the causes of 3.7 1.37 2 5 representation of the STAMP’s graphical output were contradictory
an accident accident  Timeline was not well represented in the
10 STAMP could be applied to any type of 3.3 1.03 2 5 graphical representation of the accident
accident in my industry  Participants considered control structure dia-
11 STAMP is an easy method to understand 2.3 1.51 1 5 gram to be focal point of analysis output
12 The terms and concepts used in STAMP 3.2 1.17 2 5
are clear and unambiguous
13 It is easy to identify the system safety 3.7 1.37 2 6
requirements expertise (at least during training) is not necessarily problematic.
14 It is easy to define the system control 3.7 1.03 2 5 Furthermore, the lack of industry knowledge amongst the partici-
structure
15 It is easy to identify unsafe decisions and 3.8 1.17 2 5
pants provided a degree of control over the variance between their
inadequate control actions analysis outputs and their experiences of using STAMP.
16a It is easy to describe dysfunctional 4.7 1.21 3 6 When considering the level of accident analysis experience of
interactions each participant, it is possible that Participant 4 could be consid-
16b It is easy to describe the context of 4.0 0.89 3 5
ered an ‘outlier’ (see Table 1). In other words, their level of analysis
decisions/actions taken by different
system components experience may have significantly differentiated their usage of
17 STAMP is an easy method to use 2.5 1.05 1 4 STAMP from the other participants. However, their STAMP analysis
18 STAMP is easy to use in a team-based 3.7 1.03 2 5 outputs and usage evaluation were comparable to that of the other
analysis participants. This is arguably a result of their similarly limited expe-
19 STAMP promotes team collaboration 4.3 1.03 3 6
during analysis
rience of using STAMP and justifies their inclusion in the study.
20 A STAMP diagram is a useful 3.8 1.47 2 6 Due to the resource limitations of the study, it was only possible
communication tool to conduct the evaluation of one of the systemic analysis methods,
21 A STAMP analysis can be completed in an 4.3 0.82 3 5 i.e. STAMP. While it would have been preferable for the partici-
acceptable timescale
pants to also conduct analyses with others, e.g. FRAM and AcciMap,
22 It would be easy for me to become skilled 3.5 1.38 1 5
at using STAMP this limitation represents an opportunity for future research.
23 I received sufficient training in the use of 2.7 1.97 1 6 Finally, the participants were allowed to select their own analysis
STAMP to effectively use the method method during the simulated investigation. No team pre-selected a
method and used it to guide their evidence collection. Therefore,
the participants experience of using STAMP may well have been
different, had they used it to inform their data gathering. However,
offers a preliminary, tentative look into this area of research, it is given that the participants were analysing primary data during the
considered to be a novel addition to the literature. Consequently, workshop, the findings of the study are considered to provide a
it is hoped that this study provides a template for future useful insight into the use of STAMP within an investigation.
practitioner-based method evaluations, thus allowing the develop-
ment of a more substantial body of data.
The participants, all of whom were aviation professionals, had a 6. Conclusion
limited knowledge of the rail industry. Consequently, the ability of
the participants to effectively analyse the accident may have been Little is currently known about the use of systemic accident
compromised, thus impacting on their experience of using STAMP. analysis methods by practitioners and ensuring that their needs
However, previous experience of accident investigator training at are met is an important factor in whether an analysis method will
Cranfield University suggests that this is not the case. be adopted or not. This study aimed to provide an insight into the
Braithwaite (2004) comments that a trainee investigation team usage of STAMP by obtaining a practitioner evaluation of the
comprised of aviation and marine specialists performed compara- method, based on their experience of using it in a simulated inves-
bly to other teams, which included rail experts, during a rail acci- tigation, and an understanding of how the usage characteristics of
dent investigation exercise. This highlights that the key principles the method may affect its application in a live investigation sce-
of investigation remain the same and that a lack of subject matter nario. The findings of the study suggest that STAMP does not cur-
 P. Underwood et al. / Safety Science 82 (2016) 129–143 141

rently meet the usability or analysis output requirements of prac- Acknowledgments

titioners. However, a number of study limitations exist, e.g. recruit-
ing a small group of novice STAMP users, which renders this This research was funded by Loughborough University with
suggestion a tentative one. Future work should aim to produce a access to participants, the simulated accident site and data collec-
deeper understanding of these issues (and their possible solutions) tion facilities provided by Cranfield University.
by collecting data from a larger group of practitioners which,
ideally, would include expert accident investigators. Appendix A
142 P. Underwood et al. / Safety Science 82 (2016) 129–143
 P. Underwood et al. / Safety Science 82 (2016) 129–143 143

References Johnson, C.W., Holloway, C.M., 2003. The ESA/NASA SOHO mission interruption:
using the STAMP accident analysis technique for a software related ‘mishap’.
Software: Practice and Experience 33 (12), 1177–1198.
Asadzadeh, S.M., Azadeh, A., 2014. An integrated systemic model for optimization of
Kazaras, K., Kontogiannis, T., Kirytopoulos, K., 2014. Proactive assessment of
condition-based maintenance with human error. Reliabil. Eng. Syst. Saf. 124,
breaches of safety constraints and causal organizational breakdowns in
117–131.
complex systems: a joint STAMP–VSM framework for safety assessment. Saf.
Braithwaite, G., 2004. Re-inventing (with wheels, wings and sails) – a new look at
Sci. 62, 233–247.
transport accident investigator training. In: Fager, S., Martinez, E., (Eds.),
Leveson, N., 2012. Engineering a Safer World: Systems Thinking Applied to Safety.
Proceedings of the 35th Annual International Seminar: ’Investigate-
The MIT Press, Cambridge, MA, USA.
Communicate-Educate’. Gold Coast, Australia, August 30–September 2 2004.
Leveson, N., 2004. A new accident model for engineering safer systems. Saf. Sci. 42
ISASI, Stirling, VA, USA, pp. 179–183.
(4), 237–270.
Brannen, J., 2005. Mixing methods: the entry of qualitative and quantitative
Leveson, N.G., Stephanopoulos, G., 2014. A system-theoretic, control-inspired view
approaches into the research process. Int. J. Soc. Res. Methodol. 8 (3),
and approach to process safety. AIChE J. 60, 2–14.
173–184.
Miles, M.B., Huberman, A.M., 1994. Qualitative Data Analysis: An Expanded
Carhart, N., Yearworth, M., 2010. The use of system dynamics group model building
Sourcebook, second ed. Sage Publications Ltd., London, UK.
for analysing event causality within the nuclear industry. In: Moon, T., (Ed.),
Okstad, E., Jersin, E., Tinmannsvik, R.K., 2012. Accident investigation in the
28th International Conference of the System Dynamics Society. Seoul, Korea,
Norwegian petroleum industry – common features and future challenges. Saf.
25–29 July. The System Dynamics Society, Albany, NY, USA.
Sci. 50 (6), 1408–1414.
Cedergren, A., Petersen, K., 2011. Prerequisites for learning from accident
Rail Safety and Standards Board, 2011. Investigation Guidance Part 3: Practical
investigations – A cross-country comparison of national accident
Support for Accident Investigators. Rail Safety and Standards Board, London, UK.
investigation boards. Saf. Sci. 49 (8–9), 1238–1245.
Rasmussen, J., 1997. Risk management in a dynamic society: a modelling problem.
de Carvalho, P.V.R., 2011. The use of functional resonance analysis method
Saf. Sci. 27 (2–3), 183–213.
(FRAM) in a mid-air collision to understand some characteristics of the
Read, G.J.M., Salmon, P.M., Lenné, M.G., 2013. Sounding the warning bells: the need
air traffic management system resilience. Reliabil. Eng. Syst. Saf. 96 (11),
for a systems approach to understanding behaviour at rail level crossings. Appl.
1482–1498.
Ergon. 44 (5), 764–774.
Dien, Y., Dechy, N., Guillaume, E., 2012. Accident investigation: from searching
Salmon, P.M., Cornelissen, M., Trotter, M.J., 2012a. Systems-based accident analysis
direct causes to finding in-depth causes – problem of analysis or/and of analyst?
methods: a comparison of Accimap, HFACS, and STAMP. Saf. Sci. 50 (4), 1158–1170.
Saf. Sci. 50 (6), 1398–1407.
Salmon, P.M., McClure, R., Stanton, N.A., 2012b. Road transport in drift? Applying
Energy Institute, 2008. Guidance on investigating and analysing human and
contemporary systems thinking to road safety. Saf. Sci. 50 (9), 1829–1838.
organisational factors aspects of incidents and accidents. Energy Institute,
Schröder-Hinrichs, J.U., Baldauf, M., Ghirxi, K.T., 2011. Accident investigation
London, UK.
reporting deficiencies related to organizational factors in machinery space
Health and Safety Executive, 2004. Investigating Accidents and Incidents: A
fires and explosions. Accid. Anal. Prev. 43 (3), 1187–1196.
Workbook for Employers, Unions, Safety Representatives and Safety
Underwood, P., 2013. Examining the systemic accident analysis research-practice
Professionals, second ed. HSE Books, Sudbury, UK.
gap. PhD thesis. Loughborough University.
Hollnagel, E., 2012. FRAM – The Functional Resonance Analysis Method. Ashgate,
Underwood, P., Waterson, P., 2014. Systems thinking, the Swiss Cheese Model and
Farnham, UK.
accident analysis: a comparative systemic analysis of the Grayrigg train
Hollnagel, E., 2004. Barriers and Accident Prevention. Ashgate Publishing Limited,
derailment using the ATSB, AcciMap and STAMP models. Accid. Anal. Prev. 68,
Aldershot, UK.
75–94.
Hollnagel, E., Pruchnicki, S., Woltjer, R., Etcher, S., 2008. Analysis of Comair flight
Underwood, P., Waterson, P., 2013. Systemic accident analysis: examining the gap
5191 with the functional resonance accident model. In: 8th International
between research and practice. Accid. Anal. Prev. 55, 154–164.
Symposium of the Australian Aviation Psychology Association, Sydney,
Underwood, P., Waterson, P., 2012. A critical review of the STAMP, FRAM and
Australia, 8–11 April 2008. Australian Aviation Psychology Association,
AcciMap systemic accident analysis models. In: Stanton, N.A. (Ed.), Advances in
Canberra, Australia.
Human Aspects of Road and Rail Transportation. CRC Press, Boca Raton, FL, USA,
Johansson, B., Lindgren, M., 2008. A quick and dirty evaluation of resilience
pp. 385–394.
enhancing properties in safety critical systems. In: Hollnagel, E., Pieri, F., Rigaud,
Woodcock, K., Drury, C.G., Smiley, A., Ma, J., 2005. Using simulated investigations for
E. (Eds.), Third Symposium on Resilience Engineering. 28–30 October 2008.
accident investigation studies. Appl. Ergon. 36, 1–12.
École des mines de Paris, Sophia Antipolis, France.