12. Finding Your Own Seams — The Procedure

Mapping the Architecture of Latent Conditions

Systems rarely fail at their central components, but rather at the invisible boundaries where different parts meet under unstated assumptions neither side truly owns. James Reason, in his 2000 BMJ article (Vol. 320, pp. 768–770), established that safety depends on hunting for latent conditions that accumulate before they eventually trigger. Listing every boundary before examining any individual component forces a practitioner to acknowledge that reliability is a property of the interfaces connecting the entire system. This procedure synthesizes the latent-condition thinking of Reason with the control-based analysis favored by Nancy Leveson to ensure that safety is treated as a constraint. By documenting these seams, the practitioner identifies where assumptions reside, effectively shifting the focus from the isolated parts to the interactions that govern system behavior. The evidence from 2000 shows that failing to map these boundaries leaves the system vulnerable to the silent accumulation of conditions that precede any catastrophic failure.

Testing the Constraints at the Seam

Nancy Leveson, through her 2012 STAMP framework at MIT Press, argues that safety must be managed as a control problem rather than a component problem. Testing the seam requires asking what each side of an interface assumes the other side guarantees, rather than merely verifying the functionality of the parts. A robust procedure mandates writing down these mutual guarantees so that the next person to inherit the system understands the assumptions built into the architecture. This approach acknowledges that safety is a control constraint on interaction, which is a fundamentally different perspective than viewing safety as a property of components. The 2012 work by Leveson demonstrates that testing these seams prevents the propagation of errors that occur when expectations are not explicitly aligned across the boundary. Prioritizing the interface over the component ensures that the control structure remains intact, effectively mitigating the risks that arise when assumptions remain hidden from view.

The Status of the Method

No serious dispute exists regarding the necessity of this procedure, as the evidence from the 2000 BMJ article and the 2012 STAMP framework remains unchallenged. The method relies on the established consensus that safety is a systemic property of controls and interfaces rather than a discrete attribute of individual parts. This chapter does not introduce a new claim but instead synthesizes the existing evidence to provide a practical guide for locating boundaries in any system.

Example: A bridge is not just its steel beams, but the specific, documented tension at the joints where those beams connect to the concrete foundation.

Verdict. Reliability is a property of interfaces, and safety is a control problem that requires explicit documentation of the assumptions held at every boundary.

Overturned if: A study replicates the STAMP framework and demonstrates that component-level failure analysis provides a more accurate predictor of systemic collapse than interface-boundary testing.

Sources. 2000 · Reason, J., "Human error: models and management" — PubMed/BMJ 320:768–770 · 2012 · Leveson, N.G., "Engineering a Safer World: Systems Thinking Applied to Safety" — MIT Press Open Access