STPA Analysis of Religion as a Social System¶

System-Theoretic Process Analysis Applied to the Systems Engineering Decomposition of Religion¶

Abstract¶

System-Theoretic Process Analysis (STPA) is a hazard analysis method developed by Nancy Leveson at MIT, based on the STAMP (Systems-Theoretic Accident Model and Processes) framework. STPA was designed for safety-critical engineering systems — aircraft, nuclear plants, medical devices — but its core logic applies wherever a complex system can produce unintended harmful outcomes through inadequate control rather than mere component failure. This paper applies STPA to religion, treated as a social system previously decomposed through a five-level systems engineering hierarchy. We define the system's losses, model its control structure, identify unsafe control actions across all four STPA categories, and trace loss scenarios to their causal factors. The result is a structural explanation of how religion — a system designed to provide meaning, morality, and community — can produce outcomes that are the exact opposite of its stated goals: meaninglessness, moral corruption, and social destruction.

1. Background: The SE Decomposition of Religion¶

1.1 The Five-Level Hierarchy¶

The following decomposition was established in prior work. It forms the input to the STPA analysis.

Level	ID	Description
Goal	G1	Provide existential meaning and purpose to human life
Goal	G2	Establish moral and ethical orientation for individuals and communities
Goal	G3	Create social cohesion and collective identity
Goal	G4	Offer psychological comfort in the face of suffering and mortality
Req.	R1	Coherent cosmological narrative (creation, afterlife, transcendence)
Req.	R2	Framework for interpreting personal experience as meaningful
Req.	R3	Codified behavioral norms (commandments, precepts, dharma)
Req.	R4	Authority structure to interpret and enforce norms
Req.	R5	Shared symbols, narratives, and practices for group bonding
Req.	R6	Mechanism for distinguishing in-group from out-group
Req.	R7	Rituals addressing grief, loss, and life transitions
Func.	F1	Mythological narration — transmit origin and eschatological stories
Func.	F2	Pastoral care — counsel individuals through crisis and life stages
Func.	F3	Moral legislation — define permissible and forbidden behavior
Func.	F4	Doctrinal governance — interpret scripture, settle disputes
Func.	F5	Ritual performance — enact shared ceremonies
Func.	F6	Missionary expansion — propagate belief system
Log.	L1	Liturgical Subsystem — scripture, preaching, ceremonial calendar
Log.	L2	Pastoral Subsystem — counseling, rites of passage, community support
Log.	L3	Doctrinal/Juridical Subsystem — theology, canon law, ethics boards
Log.	L4	Outreach Subsystem — evangelization, education, charity, media
Phys.	P1	Churches, mosques, temples, synagogues, gurdwaras
Phys.	P2	Sacred texts — Bible, Quran, Torah, Vedas, Tripitaka
Phys.	P3	Clergy — priests, imams, rabbis, pastors, monks, gurus
Phys.	P4	Parish networks, sanghas, congregations, umma structures
Phys.	P5	Central authorities — Vatican, Al-Azhar, ecumenical councils
Phys.	P6	Legal systems — canon law, fatwa apparatus, halakhic courts
Phys.	P7	Missionary organizations, madrasas, Sunday schools
Phys.	P8	Religious media — TV networks, podcasts, publishing houses

1.2 Why STPA?¶

Traditional risk analyses ask: "What component can fail?" STPA asks a different question: "What control actions, if inadequate, can lead to losses — even when every component is working as designed?" This is precisely the right question for religion, where the most devastating outcomes (inquisitions, abuse cover-ups, radicalization, exclusion of vulnerable people) typically occur not because the system has "broken" but because its control mechanisms are operating exactly as designed — just in a way that produces harm.

2. STPA Step 1: Define Purpose of the Analysis¶

2.1 System-Level Losses¶

STPA begins by identifying losses — outcomes that the system's stakeholders would consider unacceptable. For religion as a social system, we define:

Loss ID	Loss Description	Affected Goal
L1	Individuals suffer existential despair, alienation, or loss of meaning because of the religious system (not despite it)	Negates G1
L2	Moral harm — the system produces, enables, or conceals immoral behavior (abuse, violence, corruption, exploitation)	Negates G2
L3	Social destruction — the system causes division, persecution, hatred, or war between groups	Negates G3
L4	Psychological damage — the system inflicts trauma, guilt, fear, or mental illness on individuals	Negates G4
L5	Loss of institutional legitimacy — the system loses the trust and authority it needs to function	Negates all
L6	Suppression of truth — the system suppresses scientific knowledge, critical thinking, or individual conscience	Negates G1, G2

Note: each loss is the negation of a system goal. This is the defining feature of STPA applied to social systems — the hazards are not external threats but self-inflicted contradictions where the system's own control actions produce outcomes opposite to its stated purpose.

2.2 System-Level Hazards¶

Hazards are system states that, combined with worst-case environmental conditions, lead to losses. We derive them from the SE requirements:

Hazard ID	Hazard Description	Related Losses
H1	Doctrine becomes unfalsifiable and self-sealing — no internal mechanism can correct doctrinal errors	L1, L2, L6
H2	Authority structure becomes unaccountable — no effective oversight of those who interpret and enforce norms	L2, L4, L5
H3	In-group/out-group mechanism escalates to dehumanization of outsiders	L3
H4	Moral legislation becomes absolutist — no allowance for context, conscience, or evolving understanding	L1, L2, L4
H5	Pastoral care relationship is exploited — power asymmetry enables abuse	L2, L4, L5
H6	Missionary function prioritizes expansion over welfare of converts or target populations	L2, L3
H7	Financial resources are extracted from vulnerable populations without accountability	L2, L5
H8	Ritual performance becomes coercive — participation is compelled, not voluntary	L1, L4

2.3 System-Level Constraints¶

Each hazard implies a constraint — a condition the system must maintain to prevent the hazard:

Constraint ID	Constraint	Prevents Hazard
SC1	Doctrine must include mechanisms for self-correction, reinterpretation, and engagement with external knowledge	H1
SC2	Authority figures must be subject to transparent oversight, accountability, and removal procedures	H2
SC3	In-group/out-group distinctions must not extend to denial of outsiders' human dignity or rights	H3
SC4	Moral legislation must preserve space for individual conscience and contextual judgment	H4
SC5	Pastoral relationships must have safeguards: codes of conduct, mandatory reporting, external recourse	H5
SC6	Missionary activity must respect the autonomy and existing culture of target populations	H6
SC7	Financial management must be transparent, audited, and separated from spiritual authority	H7
SC8	Ritual participation must be voluntary, with no material or social penalty for non-participation	H8

3. STPA Step 2: Model the Control Structure¶

3.1 The STAMP Control Structure¶

STAMP models systems as hierarchical control structures where controllers issue control actions to controlled processes, and receive feedback. For religion:

                    ┌─────────────────────────────┐
                    │   CENTRAL DOCTRINAL          │
                    │   AUTHORITY (L3, P5, P6)     │
                    │   Vatican / Al-Azhar /       │
                    │   Ecumenical Councils        │
                    │                              │
                    │   Process Model:             │
                    │   - Doctrine is correct      │
                    │   - Faithful are obedient    │
                    │   - External world is         │
                    │     spiritually deficient    │
                    └──────────┬──────────┬────────┘
              Control Actions: │          │ Feedback:
              - Doctrine       │          │ - Reports from clergy
              - Canon law      │          │ - Synod deliberations
              - Appointments   │          │ - Petitions, appeals
              - Excommunication│          │ - (often: self-confirming)
                               ▼          │
                    ┌─────────────────────────────┐
                    │   REGIONAL/LOCAL CLERGY      │
                    │   (L1, L2, P3)               │
                    │   Bishops, Imams, Rabbis,    │
                    │   Pastors, Monks             │
                    │                              │
                    │   Process Model:             │
                    │   - My authority comes from   │
                    │     above                    │
                    │   - Congregation needs        │
                    │     guidance                 │
                    │   - Doubt is dangerous       │
                    └──────────┬──────────┬────────┘
              Control Actions: │          │ Feedback:
              - Sermons        │          │ - Confession/counseling
              - Pastoral rules │          │ - Attendance patterns
              - Sacraments     │          │ - Donations
              - Social pressure│          │ - Complaints (often
              - Shunning       │          │   suppressed)
                               ▼          │
                    ┌─────────────────────────────┐
                    │   CONGREGATIONAL COMMUNITY   │
                    │   (L1, L2, P4)               │
                    │   Parish networks, sanghas,  │
                    │   congregations              │
                    │                              │
                    │   Process Model:             │
                    │   - Social norms are          │
                    │     religiously grounded     │
                    │   - Conformity = belonging   │
                    │   - Dissent = exile          │
                    └──────────┬──────────┬────────┘
              Control Actions: │          │ Feedback:
              - Social norms   │          │ - Behavior observation
              - Peer pressure  │          │ - Gossip/reputation
              - Inclusion/     │          │ - Attendance
                exclusion      │          │ - Participation
                               ▼          │
                    ┌─────────────────────────────┐
                    │   INDIVIDUAL BELIEVER        │
                    │                              │
                    │   Process Model:             │
                    │   - Faith provides meaning   │
                    │   - Clergy speak for God     │
                    │   - Doubt is sinful          │
                    │   - Suffering has purpose    │
                    └─────────────────────────────┘

3.2 Why these control loops — and why only these?¶

The test for a control loop¶

STPA imposes three necessary conditions on every arrow in a control structure. All three must hold simultaneously; failure of any one disqualifies the relationship from being modelled as a control loop:

Controller (authority condition): the upstream element issues observable, authoritative control actions — directives the downstream element is structurally expected to obey, not merely influence it may choose to consider.
Controlled process (response condition): the downstream element's state is expected to change in response to those control actions as part of normal system operation.
Feedback channel (closure condition): some signal — however weak, delayed, or filtered — travels back from the controlled process to the controller and can in principle update the controller's process model.

A relationship that passes all three tests is a control loop and must be modelled. A relationship that fails any one test is modelled differently: as peer coordination (aggregated into an existing feedback channel), as an environmental disturbance, or as a belief inside a controller's process model.

Applying the test to the SE decomposition¶

The four loops follow directly from applying these three conditions to the physical elements named in §1.1. The authority source that makes relationships authoritative rather than merely influential in every case is R4 ("authority structure to interpret and enforce norms") — a requirement the system itself specifies.

Loop	Controller	Controlled Process	Condition 1: authority	Condition 2: state change	Condition 3: feedback
1	Central Authority (P5, P6)	Clergy (P3)	R4 + claimed divine mandate; clergy bound under canon law / fatwa / denominational discipline	Clergy doctrine, appointments, removal — clergy behaviour demonstrably changes in response	Reports from clergy, synod deliberations, petitions (filtered but structurally present)
2	Clergy (P3)	Congregation (P4)	R4 delegated downward; authority to preach, administer sacraments, impose social discipline	Congregation attendance, expressed belief, ritual participation change in response	Confession, counselling, donation levels, attendance — reach clergy as indirect behavioural signals
3	Congregation (P4)	Individual	R5, R6 (shared identity, in/out-group enforcement); peer authority over social standing and belonging	Individual's public behaviour, expressed belief, ritual participation change to maintain belonging	Gossip, reputation signals, observation of conformity or deviance feed back to community process model
4	Individual (self)	Own behaviour	Internalised R1–R3; conscience acts as an internal authority that the person is expected — by the system's own design — to obey	Own behaviour, choices, emotional state, and spiritual self-assessment change	Emotional feedback: guilt, consolation, doubt — conscience functions as internal sensor closing the loop

These are the only four pairs in §1.1 where one element holds designated authority to issue control actions the other is structurally expected to obey. Remove any loop and the transmission path from doctrine to individual behaviour breaks — no alternative channel carries an authoritative control action all the way to the individual.

Why every other plausible relationship fails the test¶

The table below applies the three conditions to every candidate relationship commonly raised when this control structure is presented. In every case the candidate fails at least Condition 1.

Candidate relationship	Fails condition	Reason
Clergy ↔ Clergy (lateral, same rank)	1 — authority	Clergy of equal rank do not issue authoritative control actions to each other. Synods, councils, and theological deliberations are coordination inputs that aggregate into Loop 1's feedback channel, not independent loops. Where genuine rank differences exist (bishop over priest, abbot over monk), the relationship resolves to Loop 1 or Loop 2 at finer granularity — not a new, fifth loop.
Congregation ↔ Congregation (between parishes)	1 — authority	Parish networks are parallel peers. No congregation holds designated authority over another. Binding coordination between congregations routes through Loop 1 — the central authority that owns both. Direct inter-congregational social pressure carries no structural control action.
Individual or congregation → Authority (upward)	1 — authority	In the hierarchical institutional form this analysis targets, laity have no structural authority to issue control actions upward. Their upward channel is feedback, already represented in every loop. Note: congregationalist polities (Quaker, many Baptist, Reform Jewish) genuinely invert Loop 1 — authority flows from the congregation upward. Those constitute a genuinely different control structure under the same family name and require their own analysis.
God → Authority	1 — authority	The system claims this loop, but divine control actions are not observably issued or measurably received. What actually operates is the Authority's belief that it is divinely controlled — a feature of the Authority's process model (shown inside the top box of the diagram), not a separate causal loop. STPA models what exists in the causal structure, not what is asserted.
Civil state / science / secular media	1 — authority	These elements lie in the system's environment. They can disturb the system or supply external corrective signals, but they do not issue control actions the religion is architecturally bound to obey. They appear in §7 as externally imposed circuit breakers, not as internal control loops.
Other religions	1 — authority	No cross-denominational structural authority exists by definition of denomination. Influence between traditions is cultural and bilateral; control is absent in both directions.
Schism / sect formation	Not a loop at all	This is a phase transition, not a control relationship. When Loop 1 fails to correct accumulating error, a fragment of the controlled process exits the hierarchy entirely and becomes the apex of a new control structure. Schism is a symptom of loop failure (analysed in §5), not a sixth relationship within the existing hierarchy.
The upward feedback arrows on each loop	Not a new loop	Every loop already includes a feedback channel (the upward arrows in the diagram). Those arrows satisfy Condition 3 of their respective loop. They do not satisfy Condition 1 of a new loop — feedback is not control. Treating them as control would mean the congregation governs the clergy and the clergy governs the central authority, which is structurally false in the institutional form under analysis.

A different decomposition — congregational polity, decentralised charismatic movement, household-religion — would yield a different control structure with different loops. Within the hierarchical institutional decomposition analysed here, no fifth loop exists, because no fifth pair of elements satisfies all three conditions simultaneously.

3.3 Key Observations about the Control Structure¶

Feedback poverty at the top. The Central Doctrinal Authority receives feedback primarily through its own appointees (clergy), who have incentives to report compliance rather than problems. External feedback (scientific findings, secular criticism, abuse reports) is structurally classified as hostile input, not corrective signal.

Asymmetric power at every level. Each controller has significantly more power over the controlled process than the controlled process has to send corrective feedback upward. This is by design (R4: authority to interpret and enforce), but it means that control errors propagate downward unchecked.

Self-confirming process models. At every level, the controller's mental model of the controlled process contains built-in resistance to disconfirmation. If a believer doubts, the model says "doubt is temptation" — the model explains away the very feedback that would correct it.

4. STPA Step 3: Identify Unsafe Control Actions¶

STPA categorizes unsafe control actions (UCAs) into four types:

Not providing a control action that is needed
Providing a control action that causes a hazard
Providing a control action too early, too late, or out of sequence
Providing a control action that is applied too long or stopped too soon

4.1 UCAs for Central Doctrinal Authority → Clergy¶

UCA ID	Type	Unsafe Control Action	Hazard
UCA-1	Not provided	Authority does NOT update doctrine when scientific evidence invalidates cosmological claims (e.g., geocentrism, age of earth, evolution)	H1
UCA-2	Not provided	Authority does NOT remove or discipline clergy credibly accused of abuse	H2, H5
UCA-3	Provided	Authority ISSUES doctrine that dehumanizes outsiders (infidels, heretics, apostates as subhuman or damned)	H3
UCA-4	Provided	Authority EXCOMMUNICATES or PUNISHES members who raise legitimate doctrinal questions	H1, H4
UCA-5	Provided	Authority APPOINTS clergy based on doctrinal loyalty rather than pastoral competence or moral character	H2, H5
UCA-6	Too late	Authority CORRECTS a doctrinal error only after centuries of harm (e.g., Galileo rehabilitation in 1992, 359 years late)	H1, H6
UCA-7	Too long	Authority MAINTAINS absolutist moral prohibition long after ethical understanding has evolved (e.g., blanket prohibitions that cause measurable suffering)	H4
UCA-8	Not provided	Authority does NOT establish transparent financial auditing of religious institutions	H7

4.2 UCAs for Clergy → Congregation¶

UCA ID	Type	Unsafe Control Action	Hazard
UCA-9	Provided	Clergy USES pastoral relationship to sexually, emotionally, or financially exploit vulnerable individuals	H5
UCA-10	Provided	Clergy PREACHES hatred or contempt toward out-groups (other religions, LGBTQ+ persons, ethnic minorities, apostates)	H3
UCA-11	Provided	Clergy WITHHOLDS sacraments or pastoral care as punishment for questioning doctrine	H1, H4, H8
UCA-12	Not provided	Clergy does NOT provide pastoral support during genuine crisis (grief, mental illness, abuse) because doctrinal framework has no model for the problem	H4
UCA-13	Provided	Clergy DEMANDS financial contributions from impoverished believers through spiritual coercion (prosperity gospel, indulgences, obligatory tithing)	H7
UCA-14	Too long	Clergy MAINTAINS shunning of excommunicated member long after the person has suffered disproportionate social death	H4, L3
UCA-15	Not provided	Clergy does NOT report abuse to civil authorities, instead handling it "internally"	H2, H5

4.3 UCAs for Congregation → Individual¶

UCA ID	Type	Unsafe Control Action	Hazard
UCA-16	Provided	Congregation SHUNS member who expresses doubt, questions doctrine, or leaves the faith	H1, H4, H8
UCA-17	Provided	Congregation ENFORCES social conformity on matters of personal conscience (dress, diet, relationships, career choices) through gossip and exclusion	H4, H8
UCA-18	Not provided	Congregation does NOT intervene when they observe clergy abusing a member	H2, H5
UCA-19	Provided	Congregation PRESSURES children into public faith commitments (baptism, confirmation, bar mitzvah) before they can meaningfully consent	H8
UCA-20	Too early	Congregation LABELS children as sinful, damned, or spiritually deficient at a developmentally inappropriate age	H4

4.4 UCAs for Individual (Self-Control / Internalized Beliefs)¶

UCA ID	Type	Unsafe Control Action	Hazard
UCA-21	Provided	Individual SUPPRESSES legitimate doubt, curiosity, or moral intuition because they have internalized "doubt = sin"	H1, H6
UCA-22	Provided	Individual REMAINS in an abusive religious environment because they believe leaving = damnation	H4, H5
UCA-23	Not provided	Individual does NOT seek professional mental health support because the religious framework teaches that faith alone should suffice	H4
UCA-24	Provided	Individual REJECTS medical treatment for self or dependents based on doctrinal prohibition	H4, L1
UCA-25	Too long	Individual CONTINUES religious practices that cause measurable psychological harm (extreme fasting, self-flagellation, sleep deprivation) beyond any devotional purpose	H4

5. STPA Step 4: Identify Loss Scenarios¶

Each UCA has causal factors — the reasons why the unsafe control action occurs. STPA organizes these into two categories:

A. Why would the controller issue the UCA? (Flawed process model, incorrect feedback, conflicting goals)

B. Why would the control action not be executed properly? (Communication failure, implementation breakdown)

5.1 Loss Scenario LS-1: Doctrine Fails to Self-Correct (UCA-1, UCA-6 → H1 → L1, L6)¶

The scenario: Central authority maintains a cosmological or moral doctrine that contradicts established scientific evidence or evolved ethical understanding. Believers experience cognitive dissonance between their faith and their knowledge, leading to either intellectual suppression (L6) or loss of faith and meaning (L1).