STPA enabled safety assessment in the architecting of complex systems

Figures & data

Table 1. Review of STPA methods.

Method	Diagrams & Tables	Traceability	Automation
A-STPA	Yes	No	No
(Abdulkhaleq, 2014)
XSTAMPP	Yes	No	No
(SE-Stuttgart, 2019)
An STPA tool (Thomas & Suo, 2015)	Yes	No	Context table, conflicts, requirements
SAHRA	Yes	Yes	No
(Krauss, Rejzek, Senn, et al., 2016)
(Krauss, Rejzek, Reif, et al., 2016)
Risk Management Studio	Yes	Yes	List of control actions
(Risk Management Studio, 2019)
(Björnsdóttir & Rejzek, 2017)
STAMP Workbench	Yes	No	No
(Information-technology Promotion Agency, Japan, 2018)
Astah System Safety	Yes	No	No
(Astah, 2021)
CAIRIS	Yes	Yes	No
(Shamal Faily, 2021)
SafetyHAT	Yes	No	No
(Volpe National Transportation Systems Center, 2014)
Abdellatif and Holzapfel (Abdellatif & Holzapfel, 2021)	Yes	No	Components in hierarchy, some verification
WebSTAMP (Souza, Pereira, et al., 2019)	Yes	Yes	Context table, guidewords for scenarios
Method to Automate Generation of Safety Requirements	No	No	Context table, conflicts, requirements
(Thomas, 2013)
(Thomas & Leveson, 2013)
Rule-Based Approach for STPA (Gurgel et al., 2015)	No	No	Context table, guidewords for scenarios

Figure 1. Example of a logical flow view.

Figure 2. Example of a hierarchical view.

Figure 3. Example of a hierarchical control model.

Figure 4. Links in the extended generic control loop.

Table 2. Classification of control loop links.

Link type	From	To
(1) Controller Inputs from Sensors	A sensor in the loop ${\Sigma }_{S_{\kappa }}$	Controller κ
(2) Controller Inputs from Higher-Level Controllers	A controller in ${\Sigma }_{I{\prime }_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to κ and higher than κ in the controller hierarchy	Controller κ
(3) Controller Inputs from Same-Level Controllers	A controller in ${\Sigma }_{I{\prime }_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to κ and at the same levels as κ in the controller hierarchy	Controller κ
(4) Controller Inputs from Other Process Solutions	Solutions in ${\Sigma }_{I{\prime }_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to κ and that are not controllers	Controller κ
(5) Controller Outputs to Actuators	Controller κ	An actuator in ${\Sigma }_{A_{\kappa }}$
(6) Controller Outputs to Higher-Level Controllers	Controller κ	A controller in ${\Sigma }_{I{\prime }_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to κ and higher than κ in the controller hierarchy
(7) Controller Outputs to Same-Level Controllers	Controller κ	A controller in ${\Sigma }_{I{\prime }_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to κ and at the same levels as κ in the controller hierarchy
(8) Controller Outputs to Other Process Solutions	Controller κ	A solution in ${\Sigma }_{I_{\kappa }}\setminus {\Sigma }_{A_{\kappa }}$ with a direct link to κ
(9) Actuators Inputs from Sensors*	A sensor in the loop ${\Sigma }_{S_{\kappa }}$	An actuator in ${\Sigma }_{A_{\kappa }}$
(10) Actuators Inputs from Other Process Solutions*	A solution in ${\Sigma }_{I{\prime }_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to an actuator in ${\Sigma }_{A_{\kappa }}$	An actuator in ${\Sigma }_{A_{\kappa }}$
(11) Actuators Inputs from Other Controllers*	A controller in ${\Sigma }_{I{\prime }_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to an actuator in ${\Sigma }_{A_{\kappa }}$ and that is not a controller	An actuator in ${\Sigma }_{A_{\kappa }}$
(12) Actuators Outputs to Other Process Solutions*	An actuator in ${\Sigma }_{A_{\kappa }}$	A solution in ${\Sigma }_{I_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to an actuator in ${\Sigma }_{A_{\kappa }}$ and that is not a controller
(13) Actuators Outputs to Other Controllers*	An actuator in ${\Sigma }_{A_{\kappa }}$	A controller in ${\Sigma }_{I_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to an actuator in ${\Sigma }_{A_{\kappa }}$
(14) Sensors Inputs from Actuators*	An actuator in ${\Sigma }_{A_{\kappa }}$	A sensor in ${\Sigma }_{S_{\kappa }}$
(15) Sensors Inputs from Other Process Solutions*	A solution in ${\Sigma }_{I{\prime }_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to a sensor in ${\Sigma }_{S_{\kappa }}$ and that is not a controller	A sensor in ${\Sigma }_{S_{\kappa }}$
(16) Sensors Inputs from Other Controllers*	A controller in ${\Sigma }_{I{\prime }_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to a sensor in ${\Sigma }_{S_{\kappa }}$	A sensor in ${\Sigma }_{S_{\kappa }}$
(17) Sensors Outputs to Other Process Solutions*	A sensor in ${\Sigma }_{S_{\kappa }}$	A solution in ${\Sigma }_{I_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to a sensor in ${\Sigma }_{S_{\kappa }}$ and that is not a controller
(18) Sensors Outputs to Other Controllers*	A sensor in ${\Sigma }_{S_{\kappa }}$	A controller in ${\Sigma }_{I_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to a sensor in ${\Sigma }_{S_{\kappa }}$
(19) Process Inputs from Actuators	An actuator in ${\Sigma }_{A_{\kappa }}$	A solution in ${\Sigma }_{P_{\kappa }}$
(20) Process Inputs from Other Process Solutions	A solution in ${\Sigma }_{I{\prime }_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to a solution in ${\Sigma }_{S_{\kappa }}$ and that is not a controller	A solution in ${\Sigma }_{P_{\kappa }}$
(21) Process Inputs from Other Controllers	A controller in ${\Sigma }_{I{\prime }_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to a solution in ${\Sigma }_{S_{\kappa }}$	A solution in ${\Sigma }_{P_{\kappa }}$
(22) Process Outputs to Sensors	A solution in ${\Sigma }_{P_{\kappa }}$	A sensor in ${\Sigma }_{S_{\kappa }}$
(23) Process Outputs to Other Process Solutions	A solution in ${\Sigma }_{P_{\kappa }}$	A solution in ${\Sigma }_{I_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to a solution in ${\Sigma }_{S_{\kappa }}$ and that is not a controller
(24) Process Outputs to Other Controllers	A solution in ${\Sigma }_{P_{\kappa }}$	A controller in ${\Sigma }_{I_{\kappa }}\setminus {\Sigma }_{L_{\kappa }}$ with a direct link to a solution in ${\Sigma }_{S_{\kappa }}$

Figure 5. Example of a detailed control loop.

Figure 6. WBS systems architecture in AirCADia Architect.

Figure 7. Control hierarchy obtained by AirCADia Architect.

Table 3. Control commands in the control hierarchy.

From	To	Original signals	AirCADia signals
Crew	BSCU	Power on/off	Power on/off
Crew	Autobrake	Arm and Set	Arm and Set
		Disarm	Disarm
Crew	Hydraulic Controller	Brake (pedal)	Brake 1 & 2 (x2)
Crew	WBS Hydraulics	Brake (pedal)	Brake 1 & 2
Autobrake	Hydraulic Controller	Brake command	Control command (x2)
	Process Node	–	Control command
Hydraulic Controller	WBS Hydraulics	Open/Close green valve	–
		Green position command	Brake command
		Open/Close blue valve	Anti-skid command
Hydraulic Controller	Hydraulic Controller	–	Brake command (x2)
		–	Anti-skid command (x2)
WBS Hydraulics	Wheels	Braking Force	Braking Force (x2)
Wheels	WBS Hydraulics	–	Wheel Speed
Aircraft	Autobrake	Touchdown	–
		Rejected take-off	–

Table 4. Feedback signals in the control hierarchy.

From	To	Original signals	AirCADia signals
Autobrake	Crew	Activated status	Activated status
		Armed status	Armed status
		Programmed deceleration	Programmed deceleration
		–	Fault detected
Hydraulic controller	Crew	Fault detected	Fault detected (x2)
WBS Hydraulics	Crew	Braking mode	Braking mode
Process	Crew	–	Fault detected
Hydraulic controller	Autobrake	Manual braking status	Manual braking status
		Wheel speed	–
Wheels	Autobrake	–	Wheel speed
Process	Autobrake	–	Touchdown
		–	Rejected take-off
Wheels	Hydraulic controller	Wheel speed	Wheel speed
Process	Hydraulic controller	–	Manual brake (x2)
		–	Validity signal (x2)
		–	Electrical power (x2)

Table 5. Signals in the crew control loop.

From	To	Original signals	AirCADia signals
Controller Inputs from Sensors
Annunciation	Crew	Fault Detected	Fault Detected
Annunciation	Crew	Braking mode	–
Annunciation	Crew	Autobrake activated	Autobrake activated
Annunciation	Crew	Autobrake armed	Autobrake armed
Annunciation	Crew	Autobrake deccel. rate	Autobrake deccel. rate
Controller Inputs from Other Process Solutions
Unspecified	Crew	Various signals	–
Controller Outputs to Actuators
Crew	Pedals Left Seat	Manual Braking	Manual Braking
Crew	Pedals Right Seat	Manual Braking	Manual Braking
Process Inputs from Actuators
Pedals Left Seat	Blue Metre Valve	–	Mechanical Position
Pedals Right Seat	Blue Metre Valve	–	Mechanical Position
Pedals Left Seat	CMD1	–	Brake Command
Pedals Right Seat	CMD1	–	Brake Command
Pedals Left Seat	MON1	–	Brake Command
Pedals Right Seat	MON1	–	Brake Command
Pedals Left Seat	CMD2	–	Brake Command
Pedals Right Seat	CMD2	–	Brake Command
Pedals Left Seat	MON2	–	Brake Command
Pedals Right Seat	MON2	–	Brake Command
Process Inputs from Other Process Solutions
PSU	CMD1	–	Electrical Output
PSU	MON1	–	Electrical Output
PSU	CMD2	–	Electrical Output
PSU	MON2	–	Electrical Output
PSU	Validity Monitor	–	Electrical Output
PSU	Validity Monitor	–	Electrical Output
Process Outputs to Sensors
Aircraft	AutoBrake	–	Touch Down Signal
Aircraft	AutoBrake	–	Rejected Take-Off Signal
Validity Monitor	Annunciation	–	Fault Signal
Spring Loaded Selector	Annunciation	–	Braking Mode Signal

Abdulkhaleq, A. (2014, March). An open tool support for system-theoretic process analysis. MIT, Boston. Retrieved May 25, 2021, from http://psas.scripts.mit.edu/home/wp-content/uploads/2014/03/Asim_A-STPA.pdf

 Google Scholar

SE-Stuttgart. (2019, June). XSTAMPP. Retrieved March 31, 2021, from https://github.com/SE-Stuttgart/XSTAMPP

 Google Scholar

Thomas, J., & Suo, D. (2015, March). A tool-based STPA process. Retrieved May 01, 2021, from http://psas.scripts.mit.edu/home/wp-content/uploads/2015/03/Thomas-Suo-Tool-based-STPA-process.pdf

 Google Scholar

Krauss, S. S., Rejzek, M., Senn, C. W., & Hilbes, C. (2016). SAHRA – An integrated software tool for STPA. In 4th European STAMP Workshop. Zurich, Switzerland. https://doi.org/10.21256/zhaw-4926

 Google Scholar

Krauss, S. S., Rejzek, M., Reif, M. U., & Hilbes, C. (2016). Towards a modeling language for Systems-Theoretic Process Analysis (STPA): Proposal for a domain specific language (DSL) for model driven Systems-Theoretic Process Analysis (STPA) based on UML. https://doi.org/10.21256/ZHAW-1175

 Google Scholar

Risk Management Studio. (2019). STPA software solution – Risk management studio. Retrieved March 31, 2021, from https://www.riskmanagementstudio.com/stpa-software-solution/#

 Google Scholar

Björnsdóttir, S. H., & Rejzek, M. (2017, March). Embedding STPA into a highly successful risk management software application. In 6th MIT STAMP Workshop. ZHAW Zürcher Hochschule für Angewandte Wissenschaften. https://doi.org/10.21256/ZHAW-3306

 Google Scholar

Information-technology Promotion Agency, Japan. (2018). STAMP Workbench 1.0.1 Documentation. Retrieved March 31, 2021, from https://www.ipa.go.jp/sec/stamp_wb/manual_en/tutorial/basic/basic.html

 Google Scholar

Astah. (2021, February). Astah system safety. Retrieved March 31, 2021, from https://astah.net/products/astah-system-safety/

 Google Scholar

Shamal Faily. (2021). CAIRIS 2.3.8 documentation. Retrieved May 01, 2021, from https://cairis.readthedocs.io/en/latest/stpa.html

 Google Scholar

Volpe National Transportation Systems Center. (2014). SafetyHAT: A transportation system safety hazard analysis tool. Retrieved May 01, 2021, from https://www.volpe.dot.gov/infrastructure-systems-and-technology/advanced-vehicle-technology/safetyhat-transportation-system

 Google Scholar

Abdellatif, A. A., & Holzapfel, F. (2021, January). The utilization of STPA techniques for system design safety enhancement. In AIAA Scitech 2021 Forum. American Institute of Aeronautics and Astronautics. https://doi.org/10.2514/6.2021-0565

 Google Scholar

Souza, F. G., Pereira, D. P., Pagliares, R. M., Nadjm-Tehrani, S., & Hirata, C. M. (2019). WebSTAMP: A web application for STPA & STPA-Sec. MATEC Web of Conferences, 273, 02010. https://doi.org/10.1051/matecconf/201927302010

 Google Scholar

Thomas, J. (2013). Extending and automating a systems-theoretic hazard analysis for requirements generation and analysis. [Doctoral dissertation]. Massachusetts Institute of Technology. Retrieved May 01, 2021, from https://dspace.mit.edu/handle/1721.1/81055

 Google Scholar

Thomas, J., & Leveson, N. (2013). Generating formal model-based safety requirements for complex, software- and human-intensive systems. Safety-Critical Systems Club. Retrieved March 28, 2021 http://sunnyday.mit.edu/SSS-conference-stpa.pdf

 Google Scholar

Gurgel, D. L., Hirata, C. M., & De M. Bezerra, J. (2015, September). A rule-based approach for safety analysis using STAMP/STPA. In 2015 IEEE/AIAA 34th Digital Avionics Systems Conference (DASC) (p. 7B2-1-7B2-8). https://doi.org/10.1109/DASC.2015.7311464

 Google Scholar