System-Theoretic Process Analysis Research Articles

An integrated system theoretic process analysis with multilevel flow modeling for the identification of cyber‐physical hazards in a process industry

AbstractThe deep integration of information technology and process industry production systems makes system failure increasingly multi‐source and multi‐scale. In contrast to conventional hazard methods, system theoretic process analysis (STPA) can analyze the hazards in system control processes from the perspective of interactions among the system components. Theoretically, this method offers advantages that are better suited for modern production systems. However, as of now, the integration between STPA and process industrial production systems is still lacking. To address this issue, this study improved the original STPA method. First, we propose the “5 flows” concept for the process industrial cyber‐physical systems. The systems are described using multilevel flow modeling (MFM). This leads to the development of the MSTPA method, which is specifically designed to analyze the cyber‐physical hazards in process industrial production systems. Subsequently, the cyber‐physical hazards of a fluidized‐bed catalytic cracking unit are analyzed in detail using the MSTPA method as an example. The results show that MSTPA can identify cyber‐physical hazards in multiple dimensions. It is proved that, compared with the original STPA and traditional hazard methods, the MSTPA method can better identify cyber‐physical hazards in process industrial production systems.

STPA-RL: Integrating Reinforcement Learning into STPA for Loss Scenario Exploration

Experience-based methods like reinforcement learning (RL) are often deemed less suitable for the safety field due to concerns about potential safety issues. To bridge this gap, we introduce STPA-RL, a methodology that integrates RL with System-Theoretic Process Analysis (STPA). STPA is a safety analysis technique that identifies causative factors leading to unsafe control actions and system hazards through loss scenarios. In the context of STPA-RL, we formalize the Markov Decision Process based on STPA analysis results to incorporate control algorithms into the system environment. The agent learns safe actions through reward-based learning, tracking potential hazard paths to validate system safety. Specifically, by analyzing various loss scenarios related to the Platform Screen Door, we assess the applicability of the proposed approach by evaluating hazard trajectory graphs and hazard frequencies in the system. This paper streamlines the RL process for loss scenario identification through STPA, contributing to self-guided loss scenarios and diverse system modeling. Additionally, it offers effective simulations for proactive development to enhance system safety and provide practical assistance in the safety field.

Cast analysis – floodings in Piracicaba, Brazil (summer 2020)

There have been several flood events in our country, notably in the Southeast Region, in the last decades, where the public management faces natural causes, such as storms with heavy rains and winds, causing landslides, flooding in urban centers and, consequently, losses. According to Leveson (2019, p. 34):  CAST (Causal Analysis Based on Systems Theory) is a structured technique to analyse accident causality from a systems perspective. CAST is an analysis method, not an investigation technique. But performing the CAST analysis as the investigation proceeds will assist in identifying what questions need to be answered and what information needs to be gathered during the investigation in order to create a comprehensive explanation as to why the loss occurred and to help formulate recommendations to prevent related accidents in the future. The CAST, as an approach after the occurrence, links to STPA (System-Theoretic Process Analysis) methodology (prior to the accident). This aims to analyse an event – which may or may not result in an accident – the way that its parts, acting systemically, can be studied, reaching the confrontation of the insecure condition(s) through effective actions. The /CAST methodology was herein applied to the event “Floods in the summer of 2020 in Piracicaba/SP”. This event provides analysis completeness, according to this model. Several intervening factors are sought in this study; the accident considered here are the floods that generated material losses in the city: e.g. destroyed buildings, streets and houses flooded, leading to losses.

Complying with ISO 26262 and ISO/SAE 21434: A Safety and Security Co-Analysis Method for Intelligent Connected Vehicle.

A cyber-physical system (CPS) integrates communication and automation technologies into the operational processes of physical systems. Nowadays, as a complex CPS, an intelligent connected vehicle (ICV) may be exposed to accidental functional failures and malicious attacks. Therefore, ensuring the ICV's safety and security is crucial. Traditional safety/security analysis methods, such as failure mode and effect analysis and attack tree analysis, cannot provide a comprehensive analysis for the interactions between the system components of the ICV. In this work, we merge system-theoretic process analysis (STPA) with the concept phase of ISO 26262 and ISO/SAE 21434. We focus on the interactions between components while analyzing the safety and security of ICVs to reduce redundant efforts and inconsistencies in determining safety and security requirements. To conquer STPA's abstraction in describing causal scenarios, we improved the physical component diagram of STPA-SafeSec by adding interface elements. In addition, we proposed the loss scenario tree to describe specific scenarios that lead to unsafe/unsecure control actions. After hazard/threat analysis, a unified risk assessment process is proposed to ensure consistency in assessment criteria and to streamline the process. A case study is implemented on the autonomous emergency braking system to demonstrate the validation of the proposed method.

Safety analysis of evaluation and acceptance processes for space systems and operations based on system-theoretic approach

The proposed analysis consists of identifying systemic aspects that can influence safety and mission fulfillment in the Evaluation and Acceptance Processes of Space Systems and Operations for Launch through the application of System-Theoretic Process Analysis, a technique capable of identifying potential hazardous design and operational flaws, including system design errors and unsafe interactions among multiple procedures and system components. This research identifies losses, hazards, system-level safety constraints, the control structure of the general system, unsafe control actions, loss scenarios that could occur and related causal factors, detecting improvement possibilities for future verifications, evaluations, approvals, and acceptances of space systems and launch operations. These findings can promote safety in space system designs and operations, supporting the activities conducted by launch vehicle and payload developers, certification authorities, and launch centers management, enabling means to proactively act in order to mitigate risks, avoiding unsafe actions and undesired system behaviors, or even to mitigating their consequences. The practical applications of this work can result in safety and mission fulfillment improvements for safety management systems, launch approval regulations and standards; launch operation procedures; space systems design; vehicle, payload, and ground support equipment productions; systems testing; and launch authorization processes.

Operational safety hazard identification methodology for automated driving systems fleets

The safety of Automated Driving Systems (ADS) operating as Mobility as a Service (MaaS) depends on multiple factors in addition to the vehicle’s functionality, reliability, and performance. Currently, no comprehensive approach has been formally developed to identify operational safety hazards and define the operational safety responsibilities of the key agents involved in Level 4 (L4) ADS MaaS operations. This work develops and applies a structured hazard identification methodology for this operation. The methodology leverages and complements the strengths of various hazard identification and modeling methods, including Event Sequence Diagram (ESD), Concurrent Task Analysis (CoTA), System-Theoretic Process Analysis (STPA), and Fault Tree Analysis (FTA). The methodology is applied to analyze the operation of a fleet of L4 ADS vehicle fleets without a safety driver, monitored and supervised by remote operators. The results highlight the fleet operator’s role in ensuring the correct vehicle operation and preventing and mitigating incidents. The analysis demonstrates the developed methodology’s strengths and suitability for operational safety analysis of complex systems’ operations, considering the inherent complexity of the interactions between multiple human and machine agents.

Human-autonomy collaboration in supervisory risk control of autonomous ships

This paper presents a method for developing and testing a risk-based control system, as a first step towards including the human supervisor explicitly in the design of the system. The result is a control system with improved decision-making capabilities compared to existing control systems. The methodology presented in the paper uses the Systems Theoretic Process Analysis (STPA) to analyse the risks of an autonomous ship within its concept of operations (CONOPS), and a Human-STPA (H-STPA) is used to analyse human responsibilities and involvement. The STPA results are then used to construct a Bayesian belief network (BBN)-based risk model to assess the operational risk of the ship. This is represented as a risk cost, describing the expected cost of consequences caused by potential hazardous events. This cost is combined with fuel costs, operations costs, and the potential loss of income if new missions are not undertaken using a supervisory risk controller (SRC). The SRC is capable of making decisions about how the ship should be safely operated and notifies the human supervisor in due time when it is necessary for them to take control. The last part of the methodology presented in this paper is testing the control system using a set of verification objectives based on results from the STPA and H-STPA. A case study involving an autonomous cargo ship with a human supervisor located in a remote operation center (ROC) is included; it shows that the proposed control system can operate the ship safely in different conditions and situations. By designing the SRC to notify the human supervisor before it reaches its operational limit, the ship is able to operate in a wider range of conditions compared to when just the autonomous control system is in charge. Hence, the proposed methodology shows promising results and provides useful insights related to shared control for autonomous ships.

A systems approach to hazard identification for solar-powered and wave-propelled unmanned surface vehicle

Decarbonization is a trend in the maritime industry and may include the use of alternative energy sources on ships. At the same time, autonomous ships are under development. In the future, the two technologies may be combined. The objective of this study is to identify possible hazards related to the operation of autonomous vessels using green energy sources. An extended and holistic Systems-Theoretic Process Analysis (STPA) based approach is proposed, where both safety and security is considered. Changes in level of autonomy during operation are considered, and an extension of the STPA method is proposed to highlight the interaction between the system and external energy source. A solar-powered and wave-propelled unmanned surface vehicle is analysed. The results show that mission performance may be affected by both safety and security issues, and that considering influences from the environment and the autonomous functionalities of the system together, contributes to identifying hazards. The results are compared to operational experience from multiple field campaigns. The case study focuses on a relatively simple autonomous vehicle, but some functionalities may be shared with Maritime Autonomous Surface Ships (MASS). Hence, implications for utilisation of alternative energy sources on MASS, and effects on risks, are discussed.

A framework to identify failure scenarios in the control mode transition process for autonomous ships with dynamic autonomy

The dynamic autonomy resulting from control mode transitions in the Maritime Autonomous Surface Ships (MASS) poses a significant risk to its navigation safety. While Systems-Theoretic Process Analysis (STPA) has proven effective in the hazard identification of autonomous ships, the safety challenges inherent in the dynamic autonomy of MASS with seafarers onboard controlled by three possible controllers have not been addressed much. This study proposes a three-phase framework that combines STPA, state machines and Sequentially Timed Events Plotting (STEP) diagram aiming at identifying failure scenarios in the transition process. Findings from a case study highlight the need for such a framework to understand the triggering events for mode transition, the transition process, how transition failure may occur, and refine safety constraints to ensure smooth and safe transitions. The results lay the groundwork for future research into test case generation methods that focus on these identified transition failure scenarios, intending to ensure safe and secure navigation for the progressive introduction of MASS.

Safety analysis of Civil aviation Flight and UAV Operation based on STAMP/STPA

In order to prevent the occurrence of dangerous approaches or accidents in the low-altitude UAV conflict resolution process, the security problem in the process was transformed into the control problem, and a conflict resolution security analysis method for low altitude UAV based on STAMP/STPA was proposed. Firstly, based on STAMP (System Theoretic Accident Modeling and Processes), the security control structure in the conflict resolution system was constructed. Then STPA (Systems Theoretic Process Analysis) was used to determine system-level accidents and hazards based on the context information of system operation, identify the unsafe control behaviors in the process of conflict resolution, and analyze the key causes of unsafe control behaviors.

ADSA – Association-Driven Safety Analysis to Expose Unknown Safety Issues

Autonomous systems are susceptible to unknown safety issues due to overlooked dependencies among components of the system and the entities that are part of its operating environment. The current safety analysis techniques aids in identifying known safety issues but not overlooked/unknown safety issues. To identify unknown safety issues due to problematic interactions between components, in our previous work, we proposed safety assessment for concurrent components (SACC). Despite being more effective than FMEA and goal modeling, SACC suffers from some limitations such as not considering environmental entities and their properties, and a manual process for identifying associated components for the collective analysis. For a complex system with a large number of components, such an analysis can result in overlooking safety issues. To address these limitations, in this paper, we propose an association-driven safety analysis (ADSA) approach, which is extended and built on SACC. The approach uses a property-relation (PR) table and modified association rule mining algorithm to identify components and environmental entities that need to be considered together to detect overlooked or unknown safety issues. We evaluated our approach using four robotic systems and compared with SACC and systems theoretic process analysis (STPA). Our results show that our proposed approach, in particular using behavioral dependencies, is effective at exposing unknown safety issues.

A novel methodology to evaluate criticality and sensitivity of safety barrier based on multi-agent interaction network

Focusing on the criticality and sensitivity evaluation of safety barriers involved in the complex social-tech system, a Multi-agent Interaction Network (MAIN) analysis is proposed in the present study on the basis of Systems Theoretic Process Analysis (STPA). The task scenario is firstly transferred as control structure by STPA, in which the controller and controlled process are considered as agents. Meanwhile, the basic control loops in the control structure are modeled with the application of Petri net-based association rules to develop the sub-MAINs, which are assembled into the whole MAIN by the network assembly algorithms proposed in this study. Then, a probability flow model characterized by network Green’s function is proposed to quantify the performance indicators of safety barriers, which include but not limited to scarcity, sustainability, saturation, contribution. A task scenario of “anchoring operation” in the maritime industry is selected in this study to illustrate the application of the proposed methodology. The results show that MAIN-based methodology proposed in this study is able to well compensate the constraints of the traditional network analysis and has a great potential for barrier evaluation, as well as the safety barrier management in practical industry.

Integrating Software FMEA and STPA to Develop a Bayesian Network-Based Software Risk Model for Autonomous Ships

The autonomous shipping industry is increasingly focusing on enhancing the safety and reliability of software-based systems. Conducting a risk assessment is a requirement for demonstrating the safety equivalence of autonomous ships based on such systems to conventional vessels. Traditional risk assessment models, however, primarily focus on hardware failures, often overlooking potential software-related failures and functional inadequacies. This study proposes a framework integrating Software Failure Mode and Effects Analysis (FMEA), System–Theoretic Process Analysis (STPA), and Bayesian Network (BN) for risk identification of autonomous ship software systems. The results of a case study reveal that the framework sufficiently addresses the multifaceted nature of risks related to software in autonomous ships. Based on the findings of this study, we suggest the need for standardization of software architecture development in the autonomous ship industry and highlight the necessity for an enhanced understanding of AI-specific risks and the development of tailored risk assessment methodologies.

Safety analysis of catapult takeoff of carrier-based aircraft using System-Theoretic Process Analysis method

Catapult takeoff has become the main way for carrier-based aircraft to take off. However, as a complex process of multi-system coupling and multi-control actions link, it is an important task to ensure the safety of catapult takeoff. Therefore, this paper adopts the System-Theoretic Process Analysis (STPA) and establishes a model of catapult takeoff using the Systems Theoretic Accident Model and Process(STAMP) model. To carry out safety analysis, identify unsafe control actions and extract the causes of unsafe behavior, simulation analysis is also carried out for typical unsafe actions. The results show that using STPA to make safety analysis, combined with simulation, can comprehensively analyze and evaluate the safety of catapult takeoff, which helps identify the risk before the flight test and reduce the flight test risk.

A Systems Approach to Identifying Hazards in the Management of Stream Buffers for the Protection of Drinking Water Quality

In drinking water catchments, exploiting ecosystem services provided by stream buffers has the potential to complement conventional engineering solutions such as water treatment and reduce the overall public health risks to consumers. These stream buffers interrupt the movement of contaminants and sediments from non-point source sources, such as agricultural land, to surface waters. Effectively managing stream buffers can be challenging due to the complexity and diversity of factors that can directly and indirectly impact efficacy. This study uses System Theoretic Process Analysis (STPA) and Early Warning Signal Analysis based on STPA (EWaSAP) methodology to systematically examine the sociotechnical structures for managing stream buffers in surface water catchments using a theoretical scenario representative of typical surface water supplies. The combination of STPA and EWaSAP provides a practical approach for developing requirements for stream buffers in drinking water catchments, focusing on hazard assessment and management measures. The evaluation considers the complex management arrangements for land uses within catchment areas. The performance and effectiveness of these actions can be tracked through the selected sensors and early warning measures. As a practical matter, this approach would help specify requirements for catchment management and drinking water source protection that can be systematically integrated into relevant management strategies.

On the hazards of proton exchange membrane (PEM) water electrolysis systems using system theoretic process analysis (STPA)

Green hydrogen energy is environmentally sustainable and critical to achieving a carbon-neutral society. Among several water electrolysis technologies, the proton exchange membrane water electrolysis (PEMWE) system, when integrated with renewable energy sources (RES), is seen as a promising green hydrogen production method. PEMWE is especially preferred for high-pressure operation, which decreases the energy usage and cost associated with hydrogen compression. However, it also poses significant operational risks, such as component reliability under dynamic operation, potential hydrogen leakage due to overpressure or component failure, possible hydrogen-oxygen mixtures in the system, and other unanticipated operational challenges. To fully understand the PEMWE system’s operational risk and facilitate risk management, this study conducts a systematic risk analysis using the System Theoretic Process Analysis (STPA) method, involving component failure, system design, human and organizational factors. Combined with the automated and dynamic nature of the system, salient issues during the dynamic operation of the PEMWE system, such as control reliability, component communication reliability and thermal runaway risk, are identified semi-quantitatively. This research is expected to provide a case for STPA research in the highly automated and socio-technical process industry. The findings are expected to offer valuable insights into the safety and reliability of the PEMWE system, providing engineers with technical guidelines for safer system designs, operations, and risk engineering applications, while delivering systematic strategies for risk management. Consequently, a more reliable PEMWE system could lead to the efficient utilization of fluctuating RES.

Safety improvements for laboratory handling of energetic materials applying system-theoretic process analysis

Over the past few years, numerous accidents have occurred during dangerous chemical experiments. Although there is a considerable amount of literature on laboratory safety, there is still a lack of systematic research that examines how the various laboratory systems interact and potentially contribute to accidents. The objective of this work is to lessen accidents and incidents related to Handling Energetic Materials in Research Laboratories by utilizing STPA (System-Theoretic Process Analysis). This involves examining unsafe interactions between system components, detecting potential undesired events, and implementing measures to prevent or reduce their impact. Recent literature on laboratory safety, quality standards, and interviews with lab workers were used as data sources for the STPA elaboration. As a result, it was possible to identify Unsafe Control Actions, Loss Scenarios, Causal Factors, and Safety Constraints to be considered to avoid undesired events or to mitigate their consequences during the Energetic Material Handling in research centers. It was also possible to point out key measures that can reduce waste, enhance productivity, allocate resources more effectively, decrease accidents, and, most importantly, mitigate potential hazards in laboratory work. The SPTA analysis presented a way to improve laboratory safety management and ensure a safer and more productive research environment.

On the causation analysis for hazards involved in the engine room fire-fighting system by integrating STPA and BN

A novel methodology is proposed in this study to investigate the hazards involved in the engine room fire-fighting system. In the proposed methodology, the fuzzy theory is applied to bridge the superiority of the systems theoretic process analysis (STPA) and Bayesian network (BN). The engine room fire-fighting system is initially audited within the framework of STPA qualitatively to identify unsafe control actions, and then, the causations contributing to these actions are determined, which are subsequently considered as the root nodes of the BN. To implementing Bayesian inference, the expert elicitation within fuzzy theory is employed to determine the probability distribution of the root nodes, and the conditional probability tables for intermediate nodes are obtained by leaky Noisy-OR function, based on which the developed BN is simulated. Finally, the results from BN simulation are interpretation from the perspectives of brief propagation analysis, sensitivity analysis and influence strength analysis. The proposed methodology can be applied to audit the integrity of engine room fire-fighting system to eliminate the potential causations contributing to engine room fire.

Resilient Operation Planning for CubeSat Using Reinforcement Learning

This study proposes an autonomous operation procedure for a CubeSat by applying reinforcement learning based on resilient engineering. The CubeSat requires rapid judgment in every visible window based on a sufficient understanding of the health conditions of the satellite from limited telemetry data due to the limited communication performance and poor protection functions from the harsh environment. This study first performs a risk analysis by using System Theoretic Process Analysis (STPA) to evaluate the risk scenario of the Cube-Sat. In order to successfully operate the missions while avoiding the risk scenarios, reinforcement learning is applied to learn adequate behaviors according to the satellite situations such as the temperature and voltage of the installed battery, the sunlight and eclipse phase and the mission progress and plan. Through numerical examples, the validity of the proposed method is illustrated.

Enhancing Early Systems R&D Capabilities with Systems —Theoretic Process Analysis

ABSTRACTSystems engineering today faces a wide array of challenges, ranging from new operational environments to disruptive technological — necessitating approaches to improve research and development (R&D) efforts. Yet, emphasizing the Aristotelian argument that the “whole is greater than the sum of its parts” seems to offer a conceptual foundation creating new R&D solutions. Invoking systems theoretic concepts of emergence and hierarchy and analytic characteristics of traceability, rigor, and comprehensiveness is potentially beneficial for guiding R&D strategy and development to bridge the gap between theoretical problem spaces and engineering‐based solutions. In response, this article describes systems–theoretic process analysis (STPA) as an example of one such approach to aid in early‐systems R&D discussions. STPA—a ‘top‐down’ process that abstracts real complex system operations into hierarchical control structures, functional control loops, and control actions—uses control loop logic to analyze how control actions (designed for desired system behaviors) may become violated and drive the complex system toward states of higher risk. By analyzing how needed controls are not provided (or out of sequence or stopped too soon) and unneeded controls are provided (or engaged too long), STPA can help early‐system R&D discussions by exploring how requirements and desired actions interact to either mitigate or potentially increase states of risk that can lead to unacceptable losses. This article will demonstrate STPA's benefit for early‐system R&D strategy and development discussion by describing such diverse use cases as cyber security, nuclear fuel transportation, and US electric grid performance. Together, the traceability, rigor, and comprehensiveness of STPA serve as useful tools for improving R&D strategy and development discussions. Leveraging STPA as well as related systems engineering techniques can be helpful in early R&D planning and strategy development to better triangulate deeper theoretical meaning or evaluate empirical results to better inform systems engineering solutions.