System-Theoretic Process Analysis Research Articles

A risk assessment method based on DEMATEL-STPA and its application in safety risk evaluation of hydrogen refueling stations

Conducting STPA (System Theoretic Process Analysis) analysis for hydrogen refueling stations can identify potential safety hazards and risks in the refueling station system, and take measures to prevent and mitigate these risks, ensuring safe and reliable operation of the refueling station. This paper proposes an improved STPA method for risk analysis of hydrogen refueling stations. Specifically, this method aims to first determine the purpose of risk analysis for the refueling station system, analyzing the system-level losses, hazards, and constraints of the entire refueling station. Secondly, the control structure of the refueling station system is constructed, the system boundary is determined, and a system control structure diagram is built. Next, unsafe control actions (UCA) are identified based on control actions, and a quantitative analysis of unsafe control actions is conducted using DEMATEL, obtaining the occurrence probability of unsafe control actions in the hydrogen refueling station system. Finally, loss scenarios are identified, and causation analysis is conducted for unsafe control actions with higher occurrence probabilities, providing improvement measures and risk control recommendations. Through the improved STPA analysis, problems with the control structure, safety functions, and control and safety subsystems of the hydrogen refueling station system can be identified, the safety performance and potential problems of each subsystem can be understood, and effective measures can be proposed to reduce risks and ensure the safety of the refueling station system.

Applying System-Theoretic Process Analysis (STPA)-based methodology supported by Systems Engineering models to a UK rail project

Systems safety in railways focuses on providing the necessary assurance that the railway system is operationally safe and meets all relevant regulatory requirements. Safety risks associated with changes in the UK railway are controlled through the Common Safety Method for Risk Evaluation and Assessment (CSM-RA). As part of the CSM-RA framework, various safety analysis methods such as Failure Modes and Effects Criticality Analysis (FMECA), Fault Tree Analysis (FTA), Event Tree Analysis (ETA) and other traditional analysis methods conducted via expert brainstorming such as Hazard Identification (HAZID) workshops have been relied upon for many years in the UK rail industry; aiming to evaluate and mitigate all reasonably foreseeable hazards. This paper reports a comparison case study of the application of a novel System-Theoretic Process Analysis (STPA)-based methodology against the traditional approach for hazard analysis in UK rail projects. The proposed methodology uses Systems Engineering (SE) models in each of its steps. The application of the novel methodology demonstrates that it is suitable for hazard identification and analysis in complex rail systems. It shows that the approach goes beyond the capabilities of traditional methods, provides insights into the interaction among system components and captures hazards within the context of the whole. The SE models used in this study prove to be valuable not only for illustrating the System of Interest (SOI) visually, but also providing a high-level understanding of the system and a more detailed understanding of component interactions. They also improved the focus, in scope, effectiveness, and efficiency of the analysis.

A systems approach for managing risks with complex interactions in urban spaces

Extreme phenomena have emerged strongly in urban areas in recent years and are directly linked to the current urban challenges, such as climate change and digital transformation, that future cities must face efficiently. Risk management in urban public spaces is the primary means by which decision makers and local stakeholders ensure urban resilience and enhance urban smartness. In this framework, the current research proposes risk management solutions for urban areas considering their complexity as systems. The implementation of STPA (System-Theoretic Process Analysis) method, as a relatively new hazard analysis technique for complex systems is presented. The applied method delivers a mechanism useful in understanding where gaps in current operational risk structures may exist. The findings in terms of loss scenarios can be used to generate a variety of safeguards to ensure secure operational control and in implementing targeted strategies through standard approaches of risk assessment. Results from a use case in Patras city, Greece, indicate that a systemic, hierarchically structured, and adaptive approach, can effectively assist local stakeholders in risk management of urban public spaces.

Operational risk analysis of a containerized lithium-ion battery energy storage system based on STPA and fuzzy evaluation

Lithium-ion battery energy storage system (BESS) has rapidly developed and widely applied due to its high energy density and high flexibility. However, the frequent occurrence of fire and explosion accidents has raised significant concerns about the safety of these systems. To evaluate the safety of such systems scientifically and comprehensively, this work focuses on a MW-level containerized lithium-ion BESS with the system-theoretic process analysis (STPA) method. The work identified 53 unsafe control actions and corresponding loss scenarios. By combining loss scenarios and expert evaluation opinions, the key risk factors for system operation are obtained. Finally, this work proposed corresponding countermeasures and suggestions to address the key risk factors and improve the safety and reliability of the entire system operation. This work discusses the operational risks of MW-class containerized lithium-ion BESS and provides technical guidance for engineers in system designs, safe operations, and engineering applications.

Risk-based supervisory control for autonomous ship navigation

This paper proposes a novel method to transform the results of qualitative risk analysis into a numeric optimal control problem for autonomous ship navigation. Today, making autonomous high-level decisions replacing a crew onboard is considered difficult, in some part due to the complexity of managing the operational risks involved. Although human supervisors, e.g., located in remote operating control centers are still needed for safety and liability reasons, there is a growing demand for complex decisions to be made by the onboard control system itself, both during normal operations and in emergencies. This paper suggests general principles for how the results from systems-theoretic process analysis (STPA) can be transformed into a quantitative and computationally tractable optimization problem, solved by a MPC-based decision-making algorithm for autonomous navigation. The proposed method is demonstrated and evaluated by simulating an autonomous ship navigating in a coastal environment. It is concluded that the proposed method may serve as a reasonable and valuable bridge between the realms of qualitative risk analysis and numerical optimal control for risk-aware autonomous control and decision-making.

Collision hazard modeling and analysis in a multi-mobile robots system transportation task with STPA and SPN

This paper investigates the ability to use complex multi-mobile robotic systems in risky and dynamic environments, such as industrial plants and laboratories, with the presence of the human factor. More specifically, it presents an approach to analyze the dominant risk, extract, model and quantify the hazard scenarios, then propose requirements using the combination between two methods: System Theoretic Process Analysis (STPA) and Stochastic Petri Nets (SPN). This approach is demonstrated with a case study related to a chemical transportation task within a miniature analysis laboratory in oil and gas industry. The main purposes of this article are: to investigate how the risk and safety of these systems should be managed, to create a framework for modeling collision hazard scenarios, further a Monte Carlo simulation is performed to quantify the collision frequency and unavailability. In addition, to generate the required constraints and requirements in order to improve the safe operation of robots within the laboratory. The novel contribution of this study is to provide a hazard assessment approach suited to multi-controller and autonomous systems while considering coordination between controllers. Hence, the current study proposes a set of safety requirements, which allow designers and programmers to improve autonomy features in mobile robots. The STPA-SPN combination offers better modeling and assessment of robot's performance as well as their hazard frequency.

Risk evolution model of marine traffic via STPA method and MC simulation: A case of MASS along coastal setting

Marine traffic safety for Maritime Autonomous Surface Ship (MASS)is affected by the maritime environment and complex human-machine technical systems, and it is necessary to reveal its risk evolution characteristics involving new technology. The novel risk evolution model based on the system-theoretic process analysis (STPA)method for specific scenarios is established to determine the risk mechanism in random processes. First, by combining Markov chain (MC) with cloud model based on the information transmission path, the Markov process hypothesis is proposed to devise a coupling effect model of system components and external interference environment. Second, operation and control modes for MASS under different scenarios based on STPA are constructed and analyzed, which are based on clarifications regarding two models for the parallel control of MASS. Third, a systemic risk model using safety control methodology is constructed considering the operation scenario of MASS. Last and not least, the risk performance in the MASS navigation process is simulated to reveal the emergence characteristics of ship navigation process risk after applying specific scenarios under three modes. Application examples show that the process risk emergence of MASS navigation is characterized by the dependence on safety information transmission path. Different transmission paths lead to inconsistent risk evolution results. The randomness and complexity of external environmental disturbances are the main factors involved in the formation of navigation risks in MASS.

Online risk modeling of autonomous marine systems: Case study of autonomous operations under sea ice

Since few or no human operators are directly involved in the operation of an autonomous marine system (AMS), an online risk model is necessary to enhance the intelligence of the AMS, its situation awareness, and decision making. The current study combines the system-theoretic process analysis (STPA) with Bayesian belief networks (BBNs) to develop online risk models for an AMS. Furthermore, fuzzy discretization is introduced to deal with evidence uncertainty. The proposed risk model can update the risk level as the operating conditions change, providing a basis for AMS supervisory risk control (SRC). A two-level SRC is proposed in this study. Using the operation of an autonomous underwater vehicle (AUV) under sea ice as an example, the current work presents an online risk model and a corresponding SRC system, focusing on the navigation hazards to the AUV and its potential loss. The results of simulation studies show that the model enables the AUV to be informed of the risk level and to make risk-based decisions accordingly, thereby improving its intelligence. The importance of the evidence uncertainty in online risk models and SRC is analyzed and discussed. The results and conclusions of this analysis can be adapted to other AMSs.

Privacy Risk Assessment of Smart Home System Based on a STPA–FMEA Method

Although the smart home industry is rapidly emerging, it faces the risk of privacy security that cannot be neglected. As this industry now has a complex combination system involving multiple subjects, it is difficult for the traditional risk assessment method to meet these new security requirements. In this study, a privacy risk assessment method based on the combination of system theoretic process analysis–failure mode and effect analysis (STPA–FMEA) is proposed for a smart home system, considering the interaction and control of ‘user-environment-smart home product’. A total of 35 privacy risk scenarios of ‘component-threat-failure-model-incident’ combinations are identified. The risk priority numbers (RPN) was used to quantitatively assess the level of risk for each risk scenario and the role of user and environmental factors in influencing the risk. According to the results, the privacy management ability of users and the security state of the environment have significant effects on the quantified values of the privacy risks of smart home systems. The STPA–FMEA method can identify the privacy risk scenarios of a smart home system and the insecurity constraints in the hierarchical control structure of the system in a relatively comprehensive manner. Additionally, the proposed risk control measures based on the STPA–FMEA analysis can effectively reduce the privacy risk of the smart home system. The risk assessment method proposed in this study can be widely applied to the field of risk research of complex systems, and this study can contribute to the improvement of privacy security of smart home systems.

Reasonableness of a proposed System Theoretic Process Analysis (STPA) validation framework: An interview study

Since its inception, the STPA technique has gained increasing popularity among researchers and industry practitioners. Nevertheless, the validity of its application has not yet received much scientific attention. Although some informal validation approaches have been used by STPA users, no formalized validation framework has been elaborated for practical use. This paper investigates the reasonableness of the recently proposed STPA validation framework, which includes 15 validation tests, each focusing on a specific step of an STPA analysis. To do so, STPA experts in both academia and industry were interviewed. First, it is investigated what approaches they have been using for validating an STPA analysis, the findings of which were categorized and mapped with the proposed validation framework. This aims to investigate the similarities and dissimilarities between the theory-based validation framework and the informal methods applied by experts in current practice. Then, the proposed framework was presented to the interviewees to seek their judgments about its reasonableness. Feedback from practitioners indicated that the proposed STPA validation framework has certain strengths, while several opportunities exist for further improvement. In particular, the findings indicate that most of the proposed theory-based tests have been already used by STPA experts in an unstructured manner. The experts appreciated the framework in that it provides clear guidance on how to validate each step of an STPA analysis systematically, and found some additional theory-based tests interesting for consideration in practice. The results also suggest that further research is needed to develop systematic techniques for performing each test to facilitate its application by STPA experts.

Selecting cost-effective risk control option for advanced maritime operations; Integration of STPA-BN-Influence diagram

Advanced maritime operations, such as remote pilotage, are vulnerable to new emergent risks due to increased system complexity and a multitude of interactions. Thus, maritime researchers this decade have combined Systems-Theoretic Process Analysis (STPA) and Bayesian Network (BN) to effectively manage these risks. Although these methods are effective in identifying hazards and analyzing risk levels, none of the STPA-BN studies provides a systematic process for selecting a cost-effective combination of risk control measures. Cost-benefit analysis is crucial for organizations to make informed risk-based decisions in allocating available resources for risk mitigation and achieve a balance between risk reduction (benefits) and costs associated with risk control measures. This study offers an innovative method of integrating the STPA-BN-Influence diagram for risk-based decision-making through a cost-benefit analysis. The model automatically evaluates the costs and benefits of all possible risk control options and proposes the optimum cost-effective solution. In the current study, the methodology is illustrated with a case study of remote pilotage operation, where 524,288 different risk control options (combinations of 19 risk control measures) are assessed to select an optimal risk control option. The case study results indicate that the proposed methodology is more significant when the number of risk control measures increases.

A proposal of hazard analysis method using structured system theoretical process analysis

System Theoretic Process Analysis (STPA) is a method for analyzing hazards caused by interactions between components of an industrial product. STPA is applied in the upper stream stages of industrial product development, STPA detects hazards while referring to the whole configuration of the industrial product. Therefore, STPA generally does not deal with detailed information about the industrial product. Since the information on the industrial product is insufficient, it is difficult to clarify the factors of hazards, the occurrence order of factors, and the conditions that occur the hazard by STPA. Therefore, the following methods were added to the conventional STPA; the method of describing the components of industrial products in hierarchical detail, the method of clearly defining the behaviour of each component, and the method of tracking the structured CSD to clarify the causes of the hazard. By adding those methods, it became possible to conduct a hazard analysis of the industrial product in detail. As a result of applying the proposed method to the existing railroad crossing control system, it was confirmed that the proposed method could detect more factors of hazards and create adequate scenarios from the occurrence of hazard causes to the occurrence of the hazard.

Development of the framework for quantitative cyber risk assessment in nuclear facilities

Industrial control systems in nuclear facilities are facing increasing cyber threats due to the widespread use of information and communication equipment. To implement cyber security programs effectively through the RG 5.71, it is necessary to quantitatively assess cyber risks. However, this can be challenging due to limited historical data on threats and customized Critical Digital Assets (CDAs) in nuclear facilities. Previous works have focused on identifying data flows, the assets where the data is stored and processed, which means that the methods are heavily biased towards information security concerns. Additionally, in nuclear facilities, cyber threats need to be analyzed from a safety perspective. In this study, we use the system theoretic process analysis to identify system-level threat scenarios that could violate safety constraints. Instead of quantifying the likelihood of exploiting vulnerabilities, we quantify Security Control Measures (SCMs) against the identified threat scenarios. We classify the system and CDAs into four consequence-based classes, as presented in NEI 13–10, to analyze the adversary impact on CDAs. This allows for the ranking of identified threat scenarios according to the quantified SCMs. The proposed framework enables stakeholders to more effectively and accurately rank cyber risks, as well as establish security and response strategies.

A comparative risk analysis on CyberShip system with STPA-Sec, STRIDE and CORAS

The widespread use of software-intensive cyber systems in critical infrastructures such as ships (CyberShips) has brought huge benefits, yet it has also opened new avenues for cyber attacks to potentially disrupt operations. Cyber risk assessment plays a vital role in identifying cyber threats and vulnerabilities that can be exploited to compromise cyber systems. Understanding the nature of cyber threats and their potential risks and impact is essential to improve the security and resilience of cyber systems, and to build systems that are secure by design and better prepared to detect and mitigate cyber attacks. A number of methodologies have been proposed to carry out these analyses. This paper evaluates and compares the application of three risk assessment methodologies: system theoretic process analysis (STPA-Sec), STRIDE and CORAS for identifying threats and vulnerabilities in a CyberShip system. We specifically selected these three methodologies because they identify threats not only at the component level, but also threats or hazards caused due to the interaction between components, resulting in sets of threats identified with each methodology and relevant differences. Moreover, STPA-Sec, which is a variant of the STPA, is widely used for safety and security analysis of cyber physical systems (CPS); CORAS offers a framework to perform cyber risk assessment in a top-down approach that aligns with STPA-Sec; and STRIDE (Spoofing, Tampering, Repudiation,Information disclosure, Denial of Service, Elevation of Privilege) considers threat at the component level as well as during the interaction that is similar to STPA-Sec. As a result of this analysis, this paper highlights the pros and cons of these methodologies, illustrates areas of special applicability, and suggests that their complementary use as threats identified through STRIDE can be used as an input to CORAS and STPA-Sec to make these methods more structured.

Facilitating the application of systems-theoretic process analysis in healthcare: Creating control structures using process maps.

Systems-theoretic process analysis (STPA) is a prospective safety assessment tool increasingly applied in healthcare. A problem hampering STPA proliferation is the difficulty of modeling systems for analysis by creating control structures. In this work, a method is proposed to use existing process maps-commonly available in healthcare-when creating a control structure. The proposed method entails (1) extract information from the process map, (2) determine the modeling boundary of the control structure, (3) transfer the extracted information to the control structure, (4) add additional information to complete the control structure. Two case studies were conducted: (1) ambulance patient offloading in the emergency department and (2) ischemic stroke care with intravenous thrombolysis. The amount of process map-derived information in the control structures was quantified. On average, 68% of the information in the final control structures was derived from the process map. Additional control actions and feedback were added from nonprocess map sources for management and frontline controllers. Despite the differences between process maps and control structures, much of the information in a process map can be used when creating a control structure. The method enables the creation of a control structure from a process map to be done in a structured fashion.

Hazard Analysis of an Autonomous Container Handling System – a Comparison of STPA and HAZOP Methods

Increasing automation is a major trend in container terminals. In automated container handling systems, safety has been previously ensured by segregating the automated machinery from other traffic and workers moving on foot. Currently, further increases in flexibility are sought by developing autonomous systems that are capable of mixed-traffic operations without the need for separate operating areas. This increases the complexity of the systems and introduces new safety hazards. In addition to traditional hazard analysis methods, new approaches are needed to address the emergent risks related to autonomous operations. This paper studies the applicability of the STPA (system-theoretic process analysis) method in hazard analysis of an autonomous machine system. To support the evaluation, we define evaluation categories for comparison of the analysis methods. We also compare STPA with an established method, HAZOP (hazard and operability study). To perform the comparison, both STPA and HAZOP are applied to an autonomous container handling system concept. The study suggests that both STPA and HAZOP are well suited to support the development of autonomous machinery. However, we also highlight some notable differences in the methods, mostly related to the different underlying accident models that they utilise. HAZOP is an established method with tools and standards available. STPA, on the other hand, provides a well-defined syntax to ensure the analysis quality and a system modelling approach that supports the system development.

Investigation of the compressed air energy storage (CAES) system utilizing systems-theoretic process analysis (STPA) towards safe and sustainable energy supply

Renewable energy attracts increasing attention from both industry and academia under the context of carbon neutrality. For wind and solar energy, the strong dependence on natural processes results in the imbalance between energy production and real demands. Energy storage technologies, e.g., Compressed Air Energy Storage (CAES), are promising solutions to increase the renewable energy penetration. However, the CAES system is a multi-component structure with multiple energy forms involved in the process subject to high temperature and high-pressure working conditions. The CAES system is a complex process flowsheet consisting of charging and discharging process. The process should be optimized to achieve the best thermodynamic and economic performance. Under the optimal design conditions, it might lead to severe consequences once a failure occurs, e.g., harm to humans, the environment, and assets. Limited attention and scarce available information have been paid to the CAES system risk management yet. Hence, this paper applies the System-Theoretic Process Analysis (STPA), which is a top-down method based on system theory, to identify the CAES system safety hazards. The results are expected to provide a preliminary guideline for practitioners regarding the safety and reliability of the CAES system. As a result, a more reliable CAES system can contribute to a more flexible energy system with more efficient and economic utilization of fluctuating renewable energy.

A proposed validation framework for the system theoretic process analysis (STPA) technique

Validation is a prominent challenge in the domain of risk management in general, and hazard analysis in particular. Practitioners have highlighted a lack of clear guidance on how to perform validation of hazard analyses, who should be involved, and when to stop the validation process. Aiming to contribute to addressing this issue, this study proposes a validation framework for the System Theoretic Process Analysis (STPA) technique, based on foundational concepts in risk analysis and prior theoretical work on validation in related disciplines. STPA, which is a hazard analysis technique based on System-Theoretic Accident Model and Processes (STAMP) accident causality model, is selected due to its increasing popularity in different industries, and because no validation frameworks have yet been proposed for this technique. The proposed STPA validation framework aims to support a systematic assessment of the analysis's comprehensiveness, accuracy, and credibility. It consists of a set of theory-based concepts that are elaborated as guide questions, each focusing on different aspects of STPA. The framework employs a formative approach, i.e., it aims to help stakeholders systematically reason about the analysis and advise on improvements or further elaboration. To develop this framework, theoretical validation concepts in the pertinent literature in risk science, social science, and operations research, system dynamics, and simulation modeling disciplines have been used. It is recognized that the proposed framework should be further tested to confirm its practical usefulness, and it should be investigated whether it indeed improves the hazard analysis in terms of the envisioned functions.

Risk analysis methodology using STPA-based Bayesian network- applied to remote pilotage operation

The maritime industry is currently ongoing into a digital transformation to develop cleaner, safer and smarter transport services. Establishing such services requires identifying and assessing new emerging risks such as software and design flaws. Thus, suitable hazard identification and risk analysis methods must be developed and implemented for these complex services. This study aims to develop a novel risk analysis methodology by integrating Systems Theoretic Process Analysis, Bayesian Network, Noisy-OR gates, Parent divorcing technique and Sub-modelling. The effectiveness of the proposed methodology is demonstrated through a case study of Remote pilotage operation. The results show that the methodology can be applied to complex operations to assess the propagation of risks from a single fault or failure in a system to the hazards, accidents and incidents, and ultimately the losses. Furthermore, it is demonstrated how the remote pilotage risk model can support pilots and pilotage companies in real-time decision-making by estimating the likelihood of losses in case of a single fault or failure.

An Ontology-Based Approach to Aid STPA Analysis

The safety-critical systems we are building today employ software, use physical and cybernetic components, and have more interactions (including hierarchical controllers). Systems-Theoretic Process Analysis (STPA) is a hazard analysis method that is used in the concept stage of the safety-critical systems life-cycle. It is claimed that STPA identifies more loss scenarios and safety recommendations when compared to traditional safety analysis methods. However, the STPA analyses are lengthy and complex, and it is common to miss some loss scenarios and safety recommendations. Few STPA-based tools allow systematic and automated analyses. We propose an ontology that represents the STPA analysis domain knowledge and we built an STPA ontology-based tool, called AppSTPA, that aids the analyst providing a more systematic, automated and guided analyses. We evaluated the STPA analyses made with AppSTPA and without the assistance of tools. We also assessed the benefits of AppSTPA when compared to an existing STPA tool. The results show that our ontology-based tool provides pertinent guidance and allows a more complete analysis. We conclude that our STPA ontology-based tool is able to support analysts and provide valuable suggestions, resulting in better safety analyses.