Performing Hazard Analysis on Complex, Software- and Human-Intensive Systems

STPA (System-Theoretic Process Analysis) is a new, more powerful hazard analysis technique that assumes accidents are caused by inadequate enforcement of constraints on component behavior rather than simply component failures (ref. 3). Accidents in complex systems are often caused by unsafe interactions among components that have not failed. Because STPA includes both component failure accidents and component interaction accidents, it can potentially find more causes of hazards than the older methods, including causes involving software and human errors which usually involve not failures but inadequate or unsafe control actions. The first step in STPA is to identify the unsafe control actions (including failure to adequately handle component failures) that can lead to hazards. The second step is to determine the potential causes of the unsafe control. This paper describes a procedure for identifying potentially unsafe control actions, from which component safety requirements can be derived and more detailed causal analysis performed.