Systems Theoretic Process Analysis (STPA)

Systems Theoretic Process Analysis (STPA) is a hazard analysis technique based on control theory. It identifies hazards and missing requirements, including those arising from human factors and from interactions between systems, that component failure analyses can miss. It complements the safety assessment process of SAE ARP4761 and ARP4761A.

The STPA process

1. Define the purpose of the analysis: the losses, hazards, and system-level safety constraints.
2. Model the control structure: abstractly, with its control actions, process models, and states.
3. Identify unsafe control actions. There are four types:
   • The control action is not provided.
   • The control action is provided incorrectly.
   • A potentially safe control action is provided too early, too late, or in the wrong order.
   • The control action is stopped too soon or applied too long.
4. Identify causal scenarios that link control actions and unsafe control actions to system states.
5. Restate the safety constraints as safety requirements.

Hazards and safety constraints

A hazard is stated as a system, an unsafe condition, and its link to losses. A safety constraint states what must be done to prevent or minimize the loss if the hazard occurs:

Element	Form	Example
Losses	A loss to stakeholders	L1: Fatalities. L2: Damage to aircraft.
Hazard	System, unsafe condition, and link to losses	H1: Aircraft violate minimum separation standards [L1, L2].
Safety constraint	If the hazard occurs, then what must be done to prevent or minimize a loss	SC1: If aircraft violate minimum separation standards, then the violation must be detected and measures taken to prevent collision.

Unsafe control actions are then linked to the hazards identified in the Functional Hazard Assessment (FHA). In this context, “hazard” rather than “failure condition” is the appropriate term. STPA defines a hazard as a system state or set of conditions that, together with worst-case environmental conditions, will lead to a loss. A system is a set of components that act together as a whole to achieve a common goal, and may contain subsystems or be part of a larger system.

Electric Propulsion System (EPS)

Control structure

Hazards generated by STPA

Unsafe control action	Failure condition
No motor shutdown by aircrew when over-temperature alert	Overtemperature
No motor shutdown by aircrew when over-vibration alert	Unbalanced motor
No motor shutdown by aircrew when over-speed alert	Overspeed
No motor shutdown by aircrew when over-torque alert	Overtorque
No motor shutdown by aircrew when over-current alert	Overtemperature
No voltage modulation when motor running	Loss of thrust
Incorrect voltage modulation when motor shut down	Uncommanded thrust
Incorrect voltage modulation when motor locked	Uncommanded thrust

Safety constraints

Energy Storage System (ESS)

Control structure

Hazards generated by STPA

Unsafe control action	Failure condition
No charger shutdown by BMS when battery charged	Uncontained thermal runaway
No switch disconnect by BMS when battery discharged	Uncontained thermal runaway
Charger shutdown too early by BMS when battery discharged	Loss of thrust
Switch disconnect too early by BMS when battery charged	Loss of thrust
No cell deviation limiting when cell deviation from mean alert	Uncontained thermal runaway
No module deviation limiting when module deviation from mean alert	Uncontained thermal runaway
No emergency procedure by aircrew when battery unhealthy	Loss of thrust

Safety constraints

For the fault tree analysis of the same battery system, see our DO-311A battery safety analysis.

Optionally piloted eVTOL aircraft

At aircraft level, STPA is applied in tiers. Tier 1 models the aircraft, the aircrew, and the airspace. Tiers 2 and 3 integrate Detect and Avoid (DAA), first with the other airspace users and then with the aircraft’s sensors and flight control system.

Tier 1

Tier 2: DAA integration

Tier 3: DAA integration

Conclusion

STPA is a Model-Based Safety Assessment (MBSA) technique that identifies hazards and missing requirements. It complements ARP4761 and ARP4761A, and is part of the holistic safety analysis approach.