stpa

STPA, or System-Theoretic Process Analysis, is a hazard analysis method within the System-Theoretic Accident Model and Process (STAMP) framework. Developed by Nancy Leveson and colleagues in the early 2000s, STPA treats accidents as outcomes of complex interactions in sociotechnical systems rather than mere component failures. It aims to identify unsafe constraints and control actions and to specify safety requirements that prevent hazards.

Methodology: The system is modeled as a control structure consisting of controllers (humans, software, devices), actuators, sensors, and the physical environment. Analysts define scope and safety goals, then map the control structure to identify potential hazards. The core concept is unsafe control actions (UCAs)—actions by a controller that could cause a hazard in a given context. Analysts analyze possible UCAs, their causes (such as mode confusion or communication gaps), and propose mitigations, often in the form of stricter constraints, design changes, or new procedures.

STPA emphasizes systemic interactions, feedback, and governance rather than single-component failures. It is applicable to software-intensive and cyber-physical systems and has been used in aviation, automotive, healthcare, energy, and other high-hazard domains. Variants like STPA-Sec extend the approach to cybersecurity. The method is usually conducted by multidisciplinary teams and can inform early design and architecture decisions.

Limitations include the effort required to model a control structure and generate credible safety constraints, reliance on expert judgment, and potential ambiguity in boundaries between system elements. Despite these challenges, STPA is valued for revealing systemic risks that traditional hazard analyses may miss.