STAMP/STPAIntermediate Tutorial
Guided Exercise:
Applying STPA to a real system

Dr. John Thomas
System Engineering Research Laboratory
Massachusetts Institute of Technology

Chemical Reactor Design• Toxic catalyst
flows into reactor• Chemical reaction
creates heat,pressure• Water andcondenser
provide cooling

PLANT
STATUS

What are the system losses and system
hazards?
©

Chemical Reactor Design• A-1: People diefrom toxic chemical
exposure• A-2: Economic loss
• H-1: Toxic chemical
is released• H-2: Unable toproduce chemical X©

STPA(System-Theoretic Process Analysis)• Identify accidents
and hazards• Draw the controlstructure• Step 1: Identify
unsafe control
actions• Step 2: Identify
accident causal
scenarios(Leveson, 2012)

Controller
Control
Actions

Feedback

Controlledprocess4©

Chemical Reactor Design• Toxic catalyst
flows into reactor• Chemical reaction
creates heat,pressure• Water andcondenser
provide cooling

PLANT
STATUS

Create Control Structure©

STPA Analysis• High-level (simple)
Control Structure– What are the mainparts?
PLANT
STATUS?
?

?

©

STPA Analysis• High-level (simple)
Control Structure– What commands aresent?

Operator?

PLANT
STATUS

Computer?

Physical Plant©

STPA Analysis• High-level (simple)
Control Structure
Operator– What commands aresent?

?

PLANT
STATUS

Computer?
PhysicalPlant
Valves©

STPA Analysis• High-level (simple)
Control Structure
Operator– What feedback is sent?
PLANT
STATUS

Start Process
Stop Process?

Computer
Open/close water valve
Open/close catalyst valve?

PhysicalPlant

Valves©

Chemical Reactor Design
PLANT
STATUS

Control Structure:©

STPA(System-Theoretic Process Analysis)• Identify accidents
and hazards• Draw the controlstructure• Step 1: Identify
unsafe control
actions• Step 2: Identify
accident causalscenarios(Leveson, 2012)

Controller
Control
Actions

Feedback

Controlled
process

16©

Control Structure:

Chemical Reactor:
Unsafe Control
Actions

?

?

?

?

Close WaterValve©

Control Structure:

Chemical Reactor:
Unsafe Control
Actions

Not providing
causes hazard
Close WaterValve?

Providingcauses hazard
Computerprovides Close
Water cmd
while catalyst

Incorrect
Timing/Order

Stopped Too
Soon /
Applied too
long?

?
©

Structure of an Unsafe Control
ActionExample:“Computer provides close water valve command when catalyst open”

Type
Source Controller

Context
Control Action

Four parts of an unsafe control action– Source Controller: the controller that can provide the control action– Type: whether the control action was provided or not provided– Control Action: the controller’s command that was provided /missing– Context: conditions for the hazard to occur
19• (system or environmental state in which command is provided)©

Chemical Reactor:
Unsafe Control Actions (UCA)
Not providing
causes hazard
Close WaterValve

Providing causes
hazardIncorrect Timing/
Order

Stopped Too
Soon / Appliedtoo long

ComputerComputerprovides Close
provides Close
Water cmd while Water cmd before
catalyst open
catalyst closes

Open WaterValve
Open Catalyst
Valve

Close Catalyst
Valve

©

Chemical Reactor:
Unsafe Control Actions (UCA)
Not providing
causes hazard

Providing causes Incorrect Timing/
hazardOrder
Computer closes Computer closes
Close Water
water valve while water valve before
Valvecatalyst open
catalyst closes
Computer opens
Computer does not
Open Water
water valve more
open water valve
Valve
than X seconds
when catalyst open
after open catalyst
Computer opens Computer opens
Open Catalyst
catalyst valve
catalyst more thanValvewhen water valve X seconds before
not open
open waterComputer closes
Computer does not
Close Catalyst
catalyst more thanclose catalyst whenValveX seconds after
water closed
close water

Stopped Too
Soon / Applied
too long

Computer stops
opening watervalve too soon
when catalyst
open

Computer stops
closing catalyst
too soon whenwater closed©

Safety Constraints
Unsafe Control Action

Safety Constraint

Computer does not open water valve
when catalyst valve open

Computer must open water valve
whenever catalyst valve is open

Computer opens water valve more than X
seconds after catalyst valve open?

Computer closes water valve whilecatalyst valve open?

Computer closes water valve before
catalyst valve closes?

Computer opens catalyst valve whenwater valve not open?

Etc.

Etc.

Safety Constraints
Unsafe Control Action

Safety Constraint

Computer does not open water valve
when catalyst valve open

Computer must open water valve
whenever catalyst valve is open

Computer opens water valve more than X
seconds after catalyst valve open

Computer must open water valve within Xseconds of catalyst valve open

Computer closes water valve whilecatalyst valve open

Computer must not close water valve
while catalyst valve open

Computer closes water valve before
catalyst valve closes

Computer must not close water valve
before catalyst valve closes

Computer opens catalyst valve whenwater valve not open

Computer must not open catalyst valve
when water valve not open

Etc.

Etc.

Traceability• Always provide traceability information
between UCAs and the hazards they cause– Same for Safety Constraints• Two ways:– Create one UCA table (or safety constraint list) per
hazard, label each table with the hazard– Create one UCA table for all hazards, include
traceability info at the end of each UCA• E.g. Computer closes water valve while catalyst open
[H-1]

STPA
(System-Theoretic Process Analysis)• Identify accidents
and hazards• Draw the control
structure• Step 1: Identify
unsafe control
actions• Step 2: Identify
accident causal
scenarios(Leveson, 2012)

Controller
Control
Actions

Feedback

Controlledprocess28©

Step 2A: Potential causes of UCAs
Control input or
external informationwrong or missing

UCA: Computer
opens catalyst
valve when water
valve not open

Controller
Inadequate Control
Algorithm(Flaws in creation,
process changes,incorrect
modification oradaptation)

Missing or wrong
communication
with another
Controller
controller

Process
Model(inconsistent,incomplete,or incorrect)

Inadequate or
missing feedback
Feedback Delays

Actuator

SensorInadequate
operation

Inadequate
operation
Incorrect or no
information provided

Delays, inaccuracies,
missing/incorrect behavior

Controller
Conflicting control actions

Measurement
inaccuracies

Controlled Process
Component failures
Changes over time

Process input missing or wrongFeedback delays

Unidentified or
out-of-range
disturbance

Process output
contributes tosystem hazard

Step 2B: Potential control actions not followed
Control input or
external information
wrong or missing

Controller

Computer opens
water valve

Inadequate Control
Algorithm(Flaws in creation,process changes,incorrect
modification oradaptation)

Missing or wrong
communication
with anotherController
controller

ProcessModel(inconsistent,incomplete,or incorrect)

Inadequate or
missing feedback
Feedback Delays

Actuator

SensorInadequate
operation

Inadequate
operation
Incorrect or noinformation provided

Delays, inaccuracies,
missing/incorrect behavior

Controller
Conflicting control actions

Measurement
inaccuracies

Controlled Process
Component failures
Changes over time

Process input missing or wrong

Feedback delays

Unidentified or
out-of-range
disturbance

Process output
contributes tosystem hazard

Chemical Reactor: Real accident•How does STPA compare?

MIT: TCAS– Existing high quality fault tree done by MITRE for FAA– MIT comparison: STPA captured everything in fault tree, plus more•

JAXA: HTV
– Existing fault tree reviewed by NASA
– JAXA comparison: STPA captured everything in fault tree, plus more•

EPRI: HPCI/RCIC– Existing fault tree & FMEA overlooked causes of real accident– EPRI comparison: Blind study, only STPA found actual accident scenario•

NRC: Power plant safety systems– Proposed design that successfully completed Final Safety Analysis Report– STPA found additional issues that had not been considered•

Safeware: U.S. Missile Defense Agency BMDS
– Existing hazard analysis per U.S. military standards– Safeware comparison: STPA captured existing causes plus more
– STPA took 2 people 3 months, MDA took 6 months to fix problems•

Automotive: EPS– Compare STPA results to FMECA using SAE J1739•

MIT: NextGen ITP– Existing fault tree & event tree analysis by RTCA
– MIT comparison: STPA captured everything in fault tree, plus more•

MIT: Blood gas analyzer– Existing FMEA found 75 accident causes– STPA by S.M. student found 175 accident causes– STPA took less effort, found 9 scenarios that led to FDA Class 1 recall

Who has been using STPA?
Automotive:*US silicon valleycompanies

MIT March Workshop (free)Industries:Automotive
Oil and Gas
SpaceAviation
Defense
Nuclear
Healthcare and Healthcare IT
Medical Devices
Academia
Insurance
Academia (Education)
Hydropower
Chemicals
Software/Computing
Government
Industrial Automation
Electric Utility
Security
Think Tank
Transportation
Maritime (security)
Environmental
Pharmaceuticals
Internet

The Boeing Company
National Nuclear Energy
University of Houston, Clear U.S. Air Force Test Pilot School
Boeing Environment HealthCommission, Brazil
Lake
NASA/Bastion Technologies
and Safety
FAA
Lincoln Lab
U.S. Customs and Border
Boeing Engineering andU.S. Department ofHanscom AFB
ProtectionOperations
Transportation
U.S. Army Research,
Second Curve SystemsEmbraer
U.S. Air ForceDevelopment, and Engineering Vequria
U.S. Nuclear Regulatory
U.S. Navy
CommandAkamai Technologies
Commission
IPEV (Institute for Research
McMaster University
Canadian Dept. of Defense
U.S. Armyand Flight Testing), Brazil
Bechtel(DND)
GE Aviation
Japan Aerospace Exploration Kyushu University (Japan)
University of Virginia
SikorskyAgency (JAXA)
Analog Devices
MSAG
Thoratec Corporation
U.S. Department of Energy
Cummins
Novartis
University of Alabama in
Rockwell Automation
University of Massachusetts U.S. Coast Guard
Huntsville
Democritus University ofDartmouth
EPRI (Electric Power Research
Liberty Mutual Safety Research ThraceSyracuse Safety ResearchInstitute)
InstituteDependable Management
National Civil Aviation Agency Sandia National Laboratories
ITA (Instituto Tecnologico de ILF Consulting Engineers(ANAC0, Brazil
Lawrence Livermore NationalAeronautica)
JETRO (Japan)
State Nuclear Power
Laboratories
Jeppesen
Alliance for Clinical Research Automation System
Tapestry Solutions
Beijing Institute of Technology Excellence and Safety
Engineering Company (China) Kansas State University
TEGMA Gestao Logistica S.A. Washington CORE
Toyota Central R&D Labs
Systems Planning and Analysis
Amsterdam University of
Florida Institute of Technology Massachusetts General
Zurich University of Applied
Applied Sciences
U.S. Navy Strategic Systems
Hospital
Sciences
Dutch Safety Agency
Programs
AstraZeneca
IBM
University of Stuttgart
IPEN (Institute for Nuclear and STM (Defense Technology
Lawrence Berkeley National
BC Hydro
Energy Research), Brazil
Engineering and Trading Corp., Laboratory (LBNL)
Therapeutic
Goods
Duke
EnergyTurkey)
U.S. Navy School of Aviation
Organizations:
Administration
Synensis
VarianMedicalSystems
SafetyGeneral Motors
Institute of Aeronautics andJapan MOT Society
Fort Hill GroupJAMSS (Japanese Manned
Ford
Space(IAE),
BrazilTufts
University
TUBITAK-UZAY(ScientificandSpace Systems)
Nissan Motor Company
Shell
Oil
SouthernCompany
TechnologicalResearchCouncil
U.S. Chemical Safety Board
ToyotaUniversity of Braunschweig
U.S. Army Aviation Engineering of TURKEY-Space Technologies
Draper Lab
Stiki
U.S. Army Corps of Engineers Research Institute)Volpe National Transportation
Reykjavik
University(Kansas City District)
Cranfield University (U.K.)
Research Center

mit.edu/psas

35
Countries: USA, Brazil, Japan, China, Netherlands, Germany, Canada, Australia, Iceland, Greece, United Kingdom, Turkey, Estonia, Australia

Works for security too!
DriverSkid control
on/offPark assist
on/offSteering

Desiredparking
position
Guidelines

Skid Controller
Driving speed
Steering torqueassist signal

Parking
AssistController

Powersteering
warning
light

Steering angle
commandSteeringangle

External
interface

Reduceenginepower
Brakecommands

Diagnostics
Reprogramming
Test modes

Wheelspeed

Power Steering Controller
Steering
position

Steering
assistcommand

Rotation
sensorMotor
position

Steering
torqueSteering
motor

Steering
assistTorquesensorSteering
torqueSteering rack

TemperatureTemp
sensorTemperature

Reduceelectricalload

Load Controller
Reduceelectrical
power

Air
conditioner

Brake controller
Reduceenginepower

EngineControllerBrakecommands

Wheel
speed

BrakesBraking

Steering

VehicleAcceleration,
yaw rate,
wheel speedFeedback!
• Did you like the tutorial?
• Any comments or questions?
• Email me!
jthomas4@mit.edu