Integrating Fault Tree Analysis with System Theoretic Process Analysis

Both humans and software are notoriously challenging to account for in traditional hazard analysis models. The purpose of this work is to investigate and demonstrate the application of a new, extended accident causality model, called systems theoretic accident model and processes (STAMP), to radiation oncology. Specifically, a hazard analysis technique based on STAMP, system-theoretic process analysis (STPA), is used to perform a hazard analysis. The STPA procedure starts with the definition of high-level accidents for radiation oncology at the medical center and the hazards leading to those accidents. From there, the hierarchical safety control structure of the radiation oncology clinic is modeled, i.e., the controls that are used to prevent accidents and provide effective treatment. Using STPA, unsafe control actions (behaviors) are identified that can lead to the hazards as well as causal scenarios that can lead to the identified unsafe control. This information can be used to eliminate or mitigate potential hazards. The STPA procedure is demonstrated on a new online adaptive cranial radiosurgery procedure that omits the CT simulation step and uses CBCT for localization, planning, and surface imaging system during treatment. The STPA procedure generated a comprehensive set of causal scenarios that are traced back to system hazards and accidents. Ten control loops were created for the new SRS procedure, which covered the areas of hospital and department management, treatment design and delivery, and vendor service. Eighty three unsafe control actions were identified as well as 472 causal scenarios that could lead to those unsafe control actions. STPA provides a method for understanding the role of management decisions and hospital operations on system safety and generating process design requirements to prevent hazards and accidents. The interaction of people, hardware, and software is highlighted. The method of STPA produces results that can be used to improve safety and prevent accidents and warrants further investigation.

Purpose:To investigate the hazards in cervical‐cancer HDR brachytherapy using a novel hazard‐analysis technique, System Theoretic Process Analysis (STPA). The applicability and benefit of STPA to the field of radiation oncology is demonstrated.Methods:We analyzed the tandem and ring HDR procedure through observations, discussions with physicists and physicians, and the use of a previously developed process map. Controllers and their respective control actions were identified and arranged into a hierarchical control model of the system, modeling the workflow from applicator insertion through initiating treatment delivery. We then used the STPA process to identify potentially unsafe control actions. Scenarios were then generated from the identified unsafe control actions and used to develop recommendations for system safety constraints.Results:10 controllers were identified and included in the final model. From these controllers 32 potentially unsafe control actions were identified, leading to more than 120 potential accident scenarios, including both clinical errors (e.g., using outdated imaging studies for planning), and managerial‐based incidents (e.g., unsafe equipment, budget, or staffing decisions). Constraints identified from those scenarios include common themes, such as the need for appropriate feedback to give the controllers an adequate mental model to maintain safe boundaries of operations. As an example, one finding was that the likelihood of the potential accident scenario of the applicator breaking during insertion might be reduced by establishing a feedback loop of equipment‐usage metrics and equipment‐failure reports to the management controller.Conclusion:The utility of STPA in analyzing system hazards in a clinical brachytherapy system was demonstrated. This technique, rooted in system theory, identified scenarios both technical/clinical and managerial in nature. These results suggest that STPA can be successfully used to analyze safety in brachytherapy and may prove to be an alternative to other hazard analysis techniques.

BackgroundOnline adaptive radiation therapy (ART) is a relatively new process, and it is recommended that institutions starting an online ART program conduct a risk analysis to identify potential hazards. While Failure Modes and Effects Analysis (FMEA) is common, Systems‐Theoretic Process Analysis (STPA) has also been used to evaluate online ART workflows.PurposeAn STPA hazard analysis was performed for a CT‐guided online ART system in a multi‐vendor environment. The goal was to identify potential risks and mitigations to guide the development of adaptive workflows and the quality management (QM) program.MethodsThe STPA hazard analysis was performed in four steps. First, process maps for online ART were generated to describe the interactions between users and systems. In the second step, the process maps were refined to a single control structure diagram model. In the third step, potential unsafe control actions (UCAs) were enumerated by the physicists involved in the analysis. Finally, mitigation strategies to address the UCAs were identified.ResultsA total of 496 UCAs were identified for 119 control actions, of which 239 (48.2%) were prioritized for mitigation due to having low or medium levels of detectability. The most frequent causal scenarios were accidental omission (20.1%), rushing (17.2%), and lack of training (15.9%). The most common consequences were delays (26.8%) and having to repeat work (13.5%). The two mitigation strategies considered to address the most causal scenarios were requiring trained adaptive staff (28.9%) and having physics oversight (19.9%).ConclusionsThe STPA led to valuable insights into the potential causes of unsafe control actions and various mitigation strategies that were used to develop the QM program. Notably, most UCAs were attributable to interactions between users and the system, rather than system failures. It is recommended that every institution starting an online ART program perform a risk assessment for their environment.

Analyzing National Responses to COVID-19 Pandemic using STPA

A formal approach to support the identification of unsafe control actions of STPA for nuclear protection systems

During the last decades, collaborative robots capable of operating out of their cages are widely used in industry to assist humans in mundane and harsh manufacturing tasks. Although such robots are inherently safe by design, they are commonly accompanied by external sensors and other cyber-physical systems, to facilitate close cooperation with humans, which frequently render the collaborative ecosystem unsafe and prone to hazards. We introduce a method that capitalizes on partially observable Markov decision processes (POMDP) to amalgamate nominal actions of the system along with unsafe control actions posed by the System Theoretic Process Analysis (STPA). A decision-making mechanism that constantly prompts the system into a safer state is realized by providing situation awareness about the safety levels of the collaborative ecosystem by associating the system safety awareness with specific groups of selected actions. POMDP compensates the partial observability and uncertainty of the current state of the collaborative environment and creates safety screening policies that tend to make decisions that balance the system from unsafe to safe states in real time during the operational phase. The theoretical framework is assessed on a simulated human–robot collaborative scenario and proved capable of identifying loss and success scenarios.

Cyber-Physical Systems (CPSs) represent a systems category developed and promoted in the maritime industry to automate functions and system operations. In this study, a novel Combinatorial Approach for Safety Analysis is presented, which addresses the traditional safety methods’ limitations by integrating System Theoretic Process Analysis (STPA), Events Sequence Identification (ETI) and Fault Tree Analysis (FTA). The developed method results in the development of a detailed Fault Tree that captures the effects of both the physical components/subsystems and the software functions’ failures. The quantitative step of the method employs the components’ failure rates to calculate the top event failure rate along with importance metrics for identifying the most critical components/functions. This method is implemented for an exhaust gas open loop scrubber system safety analysis to estimate its failure rate and identify critical failures considering the baseline system configuration as well as various alternatives with advanced functions for monitoring and diagnostics. The results demonstrate that configurations with SOx sensor continuous monitoring or scrubber unit failure diagnosis/prognosis lead to significantly lower failure rate. Based on the analysis results, the advantages/disadvantages of the novel method are also discussed. This study also provides insights for better safety analysis of the CPSs.

Objectives/Goals: Identify risks in the regulatory reliance ecosystem, specifically for generic reliance pathways, using system theoretic process analysis (STPA), a proactive hazard analysis method, and create sustainable solutions to ensure global accessibility to the highest attainable standard of health. Methods/Study Population: A systematic literature review will assess the regulatory reliance ecosystem and interactions among National Regulatory Agencies (NRAs). This will involve using a hierarchical control structure (HCS) to identify operational loop failures, decision-making, and information flow. The HCS will inform an STPA to prevent adverse outcomes like patient harm or regulatory non-compliance. With IRB approval, 10 regulatory experts will also be interviewed to gather insights on risk scenarios. Their input will be used to integrate regulatory pathways into the HCS for adaptability, and a second round of interviews will be conducted to validate the scenarios and assess the effectiveness of recommendations. Results/Anticipated Results: A preliminary literature review on regulatory reliance pathways from PubMed, WHO guidelines, and the DIA global forum, revealed potential risks in NRA interactions, such as overly redacted reports obscuring critical details and discrepancies in product versions or incomplete reviews affecting evaluations. Diverging guidelines and failure to adapt to country-specific needs are potential risks that also impact patient access to essential medicines. The STPA framework, along with expert feedback, will uncover unknown risks like “secondary-reliance” and soft risks, leading to sustainable recommendations to improve and optimize the safety of regulatory reliance. Discussion/Significance of Impact: Safe regulatory reliance is crucial for global health equity and patient access to essential and innovative medicines. STPA will identify and address different layers of risk in the system, improving safety, efficiency, and innovation for timely patient access to therapeutics.

A systems-based application for autonomous vessels safety: Hazard identification as a function of increasing autonomy levels

The demand for risk and safety analysis is becoming greater due to the increased complexity of modern systems such as autonomous ships. Safety is one of the main motivations behind the efforts of multiple organizations to develop autonomous ships. The adoption of an early system-theoretic approach to safety such as System Theoretic Process Analysis (STPA) is an effective way to integrate safety in complex systems. Furthermore, many authors have urged the use of this method to analyse the risks of autonomous vessels in the development phases. Applying STPA requires a description of the system to model the hierarchical control structure and conduct the analysis. At this stage, the functional description of autonomous ships remains limited, which poses a challenge in building the hierarchical control structure. This paper proposes a framework for developing a hierarchical control structure of an autonomous ship. The framework is founded on the principles of the STPA control structure and its five main elements. It makes use of the current shipping operation system, the available information about autonomous ships and the experience of seafarers executing diverse tasks on-board conventional ships. The application of the framework showed that the information provided by the seafarers is essential in developing an initial functional description of an autonomous ship. Furthermore, the results revealed that in addition to the technical aspects of autonomous ships, introducing these vessels into the organizational control structure of current maritime operation also poses challenges that need to be addressed in the earliest design phase.

By introducing autonomous or software-controlled systems, human operators are increasingly required to perform cognitive-intensive tasks in addition to existing labour-intensive tasks. As a result, it will be more difficult to identify human roles in future complex systems with traditional approaches such as hierarchical task analysis used in the conventional HRA. This paper proposes a novel systematic approach for a human reliability assessment to better understand human activities in complex systems. The proposed framework is a hybrid method combining the System Theoretic Process Analysis (STPA) and the Success Likelihood Index Method (SLIM) to assess the system reliability. The STPA is adopted to analyse the interaction relationship between different system components. The primary purpose of STPA is to find and analyse human activities that affect the risk in human-machine interaction systems. Then the identified human activities are evaluated and quantified by the SLIM as a probability of human error. The system reliability block diagram represents the derived human error probabilities to assess the entire system for a probabilistic risk assessment. Furthermore, the study proposed system alternations by comparing three different system configurations. Results demonstrate the importance of human performance in a complex system where humans, machines, and software interact.

Background: The automatic parking system (APS) is an advanced intelligent driving assistance system that depends on sensors, software algorithms, controllers, and actuators to complete parking tasks, ensuring safety and efficiency in the parking process. However, in different parking scenarios, the limitations of sensors and software algorithms potentially lead to a safety issue known as the safety of the intended functionality (SOTIF). Objective: To ensure the SOTIF of the APS, a more effective hazard analysis approach should be adopted to identify potential system hazards. Methods: The study proposes a hazard analysis approach based on systems theory process analysis (STPA), finite state machines (FSM), and the analytic network process (ANP). First, potential unsafe control actions (UCAs) and hazardous events are identified from system state transitions using the STPA-FSM method. Second, qualitative and quantitative cause analysis of UCA is performed using the STPA-ANP method to identify key causal factors. Finally, the proposed approach is applied to an APS, and the formal tool UPPAAL is used to verify the causal logic of the identified UCA and causal factors. Results: Take the state transitions of the APS model as an example; six UCAs and five hazardous events were identified. A qualitative cause analysis was conducted on UCA-1, identifying eight causal factors. The quantitative assessments were made on these causal factors to identify three key causal factors. Conclusion: The approach was suitable for the SOTIF hazard analysis of APS, and it could also be applied to other complex high-level intelligent driving assistance systems. It can identify potential UCAs in the dynamic changes of complex systems and determine key causal factors through causal analysis. Formulating corresponding safety strategies for these key causal factors can enhance the system';s SOTIF. This demonstrated the effectiveness of the approach in this patent.

Considering that few or no human operators are directly involved in the operation of Autonomous Marine Systems (AMS), an online risk model is necessary to enhance the intelligence of the AMS, its situation awareness, and decision-making. The current study identifies the criteria for an online risk model for AMS, which can be used to assess its validity and effectiveness.Taking an under-ice Autonomous Underwater Vehicle (AUV) operation as an example, the current work investigates how different risk analysis methods, namely the Preliminary Hazard Analysis (PHA), the Systems Theoretic Process Analysis (STPA), and Procedural Hazard and Operability Analysis (HAZOP), contribute to fulfilling the different criteria for online risk modeling of AMS. The analysis results show that STPA can be considered a good basis for developing an online risk model due to its relatively good coverage of the identified evaluation criteria, especially its ability to handle the interaction between system and software failure. In addition, considering some shortcomings of using STPA and the changing role of human operators in the AMS operation, PHA and Procedural HAZOP can be used as complementary tools. It is expected that the analysis results and conclusions can be adapted to other AMS as well.

The Information Harm Triangle (IHT) is a novel approach that aims to adapt intuitive engineering concepts to simplify defense in depth for instrumentation and control (I&C) systems at nuclear power plants. This approach combines digital harm, real-world harm, and unsafe control actions (UCAs) into a single graph named “Information Harm Triangle.” The IHT is based on the postulation that the consequences of cyberattacks targeting I&C systems can be expressed in terms of two orthogonal components: a component representing the magnitude of data harm (DH) (i.e., digital information harm) and a component representing physical information harm (PIH) (i.e., real-world harm, e.g., an inadvertent plant trip). The magnitude of the severity of the physical consequence is the aspect of risk that is of concern. The sum of these two components represents the total information harm. The IHT intuitively informs risk-informed cybersecurity strategies that employ independent measures that either act to prevent, reduce, or mitigate DH or PIH. Another aspect of the IHT is that the DH can result in cyber-initiated UCAs that result in severe physical consequences. The orthogonality of DH and PIH provides insights into designing effective defense in depth. The IHT can also represent cyberattacks that have the potential to impede, evade, or compromise countermeasures from taking appropriate action to reduce, stop, or mitigate the harm caused by such UCAs. Cyber-initiated UCAs transform DH to PIH.

Safety assurance remains paramount for the realization of autonomous vessels. A robust assurance methodology that can provide traceability throughout the design and verification process is necessary to demonstrate safety equivalence to that of conventional ships. However, there are few references that propose a holistic safety assurance scheme for autonomous ships, using actual engineering processes of ships as examples. This study proposes a design and development method for an autonomous navigation system that integrates Model-Based Systems Engineering (MBSE), System Theoretic Process Analysis (STPA), Failure Modes and Effects Analysis (FMEA), and several verification methods including simulation-based tests to develop a comprehensive safety assurance scheme. This safety assurance scheme is being conducted as a case study for a newly constructed autonomous vessel. First, STPA can be performed on the conceptual design established by MBSE to extract additional safety requirements from the identified loss scenarios. Focusing on the process model in the loss scenario description leads to a deeper understanding of the system behavior. FMEA in addition identify potential component failure modes and their impact on system safety. The multi-level requirements that emerge from these activities are validated in test scenarios. Simulators are used to evaluate whether the autonomous navigation system’s safety can meet predefined pass criteria in some of the scenarios. These activities ensure traceability from safety goals to design decisions, allowing design changes and their impact on safety to be evaluated throughout the development lifecycle and allowing for more systematic ongoing monitoring during operations.