Search Results

This paper presents a new methodology for the safety assessment of complex software intensive systems such as is envisioned for the coming major upgrade of the air traffic management system known as NextGen. This methodology is based on a new, more inclusive model of accident causation called Systems Theoretic Accident Model and Process (STAMP) [1]. STAMP includes not just the standard component failure mechanisms but also the new ways that software and humans contribute to accidents in complex systems. A new hazard analysis method, called Systems Theoretic Process Analysis (STPA), is built on this theoretical foundation. The STPA is based on systems theory rather than reliability theory; it treats safety as a control problem rather than a failure problem with interactive and possibly nested control loops that may include humans. In this methodology, safety is assured by closed loop control of safety parameters.

With the increasing complexity of automotive systems and the related increasing use of software in them, new approaches are needed to ensure safety. In these new types of automotive systems, safety and reliability are different and require different engineering approaches. Accidents are increasingly due to design errors and to dysfunctional interactions among components rather than component failure. In addition, safety must be engineered and built into the design from the beginning; it is not possible to effectively and affordably add safety devices onto a finished design. This paper describes the need for new approaches to automotive safety and describes an alternative to the traditional reliability-based approaches to safety engineering. The new approach is based on systems theory and views accidents in terms of lack of control or enforcement of the behavioral constraints required to ensure safety.