Leveraging Simulation and Automation for STPA

This paper discusses the use of simulation and automation while performing Systems-Theoretic Process Analysis (STPA). STPA, based on System Theoretic Accident Model and Processes (STAMP), focuses on identifying interactions between components in complex systems which lead to loss scenarios such as system hazards. STPA provides a systematic methodology centered on modeling a system’s control structure and component interactions. This paper introduces a framework for leveraging simulation and automation within STPA, which focuses on unsafe interactions between system components. An example case study of a helicopter system is used to model a control structure and extract control actions, automatically populate a spreadsheet with Unsafe Control Actions, establish traceability between STPA analysis and simulation artifacts, model a loss scenario as pass/fail criteria, and demonstrate the use of visualization tools and simulation to model unsafe control actions leading to a loss scenario. Industry standards are emerging to help engineers apply STPA when developing safety-critical systems such as autonomous vehicles, rail transit, and civil aircraft. SAE J3307, a standard published in March 2025, outlines steps required for STPA, which can be applied by engineers across industries while AIR 6913, currently a Work in Progress, will define guidance on applying STPA when analyzing system safety during the development of civil aircraft. STPA is also recognized as a useful framework to analyze the safety of “frontier AI”. Mylius cites STPA’s grounding in systems theory as making it ideally suited for analysis of emergent properties in complex systems. Falzone and Thomas describe Google’s use of STPA to identify weaknesses in the firm’s infrastructure, specifically citing the use of STPA to generate more incident mitigation recommendations than post-incident analyses. In general, STPA is recognized for its utility in the analysis of system safety for complex systems. System simulation has the potential to allow STPA practitioners to gather additional insights based on modeled system and component behavior, which we will show throughout this paper. The use of simulation and accompanying visualization tools is especially valuable with loss scenario identification. Krishnamurthy discusses the use of embedded safety constraints within a simulation environment leveraging CARLA and Simulink® for use as validators. Abdellatif and Holzapfel propose an STPA tool within Simulink. A key gap in both papers is the limited use of traceability across analysis artifacts. This paper discusses how traceability across models and analysis artifacts can be used to elicit additional insights and analyze the effectiveness of mitigation strategies. The example used in this paper is a modeled helicopter system including flight dynamics. The analysis focuses on the safety impact of a fictional new control system algorithm called “Level Cruise Mode” which is under consideration.