STPA
Apply Systems-Theoretic Process Analysis to identify unsafe control actions and loss scenarios in complex automotive systems, including advanced driver assistance and autonomous driving.
- Chapters
- 11
- Chapters
- Interactive Tools
- 6
- Interactive Tools
- Case Study
- 1
- Case Study
- Video
- 1
- Video
Quick answers
- What is STPA in functional safety?
- STPA (Systems-Theoretic Process Analysis) is a hazard analysis method built on the STAMP accident model, which treats safety as a control problem rather than a component-failure problem. Instead of asking what breaks, STPA models the system as a hierarchical control structure - controllers, controlled processes, and feedback channels - and asks how control actions can be unsafe even when every component works as designed. The analysis identifies unsafe control actions (UCAs), derives the causal loss scenarios that explain them, and turns both into safety constraints. For automotive systems, especially ADAS and automated driving with their layered software controllers, STPA complements ISO 26262's HARA by finding interaction hazards that severity-exposure-controllability analysis of failures does not surface.
- What are the four types of unsafe control actions in STPA?
- For every control action, STPA asks four questions: is a hazard caused when the action is not provided when needed; when it is provided when it should not be; when it is provided too early, too late, or in the wrong order; or when it is stopped too soon or applied too long. Applying these four guide words systematically to every controller command produces the UCA table. In the course's adaptive cruise control case study, 8 control actions analyzed this way yield 31 unsafe control actions - including phantom braking cases a failure analysis would miss.
Why it pays for itself
Find hazards without failures
STPA catches unsafe system behaviour that arises from flawed control and interaction, not component failure - the class of hazard that failure-based methods like FMEA structurally cannot see.
Analyze systematically, not ad hoc
Model the hierarchical control structure, apply the four UCA guide words to every control action, and derive causal loss scenarios - a repeatable process that produces auditable tables.
Strengthen your HARA with STPA
Map safety constraints to functional safety requirements with traceability; in the course's ACC case study, four UCAs surface FSRs that conventional HARA had not captured.
What you’ll be able to do
Build System Control Structures
Construct complete hierarchical control structure diagrams that capture all controllers, controlled processes, and feedback paths.
Identify All Unsafe Control Actions
Apply the four UCA guide words systematically to every control action to generate a comprehensive UCA table.
Derive Causal Loss Scenarios
Develop detailed causal scenarios explaining how each UCA can arise, covering hardware, software, and human factors.
Apply STPA to ADAS Systems
Extend STPA methodology to complex automated driving functions with multi-layer control architectures and ODD constraints.
Integrate STPA with ISO 26262
Use STPA outputs as structured inputs to HARA, functional safety requirements, and safety architecture in ISO 26262.
Combine STPA with Traditional Methods
Design a combined hazard analysis strategy using STPA, HARA, and FMEA to achieve comprehensive safety coverage.
Chapter by chapter
- 01
STPA Overview
Understand the motivation for STPA, its advantages over traditional failure analysis, and where it fits in the safety process.
- Why STPA?
- STAMP foundation
- Scope of application
- 02
STAMP Model Foundation
Learn the Systems-Theoretic Accident Model and Processes framework that underpins STPA analysis.
- Safety constraints
- Control hierarchy
- Emergent properties
- 03
Control Structure Modeling
Build hierarchical control structure diagrams that capture controllers, controlled processes, and feedback channels.
- Controller identification
- Feedback paths
- Environment actors
- 04
Step 1: Unsafe Control Actions
Apply the four UCA guide words to systematically identify unsafe control actions for every controller command.
- 4 UCA types
- Guide word application
- UCA table
- 05
Step 2: Loss Scenarios
Derive the causal loss scenarios that explain how each unsafe control action can occur in practice.
- Scenario categories
- Causal factors
- Scenario table
- 06
Automotive Examples
Apply STPA to representative automotive systems: adaptive cruise control, lane keeping assist, and automated parking.
- ACC analysis
- LKA analysis
- Automated parking
- 07
STPA vs HARA & FMEA
Compare STPA with HARA and FMEA, understanding unique insights each method provides and how they complement.
- Coverage comparison
- Unique STPA insights
- Combined strategy
- 08
ISO 26262 Integration
Use STPA results as input to HARA, functional safety requirements, and safety architecture decisions in ISO 26262.
- HARA input
- FSR derivation
- Evidence mapping
- 09
Autonomous Systems
Extend STPA to highly automated and autonomous driving systems with complex multi-controller architectures.
- SAE Level 3-5
- ODD constraints
- MRC & MRC states
- 10
Tools & Automation
Survey available STPA tools, templates, and automation approaches including model-based STPA generation.
- STPA tools survey
- Model-based STPA
- Export formats
- 11
Best Practices
Apply proven STPA best practices for team facilitation, scope control, and integration with existing safety processes.
- Team facilitation
- Scope management
- Review process
Not just text: the visual toolkit
Control Structure Builder
Construct hierarchical control structure diagrams with controllers, processes, and feedback channels interactively.
UCA Analysis Table
Systematically apply the four UCA guide words to every control action and generate a complete UCA table.
Loss Scenario Generator
Derive causal loss scenarios from identified UCAs with structured scenario categorization and tracking.
STPA vs FMEA Comparator
Compare STPA and FMEA coverage side-by-side for the same system to identify analysis gaps.
Safety Constraint Mapper
Map STPA safety constraints to ISO 26262 functional safety requirements with bidirectional traceability.
Control Loop Animator
Visualize dynamic control loop behavior and failure modes in an interactive animated diagram.
STPA for Adaptive Cruise Control (ACC) with Stop-and-Go Capability
Perform a complete STPA on an ACC system including control structure modeling, UCA identification across all controller commands, and loss scenario derivation.
- Control structure with 5 controllers: ACC ECU, brake actuator, engine ECU, camera, radar sensor
- 8 control actions analyzed producing 31 unsafe control actions across 4 UCA types
- Critical UCA: "ACC applies brakes when not needed at highway speed" - Loss scenario: sensor latency + FP detection
- Safety constraint SC-12 derived: "ACC shall not apply brakes unless deceleration demand > 0.1g and object confirmed by 2 sensors"
- ISO 26262 mapping: 4 UCAs linked to 4 new FSRs not captured by conventional HARA
Unlock in course
Who this guide is for
- ADAS and autonomous driving safety engineers analyzing multi-controller architectures
- HARA facilitators hitting the limits of failure-based hazard identification
- Systems engineers who need to reason about software-intensive control interactions
- Safety teams building a combined STPA, HARA, and FMEA analysis strategy
Frequently Asked Questions
Common questions about STPA
Start the course today
A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required.