STPA: System-Theoretic Process Analysis

STPA (System-Theoretic Process Analysis) is a hazard analysis method developed by Professor Nancy Leveson at MIT. It is based on systems theory: instead of asking which component can fail, it asks how the interactions between controllers, software, people and the physical process can lead to a loss.

That makes STPA effective where conventional methods struggle — complex software, human factors and interfaces between systems. The method is defined in the STPA Handbook (Leveson & Thomas, MIT, 2018).

FMEA and FTA start from components and their failures. STPA starts from the system and its control loops, so it also finds hazards that occur when every component works as specified — an unsafe command, a missing feedback, a wrong assumption about the process.

STPA looks at safety from many angles — people, environment and organisation as well as technology — and applies to product development, cybersecurity, operation and maintenance. The two kinds of analysis complement each other: on the same EPS system, STPA found 38 additional causes compared with FMEA (field report).

1. Define the purpose of the analysis

Identify the losses to prevent, the system-level hazards that lead to them, and the system-level constraints.

2. Model the control structure

Describe controllers, actuators, sensors and controlled processes, and the control actions and feedback between them.

3. Identify unsafe control actions (UCAs)

For each control action, check four ways it can be unsafe: not provided; provided when it causes a hazard; provided too early, too late or in the wrong order; stopped too soon or applied too long.

4. Identify loss scenarios

Explain why each UCA could happen — flaws in the control loop such as a wrong process model, missing feedback or sensor and actuator problems — and derive requirements and countermeasures.

To run these steps in a tool, see VisualPro STPA.

STPA is referenced in standards and guidance across industries, including:

• Automotive — ISO/PAS 21448 (SOTIF); SAE J3187, Recommended Practice for STPA in Automotive Safety Critical Systems

• Aviation — ASTM WK60748, Standard Guide for Application of STPA to Aircraft; SAE AIR6913; RTCA DO-356A (STPA-Sec)

• Nuclear — EPRI reports on STPA for digital I&C; NEI 20-07 Rev D

• Defence, security and medical — IEC 63187; NIST SP 800-160 Vol. 2; IET Code of Practice: Cyber Security and Safety; UL 2800-1:2022

• Any industry — SAE J3187A, STPA Recommended Practice for Safety-Critical Evaluations in Any Industry

Source: John Thomas and William Young, 2023 STAMP Workshop. Full list

• Automotive — EPS system · Engine Stop-Start system · Deriving misuse in autonomous vehicles · STPA and ODD · ISO/PAS 8800 for AI-based functions

• Aviation — UAM (eVTOL) · Aircraft assembly workplace safety

• Semiconductor — Why does a fab stop? · FEOL gas delivery system · Hidden risks in fabs · Maintenance with the interlock off

• Robotics — ISO 10218:2025 and ISO 25785-1

• Security — STPA and STPA-Sec · STPA-Sec for an industrial chiller

• Public health — National responses to COVID-19

• AI-assisted STPA — AI chat for loss scenarios · Scaling STPA at least 10× · Reusing countermeasures

VWAY helps teams introduce and apply STPA:

• STPA gap analysis — review current safety activities against STPA

• STPA application guide — how to apply STPA in your development process

• STPA safety and cybersecurity analysis — performing the analysis with your team

• VisualPro STPA — all four STPA steps with control-structure modelling, UCA and loss-scenario generation, STPA-Sec and reports. A free Lite version is available.

• VisualPro AI (STPA) — AI support for each of the four steps.

• TRACEIT — defines the control structure as data, by how signals are generated and passed, for STPA of complex systems with nested control loops.

Who developed STPA?

Professor Nancy Leveson at MIT. The method and its four steps are described in the STPA Handbook (Leveson & Thomas, 2018).

How is STPA different from FMEA and FTA?

FMEA and FTA analyse component failures. STPA analyses the control structure of the whole system, so it also finds hazards caused by unsafe interactions when no component has failed. The methods complement each other.

What is STPA-Sec?

STPA-Sec applies the STPA steps to security, so safety and security hazards can be analysed in one control structure. RTCA DO-356A uses STPA-Sec for the cybersecurity of digital systems.

Which standards mention STPA?

Among others ISO/PAS 21448 (SOTIF), SAE J3187, ASTM WK60748, SAE AIR6913, RTCA DO-356A, IEC 63187, NIST SP 800-160 Vol. 2 and UL 2800-1:2022 — see the list above.