The method
STPA (System-Theoretic Process Analysis) was developed by Nancy Leveson at MIT, based on the STAMP accident model. It suits complex systems where software, automation and operators interact: aviation, automotive, rail, industry, healthcare.
Rather than starting from component failures, it models the system as a control structure (controllers, control actions, feedback) and asks how control actions can become unsafe.
A variant, STPA-Sec, applies the same approach to system security.
When to use it
- Highly automated or software-intensive systems, where failure-based analyses (FMEA, trees) miss interactions.
- From early design: the method works on an architecture that is not yet detailed.
- Accident analysis, with the related CAST method.
Watch out for
- The number of unsafe control actions grows quickly: keep scope and level of detail under control.
- The control structure must include people and the organisation, not only automation.
- STPA complements classic analyses; regulations may still require FMEA or fault trees.
The four steps (STPA Handbook, 2018)
- Define the purpose of the analysis: losses, system-level hazards, safety constraints.
- Model the control structure: controllers, controlled processes, control actions and feedback.
- Identify unsafe control actions (UCAs): not provided, provided but unsafe, too early, too late or out of order, stopped too soon or applied too long.
- Identify loss scenarios that explain each UCA, then derive requirements and measures.
STPA tools
List from the Aurorisk catalogue, links checked on 2026-09-26. Confirmed free access is listed first; unknown information is labelled.
| Tool | Source · licence · access | Scope | Description |
|---|---|---|---|
| awesome-stpa ↗ | Open sourceFree | International | Curated list of STAMP/STPA resources. |
| MIT PSAS — STPA Handbook ↗ | Public bodyFree | United States | STPA handbook and STAMP resources from MIT. |
| STPAmaster ↗ | Free | International | STAMP toolset; free Lite version. |
| XSTAMPP ↗ | Open sourceFree | Europe | Eclipse platform for STPA and CAST. |
Standards and references
- Leveson N., Thomas J. — STPA Handbook (MIT, 2018)
- Leveson N. — Engineering a Safer World (MIT Press, 2011)