A systems perspective

STPA, System-Theoretic Process Analysis, is based on the STAMP model. It examines losses and hazards through the system’s control structure, including people, software, equipment and organisations. An interaction may become hazardous even when each component meets its own isolated specification.

Within process safety, this allows coordination, information and constraints to be examined alongside physical failures. Scope must be clear: which losses are to be prevented, which part of the system is included and which external conditions influence it.

Represent control and feedback

The structure identifies who controls which process, through which actions and with what feedback. A controller can be a person, software or an organisational entity; the model is not limited to electronic control circuits or automated equipment.

Feedback matters because decisions depend on the perceived state of the process. Outdated or incomplete information can make an apparently reasonable action inappropriate for the actual situation encountered during operation.

Unsafe control actions

Analysis considers whether a necessary action is missing, whether providing it creates a hazard, whether timing or sequence is wrong, or whether its duration is inappropriate where duration applies. Each case needs a defined context rather than a generic label of human error.

Scenarios then explain how the situation could occur and support development of constraints or requirements. For example, two individually valid authorisations could permit incompatible activities if their responsible parties have no effective coordination mechanism.

From scenarios to testable decisions

Traceability should connect loss, hazard, control action, scenario and proposed requirement. This makes it possible to review whether a design or procedural change addresses the analysed situation and what evidence will be needed to verify it.

STPA does not independently calculate accident frequency or replace every engineering test. It requires methodological competence and participation by people who understand the system. Its value lies in exposing hazardous interactions and guiding controls before design or operating arrangements embed them. Assumptions should be revisited when responsibilities, interfaces or operating conditions change.