Engineering for humans : a new extension to STPA

Abstract

From space shuttles to airplanes to everyday automobiles, today's systems are increasingly complex-and increasingly connected. In order to ensure that increased complexity does not simply bring an increased number of accidents, this new complexity demands new safety analysis tools. Systems-Theoretic Accident Model and Processes (STAMP) is a new accident causality model developed by Nancy Leveson at the Massachusetts Institute of Technology. This model has inspired several new methods, from accident analyses like Causal Analysis based on STAMP (CAST) to hazard analyses like Systems-Theoretic Process Analysis (STPA). Unlike traditional methods, which are based on chain-of-events causality models and generally identify only component failures, STPA can be used to identify design flaws, component interactions, and human factors that contribute to accidents. Though STPA takes a more thoughtful approach to human error than traditional methods--requiring analysts to consider how system conditions may lead to "errors"-it does not provide extensive guidance for understanding why humans behave the way they do. Prior efforts have been made to add such guidance to STPA, but there has yet to emerge a widely accepted, easy-to-use method for examining human behavior using STPA. The goal of this work is to propose a new method for examining the role of humans in complex automated systems using STPA. This method, called STPA-Engineering for Humans, provides guidance for identifying causal scenarios related to interactions between humans and automation and understanding why unsafe behaviors may appear appropriate in the operational context. The Engineering for Humans method integrates prior research on STPA and human factors into a new model intended for industry applications. Importantly, this model provides a framework for dialogue between human factors experts and other engineers. In this thesis, the Engineering for Humans method is applied to a case study of an automated driving system called Automated Parking Assist. Four different implementations of this system at different levels of automation are examined. Finally, it is demonstrated that STPA-Engineering for Humans can be used to compare how multiple system designs would affect the safety of the system with respect to the behavior of the human operator.