A systems-theoretic approach to safety in software-intensive systems

Abstract

Traditional accident models were devised to explain losses caused by failures of physical devices in relatively simple systems. They are less useful for explaining accidents in software-intensive systems and for non-technical aspects of safety such as organizational culture and human decision-making. This paper describes how systems theory can be used to form new accident models that better explain system accidents (accidents arising from the interactions among components rather than individual component failure), software-related accidents, and the role of human decision-making. Such models consider the social and technical aspects of systems as one integrated process and may be useful for other emergent system properties such as security. The loss of a Milstar satellite being launched by a Titan/Centaur launch vehicle is used as an illustration of the approach.

Formalising Responsibility Modelling for Automatic Analysis

“…Leveson [19], Leveson and Dulac [20] describe an alternative methodology, STAMP, for analysing interactions between heterogeneous systems components. In addition to providing a modelling notation based on systems dynamics, the technique also incorporates a methodology for identifying potential instabilities in system behaviour that may eventually lead to failure.…”

“…In addition to providing a modelling notation based on systems dynamics, the technique also incorporates a methodology for identifying potential instabilities in system behaviour that may eventually lead to failure. Leveson illustrates the technique by re-constructing the causes of the failure of the MilStar Satellite launch in 1999 [19]. A disadvantage is the need for expert application of the method to identify weaknesses.…”

Hazards in advising autonomy: incorporating hazard modelling with system dynamics into the aerospace safety assessment process for UAS

“…Both FTA and DD are examples of what Leveson describes as "chain-of-event" models of accident causation [9], and posits that these types of models "... cannot account for indirect and nonlinear relationships". Leveson describes that the systems of interest, in accident causation, are typically Open Systems, and maintained in a state of dynamic equilibrium through closed loop control and feedback.…”

“…Furthermore, this study has been pursued to develop a broader Systems approach towards hazard assessment so as to evaluate hypothetical deviations from declared intent -wherein a behavioural modelling framework is to be styled upon that of a STAMP [9] (Systems Theoretic Accident Model and Processes) based hazard assessment methodology and drawing upon STPA [15,18]. It is proposed that one might combine the associated system models, undertake exploratory dynamic hazard assessment, and conduct this within the context of a Preliminary Aircraft Safety Assessment (PASA); as a possible extension to the process guidelines as described in Aerospace Recommended Practice (ARP) 4754A [3]; as outlined in Figure 1.…”

Dynamically Evolvable Dependable Software: From Oxymoron to Reality

“…With respect to dependability, StPowla intends to be a bridge between high level analysis, likely those advocated in [27], which may be performed on the workflows, and the subsequent development phases. As usual in a divideand-conquer approach, the properties assessed at the workflow level assume that services offering the required service levels are available, and therefore act as requirements for the software processes procuring such services, let it be by in-house development, out-sourcing, buying, exploiting open source projects, and searching registries.…”