Extending the Human Controller Methodology in Systems-Theoretic Process Analysis ( STPA )

Traditional hazard analysis techniques are grounded in reliability theory and analyze the human controller-if at all-in terms of estimated or calculated probabilities of failure. Characterizing sub-optimal human performance as "human error" offers limited explanation for accidents and is inadequate in improving the safety of human control in complex, automated systems such as today's aerospace systems. In an alternate approach founded on systems and control theory, Systems-Theoretic Process Analysis (STPA) is a hazard analysis technique that can be applied in order to derive causal factors related to human controllers within the context of the system and its design. The goal of this thesis was to extend the current human-controller analysis in STPA to benefit the investigation of more structured and detailed causal factors related to the human operator. Leveraging principles from ecological psychology and basic cognitive models, two new causalfactor categories-flawed detection and interpretation offeedback and the inappropriate affordance of action-were added to the human-controller analysis in STPA for a total of five categories. In addition, three of the five human-controller causal-factor categories were explicitly re-framed around those environmental and system properties that affect the safety of a control action-the process states. Using a proposed airspace maneuver known as In-Trail Procedure, a former STPA analysis was extended using this updated human-controller analysis. The updated analysis generated additional causal factors under a new categorical structure and led to new instances of specific unsafe control actions that could occur based on additional human factors considerations. The process, organization, and detail reflected in the resultant causal factors of this new human-controller analysis ultimately enhance STPA's analysis of the human operator and propose a new methodology structured around process states that applies equally as well to an automated controller. Thesis Supervisor: Nancy G. Leveson Title: Professor of Aeronautics and Astronautics and Engineering Systems