Identifying Potentially Hazardous Control Actions Step

3 Identifying Potentially Hazardous Control Actions (Step 1) 

Starting from the fundamentals defined in chapter 7, the first step in STPA is to assess the safety controls provided in the system design to determine the potential for inadequate control, leading to a hazard. The assessment of the hazard controls uses the fact that control actions can be hazardous in four ways (as noted earUer)  

A control action required for safety is not provided or is not followed. 

An unsafe control action is provided that leads to a hazard. 

A potentially safe control action is provided too late, too early, or out of sequence. 

---

STPA is implemented in four steps [6] (1) establish the fundamentals of analysis (2) identify potentially hazardous control actions (3) use the identified potentially hazardous control actions to create safety requirements and constraints and (4) determine how each potentially hazardous control action could occur. In step 1, the safety analyst must identify the accidents or losses which will be considered, hazards associated with these accidents, and specify safety requirements (constraints). After establishing the fundamentals, the safety analyst must draw a preliminary (high-level) functional control structure of the system. In step 2, the analyst has to use the control structure as a guide for investigating the analysis to identify the potentially unsafe control actions. Then he or she translates them to corresponding safety constraints. In step 3, the analj t has to identify the process model variables for each controller (automated controller or human) in the control loop and analyze each path to determine how each potentially hazardous control actions could occur. At the end of the process, a recommendation for the system design should be developed for additional mitigations. 

Determine how each potentially hazardous control action identified in step 1 could occur. 

After the general control structure has been defined (or alternative candidate control structures identified), the next step is to determine how the controlled system (the two aircraft) can get into a hazardous state. That information will be used to generate safety constraints for the designers. STAMP assumes that hazardous states (states that violate the safety constraints) are the result of ineffective control. Step 1 of STPA is to identify the potentially inadequate control actions. 

Step 3 Identifying all potential hazards and determining the appropriate actions to control these hazards... 

As a part of an effective Health, Safety, and Environment (HSE) program, a Job Safety Analysis (JSA) has proved to be an effective accident and occupational illness prevention tool in many industries. The JSA, also known as a Job Hazard Analysis (JHA), is a safety management tool in which the risks or hazards of a specific job in the workplace are identified and measures to eliminate or control those hazards are determined and implemented. Most safety programs are considered reactive, an action in response to an incident. A JSA is considered a proactive approach to workplace safety. A JSA is a process of systematically evaluating certain jobs, identifying the hazards or potential hazard associated with each step of the job, and finding effective control measures to eliminate or reduce the risk of hazards and make the workplace as safe as possible, before those hazards have a chance to become accidents. 

---