Safety-guided design

The assumption in this chapter is that the system design exists when STPA is performed. The next chapter describes safety-guided design using STPA and principles for safe design of control systems. 

Safety-guided design entails tightly intertwining the design decisions and their analysis to support better decision making. 

An Example of Safety-Guided Design for an Industrial Robot... 

The process of safety-guided design and the use of STPA to support it is illustrated here with the design of an experimental Space Shuttle robotic Thermal Tile Processing System (TIPS) based on a design created for a research project at CMU [57]. 

Environmental constraints deUmit how these goals can be achieved and identifying those constraints, particularly the safety constraints, is an early goal in safety-guided design. 

In the initial candidate architecture (control structure), a decision is made to introduce a human operator in order to supervise robot movement as so many of the hazards are related to movement. At the same time, it may be impractical for an operator to monitor aU the activities so the first version of the system architecture is to have the TTPS control system in charge of the non-movement activities and to have both the TTPS and the control room operator share control of movement. The safety-guided design process, including STPA, will identify the implications of this decision and wUl assist in analyzing the allocation of tasks to the various components to determine the safety tradeoffs involved. 

The safety-guided design process, including STPA, will identify the implications of the basic decisions in the candidate tasks and will assist in analyzing the allocation of tasks to the various components to determine the safety tradeoffs involved. 

The primary responsibility of the process controller is to produce conutiands to fulfill its control responsibilities. Again, the STPA hazard analysis and safety-guided design process will produce the application-specific behavioral safety requirements and constraints on controller behavior to ensure safety. But some general guidelines are also useful. 

---