This presentation demonstrates the use of the Arcadia methodology and the open source Capella tool to implement a STPA-based analysis technique that augments the conventional HARA, HAZOP. The STPA approach extends the conventional methods to include a holistic perspective considering hardware, software, humans, and control failures in a balanced manner. Delivered by David Hetherington and Pascal Roques at the ERTS 2022 conference in Toulouse, France on 1 June 2022.

1. 2022 / 06 / 01
STPA Analysis of Automotive
Safety Using Arcadia and Capella
David Hetherington
Pascal Roques

2. 2/23
 Leading Model-Based Systems Engineering (MBSE)
consultant serving the automotive, semiconductor, oil and
gas, medical devices and other sectors
 Active member of:
• INCOSE (International Council on Systems Engineering)
• IEEE (Institute of Electrical and Electronics Engineering)
• SAE (Society of Automotive Engineers)
• United States Naval Institute
 David is the author of the SysML for Beginners book series
(Asatte Press) //asattepress.com/Books/SysML-Books-Simple-Series.html
Introduction: David Hetherington
david.hetherington@asattepress.com

3. 3/23
 Senior Consultant, 30+ years of experience
• SADT, OMT, UML, SysML, Arcadia/Capella
 UML2 and SysML Certified by OMG
 ASEP Certified by INCOSE
 Arcadia/Capella Trainer for Thales (2008-19)
• 160+ sessions, 1600+ trainees
 Author of UML/SysML best-sellers in France
 … and of the first Capella book!
Introduction: Pascal Roques
pascal.roques@prfc.fr

4. 4/23
Our Collaboration
Pascal Roques
David Hetherington
• Top Arcadia/Capella
trainer and consultant
• Deep SysML and
UML experience
• Author: Arcadia
• Author: UML, SysML
• Top MBSE consultant
• Deep SysML
experience
• Deep functional
safety experience
• INCOSE Auto
Working Group
• Author: SysML for
Beginners Series
Due: Fall 2022
This presentation/paper is an exploration of
combining automotive functional safety
perspective (Dave) with deep familiarity with the
Arcadia method and Capella tool (Pascal).

5. 5/23
 Historical Safety Approaches not Well Matched to
Current Challenges
Motivation

6. 6/23
 The STPA Generic Control Loop
STPA
Controller
Control
Algorithm
Process
Model
Controlled Process
Control
Actions
Feedback
Adapted from STPA Handbook Figure2.6 on page 23

7. 7/23
 The Bold Truck Electric Sport Utility Vehicle
 Modeled with Capella / Arcadia
Case Study

8. 8/23
Case Study
https://www.omg.org/spec/RAAML/
 Valid Automotive Situation

9. 9/23
 Valid Situations
 Freeway Context
Case Study
Name Vehicle Usage
Traffic and
People
Road Condition Location
Environmental
Condition
Freeway
Driving forward
at >100 km/hr
Light traffic.
Nearest car is 15
seconds away.
Clean, dry,
asphalt
Public high-
speed highway
Warm, sunny,
dry, normal
humidity

10. 10/23
STPA 1 – Define Purpose of the Analysis

11. 11/23
STPA 1.1 – Identify Losses

12. 12/23
STPA 1.2 – Identify System-Level Hazards

13. 13/23
STPA 1.3 – Id. System-Level Constraints

14. 14/23
STPA 2 – Model the Control Structure

15. 15/23
STPA 2
 Level 1 – The Vehicle, its Driver, and the Environment

16. 16/23
STPA 2
 Level 2 – Power Inverter Control Loop

17. 17/23
STPA 2
 Level 2 – Power Inverter Control Loop with FC

18. 18/23
STPA 3 – Identify Unsafe Control Actions

19. 19/23
STPA 3
 Level 2 – UCA Linked to Functional Chain

20. 20/23
STPA 4 – Identify Loss Scenarios

21. 21/23
STPA 4
 Level 2 – Loss Scenario, UCA…

22. 22/23
 The Arcadia method, the Capella tool, and the STPA Hazard analysis
technique can all contribute to a robust automotive safety program
• STPA can be implemented using SysML tools or specialized safety
analysis tools. However, the Arcadia method and Capella tool offer some
convenient features that ease the analysis
• In particular, functional chains are a very good fit for the fundamental
control loop approach of STPA
 The purpose of this presentation was to explore functional chains
and STPA. A full implementation of automotive functional safety
would need either a Capella addon or integration with another
specialized tool. Others who are exploring this sort of integration
include:
• ALL4TEC with their Safety Architect tool: https://www.all4tec.com/en/safety-
architect-fmeca-fta-sofware/
• Session We.2.PO.4 14:15 – “Towards Model-Based Support for STPA as a Capella
Add-On”
Conclusion

23. 23/23
Useful Links …
Web Sites:
• www.eclipse.org/capella/index.html
• asattepress.com/Books/SysML-
Books-Simple-Series.html
• www.prfc.fr/en