An Assessment of STPA as Applied to the Scaled Flight Demonstrator Test Program

Abstract

Systems Theoretic Process Analysis (STPA) is a methodology for system development and safety assessment which builds on the System-Theoretic Accident Model and Processes (STAMP) causality model which approaches safety as a dynamic control problem. The STPA methodology addresses system analysis and safety assessment for systems that involve complex human interactions and high degrees of coupling. The purpose of this paper is to demonstrate the application of STPA to the remotely piloted Scaled Flight Demonstrator (SFD) aircraft test program, and assess the effectiveness for test planning and risk assessment relative to the traditional Test Hazards Analysis (THA) process. The SFD aircraft is a 1:8.5 scaled model of the Airbus A320 which has been modified into a distributed electric propulsion (DEP) configuration. The aircraft was developed in collaboration with members of the Clean Sky 2 program: The Royal Netherlands Aerospace Centre (NLR), Technische Universiteit Delft (TU Delft), The Office national d'études et de recherches aérospatiales (ONERA), Centro Italiano Ricerche Aerospaziali (CIRA), Airbus, and Orange Aerospace. This effort identifies multiple benefits for flight testers when applying STPA to a highly complex system, including: increased knowledge of the system under test, forced collaboration between the test team and system experts, and identification of risks and mitigations that may otherwise be missed. The team also identifies some drawbacks to applying STPA, including: the time investment required to learn and apply the process, and the challenge in identifying specific hardware or software failure modes. Lessons learned and recommendations are presented to help other flight test professionals determine how and when STPA can best be applied to their programs in the future.