Next generation safety design for complex embedded systems

The next generation safety design for highly intelligent and complex systems is discussed. The conventional safety analysis methods such as FTA/ETA or FMEA are all 40-65 years old but our technology is very different today. The main difference is the introduction of computer software safety control. And, the conventional methods are difficult to be used for the complex system safety analysis, since the accidents are often caused by not simple component failures but complex interaction flaw among components and human actions. Hence, Nancy Leveson proposed the concept of STAMP (Systems-Theoretic Accident Model and Process) and the concrete procedure of hazard analysis, STPA (System-Theoretic Process Analysis) to solve the above problems. In the present paper, we discuss how STAMP/STPA is effective in the complex system safety analysis and how it is different from the conventional methods through two kinds of case studies. Also, we will discuss the possibility of STAMP/STPA utilization in NPP operation and maintenance works. (author)