Systems Theoretic Process Analysis (STPA): a bibliometric and patents analysis

Modelo teórico - Sistêmico de Análise de Processos (STPA): uma análise bibliométrica e de patentes

Abstract:

The Systemic Theoretical Process Analysis (STPA) model is used for hazard analysis and accident prevention, based on systemic thinking and the identification of causal scenarios, created by Professor Nancy Leveson of the Institute of Technology of Massachusetts (MIT). The purpose of this article is to perform a bibliometric and patent analysis of the STPA model. Since bibliometry is an important tool in the analysis of scientific production, this method is used as a descriptive statistic, for the purposes of this study, the concepts of Goffman's Epidemic Theory were highlighted, under a mainly qualitative analysis, for a study of decline and ascent scientific method. For the bibliometric analysis, the main page of Professor Nancy Leveson was used in MIT's Web site, besides the Web of Science, Mendeley, ResearchGate, Village of Engineering and Scientific Electronic Library Online (SciELO). Aiming to cover the patents analysis it was used the Derwent, IHS and Orbit research bases. Defining as search term “Analysis of the Theoretical Process of Systems” and “STPA”, searched in the title, abstract and keywords. A total of 171 publications (1990 to 2017) were found, with 89 specific references of the STPA model (2002 to 2017), addressing several subjects such as: definitions, steps, complements to the model, areas of application and use of the model with another risk analysis tool. At the end of this article are highlighted the main works of the STPA model, tools of support and analysis, serving as base and favoring future works.

Keywords:
bibliometrics; STPA; accidents prevention; hazard analysis; systemic thinking

Resumo:

O modelo Teórico - Sistêmico de Análise de Processos (STPA) é utilizado para análise de perigos e prevenção da ocorrência de acidentes, baseado no pensamento sistêmico e identificação de cenários causais, idealizado pela professora Nancy Leveson do Instituto de Tecnologia de Massachusetts (MIT). O objetivo deste artigo é realizar uma análise bibliométrica e de patentes do modelo STPA. Sendo a bibliometria uma importante ferramenta na análise da produção científica, utiliza-se deste método de forma Estatística descritiva, para fins deste estudo foi dado destaque aos conceitos da Teoria Epidêmica de Goffman, sob uma análise principalmente qualitativa, para estudo de declínio e ascensão deste método no meio científico. Para a análise bibliométrica foram utilizadas como base de dados a página principal da Professora Nancy Leveson no site do MIT e sites de pesquisa científica, dentre eles: Web of Science, Mendeley, ResearchGate, Engineering Village e Scientific Electronic Library Online (SciELO). Para o levantamento de patentes as bases de pesquisa utilizadas foram Derwent, IHS e Orbit. Definindo como termo de busca “Systems Theoretic Process Analysis” e “STPA”, buscado no título, resumo e palavras-chave. No total foram encontradas 171 publicações (1990 a 2017), sendo 89 referências específicas do modelo STPA (2002 a 2017), abordando diversos assuntos como: definições, passos, complementos ao modelo, áreas de aplicação e utilização do modelo em conjunto com outra ferramenta de análise de risco. Ao final deste artigo são destacados os primeiros trabalhos do modelo STPA, ferramentas de apoio e análises, servindo como base e favorecimento trabalhos futuros.

Palavras-chave:
bibliometria; STPA; prevenção de acidentes; análise de perigos; pensamento sistêmico

1 Introduction

The speed of technological advancement demands on the same scale, in diverse business segments, actions that accompany and guarantee basic precepts to mitigate risks to people, the environment, assets, and corporate reputation. The opportunities to transform common enterprises into modern, competitive companies, which are committed to society, employees, partners, shareholders, customers, and government, advance not only in macro-environmental monitoring actions, where technical knowledge is needed in different conditions related to workers and the environment, but also in related behavioral and educational situations. In this context, the systemic view becomes more professional and helps identify new and more comprehensive methods.

Most methods to research and investigate accidents relied on the use of linear event chain models, in which the causality of the accident is described as a chain of failure events and human errors that led to the event with real loss, among them: Failure Modes and Effects Analysis (FMEA), Fault Tree Analysis (FTA), Event Tree Analysis (ETA), and Cause and Consequence Analysis. Such models are limited in their ability to deal with complex system crashes (resulting from interactions between components and not just individual crashes), software-related crashes, highly complex human decision making, and system adaptation or migration of an accident over time (Leveson et al., 2003).

Modern complex systems require understanding of the interactions and interrelationships between the technical, human, social, and organizational aspects of the system. In an attempt to model the dynamics of these complex technical partner systems, some theories have significant contributions, including Rasmussen’s hierarchical socio-technical framework in 1997 (Rasmussen, 1997) and the Systems Theoretic Accident Model and processes (STAMP) by Leveson in 2002 (Leveson, 2002). Rasmussen adopted a system-oriented approach based on a hierarchical socio-technical framework to model the contextual factors involved in organizational, administrative, and operational structures that create the preconditions for accidents. Leveson proposed a causal model in which accidents would be treated as a result of dangerous processes involving interactions between people, social and organizational structures, engineering activities, and components of the physical and software system. In other words, Leveson recognized that the problem or failure resides throughout the system and that all play an essential role, that is, a multi-causal analysis. In addition, early risk analysis is an extremely useful tool, because when performed early in the project, the cost may be insignificant, unlike the development or operation phase that causes rework.

In this article, the existing intellectual production of the Theoretical-Systemic Analysis of Processes (STPA) model is used to support research and future work. For with this purpose, the data sources and the research method were established in the period of 2002 to 2017, which encompasses the launch of the method up to the current research.

2 Design and definitions of the STPA model

Systems theory includes the principles, models, and laws necessary to understand complex interrelationships and interdependencies between components (technical, human, organizational, and managerial). In a systems theory approach to modeling, systems are considered as interactive components that maintain equilibrium through feedback and control contacts. A system is not static, but is a dynamic process that continually adapts to achieve its objectives and react to changes in itself and its environment (Qureshi, 2008).

New approaches to accident modeling adopt a systemic view that considers the performance of the system as a whole. Systemic models consider the occurrence of an accident when several causal factors (human, technical, and environmental) coincide in a specific time and space (Hollnagel, 2004). Systemic models see accidents as emerging phenomena, which arise from complex interactions between system components, and can lead to degradation of system performance or result in an accident.

In a systemic view, one of the first causal models for accidents was the Domino theory, proposed by Heinrich in the 1930s, which describes an accident as a chain of discrete events occurring in a given temporal order (Heinrich, 1931). Another relevant model, proposed in 1997, was the “Swiss Cheese”, a model of sequential or epidemiological accidents that considered the accident process as a simple chain of cause and effect events (Ferry, 1988; Reason, 1997).

The major difference between systemic accident models and sequential or epidemiological accident models is that systemic accident models describe an accident process as a complex and interrelated network of events. In this light, Rasmussen in 1997 based his studies in highly volatile and dynamic environmental conditions, such as market competition, economic and political pressures, legislation and social awareness raising, by integrating a hierarchical socio-technical framework. His model also considered contextual factors involved in organizational, administrative structures, and operational conditions that create the preconditions for accidents (Qureshi, 2008).

In this same vein, the STAMP model considers three fundamental concepts of Systems Theory: Emergency and Hierarchy, Communication and Control, and Process Models. From this, three major models of hazard analysis were derived: System-Theoretic Early Concept Analysis (STECA) to analyze the design, Systems Theoretic Process Analysis (STPA) described below, and Causal Analysis using System Theory (CAST) for analysis after the accident.

STPA is a technique to analyze hazards and undesirable scenarios for prevention and non-occurrence of accidents, in which a collection of interactive control loops is used in system analysis. Figure 1 illustrates the top-down relationship of the model.

Figure 1
Loop of Control Model. Source: Adapted from Leveson (2011).

Like traditional methods, it seeks to identify scenarios that lead to identification of risks and, therefore, to losses that can be mitigated or controlled. The great difference of this technique comes from the analysis of hazards, considering not only the failure of a component or operator, but the existing hierarchical relation seen from different perspectives (Leveson, 2002). Thus, STPA is an approach that, in contrast to traditional techniques of hazard analysis, aims to identify more causal factors and dangerous scenarios, particularly those related to software, system design, and human behavior (Leveson, 2011).

The STPA model does not generate a hazard-related probability because it considers that in a complex system, when using the available probabilities, important causal factors are also omitted, in addition, some factors that do not have probabilistic information (such as new projects that do not have an available historical basis). Therefore, STPA can identify a greater number of causes, from the failure of projects to the insecure interaction with operational components. This information can then be used to eliminate, reduce, and control risks in the design, development, and operations of the system (Leveson, 2002). Furthermore, the production of probabilistic analyzes that do not accurately reflect the true risk can generate false security and lead to accidents due to compliance and non-correction of project failures (Leveson, 2011).

A major motivator of the STAMP and STPA model is a new way of visualizing accidents, resulting from the demand for more secure engineering methods to deal with modern problems and complex systems. Although STPA is a new method, it has already produced good results in several areas of activity, such as aerospace, defense, automotive, medicine, and energy (Campagnaro, 2016).

Some definitions regarding the STPA model are presented in Table 1.

Table 1
STPA Model Definitions.

Cause	Existence of a set of sufficient and necessary conditions for the event to occur, called Unsafe Control Actions (UCA).
Accidents	Unintended and unforeseen event that results in losses, including injuries and human lives, property damage, environmental pollution, loss of mission, financial loss, among others.
Hazard	State of the system that, along with the worst environmental conditions, will lead to an accident.

• Source: Adapted from Leveson (2011).

2.1 Steps of the STPA method

STPA is basically an approach developed from the STAMP model, which lists the general scope of the main accidents and hazards of the system and builds a control structure based on the process control model, by considering systemic thinking, the whole relationship hierarchy in top-down analysis. It is different from the theory of reliability, because it brings the benefit of analysis from different perspectives.

The first step of the STPA is to identify the Unsafe Control Actions (UCAs), which are separated into four types.

1. 1

   A control action required for safety is not provided (for example, the air traffic controller does not issue a necessary warning to maintain a safe distance apart).

2. 2

   An unsafe control action is provided and leads to a hazard (for example, an air traffic controller issues a warning that leads to the occurrence of the accident).

3. 3

   A potentially secure control action is provided too late, too early, or out of sequence.

4. 4

   A safe control action is interrupted or applied excessively (for example, the pilot performs the required ascending maneuver, but continues this maneuver after the flight level is reached) (Leveson, 2011).

The second and final step in STPA is to identify potential causes by formulating possible scenarios, i.e., causes of dangerous behaviors. The identified scenarios can then be used to eliminate the causes of the system or, if that is not possible or practical, to mitigate them. Mitigation can involve changing any part of the control circuit, assigned responsibilities, controlled process design, control actions, projected feedback, media, among others (Leveson, 2011).

Thus, performing the first step of the STPA provides the requirements for the second step, which identifies the scenarios that lead to dangerous control actions that violate the security constraints of the component. Once the potential causes have been identified, the project can be verified to ensure that the identified scenarios have been eliminated or otherwise controlled. If a design does not yet exist, designers and managers have the opportunity to eliminate or control system behaviors as the design is created (Leveson, 2011).

2.2 Conceptual Map: What is STPA?

To conclude this step, a conceptual map was built using the CmapTools software. Conceptual maps, in turn, were created by Novak, so that the students had a pedagogical strategy relevant in the construction of scientific concepts, helping to relate information and assign greater meaning to the study (Novak, 1990; Rabechini & Carvalho, 2013). Thus, Figure 2 presents the conceptual map developed by the authors with the focus question “What is STPA?”.

Figure 2
Conceptual map: What is STPA?

3 Bibliometric method

For the broad understanding of the model, bibliometric analysis or bibliometric research considered relevant was classified in a quantitative technique, using mathematical and statistical methods to quantify the production, dissemination, and use of previously registered information (Tissot et al., 2017).

According to Guedes & Borschiver (2005), Bibliometrics is a set of laws and empirical principles that contribute to establish the theoretical foundations of Information Science. The term “statistical bibliography”, now Bibliometrics, was first used in 1922 by E. Wyndham Hulme, which is prior to the date attributed to the formation of the area of ​​Information Science, with the connotation of enlightenment of the scientific and technological processes, by means of document counting. In addition, the term statistical bibliography was considered unsatisfactory to refer to the technique, and over the years, the consensus among the authors dedicated to the subject renamed it Bibliometrics. Pritchard popularized the term bibliometrics in 1969, and the technique was designed to meet the need to study and evaluate activities of scientific production (Pritchard, 1969; Tissot et al., 2017).

The main bibliometric laws are: Bradford’s Law, (productivity of periodicals), Lotka’s Law (scientific productivity of authors), and Zipf’s Law (frequency of words). Bradford’s Law helps to estimate the degree of relevance of journals in a given area of ​​knowledge, considering that the journals that produce the greatest number of articles on this subject form a nucleus of periodicals, supposedly of higher quality or relevance in the area. Lotka’s Law considers that some researchers, supposedly with more prestige in a certain area of ​​knowledge, produce a lot, and many researchers, presumably of lesser prestige, produce a little. With Zipf’s Laws, it is possible to estimate the frequencies of occurrence of words in a given scientific and technological text and the region of concentration of indexing terms, or keywords (Guedes & Borschiver, 2005).

Although, other currents exist in the bibliometric field, today, bibliometrics uses, to a large extent, the analysis of citations. According to Araújo (TISSOT et al., 2017), this analysis points to a series of standards related to scientific knowledge, such as the most cited authors, the most productive authors, the impact factor of authors and journals, the most used types of documents, obsolescence of the literature, elite research, among others. The purposed is to encourage researchers to undertake more innovative domains of science, with the need to foster a shift in the scientific community as a whole, and the objective of restricting the indiscriminate use of short-term bibliometric indicators (Nassi-Caló, 2017).

The method applied in this study has a qualitative and quantitative approach, which can be considered descriptive-exploratory in relation to its objective and in relation to the procedures. This research was bibliographical (which uses material already produced, basically consisting of books and scientific articles) or documentary (which uses more diverse sources, without deep analytical treatment, such as: statistical tables, newspapers, magazines, reports, official documents, among others) (Fonseca, 2002).

In relation to the research procedure, the line between documentary research and literature review is tenuous, and some authors see more similarities than differences between them (Tissot et al., 2017). Taking into account that this study is a bibliometric survey, these procedures were considered.

In addition, regarding the Bibliometric Law, for the purposes of this study, the concepts of Goffman’s Epidemic Theory were used, under a qualitative analysis. This is based on the analogy of the transmission of an infectious disease in the transfer and development of ideas, information recorded in a scientific community (Goffman & Newill, 1964; Guedes & Borschiver, 2005). According to this model, in the course of an intellectual epidemic, the scientific ideas are transmitted, for example, by direct communications, between a presenter and the public, or through conversations. These ideas can also be presented by an author, in newspaper articles, to a particular audience.

Goffman’s mathematical analysis was able to predict the conditions for controlling the epidemic, the rate of growth and decline, and made it possible to define the conditions under which the epidemic would decline and become stable. Similarly, this theory makes it possible to estimate the levels of importance of research lines in a given area of knowledge and to predict the behavior of these lines of research (Guedes & Borschiver, 2005).

For the bibliometric research database, the main page of Professor Nancy Leveson, creator of the method, was used on the Massachusetts Institute of Technology website and selected scientific research sites: Web of Science, Mendeley, ResearchGate, Engineering Village, and Scientific Electronic Library Online - SciELO.

Web of Science is a database available in the periodical portal of the Coordination of Improvement of Higher Education Personnel (CAPES) of the Ministry of Education (MEC). It provides access to the most trusted, integrated, and multidisciplinary search connected through citation metrics for linked content from multiple sources in a single interface. And connecting the entire search and discovery process through: Multidisciplinary content, emerging trends, specific subject content, regional content, research data, and analysis tools (CAPES, 2018).

Mendeley is a free reference manager and academic social network that supports research organization, collaboration between online researchers, and discovery of the latest publications (Elsevier, 2017b). In addition, studies have already proven the use of Mendeley as a more effective way than other sources of research to identify highly cited publications (Zahedi et al., 2017).

ResearchGate can be defined as a social networking platform whose main goal is to connect researchers with common interests. It has repositories that allow authors to upload a version of their manuscripts for public “open access” display, which facilitates sharing and solicitation of feedback on the work from colleagues in the field (Fortney & Gonder, 2015). Although this search channel allows any user to enter information, it has gained prominence by the great collection available.

Also available on the CAPES/MEC portal, Engineering Village offers access to engineering literature and patent databases that cover a wide range of reliable engineering sources. Its benefits include the availability of several filters and selected databases for a wide and deep search of content (ELSEVIER, 2017a).

SciELO is an electronic library that covers a selected collection of Brazilian scientific journals, with the objective of developing a common methodology for the preparation, storage, dissemination, and evaluation of scientific production in electronic format. It is the result of a research project of the Foundation for Research Support of the State of São Paulo (FAPESP), in partnership with the Latin American and Caribbean Center for Health Sciences Information (BIREME). In addition, since 2002, the Project has the support of the National Council for Scientific and Technological Development (CNPq) (SciELO, 2017).

For the survey of patents, the following were used: Derwent Innovations Index, IHS Knowledge Collections, and ORBIT Intelligence.

Derwent, available in CAPES/MEC journals, collects data from 42 patent offices around the world. It also organizes the patents by family, listing those referring to the same invention. It has references and summaries with links to full text documents, as well as references related to the areas of engineering, chemistry, electrical, electronics, and mechanics. The database publishes works from 1963 to the present (Santos, 2017).

IHS Markit provides a deep source of information, analysis, and solutions for companies, financial markets, and governments around the world. A team of analysts and specialists continually improve information solutions and resources for faster and more effective decision making, enabling clients to conduct strategic insights into topics, events, and issues that impact the global business community (Andrade, 2016; IHS Markit, 2018).

ORBIT is software developed and managed by QUESTEL, which offers a complete suite of services based on the productivity of research and collaboration dedicated to intellectual property with various analysis capabilities, allowing the generation and visualization of graphs, maps, and diagrams relating to patents, company depositors, and inventors. In addition, it covers patent bases from more than 96 countries, of which 21 are full texts and more than 40 with the availability of PDFs (SEDETEC, 2014).

4 Main results

For the bibliometrics process, the research to build the database for this article was carried out from August to December, 2017. The terms defined were “Systems Theoretic Process Analysis” and “STPA”, in the title, abstract, and keywords.

In total, 558 publications, from 1990 to 2017 were found. Of these, 89 were STPA specific references, which address several issues such as: definitions, steps, complements to the model, areas of application, and use of the model in conjunction with other risk analysis tools. The results are presented graphically for a better illustration.

Figure 3 shows the selected scientific database units and the results obtained.

Figure 3
STPA Bibliometrics Database.

From the general research concerning the defined term, we filtered which publications made specific reference to STPA, to select for the next analyzes, and from these repeated materials were filtered and removed.

Figure 4 shows the number of publications per year, with the first book citing the STPA model published in June 2002, titled “System Safety Engineering: Back to the Future”, and the first paper was from 2003, titled “A New Approach to Hazard Analysis for Complex Systems”. After 2011, the number of publications increased significantly, among possible reasons was the launch of the book “Engineering a Safer World”, which broadly addresses STAMP and STPA. In addition, in 2012 the first STAMP/STPA Workshop was held at MIT, and in 2013, the first European STAMP Workshop in Germany.

Figure 4
Number of publications per year.

The database also shows a decrease of 19 publications in 2014 to 12 publications in 2015, and again the growth in 2016 and 2017 (until the month of December) with 18 and 19 publications, respectively.

Figure 5 lists the types of publications (book, book chapter, article, among others). Observe that 68% of the material found and analyzed in the databases were articles, 12% dissertations, 5% technical reports, and 4% theses, with others materials in smaller quantities.

Figure 5
Types of publications.

The number of publications by country are illustrated in Figure 6. Most of the works were developed in the United States, where the method originated and, second, Germany and China. In Brazil, an article from the Technological Institute of Aeronautics-ITA, was published called “Towards a combined safety and security constraints analysis” by Daniel Pereira, Celso Hirata, Rodrigo Pagliares, and Simin Nadjm-Tehrani, in 2017. Additional research in the institutional database of the ITA found other works including: two dissertations, one titled “Application of the STPA technique in the analysis of the risk of light aircraft take-off with crossed crosswind” by Diogo Silva Castilho in 2015 and another titled “System Safety Assessment based on System Theory Process Analysis and Model Checking” by Alheri Longji Dakwat in 2017; and, a undergraduate paper, “Cubesat hazard analysis using STPA” by Leandro Scopel Campagnaro in 2016.

Figure 6
Countries of origin of documents.

Relevant information is the number of citations a work receives, which is a fundamental metric on its relevance in the academic and scientific world.

The database included which universities the authors had a connection to (some of which included authors from more than one teaching institution). Figure 7 reveals the Massachusetts Institute of Technology as the largest producer of scientific papers with the theme STPA.

Figure 7
Universities of origin of documents.

Regarding the areas of application of STPA, Figure 8 indicates that Systems Engineering was the most approached topic, and secondly applications in the area of ​​Health, followed by Software Engineering. It is possible to a diversification since its creation can be observe, because the examples treated in the first works of the author mainly referenced the Aerospace sector.

Figure 8
Areas of application of STPA.

In Figure 9, some of the techniques cited consider: Fault Tree Analysis (FTA), Analysis of Events Tree (ETA), Analysis Failure Modes, Effects and Criticality Analysis (FMECA), Hazard and Operability (HAZOP), and Matrix of Risk. The research covered the abbreviations and names in English and Portuguese, in titles, keywords, and abstracts.

Figure 9
Comparison of STPA with other methods of Risk Analysis.

The greatest comparison was with the techniques FTA and FMEA, or only the citation or deep application, revealing the differences and results obtained with each technique in comparison to the STPA.

For a better understanding, the definition of each risk analysis technique cited in the research are presented in Table 2.

Table 2
Definitions of other techniques and methods of risk analysis.

Technique or Method of Risk Analysis	Definition
ETA	ETA is a logical, qualitative or quantitative method that is used to identify possible outcomes and, if necessary, their probabilities, given the occurrence of an initiating event. ETA is a type of inductive analysis, in which the basic question addressed is “what happens if ...”, for example, “What happens if there is an earthquake of magnitude M6.5 and average acceleration (PGA) of 0.27 g ” (Hartford & Baecher, 2004).
FMEA	It is a systematic and analytical technique of quality planning in the stages of the product, design, process and service, evaluating potential failures and, thus, supporting the diagnosis of defects. The objective is to classify all possible failures according to their measured effect in terms of severity, occurrence and detection, generating in the end the solutions to eliminate or minimize them (Basu, 2004).
FMECA	It is a qualitative safety analysis technique that evaluates dangerous events to the system, classifying the consequent level and severity. During this analysis, the following questions should be answered for each component of the system: 1. How can the component fail? 2. What are the causes of failure? 3. What are the consequences? 4. How critical are the consequences? 5. How often does the fault occur? (Redmill & Anderson, 1993).
FTA	It is a technique used to identify the root causes of a hazard or failure in the main system or event by graphically displaying the various combinations of equipment failures and human errors that can lead to the higher event and can be evaluated by probability or frequency of occurrence (Crawley & Tyler, 2003).
HAZOP	It is a structured approach to hazard identification, involving a systematic and methodical examination of design documents describing a system. HAZOP is performed by a multidisciplinary team of trained employees who are familiar with the subject under study. The review is led by a president, who applies a series of guide words for each section of the system, with the purpose of avoiding the discussion of the deviation from the project analysis intention (Redmill & Anderson, 1993).
Matriz de Risco	The risk matrix is often used in simpler studies to represent frequency and the consequence of risks in categories of magnitude. The matrix is separated into three regions as follows: unacceptable risk; acceptable risk; region between acceptable and unacceptable risk. Evaluations should be performed to determine the need for risk reduction or if more detailed studies should first be undertaken (Vinnem, 1999).

Two patents were identified, complementing the results that signal a trend for this new methodology. Derwent helped identify a single software patent for risk analysis in operations with elevators, which was developed and registered by Sanguyung University in China in 2016. This patent was confirmed by the ORBIT survey, which also flagged a patent of the company AIRBUS Helicopters in France in 2015 for aircraft maintenance operations.

5. Analysis and Discussion

Next, the first works found and their contributions in the area are highlighted, as well as discoveries made during the research and final analyzes.

1. a

   The first book by author Nancy G. Leveson was published in 1993 under the title “An Assessment of Space Shuttle Flight Software Development Processes”. It addresses how the effectiveness of software is essential for the success and safety of the space shuttle, including its crew and payloads. At the request of NASA, a committee met to review flight software development processes and recommend ways to improve those processes (such as safety, supervision, and management) (Leveson, 1993).

2. b

   The second book by Nancy G. Leveson was released in 1995 titled “Safeware: System Safety and Computers”, which presents a methodology for security analysis in the development of electromechanical systems, revealing that most accidents are not the result of unknown scientific principles, but a failure to apply well-known standard engineering practices. A second lesson is that accidents are not only hindered by technological solutions, but require control over all aspects of system development and operation (Leveson, 1995).

3. c

   Nancy G. Leveson’s earlier book had taken seven years to complete. In her third book titled “System Safety Engineering: Back To The Future”, published in 2002, the author used the new technologies to design a “living book”, where the first chapters were made available for download on the web as soon as they were completed and updated as far as learning (new content and applications) are concerned. There was also notification of updates to applicants and retention of copyright rather than attribution to a publisher. This book describes the results of the author’s research to create a new model of accident analysis (STAMP), and chapter nine deals with the analysis of hazards by the STPA method. In addition, the new model was based on the systems approach that was being applied by Jens Rasmussen and his followers in the field of human-computer interaction. That is, the ideas behind the new model of accident analysis are not new, just the way they are applied, because they derive from basic concepts of Systems Theory, the theoretical foundation of Systems Engineering, which developed after the Second World War (Leveson, 2002).

4. d

   The first article located with the presentation and steps for STPA application was published in 2003, titled “A New Approach to Hazard Analysis for Complex Systems,” by author Nancy G. Leveson. It is worth mentioning that other articles of the author were found before this year, but these dealt with different themes such as systemic thinking, STAMP model, and comparison with other risk analysis techniques.

5. e

   The fourth book by author Nancy G. Leveson was “Engineering a Safer World: Applying Systems Thinking to Safety” published in 2011, dedicated to presenting a new model, different from Engineering with traditional risk analysis techniques and introducing new techniques to analyze accidents and incidents (Leveson, 2011). One of the techniques derived is the STPA, detailed in chapter 8 the fundamentals for its application, steps, and examples.

6. f

   In 2013, “An STPA Primer” was published, document “guide” for the use of STPA, presenting fundamentals of the technique, definition of concepts, description of steps, and detailed applications (Leveson, 2013).

7. g

   The first STAMP/STPA Workshop at MIT took place from April 17 to 19, 2012, with approximately 250 participants from 19 countries, sponsored by MIT the Systems Engineering Division, Department of Aeronautics and Astronautics. This workshop has occurred once a year since then. More information is available at https://psas.scripts.mit.edu/home/1st-stampstpa-workshop-2012/.

8. h

   The first European STAMP Workshop was held on 22 and 23 May 2013 at the Braunschweig University of Technology in Germany, with more than 68 researchers, professionals, and consultants, with workshops, presentations, and lectures. Afterwards, a detailed report of the workshop, published in the ITS Journal, was provided. More information available at the link: http://www.stamp-workshop.eu/2013/.

9. i

   The Canadian Standards Association Group - CSA GROUP began in 2015. This committee aims to engage students and young professionals in the development of global standards with an impact on safety and the environment. It has identified this methodology and adopted it as the standard for the qualification of hardware and software in the system of control and instruments in Nuclear Power Plants.

10. j

    The bibliometry of the STPA made it possible to observe the growth of publications and types, countries and university of origin, the different areas of application, and comparison to other methods of risk analysis. In addition, support software for the application of the technique was identified, such as: A-STPA, XSTAMPP, SAHRA (an integrated software tool for STPA) and SafeHAT (Safety Hazard Analysis Tool) software.

11. k

    As proposed in the objective of this article, beginning in 2011, a growth of publications was identified due to the launch of the book “Engineering a Safer World: Applying Systems Thinking to Safety”, Workshops and software developed. In 2015, a small drop in publications was identified, considering the databases used in this article, which is the consequence of several factors not investigated.

12. l

    In addition, despite the significant number of papers found, it is noteworthy that until now the authors of this article are unaware of any other study that used bibliometric analysis specifically for the STPA method. Anchored in the Goffman Theory, this article can serve as a basis for future research, providing an overview and an initial timeline of the method, and future work may include the use of other bibliometric laws, deepening the identification of more productive articles and authors as well as other analyzes.

13. m

    Finally, the bibliometric and patent analysis, helps to increase the knowledge about the STPA model, as an initial research for the possible development of undergraduate and postgraduate studies.

6 Conclusion

The database with the highest content found was the Web of Science, 68% of works were articles, 58% of the works came from the United States (mainly from MIT), most publications were in the category of Systems Engineering (about 31%), and the risk analysis methods most compared or complemented to STPA were FTA and FMEA (totaling 61%).

Bibliometrics were used as a large-scale technique to better understand the origin and existing works of STPA in the established period and databases as well as the evolution of patents in the technological scenario. Finally, due to the observed data and considering that the STPA is a recent technique, it has been shown to be successful and its applicability, considering the quantity and quality of the approaches carried out on diverse types of scientific works tabulated and with possibilities of more extensive use.

• Financial support:: None.
• How to cite: Borges, S. F. S., Albuquerque, M. A. F., Cardoso Junior, M. M., Belderrain, M. C. N. & Costa, L. E. L. (2021). Systems Theoretic Process Analysis (STPA): a bibliometric and patents analysis. Gestão & Produção, 28(2), e5073. https://doi.org/10.1590/1806-9649-2020v28e5073

References

• Andrade, T. (2016). IHS Markit e Plante Árvore Retrieved 2018, August 10, from https://www.plantearvore.com.br/ihs-markit-e-plante-arvore/
  » https://www.plantearvore.com.br/ihs-markit-e-plante-arvore/
• Basu, R. (2004). Implementing quality: A practical guide to tools and techniques: enabling the power of operational excellence (1st ed.). Padstow: Thomson Learning.
• Campagnaro, L. S. (2016). Cubesat Hazard Analysis Using STPA Retrieved November 18, 2017, from http://www.bdita.bibl.ita.br/TGsDigitais/lista_resumo.php?num_tg=72537
  » http://www.bdita.bibl.ita.br/TGsDigitais/lista_resumo.php?num_tg=72537
• Crawley, F., & Tyler, B. (2003). Hazard identification methods (1st ed.). Rugby: Institution of Chemical Engineers (IChemE).
• Elsevier (2017a). Engineering research and resources: engineering village database Retrieved November 18, 2017, from https://www.elsevier.com/solutions/engineering-village
  » https://www.elsevier.com/solutions/engineering-village
• Elsevier (2017b). Mendeley Retrieved November 18, 2017, from https://www.elsevier.com/americalatina/pt-br/mendeley
  » https://www.elsevier.com/americalatina/pt-br/mendeley
• Ferry, T. S. (1988). Modern accident investigation and analysis (2nd ed.). Nova Jersey: Wiley-Interscience. http://dx.doi.org/10.1002/9780470172230
  » http://dx.doi.org/10.1002/9780470172230
• Fonseca, J. J. S. (2002). Metodologia da pesquisa científica Retrieved November 3, 2017, from http://leg.ufpi.br/subsiteFiles/lapnex/arquivos/files/Apostila_-_METODOLOGIA_DA_PESQUISA(1).pdf
  » http://leg.ufpi.br/subsiteFiles/lapnex/arquivos/files/Apostila_-_METODOLOGIA_DA_PESQUISA(1).pdf
• Fortney, K., & Gonder, J. (2015). A social networking site is not an open access repository Office of Scholarly Communication Retrieved November 18, 2017, from https://osc.universityofcalifornia.edu/2015/12/a-social-networking-site-is-not-an-open-access-repository/
  » https://osc.universityofcalifornia.edu/2015/12/a-social-networking-site-is-not-an-open-access-repository/
• Goffman, W., & Newill, V. A. (1964). Generalization of epidemic theory: an application to the transmission of ideas. Nature, 204(4955), 225-228. http://dx.doi.org/10.1038/204225a0 PMid:14212412.
  » http://dx.doi.org/10.1038/204225a0
• Guedes, V. L. S., & Borschiver, S. (2005). Bibliometria: uma ferramenta estatística para a Gestão da Informação e do Conhecimento, em Sistemas de Informação, de Comunicação e de Avaliação científica e tecnológica. Encontro Nacional de Ciência Da Informação, 6(2), 1-18.
• Hartford, D. N. D., & Baecher, G. B. (2004). Risk and uncertainty in dam safety (1st ed.). Londres: Thomas Telford Ltd. http://dx.doi.org/10.1680/rauids.32705
  » http://dx.doi.org/10.1680/rauids.32705
• Heinrich, H. W. (1931). Industrial accident prevention: A scientific approach (4th ed.). New York: McGraw-Hill.
• Hollnagel, E. (2004). Barriers and accident prevention (1st ed.). Ashgate: Routledge.
• Markit, I. H. S. (2018). About Us. Retrieved August 10, 2018, from https://ihsmarkit.com/about/index.html
  » https://ihsmarkit.com/about/index.html
• Leveson, N. (1993). An assessment of space shuttle flight software development processes (1st ed.). Washington, D.C.: National Academies Press. https://doi.org/10.17226/2222
  » https://doi.org/10.17226/2222
• Leveson, N. (2013). An STPA Primer. Version 1 (Vol. 1). Cambridge.
• Leveson, N., Daouk, M., Dulac, N., & Marais, K. (2003). Applying STAMP in Accident Analysis Cambridge. Retrieved from https://shemesh.larc.nasa.gov/iria03/p13-leveson.pdf
  » https://shemesh.larc.nasa.gov/iria03/p13-leveson.pdf
• Leveson, N. G. (1995). SafeWare: system safety and computers (1st ed.). Washington: Addison-Wesley.
• Leveson, N. G. (2002). System safety engineering: back to the future (1st ed.). Cambridge: Massachusetts Institute of Technology. Retrieved from http://sunnyday.mit.edu/book2.pdf
  » http://sunnyday.mit.edu/book2.pdf
• Leveson, N. G. (2011). Engineering a Safer World: Systems Thinking Applied to Safety (Engineering Systems) (1st ed.). Cambridge: MIT Press. https://doi.org/10.1017/CBO9781107415324.004
  » https://doi.org/10.1017/CBO9781107415324.004
• Nassi-Caló, L. (2017). A miopia dos indicadores bibliométricos. Retrieved November 23, 2017, from http://blog.scielo.org/blog/2017/06/01/a-miopia-dos-indicadores-bibliometricos/
  » http://blog.scielo.org/blog/2017/06/01/a-miopia-dos-indicadores-bibliometricos/
• Novak, J. D. (1990). Concept maps and Vee diagrams: two metacognitive tools to facilitate meaningful learning. Instructional Science, 19(1), 29-52. http://dx.doi.org/10.1007/BF00377984
  » http://dx.doi.org/10.1007/BF00377984
• CAPES. Ministério da Educação. (2018). Portal de periodicos. Web of Science - Coleção Principal Retrieved August 21, 2018, from http://www-periodicos-capes-gov-br.ez63.periodicos.capes.gov.br/index.php?option=com_pcollection&mn=70&smn=79&cid=81&Itemid=&
  » http://www-periodicos-capes-gov-br.ez63.periodicos.capes.gov.br/index.php?option=com_pcollection&mn=70&smn=79&cid=81&Itemid=&
• Pritchard, A. (1969). Statistical Bibliography or Bibliometrics? The Journal of Documentation, 25(4), 348-349.
• Qureshi, Z. H. (2008). A review of accident modelling approaches for complex socio-technical systems. In 12th Australian Conference on Safety-Related Programmable Systems, (Vol. 86, No. 1, 47-59).
• Rabechini, R. Jr., & Carvalho, M. M. (2013). Relacionamento entre gerenciamento de risco e sucesso de projetos. Production http://dx.doi.org/10.1590/S0103-65132012005000091.
  » https://doi.org/10.1590/S0103-65132012005000091
• Rasmussen, J. (1997). Risk management in a dynamic society: A modelling problem. Safety Science, 27(2-3), 183-213. http://dx.doi.org/10.1016/S0925-7535(97)00052-0
  » http://dx.doi.org/10.1016/S0925-7535(97)00052-0
• Reason, J. (1997). Managing the Risks of Organizational Accidents (1st ed.). London: Routledge. https://doi.org/10.4324/9781315543543
  » https://doi.org/10.4324/9781315543543
• Redmill, F., & Anderson, T. (1993). Directions in Safety-Critical Systems: Proceedings of the First Safety-critical Systems Symposium, Bristol 1993 (1st ed.). Bristol: Springer London. http://dx.doi.org/10.1007/978-1-4471-2037-7
  » http://dx.doi.org/10.1007/978-1-4471-2037-7
• Santos, A. O. (2017). Conteúdos da Thomson Reuters são adquiridos pela Clarivate Analytics. Retrieved August 10, 2018, from http://www-periodicos-capes-gov-br.ez63.periodicos.capes.gov.br/index.php?option=com_pnews&component=NewsShow&view=pnewsnewsshow&cid=528&mn=0&Itemid=&
  » http://www-periodicos-capes-gov-br.ez63.periodicos.capes.gov.br/index.php?option=com_pnews&component=NewsShow&view=pnewsnewsshow&cid=528&mn=0&Itemid=&
• SciELO (2017). SciELO - Scientific Electronic Library Online Retrieved November 18, 2017, from http://www.scielo.br/?lng=pt
  » http://www.scielo.br/?lng=pt
• SEDETEC (2014). Ferramenta de busca – Orbit Retrieved August 10, 2018, from https://www.ufrgs.br/sedetec/?p=660
  » https://www.ufrgs.br/sedetec/?p=660
• Tissot, P. B., Tondolo, V. A. G., Espíndola, A., Longaray, A. A., & Camargo, E. M. (2017). Bibliometric analysis of publications related to the term “servitization” in operations management. Gestão da Produção Operações e Sistemas-GEPROS, 3(1), 24. http://dx.doi.org/10.15675/gepros.v12i3.1659.
  » https://doi.org/10.15675/gepros.v12i3.1659
• Vinnem, J. E. (1999). Offshore Risk Assessment (1st ed.). Dordrecht: Springer Netherlands. http://dx.doi.org/10.1007/978-94-017-2471-5
  » http://dx.doi.org/10.1007/978-94-017-2471-5
• Zahedi, Z., Costas, R., & Wouters, P. (2017). Mendeley readership as a filtering tool to identify highly cited publications. Journal of the Association for Information Science and Technology, 68(10), 2511-2521. http://dx.doi.org/10.1002/asi.23883
  » http://dx.doi.org/10.1002/asi.23883

Publication Dates

• Publication in this collection
  31 May 2021
• Date of issue
  2021

History

• Received
  28 Aug 2018
• Accepted
  06 Nov 2018