A Novel Stpa Approach to Software Safety and Security in Autonomous Maritime Systems Design

For autonomous maritime systems, tasks and responsibilities are moving from the human operator to hardware and software, which means that the software part grows in size and complexity. Software failures may be introduced from the early life cycle phases intentionally or unintentionally, and these must be mitigated by safe and secure design approaches. This paper addresses the need for systematic and efficient software failure identification and risk mitigation and proposes a novel approach by extending the Systems-Theoretic Process Analysis (STPA) with the System Modeling Language (SysML) as a basis. To demonstrate the proposed method, a case study on a semi-autonomous ferry's navigation system that operates in automatic or manual control mode is performed. The control structure and its extension are modeled utilizing implementation platform independent software, hardware, and human operator parts, covering both the dynamic and static aspects of the software functions from the software specification. The focus is on creating an avoidance map data structure, including both moving and static obstacles to be avoided by the ferry and the subsequent process of collision risk warning calculation. An implementation platform independent software failure questionnaire is developed and applied for a structured and guided search of potential software failures. The criticality of the identified software failures is evaluated over the development of loss scenarios covering cascading failure effects in software. In the case study, the identified software failures are evaluated in a loss scenario where the ferry operates under foggy conditions. Lastly, related to the hazard evaluation and risk reduction of critical software failures, the paper discusses the classic and novel approaches to mitigation in the form of fallback procedures and operational constraints. The paper shows that critical software failures may be handled by design and testing techniques to minimize the potential impact on autonomous systems´ safety and security.