11. Control, Not Components — Leveson's Reframing

The Failure of Component-Reliability Models

Traditional safety engineering often relies on techniques like FMEA or FTA to identify hazards, but these methods focus primarily on individual component failures. Nancy Leveson of MIT argues that this paradigm is fundamentally limited because it ignores accidents caused by unsafe interactions between perfectly functional system components. In complex software-intensive systems, nothing physically breaks or fails in the traditional sense, yet the system can still reach an unsafe state through logic errors. The 2012 book Engineering a Safer World by Nancy Leveson establishes that safety should be reframed as a control problem rather than a reliability problem. This shift in perspective requires moving away from the assumption that if every component works correctly, the entire system will be inherently safe.

STAMP and the Evidence of Control

To address the limitations of component-failure analysis, Leveson developed STAMP, a systems-theoretic approach that views safety as a control problem involving feedback loops. In a 2018 study published in Software Quality Journal, Sulaman et al. applied both FMEA and STPA to a forward collision-avoidance system to measure their efficacy. The researchers found that 13 hazards were identified in common by both methods, proving that they share some ground in detecting basic system risks. However, the STPA method surfaced detailed causal factors—including software and communication-related causes—that the component-failure framing of FMEA entirely missed during the analysis process. This evidence demonstrates that a control-based method can capture systemic interactions that remain invisible to traditional models that look only for broken hardware parts.

The Limits of Methodological Superiority

The 2018 comparison by Sulaman et al. remains contested because the study concluded that neither method is strictly superior to the other for safety analysis. The authors noted that some hazards were unique to FMEA, suggesting that both methods complement each other rather than one replacing the other entirely. Furthermore, the STPA Handbook (2018) by Leveson and Thomas acknowledges that STPA requires more analyst time and specific training to implement effectively.

Example: Comparing FMEA to STPA is like checking for a flat tire versus analyzing the complex software logic that governs the autonomous steering system.

Verdict. Safety is a control problem, yet the practical application of STPA requires significant time investment and does not render traditional component-based methods obsolete.

Overturned if: A future meta-analysis finds that STPA consistently identifies all hazards found by FMEA while reducing the total analyst time required for safety certification.

Sources. 2012 · Leveson, N.G., "Engineering a Safer World: Systems Thinking Applied to Safety" — MIT Press Open Access · 2018 · Sulaman, S.M., Beer, A., Felderer, M. & Höst, M., "Comparison of the FMEA and STPA safety analysis methods – a case study" — diva-portal.org