UniSTPA: A Safety Analysis Framework for End-to-End Autonomous Driving

Cheng Wang; Hongrui Kou; Yuxin Zhang; Zhouhang Lyu; Ziyu Wang

REVIEW 3 major objections 5 minor 22 references

UniSTPA: A Safety Analysis Framework for End-to-End Autonomous Driving

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read UniSTPA extends STPA to the full lifecycle and inner modules of end-to-end driving models, claiming it finds hazards that conventional safety analysis misses.

desk verdict A coherent lifecycle-wide STPA extension for modular end-to-end driving, clearly written and useful as a proposal, but the key claim of uncovering hazards missed by conventional STPA is asserted rather than demonstrated. read the letter →

arxiv 2505.15005 v1 pith:FF2WDUEN submitted 2025-05-21 cs.RO cs.SE

Hongrui Kou , Zhouhang Lyu , Ziyu Wang , Cheng Wang , Yuxin Zhang This is my paper · ORCID

classification cs.ROcs.SE

keywords end-to-endautonomousdrivingSTPAsystemtheoreticprocessanalysishazardlifecyclesafetyunsafecontrolactionsNavigateonAutopilotmodularmodels

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes UniSTPA, a safety-analysis framework for modular end-to-end autonomous driving systems. It argues that existing methods, including conventional STPA, inspect only the deployed driving loop and treat the learned model as one black box, so they miss hazards arising earlier in development and inside the network. UniSTPA extends STPA in two directions: across the full lifecycle (information gathering, data preparation, closed-loop training, verification, deployment) and deeper into the model, decomposing it into perception, navigation, and prediction-and-planning modules. Applied to a highway Navigate on Autopilot case study, the framework identifies unsafe control actions and causal scenarios such as scene-design gaps, sensor-fusion bias, and internal model flaws, and turns them into lifecycle-wide safety requirements. The underlying claim is that this dual expansion finds safety-relevant hazards that a conventional operational-phase, black-box analysis would not.

What carries the argument

The load-bearing object is the multi-layer UniSTPA control structure, a system-theoretic control-loop model that is duplicated and instantiated at every lifecycle stage and inside the model itself. It follows STPA's standard machinery—system-level hazards, unsafe control actions classified as not provided, provided improperly, mistimed, or of inappropriate duration, causal scenarios, and safety requirements—but applies that machinery to stages and modules that conventional STPA leaves outside the loop. The model's internal modules (Perception, Navigation, Prediction and Planning) become controllers in their own right, and the World Model, evaluators, validators, safety monitors, and response tiers are wired into the same feedback structure, so that analysis can range from an environment-scene configuration error to a loss-function weighting in a single trace.

What would settle it

Run both a conventional STPA and UniSTPA on the same end-to-end Navigate on Autopilot system, with the same loss list and system boundaries, and compare the resulting hazard and unsafe-control-action sets. If every hazard UniSTPA reports is also reported by the conventional analysis, the paper's central claim of broader coverage is empirically refuted in that case.

Watch

Extended reading notes

Core claim

UniSTPA's central discovery is that STPA-style hazard analysis remains effective when its control-loop structure is rebuilt at two new resolutions. Vertically, the system is no longer a single runtime loop but a chain of five lifecycle stages, with each stage contributing its own control actions and feedback, so hazards can be traced to data acquisition, scenario design, training objectives, and validation gaps rather than only to on-road behavior. Horizontally, the end-to-end model's interior is treated as a control structure of its own: perception, navigation, and prediction-and-planning modules issue and receive control actions, which lets the analyst enumerate unsafe control actions within and between modules. In the highway NOA case study, this surfaces hazards such as omitted weaving scenarios at ramps, unresolved sensor conflicts at speed, insufficient small-obstacle training data, delayed inter-module prediction, and takeover prompts that fail on ODD-boundary exit; multi-level causal analysis then traces these to data quality, network architecture, loss-function design, and human-machine interaction.

Load-bearing premise

The framework assumes that a modular end-to-end driving model can be sliced into perception, navigation, and prediction-and-planning modules whose boundaries and control interactions correspond to real functional boundaries, so that hazards are visible at those seams; if safety-critical failures instead emerge from the whole network in ways that no module-level loop captures, the internal analysis misses them.

Editorial extensions

If this is right

If UniSTPA is right, safety requirements for end-to-end driving systems can be derived before deployment, from data preparation and training design, instead of only after failures appear on road.
Hazard analysis can be reported at the level of internal modules, giving developers actionable entry points: a hazard traced to perception training data is repaired by dataset or architecture changes, not by a blanket model retrain.
The same control-loop vocabulary spans development, verification, and operation, so a safety monitor on the vehicle can feed findings back to the stage that caused the hazard, forming a closed improvement loop.
End-to-end systems become analyzable by lifecycle-based safety processes, because the framework aligns with non-fault-based hazard analysis and lifecycle safety thinking.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural test is to run conventional STPA and UniSTPA on the same production system and compare hazard lists; the paper's contribution would be falsified if the lists coincide.
The framework's value depends on how faithfully the modular decomposition matches the actual functional organization of a given end-to-end model; monolithic models without clean module boundaries would need a different internal decomposition.
If adopted by tooling, the same lifecycle-stage templates could be reused across different driving functions, turning each safety analysis into an incremental audit rather than a one-off study.
The closed-loop feedback design implies that safety evidence could eventually be treated as a continuously updated artifact, with operational incidents updating training data requirements and validation scenario libraries.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know two things about this paper. First, the UniSTPA framework is a sensible, clearly written extension of STPA: it widens the analysis from the operational phase to the full lifecycle (data gathering, preparation, training, verification, deployment) and pushes hazard analysis inside the model's modules (perception, navigation, prediction/planning). The case study on highway NOA is detailed, and the tables mapping UCAs to causal scenarios to safety requirements are well organized and plausible. That is a genuinely useful contribution for safety engineers who need a structured way to think about end-to-end ADS beyond the usual black-box treatment.

The second thing is the soft spot, and it is the load-bearing one. The abstract and Section IV-C claim UniSTPA uncovers hazards 'overlooked by conventional approaches,' including scene design defects, sensor fusion biases, and internal model flaws. But the paper never runs a conventional STPA on the same system. Table IV asserts that most of the listed UCAs 'would remain undetected' by traditional STPA, yet several of them, like UCA-DT2 (excessive delay in emergency avoidance) and UCA-DT3 (no takeover prompt on ODD breach), are standard operational-phase unsafe control actions that ordinary STPA is designed to catch. The fine-grained internal-module findings are plausible expert hypotheses, but there is no evidence they come from the systematic decomposition rather than from prior knowledge of common learning-system failure modes. So the central advantage claim is currently supported only by assertion.

Other soft spots are minor. The 'first time' priority claim is unsupported given the survey in [12] already applies STPA to learning-enabled systems. The modular decomposition assumption is reasonable but not justified against monolithic alternatives; the paper does not discuss whether safety-relevant failures might emerge from whole-network interactions that cross module boundaries. And the invented Safety Monitor/Response subsystem, while sensible, is derived from the analysis rather than validated in any way.

For all that, the framework itself is coherent, the lifecycle extension is real, and the work aligns naturally with ISO 21448 and ISO/PAS 8800. It deserves a serious referee, but the authors should be pushed to either provide a baseline STPA comparison on the same case study or explicitly soften the 'overlooked' claim to something like 'hazards not typically emphasized in conventional STPA applications.'

Who is this for? Safety practitioners and researchers working on learning-enabled ADS who want a concrete methodological template. I would not cite it in the next year as a result, but I would send it to peer review with the above caveats.

Referee Report

3 major / 5 minor

Summary. The paper proposes UniSTPA, a safety-analysis framework that extends STPA along two dimensions: a lifecycle dimension covering information gathering, data preparation, closed-loop training, verification, and deployment, and a structural-depth dimension that decomposes a modular end-to-end autonomous driving model into perception, navigation, and prediction-and-planning submodules. The framework is demonstrated on a highway Navigate on Autopilot (NOA) case study, producing system-level hazards, representative unsafe control actions (UCAs), causal scenarios, safety requirements, and a safety-monitoring and tiered-response mechanism. The central claim is that this extension uncovers multi-stage hazards, including scene-design defects, sensor-fusion biases, and internal model flaws, that conventional STPA would overlook.

Significance. If the claims are substantiated, UniSTPA addresses a real gap: existing STPA practice for autonomous driving is mostly operational-phase-oriented and tends to treat learned models as monolithic controllers. The paper's structured tables and figures provide a coherent, traceable chain from losses to hazards, UCAs, causal scenarios, and safety requirements, and the proposed closed-loop monitoring/response design is a useful practical contribution. The framework is internally coherent and the case study is detailed. However, the load-bearing assertion of superior coverage over conventional STPA is currently asserted rather than demonstrated, and the paper does not provide controlled evidence that its fine-grained causal scenarios arise from the method's systematic decomposition rather than from expert prior knowledge. The contribution is therefore best viewed at this stage as a well-structured proposal whose central comparative claim requires validation.

major comments (3)

[IV-C, Table IV] The claim in Section IV-C that 'the majority of these UCAs would remain undetected' by traditional STPA is unsupported because no baseline STPA analysis of the same NOA system is presented. Several listed UCAs, such as UCA-DT2 ('excessive delay in executing emergency avoidance commands') and UCA-DT3 ('failure to prompt driver takeover upon detecting ODD boundary breaches'), are standard operational-phase unsafe control actions that conventional STPA is designed to identify. To make the central contribution load-bearing, the authors should either perform a comparative STPA analysis of the same system with clearly defined detection criteria or restrict the claim to UCAs from the earlier lifecycle stages, where the extension is more defensible.
[IV-D, Table V] The causal scenarios in Table V are presented as outputs of UniSTPA's systematic multi-level analysis, but there is no evidence connecting each scenario to the specific decomposition rules of the framework. For example, CS-LT1-3 ('perception network architecture limitations in extracting features of dynamic small targets') and CS-LT3-2 ('simplified model structure that fails to capture subtle precursors of lane-change intentions') are plausible expert hypotheses, yet the paper does not show how they follow from the method's internal-module modeling rather than from general knowledge of common learning-system failure modes. The authors should provide a traceability audit or an inter-analyst comparison to demonstrate that the method, rather than the analyst's prior expertise, generates these causal scenarios.
[IV-B, Closed Loop Training] The framework assumes that a modular end-to-end model can be decomposed into Perception, Navigation, and Prediction & Planning submodules whose interactions are the right level of granularity for exposing safety-relevant failures. This assumption is load-bearing because the paper's claimed fine-grained internal analysis would collapse if safety-critical behaviors emerge from joint end-to-end training across module boundaries, or if the module boundaries do not correspond to functional safety boundaries. The paper defines monolithic end-to-end as a distinct architecture in Section I but does not discuss whether UniSTPA applies to it. The authors should explicitly state this scope limitation and justify why the modular decomposition is adequate for the claimed hazard coverage.

minor comments (5)

[Section I and Table IV] The phrase 'The analysis result are used' in the abstract and Section I contains a subject-verb agreement error; it should be 'results are used.'
[Figure 3 caption] The caption states "'ICU' denotes interface control unit; 'ICU' denotes vehicle control unit," but the second abbreviation is likely intended to be 'VCU.' This should be corrected for clarity.
[Section II-A] The paper cites reference [8] as the source for STPA, but [8] is a proposed validation framework for STPA rather than the original STPA reference by Leveson; the authors should cite the primary STPA source (e.g., Leveson's 'Engineering a Safer World') in addition to or instead of the validation-framework citation.
[Section IV-C] The paper states that 'owing to space limitations' only representative UCAs are enumerated, but does not state any selection criteria for representation. A brief statement of how representative UCAs were chosen would improve reproducibility and reduce the risk of cherry-picking.
[Table VI and Section IV-E] The safety requirements in Table VI are linked to causal scenarios, but the paper does not specify how these requirements are verified or validated in the closed-loop feedback mechanism; adding a verification traceability column or a short explanation would strengthen the closed-loop claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity; UniSTPA is a methodological extension of externally published STPA, and its unsupported advantage claim is an evidentiary weakness, not a circular step.

full rationale

UniSTPA's derivation chain is an extension of the externally published STPA method and applies that method to an NOA case study. The framework's steps—defining losses and hazards, constructing a control structure, identifying UCAs, analyzing causal scenarios, and deriving safety requirements—are procedural and descriptive. The paper contains no equations that define an output in terms of an input, no fitted parameter that is later renamed as a prediction, and no imported uniqueness theorem. None of the case-study outputs (Tables IV–VI) are used to justify the framework itself, so the framework is not circular. The paper does not rely on self-citations: its references are to independent STPA literature, ISO standards, and surveys. The strongest claim, that UniSTPA uncovers hazards 'overlooked by conventional approaches,' is asserted in Section IV-C and in the Conclusion without a comparative traditional-STPA analysis of the same system. That is an unvalidated empirical or methodological claim, but it is not circular, because the claim is a counterfactual about what traditional STPA would miss rather than a construction that reduces to the framework's own assumptions. The modular decomposition into perception, navigation, and prediction-and-planning modules is an analytic modeling choice; its adequacy could be questioned, but the choice is not derived from the framework's outputs and does not make the analysis self-justifying. Accordingly, no circular step can be exhibited, and the appropriate score is 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 1 invented entities

The central claim depends on the validity of STPA as a safety-analysis method, on the representativeness of the case-study decomposition into perception, navigation, and prediction/planning modules, and on the completeness of the analyst-generated UCA and causal-scenario lists. No quantitative parameters are fitted to data, and no new physical or computational entities are introduced with independent evidence.

assumptions (3)

domain assumption STPA is a valid method for identifying hazards in complex systems and is suitable for learning-based systems when extended.
The paper builds on STPA (ref [8]) without critical examination; the entire framework inherits STPA's assumptions about control loops and unsafe control actions.
domain assumption A modular end-to-end ADS can be decomposed into perception, navigation, and prediction/planning submodules that interact via control loops.
Section IV-B defines this decomposition as the basis for the structural-depth analysis; if the model is monolithic or has emergent behavior, the internal-layer analysis may miss hazards.
ad hoc to paper The representative UCAs and causal scenarios listed are sufficient to demonstrate the framework's claims.
Section IV-C explicitly says 'we do not enumerate all possible UCAs' and selects a subset; the claimed comprehensiveness is therefore assumed rather than demonstrated.

invented entities (1)

Safety Monitor and Safety Response subsystem (EgoMotion Monitor, Perception Monitor, Trajectory Monitor, Decision-Making Module, four-tier response)
purpose: To provide closed-loop safety management that detects operational risks and feeds them back to development stages.
Proposed in Section IV-E and Figure 4; no simulation or field data demonstrates these components detect risks as intended, so they are design proposals rather than validated entities.

how reviews work

0 comments

Cite this review

Pith. "Pith review of UniSTPA: A Safety Analysis Framework for End-to-End Autonomous Driving." pith.science (2026). https://pith.science/paper/FF2WDUEN

@misc{pith2026250515005,
  author       = {Pith},
  title        = {Pith review of: UniSTPA: A Safety Analysis Framework for End-to-End Autonomous Driving},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FF2WDUEN}},
  note         = {Machine review of arXiv:2505.15005}
}

read the original abstract

As autonomous driving technology continues to advance, end-to-end models have attracted considerable attention owing to their superior generalisation capability. Nevertheless, such learning-based systems entail numerous safety risks throughout development and on-road deployment, and existing safety-analysis methods struggle to identify these risks comprehensively. To address this gap, we propose the Unified System Theoretic Process Analysis (UniSTPA) framework, which extends the scope of STPA from the operational phase to the entire lifecycle of an end-to-end autonomous driving system, including information gathering, data preparation, closed loop training, verification, and deployment. UniSTPA performs hazard analysis not only at the component level but also within the model's internal layers, thereby enabling fine-grained assessment of inter and intra module interactions. Using a highway Navigate on Autopilot function as a case study, UniSTPA uncovers multi-stage hazards overlooked by conventional approaches including scene design defects, sensor fusion biases, and internal model flaws, through multi-level causal analysis, traces these hazards to deeper issues such as data quality, network architecture, and optimisation objectives. The analysis result are used to construct a safety monitoring and safety response mechanism that supports continuous improvement from hazard identification to system optimisation. The proposed framework thus offers both theoretical and practical guidance for the safe development and deployment of end-to-end autonomous driving systems.

Figures

Figures reproduced from arXiv: 2505.15005 by the authors.

**Figure 2.** UniSTPA Analysis Framework for E2E ADS. IV. CASE STUDY This section focuses on the NOA for Highway system equipped with an end-to-end model. The vehicle is equipped with cameras, LiDAR, and other sensors to acquire environmental information, leverages the end-to-end model to generate control commands for steering, acceleration, and braking, thereby achieving both longitudinal and lateral control. We apply the UniS… view at source ↗

**Figure 1.** Traditional STPA Control Structure Applied to E2E ADS. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗

**Figure 3.** This framework spans five key stages—information [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (2 more)

**Figure 3.** Figure 3: UniSTPA control loop structures applied on End-to-end Autonomous driving system. The entire diagram shows the stages of system development [PITH_FULL_IMAGE:figures/full_fig_p005_3.png]

**Figure 4.** Figure 4: UniSTPA Control Loop with Safety Monitor and Safety Response. ‘AS Trajectory’ denotes Active-Safety Trajectory; ‘TOR’ denotes Take-Over [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 19 canonical work pages

[12]

Stpa for learning-enabled systems: a survey and a new practice,

Y . Qi, Y . Dong, S. Khastgir, P. Jennings, X. Zhao, and X. Huang, “Stpa for learning-enabled systems: a survey and a new practice,” in 2023 IEEE 26th International Conference on Intelligent Transportation Systems (ITSC). IEEE, 2023, pp. 1381–1388

2023
[1]

End-to-end autonomous driving: Challenges and frontiers,

L. Chen, P. Wu, K. Chitta, B. Jaeger, A. Geiger, and H. Li, “End-to-end autonomous driving: Challenges and frontiers,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024

2024
[2]

A survey on imitation learning techniques for end-to-end autonomous vehicles,

L. Le Mero, D. Yi, M. Dianati, and A. Mouzakitis, “A survey on imitation learning techniques for end-to-end autonomous vehicles,” IEEE Transactions on Intelligent Transportation Systems, vol. 23, no. 9, pp. 14 128–14 147, 2022

2022
[3]

Fault tree analysis: A survey of the state- of-the-art in modeling, analysis and tools,

E. Ruijters and M. Stoelinga, “Fault tree analysis: A survey of the state- of-the-art in modeling, analysis and tools,”Computer science review, vol. 15, pp. 29–62, 2015. Fig. 4. UniSTPA Control Loop with Safety Monitor and Safety Response. ‘AS Trajectory’ denotes Active-Safety Trajectory; ‘TOR’ denotes Take-Over Request

work page 2015
[4]

Risk evaluation approaches in failure mode and effects analysis: A literature review,

H.-C. Liu, L. Liu, and N. Liu, “Risk evaluation approaches in failure mode and effects analysis: A literature review,”Expert systems with applications, vol. 40, no. 2, pp. 828–838, 2013

work page 2013
[5]

A functional hazop methodology,

N. L. Rossing, M. Lind, N. Jensen, and S. B. Jørgensen, “A functional hazop methodology,”Computers & chemical engineering, vol. 34, no. 2, pp. 244–253, 2010

work page 2010
[6]

ISO 26262: Road vehicles – functional safety,

International Organization for Standardization, “ISO 26262: Road vehicles – functional safety,” https://www.iso.org/standard/68383.html, 2018, international Standard

work page 2018
[7]

Adsa–association-driven safety analysis to expose unknown safety issues,

K. Madala, H. Do, and B. Tenbergen, “Adsa–association-driven safety analysis to expose unknown safety issues,”IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 1, pp. 216–228, 2023

work page 2023

Show all 22 references

[8]

A proposed validation framework for the system theoretic process analysis (stpa) technique,

R. Sadeghi and F. Goerlandt, “A proposed validation framework for the system theoretic process analysis (stpa) technique,”Safety science, vol. 162, p. 106080, 2023

2023
[9]

ISO 21448: Road vehicles – safety of the intended functionality,

I. O. for Standardization, “ISO 21448: Road vehicles – safety of the intended functionality,” https://www.iso.org/standard/70939.html, 2019, international Standard

2019
[10]

Towards behaviour based testing to understand the black box of autonomous cars,

F. Utesch, A. Brandies, P. Pekezou Fouopi, and C. Schießl, “Towards behaviour based testing to understand the black box of autonomous cars,”European Transport Research Review, vol. 12, no. 1, p. 48, 2020

2020
[11]

ISO/PAS 8800:2024 road vehicles — safety and artificial intelligence,

International Organization for Standardization, “ISO/PAS 8800:2024 road vehicles — safety and artificial intelligence,” https://www.iso.org/ standard/83303.html, 2024, publicly Available Specification

2024
[13]

Application of systems theoretic process analysis to a lane keeping assist system,

H. S. Mahajan, T. Bradley, and S. Pasricha, “Application of systems theoretic process analysis to a lane keeping assist system,”Reliability Engineering & System Safety, vol. 167, pp. 177–183, 2017

2017
[14]

N. G. Leveson,Engineering a safer world: Systems thinking applied to safety. The MIT Press, 2016

2016
[15]

Using stpa in compliance with iso 26262 for develop- ing a safe architecture for fully automated vehicles,

A. Abdulkhaleq, S. Wagner, D. Lammering, H. Boehmert, and P. Blueher, “Using stpa in compliance with iso 26262 for develop- ing a safe architecture for fully automated vehicles,”arXiv preprint arXiv:1703.03657, 2017

2017 arXiv
[16]

Explainable ai for safe and trustworthy autonomous driving: a system- atic review,

A. Kuznietsov, B. Gyevnar, C. Wang, S. Peters, and S. V . Albrecht, “Explainable ai for safe and trustworthy autonomous driving: a system- atic review,”IEEE Transactions on Intelligent Transportation Systems, 2024

2024
[17]

Systems approach to creating test scenarios for automated driving systems,

S. Khastgir, S. Brewerton, J. Thomas, and P. Jennings, “Systems approach to creating test scenarios for automated driving systems,” Reliability Engineering & System Safety, vol. 215, p. 107610, 2021

2021
[18]

Systems thinking for safety and security,

W. Young and N. Leveson, “Systems thinking for safety and security,” inProceedings of the 29th annual computer security applications conference, 2013, pp. 1–8

2013
[19]

Limitation and improvement of stpa-sec for safety and security co-analysis,

C. Schmittner, Z. Ma, and P. Puschner, “Limitation and improvement of stpa-sec for safety and security co-analysis,” inComputer Safety, Reliability, and Security: SAFECOMP 2016 Workshops, ASSURE, DECSoS, SASSUR, and TIPS, Trondheim, Norway, September 20, 2016, Proceedings 35. ...

2016
[20]

Quantitative risk assessment for connected automated vehicles: In- tegrating improved stpa-safesec and bayesian network,

Q. Liu, K. Sun, W. Liu, Y . Li, A. Zheng, C. Cao, J. Li, and W. Qin, “Quantitative risk assessment for connected automated vehicles: In- tegrating improved stpa-safesec and bayesian network,”Reliability Engineering & System Safety, vol. 253, p. 110528, 2025

2025
[21]

Engineering for humans: A new extension to stpa,

M. E. France, “Engineering for humans: A new extension to stpa,” Ph.D. dissertation, Massachusetts Institute of Technology, 2017

2017
[22]

A human reliability analysis method based on stpa-idac and bn-slim for driver take-over in level 3 automated driving,

W. Liao, Y . Qiao, T. Dong, Z. Gou, and D. Chen, “A human reliability analysis method based on stpa-idac and bn-slim for driver take-over in level 3 automated driving,”Reliability Engineering & System Safety, vol. 254, p. 110577, 2025

2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [12]

Stpa for learning-enabled systems: a survey and a new practice,

Y . Qi, Y . Dong, S. Khastgir, P. Jennings, X. Zhao, and X. Huang, “Stpa for learning-enabled systems: a survey and a new practice,” in 2023 IEEE 26th International Conference on Intelligent Transportation Systems (ITSC). IEEE, 2023, pp. 1381–1388

2023

[2] [1]

End-to-end autonomous driving: Challenges and frontiers,

L. Chen, P. Wu, K. Chitta, B. Jaeger, A. Geiger, and H. Li, “End-to-end autonomous driving: Challenges and frontiers,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024

2024

[3] [2]

A survey on imitation learning techniques for end-to-end autonomous vehicles,

L. Le Mero, D. Yi, M. Dianati, and A. Mouzakitis, “A survey on imitation learning techniques for end-to-end autonomous vehicles,” IEEE Transactions on Intelligent Transportation Systems, vol. 23, no. 9, pp. 14 128–14 147, 2022

2022

[4] [3]

Fault tree analysis: A survey of the state- of-the-art in modeling, analysis and tools,

E. Ruijters and M. Stoelinga, “Fault tree analysis: A survey of the state- of-the-art in modeling, analysis and tools,”Computer science review, vol. 15, pp. 29–62, 2015. Fig. 4. UniSTPA Control Loop with Safety Monitor and Safety Response. ‘AS Trajectory’ denotes Active-Safety Trajectory; ‘TOR’ denotes Take-Over Request

work page 2015

[5] [4]

Risk evaluation approaches in failure mode and effects analysis: A literature review,

H.-C. Liu, L. Liu, and N. Liu, “Risk evaluation approaches in failure mode and effects analysis: A literature review,”Expert systems with applications, vol. 40, no. 2, pp. 828–838, 2013

work page 2013

[6] [5]

A functional hazop methodology,

N. L. Rossing, M. Lind, N. Jensen, and S. B. Jørgensen, “A functional hazop methodology,”Computers & chemical engineering, vol. 34, no. 2, pp. 244–253, 2010

work page 2010

[7] [6]

ISO 26262: Road vehicles – functional safety,

International Organization for Standardization, “ISO 26262: Road vehicles – functional safety,” https://www.iso.org/standard/68383.html, 2018, international Standard

work page 2018

[8] [7]

Adsa–association-driven safety analysis to expose unknown safety issues,

K. Madala, H. Do, and B. Tenbergen, “Adsa–association-driven safety analysis to expose unknown safety issues,”IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 1, pp. 216–228, 2023

work page 2023