HarmRealization should be in General instead of STPA

need Generalization to Causality... and need to and from from Causality

UndesiredControlActionHarmPotential diagram wrong.... it needs to have a Generalization of UndesiredStateHarmPotential
and redefine harmPotential and undesiredState (by undesiredControlAction) instead of from and to

harmPotential in AbstractFMEAItem... does not need subset scenarioStep

Assumption is in the profile but not in Fig. 10.3

Hazard is different in the Profile than the fig. 10.3

AbstractCause figure should show generalization of Factor

I am not sure why the attributes all over the standard were made private... e.g. Verified has an attirbute result which is private... so one could not read it out of the Verified

AnyVehicleUse should be AnyVehicleUsage to be consistent

Severity should be severity

standard model practice is to use 'Kind' after a word to indicate an Enumeration.. like ASILKind

Standard modeling practice is to have all usages singular and let multiplicities define if you have more than one... so a usage conditions (plural) would be changed to condition

Exposure says a Rationale must be attached... Rationale is SysML... and this is not necessarily SysML... so perhaps an attribute should be created instead to hold the Rationale

to keep the convention... exposure should be lowercase as a usage

HarmRealization should be a Specialization of AbstractRisk and Causality ... there are two redefines so harm and harmPotential is ok... but the other redefine should be to and from .... from Causality,,, look at Fig. 10.3 ... there are many conflicts... also could show Specialiation of AbstractRisk and Causality on Fig. 10.3

Association called UndesiredStateHarmPotential not described anywhere except on Fig. 10.3

the Opposite from scenarioStep between AnySituation and Scenario should be 0..*

HarmRealization is shown in General Concepts in Fig. 10.3 but is described in the standard in STPA on page 86
and is not described in the General Concepts section...

the Opposite from scenarioStep between AnySituation and Scenario should be 0..*

The Vulnerability element is stereotyped by a generic <<Situation>> stereotype and there is no dedicated <<Vulnerability>> stereotype. To resolve this add a stereotype for Vulnerability. This change should help ensure consistency with Factors and Limitations in the STPA Loss Scenario

The Weakness element is stereotyped by a generic <<Situation>> stereotype and there is no dedicated <<Weakness>> stereotype. To resolve this, the ticket calls for adding a stereotype for Weakness. This change should help ensure consistency with Factors and Limitations in the STPA Loss Scenario.

The issue is that ProcessModel and ControlAlgorithm are not currently stereotypes in the STPA profile, but is required to accurately model a STPA Control Structure.

The issue is that Threat is not currently considered as a Limitation-Factor, which is necessary in creating STPA Loss Scenarios. To resolve this, the ticket calls for making Threat a subtype of Limitation.

The issue is that Threat is not currently stereotyped as Threat, which puts it out of alignment with the other RAAML profile elements. To resolve this, the ticket calls for stereotyping it as Threat.

Sometimes the transition from one situation to another situation needs additional properties which cannot be captured by a simple association. The common solution for that is to use an association class to express causality allowing for additional properties to be added to the transition. This pattern is already used in the STPA method. The proposal is to create a general pattern so other methods can access this capability. This would include creating an association class on the common core Situation.

In Enterprise Architect 15.2 the CoreRAAML.xmi is not loaded completely. The generalization relation from Situation to SysML Block is not loaded. It seems to me that the xmi export has tool-specific content.

RAAML claims to implement STPA, but some important elements are missing.

For example,

In Step-1 of the STPA process (in the 2018 Leveson/Thomas STPA Handbook – Figure 2.3) it calls out the need to derive “Safety Constraints” from the Losses. I can find no reference to Safety Constraints in the RAAML.

Furthermore the RAAML does not provide any linkage from Losses to Hazards, which is expected in the Handbook.