JSON and XML Schemas for WebSTAMP

WebSTAMP is a software tool to assist safety and security analysts in the application of the STPA (Systems-Theoretic Process Analysis) technique. WebSTAMP does not have a formalized schema. This prevents analysts from using an analysis created in WebSTAMP in other software tools, and using analyses exported from other software tools in WebSTAMP. This work aims to (i) define an XML (Extensible Markup Language) schema and (ii) define a JSON (JavaScript Object Notation) schema for WebSTAMP, allowing hazard analysis portability among software tools that support the schemas. We define the schemas for XML and JSON using XSD (XML Schema Definition) and JSON Schema, respectively. These schemas were used in WebSTAMP and in a second tool in order to validate the import and export features of hazard analyses in XML and JSON, using examples presented in the literature. The schemas created for WebSTAMP provide portability to hazard analyses, making it possible to use an STPA analysis created in WebSTAMP in other applications that support the schemas, and vice versa. The results of this work allow us to conclude that the schemas for XML and JSON aid safety and security analysts, making their task of conducting hazard and vulnerability analysis more flexible, since they allow the analysts to use the tools of their choice, including the possibility to use more than one tool, leveraging the strengths of each one.