Configuration-centric hazard analysis for adaptive autonomous systems: extending STPA for mobile control structures

Under control-structure mobility, an adaptive controller does not fail into danger – it optimizes into danger. It becomes hazardous not through component or function failure, but by succeeding while drifting beyond its validated regime, with no recognized change announcing the drift. Classical hazard analysis (Fault Tree Analysis, FMEA, and STPA) rests on a system model fixed at analysis time and kept current by re-analysis when changes are recognized. Adaptive systems expose a narrower gap: online policy updates migrate the effective control structure endogenously while improving monitored performance, so migration evades performance-based monitoring and triggers no configuration-indexed re-analysis. This paper develops configuration-centric hazard analysis, introducing three constructs – meta -control unsafe control actions (the adaptive update algorithm analyzed as a controller), hazard migration, and configuration-indexing of unsafe control actions and safety constraints – within a five-step STPA extension; constraint-coupling and a dynamic safety envelope supply the supporting machinery. Two reproducible worked examples (an exothermic reactor and a lane-keeping controller) demonstrate hazard migration across domains, while the 2018 Uber ATG collision, a non-adaptive analogue, shows control-structure mobility already produced harm, foreshadowing larger hazards in natively adaptive systems supplanting fixed predecessors. A runtime safety case specifies leading indicators of envelope contraction, staged containment, fallback control, and drills as first-class evidence. Seven propositions (framed as testable conjectures) identify when runtime evidence renewal is necessary and how hazard migration occurs. Safety assurance must shift from snapshot certification toward runtime hazard containment: continuous where a validated online proxy exists, periodic and drill-based where none does.