# An Accident Model with Considering Physical Processes for Indoor Environment Safety
## 4 Application of STPA
### Comparison of Results  
Originally, the STPA is the only hazard analysis technique was based on the STAMP model [2]. Thus, in this section, let us compare the results presented in Section 4.3 with those by adopting the original STPA. Since the third step of STPA was not taken into account, the comparison only considers the results that derived from the first two steps of STPA. For comparability, the temperature issue discussed in Section 4.3 is still part of our focus when adopting the original STPA.  
As discussed, the goal of STPA is to identify causes that lead to hazards and result in losses, so they can be eliminated or controlled. The causes to be identified are UCAs, and flaws in the control loop (as shown in Figure 4) under some scenarios which are different from our case. The elimination or control usually resorts to designing and implementing a safe system, while in our case, the aim is to select appropriate precautionary and reaction measures which can restore a safe Service delivery.  
The system engineering foundation is given first. The prepared definitions are illustrated in Table 4. The design constraint is system level constraint and is expected to further decompose into constraints that can be assigned to system components as the analysis evolves. Compared with what is shown in Table 3, Service Failures and reliability requirements to the system are gone, which indicates ICAs will not be identified afterward. This is because ICAs are supposed to result in Service Failure, and reliability requirements of ICAs can be taken as the decomposition of the system level reliability requirement. The safety control structure as shown in Figure 7 can also be used here.  
Next, the UCAs identified in step two of STPA are shown in Tables 5 and 6 for control actions \"set OFF\" and \"set to X \({}^{\circ}\)C\", respectively. Then, for each UCA, safety requirements and design constraints can be derived. For example, the safety requirement for UCA-1 in Figure 5 could be:  
* \"set OFF\" should be provided when the indoor temperature belongs to (25,28) \({}^{\circ}\)C and the Performers System is working in the Warm mode. The design constraints for UCA-1 could be:
* The Performers System should be accurately aware of the indoor temperature change;
* \"set OFF\" should be provided when needed.  
\begin{table}
\begin{tabular}{l l} \hline \hline Accident & Physical harm of occupants due to heat stroke \\ Hazard & Indoor WBGT temperature is over 28 \({}^{\circ}\)C \\ Safety Requirement & Indoor WBGT temperature should be adjusted bellow 28 \({}^{\circ}\)C \\ Design constraint & The Performers System is capable of adjusting the indoor \\ WBGT temperature bellow 28 \({}^{\circ}\)C \\ \hline \hline \end{tabular}
\end{table}
Table 4: Preparation for the STPA analysis.  
Figure 9: The analysis results for the control action “set to X \({}^{\circ}\)C”.  
There are some differences in the comparison with the results derived in step two of STPA. The ICAs, operation scenarios for ICAs, reliability requirements, precautionary measures, and operation scenarios for UCAs cannot be obtained by adopting the original STPA. However, the design constraints can be derived. The UCAs identified by adopting the original and tailored STPA are equivalent. The results documented by tables and lists are separated. It is a trivial problem when checking the relations between the results that were documented by the conventional approach. The LGLD approach integrated the results and overcame this problem. We discuss the advantages of the tailored STPA at the end of Section 5.