# An Accident Model with Considering Physical Processes for Indoor Environment Safety
## 4 Application of STPA
### Results
In the first step of STPA, we prepared some concepts for further analysis as shown in Table 3. For demonstration, Service Failure is defined as when the indoor WBGT temperature is adjusted within (25,28) \({}^{\circ}\)C, and the Hazard is when the indoor WBGT temperature is adjusted over 28 \({}^{\circ}\)C. The reliability requirement corresponds to the Service Failure, which represents the requirement to ensure a Service will not fail. Figure 7 illustrates the safety control structure for indoor temperature adjustment. The Home Gateway is the controller, which is responsible for executing the indoor temperature adjustment service. The controlled process is the Home Environment. Performers are taken as actuators. We consider an air-conditioner and a window here as Performers. Empirically, for energy saving, these two cannot work at the same time. The control actions are listed on the arrow from the Home Gateway to the Performers. The control action \"set to X \({}^{\circ}\)C\" means to set Performers to adjust the indoor temperature to X \({}^{\circ}\)C. The feedback to the Home Gateway is the indoor temperature. Indoor temperature can be adjusted by the indoor temperature adjustment service that is executed in the Home Gateway, or by occupants to issue commands, i.e., control inputs to the Home Gateway. Next, based on the results of the first step, we identifies ICAs and UCAs and elicited their related requirements and operation scenarios. Part of the results are shown in Figures 8 and 9, which adopted the LGLD approach introduced in Section 4.2 for the documentation. They illustrate the results of analyzing the control actions \"set OFF\" and \"set to X \({}^{\circ}\)C\". \"N/A\" denotes the taxonomy is not applicable to the corresponding control action. In Figure 8, the second \"set OFF\" can be considered as a reconfiguration compared with the first one. The precautionary measure \"set Cool mode\" can be deployed for the two ICAs that relate to the \"set OFF\". One reason could be that a different configuration has a higher possibility to restore the physical process to a comfortable state, as the \"set  
Figure 7: The safety control structure for indoor temperature adjustment. \begin{table}
\begin{tabular}{l l} \hline \hline Accident & Physical harm of occupants due to heat stroke \\ Service Failure & Indoor WBGT temperature is within (25,28) \({}^{\circ}\)C \\ Reliability Requirement & Indoor WBGT temperature should be adjusted below 25 \({}^{\circ}\)C \\ Hazard & Indoor WBGT temperature is over 28 \({}^{\circ}\)C \\ Safety Requirement & Indoor WBGT temperature should be adjusted below 28 \({}^{\circ}\)C \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Preparation for the tailored System-Theoretic Process Analysis (STPA). OFF\" has caused the ICA. For the second operation scenario, not-providing ICA, it is because people are not sensitive to temperature change and thus did not issue the \"set OFF\" command manually. For the results as shown in Figure 9, X satisfies \(X<25\)\({}^{\circ}\)C. There are two reasons for the not-providing ICA and UCA to say that the Performers System is working in the Fan mode. The first is if it works in the Warm mode, which in this case is inappropriate or hazardous, and we cannot make a solemn vow to conclude that not providing \"set to X\({}^{\circ}\)C\" is inappropriate or hazardous. Second, the other working modes, i.e., Dry and Cool, have a cooling effect based on our experience, which may not be an ICA or UCA even when \"set to X\({}^{\circ}\)C\" is not provided. One more thing that needs to be explained is that providing \"set to X\({}^{\circ}\)C\" at the \"wrong time\" is neither inappropriate nor hazardous. If it is not provided in time, the home environment would experience Service Failure or Hazard for some time. However, providing \"set to X\({}^{\circ}\)C\" at a different time should not be inappropriate or hazardous. Conversely, since \"set to X\({}^{\circ}\)C\" is provided, the home environment could be restored to a safe level, even though later than expected.