# An Accident Model with Considering Physical Processes for Indoor Environment Safety
## 4 Application of STPA
### Tailor  
The understanding of accident formation within the indoor environment has extended the STAMP model, i.e., the STAMP-PP model, by also considering physical processes. As discussed in Section 3.2.3, abnormal Behaviors result in Service Failures, and abnormal Behaviors are due to inappropriate control actions of the Performers System. Thus, it is important to know what these inappropriate control actions are. Therefore, the STPA need to be tailored for this main purpose. In the first step of STPA, in addition to the definition of accident, system hazard, and safety requirement, information about the Service Failure and requirements of no failure, i.e., the reliability of the Performers System to deliver Services, should also be provided. Design constraints are not required as this work is not for implementing a safe system. When a Service Failure occurs, which means the corresponding control action is inappropriate, then precautionary measure(s) should be provided. Thus, in the second step of STPA, ICAs should  
Figure 4: A classification of controls flaws leading to system hazards. be identified with regard to the taxonomies provided in step two of STPA. Namely, given a state of physical processes, under a specific operation scenario, we need to consider whether a control action with respect to the taxonomies will cause a Service Failure. Precautionary measures are determined by considering the context information which consists of the ICAs, operation scenarios, and the Service Failure. The process of the determination heavily depends on the expertise of concerned areas, which is directed by the reliability requirements. The precautionary measures are also control actions. Ineffective precautionary measures will result in the occurrence of a Hazard (then, reaction measures are required). For each precautionary measure, UCAs are identified by considering the taxonomies provided in step two of STPA under the conditions of operation scenarios and of a state of physical processes. Safety requirements to the UCAs also need to be identified to guide the selection of reaction measures. The third step of STPA is not necessary. This is because the analysis in our case is to identify Defects under operation scenarios, which can be utilized in selecting appropriate precautionary and reaction measures, but not in designing and manufacturing a system. STPA adopted tables and lists for documenting analytical results [2; 9]. After applying the tailored STPA, the results, i.e., control actions, ICAs, and their related reliability requirements and operation scenarios; and precautionary measures, UCAs, and their related safety requirements and operation scenarios, could be documented by that used by the STPA. However, the relations among them are not clearly represented. In this paper, we propose a Landscape Genealogical Layout Documentation (denoted as LGLD) for documenting the results, which is illustrated in Figure 5. The ancestor is a control action. The first generation illustrates ICAs and their related reliability requirements and operation scenarios. The second generation represents precautionary measures. The third generation represents UCAs and their related safety requirements and operation scenarios. These results can be numbered for better reference, e.g., ICA-m for an ICA, which means the inappropriate control action m. This way of documentation also implies the analysis direction, i.e., from control actions to ICAs, then to precautionary measures, and finally to UCAs. For each control action, the taxonomies provided in step two of STPA to list the ICAs must be considered. Every ICA is attached with the reliability requirements and operation scenarios. Then, each ICA is connected with a precautionary measure. The precautionary measure is to prevent its connected ICA from changing the home environment from a Service Failure to a Hazard. For each  
Figure 5: Documenting the analytical results by the Landscape Genealogical Layout Documentation (LGLD) approach.