# An Accident Model with Considering Physical Processes for Indoor Environment Safety
## 3 Accident Model
### Stamp  
In systems theory, systems are viewed as interrelated components kept in a state of dynamic equilibrium through feedback control loops. Figure 1 presents a standard contrl loop [2]. The STAMP model is based on system theory rather than the reliability that traditional accident models are grounded on. Safety, in STAMP, is an emergent property of systems. Accidents are the result of the lack of or inappropriate constraints imposed on the system design and operations. The STAMP model consists of three building blocks, i.e., safety constraints, a hierarchical safety control structure, and process models.  
Safety constraints are a basic concept in the STAMP model. Losses occur only because safety constraints were not successfully enforced. Systems, in system theory, are viewed as hierarchical structures, where each level imposes constraints on the activity of the levels beneath it. Constraints are enforced by control actions of a higher-level system component (controller) to the lower-level one (controlled process).  
The hierarchical safety control structure presents all stakeholders with their internal structures within the system under analysis, and the control actions and feedbacks that link the independent stakeholders and their internal components [6]. Control processes operate between levels of a system to control the processes at lower levels. The feedbacks provide information about how effectively the control actions ensure the constraints are enforced. The higher level uses the feedbacks to adapt future controls to more readily achieve its goals. An accident occurs when control processes provide inadequate control that violates safety constraints. Inadequate control comes from missing constraints, inadequate safety control commands, commands that were not executed correctly at a lower level, and inadequately communicated or processed feedback about constraint enforcement.  
Process models are used by the controller to determine appropriate control actions. It is up to the type of the controller. For an automated controller, the process model is embedded in the control logic. For a human controller, the process model is the mental model. In both situations, it contains information of the required relationship among the system variables, the current system state, and the ways the process can change state. There are four conditions required to control a process, i.e., goal,  
Figure 1: A standard control loop.  
action condition, observability condition, and model condition. Accidents related to component interaction can usually be explained in terms of an incorrect process model. The process model used by the controller does not match the controlled process that results in interaction accidents.  
In the STAMP model, safety is achieved when the behaviors of components of a system appropriately ensured safety constraints. Accidents are the results of flawed processes involving interactions among people, societal and organizational structures, engineering activities, and physical system components that lead to violating the system safety constraints. The process leading up to an accident is described in terms of an adaptive feedback function that fails to maintain safety as system performance changes over time to meet a complex set of goals and values.