# An Accident Model with Considering Physical Processes for Indoor Environment Safety
## 3 Accident Model
### Stamp-Pp
#### 3.2.3. Accident Formation  
Accidents can be understood as the resilience [26] of the Performers System, i.e., adjusting indoor environment anomalies to maintain a normal performance has failed and resulted in undesired consequences. A Service may fail and result in uncomfortableness, then further evolve into hazards and cause harm to occupants. Accident formation is to describe how Services may fail and further evolve into a hazard to cause accidents. The causes on the system part, i.e., the Performers System, can be understood by the STAMP model. The relation between the Behaviors of the Performers System and the physical processes in accident formation is discussed in this section. There are some considerations about physical processes from the viewpoint of engineering. Before a hazard is detected, physical process anomalies should be detected as early as possible so as to trigger precautionary measures. The information of hazards is also important for triggering reaction \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Hot** & **Warm** & **Slightly Warm** & **Neutral** & **Slightly Cool** & **Cool** & **Cold** \\ \hline +3 & +2 & +1 & 0 & \(-1\) & \(-2\) & \(-3\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: ASHRAE thermal sensation scale. measures. All in all, accident formation, which is shown in Figure 3 focuses on the physical process anomalies resulting from abnormal Behaviors. Next, let us discuss the terms and related rationales of the accident causality model in Figure 3.  
**Definition 7** (Defect). : Defects _are the direct causes of a_ Mutation. A Mutation (Definition 8) relates to abnormal Behaviors of the Performers System. Abnormal Behaviors are due to unexpected control actions of the Performers System. Thus, Defects are inappropriate control actions (ICAs) and unsafe control actions (UCAs) of the Performers System to the abnormal Behaviors in adjusting the home environment. ICAs occur when Mutations result in Service Failures (Definition 9), and UCAs occur when Service Failures evolve into Hazards (Definition 10). For example, an ICA can be wrongly setting the heating mode of a Performer in hot summer, which will cause thermal discomfort. To differentiate from causes introduced in the STAMP model, Defects refer to more superficial reasons. As the home environment is an application area, the deeper causes for system development defects are not considered here. When physical process anomalies are detected, the home environment is expected to react to them immediately with respect to Defects. Therefore, the Defects are the direct causes and should be controllable, e.g., through reconfiguration. As discussed at the beginning of Section 3, the STAMP-PP model relates to system operations. The occurrence of Defects is under the scenarios of system operations. The operations can be categorized into three types. One is operations by occupants. Another is by some controllers, e.g., Performers. The other is a mixture of by occupants and the controller. To react to a physical process anomaly efficiently, it is necessary to know the Defect with its corresponding operation scenario. To identify Defects with respect to the scenarios, we applied the hazard analysis technique STPA [2; 9] in Section 4. **Definition 8** (Mutation). : \(A\) Mutation _is the violation of constraint on the_ Behavior of the Performers System. Abnormal changes in physical processes are the representation of the abnormal Behavior of the Performers System. Therefore, the constraint on the Behavior of the Performers System is the prescription of changes in physical processes that satisfy the comfort purpose. Thus, the Mutation is the change of physical processes under adjustment unacceptably deviating from the prescribed curve(s), which results in uncomfortableness. For example, the amplitude of temperature fluctuation should not exceed a threshold value for thermal comfort [23]. The Mutation in this case is the amplitude of temperature fluctuation exceeding the threshold value.