# System Hazard Analysis of Tower Crane in Different Phases on Construction Site

Authors: Ling Jiang; Tingsheng Zhao; Wei Zhang; Junjie Hu
Journal: Advances in Civil Engineering
 (2021)

---

## Abstract

Tower crane accidents frequently occur in the construction industry, often resulting in casualties. The utilization of tower cranes involves multiple phases including installation, usage, climbing, and dismantling. Moreover, the hazards associated with the use of tower cranes can change and be propagated during phase alternation. However, past studies have paid less attention to the differences and hazard propagations between phases. In this research, these hazards are investigated during different construction phases. The propagation of hazards between phases is analyzed to develop appropriate safety management protocols according to each specific phase. Finally, measures are suggested to avoid an adverse impact between the phases. A combined method is also proposed to identify hazard propagation, which serves as a reference and contributes to safety management and accident prevention during different tower crane phases in the construction process.


---

## Body

## 1. Introduction

In construction sites, tower cranes are used for the vertical and horizontal transportation of materials [1]. It is essential equipment for most construction projects, especially for high-rise buildings [2]. Typically, they need to be reinstalled on the construction site once the components of the tower crane leave the factory. As the height of a construction project increases, tower cranes are necessary, and they eventually must be climbed. Furthermore, maintenance and dismantlement must be performed. Thus, a tower crane is not only a piece of auxiliary equipment in construction but also a construction object with complicated processes [3]. This negatively impacts on-site construction safety. In this investigation, 149 accident analysis reports on a tower crane in construction sites in China were collected for the period from 2015 to 2019. The accidents resulted in a total of 216 deaths and 89 injuries and led to adverse social impacts. Therefore, it is essential to analyze the hazards associated with the deployment of tower cranes on construction sites to prevent such accidents.Tower cranes on construction sites consist of the following phases: installation, usage, climbing, and dismantling. According to the investigated accidents, the processes and constructors are not the same for the different construction phases. This results in the occurrence of different types of accidents during different phases. Moreover, hazards propagate between each phase and the propagation also affects the safety of the tower crane. Therefore, it is necessary to analyze the hazards associated with each construction phase and to explore the differences and interrelations between them.To investigate the characteristics and propagation of hazards during the different construction phases of a tower crane, a combination of the IDEF0 (ICAM Definition method) along with the STAMP (Systems-Theoretic Accident Model and Processes) and its analysis technology STPA (System Theoretic Process Analysis) is adopted. This approach was undertaken to develop a safety system model for tower cranes on-site and to further identify the corresponding hazards that are present during the different phases. The combinatorial methods are found effective in exploring the hazards propagation in the workflow. The results of this study show the differences in the hazards in different tower crane phases, which can provide a specific target for accident prevention. The research also explains the hazard propagation between the different phases in an attempt to avoid the accidents caused by the hazards of previous phases.The research framework is shown in Figure1.Figure 1
Research structure.This study makes the following contributions to the body of knowledge.(a)
Since the hazards are different between phases of a tower crane on construction site, we analyze the hazards of a tower crane in different phases and compare them.(b)
This research points out that the consequence of the previous phase may influence the safety of the subsequent phase. It is helpful to dynamic risk management.(c)
The combination of IDEF0 and STAMP is applied on the tower crane for hazards analysis. This method is useful to analyze the hazard transition in a process.


## 2. Literature Review

The literature review is summarized based on previous studies that primarily investigated tower crane safety management and different research methods, namely hazard analysis.


### 2.1. Tower Crane Safety Management

The safety management of tower cranes and the analysis of the contributing factors that influence tower crane safety have been previously reported based on multiple perspectives. Based on literature reviews and site visits, Shapira and Lyachin [4] identified several safety factors including the project conditions, the environment, the human factor, and the safety management procedures. Beavers et al. [5] investigated crane incidents based on OSHA (Occupational Safety and Health Act) incident data and highlighted the importance of safety training for managers and operators. Raviv et al. [6] investigated 51 crane accidents, as well as 161 near-misses. They also investigated the importance of crane safety risk factors and the relationship between human and technical factors [7]. According to the literature review, the human factor, the environment, the safety management procedures, and the equipment quality are all associated with tower crane safety [8].Furthermore, although different hazards may occur during different phases, previous works often focused on the usage phase [9, 10]. Some researchers have investigated dynamic structural performance, the interaction effects of multitower crane operation, the load, and the environment of the tower crane in the usage phase [11–13]. In addition, the factors that impact safety during the installation (including climbing) and dismantling phases have been analyzed [14]. However, there are few comparative studies on the multiple phases of tower cranes on the construction site. Equally important are the interrelationships between the hazards associated with different phases, which have not been investigated to date. In this paper, we address the aforementioned limitations in the literature.


### 2.2. Hazard Analysis

The conventional hazard analysis methods include preliminary hazard analysis (PHA), system hazard analysis (SHA), fault tree analysis (FTA), event tree analysis (ETA), failure mode and effects analysis (FMEA), and failure mode effects and criticality analysis (FMECA) [15–17]. With the development of system thinking, system analysis methods such as AcciMap, STAMP, FRAM, and the 2–4 Model have been increasingly utilized in contemporary studies to analyze hazards [18]. According to one of the main tenets of system thinking, accidents are not caused by a series of linear events. Moreover, the relationships and interactions among the system elements should be considered [19]. A complex system of accidents may be analyzed in detail to define the relationship between several factors at different organizational levels based on the system thinking principle [20, 21]. It is an important method for the analysis of the cause of accidents and safety hazard identification.These system thinking methods have different objectives. A summary of each method is presented in Table1. These methods have also been compared in several investigations and it was concluded that the STAMP model results in a more comprehensive set of conclusions and is more reliable than other accident system analysis methods [26–28]. The STAMP model involves various elements of a system, such as the individuals, the objects, the organizations, and the environment [29]. The most important is that the STAMP model concerns the interactions of components and systems. As the tower crane safety system is a complex system with different components and phases, the STAMP model can contribute to the safety system analysis of the tower crane during different construction phases in this study.Table 1
System thinking method.
MethodMain ideaAcciMapAcciMap analyzes accidents concerning six organizational levels, including government policy and budgeting, regulatory bodies and associations, local area government planning and budgeting (including company management), technical and operational management, physical processes and actor activities, and equipment and surroundings [22].STAMPAccidents are not due to independent component failures but occur when external disturbances, component failures, or interactions between system components cannot be controlled appropriately [23].FRAMFunctional resonance theory is the theoretical basis of FRAM model construction and states that there are many functions with normal fluctuations in the system, and when the normal fluctuations of a particular function are abrupt, an accident occurs [24].2-4 modelThe model indicates that the occurrence of accidents is the result of the development of individuals and organizations in four stages: one-off behavior, habitual behavior, operational behavior, and guide behavior. The model considers the direct cause of an accident to be the unsafe behavior of humans or unsafe conditions of equipment and the environment. The root cause is a weak organizational safety culture [25].Based on STAMP, two techniques have been developed by researchers. One is System Theoretic Process Analysis (STPA) and the other is Causal Analysis based on STAMP (CAST) [30, 31]. STPA is utilized for system hazard analysis, whereas CAST is utilized for accident cause analysis [32]. Since this research is focused on system hazard analysis, STPA technology is utilized.


## 2.1. Tower Crane Safety Management

The safety management of tower cranes and the analysis of the contributing factors that influence tower crane safety have been previously reported based on multiple perspectives. Based on literature reviews and site visits, Shapira and Lyachin [4] identified several safety factors including the project conditions, the environment, the human factor, and the safety management procedures. Beavers et al. [5] investigated crane incidents based on OSHA (Occupational Safety and Health Act) incident data and highlighted the importance of safety training for managers and operators. Raviv et al. [6] investigated 51 crane accidents, as well as 161 near-misses. They also investigated the importance of crane safety risk factors and the relationship between human and technical factors [7]. According to the literature review, the human factor, the environment, the safety management procedures, and the equipment quality are all associated with tower crane safety [8].Furthermore, although different hazards may occur during different phases, previous works often focused on the usage phase [9, 10]. Some researchers have investigated dynamic structural performance, the interaction effects of multitower crane operation, the load, and the environment of the tower crane in the usage phase [11–13]. In addition, the factors that impact safety during the installation (including climbing) and dismantling phases have been analyzed [14]. However, there are few comparative studies on the multiple phases of tower cranes on the construction site. Equally important are the interrelationships between the hazards associated with different phases, which have not been investigated to date. In this paper, we address the aforementioned limitations in the literature.


## 2.2. Hazard Analysis

The conventional hazard analysis methods include preliminary hazard analysis (PHA), system hazard analysis (SHA), fault tree analysis (FTA), event tree analysis (ETA), failure mode and effects analysis (FMEA), and failure mode effects and criticality analysis (FMECA) [15–17]. With the development of system thinking, system analysis methods such as AcciMap, STAMP, FRAM, and the 2–4 Model have been increasingly utilized in contemporary studies to analyze hazards [18]. According to one of the main tenets of system thinking, accidents are not caused by a series of linear events. Moreover, the relationships and interactions among the system elements should be considered [19]. A complex system of accidents may be analyzed in detail to define the relationship between several factors at different organizational levels based on the system thinking principle [20, 21]. It is an important method for the analysis of the cause of accidents and safety hazard identification.These system thinking methods have different objectives. A summary of each method is presented in Table1. These methods have also been compared in several investigations and it was concluded that the STAMP model results in a more comprehensive set of conclusions and is more reliable than other accident system analysis methods [26–28]. The STAMP model involves various elements of a system, such as the individuals, the objects, the organizations, and the environment [29]. The most important is that the STAMP model concerns the interactions of components and systems. As the tower crane safety system is a complex system with different components and phases, the STAMP model can contribute to the safety system analysis of the tower crane during different construction phases in this study.Table 1
System thinking method.
MethodMain ideaAcciMapAcciMap analyzes accidents concerning six organizational levels, including government policy and budgeting, regulatory bodies and associations, local area government planning and budgeting (including company management), technical and operational management, physical processes and actor activities, and equipment and surroundings [22].STAMPAccidents are not due to independent component failures but occur when external disturbances, component failures, or interactions between system components cannot be controlled appropriately [23].FRAMFunctional resonance theory is the theoretical basis of FRAM model construction and states that there are many functions with normal fluctuations in the system, and when the normal fluctuations of a particular function are abrupt, an accident occurs [24].2-4 modelThe model indicates that the occurrence of accidents is the result of the development of individuals and organizations in four stages: one-off behavior, habitual behavior, operational behavior, and guide behavior. The model considers the direct cause of an accident to be the unsafe behavior of humans or unsafe conditions of equipment and the environment. The root cause is a weak organizational safety culture [25].Based on STAMP, two techniques have been developed by researchers. One is System Theoretic Process Analysis (STPA) and the other is Causal Analysis based on STAMP (CAST) [30, 31]. STPA is utilized for system hazard analysis, whereas CAST is utilized for accident cause analysis [32]. Since this research is focused on system hazard analysis, STPA technology is utilized.


## 3. Methodology

### 3.1. IDEF0

IDEF0 is one of the IDEF (ICAM Definition method) developed by the US Air Force’s ICAM (Integrated computer-aided manufacturing) to describe the system manufacturing process using structured graphics [33, 34]. This approach utilizes boxes that represent activities and arrows that represent interfaces that affect the activities and mainly includes the following four interfaces:(i)
Input interface: Resources required to perform or complete specific activities, placed on the left side of the box diagram.(ii)
Output interface: Processed or modified output by the activities, placed on the right side of the box diagram.(iii)
Control interface: The conditions and restrictions required by the activities, placed above the box diagram.(iv)
Mechanism interface: The tools needed to complete the activities, including personnel, facilities, and equipment, are placed below the box diagram. The basic structure of IDEF0 is shown in Figure 2.The output of the previous activity may be utilized as the input of the next activity when IDEF0 is used to analyze a series of process activities. In this research, the construction process of the tower crane is analyzed via this method.Figure 2
Basic structure of IDEF0.


### 3.2. STAMP

For accident analysis based on system theory, Leveson proposed STAMP (Systems-Theoretic Accident Model and Processes) that considers safety as a control problem and asserts that accidents occur when the control system cannot adequately address system component failures, external disturbances, or dysfunctional interactions among the system components.The STAMP model was compared to other accident analysis methods in several previous works, including AcciMap, FRAM, HFACS, and 2-4 model [35]. The results of these studies also suggest that STAMP has better performance on hazard analysis for complex systems. Based on our literature review, the STAMP model can reflect both the impact of system components and process interactions [36]. As the tower crane safety system is a complex system with different components and phases, the STAMP model can contribute to the improvement of the safety system analysis of tower cranes during different construction phases in this study.


### 3.3. STPA

System Theoretic Process Analysis (STPA) is a system hazard analysis based on the STAMP model. It identifies hazards by analyzing unsafe behaviors in the STAMP control model [37–40]. The STPA Handbook defines the steps of STAMP and STPA as follows [41]:(1)
Define the purpose of the analysis(2)
Model the control structure(3)
Identify loss scenarios(4)
Identify unsafe control actionsAccording to STPA Handbook, the steps involved in STAMP and STPA are shown in Figure3.Figure 3
STAMP and STPA steps.


## 3.1. IDEF0

IDEF0 is one of the IDEF (ICAM Definition method) developed by the US Air Force’s ICAM (Integrated computer-aided manufacturing) to describe the system manufacturing process using structured graphics [33, 34]. This approach utilizes boxes that represent activities and arrows that represent interfaces that affect the activities and mainly includes the following four interfaces:(i)
Input interface: Resources required to perform or complete specific activities, placed on the left side of the box diagram.(ii)
Output interface: Processed or modified output by the activities, placed on the right side of the box diagram.(iii)
Control interface: The conditions and restrictions required by the activities, placed above the box diagram.(iv)
Mechanism interface: The tools needed to complete the activities, including personnel, facilities, and equipment, are placed below the box diagram. The basic structure of IDEF0 is shown in Figure 2.The output of the previous activity may be utilized as the input of the next activity when IDEF0 is used to analyze a series of process activities. In this research, the construction process of the tower crane is analyzed via this method.Figure 2
Basic structure of IDEF0.


## 3.2. STAMP

For accident analysis based on system theory, Leveson proposed STAMP (Systems-Theoretic Accident Model and Processes) that considers safety as a control problem and asserts that accidents occur when the control system cannot adequately address system component failures, external disturbances, or dysfunctional interactions among the system components.The STAMP model was compared to other accident analysis methods in several previous works, including AcciMap, FRAM, HFACS, and 2-4 model [35]. The results of these studies also suggest that STAMP has better performance on hazard analysis for complex systems. Based on our literature review, the STAMP model can reflect both the impact of system components and process interactions [36]. As the tower crane safety system is a complex system with different components and phases, the STAMP model can contribute to the improvement of the safety system analysis of tower cranes during different construction phases in this study.


## 3.3. STPA

System Theoretic Process Analysis (STPA) is a system hazard analysis based on the STAMP model. It identifies hazards by analyzing unsafe behaviors in the STAMP control model [37–40]. The STPA Handbook defines the steps of STAMP and STPA as follows [41]:(1)
Define the purpose of the analysis(2)
Model the control structure(3)
Identify loss scenarios(4)
Identify unsafe control actionsAccording to STPA Handbook, the steps involved in STAMP and STPA are shown in Figure3.Figure 3
STAMP and STPA steps.


## 4. Hazards of Tower Crane in Different Phases

### 4.1. Process Analysis of Tower Crane with IDEF0

In principle, the installation, usage, climbing, and dismantling phases of the tower crane occur at construction sites. Once the tower crane is installed, it is frequently used and climbed until it is removed at the end of the service cycle. A structured flowchart is generated via IDEF0 as shown in Figure4. This figure shows the ordinal relations and involved components of tower crane installation (A1), usage (A2), climbing (A3), and dismantling (A4). In order to analyze the system input of installation (A1), the preparation for tower crane installation (A0) is also considered in the workflow.Figure 4
Tower crane phases on-site (IDEF0).According to the site investigation, the personnel, equipment, and task of each phase are listed in Table2.Table 2
Features of tower crane phases.
PhaseTaskPersonnelEquipmentInstallationThe workers assemble the components to install a tower crane.Installers, operator, rigger, signalman, supervisor, and managerTruck crane and other tower cranesUsageThe workers use a tower crane to lift materials.Operator, rigger, and signalmanTower craneClimbingThe workers install a subassembly of the tower crane mast to add the height of the tower crane.Installers, operator, rigger, signalman, supervisor, and managerTruck crane and other tower cranesDismantlingThe workers dismantle the tower crane to components.Installers, operator, rigger, signalman, supervisor, and managerTruck crane and other tower cranesThe personnel involved in the installation, climbing, and dismantling phases of the tower crane are primarily the same. The individuals and components involved in the climbing and dismantling phases are mostly the same as those of the installation phase. The differences are the system input and the working activities. The climbing process involves repeating certain steps of the installation process, namely the installation of the mast section. The dismantling process entails the inverse of the installation process. In consideration of the similar components and interactions in installation, climbing, and dismantling, the installation phase is selected to represent others to analyze internal system hazards. In the usage phase, the lifting system that consists of the tower crane and the lifting object is considered as the controlled object. The personnel in the usage phases mainly include the operator, rigger, and signalman. This is the process in which the operator uses the tower crane to lift the objects and is relatively different from the installation phase. Hazard analysis of the usage phase is therefore performed separately. Moreover, the hazards caused by the interaction among the phases are also analyzed separately.


### 4.2. System Analysis of Tower Crane with STAMP

The STAMP model has good performance for system modeling and safety analysis and is broadly applied to accident analysis in astronautics, fire disasters, traffic incidents, and other industries [42–44]. However, it is seldom applied to system hazard analysis in the construction industry, and the tower crane in particular. In the following, the STAMP method is adapted to model the installation and usage phases of the tower crane. Moreover, the proposed STPA method based on STAMP is applied to analyze hazards, namely, the unsafe behavior of humans and the unsafe state of the objects.Since the STAMP model is proposed in the context of system theory, the system model is considered as a hierarchical structure in which each layer imposes constraints on its lower layers. In the complete STAMP, several superstructures are involved, including Congress and Legislatures, Government Regulatory Agencies, and Companies. However, in this investigation, only hazards at the construction site are analyzed and superstructures such as government and enterprise are not considered. Thus, the core content of the STAMP model, i.e., the control loop and the process model, is utilized in this work (Figure5).Figure 5
The control model of STAMP.In the control loop and process model of STAMP, the boxes represent components, and the arrows represent the interactions between the components, the system, and the outside world. The components are listed as follows:(i)
Controlled process: The object of information perception, control decision, and instruction execution in the system process.(ii)
Sensors: Collect information during the controlled process and feedback for other components.(iii)
Controller: Provide control decisions based on system feedback, including feedback from human supervisors and automation controllers.(iv)
Actuators: According to the instructions issued by the controller, the operation is then conducted on the controlled object.The interaction between components consists of the feedback of information and the control loops. A dynamic balance is also maintained by the system via the feedback and control of the components. The interactions between the system and the outside world include the process input, the process output, and the disturbance due to the outside world. Generally, the STAMP model is applied to system security analysis related to three aspects: component failure, component interaction failure, and external influence.There are few safety analysis methods that consider system inputs and outputs. They usually consider factors within the system. STAMP can analyze the interaction between phases via the input and output analysis. It is the main reason to choose this method in our research. The process input and output of STAMP can correspond to the IDEF0 interface. Meanwhile, the controls and mechanisms of IDEF0 can help establish the control model of STAMP. Thus, it is feasible to combine IDEF0 and STAMP in this study. This method can analyze the hazard transition between different phases.


#### 4.2.1. Tower Crane STAMP Model for the Installation Phase

Tower crane installation is a process that involves rigorous operation steps, short operation time, complicated procedures, and high professional requirements of the workers. Younes and Marzouk [13] analyzed and listed the components required for the installation of the tower crane as the foundation, basic mast, main jib, counter jib, winding gear, and operating room. All these components constitute the tower crane and form the controlled process of the system. The installation processes include sensing, controlling, and execution in the vicinity of the tower crane and its components. The supervisor acts as a sensor and collects on-site information, including the status of the tower crane and the behavior of the operators, which is then fed back to the manager. The manager acts as a controller, which involves making decisions and sending out operational commands based on the installation scheme and the information received from the construction site. Based on the directives of the supervisor, the workers install the tower crane according to the installation scheme and the operational commands from the manager. The workers consist of an installer, operator, signalman, and rigger. The latter three can be the individuals that also operate the tower crane or those who use other lifting machinery to lift the tower crane components. Moreover, the completion of the previous phase, as the process input, affects the installation process. The external disturbance affects the system components, including the construction environment and the weather conditions. Likewise, the completion of the installation phase as the process output also affects the next phase. According to the previous analysis, the system control loop and the process model for the tower crane installation process are constructed using the STAMP method, as illustrated in Figure 6.Figure 6
STAMP model in installation.


#### 4.2.2. Tower Crane STAMP Model for the Usage Phase

The usage phase of the tower crane consists of several work components and participants different from the installation, climbing, and dismantling phases. Therefore, the analysis is performed separately. In the usage phase, the operators, riggers, and signalmen lift objects by operating the tower crane. Hence, the lifting system that consists of the tower crane and the lifting objects is considered as the controlled process. The tower crane monitoring system acts as a sensor to monitor the status of the lifting system. If the monitoring system identifies abnormal data, the security system, including lifting limiters, lifting height limiters, and other functional systems, limits the operation of the tower crane to ensure safety. The signalman acts as a human sensor to observe the state of the lifting system and to transmit signals to the operator and riggers. The operator evaluates the status of the lifting system by observing and monitoring system data and the information provided by the signalman. The operator then informs the signalman to command the riggers to cooperate with the operation. According to the command of the signalman, the riggers operate the hook and the lifting objects and cooperate to complete the lifting task. Figure7 shows the STAMP system model of the tower crane in the usage phase.Figure 7
STAMP model in the usage phase.


### 4.3. Hazards Analysis of Tower Crane with STPA

In the STAMP model, hazard analysis involves three components: component failure, component interaction failure, and external influence. In this research, the system input and output at the installation, climbing, and dismantling phases are different, whereas the other internal components and external disturbance of the system are almost the same. Therefore, system interactions that involve system input and output are analyzed separately. The hazard analysis is conducted based on four aspects: component failure, component interaction failure, external disturbance, and system interaction. The first three components are analyzed in this section. Referring to the STAMP model diagram, the relevant components and processes of the installation are also listed, and the hazards are analyzed using the STPA method. STPA defines the following four unsafe control actions:(1)
Action required but not provided;(2)
Unsafe action provided;(3)
Incorrect timing/order;(4)
Terminated too soon/applied too long.The specific descriptions of the hazards are provided based on the analysis of 149 tower crane accident reports and construction site investigations. In China, once an accident occurs, the government will organize an expert group to investigate the accident site and disclose the accident report to the public. The accident report will specify the course of the accident, the causes, and the person responsible for the accident. The tower crane accident reports can be obtained from the website of the Ministry of Housing and Urban-Rural Development of the People’s Republic of China. We collected 149 tower crane accidents that happened in the period from 2015 to 2019. According to the analysis and statistics of the accidents, 27 occurred during installation, 19 during climbing, 11 during dismantling, and 92 during usage. Figure8 shows the information of the accident reports collected in this research.Figure 8
Information of accident reports: (a) Accident consequence; (b) Accident phase; (c) Accident type.
(a)(b)(c)Among all the phases, the number of accidents in the usage is the largest. In the service cycle of the tower crane, the time in the usage phase is the longest. The time for installation, climbing, and dismantling is only a few days. Table3 shows the number of casualties at each phase. According to the statistic table, the average number of casualties in the usage phase is lower than the other three phases. It indicates that the consequences of the accident during the installation, climbing, and dismantling phases are serious. Therefore, the safety of the tower crane in these phases is also worthy of attention.Table 3
Casualties of tower crane accidents.
PhaseAccidentsDeathsInjuriesAverage casualtiesInstallation2742322.74Usage92110301.54Climbing1941183.10Dismantling112392.91Throughout this investigation, from November 2017 to December 2019, the research team conducted field studies at least twice a month at the construction sites of three high-rise building projects and a bridge project in China. The three high-rise building projects included at least two large tower cranes. In the case of the bridge project, each pier of the bridge was equipped with a small tower crane. Thus, several tower cranes were simultaneously in different phases. Fifty-two research reports were generated based on the observation of each phase during the service cycle of the tower cranes.


#### 4.3.1. System Hazard Analysis for Installation Phase

According to the accident reports from the government and research reports from the construction site, the hazard descriptions associated with the tower crane can be extracted. Using this information, the hazards analysis for the tower crane can be conducted by STPA.(1) Component failure. This refers to the possible unsafe states of the system components, including the tower crane and its elements, the relevant personnel, and the documents. The unsafe state of the components is an absent and unqualified component. The hazards associated with the installation phase (HIP) due to component failure are gained via the analysis of each component in the STAMP model, as presented in Table 4.Table 4
Component failure of installation phase.
ComponentHazardTower crane and its componentsHIP1 defective foundation of tower craneHIP2 unstable integral structure of tower craneHIP3 nonconforming member of tower craneHIP4 deletion of tower crane memberHIP5 unstable fasteningsManager/supervisor/workerHIP6 lack of staffHIP7 lack of ability or qualificationHIP8 mental and physical distressHIP9 weak safety conceptHIP10 failure to wear protective equipment as requiredDocumentHIP11 lack of documentHIP12 incomplete schemeHIP13 design error(2) Component Interaction. In the STAMP model, the component interaction is divided into the control and feedback processes. The difference between them is that the feedback process only yields data and not the decision commands. The control process also yields decision results and commands. The interaction between the components includes the control and feedback process. According to the four unsafe constraints of the STPA, the component interaction hazards associated with the installation phase are analyzed, and the analysis results are shown in Table 5.Table 5
Unsafe control action behaviors in the installation phase (STPA).
InteractionsAction required but not providedUnsafe action providedIncorrect timing/orderTerminated too soon/applied too longC1. Archives managementHIP14 scheme has not been inspectedHIP15 wrong scheme has been providedHIP16 scheme inspection has not been conducted before installation—C2. Operational commandHIP17 manager has not provided operational commandHIP18 manager command errorHIP19 operational command delayHIP20 command behavior last too longC3. Technical disclosureHIP21 worker has not participated in the technical disclosureHIP22 incorrect technical disclosureHIP23 technical disclosure has not been conducted before installation—C4. OperatingHIP24 necessary operations have not been conductedHIP25 missing operationHIP26 sequence of operations errorHIP27 operations last too longC5. SuperviseHIP28 supervisors have not observed the behavior of the workersHIP29 supervisor has not stopped the unsafe behavior of the workersHIP30 cessation of the unsafe behavior was too lateHIP31 supervisor has not supervised the whole processF1. Provide schemeHIP32 manager has not participated in the technical disclosureHIP22 incorrect technical disclosureHIP23 technical disclosure has not been conducted before installation—F2. FeedbackHIP33 workers have not reported to the managerHIP34 workers have misreportedHIP35 workers have reported too late—F3. Status and process informationHIP36 workers have not observed the status of the tower craneHIP37 workers have misjudged the status of the tower crane——F4. Provide schemeHIP38 supervisor has not participated in the technical disclosureHIP22 incorrect technical disclosureHIP23 technical disclosure has not been conducted before installation—F5. ObservationHIP39 supervisor has not observed the status of the tower craneHIP40 supervisor has misjudged the status of the tower crane—HIP31 supervisor has not supervised the whole processF6. ObservationHIP41 manager has not observed the status of tower craneHIP42 manager has misjudged the status of tower crane——F7. Feedback informationHIP43 supervisor has not reported information to the managerHIP44 supervisor provided wrong information to managerHIP45 supervisor provided feedback too late—(3) External Disturbance. Disturbances from the outside may influence components and interactions. The hazard analysis results are shown in Table 6.Table 6
External disturbance of installation.
Components and interactionsExternal disturbanceWorkerHIP46 The pressure of reward and punishment mechanismHIP47 short of safety education and trainingHIP48 schedule pressureC4. OperatingHIP49 auxiliary equipment failureTower crane and its componentsHIP50 bad weatherHIP51 complex operating environmentHIP52 lack of warning signsManagerHIP48 schedule pressureCommunicationHIP53 noiseHIP54 failure or interference of communication tools


#### 4.3.2. System Hazard Analysis for Usage Phase

According to the accident reports and construction site investigations, the hazards associated with the usage phase (HUP) are analyzed using similar methods to the aforementioned approach. Table7 lists the component failure associated with the usage phase and analyzes the corresponding hazards. Table 8 shows the hazards caused by components interaction. The hazards caused by external disturbances are presented in Table 9.Table 7
Component failure of usage phase.
ComponentUnsafe stateLifting systemHUP1 defective foundation of tower craneHUP2 unstable integral structure of tower craneHUP3 nonconforming member of tower craneHUP4 deletion of tower crane memberHUP5 unstable fasteningsHUP6 tower crane over the service lifeHUP7 tower crane operating system malfunctionHUP8 materials too large or too heavyMonitoring system of tower craneHUP9 lack of monitoring systemHUP10 sensors failureSecurity system of tower craneHUP11 lack of security systemHUP12 security device failureSignalman/operator/riggerHUP13 lack of staffHUP14 without ability or qualificationHUP15 mental and physical distressHUP16 weak safety conceptHUP17 failure to wear protective equipment as requiredTable 8
Unsafe control action behaviors of usage phase (STPA).
InteractionsAction required but not providedUnsafe action providedIncorrect timing/orderTerminated too soon/applied too longC1. CheckHUP18 operator has not routinely checkedHUP19 illegal shut down or destroy the security system——C2. Limit runningSame as “component failure.”HUP20 security device setting error or faultHUP21 security device is not sensitive—C3. OperatingHUP22, the operator has not performed the operationHUP23 misoperation of operatorHUP24 Operator’s operation is not timelyHUP25 insufficient or excessive lifting height and swivel angleC4. OperatingHUP26 rigger has not checked the lifting systemHUP27 rigger illegally has bound or placed the lifting objectHUP28 rigger has not escaped to a safe place when lifting—C5. CommandHUP29 signalman has not provided commandHUP30 command errorHUP31 command not timely—C6. CommandHUP29 signalman has not provided commandHUP30 command errorHUP31 command not timely—F1. ObservationHUP32 signalman has not observed the status of tower craneHUP33 signalman has misjudged the status of tower crane——F2. MonitorHUP34 the tower crane monitoring system is not openHUP35 sensors are not sensitive——F3. FeedbackHUP36 monitoring data have not uploadedHUP37 data missing or errorHUP38 data is not uploaded timely—F4. State displayHUP39 monitoring data is not visualHUP40 wrong data have been displayed to the operator——F5. FeedbackHUP41 operator has not submitted feedback to the signalmanHUP42 feedback information missing or errorHUP43 feedback is not timely—F6. FeedbackHUP44 rigger has not sent a signalHUP45 signal sending errorHUP46 the signal is not sent in time—F7. WarningHUP47 lack of alarmHUP48 false alarm—HUP49 alarm ringing after trouble removalF8. ObservationHUP50 operator has not observed the status of tower craneHUP51 operator has misjudged the status of tower crane——F9. ObservationHUP52 rigger has not observed the status of tower craneHUP53 rigger has misjudged the status of tower crane——Table 9
External disturbance of usage phase.
Components and interactionsExternal disturbanceWorkerHUP54 the pressure of reward and punishment mechanismHUP55 short of safety education and trainingHUP56 schedule pressureLifting systemHUP57 bad weatherHUP58 complex operating environmentHUP59 lack of warning signsHUP60 multitower crane interactionCommand and feedbackHUP61 noiseHUP62 failure or interference of communication tools


#### 4.3.3. Hazards of System Interactions during the Four Phases

The system interactions include the inputs and outputs, which differ for the different phases based on the state of the construction process of the tower cranes on-site. According to the IDEF0 map of the tower crane, the outputs of previous phases are the inputs of the next phase. The inputs and outputs of each phase are shown in Figure9. The hazards of system interactions mean the negative effects of the previous process. The arrows show the propagation path of hazards. According to the accident reports and research reports, some descriptions of the hazards associated with system interactions during the four phases can be found. Table 10 lists the hazards of system interactions, including hazards associated with the installation phase (HIP), hazards associated with the usage phase (HUP), hazards associated with the climbing phase (HCP), and hazards associated with the dismantling phase (HDP).Figure 9
System inputs and outputs of each phase.Table 10
Hazards of system interactions.
Current phasePrevious phaseHazards of system interactionA1A0HIP55 insufficiency of preparation for tower crane installationA2A1HUP63 unqualified installation of tower craneA2HUP64 without maintenanceA3HUP65 unqualified climbing of tower craneA3A2HCP55 overuse causes breakdownA4A2HDP55 overuse causes breakdownNote: A0-Preparation for installation, A1-Installation, A2-Usage, A3-Climbing, A4-Dismantling, as in Figure3.


## 4.1. Process Analysis of Tower Crane with IDEF0

In principle, the installation, usage, climbing, and dismantling phases of the tower crane occur at construction sites. Once the tower crane is installed, it is frequently used and climbed until it is removed at the end of the service cycle. A structured flowchart is generated via IDEF0 as shown in Figure4. This figure shows the ordinal relations and involved components of tower crane installation (A1), usage (A2), climbing (A3), and dismantling (A4). In order to analyze the system input of installation (A1), the preparation for tower crane installation (A0) is also considered in the workflow.Figure 4
Tower crane phases on-site (IDEF0).According to the site investigation, the personnel, equipment, and task of each phase are listed in Table2.Table 2
Features of tower crane phases.
PhaseTaskPersonnelEquipmentInstallationThe workers assemble the components to install a tower crane.Installers, operator, rigger, signalman, supervisor, and managerTruck crane and other tower cranesUsageThe workers use a tower crane to lift materials.Operator, rigger, and signalmanTower craneClimbingThe workers install a subassembly of the tower crane mast to add the height of the tower crane.Installers, operator, rigger, signalman, supervisor, and managerTruck crane and other tower cranesDismantlingThe workers dismantle the tower crane to components.Installers, operator, rigger, signalman, supervisor, and managerTruck crane and other tower cranesThe personnel involved in the installation, climbing, and dismantling phases of the tower crane are primarily the same. The individuals and components involved in the climbing and dismantling phases are mostly the same as those of the installation phase. The differences are the system input and the working activities. The climbing process involves repeating certain steps of the installation process, namely the installation of the mast section. The dismantling process entails the inverse of the installation process. In consideration of the similar components and interactions in installation, climbing, and dismantling, the installation phase is selected to represent others to analyze internal system hazards. In the usage phase, the lifting system that consists of the tower crane and the lifting object is considered as the controlled object. The personnel in the usage phases mainly include the operator, rigger, and signalman. This is the process in which the operator uses the tower crane to lift the objects and is relatively different from the installation phase. Hazard analysis of the usage phase is therefore performed separately. Moreover, the hazards caused by the interaction among the phases are also analyzed separately.


## 4.2. System Analysis of Tower Crane with STAMP

The STAMP model has good performance for system modeling and safety analysis and is broadly applied to accident analysis in astronautics, fire disasters, traffic incidents, and other industries [42–44]. However, it is seldom applied to system hazard analysis in the construction industry, and the tower crane in particular. In the following, the STAMP method is adapted to model the installation and usage phases of the tower crane. Moreover, the proposed STPA method based on STAMP is applied to analyze hazards, namely, the unsafe behavior of humans and the unsafe state of the objects.Since the STAMP model is proposed in the context of system theory, the system model is considered as a hierarchical structure in which each layer imposes constraints on its lower layers. In the complete STAMP, several superstructures are involved, including Congress and Legislatures, Government Regulatory Agencies, and Companies. However, in this investigation, only hazards at the construction site are analyzed and superstructures such as government and enterprise are not considered. Thus, the core content of the STAMP model, i.e., the control loop and the process model, is utilized in this work (Figure5).Figure 5
The control model of STAMP.In the control loop and process model of STAMP, the boxes represent components, and the arrows represent the interactions between the components, the system, and the outside world. The components are listed as follows:(i)
Controlled process: The object of information perception, control decision, and instruction execution in the system process.(ii)
Sensors: Collect information during the controlled process and feedback for other components.(iii)
Controller: Provide control decisions based on system feedback, including feedback from human supervisors and automation controllers.(iv)
Actuators: According to the instructions issued by the controller, the operation is then conducted on the controlled object.The interaction between components consists of the feedback of information and the control loops. A dynamic balance is also maintained by the system via the feedback and control of the components. The interactions between the system and the outside world include the process input, the process output, and the disturbance due to the outside world. Generally, the STAMP model is applied to system security analysis related to three aspects: component failure, component interaction failure, and external influence.There are few safety analysis methods that consider system inputs and outputs. They usually consider factors within the system. STAMP can analyze the interaction between phases via the input and output analysis. It is the main reason to choose this method in our research. The process input and output of STAMP can correspond to the IDEF0 interface. Meanwhile, the controls and mechanisms of IDEF0 can help establish the control model of STAMP. Thus, it is feasible to combine IDEF0 and STAMP in this study. This method can analyze the hazard transition between different phases.


### 4.2.1. Tower Crane STAMP Model for the Installation Phase

Tower crane installation is a process that involves rigorous operation steps, short operation time, complicated procedures, and high professional requirements of the workers. Younes and Marzouk [13] analyzed and listed the components required for the installation of the tower crane as the foundation, basic mast, main jib, counter jib, winding gear, and operating room. All these components constitute the tower crane and form the controlled process of the system. The installation processes include sensing, controlling, and execution in the vicinity of the tower crane and its components. The supervisor acts as a sensor and collects on-site information, including the status of the tower crane and the behavior of the operators, which is then fed back to the manager. The manager acts as a controller, which involves making decisions and sending out operational commands based on the installation scheme and the information received from the construction site. Based on the directives of the supervisor, the workers install the tower crane according to the installation scheme and the operational commands from the manager. The workers consist of an installer, operator, signalman, and rigger. The latter three can be the individuals that also operate the tower crane or those who use other lifting machinery to lift the tower crane components. Moreover, the completion of the previous phase, as the process input, affects the installation process. The external disturbance affects the system components, including the construction environment and the weather conditions. Likewise, the completion of the installation phase as the process output also affects the next phase. According to the previous analysis, the system control loop and the process model for the tower crane installation process are constructed using the STAMP method, as illustrated in Figure 6.Figure 6
STAMP model in installation.


### 4.2.2. Tower Crane STAMP Model for the Usage Phase

The usage phase of the tower crane consists of several work components and participants different from the installation, climbing, and dismantling phases. Therefore, the analysis is performed separately. In the usage phase, the operators, riggers, and signalmen lift objects by operating the tower crane. Hence, the lifting system that consists of the tower crane and the lifting objects is considered as the controlled process. The tower crane monitoring system acts as a sensor to monitor the status of the lifting system. If the monitoring system identifies abnormal data, the security system, including lifting limiters, lifting height limiters, and other functional systems, limits the operation of the tower crane to ensure safety. The signalman acts as a human sensor to observe the state of the lifting system and to transmit signals to the operator and riggers. The operator evaluates the status of the lifting system by observing and monitoring system data and the information provided by the signalman. The operator then informs the signalman to command the riggers to cooperate with the operation. According to the command of the signalman, the riggers operate the hook and the lifting objects and cooperate to complete the lifting task. Figure7 shows the STAMP system model of the tower crane in the usage phase.Figure 7
STAMP model in the usage phase.


## 4.2.1. Tower Crane STAMP Model for the Installation Phase

Tower crane installation is a process that involves rigorous operation steps, short operation time, complicated procedures, and high professional requirements of the workers. Younes and Marzouk [13] analyzed and listed the components required for the installation of the tower crane as the foundation, basic mast, main jib, counter jib, winding gear, and operating room. All these components constitute the tower crane and form the controlled process of the system. The installation processes include sensing, controlling, and execution in the vicinity of the tower crane and its components. The supervisor acts as a sensor and collects on-site information, including the status of the tower crane and the behavior of the operators, which is then fed back to the manager. The manager acts as a controller, which involves making decisions and sending out operational commands based on the installation scheme and the information received from the construction site. Based on the directives of the supervisor, the workers install the tower crane according to the installation scheme and the operational commands from the manager. The workers consist of an installer, operator, signalman, and rigger. The latter three can be the individuals that also operate the tower crane or those who use other lifting machinery to lift the tower crane components. Moreover, the completion of the previous phase, as the process input, affects the installation process. The external disturbance affects the system components, including the construction environment and the weather conditions. Likewise, the completion of the installation phase as the process output also affects the next phase. According to the previous analysis, the system control loop and the process model for the tower crane installation process are constructed using the STAMP method, as illustrated in Figure 6.Figure 6
STAMP model in installation.


## 4.2.2. Tower Crane STAMP Model for the Usage Phase

The usage phase of the tower crane consists of several work components and participants different from the installation, climbing, and dismantling phases. Therefore, the analysis is performed separately. In the usage phase, the operators, riggers, and signalmen lift objects by operating the tower crane. Hence, the lifting system that consists of the tower crane and the lifting objects is considered as the controlled process. The tower crane monitoring system acts as a sensor to monitor the status of the lifting system. If the monitoring system identifies abnormal data, the security system, including lifting limiters, lifting height limiters, and other functional systems, limits the operation of the tower crane to ensure safety. The signalman acts as a human sensor to observe the state of the lifting system and to transmit signals to the operator and riggers. The operator evaluates the status of the lifting system by observing and monitoring system data and the information provided by the signalman. The operator then informs the signalman to command the riggers to cooperate with the operation. According to the command of the signalman, the riggers operate the hook and the lifting objects and cooperate to complete the lifting task. Figure7 shows the STAMP system model of the tower crane in the usage phase.Figure 7
STAMP model in the usage phase.


## 4.3. Hazards Analysis of Tower Crane with STPA

In the STAMP model, hazard analysis involves three components: component failure, component interaction failure, and external influence. In this research, the system input and output at the installation, climbing, and dismantling phases are different, whereas the other internal components and external disturbance of the system are almost the same. Therefore, system interactions that involve system input and output are analyzed separately. The hazard analysis is conducted based on four aspects: component failure, component interaction failure, external disturbance, and system interaction. The first three components are analyzed in this section. Referring to the STAMP model diagram, the relevant components and processes of the installation are also listed, and the hazards are analyzed using the STPA method. STPA defines the following four unsafe control actions:(1)
Action required but not provided;(2)
Unsafe action provided;(3)
Incorrect timing/order;(4)
Terminated too soon/applied too long.The specific descriptions of the hazards are provided based on the analysis of 149 tower crane accident reports and construction site investigations. In China, once an accident occurs, the government will organize an expert group to investigate the accident site and disclose the accident report to the public. The accident report will specify the course of the accident, the causes, and the person responsible for the accident. The tower crane accident reports can be obtained from the website of the Ministry of Housing and Urban-Rural Development of the People’s Republic of China. We collected 149 tower crane accidents that happened in the period from 2015 to 2019. According to the analysis and statistics of the accidents, 27 occurred during installation, 19 during climbing, 11 during dismantling, and 92 during usage. Figure8 shows the information of the accident reports collected in this research.Figure 8
Information of accident reports: (a) Accident consequence; (b) Accident phase; (c) Accident type.
(a)(b)(c)Among all the phases, the number of accidents in the usage is the largest. In the service cycle of the tower crane, the time in the usage phase is the longest. The time for installation, climbing, and dismantling is only a few days. Table3 shows the number of casualties at each phase. According to the statistic table, the average number of casualties in the usage phase is lower than the other three phases. It indicates that the consequences of the accident during the installation, climbing, and dismantling phases are serious. Therefore, the safety of the tower crane in these phases is also worthy of attention.Table 3
Casualties of tower crane accidents.
PhaseAccidentsDeathsInjuriesAverage casualtiesInstallation2742322.74Usage92110301.54Climbing1941183.10Dismantling112392.91Throughout this investigation, from November 2017 to December 2019, the research team conducted field studies at least twice a month at the construction sites of three high-rise building projects and a bridge project in China. The three high-rise building projects included at least two large tower cranes. In the case of the bridge project, each pier of the bridge was equipped with a small tower crane. Thus, several tower cranes were simultaneously in different phases. Fifty-two research reports were generated based on the observation of each phase during the service cycle of the tower cranes.


### 4.3.1. System Hazard Analysis for Installation Phase

According to the accident reports from the government and research reports from the construction site, the hazard descriptions associated with the tower crane can be extracted. Using this information, the hazards analysis for the tower crane can be conducted by STPA.(1) Component failure. This refers to the possible unsafe states of the system components, including the tower crane and its elements, the relevant personnel, and the documents. The unsafe state of the components is an absent and unqualified component. The hazards associated with the installation phase (HIP) due to component failure are gained via the analysis of each component in the STAMP model, as presented in Table 4.Table 4
Component failure of installation phase.
ComponentHazardTower crane and its componentsHIP1 defective foundation of tower craneHIP2 unstable integral structure of tower craneHIP3 nonconforming member of tower craneHIP4 deletion of tower crane memberHIP5 unstable fasteningsManager/supervisor/workerHIP6 lack of staffHIP7 lack of ability or qualificationHIP8 mental and physical distressHIP9 weak safety conceptHIP10 failure to wear protective equipment as requiredDocumentHIP11 lack of documentHIP12 incomplete schemeHIP13 design error(2) Component Interaction. In the STAMP model, the component interaction is divided into the control and feedback processes. The difference between them is that the feedback process only yields data and not the decision commands. The control process also yields decision results and commands. The interaction between the components includes the control and feedback process. According to the four unsafe constraints of the STPA, the component interaction hazards associated with the installation phase are analyzed, and the analysis results are shown in Table 5.Table 5
Unsafe control action behaviors in the installation phase (STPA).
InteractionsAction required but not providedUnsafe action providedIncorrect timing/orderTerminated too soon/applied too longC1. Archives managementHIP14 scheme has not been inspectedHIP15 wrong scheme has been providedHIP16 scheme inspection has not been conducted before installation—C2. Operational commandHIP17 manager has not provided operational commandHIP18 manager command errorHIP19 operational command delayHIP20 command behavior last too longC3. Technical disclosureHIP21 worker has not participated in the technical disclosureHIP22 incorrect technical disclosureHIP23 technical disclosure has not been conducted before installation—C4. OperatingHIP24 necessary operations have not been conductedHIP25 missing operationHIP26 sequence of operations errorHIP27 operations last too longC5. SuperviseHIP28 supervisors have not observed the behavior of the workersHIP29 supervisor has not stopped the unsafe behavior of the workersHIP30 cessation of the unsafe behavior was too lateHIP31 supervisor has not supervised the whole processF1. Provide schemeHIP32 manager has not participated in the technical disclosureHIP22 incorrect technical disclosureHIP23 technical disclosure has not been conducted before installation—F2. FeedbackHIP33 workers have not reported to the managerHIP34 workers have misreportedHIP35 workers have reported too late—F3. Status and process informationHIP36 workers have not observed the status of the tower craneHIP37 workers have misjudged the status of the tower crane——F4. Provide schemeHIP38 supervisor has not participated in the technical disclosureHIP22 incorrect technical disclosureHIP23 technical disclosure has not been conducted before installation—F5. ObservationHIP39 supervisor has not observed the status of the tower craneHIP40 supervisor has misjudged the status of the tower crane—HIP31 supervisor has not supervised the whole processF6. ObservationHIP41 manager has not observed the status of tower craneHIP42 manager has misjudged the status of tower crane——F7. Feedback informationHIP43 supervisor has not reported information to the managerHIP44 supervisor provided wrong information to managerHIP45 supervisor provided feedback too late—(3) External Disturbance. Disturbances from the outside may influence components and interactions. The hazard analysis results are shown in Table 6.Table 6
External disturbance of installation.
Components and interactionsExternal disturbanceWorkerHIP46 The pressure of reward and punishment mechanismHIP47 short of safety education and trainingHIP48 schedule pressureC4. OperatingHIP49 auxiliary equipment failureTower crane and its componentsHIP50 bad weatherHIP51 complex operating environmentHIP52 lack of warning signsManagerHIP48 schedule pressureCommunicationHIP53 noiseHIP54 failure or interference of communication tools


### 4.3.2. System Hazard Analysis for Usage Phase

According to the accident reports and construction site investigations, the hazards associated with the usage phase (HUP) are analyzed using similar methods to the aforementioned approach. Table7 lists the component failure associated with the usage phase and analyzes the corresponding hazards. Table 8 shows the hazards caused by components interaction. The hazards caused by external disturbances are presented in Table 9.Table 7
Component failure of usage phase.
ComponentUnsafe stateLifting systemHUP1 defective foundation of tower craneHUP2 unstable integral structure of tower craneHUP3 nonconforming member of tower craneHUP4 deletion of tower crane memberHUP5 unstable fasteningsHUP6 tower crane over the service lifeHUP7 tower crane operating system malfunctionHUP8 materials too large or too heavyMonitoring system of tower craneHUP9 lack of monitoring systemHUP10 sensors failureSecurity system of tower craneHUP11 lack of security systemHUP12 security device failureSignalman/operator/riggerHUP13 lack of staffHUP14 without ability or qualificationHUP15 mental and physical distressHUP16 weak safety conceptHUP17 failure to wear protective equipment as requiredTable 8
Unsafe control action behaviors of usage phase (STPA).
InteractionsAction required but not providedUnsafe action providedIncorrect timing/orderTerminated too soon/applied too longC1. CheckHUP18 operator has not routinely checkedHUP19 illegal shut down or destroy the security system——C2. Limit runningSame as “component failure.”HUP20 security device setting error or faultHUP21 security device is not sensitive—C3. OperatingHUP22, the operator has not performed the operationHUP23 misoperation of operatorHUP24 Operator’s operation is not timelyHUP25 insufficient or excessive lifting height and swivel angleC4. OperatingHUP26 rigger has not checked the lifting systemHUP27 rigger illegally has bound or placed the lifting objectHUP28 rigger has not escaped to a safe place when lifting—C5. CommandHUP29 signalman has not provided commandHUP30 command errorHUP31 command not timely—C6. CommandHUP29 signalman has not provided commandHUP30 command errorHUP31 command not timely—F1. ObservationHUP32 signalman has not observed the status of tower craneHUP33 signalman has misjudged the status of tower crane——F2. MonitorHUP34 the tower crane monitoring system is not openHUP35 sensors are not sensitive——F3. FeedbackHUP36 monitoring data have not uploadedHUP37 data missing or errorHUP38 data is not uploaded timely—F4. State displayHUP39 monitoring data is not visualHUP40 wrong data have been displayed to the operator——F5. FeedbackHUP41 operator has not submitted feedback to the signalmanHUP42 feedback information missing or errorHUP43 feedback is not timely—F6. FeedbackHUP44 rigger has not sent a signalHUP45 signal sending errorHUP46 the signal is not sent in time—F7. WarningHUP47 lack of alarmHUP48 false alarm—HUP49 alarm ringing after trouble removalF8. ObservationHUP50 operator has not observed the status of tower craneHUP51 operator has misjudged the status of tower crane——F9. ObservationHUP52 rigger has not observed the status of tower craneHUP53 rigger has misjudged the status of tower crane——Table 9
External disturbance of usage phase.
Components and interactionsExternal disturbanceWorkerHUP54 the pressure of reward and punishment mechanismHUP55 short of safety education and trainingHUP56 schedule pressureLifting systemHUP57 bad weatherHUP58 complex operating environmentHUP59 lack of warning signsHUP60 multitower crane interactionCommand and feedbackHUP61 noiseHUP62 failure or interference of communication tools


### 4.3.3. Hazards of System Interactions during the Four Phases

The system interactions include the inputs and outputs, which differ for the different phases based on the state of the construction process of the tower cranes on-site. According to the IDEF0 map of the tower crane, the outputs of previous phases are the inputs of the next phase. The inputs and outputs of each phase are shown in Figure9. The hazards of system interactions mean the negative effects of the previous process. The arrows show the propagation path of hazards. According to the accident reports and research reports, some descriptions of the hazards associated with system interactions during the four phases can be found. Table 10 lists the hazards of system interactions, including hazards associated with the installation phase (HIP), hazards associated with the usage phase (HUP), hazards associated with the climbing phase (HCP), and hazards associated with the dismantling phase (HDP).Figure 9
System inputs and outputs of each phase.Table 10
Hazards of system interactions.
Current phasePrevious phaseHazards of system interactionA1A0HIP55 insufficiency of preparation for tower crane installationA2A1HUP63 unqualified installation of tower craneA2HUP64 without maintenanceA3HUP65 unqualified climbing of tower craneA3A2HCP55 overuse causes breakdownA4A2HDP55 overuse causes breakdownNote: A0-Preparation for installation, A1-Installation, A2-Usage, A3-Climbing, A4-Dismantling, as in Figure3.


## 4.3.1. System Hazard Analysis for Installation Phase

According to the accident reports from the government and research reports from the construction site, the hazard descriptions associated with the tower crane can be extracted. Using this information, the hazards analysis for the tower crane can be conducted by STPA.(1) Component failure. This refers to the possible unsafe states of the system components, including the tower crane and its elements, the relevant personnel, and the documents. The unsafe state of the components is an absent and unqualified component. The hazards associated with the installation phase (HIP) due to component failure are gained via the analysis of each component in the STAMP model, as presented in Table 4.Table 4
Component failure of installation phase.
ComponentHazardTower crane and its componentsHIP1 defective foundation of tower craneHIP2 unstable integral structure of tower craneHIP3 nonconforming member of tower craneHIP4 deletion of tower crane memberHIP5 unstable fasteningsManager/supervisor/workerHIP6 lack of staffHIP7 lack of ability or qualificationHIP8 mental and physical distressHIP9 weak safety conceptHIP10 failure to wear protective equipment as requiredDocumentHIP11 lack of documentHIP12 incomplete schemeHIP13 design error(2) Component Interaction. In the STAMP model, the component interaction is divided into the control and feedback processes. The difference between them is that the feedback process only yields data and not the decision commands. The control process also yields decision results and commands. The interaction between the components includes the control and feedback process. According to the four unsafe constraints of the STPA, the component interaction hazards associated with the installation phase are analyzed, and the analysis results are shown in Table 5.Table 5
Unsafe control action behaviors in the installation phase (STPA).
InteractionsAction required but not providedUnsafe action providedIncorrect timing/orderTerminated too soon/applied too longC1. Archives managementHIP14 scheme has not been inspectedHIP15 wrong scheme has been providedHIP16 scheme inspection has not been conducted before installation—C2. Operational commandHIP17 manager has not provided operational commandHIP18 manager command errorHIP19 operational command delayHIP20 command behavior last too longC3. Technical disclosureHIP21 worker has not participated in the technical disclosureHIP22 incorrect technical disclosureHIP23 technical disclosure has not been conducted before installation—C4. OperatingHIP24 necessary operations have not been conductedHIP25 missing operationHIP26 sequence of operations errorHIP27 operations last too longC5. SuperviseHIP28 supervisors have not observed the behavior of the workersHIP29 supervisor has not stopped the unsafe behavior of the workersHIP30 cessation of the unsafe behavior was too lateHIP31 supervisor has not supervised the whole processF1. Provide schemeHIP32 manager has not participated in the technical disclosureHIP22 incorrect technical disclosureHIP23 technical disclosure has not been conducted before installation—F2. FeedbackHIP33 workers have not reported to the managerHIP34 workers have misreportedHIP35 workers have reported too late—F3. Status and process informationHIP36 workers have not observed the status of the tower craneHIP37 workers have misjudged the status of the tower crane——F4. Provide schemeHIP38 supervisor has not participated in the technical disclosureHIP22 incorrect technical disclosureHIP23 technical disclosure has not been conducted before installation—F5. ObservationHIP39 supervisor has not observed the status of the tower craneHIP40 supervisor has misjudged the status of the tower crane—HIP31 supervisor has not supervised the whole processF6. ObservationHIP41 manager has not observed the status of tower craneHIP42 manager has misjudged the status of tower crane——F7. Feedback informationHIP43 supervisor has not reported information to the managerHIP44 supervisor provided wrong information to managerHIP45 supervisor provided feedback too late—(3) External Disturbance. Disturbances from the outside may influence components and interactions. The hazard analysis results are shown in Table 6.Table 6
External disturbance of installation.
Components and interactionsExternal disturbanceWorkerHIP46 The pressure of reward and punishment mechanismHIP47 short of safety education and trainingHIP48 schedule pressureC4. OperatingHIP49 auxiliary equipment failureTower crane and its componentsHIP50 bad weatherHIP51 complex operating environmentHIP52 lack of warning signsManagerHIP48 schedule pressureCommunicationHIP53 noiseHIP54 failure or interference of communication tools


## 4.3.2. System Hazard Analysis for Usage Phase

According to the accident reports and construction site investigations, the hazards associated with the usage phase (HUP) are analyzed using similar methods to the aforementioned approach. Table7 lists the component failure associated with the usage phase and analyzes the corresponding hazards. Table 8 shows the hazards caused by components interaction. The hazards caused by external disturbances are presented in Table 9.Table 7
Component failure of usage phase.
ComponentUnsafe stateLifting systemHUP1 defective foundation of tower craneHUP2 unstable integral structure of tower craneHUP3 nonconforming member of tower craneHUP4 deletion of tower crane memberHUP5 unstable fasteningsHUP6 tower crane over the service lifeHUP7 tower crane operating system malfunctionHUP8 materials too large or too heavyMonitoring system of tower craneHUP9 lack of monitoring systemHUP10 sensors failureSecurity system of tower craneHUP11 lack of security systemHUP12 security device failureSignalman/operator/riggerHUP13 lack of staffHUP14 without ability or qualificationHUP15 mental and physical distressHUP16 weak safety conceptHUP17 failure to wear protective equipment as requiredTable 8
Unsafe control action behaviors of usage phase (STPA).
InteractionsAction required but not providedUnsafe action providedIncorrect timing/orderTerminated too soon/applied too longC1. CheckHUP18 operator has not routinely checkedHUP19 illegal shut down or destroy the security system——C2. Limit runningSame as “component failure.”HUP20 security device setting error or faultHUP21 security device is not sensitive—C3. OperatingHUP22, the operator has not performed the operationHUP23 misoperation of operatorHUP24 Operator’s operation is not timelyHUP25 insufficient or excessive lifting height and swivel angleC4. OperatingHUP26 rigger has not checked the lifting systemHUP27 rigger illegally has bound or placed the lifting objectHUP28 rigger has not escaped to a safe place when lifting—C5. CommandHUP29 signalman has not provided commandHUP30 command errorHUP31 command not timely—C6. CommandHUP29 signalman has not provided commandHUP30 command errorHUP31 command not timely—F1. ObservationHUP32 signalman has not observed the status of tower craneHUP33 signalman has misjudged the status of tower crane——F2. MonitorHUP34 the tower crane monitoring system is not openHUP35 sensors are not sensitive——F3. FeedbackHUP36 monitoring data have not uploadedHUP37 data missing or errorHUP38 data is not uploaded timely—F4. State displayHUP39 monitoring data is not visualHUP40 wrong data have been displayed to the operator——F5. FeedbackHUP41 operator has not submitted feedback to the signalmanHUP42 feedback information missing or errorHUP43 feedback is not timely—F6. FeedbackHUP44 rigger has not sent a signalHUP45 signal sending errorHUP46 the signal is not sent in time—F7. WarningHUP47 lack of alarmHUP48 false alarm—HUP49 alarm ringing after trouble removalF8. ObservationHUP50 operator has not observed the status of tower craneHUP51 operator has misjudged the status of tower crane——F9. ObservationHUP52 rigger has not observed the status of tower craneHUP53 rigger has misjudged the status of tower crane——Table 9
External disturbance of usage phase.
Components and interactionsExternal disturbanceWorkerHUP54 the pressure of reward and punishment mechanismHUP55 short of safety education and trainingHUP56 schedule pressureLifting systemHUP57 bad weatherHUP58 complex operating environmentHUP59 lack of warning signsHUP60 multitower crane interactionCommand and feedbackHUP61 noiseHUP62 failure or interference of communication tools


## 4.3.3. Hazards of System Interactions during the Four Phases

The system interactions include the inputs and outputs, which differ for the different phases based on the state of the construction process of the tower cranes on-site. According to the IDEF0 map of the tower crane, the outputs of previous phases are the inputs of the next phase. The inputs and outputs of each phase are shown in Figure9. The hazards of system interactions mean the negative effects of the previous process. The arrows show the propagation path of hazards. According to the accident reports and research reports, some descriptions of the hazards associated with system interactions during the four phases can be found. Table 10 lists the hazards of system interactions, including hazards associated with the installation phase (HIP), hazards associated with the usage phase (HUP), hazards associated with the climbing phase (HCP), and hazards associated with the dismantling phase (HDP).Figure 9
System inputs and outputs of each phase.Table 10
Hazards of system interactions.
Current phasePrevious phaseHazards of system interactionA1A0HIP55 insufficiency of preparation for tower crane installationA2A1HUP63 unqualified installation of tower craneA2HUP64 without maintenanceA3HUP65 unqualified climbing of tower craneA3A2HCP55 overuse causes breakdownA4A2HDP55 overuse causes breakdownNote: A0-Preparation for installation, A1-Installation, A2-Usage, A3-Climbing, A4-Dismantling, as in Figure3.


## 5. Case Study

To verify and explain the practical significance of the preceding results, a case study was conducted based on random selection from the available 149 accident cases. The selected tower crane collapse incident resulted in 3 deaths and occurred on December 10, 2018, in Shanxi, China. The tower crane was lifting 1.7 t of cement when it leaned, and the mast was fractured. The main jib then fell, causing the death of the operator. The counter jib also fell and killed two workers. The on-site sceneries of the accident are shown in Figure10. After the accident, the Shanxi province government organized an expert group to conduct an investigation on the scene immediately. Then, the accident investigation report was disclosed on April 16, 2019. According to the accident investigation report, all the on-site hazards that caused this accident can be found in the hazard list in this research. The hazards and their propagations in this accident are shown in Figure 11.Figure 10
On-site sceneries of Shanxi tower crane accident.Figure 11
Hazards associate with the accident.Although this accident occurred during the usage phase, the hazards involved A0, A1, A2 phases. The inadequate preparation caused a hazard in installation (HIP55). Based on the presented research results, the hazards associated with the installation phase were propagated to the usage phase, resulting in hazards of the usage phase: unqualified installation of the tower crane (HUP63). With the use of the tower crane, the tower crane was gradually ageing. The tower crane was assembled on-site, which was mainly connected by bolts. After long-term work, the tower crane was rusty and the connections were loose. These aging phenomena affected the safety of the tower crane because there was no maintenance, which caused a hazard of usage (HIP64). This accident case suggests that the hazards associated with previous phases can transmit and adversely affect the safety of subsequent phases, which is consistent with the results of this research.


## 6. Discussion

To facilitate comparative analysis, repetitive or similar hazards in Section4 are merged. Considering the described scenarios, these hazards were classified into seven categories: Document (X1), Structure (X2), Equipment (X3), People (X4), Management (X5), External environment (X6), and Procedure (X7). Among them, Procedure (X7) is the result of hazard propagation between phases. The integration results are presented in Table 11.Table 11
Integration of hazards.
AspectInstallation/climbing/dismantling phaseUsage phaseDocument X1Lack of document HIP(11)—Scheme error HIP(12, 15)—Design error HIP(13)—The scheme has not been inspected as required HIP(14, 16)—Structure X2The defective foundation of tower crane HIP(1)The defective foundation of tower crane HUP(1)Unstable integral structure of tower crane HIP(2)Unstable integral structure of tower crane HUP(2)Nonconforming member of tower crane HIP(3)Nonconforming member of tower crane HUP(3)Deletion of tower crane member HIP(4)Deletion of tower crane member HUP(4)Rickety fastenings HIP(5)Rickety fastenings HUP(5)Tower crane over service life HUP(6)Materials too large or too heavy HUP(8)Equipment X3Auxiliary equipment failure HIP(49)Tower crane operating system malfunction HUP(7)Lack or failure of monitoring system HUP(9, 10, 34, 35, 36, 37, 38, 39, 40)Lack or failure of security system HUP(11, 12, 19, 20, 21, 47, 48, 49)People X4Personnel statusLack of staff HIP(6)Lack of staff HUP(13)Without the ability or qualification HIP(7)Without the ability or qualification HUP(14)Mental and physical distress HIP(8)Mental and physical distress HUP(15)Weak safety concept HIP(9)Weak safety concept HUP(16)Failure to wear protective equipment as required HIP(10)Failure to wear protective equipment as required HUP(17)Personnel behaviorCommand missing or error HIP(17, 18, 19, 20)Command missing or error HUP(29, 30, 31)Operational error or failure to conduct HIP(24, 25, 27)Operational error or failure to conduct HUP(18, 22, 23, 24, 25, 26, 27, 28)Failure to observe the status of tower crane as required HIP(36, 37, 39, 40, 41, 42)Failure to observe the status of tower crane as required HUP(32, 33, 50, 51, 52, 53)Failure to monitor worker behavior as required HIP(28, 29, 30, 31)—The sequence of operations error HIP(26)—CommunicationCommunication barriers between workers HIP(53, 54)Communication barriers between workers HUP(61,62)Failure to report as required HIP(33, 34, 35, 43, 44, 45)Failure to report as required HUP(41, 42, 43, 44, 45, 46)Management X5Failure to carry out the technical disclosure as required HIP(21, 22, 23, 32, 38)—Unreasonable reward and punishment mechanism HIP(46)Unreasonable reward and punishment mechanism HUP(54)Short of safety education and training HIP(47)Short of safety education and training HUP(55)Schedule pressure HIP(48)Schedule pressure HUP(56)External environment X6Severe weather HIP(50)Severe weather HUP(57)Complex operating environment HIP(51)Complex operating environment HUP(58)Lack of warning signs HIP(52)Lack of warning signs HUP(59)—Multitower crane interaction HUP(60)Procedure X7InstallationInsufficiency of preparation for tower crane installation HIP(55)—ClimbingOveruse cause breakdown HCP(55)—DismantlingOveruse cause breakdown HDP(55)—Usage—Unqualified installation or climbing of tower crane HUP(63, 65)Without maintenance HUP (64)Comparing the hazard analysis results for different phases, it was determined that although there are similar hazards in these phases, there are also many differences between their hazards. This is because although an object in different phases is the same, the work content and requirements are different. In addition, each phase is in different positions along the tower crane workflow, with different previous and subsequent phases. Thus, the hazards associated with system interactions during the phases are different. In order to avoid the accident caused by hazards propagation, the following precautionary measures can be taken:(i)
For the installation phase, the quality and integrity of the tower crane components should be checked carefully before installation. In addition, the auxiliary equipment and tools should be prepared in advance. After the installation, the acceptance inspection should also be performed by following strict standards.(ii)
During the usage phase, the overall quality and stability of the tower crane equipment should be examined before use to ensure that quality defects are not present. Regular maintenance should also be performed during use.(iii)
During the climbing and dismantling phases, the tower crane equipment should be repaired in advance to potentially detect the unstable structure of an aging tower crane, which may cause accidents. After climbing, the acceptance inspection should be conducted by adhering to strict standards.


## 7. Conclusion

This paper analyzes the whole process of the tower crane on the construction site. The hazards of each phase are identified through a systematic analysis method. The results show the differences and relations between the hazards of phases. The results can provide a reference for tower crane accident prevention. The main conclusions and contribution of this research are as follows:(a)
The research found that STAMP combined with IDEF0 is an effective method for hazard analysis during the different phases. IDEF0 can provide system input, output, and relevant elements for STAMP. STAMP can model the system based on components and processes. As an analysis tool derived from STAMP, STPA can identify the hazards of a system. Using these methods, the hazards of a tower crane can be identified and its propagation path can be found.(b)
Based on comparisons, it was determined that the personnel, equipment, and work content of the different phases of the tower crane service cycle are different. Moreover, the hazards that may occur in different phases are also different. Thus, this research provides a hazard list for different tower crane phases. This list can help to carry out formulate emergency measures according to the phase of the tower crane.(c)
Since various phases of tower cranes are interrelated, the adverse consequences associated with each phase can also affect the next phase. Therefore, the safety management of the subsequent phase is predicated on the construction results of the previous phase to achieve the desired safety level. The research analyzes the propagation path of hazards about the tower crane. Accordingly, it is crucial to improve the inspection and maintenance of the tower crane before and after each phase to reduce the possibility of accidents caused by the propagation of hazards between phases.Generally, in this investigation, the tower crane hazards that can arise at the construction site during different phases were analyzed. The hazard identification and classification procedures used in this investigation are qualitative and are primarily suitable for comparative and process analysis of different phases. In subsequent research, quantitative calculations will be investigated for further classification of these hazards.



---

*Source: 7026789-2021-07-08.xml*