Comparison of STPA and Bow-tie Method Outcomes in the Development and Testing of an Automated Water Quality Management System

Abstract

The technology available to water quality management applications needs to be advanced due to greater use of automation to increase ease of operation, support remote operation and reduce risks due to operator error. In this case study, a comparison is made between System-Theoretic Process Analysis (STPA) and the Bow-tie methodology for identifying process hazards and countermeasures which can be used to guide the design and testing of an automated water quality management system (AWQMS). For this study, the application considered is a small hydroponics installation where water quality management has been automated. The STPA methodology uses a system theory-based approach to identify hazards, which include operational failures, human errors, and component interactions. The Bow-tie diagram focuses on individual barriers for a given threat which can prevent the realisation of a hazardous event and unwanted consequences. Thus, the 22 preventative barriers and seven recovery barriers identified through the Bow-tie diagram provide the design process with broad requirements for reducing the risks of user error as well as the ones associated with ongoing operations. The STPA method identified many Causal Factors (CF) generated from the Unsafe Control Actions after considering all the feasible scenarios. For design input, the STPA provided the design process with 204 specific CFs which were used to create 94 countermeasures to be included in software and hardware design as well as user information material. Both methods identified useful measures to control the hazards associated with human interaction with the AWQMS. However, the measures differed in the level of detail and the involvement in the evolution in the final system losses. In this study, the STPA process was able to identify several hazards which did not visibly relate to the Bow-tie barriers. However, the Bow-tie diagram illustrates a distinction between preventative and recovery hazard controls.

A Systems Analysis Approach to Identifying Critical Success Factors in Drinking Water Source Protection Programs

“…Following the identification CF for the UCAs, to provide information on how to reduce risk associated with UCAs the next step is to identify suitable countermeasures for each CF. The countermeasures are actions required to either prevent the causal scenario from occurring or reduce the impacts of the relevant CF for the scenarios considered [34]. It's these countermeasures which are included in the program requirements to reduce the risk of unsafe or out of spec water being produced by the catchment.…”

“…For the formal STPA method the identification of causal factors is normally the last step but, in this study, countermeasures were considered for each CF. The process of identifying countermeasures consists of reviewing each causal factor and identifying requirements to either prevent the CFs from occurring or reduce the potential for causal factors to result in a UCA [34]. A review of the CFs showed that more than one viable countermeasure can be applied to many CFs.…”

System-Theoretic Process Analysis (STPA) for Hazard Analysis in Complex Systems: The Case of “Demand-Side Management in a Smart Grid”

“…Following the CFs identification, and in order to provide information on how to reduce the CF-related risk associated with UCAs, the next step is to identify appropriate "safeguards" for each CF. The safeguards are actions required to either prevent the causal scenario from occurring or reduce the impact on the scenarios perceived by the relevant CF [34].…”

A Systems Analysis Approach to Identifying Critical Success Factors in Drinking Water Source Protection Programs

“…For the formal STPA method, the identification of causal factors is normally the last step, but, in this study, countermeasures were considered for each CF. The process of identifying countermeasures consists of reviewing each causal factor and identifying requirements to either prevent the CFs from occurring or reduce the potential for causal factors to result in a UCA [32]. The initial investigation of the CFs showed that more than one viable countermeasure can be applied to many CFs.…”

“…Following the identification CF for the UCAs, to provide information on how to reduce risk associated with UCAs, the next step is to identify suitable countermeasures for each CF. The countermeasures are actions required to either prevent the causal scenario from occurring or to reduce the impacts of the relevant CF for the scenarios considered [32]. It is these countermeasures that are included in the program requirements to reduce the risk of unsafe or out of spec water being produced by the catchment.…”