Comparison of STPA and Bow-tie Method Outcomes in the Development and Testing of an Automated Water Quality Management System

摘要

The technology available to water quality management applications needs to be advanced due to greater use of automation to increase ease of operation, support remote operation and reduce risks due to operator error. In this case study, a comparison is made between System-Theoretic Process Analysis (STPA) and the Bow-tie methodology for identifying process hazards and countermeasures which can be used to guide the design and testing of an automated water quality management system (AWQMS). For this study, the application considered is a small hydroponics installation where water quality management has been automated. The STPA methodology uses a system theory-based approach to identify hazards, which include operational failures, human errors, and component interactions. The Bow-tie diagram focuses on individual barriers for a given threat which can prevent the realisation of a hazardous event and unwanted consequences. Thus, the 22 preventative barriers and seven recovery barriers identified through the Bow-tie diagram provide the design process with broad requirements for reducing the risks of user error as well as the ones associated with ongoing operations. The STPA method identified many Causal Factors (CF) generated from the Unsafe Control Actions after considering all the feasible scenarios. For design input, the STPA provided the design process with 204 specific CFs which were used to create 94 countermeasures to be included in software and hardware design as well as user information material. Both methods identified useful measures to control the hazards associated with human interaction with the AWQMS. However, the measures differed in the level of detail and the involvement in the evolution in the final system losses. In this study, the STPA process was able to identify several hazards which did not visibly relate to the Bow-tie barriers. However, the Bow-tie diagram illustrates a distinction between preventative and recovery hazard controls.