Application of Systems Theoretic Process Analysis and Failure Modes and Effects Analysis to Process Reliability and Occupational Safety and Health in Construction Projects

Construction is an industry requiring high reliability and quality of processes. If the processes are not executed well, various workplace accidents and occupational diseases may occur. On a construction site, each working day involves different activities and processes. One of these activities is the application of a pure polymer concrete called epoxy resin over concrete floors, aiming to improve rigidity and thermo-mechanical properties, and enhance the resistance to chemical corrosion, wear, water damages, and freeze injuries [1, 2]. Epoxy resin may include natural fibers, synthetic fibers, and other reinforced particles [1]. The application of epoxy resin intends to provide a smooth, seamless, durable, and clean surface that is expected to last for many years. However, epoxy resin could cause several safety and health issues for the workers, including eye irritation, dermatitis, airway allergy, asthma, and even cancer [3]. Thus, the processes related to epoxy resin application should be well-planned, such as to maximize the process reliability and quality, ensure the intended technical benefits, and minimize the safety and health related risks.

To perform risk assessment in reliability engineering and occupational safety and health (OSH), many conventional techniques have been adopted in construction industry, namely, failure modes and effects analysis (FMEA), fault tree analysis (FTA), event tree analysis (ETA), hazard and operability (HAZOP) study, and root cause analysis. Towler and Sinnott [4] overviewed FMEA, FTA and HAZOP study. The FMEA, originally proposed for manufacturing industry, is a semi-quantitative approach that identifies the failure modes, their effects, as well as failure detectability of a system function, and assigns numerical scales to the failure modes, making it possible to take measures against the most probably failure modes [4]. Starting with an end event atop a tree structure, the FTA connects the possible incidents that may cause the upper-level incidents through AND or OR gates. Once the fault tree is completed, all direct and indirect incidents that may lead to the end event are identified, and the likelihood of the end event can be obtained by assigning probability values to each incident at each level [4]. The HAZOP study attempts to determine the risks regarding the process operability in processing industry, and mainly explores the potential hazards arising from the deviations from the intended design specifications [4]. Crawley [5] described the basic features of the ETA. Different from the FTA, the ETA begins with a selected initiating event, such as a failure, and depicts the possible outcomes of the event in a tree structure. The ETA can be a qualitative analysis like the FTA. If probabilities are assigned to the possible outcomes, the ETA can also become a quantitative method [5]. In addition, the root cause analysis supplements other techniques, where the root causes of an incident need to be identified and analyzed by techniques like 5 Whys and fishbone (Ishikawa) diagram [6].

Being a popular conventional method, the FMEA offers an inductive way to explore the potential failure modes, effects, and causes, and rank the failures by risk priority number (RPN). Prof. Leveson from Massachusetts Institute of Technology (MIT) provided an alternative to the conventional methods named systems theoretic process analysis (STPA). This alternative strategy regards the systems as dynamic control structures, and considers hazards and losses as the results of unsafe control actions (UCAs), not those of the chain of events [7, 8]. The STPA is based on the set of assumptions of the system-theoretic accident model and processes (STAMP), where the complexity of the systems is treated as a whole, with different components like software, human, organization, and safety culture [7, 8]. The STPA has several advantages over the conventional methods. In STAMP and STPA, reliability and safety are defined as dynamic control problems rather than failure prevention problems [7]. Thus, a hierarchical control structure is defined to reveal the control functions and feedbacks between the elements in the structure, and to make the different STPA results fully traceable. The most distinctive feature of the STPA lies in the identification of the hazard-inducing UCAs, and the analysis of the potential UCA causes, including software causes and human causes [7]. Leveson and Thomas [7] suggested that the STPA applies to early concept analysis, and can be refined to suit the system design, realizing the dynamic monitoring of the system improvement. The STPA is generally implemented in the following basic steps [7, 8]: (1) Drawing the system boundaries, and defining the basic goals; (2) Identifying the high-level losses, high-level hazards, and system-level constraints; (3) Building the hierarchical control structure; (4) Setting up the UCA table with causes and controller constraints; (5) Constructing a hierarchy of preventive and protective measures.

To find the risks to process reliability and worker OSH, this paper relies on STPA and FMEA to examine the processes related to the application of epoxy resin over concrete floors in construction industry. The STPA considers a hierarchical control structure, and the UCAs that can be traced to the high-level system losses and goals. Meanwhile, the FMEA, a popular conventional risk assessment technique, emphasizes individual functions, single component failures, failure modes, failure effects, and failure ranking. From different angles, STPA and FMEA provide diverse outcomes regarding system safety, which were compared and combined for an overall understanding about system safety. Instead of building a hybrid model coupling the two approaches, STPA and FMEA were utilized to understand the whole system from multiple perspectives.

The rest of the paper is organized as follows: Section 2 reviews the literature on STPA and FMEA; Section 3 gives the methodology for the application of STPA and FMEA; Section 4 illustrates the application of STPA and FMEA for epoxy application over concrete floors; Section 5 provides the conclusions.

Sections 3.1 and 3.2 explain the basic steps of STPA and FMEA, respectively. Our study essentially tries to identify and analyze the process reliability and OSH related issues of the epoxy resin application processes in construction industry.

3.1 STPA

3.1.1 Defining research purpose, system boundaries, and system goals

The first step of the STPA is to specify the research purpose. The purpose of a research could either be limited to process reliability, which includes different dimensions of the system, or be extended to the OSH.

Defining system boundaries means selecting a part of the whole system as the target of analysis. This step is critical for a feasible and effective analysis, because it is impossible to analyze the whole system all at once. Leveson and Thomas recommended to draw the system boundaries such that the selected part can be controlled by system designers [7, 8]. Once the boundaries are clearly defined, it is easy to identify the basic goals regarding the partial system.

3.1.2 Identifying the high-level losses, high-level hazards, and system-level constraints

According to Leveson and Thomas, losses may include a “loss of human life or human injury, property damage, environmental pollution, loss of mission, loss of reputation, loss or leak of sensitive information, or any other loss that is unacceptable to the stakeholders”; a hazard is a “system state or set of conditions that, together with a particular set of worst-case environmental conditions, will lead to a loss”; a system-level constraint specifies “system conditions or behaviors that need to be satisfied to prevent hazards and losses” [7, 8].

Upon defining the boundaries, basic goals, and high-level losses of a system, the researcher can recognize the high-level system hazards, and map them to high-level system losses. The mapping does not have to be one-to-one. Each system-level hazard can be mapped to multiple high-level system losses [7, 8]. It is also possible to define sub-hazards of each hazard. Of course, the sub-hazard definition is optional [7, 8]. The high-level system hazards can be further translated into system-level constraints as enforcing conditions. There are links between these constraints and the corresponding high-level system hazards [7, 8].

3.1.3 Setting up hierarchical control structure

A physical control structure refers to a system structure consisting of the part of the system under control (controlled process), sensors, controllers, actuators, control actions, and feedback loops. Specifically, a controller is made up of a control algorithm responsible for decision-making, and a process model representing the controller’s belief system [7, 8].

In the STPA, the hierarchical control structure is not a physical control structure, but a system model with control actions and feedbacks, which mainly include the controlled process, and a hierarchy of controllers. The hierarchical control structure of the STPA is shown in Figure 1 [7], where the downward arrows stand for control actions, while the upward stand for feedbacks. It is advisable to define the control actions based on the responsibilities of the controllers, and derive the feedbacks from the control actions and the responsibilities of the controllers [7, 8].

1.png

Figure 1. A generic hierarchical control structure [7]

Note that Figure 1 only represents one generic hierarchical control structure, in which Controller 1 has the highest level of authority, and Controllers 2 and 3 have lower but the same level of authority. The horizontal arrows between Controllers 2 and 3 do not represent control actions or feedbacks, but the communication between the two controllers.

The hierarchical control structure can also be refined and detailed, in view of the different subsystems of the partial system selected for the study [7, 8].

3.1.4 Building the UCA table with causes

Leveson and Thomas defined an UCA as “a control action that, in a particular context and worst-case environment, will lead to a hazard” [7, 8], and enumerated the generation paths of UCAs [7, 8]:

-Not providing the control action leads to a hazard.

-Providing the control action leads to a hazard.

-A potentially safe control action is provided too early, too late, or in the wrong order.

-The control action lasts too long or is stopped too soon.

Note that the third and fourth paths are related to the timing and duration of the control action, while the first two paths are related to not providing a control action at all, or providing a control action that leads to a hazard. Table 1 provides a representative UCA table with UCAs to be written under each category, causes for these UCAs, and controller constraints. Some UCA tables only display the UCAs under each category. The causes or controller constraints are provided separately.

Table 1. A representative UCA table [54]

A separate UCA table like Table 1 can be prepared for every control function. In such a table, several UCAs can be defined for each category, and be linked to high-level system hazards. The defined UCAs should be translated into controller constraints, which are the required controller behaviors to prevent the UCAs [7, 8]. The causes (loss scenarios) of the UCAs should also be identified, and provided in the table clearly. The two main causes, namely, unsafe controller behavior, and inadequate feedback and other inputs, should be detailed for each UCA [7, 8]. During the cause identification, the physical control structure including sensors and actuators can also be considered [7, 8]. Before preparing the UCA tables, it is also possible to classify controllers as technical controllers or human controllers [7].

3.1.5 Constructing the hierarchy of preventive and protective measures

The hierarchy of preventive and protective measures, a term generally used for the OSH, can be extended to general system reliability, including process reliability and OSH.

Table 2 lists the four basic hierarchy levels with examples in the second column. The higher the hierarchy level, the better the effectiveness of the measure, and the fewer the total cost. Accordingly, hazard elimination is the most effective measure with the minimum total cost, while damage reduction is the least effective one with the maximum total cost.

Table 2. Hierarchy of preventive and protective measures [8]

To briefly summarize the STPA, Figure 2 outlines the connections between STPA outputs. The hierarchical control structure is not displayed, for it is related to each output, as suggested by Leveson and Thomas [7].

2.png

Figure 2. Connections between STPA outputs [7]

It can be clearly seen that, each STPA output can be traced to another output. Many accidents may occur due to the ineffective and ambiguous definition of responsibilities. Hence, it is highly recommended to define the responsibilities, although this is not a must-to-do task.

3.2 FMEA

The FMEA was developed in the 1960s by the NASA. Since then, the strategy has gained popularity in risk assessment of aerospace, nuclear power plants, and automotive industry. There are several types of FMEA, including system FMEA, function FMEA, design FMEA, and process FMEA [28].

As an inductive method, the FMEA focuses on identifying the modes, effects, and causes of potential failures, considering their RPN values [28]. Failure mode is a very basic term in the FMEA. It refers to a description of the fault, i.e., the way to observe the fault, so that the failures can be apparent and observable to indicate a problem in the system [55]. Failure mode identification is a time-consuming yet crucial step of the FMEA [28].

The representative FMEA table is given as Table 3, where F is the selected function of the target system; PFM is the potential failure mode; PFE is the potential failure effects, namely, minor damage, and total system breakdown; PFC is the potential failure causes, technical or organizational; RA is the recommended actions, whose application underpins the evaluation of system improvement; O is occurrence, i.e., the probability or frequency of a failure mode under its corresponding failure cause; S is severity, i.e. the degree of the potential failure effect [28]; D is detection, which depends on the probability of detecting a failure cause easily before it leads to a failure [28].

Table 3. Representative FMEA table [28]

The values of O, S, and D generally fall in [1, 10]. The RPN can be calculated by:

RPN $=0 \times S \times D$      (1)

In the extreme cases, an RPN value can be 1 × 1 × 1 = 1 or 10 × 10 × 10 = 1,000. The mean RPN can be calculated as 5 × 5 × 5 =125. Once the FMEA table is prepared, it is necessary to rank the potential failure modes, as well as the corresponding effects and causes, by the RPN. The failure modes with the values O>8, S>8, \text { and } D>8 should be observed separately [28]. After implementing the recommended actions, the new values can be assigned to O, S, and D, and the revised RPN values can be calculated to compare the updated RPN values with the former values. The responsibility assignments and target completion dates can be added as two columns to the representative FMEA table in Table 3 [28].                                                                                                   

As a specific type of the FMEA, system FMEA covers five steps [28]: (1) Defining the target system structure, identifying the subsystems and components, and building the hierarchy of system elements; (2) Defining functions and building function structures by function trees and several other approaches; (3) Identifying potential failure modes, effects, and causes for each system element; (4) Performing risk assessment, including assigning values to O, S, and D, (5) Prioritizing and evaluating risks as explained for the general FMEA.