A Novel Method for Safety Analysis of Cyber-Physical Systems—Application to a Ship Exhaust Gas Scrubber System

: Cyber-Physical Systems (CPSs) represent a systems category developed and promoted in the maritime industry to automate functions and system operations. In this study, a novel Combinatorial Approach for Safety Analysis is presented, which addresses the traditional safety methods’ limitations by integrating System Theoretic Process Analysis (STPA), Events Sequence Identiﬁcation (ETI) and Fault Tree Analysis (FTA). The developed method results in the development of a detailed Fault Tree that captures the e ﬀ ects of both the physical components / subsystems and the software functions’ failures. The quantitative step of the method employs the components’ failure rates to calculate the top event failure rate along with importance metrics for identifying the most critical components / functions. This method is implemented for an exhaust gas open loop scrubber system safety analysis to estimate its failure rate and identify critical failures considering the baseline system conﬁguration as well as various alternatives with advanced functions for monitoring and diagnostics. The results demonstrate that conﬁgurations with SOx sensor continuous monitoring or scrubber unit failure diagnosis / prognosis lead to signiﬁcantly lower failure rate. Based on the analysis results, the advantages / disadvantages of the novel method are also discussed. This study also provides insights for better safety analysis of the CPSs.

Introduction
Cyber-Physical Systems (CPSs) represent a class of systems advancing in a number of application areas including the maritime industry [1]. The CPSs are expected to increase the productivity and safety levels by removing, substituting [2] and/or supporting the operator in the decision-making process, thus reducing the number of human errors leading to accidents [3]. Typical examples of the CPSs include the Industrial and automation Control Systems (ICS), robots, and Cyber-Physical Systems of Systems [4]. Examples of marine CPSs include the Power Management System, Propulsion engines, Heat Ventilation Air Conditioning systems and autonomous ships whose functions are supported by the CPSs [1].
Whilst CPSs are expected to bring significant benefits, they are considered to be complex, which implies that they may behave unpredictably [4][5][6]. Their complexity can be attributed to a number of the potential to identify the harmful effects of successful cyberattacks on CPSs [44]. However, the STPA needs enhancement with the inclusion of a quantitative step to support the decision-making process.
On the other hand, FTA is effective for capturing the dependencies between components and analysing the physical failures [45]. Potentially, FTA could be substituted using other methods; however, FTA is rather simple to be applied. In addition, the ETA exhibits strength in identifying the event sequences of the investigated system and identifying multi-point failures [46]. This is important in CPSs, as CPSs have the ability to reconfigure responding to specific fault or control commands. Potentially, Event Sequence Diagrams as reported in [47] could be used, but the ETA based method was selected herein, due to its formalism simplicity.
Hence, integrating these three methods and a quantitative approach to form a novel method is expected to improve the analysis rigour, through increasing the number of identified complex scenarios, capturing the dependencies between different component failures, more effectively capturing the software related failures and identifying the temporal relationship between different events in the system. In addition, it allows for the quantification of appropriate safety and criticality/importance analysis metrics, thus facilitating the generation of safety recommendations and enhancement processes.
The preceding considerations led to the development of the proposed method, known as "Combinatorial Approach for Safety Analysis" (CASA), which consists of ten steps. Whilst some of the method steps were presented in [48], they are elaborated and enhanced further in this study by including the quantitative part description and delineating the method steps. The method phases and steps are provided in Figure 1, whereas the steps' characteristics are summarised in Table 1. On the other hand, FTA is effective for capturing the dependencies between components and analysing the physical failures [45]. Potentially, FTA could be substituted using other methods; however, FTA is rather simple to be applied. In addition, the ETA exhibits strength in identifying the event sequences of the investigated system and identifying multi-point failures [46]. This is important in CPSs, as CPSs have the ability to reconfigure responding to specific fault or control commands. Potentially, Event Sequence Diagrams as reported in [47] could be used, but the ETA based method was selected herein, due to its formalism simplicity.
Hence, integrating these three methods and a quantitative approach to form a novel method is expected to improve the analysis rigour, through increasing the number of identified complex scenarios, capturing the dependencies between different component failures, more effectively capturing the software related failures and identifying the temporal relationship between different events in the system. In addition, it allows for the quantification of appropriate safety and criticality/importance analysis metrics, thus facilitating the generation of safety recommendations and enhancement processes.
The preceding considerations led to the development of the proposed method, known as "Combinatorial Approach for Safety Analysis" (CASA), which consists of ten steps. Whilst some of the method steps were presented in [48], they are elaborated and enhanced further in this study by including the quantitative part description and delineating the method steps. The method phases and steps are provided in Figure 1, whereas the steps' characteristics are summarised in Table 1.

Steps
Step Description Employed Technique Justification Required Resources Output Output to Steps

Initiation
Step 0: Preparation Accumulating system data: accidents investigations reports, previous hazards analyses, components failure rates, system simulations, etc.
Publications and accident investigation reports analysis Good understanding of system problems required for analysis Access to data Good understanding of the system All other steps

STPA
Step The first four steps (steps 1-4) are similar to the steps of the STPA method. In step 5, the ESI method is employed to develop the "Event Trees" by analysing the system and using the STPA results, thus obtaining insight into the system temporal behaviour and potential complex failures. Step 6 employs the developed "Event Trees" and synthesizes/transforms them into one Fault Tree. In step 7, the generated Fault Tree is populated with the results from the STPA. In step 8, this Fault Tree is further refined to address inconsistencies due to the integration of STPA and ESI results.
Step 9 expands on some physical failures identified by STPA (nodes of step 8 Fault Tree) by using the FTA to develop the final Fault Tree.
Step 10 includes the quantitative analysis that is needed for calculating the top event failure rate for the investigated system, as well as the importance analysis that provides metrics for the critical system components and failures. The CASA results are used to derive the safety recommendations for the system safety enhancement. The method steps have to be applied in a specified sequence; otherwise, the results will differentiate from CASA results.

Preparatory Step (Step 0)
This step involves the activities required to gather the information about the system and system hazards. This includes, if available, the system simulations using detailed models depicting the system behaviour and responses, previous hazard identification analyses, the study of the system operation and maintenance manuals, development and analysis of system experts' questionnaires and the analysis of previous accident investigation reports, as well as getting access to the failure rates databases for the system components.

STPA (Steps 1-4)
Step 1 (Figure 1) aims at accurately defining the targets of the whole analysis. The process starts with the accidents' identification for the investigated system. Based on the identified accidents, the relevant hazards are subsequently identified. Hazards in the STPA framework are understood as 'the system states or the set of conditions that together with a worst-case set of environmental conditions will lead to an accident' [49]. The hazard identification can be implemented either with the assistance of a hazard review by an individual or an expert teams' brainstorming. According to the STPA framework, only the hazards related to the accident under consideration are taken into account, which can be further broken down in sub-hazards [49]. Based on these hazards and sub-hazards, the safety constraints and requirements of the system design are identified. The list of existing control measures is used to augment the ESI implementation as explained in the next step.
Step 2 ( Figure 1) focuses on the development of the investigated system hierarchical control structure, which is one of the differentiating points of the STPA analysis compared with the other methods [49]. As shown in Figure 2, the process commences with a high-level system abstraction and proceeds to a more detailed level. The initial control structure consists of the high-level controller, the human operator and the controlled process with its basic control, feedback and communication links. A more detailed description incorporates the controllers' hierarchies. The final refined control structure includes the information on responsibilities of each controller, the process model with the process variables and their ranges, the control actions, the actuators' behaviour, the information provided by sensors and the interactions between the controllers. The development of a hierarchical control structure is influenced by the system identifying accidents and hazards. The analysis output from this step is expected to be in the form shown on the right-hand side of Figure 2. The previous steps are the STPA initial steps. The actual hazard identification process starts in step 3 as shown in Figure 1, having as an objective to identify the Unsafe Control Actions (UCAs) that lead to hazards. The possible UCAs are categorised into the following four types [50]:


Type 1: Not providing the control action that leads to a hazard.  Type 2: Providing a control action that leads to a hazard.  Type 3: A control action is untimely provided (too late, too early or out of sequence).  Type 4: A control action duration is not adequate (stopped too soon or applied for too long).
In addition, there is also the following UCA type: "a safe control action is provided but not followed"; however, this is considered equivalent to the Type 1 UCAs [50]. This type of failure mode is analysed during the identification of causal factors in the next paragraph.
For each control action, the potential process variables values are considered, and it is investigated whether the control action will lead to a hazard/sub hazard or not. Similarly, with the system hazard identification, safety constraints can be derived from the UCAs, aiding the identification of appropriate hazard control measures.
Step 4 includes the causal factors' identification and forms an essential step for the STPA ( Figure  1) as the causal factors explain why an UCA can occur. In this study, the process was augmented by the usage of a modified tree structure proposed in Blandine [51], which was enhanced by a list of causal factors from [52], and it is shown in Figure 3. This allows for the easy transition from the STPA results into a Fault Tree structure, as in this way the causal factors can be connected to the UCAs by using the OR gate of a Fault Tree. The UCAs are considered undeveloped events, and their causal factors are connected to these UCAs using OR gates. Practically, this step is very similar to the checklist procedures. The list of typical generic causal factors is given in Appendix A. Such a provision of this checklist is beneficial, as it supports the repeatability and objectiveness of the STPA results. In this study, the term "scenario" is not used according to STPA framework; instead, scenario is considered in a much wider context, as, for example, a generic hazardous scenario. The previous steps are the STPA initial steps. The actual hazard identification process starts in step 3 as shown in Figure 1, having as an objective to identify the Unsafe Control Actions (UCAs) that lead to hazards. The possible UCAs are categorised into the following four types [49]: • Type 1: Not providing the control action that leads to a hazard. • Type 2: Providing a control action that leads to a hazard. • Type 3: A control action is untimely provided (too late, too early or out of sequence). • Type 4: A control action duration is not adequate (stopped too soon or applied for too long).
In addition, there is also the following UCA type: "a safe control action is provided but not followed"; however, this is considered equivalent to the Type 1 UCAs [49]. This type of failure mode is analysed during the identification of causal factors in the next paragraph.
For each control action, the potential process variables values are considered, and it is investigated whether the control action will lead to a hazard/sub hazard or not. Similarly, with the system hazard identification, safety constraints can be derived from the UCAs, aiding the identification of appropriate hazard control measures.
Step 4 includes the causal factors' identification and forms an essential step for the STPA (Figure 1) as the causal factors explain why an UCA can occur. In this study, the process was augmented by the usage of a modified tree structure proposed in Blandine [50], which was enhanced by a list of causal factors from [51], and it is shown in Figure 3. This allows for the easy transition from the STPA results into a Fault Tree structure, as in this way the causal factors can be connected to the UCAs by using the OR gate of a Fault Tree. The UCAs are considered undeveloped events, and their causal factors are connected to these UCAs using OR gates. Practically, this step is very similar to the checklist procedures. The list of typical generic causal factors is given in Appendix A. Such a provision of this checklist is beneficial, as it supports the repeatability and objectiveness of the STPA results. In this study, the term "scenario" is not used according to STPA framework; instead, scenario is considered in a much wider context, as, for example, a generic hazardous scenario.

ESI (Step 5)
The Events Sequence Identification (ESI) commences after the STPA results have been derived (Figure 1Error! Reference source not found.). The methodology employed in the ESI is very similar o Event Tree Analysis (ETA) [46] and all the tools relevant to ETA are also used herein to ensure the identified scenarios completeness and to capture potential sequences of events in the investigated system. Each sub hazard/hazard is used as an initiating event and the propagation of sub hazards/hazards into a hazard or an accident is investigated by considering: (a) the protective barriers designed to mitigate the sub hazards/hazards consequences; (b) the relevant system states; and (c) the identified UCAs from the previous step. The 'Event Trees' are considered fully developed when all the outcomes end at either the safe condition, another sub hazard/hazard, or the investigated hazard/accident. It was assumed that the events' duration has no effect on the identified event sequences, but it affects the probability of each selected branch and consequently the specific states' calculation (described in Section 2.6).
Despite the similarities between the ESI and the ETA, the following differences exist (justifying the method name): (a) the ESI analysis is completely internal to the system compared to the ETA, which can be external to the investigated system; (b) the ESI does not incorporate the calculation of the protective barriers' failure probability, and it is implemented only qualitatively; (c) the ESI outcome is not necessarily an accident but can be a hazard at the system level (the ESI corresponds to the left side of the classical Bow Tie, in comparison to the ETA that corresponds to the part on the right of the bow tie); (d) hence, no estimation of risk is provided by the ESI; (e) the ESI along with the STPA results are used to develop a Fault Tree as described in the next section. It must be noted that the introduction of the ESI term was followed for distinguishing between the two methods (ESI and ETA).

STPA and ESI Results' Integration (Steps 6-8)
Since not all sub hazards/hazards lead directly to the system hazard/accident and some interactions exist between the various sub hazards/hazards, the developed "Event Trees" are restructured in step 6 of the proposed method (Figure 1), so that the investigated sub

ESI (Step 5)
The Events Sequence Identification (ESI) commences after the STPA results have been derived ( Figure 1). The methodology employed in the ESI is very similar to Event Tree Analysis (ETA) [46] and all the tools relevant to ETA are also used herein to ensure the identified scenarios completeness and to capture potential sequences of events in the investigated system. Each sub hazard/hazard is used as an initiating event and the propagation of sub hazards/hazards into a hazard or an accident is investigated by considering: (a) the protective barriers designed to mitigate the sub hazards/hazards consequences; (b) the relevant system states; and (c) the identified UCAs from the previous step. The 'Event Trees' are considered fully developed when all the outcomes end at either the safe condition, another sub hazard/hazard, or the investigated hazard/accident. It was assumed that the events' duration has no effect on the identified event sequences, but it affects the probability of each selected branch and consequently the specific states' calculation (described in Section 2.6).
Despite the similarities between the ESI and the ETA, the following differences exist (justifying the method name): (a) the ESI analysis is completely internal to the system compared to the ETA, which can be external to the investigated system; (b) the ESI does not incorporate the calculation of the protective barriers' failure probability, and it is implemented only qualitatively; (c) the ESI outcome is not necessarily an accident but can be a hazard at the system level (the ESI corresponds to the left side of the classical Bow Tie, in comparison to the ETA that corresponds to the part on the right of the bow tie); (d) hence, no estimation of risk is provided by the ESI; (e) the ESI along with the STPA results are used to develop a Fault Tree as described in the next section. It must be noted that the introduction of the ESI term was followed for distinguishing between the two methods (ESI and ETA).

STPA and ESI Results' Integration (Steps 6-8)
Since not all sub hazards/hazards lead directly to the system hazard/accident and some interactions exist between the various sub hazards/hazards, the developed "Event Trees" are restructured in step 6 of the proposed method (Figure 1), so that the investigated sub hazards/hazards' propagation is identified. Subsequently, the ESIs are transformed into a Fault Tree by connecting the events in a Safety 2020, 6, 26 9 of 31 hazardous sequence using AND gates as shown in Figure 4 using exemplificatory "Event Trees". The different scenarios resulting in the same hazard/accident are connected using the OR gates ( Figure 4). The paths from a sub hazard/hazard to another sub hazard/hazard are connected using OR gates ( Figure 4). As a result, a preliminary Fault Tree is developed, which is enriched and refined in the next steps of the proposed method. This is an important difference between the proposed approach for employing the ESIs' "ETs" to develop an FT and the typical approach, according to which FTA is used to model the causes identified in ETA. In this way, accident becomes a top event in the Fault Tree, which is rather uncommon. However, accidents/hazards were used as the Fault Tree top events or nodes in BBN in the pertinent literature, as reported in [32,52]. ISO 31010 allows for using a broader outcome of a specific failure as the top event [46]. hazards/hazards' propagation is identified. Subsequently, the ESIs are transformed into a Fault Tree by connecting the events in a hazardous sequence using AND gates as shown in Figure 4 Error! eference source not found.using exemplificatory "Event Trees". The different scenarios resulting in the same hazard/accident are connected using the OR gates ( Figure 4). The paths from a sub hazard/hazard to another sub hazard/hazard are connected using OR gates ( Figure 4). As a result, a preliminary Fault Tree is developed, which is enriched and refined in the next steps of the proposed method. This is an important difference between the proposed approach for employing the ESIs' "ETs" to develop an FT and the typical approach, according to which FTA is used to model the causes identified in ETA. In this way, accident becomes a top event in the Fault Tree, which is rather uncommon. However, accidents/hazards were used as the Fault Tree top events or nodes in BBN in the pertinent literature, as reported in [32,53]. ISO 31010 allows for using a broader outcome of a specific failure as the top event [46]. In step 7 (Figure 1), the preliminary Fault Tree is enriched by using the derived STPA results. This is implemented in two stages. First, the UCAs are related to the branches in the ESI "Event Trees" (and, consequently, the events of the preliminary Fault Tree). These UCAs are connected to the event In step 7 (Figure 1), the preliminary Fault Tree is enriched by using the derived STPA results. This is implemented in two stages. First, the UCAs are related to the branches in the ESI "Event Trees" (and, consequently, the events of the preliminary Fault Tree). These UCAs are connected to the event in a Fault Tree using an OR gate. Subsequently, for each UCA, the causal factors are developed under the UCAs with an OR gate. An example for the implementation of this step is shown in Figure 5 using exemplificatory UCAs for accident (scenario 2). in a Fault Tree using an OR gate. Subsequently, for each UCA, the causal factors are developed under the UCAs with an OR gate. An example for the implementation of this step is shown in Figure 5 using exemplificatory UCAs for accident (scenario 2). The Fault Tree developed in step 7 is not accomplished by populating the Fault Tree with the UCAs and the causal factors as inconsistencies may arise due to the fact that the results from the two different methods are merged into one structure. Therefore, the developed Fault Tree further refinement takes place in Step 8 ( Figure 1). This step also takes into account the system architecture and the common causal factors. The conditions and applied actions for the FT refinement are described in Table 2. These conditions were identified from method application to other systems, as it is reported for example in [48]. An applied refinement example is provided in Figure 6, where UCA 1 is split into the UCA 1 representing its causal factors and the system state (in which UCA 1 occurs); UCA2 is split into UCA 2 representing its causal factors and the system fault (with which it occurs), whereas the common causal factor for UCA 3 and UCA 4 is 'upgraded' to a higher level in Fault Tree (the same level as other UCAs). The refinement is required to ensure that the OR and AND gates' calculation involves non repeated and independent events. Special refinement is applied when a UCA is connected by using OR gates or AND gates. In the former case (UCA connected using OR gates), the common causal factor is propagated to the UCA level, whereas, in the latter case (UCA connected using AND gates), the common causal factor is propagated even to a higher level in the Fault Tree moving from the basic events to the top event. This special refinement for the integration of the methods is an important novel aspect of this method. The Fault Tree developed in step 7 is not accomplished by populating the Fault Tree with the UCAs and the causal factors as inconsistencies may arise due to the fact that the results from the two different methods are merged into one structure. Therefore, the developed Fault Tree further refinement takes place in Step 8 ( Figure 1). This step also takes into account the system architecture and the common causal factors. The conditions and applied actions for the FT refinement are described in Table 2. These conditions were identified from method application to other systems, as it is reported for example in [48]. An applied refinement example is provided in Figure 6, where UCA 1 is split into the UCA 1 representing its causal factors and the system state (in which UCA 1 occurs); UCA2 is split into UCA 2 representing its causal factors and the system fault (with which it occurs), whereas the common causal factor for UCA 3 and UCA 4 is 'upgraded' to a higher level in Fault Tree (the same level as other UCAs). The refinement is required to ensure that the OR and AND gates' calculation involves non repeated and independent events. Special refinement is applied when a UCA is connected by using OR gates or AND gates. In the former case (UCA connected using OR gates), the common causal factor is propagated to the UCA level, whereas, in the latter case (UCA connected using AND gates), the common causal factor is propagated even to a higher level in the Fault Tree moving from the basic events to the top event. This special refinement for the integration of the methods is an important novel aspect of this method.

FTA (Step 9)
According to the STPA results, some of the hazardous situations are related to a combination of a control action and a system state, which in turn is caused by a physical failure. For the cases where this system state is attributed to a number of a subsystem physical components failures, FTA is employed to identify these components' failures ( Figure 1). The top event in the FTA is taken as the system state from the relevant UCA (a high level physical failure) and the causes are identified by: (a) breaking down the subsystem into components; (b) assessing which component failure will lead to the top event of the local FTA, and; (c) considering the functional dependencies between the identified components. The identification of components failures leading to the top failure can be supported by considering the conditions under which the safety functions in specific components are activated. This step requires much more detailed information about the investigated subsystem and its components dependencies, as well as the subsystem components' specific failures. The different components' failures are connected using OR gates. If the same components are connected in parallel, their failures are connected to other failures using AND gates. If some of the components have identical standby components, then these components failures are connected using OR gates, but special treatment is provided for estimating its probability of failure as described in the next section. The developed Fault Tree in this step is connected to the previous steps Fault Tree (as shown in Figure 6), resulting in a more detailed Fault Tree, linked to the investigated system components' failures, which can be used for the purposes of the Quantitative Analysis (QA) described in the next section.

Quantitative Analysis (Step 10)
The purpose of the QA is to support the decision-making process and the safer systems design [22,53]. The approach followed in this study is probabilistic based and the QA output includes the calculation of top event failure rate λ TE . The λ TE due to its linear connection to the frequency of events, which is used as a risk metric [54]. The top event failure rate is considered to be a more representative metric, as it corresponds to the investigated event and, therefore, historical data for its frequency can be retrieved through the number of the reported accidents. In this respect, ambiguous and computationally expensive calculations of the top event frequency (for example, by employing Markov chains) can be avoided. In addition, this step includes a importance analysis to identify the system critical failures.
The following assumptions were made for the QA purposes: • The basic events in the Fault Tree can be grouped to three categories: (a) the operating system components failures (p oc i ); (b) the safety systems failures (p ss i ) (it must be noted that the safety systems function is to control and handle the operating system components failures); and (c) specific system states, for example overloading of the generation sets (p sss i ).

•
The considered systems components' failure rates follow an Exponential failure probability distribution.

•
The inspection of the system components is performed according to the manufacturers' guidelines and can effectively detect the system components' condition including their failures and degradation level.

•
The implemented maintenance practice for the systems components is according to the manufacture guidelines and restores the system components to the best possible condition (repairing their detected faults and mitigating their degradation). The maintenance intervals of the system components are considered to be timely as proposed by the respective manufacturers.

•
The duration of testing and duration of repairs of faults detected during testing have negligible impact on the availability of the standby components or the components implementing safety functions.

•
The top event probability differential can be adequately approximated by employing the respective difference considering a relatively small time interval, which was taken as 1 h.
The failure rate for the top event λ TE is estimated using the following approximation based on the failure rate definition [55]: λ TE = P[ f ailure occurs between t and t + dt no prior f ailure] where P TE denotes the top event probability, which is derived from the Fault Tree (from Step 9) (an example is shown in Figure 6) by applying the specific calculation rules for the Fault Tree gates. The following equation is employed to calculate the probability outcome of an OR gate with z input events (E z ) [56]: The following equation is employed to calculate the probability outcome of an AND gate with z input events (E z ) [56]: The equations used for the calculation of the basic events probability P E j (for the basic event E j of the Fault Tree), which were derived considering the event type and the assumptions presented previously, are provided below. The required input parameters include the number of the redundant components, the components' maintenance and testing intervals (T i ), the maintenance repair rates (µ i ), the components failure rates (λ i ), and the probability of failure on demand for the software components (PFD i ).
For software, hardware, communication, and sensors' failures (based on [55,56]): For tested cold standby equipment failure on demand (except for software failures) (based on [55,56]): For safety system/functions with continuous monitoring failure on demand (based on [55,56]): For software failures in safety functions (based on [55,56]): The Birnbaum's importance measure (I B j ) [56], which is approximated according to Equation (8), is employed for the basic events importance analysis. This metric can be used to identify the components with a significant impact on the top event failure rate λ TE . In such cases, an improvement of the respective failure rates/probability can result in reducing the λ TE . In addition, this metric can be used to identify components having a structural importance or occupying important locations of the Fault Tree for the investigated system [57]. It depends on the quality of the developed Fault Tree, which is used for the calculation of the top event failure rate: The Fussell-Vesely importance measure (I FV j ), which is approximated according to Equation (9), is another metric that is employed in this study for facilitating the system importance analysis [56][57][58]. Based on this metric, the system components, the failure of which will most probably lead to the undesired event are identified [59]: Safety 2020, 6, 26 14 of 31

System Description and Analysis Input
For the application and demonstration of the proposed method, a rather simple industrial control system (ICS) has been selected, in particular, an open loop exhaust gas scrubber system. This can be considered as a simple example of CPSs, as it consists of a Programmable Logic Controller, the relevant actuators and physical components (pumps, scrubber unit, valves, etc.), and sensors for controlling the cleaning of exhaust gases.
The main purpose of the exhaust gas scrubber is to reduce the SOx emissions from the exhaust gas of the ship main engine and auxiliary engines when operating by burning High Sulphur Heavy Fuel Oil (HSHFO). The exhaust gases coming from the ship main and auxiliary engines are sprayed by injecting sea water within the scrubber. The sea water has a slightly higher pH (8) and, therefore, it will react with the SOx dissolved in the injected sea water. The main components of the open loop exhaust gas scrubber system are demonstrated in Figure 7 [60]. For the application and demonstration of the proposed method, a rather simple industrial control system (ICS) has been selected, in particular, an open loop exhaust gas scrubber system. This can be considered as a simple example of CPSs, as it consists of a Programmable Logic Controller, the relevant actuators and physical components (pumps, scrubber unit, valves, etc.), and sensors for controlling the cleaning of exhaust gases.
The main purpose of the exhaust gas scrubber is to reduce the SOx emissions from the exhaust gas of the ship main engine and auxiliary engines when operating by burning High Sulphur Heavy Fuel Oil (HSHFO). The exhaust gases coming from the ship main and auxiliary engines are sprayed by injecting sea water within the scrubber. The sea water has a slightly higher pH (8) and, therefore, it will react with the SOx dissolved in the injected sea water. The main components of the open loop exhaust gas scrubber system are demonstrated in Figure 7 Table 3. The exhaust gas scrubber control system can shut down the scrubber operations by closing the valves and switching off the sea water pumps. It also regulates the sea water flow rate and operating status of the sea water pumps based on the estimation of the fuel flow of the ship main and auxiliary engines. The process is supervised by the crew, which can implement switching over to a fuel with a low sulphur content if the exhaust gas SOx emissions exceed the acceptable limits. As an optional functionality, the exhaust gas scrubber control system could monitor the health status of the scrubber unit and predict its failures. In such a case, it is assumed that all the scrubber unit failures can be handled by the ship crew by switching over to a low Sulphur fuel. For the sake of the case study, it is considered that the scrubber unit failures as well as the SOx emissions sensor are not monitored by the alarm monitoring system, so the crew is not aware of the specific failures in order to switch off the scrubber system. It is also assumed that the crew can only mitigate the system hazards, but do not introduce the new hazards, so the crew cannot inadvertently switch off the exhaust gas scrubber system when the ship engines operate using HFO.  Table 3. The exhaust gas scrubber control system can shut down the scrubber operations by closing the valves and switching off the sea water pumps. It also regulates the sea water flow rate and operating status of the sea water pumps based on the estimation of the fuel flow of the ship main and auxiliary engines. The process is supervised by the crew, which can implement switching over to a fuel with a low sulphur content if the exhaust gas SOx emissions exceed the acceptable limits. As an optional functionality, the exhaust gas scrubber control system could monitor the health status of the scrubber unit and predict its failures. In such a case, it is assumed that all the scrubber unit failures can be handled by the ship crew by switching over to a low Sulphur fuel. For the sake of the case study, it is considered that the scrubber unit failures as well as the SOx emissions sensor are not monitored by the alarm monitoring system, so the crew is not aware of the specific failures in order to switch off the scrubber system. It is also assumed that the crew can only mitigate the system hazards, but do not introduce the new hazards, so the crew cannot inadvertently switch off the exhaust gas scrubber system when the ship engines operate using HFO. The failure rates used as input for this analysis and their sources are provided in Table 4. The inspection and testing of the SOx sensor and the standby pump are considered to be implemented every 5000 h, in line with the system maintenance manual [61]. The analysis in this study investigated the exhaust gas open loop system shown in Figure 7 considering the following functionalities and alternative configurations: (a) regular testing of the SOx emissions sensor (without continuous monitoring); (b) continuous monitoring of the SOx emissions sensor (the SOx emissions sensor failure/erroneous measurements are immediately identified using advanced diagnostic techniques); (c) when scrubber unit failures (Scrubber body, piping, droplet, venturi, injection nozzles) are monitored using diagnostic/prognostic techniques and immediately diagnosed; and (d) with two installed SOx emissions' sensors. (Steps 1-4) A number of accidents and hazardous scenarios that can arise in the investigated exhaust gas scrubber system are provided in Table 5 (results of step 1) (derived based on previous studies [42,43] and own analysis). As it can be observed, despite the fact that the system is simple and non-safety-critical, a number of accidents and hazards can occur, which may result in human injury or death, as well as damage to equipment or environment. The analysis in the CASA method subsequent steps will focus on the environmental pollution [A-3] and specifically on [H-5] (Exhaust gas not complying with regulatory requirements.), as this study scope is to demonstrate the functionality of the CASA method. As elaborated in Sections 1 and 3, the proper spraying of exhaust gas is an important scrubber function and its failure may result in environmental pollution and strict financial penalties. The hazard [H-5] is used for the development of the hierarchical control structure (step 2) and the identification of the UCAs (step 3). SOx sensor Sea water analysers

STPA Results
The system control structure (results of step 2) is provided in Figure 8. It can be observed that the control loop incorporates two controllers, the scrubber control system and the human operator. The scrubber controller uses as input the ship engines fuel flow to control the pumps' operating status, the sea water flow and the control valves' status. The crew can implement the fuel change command and switch off the scrubber, in cases where the measured SOx emissions exceed the regulatory threshold. In cases where a provisional functionality is available in the scrubber controller for monitoring the scrubber body failures based on pressure measurements, then the crew can immediately implement the fuel change to a low Sulphur fuel, when scrubber body failure occurs. Measuring the discharged sea water pH is also an important measure to ensure that the discharged sea water is in compliance with the environmental regulations. However, since this measure is not relevant to [H-5], it is not included in the hierarchical control system. The hierarchical control structure is used for the identification of the UCAs (step 3) and their causal factors (step 4). 2020, 7, x FOR PEER REVIEW 18 of 30 The list of identified Unsafe Control Actions (UCAs) is provided in Table 6 (results of step 3). In total, 10 UCAs were identified for the system hazard [H-5]. The 10th identified UCA is applicable only if a new functionality performing the exhaust gas scrubber unit health diagnosis/prognosis is employed (case c as described in Section 3). The identified UCAs are found to be of Type 1 (not provided), Type 2 (provided), or Type 3 (provided too early/late/out of sequence). This is attributed to the fact that mostly discrete control actions, such as start, open, or close are considered. Thus, Type 4 UCA (stopped too soon/applied for too long) for many of the identified UCAs can be considered as equivalent to Type 1 UCAs; for example, a start pump stopped too soon would be equivalent to not providing a control action (not starting the pump) in its final effect, leading to the specific hazard. Type 4 UCA, instead, is more applicable if the control action exhibits some variation in its effect, as in the case of the PID controllers, where overshoots can occur. However, in this particular case, they are either covered by other UCA Type or do not lead to the investigated hazard. Based on the UCAs shown in Table 7, their causal factors are identified (step 4). The UCAs are also used to support the 'Event Trees' development (step 5) as well as in step 7 to enrich the Fault Tree developed in step 6. The UCAs are also utilised to indicate which physical failures might need further elaboration in step 9. The list of identified Unsafe Control Actions (UCAs) is provided in Table 6 (results of step 3). In total, 10 UCAs were identified for the system hazard [H-5]. The 10th identified UCA is applicable only if a new functionality performing the exhaust gas scrubber unit health diagnosis/prognosis is employed (case c as described in Section 3). The identified UCAs are found to be of Type 1 (not provided), Type 2 (provided), or Type 3 (provided too early/late/out of sequence). This is attributed to the fact that mostly discrete control actions, such as start, open, or close are considered. Thus, Type 4 UCA (stopped too soon/applied for too long) for many of the identified UCAs can be considered as equivalent to Type 1 UCAs; for example, a start pump stopped too soon would be equivalent to not providing a control action (not starting the pump) in its final effect, leading to the specific hazard. Type 4 UCA, instead, is more applicable if the control action exhibits some variation in its effect, as in the case of the PID controllers, where overshoots can occur. However, in this particular case, they are either covered by other UCA Type or do not lead to the investigated hazard. Based on the UCAs shown in Table 7, their causal factors are identified (step 4). The UCAs are also used to support the 'Event Trees' development (step 5) as well as in step 7 to enrich the Fault Tree developed in step 6. The UCAs are also utilised to indicate which physical failures might need further elaboration in step 9. The causal factors list for the identified UCAs is provided in Table 7 (step 4). In total, 26 causal factors are identified. For the majority of the UCAs, software failures are considered as causal factors. In this study, software failure refers to all those conditions, which may lead to the controller inability to implement a specific function due to errors in the software design, integer overflows, software bugs, communication errors in the controller, etc. They are treated as software failure because the available statistical data does not offer their further description. The human error depicts the failure of the human operator to act as a protective barrier. The human error was also treated on a high-level based on the relevant statistical data reported in IEC 61511 [66]. The identification of human failure causes is out of the scope of this research. The results of this step are used in step 7 to enrich the Fault Tree developed in step 6.

ESI Results (Step 5)
The "Event Tree" derived by applying the ESI for the hazard [H-5] is provided in Figure 9, which also depicts the relations between the UCAs and the different events of "Event Tree". As it is deduced from this figure, the UCAs support the development of the "Event Tree". When the exhaust gas system operation does not comply with the emission regulations ([H-5]), the SOx emissions sensor provides an alarm. This can be used from the crew to switch the engine operation to the low sulphur fuel usage and simultaneously to switch off the scrubber system. If crew fails to do that, the first hazardous scenario occurs. If the SOx sensor is faulty, then the crew will be unaware of potential noncompliance with the emissions' regulations (scenario 2). The developed "Event Tree" will be converted to a Fault Tree in the next step (step 6). Human error 10 Software failure, inconsistent physical model, pressure sensor errors

ESI Results (Step 5)
The "Event Tree" derived by applying the ESI for the hazard [H-5] is provided in Figure 9, which also depicts the relations between the UCAs and the different events of "Event Tree". As it is deduced from this figure, the UCAs support the development of the "Event Tree". When the exhaust gas system operation does not comply with the emission regulations ([H-5]), the SOx emissions sensor provides an alarm. This can be used from the crew to switch the engine operation to the low sulphur fuel usage and simultaneously to switch off the scrubber system. If crew fails to do that, the first hazardous scenario occurs. If the SOx sensor is faulty, then the crew will be unaware of potential noncompliance with the emissions' regulations (scenario 2). The developed "Event Tree" will be converted to a Fault Tree in the next step (step 6).

STPA and ESI Results Integration (Steps 6-8), FTA Results (Step 9)
Since the investigated system is simple, there are no interactions between the different developed "Event Trees". By transforming the "Event Tree" (Figure 9) (step 6) and enriching it with the results of STPA (step 7), the Fault Tree shown in Figure 10 is generated. As the causal factors are given in Table 7, these causal factors were not developed further in Figure 10. The developed Fault Tree includes the two scenarios leading to environmental pollution, inheriting the structure of the "Event Tree" from Figure 9. This Fault Tree is refined further in step 8.

STPA and ESI Results Integration (Steps 6-8), FTA Results (Step 9)
Since the investigated system is simple, there are no interactions between the different developed "Event Trees". By transforming the "Event Tree" (Figure 9) (step 6) and enriching it with the results of STPA (step 7), the Fault Tree shown in Figure 10 is generated. As the causal factors are given in Table 7, these causal factors were not developed further in Figure 10. The developed Fault Tree includes the two scenarios leading to environmental pollution, inheriting the structure of the "Event Tree" from Figure 9. This Fault Tree is refined further in step 8. If we ignore steps (5-6), the Fault would be developed by connecting all the UCAs by OR gate. In the hypothetical case, all the UCAs (UCAs 1-10) were connected using the OR gate, then either 'Closing valves during normal operation/faulty conditions will restrict the scrubber functionality [H-5]' (UCA 1) or 'Not changing fuel during faulty operation of the scrubber [H-5]' (UCA10) would lead to the hazard [H-5], which is noncompliance with regulations. However, it is known from experience that these two UCAs must occur at the same time (there is a need for AND gate). Potentially, it would be possible to identify this relationship using the safety analyst experience. Nonetheless, using the ESI adds rigor to the analysis; hence, ESI was included in the CASA method.
After applying the refinement rules provided in Table 2 (step 8), the Fault Tree shown in Figure  11 is developed. As shown in Figure 11, the refinement was applied to UCAs 1-3 and 5-7 context (refinement rule 1, Table 2) and for the common causal factors to UCA 5 and 7 (erroneous measurement of fuel flow) (refinement rule 4, Table 2). The system is rather simple; hence, no other refinements were required. In more complex systems, such as the system analysed in [48], more refinement rules would be applicable. The Fault Tree of step 8 is enriched with the results of FTA for physical failures, thus providing the finally developed Fault Tree (shown in Figure 10), which is the output of the CASA method qualitative analysis. The FTA (step 9) is applied to the scrubber system to identify the components that may fail. Only five scrubber unit components have been considered in the analysis. The results of the FTA are also provided in Figure 11. The results of FTA are similar to the structural breakdown of the scrubber unit. The final Fault Tree depicted in Figure 11 is used for the purpose of quantitative analysis (step 10). The results for the cases a-d are almost identical. There is no difference in structure for cases a and b. The location of the optional functionality for case (c) is also provided in the modified Fault Tree in Figure 11. For case (d), instead of one sensor, two sensors are provided. If we ignore steps (5)(6), the Fault would be developed by connecting all the UCAs by OR gate. In the hypothetical case, all the UCAs (UCAs 1-10) were connected using the OR gate, then either 'Closing valves during normal operation/faulty conditions will restrict the scrubber functionality [H-5]' (UCA 1) or 'Not changing fuel during faulty operation of the scrubber [H-5]' (UCA10) would lead to the hazard [H-5], which is noncompliance with regulations. However, it is known from experience that these two UCAs must occur at the same time (there is a need for AND gate). Potentially, it would be possible to identify this relationship using the safety analyst experience. Nonetheless, using the ESI adds rigor to the analysis; hence, ESI was included in the CASA method.
After applying the refinement rules provided in Table 2 (step 8), the Fault Tree shown in Figure 11 is developed. As shown in Figure 11, the refinement was applied to UCAs 1-3 and 5-7 context (refinement rule 1, Table 2) and for the common causal factors to UCA 5 and 7 (erroneous measurement of fuel flow) (refinement rule 4, Table 2). The system is rather simple; hence, no other refinements were required. In more complex systems, such as the system analysed in [48], more refinement rules would be applicable. The Fault Tree of step 8 is enriched with the results of FTA for physical failures, thus providing the finally developed Fault Tree (shown in Figure 10), which is the output of the CASA method qualitative analysis. The FTA (step 9) is applied to the scrubber system to identify the components that may fail. Only five scrubber unit components have been considered in the analysis. The results of the FTA are also provided in Figure 11. The results of FTA are similar to the structural breakdown of the scrubber unit. The final Fault Tree depicted in Figure 11 is used for the purpose of quantitative analysis (step 10). The results for the cases a-d are almost identical. There is no difference in structure for cases a and b. The location of the optional functionality for case (c) is also provided in the modified Fault Tree in Figure 11. For case (d), instead of one sensor, two sensors are provided.

Quantitative Analysis (Step 10)
The results of estimating the top event failure rate by considering the different system functionalities (cases (a) to (d) as described in Section 3) are provided in Table 8. The results of the importance analysis (cases (a) to (d) as described in Section 3) are provided in Table 9. Only the five top failures according to each metric and system functionalities are demonstrated. The results of importance analysis are presented in a reduced ranking order, proceeding from the most critical to the least critical failures according to each importance measure. As it can be deduced from the derived Birnbaum metric values for case a, the top event failure is sensitive to the scrubber components failures and various software failures in the system with the regular SOx sensor testing (case a). The top event failure rate will emanate from the SOx sensor failure and some scrubber unit failures as well as the scrubber controller software failure according to Fussell-Vesely metric for case a. Therefore, the system safety performance can be improved if safety measures to address the SOx emissions sensor failure are implemented.
As it can be observed from Table 8, the implementation of continuous monitoring and diagnosis of the SOx sensor failures (case b) instead of regular testing of SOx sensor will lead to significant decrease in top event failure (several orders of magnitude). However, the human error becomes a more critical failure according to the calculated Fussell-Vesely metric ( Table 9). The scrubber and controller failures still remain critical failures with this additional system function. Therefore, to enhance the system safety performance further, it is required to provide information for the system conditions to support the crew in making decisions.
Instead, the application of diagnosis/prognosis techniques for the scrubber failure leads to approximately 27% reduction in the top event failure rate as depicted in Table 8 (case c). In case c, the system top failure rate also becomes sensitive to failures of the sensors used to control the sea water flow ( Table 9). The most probable cause of the system failure according to the Fussell-Vesely metric remains the SOx sensor failure and various scrubber components' failures (Table 9). Thus, with this system functionality, system safety enhancement will occur when redundancy to the SOx emissions sensor measurements is provided.
Installation of two SOx sensors (instead of one) also results in a significant reduction of the top event failure rate (an order of magnitude) ( Table 8). In case d, the failure of the SOx sensors (both fail) still remain critical, but their criticality is reduced compared to the case with the regular SOx sensor failure ( Table 9). The other importance analysis results are similar to the previous cases importance analysis results. Thus, the system safety in case c can be enhanced by closely monitoring the scrubber unit components for detecting failures.
Based on the presented results, it can be concluded that the exhaust gas open loop scrubber system compliance with the SOx emission regulations can be enhanced when functionality of the SOx emissions sensor is continuously monitored or two SOx emissions sensors (redundancy) are installed. The scrubber unit components' failures seem to be critical for the normal system operation. The installation of diagnosis/prognosis technologies will lead to the system design improvement, however not as effectively as the installation of continuous monitoring system for the SOx sensor failures or an additional SOx emissions' sensor. If diagnosis/prognosis techniques are employed, then the top event failure rate will become sensitive to other failures such as in fuel flow sensors, so redundancy in fuel measurements would be recommended. However, the cost-effectiveness of the suggested measures is outside the scope of present study.

Discussion on the Method
To the best knowledge of the authors, no article or conference paper providing results from scrubbers' safety analyses is currently available. Only two theses (master and bachelor) have been identified focusing on this type of system safety analysis [42,43]. Comparing these studies' results with the results derived in the present study is challenging due to the differences in the considered systems, the experience level of the involved safety analysts and used input data.
Nevertheless, it can be observed that the considered top events in the systems in these studies [42,43] are rather slightly different from the top event of the present study. In the present study, the top event was the noncompliance with the regulations, whilst in the investigated master theses one of the Fault Trees top events was improper treatment of exhaust gases ( Figure 11). However, it can be observed that the Fault Tree derived by the CASA method incorporated the SOx emissions' sensor failure at a much higher level connected to other events using an AND gate, highlighting its criticality. In the other studies Fault Trees [42,43], the SOx sensor failure was not included. Therefore, the present analysis considered more failures related to the top event. This can be attributed to the inclusion of the STPA and ESI results. STPA is a top-down approach, which guides the analysis of specific undesired events (called accidents in the STPA framework) and system states (hazards) rather than of system component failures. The ESI results can be used to demonstrate how the hazards propagate to accidents; the SOx sensors' failure appeared in the Fault Tree (Figure 9) based on this approach. Human failure was also incorporated in the present analysis. However, it was out of the analyses scope reported in [42,43].
In addition, several software failures were not considered in these analyses, whereas they are considered in the present study, such as 'scrubber control system not increasing sea water flow/decreasing sea water flow in the system' or 'scrubber control system shutting down the system'. These need to be included in the analysis, as they contribute to the improper treatment of the exhaust gases. Based on that, it can be argued that, thanks to incorporation of the STPA results, new scenarios are considered in the Fault Tree structure. Therefore, it could be claimed that the proposed CASA method guides a more accurate safety analysis, which incorporates software failures, addressing the software-intensive character of the modern ICS and CPSs.
In addition, the refinement, which was applied to the identified UCAs, allowed for the better consideration of the temporal system behaviour. To be specific, the consideration of probability of UCA context, such as 'significant power increase' allowed for the incorporation of cases where a specific UCA can become hazardous and their consideration in the analysis quantitative step. This is often a case for ICS, as specific control actions become hazardous only in specific system context [16].
The structure of the final Fault Tree developed in step 9 of this study is different from the Fault Trees presented in other studies FTA [42,43], which can be considered as the open-loop scrubber system breakdown. In addition, they also incorporated the failures during the system start-up. In this way, failures that can occur at different operating phases without any relation were incorporated in one Fault Tree [42,43]. This is not true in the actual system operation, as a number of factors must occur simultaneously or in a sequence, in order for a top event to occur in modern CPSs. In the present study Fault Tree, there is a logical sequence of events, which is depicted using AND gates as connectors. For instance, a failure in scrubber system together with the SOx emissions' sensor failure must occur, so that the system is noncompliant with the existing SOx regulations. Therefore, it can be argued that the presented Fault Tree, thanks to the ESI, more effectively considered the system multi-points failures and temporal character.
The method allowed for the comparison of the system behaviour using quantitate metrics in cases where advances monitoring/diagnostics functionalities were considered. It was demonstrated that, when including diagnosis/prognosis techniques or the SOx emissions, sensor failures' continuous monitoring settings change the system safety performance significantly, overcoming this STPA limitation. This can be useful when considering the implementation of new functions in system or design alternatives during the system design phase.
Based on the above, it is demonstrated that the proposed novel CASA method's main advantage is the development of a Fault Tree of greater accuracy in comparison with the Fault Tree that can be derived using the classical FTA. The classical FTA may result in inaccuracies if applied to a modern CPS. The CASA method incorporates a wider system context, considers the software failures, thus addressing the CPSs software-intensive character of CPSs, and incorporates the system temporal behaviour in the Fault Tree thanks to the inclusion of the ESI approach. The incorporation of the system temporal aspects is an advantage compared to other studies using FMEA [29], FTA [30,31], Bayesian Networks [32], and STPA [34][35][36][37][38].
Compared to the STPA, the CASA method included the estimation of the safety and importance metrics, thus supporting a financial resources' prioritisation for addressing the system safety enhancement. The importance metrics estimation is an advantage compared to Petri Nets based approaches [20,27,28]. As it was demonstrated, in the CASA method, a more detailed system safety model was developed than STPA based ranking approaches [34][35][36][37], which supports more accurate criticality/importance analysis.
Another advantage of the CASA method is the quantification of the impact on the system safety of adding advanced software-based functions, which was not demonstrated in STPA based approaches [34,[36][37][38], and only approximated in [35,38]. This is an advantage compared to a number of model-based approaches. For instance, a model based approach used for the Fault Tree development applied to a power system failed to quantify the power reduction functions impact on the system safety [68]. In this respect, it can be deduced that the quantification of the advanced functionalities impact on the system safety by using FTA is questionable. Potentially, this would be possible by using Bayesian Networks or Petri Nets, and this is a topic for future research.
The fact that the method was successfully implemented for the safety analysis of a non-safety critical ship system demonstrates that it can be applied to other safety critical and non-safety critical ICS, such as the ship power and propulsion systems, ballast water treatment systems, nuclear control systems, industrial power systems, heat, ventilation, and air conditioning control system. Forthcoming studies could also investigate if the CASA method is effective for the safety analysis of socio-technical systems and autonomous CPSs.
The increased CASA accuracy, however, comes at a cost. The method has rather a large number of steps, which indicates that more time is required to apply the method than the STPA or the classical FTA. This poses a need to automate the application of the method based on formal models. This is also a topic proposed for future research.

Conclusions
In this study, a novel method for safety analysis of the CPSs was developed and demonstrated. This method combines two hazard identification and analysis techniques and a modified hazard identification and analysis technique-to be specific, the systemic STPA, the traditional FTA as well as the ETA-based ESI method. The method commences with STPA to identify potential software failures, proceeds with system hazardous sequences identification using the ESI, employs the FTA to analyse further specific system failures and finishes with the Quantitative Analysis to estimate safety and importance metrics. The novel method was applied for safety analysis of the open-loop exhaust gas scrubber system.
The main findings of this study are summarised as follows: • The straightforward application of FTA to CPSs may result in inaccurate representation of the top event.

•
The CASA method guided and resulted in a more accurate safety analysis, compared with previous FTAs for the same system by incorporating the system software failures represented by UCAs, considering the system states' probabilities, multi-point failures, and temporal relationships in the system.

•
The CASA method also allowed for the investigation and quantitative estimation of the system behaviour for cases where new functions are added to the system, as was demonstrated with the monitoring techniques applied to the SOx sensor and scrubber unit.

•
The proposed method allowed for the estimation of the safety-related event failure rate and the identification of the most important factors and failures affecting the safety-related event guiding the safety enhancement of the investigated system.

•
The implementation of monitoring techniques for the SOx sensor failures or two SOx sensors' installation is expected to reduce significantly the system noncompliance failure rate (an order of magnitude) with regulations. Implementation of advanced monitoring techniques for the scrubber unit failures is expected to improve system safety, but to a lesser extent.
In summary, this study demonstrated that the developed method for a complex system undesired event failure rate estimation led to a more effective and complete Fault Tree development in comparison to the previous studies. The method also allowed for assessing the impact of different parameters to the overall system undesired event failure rate overcoming the STPA limitations. It is expected that the proposed method will constitute a valuable tool for the CPS safety analysis during the initial design phases and support the safe systems operation. A future work could investigate the proposed method automation based on formal models or application to other systems. Other safety/financial metrics estimation could also be considered for the exhaust gas open loop scrubber system.


MOOD TYPE AND APPRAISAL REALIZED IN THE ONLINE JAKARTA POST EDITORIAL ISSUED ON MARCH 12TH, 2018 “VOTERS NEED MORE CANDIDATES – ALPIAN BAGUS PRATAMA & KATHARINA RUSTIPA – DBB V15 N1 JANUARI 2020 7 MOOD TYPE AND APPRAISAL REALIZED IN THE ONLINE JAKARTA POST EDITORIAL ISSUED ON MARCH 12

This research attempt to investigate an editorial text of the online Jakarta Post entitled “Voters Need More Candidates” Issued on March 12th, 2018 with two research questions, i.e. (1) What kinds of mood system are realized in the text of “Voters need more candidates”? (2) What kinds of author’s attitude, engagement and graduation are reflected in the text? This research used qualitative research tradition Method. This research found out that the type of mood mostly used in editorial text entitled Voter Need More Candidates is declarative. The lexical of appraisal system are JudgmentAttitude (9%) and Appreciation Attitude (91); Mono-glossic-Engagement (36.84%), Dialogic Contraction-Engagement (15.79%) and Dialogic Expansion-Engagement (47.37%)); Force-Graduation (100%).

BACKGROUND
Associated to Indonesia presidential vote of 2019, the Newspaper has the major function to address the information. Getting nearer to the election we got extensive news or articles of opinion. The journalist investigated, critiqued, and advised the candidate or wrote about the Indonesia government system. As a result, it triggered the reader to the attitude of the journalist of the newspapers which influenced public opinion. In short, the paper is a resource of information.
In this case journalist is important writer to positioning the reader in certain position.
One of newspaper columns that facilitated journalist to giving opinion about certain issue is editorial. Reah (2002) states that the editorial column is a significant article in a newspaper, that declares the editor's opinion about an item of news or an issue. Schaffer et al, (2009)  The writer decided to analyze an editorial text of the online Jakarta Post because the paper is representative of English writing of Indonesians in an international community about politics, culture, economic, etc. Moreover, Indonesia held presidential election in 2019.
Consequently, Indonesians will focus on political dynamics in this country.

Sutomo (2014) did a study on "Interpersonal Meaning Realized in Online News Text of
The Bali Times". There are four components found in the data, they are mood system, modal Auxiliary, personal pronoun, and tense shift. All the subjects are non-interactants (100%) and positive polarity (96.9%). Modal Auxiliaries used are will (used five time), can and could (used five time). Some of the events occurred in past tense and the present tense This research is different from the previous researches. First, this research uses different data. Second this research combines interpersonal meaning and Interpersonal Meaning (Halliday, 2014;Eggins, 2004;Martin, 2001) and appraisal theory proposed by Martin & White (2005). This article conducted to find out mood type of the text and the author's attitude, engagement and graduation which are reflected in the text.

THEORITICAL FRAMEWORK
Newspaper loads many kinds of news article, for instance news, feature, opinion, etc. Ishwara (2016) divides news in two types as follow: Event-centered news (waiting event, incident, happening, affair, and phenomenon), and Process-centered news (Opinion Columns: Editorial, Articles, and News Letters). Event-centered news is kind of news that reported by The improvement of technology is impact to newspaper corporate. It is stand out at the news media presentation (printed, broadcast, and online). This situation appearing various argument or debate of academic society/scholar that interested in media improvement.
Generally, the newspaper corporate publishes their paper through printed newspaper and online newspaper. The newspaper corporate also take a part making opinion in certain issue.
For instance, talking about point of view of the media to conflict, war, national politics, human right, independent media etc. According to Reah (2002:46), editorial is as the place where the reader expects to find an overt comment on the news of the day.
Systemic Functional Grammar 2.1 In this theory, there are two important ideas that state. first, make accepted the unit of analysis of the text. The second, it is explaining the three fundamental concepts of the meaning of the clause. Halliday (2014) claim that the clause has metafunction meaning. They are ideational meaning. Interpersonal meaning and textual meaning. Ideational meaning is construing a model of experience and the correspondent in the clause is the clause as representation. Interpersonal meaning is enacting of social relationship and the clause states are as an exchange, and the last one is textual meaning. It specified how creating relevance to context. Interpersonal meaning (Halliday, 2004;Eggins, 2004;Martin, 2001) 2.2 Interpersonal meaning simple can divine as interaction or communication or exchange. We tell other people things for a purpose: we may want to influence their attitudes or behavior, or to provide information that we know they do not have, or to explain our own attitudes or behavior, or to get them to provide us with information, and so on. According to Thompson (2014)  Appraisal theory is part of Systemic Functional Linguistic (SFL). This theory focus evaluation feeling, character and values of the writer. According to Thompson (2014) appraisal is model set out in Martin and White (2005), moreover it is aims to systematize a varied set of linguistic resources that speakers and writers. Martin and Rose (2003:22) state that appraisal is a system of interpersonal meaning and appraisal as a tool to negotiate our social relationship. In short, appraisal is evolution of interpersonal metafunction of systemic functional grammar. Xinghua and Thompson (2009) state that ATTITUDE is the main subsystem in appraisal. Attitude is there are three part of sub-categories system: Affect (analysis about peoples feeling), Judgement (refer to evaluate people characters), and Appreciation (evaluate value of thing). Graduation and engagement are the last sub-system of appraisal system. Graduation regarding to gradable meaning of the word. It divides to two kind of recourse i.e.
Alvin (2019) stated that "Appraisal analysis, there is no need to first divide up the text into ranking clauses. The unit of analysis here is not the ranking clause, but the entire text.
Any word, word group, or part of a word group can be singled out as an example of appraisal.
Analysis of appraisal is essentially interpretive, and the same text can be analyzed very differently by different people".

METHOD
The research tradition employed in this article is qualitative research. Qualitative research is to exploring and understanding the meaning of individuals or groups to describe a social or human problem (Creswell, 2007). The editorial text took from the online Jakarta Post issued in March 12 th , 2018. To gathering the data the writer browsing, visiting, downloading and breaks down the text into clause for the sake of analysis. After segmented the data. The writer reading the segmented units of analysis, identifying the sentences Classifying/Categorizing the sentences, tabulating the categorized sentences which and interpreting of the findings based on interpersonal theory and appraisal system.

Mood Type 4.1
The mood type found in the text are presented below:  (2004), that statement is part of the subsystem of proposition. It is means declarative clause enables writer or speaker to exchange information.
As a result, the article was used by author of editorial to spread their opinion on a special issue, in the presidential election in the society. The writer expressed their position regarding the presidential candidates of Indonesia and democracy system which have been implemented in to previous periods. And also, the author compared the Indonesian government system with other country to decide their president (i.e. China and Egypt). The author believes that if there were more president candidates, the tension will be reduced. In the following, the writer presents the appraisal system found in the text.

Engagement
Engagement deals with sourcing attitudes and the play of voices around opinion in discourse (Martin & White, 2004, p. 35). The two types of engagement are heteroglossia (other voice) and Monoglossia (single voice) where the source is simply the author. The results of the analysis in terms of engagement, are set out bellow: Thus, it can be understood that the authors make this article use only the second source of sound both dialogic contraction and dialogic expansion. This means that the editorial writer used monoglossia.

Examples No
Mono-glossic 1 Free competition among candidates is the cornerstone of democracy.
2 Many, especially in an authoritarian regime or quasidemocracy, find this basic principle of democracy problematic.

No
Hetero-glossic Expansion 1 The widelyshared assumption is that democracy works like a market system in which more options for voters means they get the best possible candidate to run the government.
2 China decided to do away with competition among members of the elite and abolished the presidential term limit, handing over power to President Xi Jinping, probably for the next three decades.

No
Hetero-glossic Contraction 1 In Egypt, with no credible opponents working to challenge him in the election, a victory for current President Abdel Fattah el-Sisi is all but assured.

2
In fact, in the inaugural direct presidential election in 2004, voters cast their ballots twice as no presidential ticket won the majority of the vote in the first round.

Attitude
Appraisal resources include lexical items for judging people's behaviour in terms of social esteem and social sanction. The results of the analysis in terms of attitude are set out bellow:  Table 4.9 states that appreciation shows the highest percentage of the other two subsystems. This states that the author gives more assessment of democracy and presidential elections when expressing feelings and evaluating the character of the presidential candidate.

Judgement
The results of the analysis in terms of judgement are set out bellow: The type of sentence above expresses the judgment given by editorial writer. Lexical items that refer to negative judgment are no credible opponents. Actually, it is difficult to say that the lexical item is judgment or application.

Appreciation
The results of the analysis in terms of appreciation are set out in bellow: The table above explain two types of appreciation, there are two kinds of appreciation (i.e. positive and negative). Founded eleven items that expressed by appreciation, there were six negative appreciations so that the percentage reaching 60% and the rest were positive appreciation which were 4 items with a percentage of 40%. From the findings above it can be concluded that the editorial writer is more likely to use a negative appreciation to deliver the idea. This means that something is not good from the writer's point of view. The negative appreciation gives the reader understanding the problem have been done. Examples:

No
Positive appreciation 1 Free competition among candidates is the cornerstone of democracy.

2
The widely shared assumption is that democracy works like a market system in which more options for voters means they get the best possible candidate to run the government.

3
In the past two decades, Indonesia has seen competitive presidential elections with multiple candidates being nominated by coalitions of political parties.
In the clause above is containing positive appreciation can be understood through the selection of lexical items. In the first clause there is the word "cornerstone". The word explains the positive appreciation of the writer. The word cornerstone symbolizes something strong and fundamental. On the other hand, the editorial article writer would say that free competition among candidates is recognized as the foundation of democracy. If there is fraud among candidates who are competing, the elected leader is likely to raise problems in government and disturb the stability of a country.
In the second clause the word that refers to positive appreciation is best. This word means that the best leaders will be produced if there are many candidates who will be chosen by the voters.
In the third clause, writer expressed positive appreciation for the presidential election at two decades earlier. The author uses lexical "competitive" to describe the presidential election which is followed by more than two candidates. 3 China decided to do away with competition among members of the elite and abolished the presidential term limit, handing over power to President Xi Jinping, probably for the next three decades.
The sentences above expresses the negative appreciation of the editorial writer.
Lexical items that express negative appreciation are polarizing, authoritarian, quasi democratic, problematic and elite. In the first clause the use of the word polarizing means that in the community there have been disputes and conflicts in which supporters of the two presidential candidates in 2014.

Graduation
Graduation attend to grading phenomena whereby feelings are amplified and categories blurred (Martin & White, 2004). The finding of graduation as follow: The table above is the graduation item that found in the text. Graduation is divided into two namely force and focus. The number of Lexical items found in the editorial text is 14 lexical items. The distribution of lexical items is in force only. There are 6 lexical items that refer to low force and 8 lexical items that refer to high force. The lexical findings above can be concluded that the editorial writer uses only sub-system force rather than sub-system focus. 2 Cynics may say this axis, which the Dems plan to set up with the National Awakening Party (PKB) and the National Mandate Party (PAN), will only serve as a bargaining chip in the event of postelection coalition talks, however, any effort to prevent the incumbent from scoring a guaranteed victory is worth supporting.
The examples of sentences above is refer to graduation. The lexical item that refer to graduation is modality. Lexical items that refer to modality are possibility, may, possible, and will. It has been said before that modality is a system which leaves the writer position between yes or no. lexical modality selection states the author's intensity of the message delivered to the readers.

CONCLUSION
The type of mood found in the editorial text is declarative. There were 35 clauses (100%). It means that the editorial writer used commodity exchange of information. The editorial writer used declarative clauses to give information and evaluation to the readers.
The appraisal systems realized in the editorial text entitled Voters Need More Candidates are engagement, attitude, and graduation. There were 19 lexical of engagement, consisting of hetero-glossic and mono-glossic. There were 12 lexical of hetero-glossic: 3 Hetero-glossic Contraction (15.79%) and 9 hetero-glossic expansion (47.37%) And there were 7 lexical of mono-glossic (36.84%). The graduation consisted of 14 lexical of Force (100. The system of attitude consisted of 11 lexical of affect, judgement, and appreciation. The attitude system of affect was not found in the text (0%), the attitude system of judgement appearance once (9%), and the attitude system of appreciation consisted of ten lexical (91%).
That statistic shows us that the writer of editorial mostly used engagement are hetero-glossic, attitute mostly use is appreciation, and graduation mostly used is force.