Analyzing national responses to COVID-19 Pandemic using STPA.

The unprecedented COVID-19 pandemic has affected most aspects of human life, including the ways in which organizations are operating. Minimizing the spread of coronavirus and its economic consequences, and creating a new and safe lifestyle has now become the common goals of governments all over the world. Although governments have responded to the COVID-19 pandemic by implementing various rules while interacting with relevant organizations to provide health service, vaccine research, and production of essential items, the complexities in the interactions between various stakeholders have proved to be challenging to have efficient and timely outputs. When different stakeholders (i.e. governments, organizations, and the public) are interacting with each other, a systems thinking process needs to be applied to capture the nuances of the interactions and the subsequent emergent behavior to effectively contribute to the system output (i.e. a safer way of life). This paper applied a system-thinking-inspired process called System Theoretic Process Analysis (STPA) to analyze the current response to the COVID-19 pandemic. The analysis treated various stakeholders as a part of the system, and it focused on the interactions among different stakeholders (i.e. functional blocks) within the system - i.e. 'Government', 'Foreign Governments', 'Organizations', and 'General Public', as well as the interactions with 'W.H.O'. The STPA analysis found 236 potential Unsafe Control Actions (UCAs) (or unsafe interactions) among the stakeholder interactions, each of the UCAs was then further analyzed. In total 1440 causal factors of the UCAs were identified, and 2880 requirements were proposed to avoid such unsafe interactions.

Introduction

The coronavirus disease, also known as COVID-19, is an air-borne disease that spread around the world during the first quarter of 2020 (Sheng, 2020). Unlike influenza whose viral shedding usually starts two days after the symptoms appear, COVID-19 viral shedding may begin up to 37 days before the first symptoms appear, with very rare infected cases who never built symptoms (Hu et al., 2013). This suggests that the people might already become infectious before they are even aware of the disease and spread the virus during this period (Lee et al., 2020).

The special characteristics of COVID-19 make it very hard to be detected and controlled. A recent study emphasized that the only thing the public can do to stop the COVID-19 outbreak is to change their behavior (Anderson et al., 2020, Huynh, 2020). Most governments have responded to the COVID-19 threats when the outbreak occurred at the end of the first quarter of the year, by implementing COVID-19 specific rules which include social distancing, activity restrictions, temporary closing of all the non-essential shops (i.e. lockdown) (Wang, 2021, Ren et al., 2020). In some countries, the lockdown worked well in terms of minimizing the spread of infections (Wieland, 2020, Burki, 2020). However, it has also affected the growth of countries’ economy which potentially could lead to a severe national predicament after the COVID-19 pandemic has subsided (Manjula Bai, 2020). Having considered these potential consequent predicaments, the governments changed the lockdown rules to be harsher in some areas where coronavirus reproduction number (also known as R0) was high – i.e. R0 > 1 (Anzum and Islam, 2020). Although the safety and wellness of the public always have higher priority than the economy, there still needs to be a balance as studies showed that an economic depression could potentially put people’s lives and livelihoods at risk (Jing and Wang, 2020, Li and Yi, 2020). For example, non-COVID-19 patients might not receive effective treatments due to a lack of essential supplies in hospitals, there might be panic buying or even public violence due to a shortage of resources (Lins and Aquino, 2020). Such outcomes wouldn’t be acceptable in a society, and therefore optimizing the interactions between governments and other parts of the society has become the top priority. Due to the complexity of the interactions between various stakeholders of the system, a systems thinking inspired model is therefore needed to analyze such interactions and to provide relevant requirements to either prevent or mitigate the consequences of the unsafe interactions.

Human behaviors play vital roles in controlling the spread of the virus and the economic depression, both as part of the governments providing relevant rules, as well as part of the organizations or public following the rules. Therefore, the potential inadequate human behaviors, as well as the causes of such behaviors need to be thoroughly analyzed. There has been a variety of analysis methods developed since the 1990s to identify causes of human errors in a risk management system, including AcciMap Approach (Peng et al., 2018), Functional Resonance Analysis Method (FRAM) (Hollnagel and Goteman, 2004), Human Factors Analysis and Classification System (HFACS) (Shappell and Wiegmann, 2017), HERA-JANUS (Eurocontrol, 2004). etc. These methods commonly illustrate the diversity of causal factors across different levels of the systems, their interactions, and the roles played by external influences such as political, cultural, financial, and technical circumstances. When analyzing causes of accidents using these methods, they are either based on retrospective accidents or are elaborate, requiring contributions from different teams. During the unprecedented COVID-19 pandemic, the available information on the virus and the interactions between governments and organizations, and the public are very limited (Spalluto et al., 2020). Applying these methods in such situations become unrealistic.

Contrary to the aforementioned methods which require detailed information before initialization, systems-thinking-inspired System Theoretic Process Analysis (STPA) can be applied at the early stages of the system development when only very limited information is available or known, which is particularly useful for analyzing the COVID-19 pandemic. When more relevant information becomes available, the analysis can be iterated at a progressive level of detail with this additional information. STPA believes that accidents occur most likely when external disturbances or dysfunctional interactions among subsystems are not adequately handled by the control system (Leveson, 2011). STPA can potentially identify causes that may not be identified by other methods, especially those concerning risk management, human–computer interaction, software bugs, and missing requirements. It prevents accidents by enforcing constraints on component behavior requirements and interactions. STPA has been widely applied in space (Dulac et al., 2007), aviation (Castilho et al., 2018), marine applications (Wróbel et al., 2018), automotive (Abdulkhaleq et al., 2017), and more recently in the healthcare (Bas, 2020).

The remaining text is organized as follows. Section 2 presents the theoretical process of STPA. Section 3 presents the case study of STPA on the national response to the COVID-19 pandemic. Section 4 discusses the results from the analysis and presents some future work. Section 5 concludes our paper and the analysis.

Method

STPA is based on systems theory, and it believes that accidents occur not just because of component failures but also due to unsafe interactions among system components or with external disturbances. It starts by defining any unacceptable events (i.e. losses) and identifying possible hazardous system-level states that could trigger the losses (i.e. system-level hazards). The rest of the analysis provides a systematic way of identifying potential unsafe control actions (UCAs) from the stakeholders that could lead to the system-level hazards, and consequently losses, followed by further analysis of each UCA to identify their possible causal factors. The flowchart of the STPA process is illustrated in Fig. 1 . The detailed descriptions of each step are presented in the rest of this section.

Fig. 1

Flowchart for STPA Process.

STPA step 1: Define purpose of the analysis

As a top-down approach, STPA starts by defining losses, based on the inputs from the stakeholders regarding their unacceptable events. Apart from the safety–critical losses such as loss of human life or human injury, STPA specified losses may not be safety–critical. For example, loss of air quality, loss of mission, loss of reputation may not be safety–critical, but they are also treated as losses in STPA because they may be unacceptable to the stakeholders. After defining the losses, the system boundary for the analysis is identified. A system boundary consists of a set of components or stakeholders that act together as a whole to achieve some common goals. During the COVID-19 pandemic, the governments from various countries, together with the World Health Organization (W.H.O) are considered as part of the system. Because they are interacting with each other to control the spread of the virus and the economic depression. Although the system boundary covers international interactions between different governments and W.H.O, the analysis boundary in this paper focuses more on the national response to the COVID-19 pandemic. System-level hazards are then identified, which describe a system state or set of conditions that lead to a loss, in a particular set of worst-case environment conditions. For example, panic buying in the country may be identified as a system-level hazard, which represents the system state (i.e. national state). This hazard may lead to a long term impact on people’s health and wellbeing and even loss of life due to the shortage of resources available to other people.

STPA step 2: Model the control structure

This step aims to create a hierarchical control structure that captures functional blocks in a state of dynamic equilibrium by feedback control loops. In an ideal circumstance, a control loop consists of a controller that provides control actions (CAs) to control some process and to enforce constraints on the behavior of the controlled process. The control algorithm is embedded inside the controller, which represents the controller’s decision-making process – i.e. it determines the CA to be provided. The CA from the controller may be updated in part by the feedback used to observe the controlled process. A high-level control structure of the system under analysis is illustrated in Fig. 2 . There are several control loops captured in the control structure, such as the control loop between ‘Government’ and ‘Organizations’, between ‘Local Authorities & Councils’ and ‘Organizations’, and between ‘Organizations’ and ‘General Public’. The control structure at this abstraction level includes a total of 19 CAs.

Fig. 2

A high-level control structure of the system under analysis.

STPA step 3: Identify unsafe control actions (UCA)

Once all the CAs in the control structure are identified, each CA is further analyzed to examine how it would manifest into a UCA. In a certain circumstance, a CA could lead to one or multiple system-level hazards (as identified in Step 1). To identify a UCA, the CA is analyzed in four different categories:

Not providing the CA leads to a hazard

Providing the CA incorrectly or when not needed leads to a hazard

Providing the CA too early or too late or in the wrong order leads to a hazard

Providing the CA too long or too short leads to a hazard

An example CA ‘Furlough’ provided from ‘Government’ to ‘Organizations’, and its UCAs are illustrated in Table 1 .

Table 1

Example CA ‘Furlough and its UCAs.

CA	UCA Categories	UCAs
Furlough	Not Provided	UCA-1: ‘Government’ does not provide ‘Furlough’ when R > 1 and employees are redundant and not able to find new jobs.
	Provided incorrectly / when not needed	UCA-2: ‘Government’ provides incorrect ‘Furlough’ (e.g. insufficient amount of payments) when R > 1 and employees are redundant and not able to find new jobs.
	Provided too early / too late	UCA-3: ‘Government’ provides ‘Furlough’ too late when employees are already jobless due to the COVID-19 pandemic.
	Provided too long / too short	UCA-4: ‘Government’ provides ‘Furlough’ too long when R < 1 and employees are ready to return to work safely.

STPA step 4: Identify loss scenarios and requirements

Once the UCAs are identified, each UCA is then further analyzed to identify the possible loss scenarios. A loss scenario describes the possible causal factors (CF) that can lead to UCAs and hazards. A controller in a control loop has a process model that represents the controller’s internal belief and assumption (i.e. its view of the outer world) used to make decisions. Process models may include beliefs about the process being controlled or other relevant aspects of the system or the environment. For a UCA to occur, the process model of the controller has a belief based on which it believes that the CA it is directing is safe when it is unsafe.

Fig. 3 illustrates the general types of loss scenarios that can be identified from STPA. Loss scenarios can be of two types, ‘Type A and Type B’ (Leveson and Thomas, 2018). Type A loss scenarios are identified to understand why the UCA would occur. CAs provided by the process model could inevitably be unsafe if its belief is inadequate, which could be due to missing feedbacks, feedbacks from sensors that are incorrectly received, the inadequate CAs from other controllers, flawed control algorithm within the controller, or inability of the controller to issue the CA due to its internal malfunctions. Type B Loss Scenarios identify why correct CAs are improperly executed or not executed, leading to a hazard. This could be due to communication issues between the controller and the controlled process, conflicted controls, or the malfunctioning actuators. Considering the example UCA-2 in Table 1, ‘Government’ provides incorrect ‘Furlough’ (with insufficient amount of payments) when R > 1 and employees are redundant and unable to find new jobs. ‘Government’ as a controller has its built-in process model that incorrectly believes that the provided ‘Furlough’ is correct, which may partially be due to the inadequate feedback it receives from the ‘Organizations’ regarding their employees’ status (i.e. Type A loss scenario), or due to the inadequate communications between ‘Government’ and ‘Organizations’, leading to misinterpretations of the furlough scheme (i.e. Type B loss scenario).

Fig. 3

General types of loss scenarios that can be identified from STPA.

For each CF identified, corresponding requirements are proposed either to prevent the CF or to enable the system to detect the CF. Ideally, the CF shall be prevented as a top priority to avoid the UCA. However, it is also possible that the CF cannot be prevented and therefore, the redundant requirement may be proposed so that the CF is detected, hence minimizing the potential effects of hazards caused by that CF.

Results

This section describes the STPA on COVID-19 pandemic following the aforementioned 4 steps of the process. The system consists of three main stakeholders, including the government, different organizations, and the general public. Government may provide updated regulations to different organizations and the public as a way of controlling the spread of the virus and reducing the loss of economic stability. The organizations include various functionalities, including vaccine research that aims at developing the vaccine to protect people from infection, public health service that provides treatments to patients or health guidances to the public, police & military that serves as the actuators of governmental regulations and ensures that people are following the regulations, essential service providing companies that have key workers to provide essential productions (e.g. ventilators, PPEs) or service (e.g. deliveries, supermarkets), and non-essential service providing companies.

To start with, a list of losses were identified as presented in Table 2 . It is worth noting that neither L-2 nor L-3 are safety–critical losses, but they are indeed unacceptable.

Table 2

A list of losses.

Losses
L-1	Loss of human life/damage to physical/mental health and wellbeing (e.g. long term concerns with COVID-19)
L-2	Loss of economic stability (e.g. closure of businesses/increase in unemployment, decrease in purchasing power)
L-3	Loss of functioning democratic society (e.g. loss of freedom, human rights .etc.)

The analysis boundary captures the whole nation, which includes the government with functional departments responsible for controlling the COVID-19 pandemic, the relevant organizations, and the general public. The World Health Organization (W.H.O) and foreign governments are considered as outside the analysis boundary in this paper, and therefore the detailed analysis of these stakeholders is not presented. However, they are considered as parts of the system, because W.H.O may provide health standards and guidances to the government, and foreign governments may supply essential resources to the Public Health Service (PHS). Both could consequently affect how PHS prioritizes the treatments of different patients, as well as the way the treatments are provided.

A list of system-level hazards is described in Table 3 . It is important to note that the identified hazards represent the system-level state, and therefore the conditions of subsystems, including ‘Governments’, ‘Organizations’, and ‘General Public’, are not considered in this step. A system-level hazard may be associated with more than one loss. For example, the inequality in society (as per H-7) could lead to violence and therefore the loss of human life (as per L-1). The diversity of an organization could also be affected as a result of bias in the recruitment process, in which case a company might not be able to select the right person for the specific role. When this occurs in a high proportion of organizations, the economic stability could be affected (as per L-2). Furthermore, biased treatments also lead to the violation of equal rights (as per L-3).

Table 3

A list of national-level hazard.

System-Level Hazards		Link to Losses
H-1	Increase in the number of infected cases	L-1,2
H-2	Inability of companies/organizations to operate normally	L-2
H-3	Overwhelming health system in the nation	L-1
H-4	Lack of essential supply available in the nation	L-1,2,3
H-5	Public discontent in the nation	L-1,2
H-6	Panic buying in the nation	L-1
H-7	Inequality in society	L-1,2,3

For the initial iteration of the analysis, a high-level control structure was created as illustrated in Fig. 2. The control structure at this abstraction level mainly consisted of functional blocks relevant to COVID-19 that are represented by different stakeholders. The stakeholders that are governed by the CAs provided by ‘Government’, together with the ‘Government’, are considered to be inside the analysis boundary. This includes the ‘Government’ stakeholder itself, ‘Opposition Political Parties’, ‘Local Authorities & Councils’, ‘Organizations’, and ‘General Public’. There could also be other stakeholders outside the analysis boundary interacting with the internal stakeholders, including ‘W.H.O’ and ‘Foreign Governments’. Because ‘W.H.O’ may provide some health guidances to ‘Government’ and ‘Foreign Governments’ may restrict the access to their countries, which consequently affect the decisions made by ‘Government’. At this level of analysis, the functional blocks are considered as black boxes, and therefore only box-level interactions were considered.

During the COVID-19 pandemic, ‘Government’ may restrict access from other countries to minimize imported cases, by providing the CA ‘Entry Restrictions’. ‘Government’ may also require ‘General Public’ to follow the CAs ‘Social Distancing’ and ‘Health Regulations’. ‘Government’ may also update or invalidate these ‘Health Regulations’, which is partially dependent on the feedback they receive, including the ‘Health & Safety Guidance’ from ‘W.H.O’, ‘Alternative Policies’ proposed from ‘Opposition Political Parties’, ‘Reports’ from ‘Organizations’, or ‘Change Request’ from ‘General Public’. ‘General Public’ may also receive the CA ‘Legal Penalties’ if not following the rules. Similarly, The CA ‘Health Regulations’ may also be provided to ‘Organizations’ to ensure that employees are working safely, as well as making sure that the working places are reorganized to limit the number of staff inside at a time. ‘Organizations’ may also follow the CA ‘COVID-19 Standards & Work Policies’ from their ‘Local Authorities & Councils’.

Fig. 4 shows a more detailed level of the control structure, with the addition of details in each stakeholder – i.e. ‘Government’, ‘Organizations’, and ‘General Public’. ‘Media Platform’ was also added to the control structure, functioning as the communication channel between the subsystems. Inside the ‘Organizations’, the sub-functional blocks were split into four categories. First is the ‘Research Institutions’, which mainly focus on the ‘Vaccine Research’ projects for the COVID-19, subject to the CA ‘Project Request’ from ‘Department of Health and Social Care (DHSC)’. Depending on the research progress, ‘Vaccine Research’ may provide CA ‘Request Volunteers’ to ‘General Public’ for the trial of the vaccine prototype. The second category is related to ‘Public Services’, which consists of ‘PHS’ and ‘Police & Military’. Whilst ‘PHS’ may disseminate the up to date CA ‘Health Guidance’ or provide the CA ‘Treatments’ to ‘General Public’, ‘Police & Military’ perform as the actuators of CAs from ‘Government’ to minimize the spread of the virus, by issuing the CA ‘Legal Penalties’ to those who do not follow the rules. When faced with a significantly high demand of workforce, both ‘PHS’ and ‘Police & Military’ may provide CA ‘Recall retired Workforce’ to meet the demands. The third category includes the ‘Business’, which is further categorized as ‘Essential Service Providing Companies (ESPC)’ and ‘Non-Essential Service Providing Companies (NESPC)’. ‘ESPC’ may include companies providing utility services, delivery services, public transport, take-away services, and supermarkets. ‘ESPC’ may also include manufacturing companies producing essential supplies for both public and health care, such as productions for PPE, ventilators, and building temporary hospitals (Araya, 2021). ‘NESPC’ are also considered as part of the control structure as their working policy relevant to COVID-19 significantly affects the behavior of employees, who form a large proportion of the public (Ruiz-Frutos et al., 2021). The last category is ‘The Media’, which is considered as a stakeholder whose behavior may significantly affect the mind-set of ‘General Public’. This is because people increasingly rely on media to acquire information, such reliance is further increased due to restrictions on people’s activities during the COVID-19 pandemic (Huang and Chang, 2020). ‘The Media’ consists of ‘Media Companies’ that are responsible for managing ‘Media Platforms’ to ensure that correct information is disseminated, and ‘Influencers’, which may be an individual or a group of individuals who are using the ‘Media Platform’ to disseminate the information regarding COVID-19. The ‘Media Platform’ is not limited to social media, but can also include websites, newsletters, and televisions .etc. Other functional blocks may also use ‘Media Platform’ to maximize the effectiveness of their CA. For example, ‘Government’ may disseminate the CA ‘Health Regulations’ via televisions, ‘PHS’ may disseminate the CA ‘Health Guidance’ via their website, and ‘Police & Military’ may disseminate the request to ‘Recall retired Police workforce’ via newsletters.

Fig. 4

A detailed level of control structure.

The detailed level of control structure illustrated in Fig. 4 captures in total 37 CAs, this led to 236 UCAs. Some UCAs for the CA ‘Health Regulations’ were identified as presented in Table 4 . The original intention of providing the CA ‘Health Regulations’ is to minimize the rate of infections. The CA on its own is safe and reasonably needed. However, providing such CA might become unsafe when there is no COVID-19 pandemic (as per UCA-5.3.1), and the unnecessary regulation could lead to public discontent as well as a new wave of panic buying (as per H-5 and H-6). Providing the CA ‘Health Regulations’ at the wrong time could also be unsafe. For example, when ‘Police & Military’ have not yet been prepared for the new regulations (as per UCA-5.4.1), they might not be able to handle the disorder caused by the new regulations (as per H-5 and H-6). Similarly, if the ‘Health Regulations’ are rolled out by organizations too early (e.g. remote working, one-way system .etc), they might have no time to align their strategies with the new working policy (as per UCA-5.4.2). As a result, most companies might not be able to operate the businesses efficiently (as per H-2).

Table 4

Some UCAs resulted from COVID-19 Regulations.

CA	UCA Categories	UCAs
Health Regulations	Not Provided	UCA-5.1.1: ‘Government’ does not provide ‘Health Regulations’ when the COVID-19 pandemic is severe. [H-1]
	Provided incorrectly / when not needed	UCA-5.2.1: ‘Government’ provides incorrect ‘Health Regulations’ when COVID-19 pandemic is severe. [H-1]
		UCA-5.3.1: ‘Government’ provides Health Regulations when COVID-19 pandemic is minor/resolved. [H-5,6]
	Provided too early / too late	UCA-5.4.1: ‘Government’ provides ‘Health Regulations’ too early when the police workforce is not ready to handle the emergent incidents. [H-5,6]
		UCA-5.4.2: ‘Government’ provides ‘Health Regulations’ too early when organizations are not ready to align their strategies with the new policy. [H-2]
		UCA-5.5.1: ‘Government’ provides ‘Health Regulations’ too late when the COVID-19 pandemic is already severe. [H-1]
	Provided too long / too short	UCA-5.6.1: ‘Government’ provides ‘Health Regulations’ too long when COVID-19 pandemic is already minor/resolved. [H-5,6]
		UCA-5.7.1: ‘Government’ stops providing ‘Health Regulations’ too soon when the COVID-19 pandemic is still severe. [H-1]

In Table 5 , some UCAs related to the CA ‘Treatment’ were identified. It is essential and important that the ‘PHS’ provides accurate treatment to patients. However, without adequate consideration of available resources in the hospital, the decisions on arranging treatments might become unsafe to those patients who are in greater need of hospital resources but could not receive the treatment. This is vital in the current COVID-19 pandemic due to the very limited resources available in hospitals, including workforces in hospitals, PPEs, ventilators, and available spaces in ICUs. As captured in UCA-37.3.1, providing the CA ‘Treatment’ to patients who have minor COVID-19 related symptoms could result in health systems being overwhelmed (i.e. H-3). Advising patients with minor COVID-19 symptoms to stay at home would then become a wiser decision to minimize the number of deaths. However, the same decision may also be unsafe for patients with similar symptoms but who are suffering from other diseases (as per UCA-37.2.1). Furthermore, correct ‘Treatment’ could also be unsafe when the patient is not ready for the treatment (as per UCA-37.4.1), or when it is implemented too late after it has passed the best time for treatment (as per UCA-37.5.1).

Table 5

Some UCAs resulted from Treatment & Advice.

CA	UCA Categories	UCAs
Treatment	Not Provided	UCA-37.1.1: ‘PHS’ does not provide ‘Treatment’ when the patient is severely ill (including COVID-19 and other diseases). [H-1,5,7]
	Provided incorrectly / when not needed	UCA-37.2.1: ‘PHS’ provides incorrect ‘Treatment’ (e.g. advice the patient to stay at home) when the health system is not overwhelmed and the patient has built symptoms similar to COVID-19 but it is another disease. [H-1,5]
		UCA-37.2.2: ‘PHS’ provides incorrect ‘Treatment’ (e.g. excessive dose, incorrect type of treatment) when the patient only has minor symptoms. [H-1,3,5]
		UCA-37.3.1: ‘PHS’ provides ‘Treatment’ when the patient have minor symptoms and there are limited spaces/workforce available [H-3]
	Provided too early / too late	UCA-37.4.1: ‘PHS’ provides ‘Treatment’ too early when the patient is not ready for it (either physically or mentally). [H-1,3,5]
		UCA-37.5.1: ‘PHS’ provides ‘Treatment’ too late when the patient has severe illness and already passed the best time for treatment. [H-1,5,7]
	Provided too long / too short	UCA-37.6.1: ‘PHS’ provides ‘Treatment’ too long when the treatment has already been completed. [H-1,3,5]
		UCA-37.7.1: ‘PHS’ stops providing treatment too soon when the patient is still suffering from severe illness. [H-1]

Table 6 captures some UCAs related to vaccine research. As part of the testing phases, volunteers are needed to validate the research results. During the COVID-19 pandemic, the time allowed for vaccine research is extremely tight. The safety arrangements during vaccine testing could therefore be easily overlooked (as per UCA-16.4.1). This includes the COVID-19 related rules such as social distancing, a stricter requirement on sanitizations as well as the one-way systems. Without these safety arrangements, volunteers are at a higher risk of infection (as per H-1) and the testing result would also become invalid, causing more delays in the research progress.

Table 6

Some UCAs resulted from Request for Volunteers.

CA	UCA Guidewords	UCAs
Request for Volunteers	Not Provided	UCA-16.1.1: ‘Vaccine Research’ does not request for volunteers when R > 1, there are no therapies, and research has reached the testing phase. [H-3,5]
	Provided incorrectly / when not needed	UCA-16.2.1: ‘Vaccine Research’ requests for volunteers incorrectly (e.g. incorrect requirements of the volunteers, incorrect procedure during the testing, etc.) when R > 1, there are no therapies, and research timing is critical. [H-1,3,5]
		UCA-16.3.1: ‘Vaccine Research’ requests for volunteers when R > 1 and there is no safety arrangements for testing. [H-1,3,5]
	Provided too early / too late	UCA-16.4.1: ‘Vaccine Research’ requests volunteers too early when R > 1 and the safety arrangements for the volunteers is not ready yet. [H-1,3,5]
		UCA-16.5.1: ‘Vaccine Research’ requests for volunteers too late when R > 1, there are no therapies, and research already reached the testing phase. [H-3,5,6]
	Provided too long / too short	UCA-16.7.1: ‘Vaccine Research’ stops requesting volunteers too soon when R > 1, there are still no therapies, and testing has not been completed yet. [H-3,5]

Once the UCAs had been identified, possible loss scenarios of the UCAs were then derived. For each UCA, there are many possible loss scenarios and causal factors. In this section, three example UCAs identified in Section 3.3 are analyzed further. In total, 12 causal factors, 3 loss scenarios, and 6 requirements were presented.

UCA- 5.4.1 (‘Health Regulations’ CA from ‘Government’)

UCA-5.4.1 (from Table 4 ): ‘Government’ provides ‘Health Regulations’ too early when the police workforce is not ready to handle the emergent incidents. [H-5, 6]

Fig. 5 shows the control loop for UCA-5.4.1. To identify the loss scenarios for the UCA, the beliefs of the process model (i.e. ‘Government’) at the time when the UCA occurred were identified first:

Fig. 5

Control loop of the CA ‘Health Regulations’ from ‘Government’

Process Model Beliefs for UCA-5.4.1:

B-1: ‘Government’ was believing that they were providing Health Regulations at the correct time.

B-2: ‘Government’ was believing that police had been well prepared to handle the incidents arising from the enforcement of the new regulations.

Secondly, the reasons behind each of the process model beliefs above were identified.

Reasons for Process Model Belief B-2:

B-2.1: ‘Government’ was believing that because they were referring to the ‘Status Report’ from ‘Police & Military’ to determine their workforce status.

And lastly, the CFs triggering each of the reasons were identified. Considering B-2.1, which is the reason for the process model belief B-2, some of the CFs which were identified are presented below:

CFs of B-2.1:

CF-2.1.1: The ‘Status Report’ feedback from ‘Police & Military’ was not updated properly. [Type A]

CF-2.1.2: The ‘Status Report’ feedback from ‘Police & Military’ was correctly updated, but due to inadequate communications, it was incorrectly received by ‘Government’. [Type A]

CF-2.1.3: The ‘Status Report’ feedback from ‘Police & Military’ was correctly updated, but misinterpreted by ‘Government’. [Type A]

Once identified CFs, the loss scenarios were summarized to link different process model beliefs, reasons for the process model beliefs, and the CFs, followed by two requirements proposed to either avoid the CF or to minimize the potential hazardous effects of the CF. One of the loss scenarios and its two requirements for CF-2.1.1 were proposed as shown below:

Loss Scenario linking B-1, B-1.1, and CF-2.1.1:

‘Government’ was incorrectly believing that the ‘Police & Military’ had been well prepared to handle the potential incidents arising from the updated ‘Health Regulations’ because it was referring to the ‘Status Report’ from ‘Police & Military’ to determine their workforce status. However, due to the outdated ‘Status Report’, the ‘Health Regulations’ was provided too early.

Requirements for CF-2.1.1:

Requirement to prevent CF-2.1.1: ‘Police & Military’ shall always provide up to date ‘Status Report’ to ‘Government’.

Requirement to detect CF-2.1.1: ‘Government’ shall always request up to date ‘Status Reports’ from ‘Police & Military’ before disseminating updated regulations.

UCA-37.2.1 (‘Treatment’ CA from ‘PHS’)

UCA-37.2.1 (from Table 5 ): ‘PHS’ provides incorrect ‘Treatment’ (e.g. advice the patient to stay at home) when the health system is not overwhelmed and the patient has built symptoms similar to COVID-19 but it is another disease. [H-1, 5]

Fig. 6 shows the control loop for UCA-37.2.1. To identify the loss scenarios of the UCA, the beliefs of the process model (i.e. ‘PHS’) when the UCA was executing, were identified first:

Fig. 6

Control loop of the CA ‘Treatment’ from ‘PHS’

Process Model Beliefs for UCA-37.2.1:

B-1: ‘PHS’ was believing that they were providing correct advice.

B-2: ‘PHS’ was believing that the health system was nearly overwhelmed.

B-3: ‘PHS’ was believing that the patient had built COVID-19 related symptoms.

Secondly, the reasons for each of the process model beliefs above were identified. Some of the reasons for the process model beliefs B-2 and B-3 are summarized below:

Reasons for Process Model Belief B-2:

B-2.1: ‘PHS’ was believing that because they were referring to the ‘Supplied Resources’ from ‘Government’ to determine the health system capacity.

B-2.2: ‘PHS’ was believing that because they were referring to the ‘Available Supply’ feedback from ‘Foreign Governments’ to determine the health system capacity.

B-2.3: ‘PHS’ was believing that because they were referring to the ‘Production & Construction Reports’ from ‘Essential Service Providing Companies (ESPC)’ to determine the health system capacity.

Reasons for Process Model Belief B-3:

B-3.1: ‘PHS’ was believing that because they were referring to the ‘Individual Report’ from ‘Patients’ to diagnose their health status.

And lastly, the CFs triggering each of the reasons were identified. Considering B-2.3 and B-3.1, which are the reasons for the process model belief B-2 and B-3, some of the CFs which were identified are summarized below:

CFs of B-2.3:

CF-2.3.1: ‘Ventilator Production Report’ from ‘ESPC’ was incorrect/misinterpreted. [Type A]

CF-2.3.2: ‘PPE Production Report’ from ‘ESPC’ was incorrect/misinterpreted. [Type A]

CF-2.3.3: ‘Hospital Construction Report’ from ‘ESPC’ was incorrect/misinterpreted. [Type A]

CF-2.3.4: The process of calculating the available supplies based on feedbacks from ‘Government’, ‘Foreign Government’, and ‘ESPC’ was incorrect. [Type A]

CFs of B-3.1:

CF-3.1.1: The ‘Individual Report’ feedback from ‘Patient’ was incorrect/not complete. [Type A]

CF-3.1.2: The ‘Individual Report’ feedback from ‘Patient’ was correct, but due to inadequate communications, it was incorrectly received by ‘PHS’. [Type A]

CF-3.1.3: The ‘Individual Report’ feedback from ‘Patient’ was correct, but misinterpreted by ‘PHS’. [Type A]

Once identified CFs, the loss scenarios were summarized to link different process model beliefs, reasons for the process model beliefs, and the CFs, followed by two requirements proposed to either avoid the CF or to minimize the potential hazardous effects of the CF. One of the loss scenarios and its two requirements for CF-3.1.1 were proposed as shown below:

Loss Scenario linking B-3, B-3.1, and CF-3.1.1:

‘PHS’ was incorrectly believing that the provided ‘Treatment’ was correct because it was referring to the ‘Individual Report’ from ‘Patient’ to determine his/her health status. However, due to the incorrect ‘Individual Report’, the provided ‘Treatment’ was incorrect.

Requirements for CF-3.1.1:

Requirement to prevent CF-3.1.1: ‘Patient’ shall always provide accurate and complete descriptions of their illness.

Requirement to detect CF-3.1.1: ‘PHS’ shall acquire adequate information from ‘Patient’ until they are certain about the diagnostic results.

UCA-16.2.1 (‘Request for Volunteers’ CA from ‘Vaccine Research’)

UCA-16.2.1 (from Table 6 ): ‘Vaccine Research’ requests for volunteers incorrectly (e.g. incorrect requirements of the volunteers, incorrect procedure during the testing, etc.) when R > 1, there are no therapies, and research timing is critical. [H-1, 3, 5]

Fig. 7 shows the control loop for UCA-16.2.1. To identify the loss scenarios of the UCA, the process model beliefs (i.e. ‘Vaccine Research’) were first identified:

Fig. 7

Control loop of the CA ‘Request for Volunteers’ from ‘Vaccine Research’

Process Model Beliefs for UCA-16.2.1:

B-1: ‘Vaccine Research’ was believing that they were disseminating correct requests (i.e. correct volunteer requirements, correct introduction to the procedure).

B-2: ‘Vaccine Research’ was believing that R < 1.

Secondly, the reasons for each of the process model beliefs were identified. Considering the reasons for process model belief B-1 above, some of the reasons which were identified are presented below:

Reasons for Process Model Belief B-1:

B-1.1: ‘Vaccine Research’ was believing that because it was following the procedure to request volunteers.

B-1.2: ‘Vaccine Research’ was believing that because there was no feedback from ‘PHS’ suggesting that the request is not valid.

B-1.3: ‘Vaccine Research’ was believing that because it was referring to the ‘Case Report’ feedback from ‘Volunteers’ to make the decision.

And lastly, the CFs triggering each of the reasons were identified. Considering B-1.1, which is the reason for the process model belief B-1, some of the CFs which were captured are shown below:

CFs of B-1.1:

CF-1.1.1: The specified procedure determining the ‘Request for Volunteers’ is flawed. [Type A]

CF-1.1.2: Correct request was sent out from ‘Vaccine Research’, but due to malfunctioning ‘Media Platform’, it was incorrectly propagated. [Type B]

CF-1.1.3: Correct request was issued from ‘Vaccine Research’, but due to communication errors between ‘Vaccine Research’ and ‘Media Platform’, the received CA was incorrect. [Type B]

CF-1.1.4: Correct request was sent out from ‘Vaccine Research’, but due to communication errors between ‘Media Platform’ and ‘Volunteers’, the received CA was incorrect. [Type B]

CF-1.1.5: Correct request was sent out from ‘Vaccine Research’, but it was too complicated and therefore misinterpreted by the ‘Volunteers’. [Type B]

Once identified CFs, the loss scenarios were summarized to link different process model beliefs, reasons for the process models, and the CFs, followed by two requirements proposed to either avoid the CF or to minimize the potential hazardous effects of the CF. One of the loss scenarios and its two requirements for CF-1.1.2 were proposed as shown below:

Loss Scenario linking B-1, B-1.1, and CF-1.1.2:

‘Vaccine Research’ was incorrectly believing that the ‘Request for Volunteers’ was propagated to ‘General Public’ correctly because it was following the procedure to disseminate the request. However, due to the inadequate operation of the ‘Media Platform’, the request was incorrectly propagated.

Requirements for CF-1.1.2:

Requirement to prevent CF-1.1.2: ‘Media Platforms’ shall always function correctly to ensure that information disseminated is intended.

Requirement to detect CF-1.1.2: ‘Vaccine Research’ shall be aware of the incorrect information disseminated from ‘Media Platform’.

Discussion

Due to the uncertainties during the COVID-19 pandemic and the complex interactions among the governments, organizations, and public, STPA has been applied to a national response to the COVID-19 pandemic to identify possible loss scenarios and their causal factors that could lead to inefficient or ineffective response to the COVID-19 pandemic, as well as proposing requirements to avoid such loss scenarios.

In Section 3.4, three example UCAs were analyzed further to identify their possible loss scenarios. Identifying UCAs includes the identification of the contexts in which the UCAs are executed, which helps analysts understand the interactions with other subsystems and the external elements. Loss scenarios of ‘Government’ providing ‘Health Regulations’ CA at incorrect time (i.e. UCA-5.4.1 from Table 4) were identified in Section 3.4.1. During the COVID-19 pandemic, executing COVID-19 related health regulations as early as possible maximizes its effectiveness (Duy et al., 2015). However, the effectiveness of the regulation cannot be guaranteed without the support from Police & Military (Frenkel et al., 2020). From this example, we identified possible loss scenarios for the inadequate cooperation between ‘Government’ and ‘Police & Military’. By analyzing the control loop in Fig. 5 for the CA ‘Health Regulations’, we found that the inadequate process within ‘Government’ could lead to the ‘Health Regulations’ being effective at an inappropriate time, hence triggering the belief of ‘Government’ that they were issuing the ‘Health Regulation’ at the right time (as per B-1). The miscommunications between ‘Police & Military’ and ‘Government’ could also trigger UCA-5.4.1. ‘Government’ might have created the new regulations based on the outdated information from ‘Police & Military’ (as per CF-2.1.1), incorrectly believing that they still have a sufficient workforce to enforce the new regulations, thereby reducing the effectiveness of the regulations. To avoid the causal factors identified in Section 3.4.1 – i.e. CF-2.1.1 (i.e. outdated ‘Status Report’), and consequently UCA-5.4.1, ‘Police & Military’ must provide up to date ‘Status Report’ before regulations are updated (as per requirement to prevent CF-37.2.1). In the circumstance that ‘Police & Military’ are not able to provide the updated report, ‘Government’ shall always request the up to date report before changing the regulations (as per requirement to detect CF-37.2.1).

In the second example UCA (UCA-37.2.1), the causes of incorrect advice (as part of the CA ‘Treatment’) were identified. Considering the peak period of the COVID-19 pandemic in the UK in March 2020 as an example, when daily infected cases exceed 10,000, the total number of emergency calls received during that month reached nearly 3 million (Vestesson and Gardner, 2020). Due to the limited number of call handlers available, >1.5 million calls could not be answered (Vestesson and Gardner, 2020). Within those answered calls, most of them were seeking advisories on COVID-19 related symptoms. An emergency call dispatcher, who was continuously handling COVID-19 related calls, might have been well trained to advise people with mild COVID-19 symptoms to stay at home (Penverne et al., 2020). However, when someone who was suffering from other diseases but with similar symptoms to COVID-19 made the emergency call, they could also receive the same response – i.e. to stay at home. Sadly, this UCA was reflected by the passing of a Chinese student from the University of Leicester, who passed away due to meningitis in March 2020 (Zhao Junwei, n.d.). Due to the similarities in symptoms between meningitis and COVID-19, the student was advised to stay at home, and unfortunately, he missed the best time to receive appropriate treatment.

Whilst what has happened cannot be changed, it is much more important to prevent similar accidents from happening in the future. When the dispatcher was advising the patients to stay at home, he might be equipped with several beliefs. Firstly, the dispatcher might have realized that the patient had a different disease (non-COVID-19), but was still believing that staying at home was the best option (as per B-1). Secondly, the dispatcher was concerned about the limited capacity of the health system and was still believing that the health system was overwhelmed (as per B-2, although it was not) (Wang et al., 2020). And lastly, based on what the patient described, the symptoms seemed to be built from COVID-19, which was what the dispatcher was believing (as per B-3). Whilst all three beliefs can be prevented by providing the dispatchers with adequate pieces of training to enable them to make more precise decisions, both B-2 and B-3 also require improvements in other parts of the system. For B-2 (i.e. believing that the health system was overwhelmed), reports on the available supply (including PPE, ventilator, and temp. hospitals) shall always be up to date, so that when there is sufficient supply, the dispatcher does not subjectively advise the patient to stay at home due to his incorrect belief that the health system has been overwhelmed. In B-3 (i.e. believing that the symptom was COVID-19), it is very common that the patients by themselves have no idea as to what happened to them. In an urgent situation, the information they provided to dispatchers might be inaccurate or incomplete, or even misinterpreted (as per CF-3.1.1). The call dispatchers shall ensure that patients provide accurate and complete information (as per the requirement to prevent CF-3.1.1), or if the call dispatchers are unsure about the information received, they shall guide the patients to provide accurate and complete information about their illness, to aid the diagnosis (as per the requirement to detect CF-3.1.1).

The third example UCA (UCA-16.2.1) captured the incorrect request provided from ‘Vaccine Research’ to ‘Volunteers’, via ‘Media Platforms’. To speed up the process of vaccine testing, the vaccine research team was seeking appropriate volunteers. The information regarding criteria for volunteers, as well as the procedures during testing, were created, which were disseminated via media platforms. This includes social media, websites, or newsletters. Although the members of vaccine research have received trainings to create this information, the information sent could still be incorrect if the trainings are insufficient or inadequate (as per CF-3.1.1). It is also likely that the media account was hacked and incorrect information was disseminated (as per CF-3.1.2). As part of the requirements to avoid such loss scenarios, the security of media accounts shall always be well maintained. Considering the process model belief B-2 – i.e. the research team was believing that the reproduction rate has dropped (i.e. R < 1), according to the control loop illustrated in Fig. 7, the incorrect information from the media platform could trigger process model belief B-2. Newman & Fletcher carried out an in-depth survey and analysis of consumer perceptions of the quality of news in nine countries (Newman and Fletcher, 2017, Martens et al., 2018). They found that people do not operate with categorical distinctions between ‘fake’ and ‘real’ news but rather see the difference as one of degree. It is human nature to believe what they want to believe (Moravec et al., 2018). With the addition of cookie-based machine learning and customized settings in notifications, the diversities in categories of news people can see, are becoming even more limited (Loni et al., 2019). To ensure that vaccine research teams always receive correct and objective news, they must avoid enabling any subjective settings on the information received. As captured in other parts of the control structure, it is also the responsibility of ‘Media Companies’ to filter out fake news or to provide legal penalties to the corresponding owners. ‘Vaccine Research’ may also believe that the COVID-19 reproduction rate is low, based on the information they have received from ‘Government’. As illustrated in Fig. 7, both the outdated COVID-19 regulations and guidances could trigger such beliefs. Besides, the outdated information from the ‘Government’ could also mislead research teams to believe that they have made the correct safety arrangements (as per B-3). Such beliefs might be continuously maintained if no legal penalties are issued by the Government.

When we first came up with the idea of analyzing the national COVID-19 pandemic, we found out that the information we had on the pandemic was very limited. One of the main reasons we chose STPA was that it does not require full information to be acquired before the analysis can be initiated. In the initial phase of our analysis, the control structure only consisted of very high-level sub-system blocks, including ‘W.H.O’, ‘Government’, ‘Organizations’, and ‘General Public’. As we proceeded with the analysis, we acquired more knowledge in terms of how different departments within the ‘Government’ cooperate, and different categories of ‘Organizations’, as well as the interactions with ‘Foreign Governments’. We then added corresponding sub-blocks into the initial version of the control structure. Besides, as a top-down approach, STPA starts from the identification of unacceptable events (i.e. losses), and the rest of the process will then guide analysts to identify how unsafe interactions among the functional blocks could lead to such losses. Since we already knew the goals – i.e. to minimize the spread of coronavirus and the economic depression, thus creating a new, and safe normality, the rest of the analysis identified potential unsafe scenarios in contravention of the goals. Additionally, since the outputs at different stages of the analysis were assigned with ID numbers, the traceability diagram can then be easily created. This significantly enhances system maintainability and evolution. As part of future work, to avoid similar hazards during potential new waves of the pandemic, it is important to create warning signs based on the requirements identified from the analysis. These warning signs can be used as prospective measures to identify the potential for an accident before it occurs. STPA methodology can be extended to generate system-specific leading indicators (Leveson, 2015). These leading indicators will be used to monitor the assumptions upon which the safety of the system was assured, both to find assumptions that originally were incorrect and those that have become incorrect over time.

Conclusion

The COVID-19 pandemic has affected most aspects of daily life. Although governments have proposed relevant regulations to control the spread of the virus and minimize the economic depression, the complex nature of the interactions between the stakeholders (i.e. governments, organizations, and public) brings massive challenges to the stakeholders to make appropriate decisions. The STPA on the response to the COVID-19 pandemic was therefore initiated to identify improvements needed (if any) in the national response to minimize the spread of the virus and the economic depression due to the pandemic. In this paper, we presented the control structure of the system at two abstraction levels. We then presented three example UCAs from three different stakeholders of the system – i.e. ‘Government’, ‘PHS’, and ‘Vaccine Research’. It was also emphasized that each UCA could be triggered by a diverse range of CFs, including miscommunications, flawed processes, processing delays, misinterpreted CAs, while the failure of the controller only represents a small part of the CFs. For each CF identified, the requirements to avoid or to minimize the potential hazardous effects of the CF were proposed. This includes the requirements on ‘Government’ to ensure that they are aware of the updated status of ‘Police & Military’ before updating any regulations, and the requirements on ‘PHS’ to ensure that accurate information of patients’ status is always acquired before providing any advice or treatments.

In the complete STPA, we identified in total 37 CAs, which led to 236 UCAs. This included 53 UCAs from ‘Government’, 28 UCAs from ‘PHS’, and 12 UCAs from ‘Vaccine Research’. From these 236 UCAs, 1440 CFs were captured, followed by the identification of 2880 requirements.