Aligning Stakeholders and Actors: A New Safety and Security-Based Design Approach for Major National Infrastructures

Abstract

This study introduces a systems-theoretic methodology to meet the requirements of a major national infrastructure for safety and security-based design by enhancing the alignment of stakeholders and actors in the project. Safe-by-Design (SbD) is an engineering concept for risk management that considers safety as much as possible in the design phase. The article presents the results of a case study conducted to investigate the efficacy of recent system safety models and analysis techniques in the major national infrastructure of a Waste-to-Energy (WtE) project under consideration in Iceland. The structures and roles within the system responsible for constructing the WtE plant, given the sustainability and circular economy restrictions, are addressed in the study. Stakeholders’ roles and responsibilities are analyzed, yielding their feedback on potential risks and creating a positive image of the project. Also, suitable ways to enter the project and finance it are devised. In essence, this enables the creation of a safety and security-based design approach. Furthermore, detailed documentation of the system model development is presented. The novelty of the study lies in the application of STAM, STPA, and STECA as an SbD approach for a major infrastructure project. Also, the methods discussed here have not been used in a WtE project as far as we know.

1. Introduction

This study was conducted to investigate a relatively new methodology and techniques, still in development, for solving the objectives of a safety and security-based design of a major national infrastructure. The research objectives were tested on a specific project, a WtE project that can have significant and diverse impacts on people and the environment. It is feared that it may have many safety and security issues unless they are considered from the beginning, as well as risks being identified and met appropriately during decision making at all stages of the project from the start. The safety and security issues people fear are, e.g., harmful long-term effects on the health of people and nature in the vicinity of the incineration plant, odor pollution, smoke pollution, visual pollution, noise pollution, weight of traffic due to heavy transport with waste, carbon offsets, secure financing for construction and operation, and increased costs for the public and local authorities for waste disposal and treatment.

The project chosen for the analysis is at an early stage, and a detailed analysis and validation of all aspects is needed, i.a., assessment of the amount of waste to be incinerated in the coming decades, the size of the incinerator, and the scope of the entire project. Then, a suitable place needs to be selected for the incineration plant. It has to be designed in accordance with the environment and nature of the place, and possible transport routes on land and at sea must be analyzed. Furthermore, technical solutions must be selected so that the incineration will be as efficient as possible, the cleaning process must be designed, and the associated cleaning equipment must be selected, together with various monitoring and warning systems, control systems, and automation of various kinds. When looking at all these factors, it is also important to assume a suitable ownership arrangement, such that those involved in the project from the beginning will have the means, the will, and the ability to build and operate a WtE incineration plant, so that they can live up to the responsibility they take on in the project. Various laws and regulations apply to this kind of project, including the EU market and competition laws, which affect the forms of businesses. There is, for example, a distinction made between the tendering obligations of governmental entities and private entities regarding public service projects and competitive business operations.

The SbD concept has gained ground and has been applied in engineering in recent years. In SbD, emphasis is put on responsible research and innovation, with a focus on safety and security about other important values such as well-being, sustainability, equality, and affordability [1,2,3,4]. SbD envisages an intellectual platform where the social sciences and humanities work together for technological development and innovation by helping to proactively incorporate safety considerations into engineering practices, while navigating between the extremes of technological optimism and excessive caution. In this way, SbD is also a practical tool for policy makers and risk assessors in designing management structures to encourage and meet safety and security requirements, while simultaneously acknowledging uncertainty [1]. It is challenging to find ways to reduce uncertainties that accompany modern systems with the complex interactions and emergent behavior that are inherent in present-day socio-technical systems. Dealing with uncertain risks requires measures different from those used in traditional risk assessment. For the risk management process to capture this, it should involve the co-evolution of knowledge, especially when risk data prove insufficient in the early stages of development. The concept of SbD enables this by engaging different stakeholders throughout the development process [2]. The expectations of different stakeholders towards SbD are not aligned. One way to resolve this issue is to make the viewpoints and expectations of others understandable and transparent to each other. For this to happen, communication between stakeholder groups must be enabled. It is essential to realize the importance of the design process in determining the level of safety and security during the use of a system or product. In such a process, it is necessary to ensure that the designer has a coherent and systematic way of considering possible safety and security problems and how to avoid them [3]. It is also argued that rather than directly designing for safety and security, it would be better to design with regard to responsibility for safety and security. Therefore, designers should also analyze where the responsibility for safety and security is best situated and design systems and technology accordingly [4].

The Cambridge Dictionary defines an actor as “a person or an organization that is involved in politics, society, etc. in some way because of their actions” (https://dictionary.cambridge.org/dictionary/english/actor?q=Actor, accessed on 16 December 2023). A stakeholder is also defined as “a person such as an employee, customer, or citizen who is involved with an organization, society, etc. and therefore has responsibilities towards it and an interest in its success” (https://dictionary.cambridge.org/dictionary/english/stakeholder?q=Stakeholder, accessed on 16 December 2023). In economic terms, this can be “an employee, investor, customer, etc. who is involved in or buys from a business and has an interest in its success”. Miles [5] discusses a stakeholder theory classification and recalls an early but comprehensive definition of a stakeholder, based on a dependency from which stakeholder power is derived. It states that actors may, e.g., provide essential raw materials, may control key marketing channels or resources, or may possess control over the organization’s financial well-being. Because the organization is dependent on the actors for their cooperation, the actors can influence the actions of the firm. It is also argued that an actor cannot be a stakeholder without being in an actual relationship with the organization.

In the case analyzed here, the system is a major national infrastructure that concerns the interests of all citizens of Iceland. According to law, the country’s local authorities (municipalities) are responsible for waste management, both for homes (individuals) and companies. According to law, these parties are responsible for sorting waste and must pay for the waste management service. According to the definition of actors and stakeholders, all citizens of Iceland are both actors and stakeholders in the system analyzed in this study.

Stakeholders can, furthermore, be viewed as both internal and external according to the nature of their relationships with the system [6,7]. Internal stakeholders help with organizational efficiency through production decisions. In contrast, external stakeholders help in aiding the organizational effectiveness through participative decision making, which involves an evaluation of the organization’s legitimacy and the supply of resources to the organization [8]. Internal stakeholders include parties who are internal to the system or logically connected, e.g., employees, internal parties, and functional divisions of the system. External stakeholders include, e.g., regulators, competitors, and parties not logically connected. Since the system analyzed in this article does not yet exist, the decisions regarding stakeholders are only possible based on laws and regulations. In the beginning, the only internal stakeholders will be local authorities that already have legal responsibility. When decisions about the system are made, it will become clear who is directly involved in the project and will, thus, become an internal stakeholder. Others, e.g., regulators, will remain external stakeholders. Still other parties, e.g., the public administration, including the police, the judicial system, and the Directorate of Labor in Iceland, will certainly be actors, but will not have a direct interest in the system and are, therefore, not considered stakeholders in this analysis.

This study is based on a feasibility study conducted on a WtE project and published in December 2021 [9]. A group of experts within academia and industry worked together on the study to find a future solution for the treatment of combustible waste instead of landfills in Iceland. The feasibility study also included a pre-risk analysis with three different risks and hazards analysis techniques. One of those techniques is the systems theory (https://www.sciencedirect.com/topics/psychology/systems-theory, accessed on 12 November 2023) method Systems-Theoretic Process Analysis, STPA [10,11]. STPA is based on Systems-Theoretic Accident Model and Processes, STAMP, which is a causality accident modeling technique for identifying system hazards and safety-related constraints necessary to ensure acceptable risk in complex systems [10,11,12]. Given that a STAMP system model exists, STPA can be used to generate detailed safety requirements to prevent the occurrence of the identified hazardous scenarios. It is a top-down process addressing system components interactions and hazards/threats such as design errors and component interaction failures. STPA can be used for any system property, including cybersecurity. Due to limitations of the feasibility study, i.a., a short time frame, a vague system model, and a lack of knowledge about stakeholders and their relations and responsibilities, it was not possible to complete the analysis at the time.

With increasing demand for sustainability, transparency, and environmental protection, the scope of management and the responsibilities of managers are also growing. Management systems are often based on ISO standards like ISO 9001 for quality management systems [13], ISO 14001 for environmental management systems [14], ISO 27001 for information security management systems [15], and ISO 45001 for management systems of occupational health and safety [16], and previous research shows the growing importance of risk management in such systems and standards [17]. Recent articles also show the importance of accredited certification of management systems and businesses in “green” projects (https://www.researchgate.net/publication/301123031_Green_Project_Requirements_and_Strategies, accessed on 12 November 2023) like the one studied in this article [18,19,20].

Another study [21] shows evidence of flaws and risk issues in ISO-certified risk management systems. The study also shows that not all risk factors have been identified with conventional methods. Inconsistencies in risk terminology and lack of guidance in the standards have caused uncertainty regarding the identification, analysis, and management of risk. Therefore, certain weaknesses and flaws in risk management are evident in practice. The study also shows that with STPA, risk factors have been identified that could not be identified with previous methods based on ISO/IEC standards.

The authors’ motivation originated in verifying feasibility and identifying risk factors in an important WtE project concept that promotes sustainability and will become an important element in the circular economy of an entire nation if executed. All aspects of the project concept must be analyzed as well as possible, creating an understanding of risk factors, and contributing to the best possible decision making during the preparation, design, and construction phases. Compensating later for making poor decisions, including those affecting safety and security, can be very ineffective and costly, as illustrated in Figure 1.

The authors’ motivation for this study, furthermore, originated in decades of experience in applying ISO standards in ISO-certified management systems, as project managers, as directors, and as internal and external auditors. Experience has shown that identification and analysis of risk is an important but challenging factor in modern systems, not least during the preparation and design phases of projects and in the decision-making process. It provides the foundation for effective risk treatment, in decision making, design, development, production, construction, and operation. Conventional methods like Fault Tree Analysis and Failure Mode and Effects Analysis are not adequate for risk identification and analysis in complex socio-technical systems with many layers and interactions between individual system elements [11,22,24]. Such systems are non-linear, and time is an important factor, as is known from both systems theory (https://www.sciencedirect.com/topics/psychology/systems-theory, accessed on 12 November 2023) and control theory (https://www.sciencedirect.com/topics/social-sciences/control-theory, accessed on 12 November 2023). New methods and techniques are required to analyze risk in such systems. Therefore, the authors of this study want to investigate the efficacy of the relatively newly developed STAMP method and the derived analysis techniques, STPA and the Systems-Theoretic Early Concept Analysis, STECA [22,25,26], to analyze risk.

In this study, the authors have applied STAMP, STPA, and STECA techniques to develop a system model of a WtE project in Iceland and its implementation with the necessary control structure. The model is used to verify the WtE project concept and how best to start it and ensure that it succeeds. Furthermore, it can be used to conduct decision making from the beginning, taking risk into account. The aim of this study was:

1.

To review the scientific literature on risk analysis conducted in recent WtE projects.

2.

To review recent literature on the application of STAMP, STPA, and STECA.

3.

To show how STAMP, STPA, and STECA can be applied to establish a system model that can then be used to confirm the concept, analyze the project risk, and define design requirements regarding risk in the early phases of the project.

4.

To compare the results from this study to the results from risk analyses presented in recent articles on WtE projects; see the literature review in Section 3.

The novelty of this study lies in the combined application of STAMP, STPA, and STECA in a WtE project, a major national infrastructure project, and the detailed documentation of the process. To the knowledge of the authors, STAMP/STPA/STECA has not previously been applied to WtE projects, and the process has not yet been documented in the same detailed way. The article shows the implementation of STECA, but few articles have been published on the application of STECA.

This article is organized as follows. In Section 2, the context for the study is described; in Section 3, a literature review is conducted on both risk analysis in recent WtE and the application of STAMP/STPA/STECA; in Section 4, the research methodology is illustrated; in Section 5, the results are presented; in Section 6, a discussion on the results is given; and in Section 7, conclusions are drawn with thoughts on future work.

2. Context for the Study

This study is based on the results of a WtE feasibility study conducted in 2021, to prepare for the implementation of a future solution for the treatment of combustible waste for Iceland [9]. It contains expert analyses of the main factors concerning such a project. It reveals that exporting combustible waste is not a future solution and that preparations need to begin for the introduction of new methods and solutions for changing the treatment of waste generated in Iceland. The aim of this study is to take the project one step further and develop a system model that can be used for supporting the design and decision making in the project and, at the same time, to implement system safety and security into the project. This would be a megaproject on an Icelandic scale. (A megaproject is a very large-scale investment project. The Oxford Handbook of Megaproject Management gives a definition: “Megaprojects are large-scale, complex ventures that typically cost $1 billion or more, take many years to develop and build, involve multiple public and private stakeholders, are transformational, and impact millions of people” [27]. Other sources have suggested that USD 1 billion is not a defining constraint; in some countries, a much smaller project (e.g., with a USD 100 million budget) could constitute a megaproject [28].) The waste disposal methods used in Iceland are listed in

Table 1. Current and future waste disposal methods in Iceland.

Method	Definition	Description and Characteristics
Landfill	Waste collected in certain areas is compacted and wrapped in plastic. The bales are stacked in ditches and soil is layered over for natural decomposition and to improve appearance.	Landfills take up large areas of land and have a significant impact on the surrounding environment, both as a visible dumping ground and often, also, as an odorous pollutant as gas rises to the surface from decaying waste, where it is often hidden in mixed waste. Waste landfills are usually located near urban areas and cities to reduce transportation costs. Decomposition of landfilled waste is slow, and it takes waste more than 20 years to decompose in a cool climate like Iceland.
Compost	The biochemical effects of microorganisms are used to decompose and decay organic waste and turn it into fertilizer (manure).	Composting is the process of turning organic waste into compost. There are various methods of composting, but they have one thing in common: they create ideal conditions for the microbes that take care of the decomposition. During decomposition, the organic waste, e.g., the food scraps and garden waste, turns into nutritious compost that can be used to increase the fertility of the soil for cultivation and revegetation. During composting, the decomposition of the organic matter is accelerated by creating these ideal conditions for the microbes and insects that take care of the decomposition, but usually it happens quite slowly in nature.
Incineration	Waste is burned at high temperatures so that the waste materials are turned into ash, flue gases, and heat.	By incinerating waste, it is possible to get rid of combustible waste that would otherwise have to be landfilled. To ensure that the incineration is harmless, no toxic substances (e.g., batteries) or organic materials (e.g., animal carcasses or other organic waste) must be included with the waste to be incinerated. Otherwise, there is a risk of contamination, e.g., dioxin pollution.
WtE Incineration	WtE is a form of energy recovery that is not yet being used in Iceland but is now considered as a future waste treatment. It is the process of burning waste at high temperatures and, thus, generating energy in the form of electricity, heat, or fuel.	Most WtE processes generate electricity and/or heat directly through combustion or produce a combustible fuel commodity. All new WtE plants in OECD countries incinerating waste must meet strict emissions standards. Modern incineration plants are very different from older types of incineration plants, some of which have recovered neither energy nor materials. With the WtE incineration process, a harmless reduction of waste can be achieved, and the remaining material can be used in the construction industry and in road construction. The temperature of the combustion chamber exceeds 1000 °C and during combustion 95–96% of the original waste turns into very hot gas and ash [18]. WtE mainly leaves bottom ash and fly ash.

.

In the feasibility study, it is estimated that by 2030, up to 130,000 tons of combustible waste will be generated in Iceland per year. The production will generate 10 MW of electricity and 28 MW of heat (hot water). Ash and solid residues from the process can largely be used in road construction or as a building material. Although the energy will be sold, the operating costs will primarily be covered by charging gate fees. However, on average 70% of this capacity will be sufficient to run the incineration plant. Hazardous waste will not be accepted to ensure that solid residues from the plant are not contaminated. For comparison, the Amager Bakke WtE incineration plant in Denmark burns up to 400,000 tons of waste yearly (https://www.power-technology.com/projects/amager-bakke-waste-energy-plant/, accessed on 12 November 2023) (46 tons/h), and the Spittelau WtE plant in Austria burns around 250,000 tons yearly (https://positionen.wienenergie.at/en/projects/spittelau-waste-incineration-plant/ accessed on 12 November 2023) (29 tons/h).

WtE incineration plants that have recently been built around the world are often located close to densely populated areas, and no research has shown any harmful effects of their operation on human health or the ecosystem [29,30]. Environmental issues are a key factor in the preparation, design, construction, and operation of incineration plants. Important environmental factors are not only the possible pollution of air or water due to solid material flows, but also noise, odor, effects on health, ecosystems and vegetation, and visual effects. It is also necessary to look at possibilities for using energy and solid material streams. The intention is to carbon-offset all operations of the plant.

In the feasibility study, the choice of location has been examined from different perspectives, considering five sites identified in a report written on the need for waste incineration plants in Iceland, prepared for the Icelandic Ministry of the Environment and Natural Resources in 2020 [31]. The choice of location must not only be based on transport cost, but also on opportunities for selling the energy, the positive attitude of the public, there being enough land for future development, and there being a reasonable distance from residential areas. Furthermore, there must be good access to labor, possibilities for carbon capture, and (important for Iceland) not a great risk of natural hazards like earthquakes and volcano eruptions, which are common in Iceland.

The feasibility study states that the capital expenditure (CAPEX) is expected to be 177.5 million EUR, including financial costs. There is an 80% probability that the final cost will be in the range of 135–236 million EUR. The explanation for this wide range in the cost estimate is that no design has yet been created. The project plan is primarily based on information from the COWI engineering consultant company in Denmark (https://www.cowi.com/, accessed on 12 November 2023), which has been involved in many similar projects in recent years. COWI has also made an estimate of the operational expenditure (OPEX), which is in the range of 57–80 EUR per ton with 35 full-time employees working at the plant. The profitability of the project was assessed by developing a financial model based on the CAPEX and OPEX, income from gate fees, and sale of energy, along with other assumptions. In the base case, it was assumed that a private company is established, that 80% of the CAPEX is borrowed at 8% interest rates, that the gate fee is 40 ISK/kg, and that the plant processes 100.000 tons annually. Based on these assumptions, the project is profitable, and the annual internal rate of return is about 12%. Sensitivity analysis shows that even if the CAPEX increases by 30%, the project is still profitable, and even if the OPEX increases by 50%, the project is still profitable. The feasibility is most sensitive to changes in gate fees and material quantity, and the project remains profitable while neither of these parameters is reduced by more than 15%. An estimate was made on how low the gate fee can be for the project to maintain profitability for two variations of ownership, where the interest rate is much lower than in the base case. In the case of a Public–Private Partnership (PPP) project, the gate fee must be higher than in the case of a purely public project.

There are different options regarding the types of organizations that could be formed around this waste incineration project. The decision, however, influences the extent to which the provisions of special legislation will apply to the operator, e.g., on whether waste incineration agreements may be exempt from tendering. To ensure this, the operator would have to be a public organization, but it is also possible that agreements with a private legal entity could be defined as internal agreements, and thus exempt from the obligation to tender. In the case of a PPP arrangement, the principles of competition law need to be carefully studied. A system could be set up to offset the transport costs of waste, especially if such a system has a better environmental impact and does not contribute to increased waste production. The rules of the EEA Agreement (https://www.efta.int/eea/eea-agreement, accessed on 12 November 2023) place restrictions on any kind of state aid intended to distort competition or favor companies. Such assistance is possible, provided that certain conditions are met. This could, for example, apply to an investment in energy production.

3. Literature Review

Section 3.1 reviews the scientific literature on risk analyses conducted in recent WtE incineration projects. Section 3.2 reviews the STAMP, STPA, and STECA literature, referring to techniques to identify hazards and threats that may lead to accidents, losses, and risks.

3.1. Scientific Literature on Risks and Risk Analyses in Recent WtE Projects

A search for published scientific articles on recent WtE projects on Google Scholar resulted in 16 articles and theses, which all were reviewed with regard to identification and analyses of risks. The articles all deal with high-tech WtE incineration plants and the importance of identifying risks in such projects. The literature shows that extensive, complex, and expensive infrastructure projects like WtE projects are often carried out as Public–Private Partnerships (PPPs). This is not only to finance the projects but also to ensure access to the necessary knowledge for the project, to distribute risk, and to create a suitable framework for the project—all to ensure that the project is successfully executed. The WtE project analyzed in this study is similar to projects described in many scientific articles [29,30,32,33,34,35,36,37,38,39,40,41,42,43].

Risk assessment is important for PPP in WtE incineration projects, as described in [32], where a WtE project in China is investigated. Risk assessment promotes the sustainable development of WtE incineration plants. Some studies, however, do not consider the effects of the participation of many individuals and the resultant mutual compensation among risk factors. This affects the reliability of the evaluation of the results of the risk assessments and increases decision risk. The public sector commonly lacks knowledge and experience in PPP projects, and, particularly, risk allocation issues may prevent WtE incineration projects from succeeding [33]. It is possible to utilize a methodology based on weighted multiorganization fuzzy rough sets over two universes to perform risk evaluation for PPP in WtE incineration plant projects [32]. Although WtE projects are characterized by many advantages, such projects involve a variety of risk factors, e.g., economic risk, legal risk, political risk, environmental risk, social risk, and technical risk. These risk factors are usually created by many complex factors, e.g., large investments, long payback periods, government discretion, inadequate government oversight, and complex contractual relationships. All these factors have a major impact on all levels of the effectiveness of such projects.

A possible way to provide a framework for risk assessment for PPP in WtE projects is partly based on linguistic variables [34]. It is necessary to place emphasis on identifying risk factors that may accompany projects of this type throughout the life cycles of the projects. Uncertainty, which consists of fuzziness on the one hand and randomness on the other, is of great importance in risk assessment in an increasingly complex environment. The linguistic technique is used to express and explain unclear information (inaccurate wording of those involved in the assessment) and then, a calculation model is used to process the data. Most risk factors in PPP WtE incineration projects are generally assessed qualitatively rather than quantitatively and, therefore, it is important to carefully analyze the meaning of the words of the assessors, which can be very subjective. The main risk factors mentioned in [34] are: (1) public opposition, (2) lack of municipal waste, and (3) improper operation.

In recent years, it has been the policy of the Chinese government to develop waste incineration projects as PPP projects to achieve better and more efficient management of such projects [35]. Experience has revealed a variety of risk factors in such projects, which are associated with a lack of work experience and poor risk management. In [35], not only are the potential risk factors investigated, but also both the severity of risks and the likelihood of the realizations of risks are assessed. Views of experts in the field of waste industry were collected in a survey in the form of a questionnaire. Respondents were asked to evaluate a total of 18 risk factors that affect the success of PPP WTE projects, but these risk factors had previously been identified in former studies that were referenced. The results show that the risk factors that are considered most critical and to affect sustainability are: (1) public opposition, (2) governmental decision making, (3) shortcomings in the legal and regulatory system, (4) environmental pollution, (5) the lack of supporting infrastructure, (6) government credit.

In [36], critical risk factors in PPP WtE incineration projects are analyzed. Twenty-one risk factors are identified and analyzed, then ranked with regard to significance (1 = max, 21 = min): (1) public opposition, (2) environmental pollution, (3) land acquisition and administration approval risk, (4) revenue risk, (5) government credit risk, (6) governmental decision-making risk, (7) technical risk, (8) construction cost overruns, (9) operating cost overruns, (10) municipal solid waste supply risk, (11) incompleteness of laws or changes in laws, (12) private sector credit risk, (13) delays in completion, (14) design/construction/commissioning performance risk, (15) private sector decision-making risk, (16) operational performance risk, (17) unwillingness to pay, (18), interest rate risk, (19) force majeure, (20) inflation risk, (21) currency exchange risk.

Critical risk factors in WtE PPP in China are also discussed in [37]. The five most important risk factors in WtE PPP projects are identified based on an analysis drawn from real-life risk events in 14 such incinerator projects. These risk factors are (1) an inadequate waste supply, (2) unlicensed waste disposal, (3) environmental risk, (4) payment risk, and (5) a lack of infrastructure.

In [38], an interdisciplinary study was conducted on the criteria and accepted research framework (paradigm) for municipal solid waste management (MSW). The aim of the study was to identify influencing factors and present realistic indicators and measures for MSW from different perspectives. The study covers engineering, management, business, and social aspects. The study considers soil and underground pollution, air pollution, and the fight against global warming, which are complex and difficult issues.

A systematic review has been conducted of the literature on the health impacts of WtE emissions [29], notably the potential health effects (benefits and risk factors) of exposure from WtE projects. Little has been published regarding the health effects of such projects. In only 19 out of 269 articles surveyed, the health effects of WtE incinerators are addressed. Out of these 19 articles, 2 are on epidemiological studies, 5 on environmental monitoring, 7 on health effects, and 5 on life cycle assessment in such projects. The conclusion is that rigorous assessments (e.g., health impact or risk assessment, including sensitivity analyses) of WtE facilities and their technological characteristics and refuse type used are necessary when planning or proposing facilities to protect human health. Most life cycle assessment studies indicate that emissions from, and consequently health risks associated with, WtE plants are lower than those due to landfilling and conventional incineration. There is, however, an increased risk of lead pollution and pollution due to other heavy metals in sediment and fly ash that may be released into the environment at later stages of the life cycle. In this respect, proper design and operation of the WtE plants is required, as well as good management and monitoring of the emissions. Furthermore, continuous monitoring of environmental factors and health conditions is required to maximize both economic and environmental benefits, while minimizing harmful health effects and risks. Regarding the planning and design of WtE structures, it is important that a health risk assessment supported by comprehensive exposure monitoring and robust calculation models (e.g., accurate emission models, atmospheric models, and actual population data) is carried out before the proposed WtE incineration measures are implemented. It is important to ensure that measures work optimally. Also, careful consideration must be given to the health data used, the criteria used for the reference values, and the duration of the effects and their frequency. Sensitivity analysis needs to be performed to verify and test the criteria for health risk assessment and life expectancy assessment.

Environmental and health risks related to waste incineration are the subject of [30]. There, no research is found that strongly suggests that incinerators operating with modern technology and complying with emission laws carry an increased risk of cancer, infertility, or developmental disabilities. Proximity limits are not defined. There are three factors that support this:

1.

Emissions from incinerators now being built in developed countries for waste incineration are much lower than before. The epidemiological studies that have been carried out that revealed negative effects on health relate to older types of such incinerators;

2.

Risk assessment studies indicate that most of the exposure is through people’s diets;

3.

Dioxin level studies in residents living near incineration plants have not shown an increase in this level compared to residents living in reference areas.

However, studies exist showing that people who live and work near waste incineration plants believe they are exposed to various types of health damage. The mentioned effects include cancer, adverse effects on the respiratory system, heart disease, effects on the immune system, increased allergies, and malformations in children. Despite this, it has not been possible to link such illnesses and risk factors directly to pollution from high-tech waste incinerators.

Legislation regarding WtE plants is different between countries, including countries belonging to the EU. In [39], it is argued that favorable legislation has enabled Denmark to become a leader in the category of high-tech WtE incineration plants, whereas Italy is on the other end of the spectrum due to non-favorable legislation. The EU’s environmental goals have, in the Nordic countries, facilitated investment in waste management and contributed to better and more environmentally friendly high-tech incinerators. Reducing greenhouse gases through improved waste management is one of the main policy challenges in the EU’s environmental program. The Waste Framework Directive (EU Directive 2008/98/EC) classifies waste treatment as “energy recovery” rather than “disposal”. With the EU Directive, WtE gained a role and weight in the circular economy. WtE incinerators now play an important role in protecting clean/non-toxic cycles and treating non-recyclable waste. The function of such plants is to clean/decontaminate waste streams and remove waste with toxic substances from the recycling ring. The WtE incinerators help keep the recycling economy clean by acting as a scrubber for pollutants. The only other treatment for this waste stream would be landfills, which is not advantageous.

Public communication is needed to build positive attitudes and acceptance regarding the construction and operation of high-tech incineration plants for waste [40]. People’s opposition to WtE plants is mostly related to fear of negative effects on the environment, risks to the health or safety of the inhabitants, or a reduction in the status of the territory. Communication can not only contribute to the success of and consensus about incineration plants but can also play a key role in strengthening people’s willingness to participate in the circular economy. Public debate on waste issues within European institutions and public opinion within European countries is characterized by differing views of the people of these countries. In many other areas, the public seems to lack understanding and is opposed to the construction of waste incineration plants. To mitigate the risk of public opposition, it is suggested that those responsible for WtE projects should develop a communication policy wherein the main stakeholders and participants in projects are made to disseminate information and knowledge to the public in an accessible way so that it is easy to understand.

A possible relationship between WtE plants and electric cars is depicted in [41]. Following the ideas, an urban microgrid consisting of a WtE combined heat and power generation unit and charging stations for plug-in electric vehicles could be devised. The main purpose is to provide additional services and speed up the introduction of electric cars.

Finding the optimal time to start a WtE incineration project is not obvious. The values of waiting vs. switching technologies from landfills to WtE systems must be evaluated. In [42], it is concluded that it is best to invest immediately in either incineration or gasification, as delaying investment results in a loss of opportunity for energy generation with WtE systems. At the same time, it is emphasized that the government must support the WtE program as it will make a significant contribution to solving problems in the environment, especially regarding air quality and waste management as well as energy security and sustainability.

Investment risk in WtE projects is considerable and needs to be assessed [43]. One approach is to estimate future competition in the waste market by building complex simulation models. This may be approached by defining a waste availability factor for use in the assessment. Since the presence of a sufficient supply of waste is one of the major risk factors in WtE projects, its evaluation represents an important part of feasibility studies for such projects.

The construction of a high-tech incineration plant in Amager Bakke in Copenhagen, Denmark is described in [44]. The innovative steel structure of the plant and its roof, which is designed as an outdoor recreation area for the public, are described. Construction of the plant began in 2013 and its operation started in 2016 (officially opened in March 2017). The incineration plant is 43,000 m² and the roof of the building rises to a height of 85 m. The roof is a garden the size of two and a half soccer fields with trees. It offers areas for hiking, climbing, and skiing, a viewing platform, and a café. However, a special law deals with the risk regarding the design of the plant’s chimney, which does not rest on its own foundation (ground support) but is connected to the steel structure of the main building at a height of about 20 m and, therefore, appears to hang visually on the outside of the building. The location of the chimney on the gable of the main building and the rather weak foundation causes the risk of excessive vibration due to wind, which had to be considered when designing the plant.

Though the WtE plant at Amager Bakke has been in operation for only a few years, there is already a demand for change that requires impact analysis and environmental assessment [45]. Although the plant is one of the most advanced in the world, there is reason to update the technology and add carbon capture and storage (CCS) to reduce the environmental impact of the waste incineration. In [45], a detailed analysis is made of the impact of changing the plant’s incinerator at Amager Bakke (capacity: 600,000 tons of waste per year) using CCS as a post-incineration technology.

What the scientific articles in this section state about risk in WtE projects can be summarized as follows:

1.

Risk is associated with big and complex projects (i.a., megaprojects) that take several years. Circumstances can change over time and various project criteria can change [29,32,33,34,35,36,37,38];

2.

Establishing WtE projects as PPP projects is one way to mitigate project risk, for example, financial risk [32,33,34,35,36,37];

3.

People’s fear of environmental pollution causes public opposition and a bad image of waste incinerators. This creates risk and complicates WtE projects [30,35,40];

4.

There is a risk due to inadequate communication and lack of communication with the public [40];

5.

National legislation regarding WtE involves risk. Risk is associated with inconsistencies and unclear legal provisions. Governmental decision making and shortcomings in legal and regulatory systems are risk factors [32,35,39];

6.

Project financing is a risk factor and state backing is important [34,35];

7.

Unclear risk allocation in PPP projects creates risk [33];

8.

All decision making in WtE projects must be based on results from risk analysis and risk assessment, i.e., planning, design, implementation, and operation of WtE incineration plants [33];

9.

In WtE projects, it is common for communities to develop their “own” risk analysis methods that take into account the local environment, situation, and culture [33];

10.

Criteria used in risk analysis need to be carefully considered, and they need to be kept under continual review [29,30];

11.

The effects on the health of people working or living in the vicinity of WtE incineration plants have not been sufficiently studied. Long-term and life cycle research needs to be done. Continuous monitoring and review of standards is important in all existing high-tech incineration plants [29];

12.

The deposition of energy and heat from WtE plants influences site selection [41];

13.

The choice of the location and appearance of buildings is important to the public. A positive image of a high-tech incinerator can support a circular economy, improve the public’s environmental awareness, and strengthen the willingness of people to take an active part in any kind of sustainability project [40,44];

14.

Technology is ever-evolving. It can be assumed that the equipment of high-tech incinerators needs to be renewed regularly [45];

15.

Delaying investment results in a loss of opportunity for selling the products from the WtE plant [42];

16.

There is no mention of ISO standards or their use in the scientific articles, neither ISO management system standards (https://www.iso.org/management-system-standards.html, accessed on 12 November 2023) nor ISO risk management guidelines like ISO 31000 [46], which is the guiding standard for risk management referenced in all ISO management standards.

3.2. Literature Review on STAMP, STPA, and STECA

Systems-Theoretic Accident Model and Processes (STAMP) is a causality accident modeling technique for identifying system hazards and safety-related constraints necessary to ensure acceptable risk in complex systems [10,11,12]. STAMP is a recent technique, first developed by Leveson in 2004 [10] but since then widely applied and tested in many fields.

Systems-Theoretic Process Analysis (STPA) is a hazard/threat analysis technique, derived from STAMP and based on systems theory (https://www.sciencedirect.com/topics/psychology/systems-theory, accessed on 12 November 2023). Since being introduced [11], STPA has been developed further to also analyze the security of systems with STPA-Sec [39], and Systems-Theoretic Early Concept Analysis with STECA [22,25,26]. Scientific studies have been conducted on the use of STPA in many areas, e.g., aviation, spacecraft, healthcare, railroads, automobiles, military, nuclear power plants, oil, gas (petrochemicals), and energy. Interdisciplinary studies have also been conducted on, e.g., human factors and safety, integration of safety into systems engineering processes, identifying leading indicators of increasing risk, application of standards and certification, and the roles of cultural, social, and legal systems in safety and security. To the knowledge of the authors, STAMP/STPA has not been applied in WtE projects and no scientific articles or reports on STAMP/STPA in such projects were found on Google Scholar.

According to the STPA handbook [47], basic STPA is conducted in four main steps:

• Define the purpose of the analysis;
• Model the control structure in accordance with STAMP;
• Identify unsafe control actions;
• Identify loss scenarios.

Figure 2 gives an overview of the STPA iterative analysis process as described in [47]. STPA is still being developed as a technique in many parts of the world, especially steps 3 and 4. This is described in many recent scientific articles, either as a theoretical analysis of the technique or as case study articles on actual application examples. In this review, the focus is on the practical application of the STAMP/STPA technique in an early-stage project concept. Therefore, STECA, as an early concept analysis variant of STAMP/STPA, is an interesting technique to test and confirm the feasibility of the WtE project. In STECA, the emphasis is on preparing a model to be used for safety/security hazard analysis during the preliminary inspection of the project. Since the WtE project is only at the discussion stage and no decisions have been made of any kind, it is neither possible to make scenarios about “unsafe control actions” nor to “identify loss scenarios”. It is only possible to take the first two STPA steps out of the four, i.e., to define the scope and develop the model.

STECA consists of two basic steps. The first step involves recursively applying control-theoretic concepts using guide words, heuristics, and feedback control criteria to parse the existing concept report and review it with regard to statutory and regulatory requirements [22,48]. Also, the main results regarding the project, e.g., the waste amount and possible location, are used as Concepts of Operations (ConOps), resulting in the development of a control structure of the model of the concept. With STECA, it should be possible to determine the hierarchical control structure but, in this case, it is not relevant since laws and regulations determine the hierarchical structure for the most part. The second step in STECA, the analysis, consists of examining the resulting model with the explicit goal of identifying hazardous/threat scenarios, information gaps, inconsistencies, and potential tradeoffs and alternatives. The analysis aims at identifying incompleteness or gaps in the control structure, ensuring that all safety/security-related responsibilities are accounted for, and identifying sources of uncoordinated or inconsistent control [22,25], that is, to perform the following functions:

• Identify incompleteness or gaps in the control structure;
• Ensure that all safety-related responsibilities are accounted for;
• Identify sources of uncoordinated or inconsistent control.

Figure 3 shows a simple but typical STPA control loop [22].

This section reviews articles on the application of STAMP, STPA, and STECA. Such articles have been written in various fields, although not about WtE according to the knowledge of the authors of this article.

In the first article, Chaal et al. [49] propose a framework to support the model development, or hierarchical control structure, of an autonomous vessel. They use STAMP, STPA, and STECA as the foundation of the proposed framework. STECA is applied to verify the control structure for completeness, safety-related responsibilities, coordination, and consistency. The framework utilizes the current shipping operation system, the available information about autonomous vessels, and seafarers’ experiences on board conventional ships. The authors refer to the STPA handbook and point out that the guidance does not always provide the necessary level of support when developing a control structure of a new design. The level of knowledge required is different for every new design, which means that a different starting point is needed for the development of each new system. The framework proposed in this case is a supporting tool for using the available knowledge about the concept of an autonomous vessel and the knowledge about traditional vessel operations to define a control structure of an autonomous vessel. It provides additional support for applying STPA in the design phases of autonomous vessels.

Sultana et al. [50] evaluate the feasibility of using STPA in process industry applications. High levels of automation and complex system interactions in the process industry have brought new challenges to risk management. Traditional hazard analysis techniques (such as a hazard and operability study, HAZOP) are not sufficient to analyze risk. Sultana et al. compare STPA and a HAZOP to determine whether STPA can replace traditional HAZOPs when transferring liquefied natural gas from one ship to another. Their results show that STPA is complementary to traditional HAZOPs.

Friedberg et al. [51] analyze safety and security risk in a smart grid, a complex cyber-physical system. The authors apply STPA as an integrated STPA-SafeSec approach to analyze both safety and security aspects together in a single framework. Their results show that safety and security need to be analyzed together to identify a full set of system loss scenarios. The results, furthermore, show that STPA-SafeSec does not directly provide quantifiable results. Friedberg et al., however, point out that by combining STPA with traditional techniques like HAZOPs, more quantifiable results may be obtained.

Dakwat and Villani [52] present a method for combining STPA and system model checking with a technique called UPPAAL (https://uppaal.org/, accessed on 12 November 2023) (developed in collaboration between Uppsala University in Sweden and Aalborg University in Denmark) during product development, in order to provide a formal and unambiguous representation of the system being analyzed. They conducted a practical case study of a robotic flight simulator as an example of the proposed method. The result indicates that by merging the two techniques, system knowledge can be improved. STPA is used to analyze control actions and identify safety constraints, and then update and verify the system model.

Bjerga et al. [53] address uncertainty treatment in the risk analysis of complex systems. They name STPA and the Functional Resonance Analysis Method (FRAM) as examples of suitable approaches to analyze risk in such systems. Their focus is on the treatment of uncertainty and potential surprises linked to the operation of complex systems. They warn against abandoning probability as the consequence can be that important aspects of risk and uncertainty are ignored, which leads to poor decision making. Bjerga et al. contrast two views on how to proceed in the case of an uncertain/inadequate probability model: (a) reduce uncertainty by better modeling of the system; (b) characterize uncertainty better. They argue that both are needed.

Jamot and Park [54] present a case study where STAMP/STPA is applied for risk assessment in a real construction project. The study was carried out to check the applicability of the STPA technique where Probabilistic Risk Analysis (PRA) had initially been used by the project team. After going through a risk analysis on the project with STPA, five members of the project team were asked to evaluate in a questionnaire (on scale 0 = poor to 5 = excellent) their experience working with STPA compared to using PRA. The STPA technique received a good rating of 3.6 for risk identification, 3.4 for risk mitigation, and 3.2 for its structure. On the other hand, the average rating was 2.6 for the analysis time, and 2.4 for the complexity of the method. It is unclear from the paper whether the project members evaluating the STPA technique had more previous experience with the PRA technique and what effect this may have had. The authors, however, conclude that for dealing with complex construction projects, the STPA approach seems to deliver higher-quality results compared to the PRA approach since its main objective is to simulate possible scenarios.

Sulaman et al. [55] present a comparative study where STPA and Failure Mode and Effect Analysis (FMEA) are both used to analyze the same forward collision avoidance system. These techniques have different focuses, and STPA is a top-down analysis technique, whereas FMEA is a bottom-up analysis technique. FMEA especially takes the architecture and complexity of components into account, whereas STPA is stronger in finding causal factors of identified hazards. The comparison in the study shows that FMEA and STPA deliver similar results.

The lessons learned from the above articles on STAMP, STPA, and STECA can be summarized:

• The STAMP, STPA, and STECA techniques are helpful in developing new and complex systems;
• The STAMP and STECA techniques are helpful in early concept analysis and building system models;
• The STAMP and STPA techniques are helpful in further design, especially when analyzing complex systems and projects;
• The STPA handbook does not always provide the necessary guidance and level of support when developing a control structure of a new system;
• STAMP and STPA are often complementary to other analysis techniques, e.g., HAZOP, UPPAAL, FRAM, FMEA.

4. Research Methodology

In this study, the systems theory-based STAMP method was applied together with the derived hazard/threat analysis techniques STPA and STECA. A system model was created with STAMP showing stakeholders and their communication. The first steps of STPA were taken by identifying major losses/accidents and system-level hazards/threats that can lead to losses/accidents. To be able to conduct a full STPA, the system must, however, be defined and known. There, STECA is useful as a technique/tool to analyze the necessary system elements and the corresponding communication, in terms of both actions and feedback. In this case, STECA together with STPA was used to help define the WtE project scope and to clarify who the stakeholders must be, their responsibilities, and their connection and necessary communication with each other. This was done to identify the prime risk factors in the first phase of the project. This research proceeded in the following ten steps:

1.

Definition of the scope of the WtE project;

2.

Review of all relevant Icelandic laws and regulations on waste management, environmental issues, local government issues, health issues, building regulations, and the European directives on environmental issues in relation to roles and responsibilities in a WtE project;

3.

Definition of stakeholders, based on step 1 and 2;

4.

Definition of roles and responsibilities of all stakeholders from step 3 based on requirements in laws and regulations reviewed in step 2;

5.

Creation of a first draft of the control structure of the WtE system, representing stakeholders and their communication, based on the stakeholder analysis in steps 3 and 4. A graph was made of the communication required between stakeholders according to laws and regulations, in terms of both feedback and control actions, resulting from step 4;

6.

Identification of control actions as subsystems where there might be a reason to make special models;

7.

Review of a STAMP system model by stakeholders and actors in different fields. Validation was sought for every part of the STAMP system model, i.e., stakeholders, responsibilities, feedback needed, control actions needed, and sub-processes within the model. See Appendix A, Appendix B and Appendix C;

8.

The first two steps were taken in STPA based on the validated STAMP system model. Stakeholders and actors, experts on individual project aspects from step 7, were asked which losses/accidents and system-level hazards/threats may not occur in the project at all, and furthermore, which hazards/threats they believed could cause such losses/accidents. These two STPA steps further confirmed the STAMP model and pointed to important aspects of the project discussed in the results section;

9.

Review of the project scope;

10.

Refinement of the STAMP system model, and description of control actions made. Control action analysis was performed regarding whether an action is (a) a requirement, (b) an output, (c) a one-time action, or (d) a continuous action.

In this case study, the STECA process was followed as shown in Figure 4 [56].

The STAMP model for the WtE project was iterated and individual factors were verified in various ways for model integrity and analyzed as described in Section 6.

If the STECA process is followed further, then the analysis continues with the modeling and analyses of the hierarchical safety/security control structure. In this study, hierarchical control is not critical. It is, at this point, defined by laws and regulations. The modeling analysis is focused on (a) the identification of stakeholders, (b) the responsibilities of stakeholders, (b) feedback needed from stakeholders, (c) actions required from stakeholders, and (d) descriptions of actions.

Table 2. Control-theoretic analysis of textual or graphical information, based on STECA.

Name of Model Item/Element	Definition
Stakeholder (matches “source/subject” in STECA)	A legal entity that is required in the project.
Responsibility (matches “role” in STECA)	Legal responsibility as stated in law or role necessary for some reason, which should be documented.
Feedback needed (from which stakeholder(s)?) (matches “behavior type” of the nature “action” in STECA)	For a given responsibility/role, which type(s) of feedback behavior are required or exhibited?
Action required (towards which stakeholder(s)?) (matches “behavior type” of the nature “action” in STECA)	Description of control action (CA): (a) is it a clear control action, (b) is it a requirement, (c) is it a simple output?

shows the control-theoretic analysis of textual or graphical information from the feasibility study and from document review.

No further STPA steps can be taken at this point. For that to happen, a decision must be made on several important factors, e.g., who will participate in the project and the project ownership setup (owner structure), what location will be chosen for the incineration plant, and what is the time frame of the project, i.e., when should the project start and when should it end? Time is a sensitive factor due to political risks and the local and parliament elections being held every four years.

There are few software tools that can support risk analysis with STAMP/STPA/STECA. The software tool (https://www.riskmanagementstudio.com/stpa-software-solution/, accessed on 12 November 2023) used in the study for modeling is the product of a collaboration between Stiki (https://www.stiki.eu/en/ accessed on 12 November 2023) in Iceland and The Zurich University of Applied Sciences (https://www.zhaw.ch/en/university/ accessed on 12 November 2023) in Switzerland, a product of a Eurostars project funded for three years [57,58].

5. The Results

A simplified STAMP system model of the WtE project with a generic control loop is shown in Figure 5. The controlled process is the WtE project, and the controller is the management of the whole project.

Having only this simplified control structure, the expert team from the WtE feasibility study [9] was guided through the first step in the STPA, shown in Figure 2, by asking two questions. This first STPA step is divided into four parts: (1) identify losses, (2) identify system-level hazards/threats, (3) identify system-level constraints, (4) refine hazards/threats (optional). So, having assumed that the decision to build a WtE plant in Iceland had been made, the questions asked are listed below. (See a list of those who were asked in Appendix A and examples of the questions and answers in Appendix B).

• What types of losses/accidents does the analysis aim to prevent—What major loss/accident should not happen during the design and construction period? (Name 1–3);
• What system-level hazard/threat could result in such a loss? (Name 1–3 for each loss/accident).

Table 3. Losses/accidents that should be prevented in the WtE project.

Loss Id	Name of Loss
L-1	The project stops before it finishes
L-2	Serious accidents to people
L-3	Delays in completing the project

shows the answers received, sorted by frequency. Three major losses were identified and the one considered most serious was “The project stops before it finishes”.

Table 4. Hazards/threats that might result in loss—answers received.

Hazard/Threat Id	Name of a Hazard/Threat	Resulting Losses
H-1	It is not possible to finance the preliminary project	L-1, L-3
H-2	Disputes arise between parties that are not covered by contracts and cannot be resolved	L-1, L-3
H-3	Design criteria change during the project time	L-1, L-3
H-4	Costs exceed budget	L-1, L-3
H-5	Time and progress plan fail, e.g., due to strikes or delays in construction permits	L-1, L-3
H-6	Opposition to the project, a negative image	L-1
H-7	Business plan fails	L-1, L-3
H-8	Waste plan fails	L-1
H-9	Inadequate project management	L-1, L-2, L-3
H-10	Lack of safety culture and accident prevention	L-2, L-3
H-11	Allocation/splitting of risk is unclear	L-2, L-3

presents the answers received when asked about system-level hazards/threats that could result in a loss. The answers were not all descriptions of system-level hazards/threats at this point.

The system-level hazards/threats derived from the answers in Table 4 are shown in

Table 5. System-level hazards/threats (refined) and constraints.

System-Level Hazard/Threat and Constraint	System-Level Hazard/Threat System Level Constraint	Resulting Losses
SLH-1 SLC-1	Project is not fully financed. Project must be fully financed.	L-1, L-3
SLH-2 SLC-2	Project contracts are not clear so that unresolvable disputes arise between parties. Project contracts between parties must be clear so that unresolvable disputes will not arise between parties.	L-1, L-3
SLH-3 SLC-3	Project design criteria change during the project time. Project design criteria must be validated and confirmed during the project time.	L-1, L-3
SLH-4 SLC-4	Project business plans (time, cost) fail. Project business plans (time, cost) must be reliable and must not fail.	L-1, L-3
SLH-5 SLC-5	Project experiences opposition and a negative image from the public. Project must enjoy a positive attitude/image in the public during the project period.	L-1
SLH-6 SLC-6	Project management is inadequate during the project time. Project management must be maintained during the project time.	L-1, L-2, L-3
SLH-7 SLC-7	Project safety culture is not maintained. Project safety culture must be maintained during the project.	L-2, L-3

. The refined system-level hazards/threats are presented with the responsive system-level constraints (SLH-1 = H-1 + H-4, SHL-2 = H-2 + H-11, SLH-4 = H-4 + H-7 + H-8).

When it comes to modeling the system control structure, a review of Icelandic laws and regulations reveals which main stakeholders would be involved in the preparation and construction phase of the WtE project. Some of them serve the same purpose and are, therefore, grouped together as a single entity, e.g., the municipalities are grouped in S-1 and the licensors in S10. This makes a total of 26 stakeholders that are listed in

Table 6. List of stakeholders in the WtE project and their roles and responsibilities in the preparation and construction phase.

Stakeholder Id	Names of Stakeholders in the Construction Phase	Roles and Responsibilities of Stakeholders
S-1	Municipalities	Legal obligation to dispose of waste in a sustainable way Responsibility for establishing the proper governance in the preparation and early decision-making phase of the project Project feasibility study Project risk assessment Responsibility for financing the whole project Establishing the PPP for the project Supervisor role
S-2	Waste Municipal Association (WMA)	Serves the municipalities in establishing the WtE project Knowledge source
S-3	WtE Ltd.—project owner	Project owner (PPP affiliate) Project mgmt., incl. quality, health and safety, environmental and sustainability requirements Ensures project financing Daily supervision during project time Appoints a design manager Appoints a construction manager Assigns auditors Applies for a construction permit for the intended project and provides the necessary data, e.g., environmental assessment
S-4	Ministry of the Environment, Energy and Climate	Waste matters in accordance with the provisions of the regulatory framework for waste management, i.a., obligations under EEA law
S-5	The Environment Agency of Iceland	Enforces laws on pollution prevention, environmental responsibility, nature conservation, and hygiene—sets environmental regulation Issuance of operating license for the WtE plant
S-6	Municipality port	Provides harbor facilities for shipping to and from WtE plant location Examines conditions for harbor construction
S-7	National Planning Agency	Implementation of laws and regulations on environmental assessment of projects and plans Presents the project owner’s assessment plans and environmental assessment reports Issues an opinion on assessment plans and on the environmental assessment of a project based on the developer’s environmental assessment report and comments received on it
S-8	The Road and Coastal Administration	Determines the roadway Negotiates with landowners Road design
S-9	Regulatory body for buildings and constructions	Monitoring of the implementation and compliance with laws and regulations reg. building and construction Investigation of whether building regulations are violated or not followed Operation of a database for information on buildings and construction
S-10	Building licensor (municipality/landowner) of WtE construction site (many sub-institutions, fire brigade, health committee, planning committee, and politicians)	Review of building permit application and building documents Confirming consistency in the regional development plans Granting a building permit Investigation of major accidents and injuries Work status checks
S-11	Parliament	Makes legislation reg. waste disposal, environment, health and safety
S-12	European Union (EU)	Coordinates waste and environmental issues within the EU Working groups with the participation of individual countries
S-13	Investors	Co-finance
S-14	Banks	Co-finance
S-15	Main contractor	Human resources available when needed Necessary equipment available when needed Project management on site Tendering and selection of subcontractors Project risk assessment Coordination of subcontractors Assesses, monitors, and manages risk on project site Finishes the project on time
S-16	Subcontractors	Subcontractors available on time Risk assessment for work packages carried out Professional knowledge and experience
S-17	Design manager	Submission of design data/drawings for approval for a building permit application Compiles a report on the designer’s area of responsibility and confirms with their signature that it is a comprehensive overview Handles the owner’s internal control for the design of the construction Organization of coordination of design data
S-18	Construction manager	Makes written agreement with the master craftspeople which they hire on behalf of the owner Carries out the owner’s internal control from the time the building permit is issued until the final assessment has taken place Carries out phased audits according to the inspection manuals Professional representative of the project owner [S-3] Requests a final audit before the WtE plant is started Operation of a quality management system
S-19	Engineers, consultants, and designers	Business plan Risk analysis and risk assessment Information gathering Design of the WtE plant
S-20	Insurance companies	Insurance
S-21	Auditors, inspection agencies, e.g., the Government Property Agency	Auditing standards and process Financial auditing Health and safety, quality, security, and environmental management auditing ESG auditing
S-22	The public	Approve of the project Remain critically engaged
S-23	Parties of the labor market	Preserve peace in the labor market
S-24	Electrical grid company	Provides a connection to an electricity transmission system through a substation Transmits electrical power generated by the WtE plant to buyers
S-25	Hot water distribution company	Provides a connection to the hot water distribution system Distributes the hot water coming from the WtE plant
S-26	Concrete plants and tarmac production units (buildings and roads)	Use of good and affordable additive building materials

.

The STAMP system model with its control structure of the WtE project is shown in Figure 6. The actual project, the construction of the WtE incineration plant, is the controlled process and is shown with the red color in the bottom half of the figure. The model is not presented in a hierarchical form, but is organized with regard to time factors in the project, with early involvement shown from the top and later involvement towards the bottom. The figure shows 26 stakeholders (listed in Table 6) displayed as gray-colored controllers and one red-colored controlled process. Figure 6 shows a simplified interaction that consists of necessary feedback and control actions occurring between stakeholders.

Figure 6 shows that the project owner plays a central role in the system and the project. Until the project owner group has been established, the Waste Municipality Association (WMA), stakeholder S-2, functions as a think tank and drives the project forward—it is already responsible for processing more than half of all waste in Iceland. Six municipalities in the capital area of Iceland, representing 63% of Iceland’s population (https://statice.is/publications/news-archive/inhabitants/the-population-on-january-1st-2022/, accessed on 12 November 2023), build the owner group of the WMA. They are marked as stakeholder S-1 in the STAMP model. They play a leading role in the preparation phase of the project, together with S-2. The business is controlled by politically elected representatives, with authority only for four years at a time (https://ssh.is/english, accessed on 12 November 2023). These two stakeholders do not have the financial resources to execute this project alone. Therefore, a partnership of public and private investors is needed. A review of current laws on waste management and the responsibilities and duties of municipalities reveals uncertainties in many aspects of this kind of project.

The STAMP system model shows the feedback every stakeholder needs to give, with broken arrow lines, in order to fulfill their roles and responsibilities. In the same way, the control action required from each stakeholder is shown with an unbroken arrow line. For the project to be interesting to investors, the flow of material for incineration must be guaranteed. In most countries, the products of the incineration plant will be in demand for energy buyers, both electricity and hot water. In Iceland, however, there is already enough of a supply of both electricity and hot water at a relatively low price. The motivation is, therefore, primarily for the country to be sustainable regarding waste management and independent from other countries. This makes it a more challenging business plan. Stakeholders S-13 and S-14 are needed to finance the project, but they need assurance for their investment. The municipalities also need assurance that the project will be completed, and that the incineration plant will be able to fulfill their duties regarding waste management. The next step in the modeling process is, therefore, to focus on how this challenge can be met and to take a closer look at the project owner function, i.e., stakeholder S-3.

Iceland’s waste management is governed by Act No. 55/2003, which places an obligation on local authorities to operate reception and collection centers, sometimes referred to as disposal sites. This legislation also sets limits on the WMA (stakeholder S-2) disposal of household waste. Public procurement projects of governmental entities are subject to tender as per Act No. 84/2007, contingent on circumstances within the European Economic Area (EEA). Additionally, the activities of the WMA are governed by Act No. 44/2005 on competition, which prohibits the abuse of market-dominant and monopoly positions.

It is plausible to consider that the already existing WMA could serve as the proprietor of an incineration plant. This aligns with the legal mandate for municipalities to establish waste management channels. The rationale supporting an incineration plant mirrors that of the existing landfill’s operation. This holds true even if the incineration plant operates under a distinct WMA organization as an autonomous business unit, maintaining compliance with the same legal framework.

The existing WMA is equipped to oversee the incineration of all household waste, given municipalities’ obligation to collect and manage it. On the other hand, waste from businesses and industries is handled by private entities. Consequently, maintaining competitive gate fees becomes a crucial requirement. As the activity falls under the purview of Act no. 44/2005 on competition, careful steps must be taken when implementing measures to secure a steady supply of waste for the incineration plant.

Incineration of waste for the WMA (S-2) is subject to tender in the EEA (S-11 and S-12) unless the association takes care of it itself. An exemption from this is granted if the operator of the incineration plant is a public entity and if 80% of the plant’s projects are assigned to the plant by public entities.

The first steps taken here with the STAMP modeling of the WtE project, and preliminary risk analysis with STPA and STECA, highlight the assumptions that must be laid as a basis for a project like this. Based on the assumptions of the project stated here, the following five scenarios can be thought of as possible advantages for the WtE project owner in terms of structure or setup of the project:

• Public ownership, implementation, and operation;
• Public ownership, but private implementation/execution and operation;
• Private ownership and implementation/execution, but public operation (property leased to a public entity);
• Mixed ownership of implementation/execution and operation;
• Private ownership, execution, and operation.

After the first review of these five scenarios by stakeholder S-2, it seems that the third scenario is the most favorable. This result was obtained with the help of the STAMP model and, with its control structure, delineated the first STPA step (see results in Table 6) and iterated safety/security communication and interaction protocols between stakeholders and actors using the STECA technique. This process made it easier for people who participated in the analysis to sharpen their focus and capture the essential parts of the system at this point; see a list of interviewees in

Table A1. An overview of interviewees and meetings held while modeling the WtE project.

Id.	Organization	Occupation/Role	No. of Meetings	No. of Hours
P-01	University	Professor	1	1
P-02	Engineering company	CEO	1	1
P-03	University	Professor	8	29
P-04	University	Professor	4	4
P-05	University	Professor	1	4
P-06	Ministry of the Environment	Head of department	1	1
P-07	Director of planning committee	Director	1	1
P-08	Environmental consulting company	Director	3	10
P-09	Engineering organization	Director	1	5
P-10	Accounting firm	Head of department	1	1
P-11	University and engineering agency	Professor	1	1
P-12	Waste processing organization	CEO	11	36
P-13	Waste processing organization	CFO		36
P-14	Waste processing organization	Head of department		22
P-15	Waste processing organization and politician	Board member		22
P-16	Waste processing organization and politician	Board member		22
P-17	Waste processing organization and politician	Board member		22
P-18	Waste processing organization and politician	Board member		22
P-19	Waste processing organization and politician	Board member		22
P-20	Waste management organization	Manager	9	18
P-21	Waste management organization	Manager		14
P-22	Law firm	Attorney	4	5
P-23	Law firm	Attorney		5
P-24	Law firm	Attorney	1	1
P-25	Financial organization	Head of department	1	1
P-26	Financial organization	Specialist		1
P-27	Municipality	Mayor	3	3
P-28	Municipality	Mayor		3
P-29	Municipality	Mayor		3
P-30	Municipality	Mayor		3
P-31	Municipality	Mayor		3
P-32	Municipality	Mayor		3
P-33	University	Professor	2	16
P-34	European WtE incineration plant	CEO	1	7
P-35	European WtE incineration plant	Specialist		7
P-36	European WtE incineration plant	CEO	1	7
P-37	European WtE incineration organization	Managing director	1	1
P-38	University	Professor		5
P-39	University	Professor	4	17
P-40	Environmental consulting company	CEO	7	7
P-41	Engineering company	Head of department		7
P-42	Engineering company	Expert		7
P-43	Municipality	Mayor	2	1
P-44	Municipality organization	Expert		1
P-45	Waste processing company	CEO		1
P-46	Consultancy company	Manager	6	6
P-47	Consultancy company	Manager		6
P-48	Consultancy company	Manager		6
P-49	Consultancy company	Analyst		6
P-50	Consultancy company	Analyst		6
P-51	Consultancy company	Consultant		6
P-52	University	Professor	4	9
P-53	Governnmental institution	CEO	1	1
	Total:		81	455

in Appendix A. Examples of questions and answers from interviewees are presented in

Table A2. Examples of questions asked and answers received in this study.

No.	Questions	Answers
1	How does the status/responsibility of individual municipalities [S-1] change after the WtE Project Owner [S-3] has been established?	P-01: The municipalities [S-1], the local authorities, are ultimately responsible according to law, they are responsible in contracts regarding the construction.
2	Does the Ministry of the Environment, Energy and Climate [S4] need technical information regarding the proposed WtE project from the WtE Project Owner [S-3], the design manager [S-17], or the engineers [S-19]?	P-04: If the electrical power from the WtE plant is 10 MW or more, the plans need to be reviewed by the electrical power framework committee, according to law. The WtE plant must be connected to the electrical grid [S-24]. P-01: The project plan must not be reviewed by the Ministry of the Environment, Energy and Climate [S-4].
3	Who needs to review or approve an environmental assessment other than the municipality licensor [S-10] that grants the construction permit and the National Planning Agency [S-7]?	P-01: Basically, these two parties, but sometimes there are requirements in laws regarding whom the Planning Agency has to contact and ask for their opinions.
4	Which public bodies must be informed about the project?	P-07: The building official is part of the relevant municipality [S-10]. P-01: The construction process must be followed, the project concerns notifiable construction, the project has to go through a review process (according to the Aarhus Agreement, it is a citizen’s right to be informed), one has to be prepared for appeals from the public [S-22].
5	What information or feedback does the Environment Agency of Iceland [S-5] need to grant a work/project permit?	P-01: The “building regulation” frames authorizations (see: https://www.byggingarreglugerd.is/, accessed on 12 November 2023).
6	Does the license provider (a municipality [S1, S-10]) himself have to carry out an investigation into accidents or mishaps that may occur?	P-02: The Administration of Occupational Safety and Health carries out the investigation in case of an accident. It is a part of the standard public regulatory framework (out of scope, not considered a stakeholder).
7	The role of the Regulatory body for buildings and constructions [S-9] is limited (monitoring)—is it right to include this organization in the STAMP system model?	P-11: Yes. P-04: Yes.
8	Is an “incident report” an output from an investigation process? Who manages or directs such an accident investigation process?	P-02: The requirements of “The Administration of Occupational Safety and Health” governs what incidents must be investigated and what reports given after accidents of any kind (out of scope, not considered a stakeholder).
9	In the construction regulation, it says about execution control: “The licenser carries out external control”. Is the “Regulatory body for buildings and constructions” [S-9] also involved in supervision?	P-02, P-07: The external control is in the hands of the municipality that grants the building permit [S-10]. The role of the regulatory body [S-9] is to monitor that laws and building regulations are followed, if there is a suspicion that this is not the case.
10	Should the Road and Coastal Administration [S-8] be a part of the STAMP system model?	P-03, P-04: Yes.
11	Has there been sufficient differentiation between internal and external auditors in the STAMP system model?	P-03: Yes.
12	Does the WtE Project Owner [S-3] (building licensee) take care of the final inspection and safety inspection on the construction site?—or is this “auditing” role outsourced to others (in contracts with the Project Owner)?	P-02: - Owner’s engineer, also known as the client’s engineer, is a term often given to the representative of the commissioning company of a construction or engineering project. It is a subcontracted role; undertaken to protect the owner’s interests by ensuring that the technical and build contractors are adhering sufficiently to the project specification. - The Project Owner is responsible for carrying out the mandatory supervision of the construction of a structure in accordance with the provisions of the Act on Structures and this regulation, regardless of scope categories. - Building control is divided into internal control, which is the responsibility of the owner, and external control, which is carried out by inspectors. Supervision is then divided into supervision of the design of structures on the one hand and supervision of implementation on the other hand. - The design manager [S-17] takes care of the owner’s internal control of the design of the structure, while the construction manager, as the owner’s professional representative, takes care of the internal control of the implementation on his behalf from the time the building permit or permit is issued until the final assessment has been carried out. The licensor carries out external monitoring to ensure that the design of the structure is in accordance with the provisions of “the Act on Structures”. The licensor is permitted to outsource supervision during the review of special plans in the case of difficult or extensive construction. - The inspector carries out status inspections [according to 3.7.3. art.] and performs security and final audits [according to 3.8. and 3.9. chapter]. - In the case of a public project, the governmental property agency must have a performance evaluation carried out, which states how the project has been carried out according to the plan, together with a comparison with similar projects if possible. It must be available no later than 6 months after the completion of the work.
13	Does the main contractor [S-15] take care of tendering and selection of subcontractors?	P-02: Yes. Often, the project’s tender documents specify that the main contractor should name several possible subcontractors, especially in specialized aspects, such as the supply of special equipment. Ultimately, however, the selection of subcontractors [S-16] is the responsibility of the main contractor [S-15].
14	What is the most complex and risky part of this project?	P-02, P-03, P-04, P-07, P-08, P-09, P-10, P-12, P-15-P19, P-27-P32: The most difficult part in a project like this one is to get the country’s municipalities [S-1] (including the owners of the WMA [S-2], which are among Iceland’s largest municipalities) to commit to the project and approve it (sub process1). Although the project is technical, politicians make the decisions about it. This creates a lot of uncertainty. It is important that the Icelandic state [S-11] participates in the project, but also there is great uncertainty. There is uncertainty regarding the form of project ownership [S-3] (sub process2) and financing of the project [S-1, S-11, S-13, S-14]. There is also uncertainty regarding the permit process (sub process8) until a construction/building permit is obtained. It may take years (with municipal elections in between). Many institutions, both governmental and within the municipality that grants the building permit, need to assess the impact of the project, i.a., due to environmental impact, zoning plan issues, health issues and traffic issues.
15	What information/feedback can the EU [S-12] receive on necessary legislation regarding to WtE issues from stakeholders? How can information be given to EU institutions?	P-06: Iceland has observer representatives in various EU working groups [S-12] in the climate field. The European IPPC Bureau is a cooperation platform between the governments of the EEA countries and the European business community. The European Integrated Pollution Prevention and Control Bureau (EIPPCB) is part of the Circular Economy and Industrial Leadership Unit of Directorate B—Growth and Innovation, one of six scientific directorates of the European Commission’s Joint Research Center (JRC). Best Available Techniques (BAT) reference documents (BREFs) represent the outcome of the ‘Seville process’. BAT should ensure that certain developed and tested technologies are used in environmental matters, which should be the best available technology available, the best for use. Iceland’s participation is through Nordic cooperation, i.e., through the Nordic Council of Ministers (https://eippcb.jrc.ec.europa.eu/reference, accessed on 12 November 2023). P-01 confirms information given by P-06.
16	The “The Administration of Occupational Safety and Health” is a public institution that would only be involved in matters in case of a health and safety incident or accident. Should this institution be included in the STAMP system model?	P-02, P-03: No. The requirements of “The Administration of Occupational Safety and Health” governs what incidents must be investigated and what reports given after accidents of any kind. This organization is not a direct participant in a project, not rather than other public organizations, e.g., Data Protection Authorities, Police, and the Directorate of Labour. Out of project scope, not considered a stakeholder in the STMP system model.

in Appendix B. During meetings with stakeholders and actors where the system-level constraints were scrutinized, the five scenarios were defined and analyzed. The scenario analysis included a closer look at the possibilities for minimizing the system risk and obtaining the most favorable ownership arrangement. This examination resulted in choosing scenario 3 as the best solution.

Scenario 3 involves private ownership and suggests that the project is financed with equity capital and a construction loan. The scenario also implies that the operation will be public and that access to household waste is guaranteed. The risk factors in this scenario, at this stage, are related to (1) social risk and (2) risks related to investors and contracts with them; projects like this offer green investment potential, but investors are likely to want to minimize their risk with a turnkey contract project arrangement. (A turnkey project is constructed such that it can be sold to any buyer as a completed product. The Cambridge Dictionary provides a definition of a turnkey contract: “A contract in which a company is given full responsibility to plan and build something that the client must be able to use as soon as it is finished without needing to do any further work on it themselves” [59].)

Table A3. Overview of the STECA analysis.

WtE Incineration Plant—PPP Project—Preparation and Construction Phase
Stakeholder Id.	Name of Stakeholder	Responsibility	Feedback Needed [from Stakeholder(s) (Id.)]	Control Action [to Stakeholder(s) (Id.)]	Description of Control Action (CA)
S-1	Municipalities	Legal obligation to dispose of waste in a sustainable way Responsibility for establishing the proper governance in the preparation and early decision-making phase of the project Project feasibility study Project risk assessment Responsibility for financing the whole project Establishing the PPP partnership for the project Supervisor role	Analysis of technical possibilities to dispose of waste in a sustainable way [S-2, S-19] Results of a feasibility study [S-2, S-19] Estimates future cost without project [S-2, S-19] Financial backup or guarantee [S-9, S-13, S-14] Financial progress reports during project time [S-3] Public opinion [S-22]	(a) Approval of the project (sub-process1) [S-3] (b) Establish WtE Ltd. as a project owner (sub-process2) [S-3] (c) Responsibility for the project transferred to project owner [S-3] (d) Location decision for the WtE plant [S-3]	(a) The approval of the project is both an output of the approval sub-process that is partially prepared by S-2 (in a pre-phase of the project) and a requirement. (b) This is an output of the approval sub-process and a special establishment sub-process, but also a requirement. The WtE Ltd. will be formed if and when all the main municipalities in the country are ready to unite on the project—and if Minister for the Environment and Natural Resources of Iceland supports the project—and if (potential) investors, S-11, have been found. (c) This is an output of the approval sub-process. (d) This is an output of the approval sub-process and a requirement.
S-2	WMA—Waste Municipal Association	Serves the municipalities in establishing the WtE project Knowledge source	Intentions of municipalities [S-1] Public opinion [S-22]	(a) WtE feasibility study (sub-process3) [S-3] (b) Estimates amount of waste into WtE incineration plant [S-3] (c) Estimates composition of waste into WtE incineration plant [S-3] (d) Preliminary project plan [S-3] (e) Preliminary business plan [S-3] (f) Results from preliminary project risk assessment [S-3] (g) Overview of legal requirements for WtE incineration plant [S-3] (h) Informs authorities about the intended project [S-4, S-5, S-7] (i) Informs the public through web site and social media [S-22]	(a) The WtE feasibility study is an output of a sub-process managed by S-2. (b) A one-time output of the feasibility study but must be reviewed and confirmed by S-3 once the project starts. A design requirement. (c) A one time output of the feasibility study, but must be reviewed and confirmed by S-3 once the project starts. A design requirement. (d) An output of the feasibility study, but must be reviewed and confirmed by S-3 once the project starts. (e) An output of the feasibility study, but must be reviewed and confirmed by S-3 once the project starts. (f) An output of the feasibility study, but project’s risk must be re-assessed by S-3 once the project starts—and during design and construction phase. (g) An output of the feasibility study, but must be reviewed and confirmed by S-3 once the project starts. (h) This is a requirement; S-3 will take over once project starts. (i) This is a requirement; S-3 will take over once project starts.
S-3	WtE Ltd.—project owner	Project owner (PPP affiliate) Project management, including reg. quality, health and safety, environmental and sustainability requirements Ensures project financing Daily supervision during project time Appoints a design manager Appoints a construction manager Assigns auditors Applies for a construction permit for the intended project and provides the necessary data, e.g., environmental assessment	Results from a preliminary project plan [S-2, S-19] Results from a preliminary business plan [S-2, S-19] Results from a preliminary risk assessment [S-2, S-19] Project progress reports [S-15] Reports from auditors [S-21] Public opinion [S-22]	(a) Environmental impact assessment (sub-process4) [S-10] (b) Application for WtE plant, building permit application and building documents (sub-process5) [S-10] (c) Signs contracts with clear split of responsibility [S-1, S-10, S-17, S-18, S-19, S-20, S-21] (d) Starting the project [S-10, S-15, S-22] (e) Project plan [S-10, S-15, S-17, S-18] (f) Business plan [S-10, S-15, S-17, S-18] (g) Tendering the project (main contractor) [S-15, S-16] (h) Chooses main contractor and sign contract [S-15] (i) Informs the public through web site and social media [S-22] (j) Informs authorities about the project [S-4, S-5, S-7] (k) Seeks/monitors public opinion [S-22] (l) Assigns auditors [S-10, S-21]	(a) This is a one-time output of an environmental assessment process conducted by project owner and a requirement. (b) This is a one-time output of the building permit application. (c) This is an output. (d) This is a one-time output. (e) This is an output from feasibility study (from S-2), reviewed by S-3 and maintained as a “live” project plan, constantly reviewed through the project time. Also a requirement. (f) This is an output from feasibility study (from S-2), reviewed by S-3 and maintained as a “live” project plan, constantly reviewed trough the project time. Also a requirement. (g) This is both a one-time output and a requirement. (h) This is both an one-time output and a requirement. (i) This is a continuous CA. (j) This is a continuous CA. (k) This is a continuous CA. (l) This is a requirement.
S-4	Ministry of the Environment, Energy and Climate	Waste matters in accordance with the provisions of the regulatory framework for waste management, i.a., obligations under EEA law	Information reg. location of WtE plant [S-3] Information reg. environmental and health issues [S-3] Technical information reg. WtE plant [S-3, S-17]	(a) Supports the project in public [S-3, S-10] (b) Supports a possible application for a state guarantee [S-3]	(a) This is a continuous CA and a requirement. (b) This is a CA (may be possible).
S-5	The Environment Agency of Iceland	Enforces laws on pollution prevention, environmental responsibility, nature conservation, and hygiene—sets environmental regulation Issuance of operating license for the WtE plant	Project progress reports [S-3]	(a) Grants an operating license at the end of the project [S-3]	(a) This is a requirement and an output that needs to be renewed/maintained.
S-6	Municipality port	Provides harbor facilities for shipping to and from WtE plant location Examines conditions for harbor construction	Location of the WtE incineration plant [S-3] Design requirements [S-3, S-17] Materials and quantities for shipping [S-3, S-17]	(a) Builds a harbor near the WtE plant (sub-process6) [S-3]	(a) This is a requirement and a one-time output (needs maintenance from time to time).
S-7	National Planning Agency	Implementation of laws and regulations on environmental assessment of projects and plans Presents the project owner’s assessment plans and environmental assessment reports Issues an opinion on assessment plans and on the environmental assessment of a project based on the developer’s environmental assessment report and comments received on it	Environmental impact assessment [S-3]	(a) A written statement (opinion) regarding the assessment plans and the environmental assessment of a project based on the developer’s environmental assessment report and comments received on it [S-3, S-10]	(a) This is a requirement and a one-time output.
S-8	The Road and Coastal Administration	Determines the roadway Negotiates with landowners Road design	Location of WtE incineration plant [S-3] Location of WtE harbor [S-3, S-6]	(a) Road construction (sub-process7) [S-3]	(a) This is a requirement and a one-time output (needs maintenance from time to time).
S-9	Regulatory body for buildings and constructions	Monitoring of the implementation and compliance with laws and regulations reg. buildings and constructions Investigation of whether building regulations are violated or not followed Operation of a database for information on buildings and construction	Notification if law or regulation is violated [S-10, S-18]	(a) Monitoring of the implementation of the law on buildings and constructions [S-3]	(a) Monitoring is a legal requirement.
S-10	Building licensor (municipality/landowner) of WtE construction site (many sub-institutions, fire brigade, health committee, planning committee, and politicians)	Review of building permit application and building documents Confirming consistency in the regional development plans Grants a building permit Investigation of major accidents and injuries, if and when they occur Work status checks	Main drawings and building description documents [S-3, S-19] Consent of co-owners or other parties as appropriate [S-1, S-13] Work progress plan [S-3] Signed declaration of responsibility from master builder etc. responsible for individual work components [S-15, S-16] Design manager’s overview of internal control during the implementation of the design [S-17] Design manager’s overview of responsibilities of individual designers and their signature to confirm that this is a comprehensive overview [S-17] Statement from the construction manager [S-18]	(a) Issuance of a building permit (sub-process8) [S-3] (b) Review of work status check reports [S-3] (c) The licensor carries out a safety and final audit in accordance with the provisions of the inspection manual and inspection list and issues certificates for them [S-3] (d) Launches an accident investigation [S-3]	(a) The building permit is a requirement and a one-time output of the building application and document review. (b) Work status checks are a requirement. (c) A safety and final audit report is a requirement and a one-time output at the end of the project. (d) An accident investigation is a legal requirement.
S-11	Parliament	Makes legislation reg. waste disposal, environment, health, and safety	Legal requirements needed [S-4, S-12]	(a) Legislation [S-1, S-3, S-10]	(a) The project needs to comply with legislation at all times. Changes in relevant legislation must be monitored. This is a requirement and a continuous CA.
S-12	European Union (EU)	Coordinates waste and environmental issues within the EU Working groups with the participation of individual countries	Intendment and requirement of EU and EEA member states [S-4, S-5]	(a) EU directives on waste and environmental issues [S-4, S-11]	(a) The project needs to comply with EU directives at all times. Changes in directives must be monitored. This is requirement and a continuous CA.
S-13	Investors	Co-finance	Business plan [S-3] Financial progress [S-3]	(a) Provides contractual capital [S-3]	(a) This is a requirement.
S-14	Banks	Co-finance	Business plan [S-3] Investment need [S-3 ] Financial progress [S-3]	(a) Provides loans with acceptable collateral [S-3] (b) Line of credit [S-3]	(a) This is a requirement, based on the output of the business plan and capital from investors. (b) This is requirement and a continuous CA during project time.
S-15	Main contractor	Human resources available when needed Necessary equipment available when needed Project management on site Tenders and selection of subcontractors Project risk assessment Coordination of subcontractors Assesses, monitors and manages risk on project site Finishes the project on time	Project progress reports from subcontractors [S-16] Incident reports from subcontractors [S-16] Information reg. availability of necessary resources from subcontractors [S-16]	(a) Subcontractors’ tenders and agreements [S-16] (b) Regular project progress reports [S-3, S-18] (c) Delivers project (and individual) work packages safely and on time [S-3, S-10] (d) Registration of incidents and nonconformities [S-3, S-9, S-10, S-18] (e) Root cause analysis of incidents and nonconformities that happen on project site (sub-process9) [S-3, S-9, S-10, S-18] (f) Incident reports [S-3, S18]	(a) This is a requirement and subcontractor agreements are outputs of the tender sub-processes. (b) This is a requirement and a regular output of management team. (c) This is a requirement and a regular output of management team. (d) This is a requirement and a regular output of management team. (e) This is a requirement and an output of incident review process. (f) This is a requirement and a regular output of management team.
S-16	Subcontractors	Subcontractors available on time Risk assessment for work packages carried out Professional knowledge and experience	Project requirements in written main contracts [S-13] Timed work schedule [S-13]	(a) Project progress reports [S-15] (b) Incident reports [S-15] (c) Delivers work packages safely and on time [S-15] (d) Involvement in project risk assessment [S-15]	(a) This is a requirement and a regular output of S-16 to S-15 to S-3. (b) This is a requirement and a regular output of S-16 to S-15 to S-3. (c) This is a requirement and a regular output of S-16 to S-15 to S-3. (d) This is a requirement and an output of a limited risk assessment.
S-17	Design manager	Submission of design data/drawings for approval for a building permit application Compiles a report on the designer’s area of responsibility and confirms with their signature that it is a comprehensive overview Handles the owner’s internal control for the design of the construction Organization of coordination of design data	Design data from individual engineers and designers [S-19]	(a) Compiles design data from individual engineers and designers [S-3, S-10] (b) Signing a compiled statement on the responsibilities of designers and confirmation (with sign.) that the overview is comprehensive [S-3, S-10] (c) Internal control during the design phase [S-3, S-10]	(a) This is a requirement and an output of the design data compiling process. (b) The signature of a certified design manager is a requirement and a one-time output of the design process. (c) This is a requirement and a continuous CA.
S-18	Construction manager	Makes written agreement with the master craftspeople which they hire on behalf of the owner Carries out the owner’s internal control from the time the building permit is issued until the final assessment has taken place Carries out phased audits according to the inspection manuals Professional representative of the Project Owner [S-3] Requests a final audit before the WtE plant is started Operation of a quality management system	Operating license from the regulatory body for buildings and constructions [S-9] Written contract with project owner [S-3]	(a) Signed statement by the construction manager regarding responsibility for the project so that a building permit can be granted [S-3, S-10] (b) Internal control (phase evaluation) during the construction phase [S-3, S-10, S-21] (c) Request and be present at a safety assessment for parts that are finished and ready for use [S3, S-10, S-21] (d) Requests a final audit on behalf of the project owner and ensures that all necessary documents are available during the audit [S-21]	(a) The signature of a certified construction manager is a requirement and a one-time output before the construction process starts. (b) This is a requirement and a continuous CA. (c) This is a requirement. (d) This is a legal requirement.
S-19	Engineers, consultants and designers	Business plan Risk analysis and risk assessment Information gathering Design of the WtE plant	Project information and requirements [S-2, S-3]	(a) Technical and design plans for WtE plant [S-3] (b) Financial plan for WtE plant [S-3]	(a) This is a requirement and an output from the project plan. (b) This is a requirement and an output from the business plan.
S-20	Insurance companies	Insurance	Need for insurance [S-3] Notification about loss, damage, and mishaps [S-3]	(a) Insurance benefits due to damages, financial losses and mishaps based on insurance contracts (sub-process10) [S-3]	(a) This is a requirement and an output from sub-process10.
S-21	Auditors, inspection agencies, e.g., the Government Property Agency	Auditing standards and process Financial auditing Health and safety, quality, security, and environmental management auditing ESG auditing	Project progress reports [S-3] Cost statement from project owner [S-3] Incident reports [S-3]	(a) Financial audit reports [S-3, S-10] (b) EGS audit reports [S-3, S-10] (c) Reports on health and safety, quality, security, and environmental management [S-3, S-10]	(a) This is a requirement and an output of an audit process. (b) This is a requirement and an output of an audit process. (c) This is a requirement and an output of an audit process.
S-22	The public	Approve of the project, Remain critically engaged	Information reg. the project and project progress throughout the project time, esp. health and safety, and environmental issues [S-3]	(a) Project support [S-3] (b) Ask critical questions [S-3] (c) Provide restraint if there is a reason [S-3]	(a) This is a requirement and a continuous CA. (b) This is a requirement and a continuous CA. (c) This is a requirement and a continuous CA.
S-23	Parties of the labor market	Preserve peace in the labor market	Information on wage-related issues [S-3, S-22]	(a) Wage settlements [S-3] (b) Peace in the labor market [S-3]	(a) This is a requirement, but the project has only little influence on this. (b) This is a requirement, but the project has only little influence on this.
S-24	Electrical grid company	Provides a connection to an electricity transmission system through a substation Transmits electrical power generated by the WtE plant to buyers	Project time schedule [S-3] Information on est. electrical power production [S-3]	(a) Agreement on transmittance of electrical power through a grid system (sub-process11) [S-3]	(a) This is a requirement and an output of a negotiation from sub-process11.
S-25	Hot water distribution company	Provides a connection to the hot water distribution system Distributes the hot water coming from the WtE plant	Project time schedule [S-3] Information on est. water temperature and quantity [S-3]	(a) Agreement on distribution of hot water through a pipeline system (sub-process12) [S-3]	(a) This is a requirement and an output of a negotiation from sub-process12.
S-26	Concrete plants and tarmac production units (buildings and roads)	Use of good and affordable additive building materials	Est. amount of solid waste residues [S-3] Information reg. quality of solid waste residues [S-3] Est. price of solid waste residues [S-3]	(a) Purchase agreements on solid waste residue as additives for the construction industry for buildings and roads (sub-process13) [S-3]	(a) This is a requirement and an output of a negotiation from sub-process13.

in Appendix C is an extension of Table 6 and gives an overview of the feedback and actions needed for all 26 stakeholders listed in Table 6. The first column shows the stakeholder’s number (S-1–S-26), the fourth column shows the feedback (in Arabic numerals) received from another stakeholder (in square brackets), the fifth column shows the action (in lowercase alphabet letters) the respective stakeholder must provide to another stakeholder (in square brackets), and the last column shows a description for each action (equivalent in lowercase alphabet letters). The table setup is equivalent to the setup shown in Table 2, based on STECA.

As Table A3 illustrates, the STAMP system model of the project, developed with the STECA technique, is comprehensive and detailed. It is based on a systems theory and a systematic method that has been used in various projects in recent years. The sub-processes identified in the third column, marked in blue, have been identified by stakeholders and actors as system elements that need further modeling when a decision is made to undertake the project.

6. Discussion

In this study, a relatively new methodology and techniques and tools are proposed for achieving the objectives of a safety and security-based design of a major national infrastructure. It was tested on the example of a WtE project. In this, many academic fields were involved, i.a., safety science, risk analysis, project management, stakeholder theory, systems theory, and social science. The focus was on risk analysis and risk management. Designing and building a major national infrastructure that is very costly, takes many years, and concerns all citizens of a country is a challenge. The project not only needs to be financed, but it must also be supported by both the public and politicians. If executed, the project would also be an important step in making Iceland sustainable in waste management.

In the study, SbD has been chosen as an engineering concept for risk management. It is a way to consider safety and security as much as possible from the beginning. Through communication, the SbD concept enables engaging different stakeholders throughout the development process and making their viewpoints and expectations understandable and transparent to each other.

The analysis methods and techniques of STAMP, STPA, and STECA were used to identify and evaluate actors and stakeholders, and appendant hazards and threats. They are based on systems theory and enable the development of a system model of the project. These methods have proven to be successful in analyzing complex systems. With STAMP, a system model of a WtE incineration plant was created including all influential stakeholders according to laws and regulations. In the beginning, however, only local authorities were considered to be internal stakeholders according to law, but since all the country’s citizens and companies are buyers of waste management services, there are many stakeholders in this project. Only the country’s general governmental system is excluded here, e.g., police and courts, since their involvement is only as general actors.

The results of the analysis of stakeholders and their roles, responsibilities, and necessary feedback and actions, are summarized in Table 4 and Table 5, and an overview is given in Table A3 in Appendix C. These tables contain quite detailed information that has been confirmed in the study, as described in this article. Then, Figure 6 shows the system model of the entire project and the relationships of all stakeholders involved in it. The STPA software tool (first version) greatly facilitated the modeling work, which involved many iterations.

All the data obtained in this analysis work are important for the progress of the project. Based on this data, with the involvement of stakeholders, the fact was brought out that the most important thing at an early stage is to find the right composition for the project’s owner group based on the requirements that will later become most significant in the operation of the WtE incinerator. Stakeholders came up with five possible scenarios, of which one was considered the best. This scenario (scenario 3) involves private ownership and that the project is financed with equity capital and a construction loan. The scenario also implies that the operation will be public and that access to waste is guaranteed. The risks are both social risks and risks related to investors and contracts with them. Projects like this offer green investment opportunities, but investors are likely to want to minimize their risk with a turnkey contract project arrangement. They are also likely to want the transparency and security that ISO audits and certification provide.

This study shows that the STAMP, STECA, and STPA hazard/threat analysis techniques can be applied in order to achieve safety and security-based design. These techniques can be used to identify stakeholders in a complex system and involve them and other actors in reviewing the system and its individual components. The system model serves as a basis for communication between stakeholders and actors and helps make not only their roles and responsibilities understandable and transparent, but also their viewpoints and expectations. STAMP, STPA, and STECA prove to be useful when analyzing a complex system/project and determining how best to design safety and security into a system.

In this study, the subject is a WtE incineration plant, which is an important sustainability project in any country. Figure 6 shows the system model of the project developed in this study. With the STAMP method, it was possible to identify 26 actors and stakeholders, some of which represent types of homogeneous stakeholders. They each have a role and responsibilities defined by laws and regulations. Only the municipalities can be considered internal stakeholders in the beginning since they carry responsibility for waste management by law. It is up to the politically elected local authorities to decide if and when the project will be carried out.

Figure 6 also shows the necessary feedback each stakeholder needs for their actions in the system and shows the importance of the project owner (stakeholder S-3) as the main controller in the system. The controlled system, the actual WtE project, depends on that stakeholder. The responsibility for waste management that the municipalities carry (stakeholder S-1) is forwarded to the project owner. The municipalities are not able to execute the project on their own due to a lack of funds. The already existing SORPA Waste Municipal Association (stakeholder S-2) is not able to carry out the project, as the operating form of a municipal association does not allow the participation of private parties in the project and is subject to strict rules regarding tax and tender issues. It is not enough that there is political will to execute the project; private parties with enough resources are also needed to execute it, and the people of the country must look at the project positively and see their interest in it being addressed. Until now, there has been little progress in the project, but with the knowledge created in the preliminary project, carried out in 2021 [9], and in this case study, this might change. At this early stage, it is important to ensure that the project gets off to a good start, that risks are identified from the beginning, and that a suitable combination of owners is found, all while securing the funds and minimizing the project’s risks. It is a prerequisite that other aspects of the project go well.

The decision-making process of the project, i.e., how to start the project and finance it and how to establish the owner group and share risk, is, however, complicated. There are many stakeholders and actors that influence the project in various ways, and they carry a variety of risk factors that need to be communicated and understood. These are both private and public parties, and their partnerships need to be carefully analyzed to find the optimal structure. The partnerships and all their prerequisites and criteria must be carefully thought out before the project begins. It must also be ensured that the legislation is sufficiently clear regarding tender requirements, possible competitive factors, material flows for incineration, and the division of responsibilities between municipalities and all the other parties involved in the project. There are two types of public bodies involved in the project, the local authorities and the governmental authorities, with politically elected representatives who are replaced at different times. The project also includes private parties and investors who will participate in the project after a decision has been made to go ahead with it. Only then can the actual preparatory work for the project begin, e.g., design and tendering. In the case discussed here, it is likely that known solutions in combustion technology will be able to be used. Less known is the technology of carbon capture and storage during operation.

This study shows that there is a need for a continuous and revised analysis of risk factors during the project’s life cycle. After the WtE incinerator has been built and daily operations start, regular risk analysis and risk assessment must be carried out continuously, but this will most likely follow a standard process and be part of the internal control and coordinated management system of quality, safety, health, and environmental factors. To ensure reliability and credibility, it may be wise to build the management system based on international ISO standards and obtain accredited ISO certifications for the entire operation.

It is not a coincidence that all ISO management standards now require risk analysis as a part of decision making and good governance. The standards, however, do not give much guidance on how to conduct risk analysis. This study shows that the STAMP, STPA, and STECA techniques are effective when preparing big and complex projects that may take years to complete, like a WtE project. Their use helps to organize the project in an optimal way, also considering time factors. It supports decision making regarding both when and how it is best to take every step in the project. By identifying risk factors in time, it is possible to find ways to mitigate risk and make it manageable. This study confirms results from Bjerga et al. [53], who indicate that it provides a suitable approach to analyze risk in complex systems, with a focus on the treatment of uncertainty and potential surprises linked to the operation of complex systems. The application of ISO standards is a demand of many investors who want to invest in green and environmentally friendly projects of this kind. Accredited certification of the project may, therefore, facilitate the financing of the project [18,19,20].

This study also reveals the great responsibility government and municipalities have regarding infrastructure projects like this one, to ensure there is an administration that finds the right channel for its preparation and all associated decisions. The law in Iceland is not clear in this regard, and this must, therefore, be considered a risk. One way to mitigate this risk would be to set up a special law for the project. There are precedents for this in the case of major national infrastructures, e.g., energy infrastructure.

7. Conclusions and Future Work

This study shows that STECA, as an early concept analysis variant of STPA, can be used to identify necessary stakeholders, analyze their responsibilities and roles, identify necessary feedback and control actions, and model the control structure of the system. This is, furthermore, an effective technique to integrate systemic safety and security into a major and complex infrastructure project like the WtE project studied in this article. The results show that the current mandatory administrative structure of a municipality association is not suitable as a governance structure for this kind of project. Municipalities have a legal obligation to dispose of waste in a sustainable way, but they have limited funds for large and costly projects like this one. This means that municipalities must participate in the project and be responsible for it according to law, but they cannot execute the project alone. They are public entities and are exempt from tendering requirements. Other investors, however, must submit to tender requirements. The project is, however, a feasible investment option for long-term investors, like those managing pension funds or investment funds, who prefer a steady return on investment. As a “green” project, it is also a feasible investment opportunity for those who choose to invest in sustainable and environmentally friendly projects. It is, therefore, necessary to assess the potential scenarios of the WtE project and analyze its risk further regarding each possible participant and quantify the outcomes that could be expected from each. For example, the possible operating arrangements of owners and operators must be differentiated and analyzed. The results of this study show that it can be beneficial to establish the project owner of the WtE incineration plant as a limited liability and listed company, but the operator could be a public organization, owned by municipalities, that rents the incineration properties and runs the plant, and so be exempt from tender obligations. With scenario analysis, it is possible to analyze more precisely the implementation opportunities of this project. It is worth mentioning that legislation on a national incineration plant could guarantee such a project. There is an example of such legislation for Reykjavík Energy from 2013. The law on the establishment of the national grid (Landsnet) in the year 2004 as a concessionaire for electricity transmission and the operation of the main electricity system in Iceland with independent board members with sufficient knowledge and experience is an example of how to ensure the professional operation of an important high-tech infrastructure company.

The study, furthermore, shows the importance of continuous and revised analysis of hazards, threats, and risks during the project period. After the WtE incinerator is built and daily operations begin, regular risk analysis and risk assessment must be carried out continuously, but this will most likely follow a standard process and be part of the internal control and coordinated management system of quality, health and safety, and environmental factors. To ensure reliability and credibility, it may be wise to base the management system on international ISO standards and obtain accredited ISO certifications for the entire operation. This study shows that in combination, STAMP, STPA, and STECA are powerful analysis techniques that can be used in the early stages of project design and throughout the project for all critical decision making.

The limitation of this study lies in the data available at this early stage of the project. There is great uncertainty about most aspects of the project since no decision has been made regarding the location of the WtE incineration plant. Most people involved have a limited view and understanding of the whole project and mainly look at the aspects that affect them. The representatives of the municipalities who sit in the town councils are the ones who have the most control over the project at the beginning. They are politically elected for four years, and in politics, there is a tendency to disagree on issues rather than to agree on decisions. Therefore, the opinions of the public, who are also voters, are important. It is also a limitation of this study that many people who have participated in this study have limited experience and understanding of the implementation of risk analysis and how best to use it for decision making.

The findings, however, show that there is a strong reason to further investigate the feasibility of this project. A former feasibility study shows that gate fees and the investment that the project requires are acceptable in comparison to the current costs. It is important to ensure transparency in a project like this, where many parties have interests.

This study contributes to safety science, risk management, and project management. It utilizes, in an important way, different fields of study to improve important infrastructure projects that concern scientists, and many others, a great deal.

In future work, the authors plan to further explore the benefits of using STAMP and STPA in the project management of this WtE project when the decision has been made to start it.