InD.deWaard,A.Axelsson,M.Berglund,B.Peters,andC.Weikert(Eds.)(2010).HumanFactors:Asystemviewofhuman,technologyandorganisation(pp.185-198).Maastricht,theNetherlands:ShakerPublishing.Accidentmodelling:fromsymptomtosystemJohnStoop1,2&SidneyDekker21DelftUniversityofTechnology,TheNetherlands2LundUniversity,SwedenAbstractAseriesofsurveysonaccidentinvestigationmodelsshowawidevarietyofmodels,dedicatedtospecificindustrialapplications,domainsandinvestigationaspects.Inparticulartheinvestigationofhumanfactorsisexposedtoawidediversityofmodels.Inreviewingsuchmodels,themajorityprovestobeaderivatefromtheReason’sSwissCheesecausationmodelortheRasmussenmodelonsystemhierarchy.Mostofthemodelsoriginfromtheprocessindustryandtheenergysector.Applicationintheaviationindustryhasrevealedtheirconceptuallimitations.Duetotheirsimplificationsandlayinterpretations,theirinterventionpotentialinpracticeislimitedtolinearsolutions.Inordertocopewithsocio-technologicalinteractionsinamulti-actorperspective,afullsystemsengineeringdesignapproachshouldbeappliedinamissionspecificoperatingenvelope.Suchanapproachissubmittedtothreeparadigmaticshiftsininvestigationmethodology.First;disengagementisrequiredbetweeneventmodellingandsystemsmodelling.Second;adistinctionintwodesignclassesisrequired.Adistinctionismadebetweenlinearinterventionswithintheexistingdesignenvelopeandsecondorderinterventionsfocusingonexpansionofthedesignsolutionspace.Third;designingsafersolutionsinamulti-actorsystemsenvironmentrequiresprototyping,virtualsystemmodelsimulationandtestingoflimitstatescenarios.Basedontheseconstraints,aframeworkforsafetyenhancementisdescribed,derivedfromexperiencesintheaviationindustryitself.Thisframeworkisbasedonanewviewonhumanerror,adynamicsystemsengineeringdesignapproach,analyticalforensicabilitiesandinstitutionalconditionsforindependentandqualifiedaccidentinvestigations.AccidentsandcausationAlthoughaccidentmodelshavebeenappliedonalargescaleinpractice,areflectionontheirmethodologicalassumptions,scopeanddeficienciesrevealsseveralschoolsofmodelling.Severalsurveysindicateconsecutivegenerationsofmodels,theirpoormethodologicalbasis,absenceofasystemsapproachandafocusontheapplicationofmodelsbylaypeople(Benner,1975,1985,1996,2009;Sklet,2004;ESReDA,2005).ThefirstaccidentcausationmodelsasderivedbyHeinrichinthe1930’sreferredtoaccidentanalysisbymetaphors,suchastheIcebergPrincipleandDominoTheory.Inasecondgenerationofthe1970’sBirdandLoftusappliedalinearcausality,whileKjellenintroducedthedeviationconcept.Multi-causalitywas186Stoop&DekkerintroducedbyReason,definingaccidentasaninteractionbetweenlatentandactivefailures,andinordertoavoidsuchinteraction,apro-activeinvolvementoftopmanagement.Basedonattributiontheory,inthe1980’sHaleandGlendonwereconcernedabouthowpeopleprocessinformationindeterminingthecausalityofevents.Theyfocusedonthenon-observableelementsofthesystem:perceptionsanddecisions.WhileReasondevelopedhismodelonorganizationalaccidentcausation,anextstepwastakenbyHollnagel(2008)whoidentifiedthesystemasthefullcontextinwhicherrorsandaccidentsoccur.Agradualdevelopmentofaccidentmodellingshowsthreegenerationsofhumanerrormodelling,fromasequentialaccidentmodel,viahumaninformationprocessingaccidentmodelstowardssystemicaccidentmodels(Katsakiorietal.,2009).Theevolutionexpandsthescopeoftheinvestigationfromsequencingeventstowardsarepresentat...