Accident Analysis Methods and Models —

a Systematic Literature Review

H.C.A. Wienen, F.A. Bukhsh, E. Vriezekolk, R.J. Wieringa

2017–06–04
 Abstract
As part of our co-operation with the Telecommunication Agency of the Netherlands, we want to
formulate an accident analysis method and model for use in incidents in telecommunications that
cause service unavailability. In order to not re-invent the wheel, we wanted to first get an overview
of all existing accident analysis methods and models to see if we could find an overarching method
and commonalities between models. Furthermore, we wanted to find any methods that had been
applied to incidents in telecommunication networks or even been designed specifically for these
incidents. In this article, we present a systematic literature review of incident and accident
analysis methods across domains. We find that accident analysis methods have experienced a
rise in attention over the last 15 years, leading to a plethora of methods. We discuss the three
classes in which they are often categorized. We find that each class has its own advantages
and disadvantages: an analysis using a sequential method may be easier to understand and
communicate and quicker to execute, but may miss vital underlying causes that can later trigger
new, similar accidents. An analysis using an epidemiological method takes more time, but it also
finds underlying causes the resolution of which may prevent accidents from happening in the
future. Systemic methods are appropriate for complex, tightly coupled systems and executing
such a method takes a lot of time and resources, rendering it very expensive. This will often not
be justified by the costs of the accident (especially in telecommunications networks) and it will
therefore be too expensive to be employed in regular businesses.
We were not able to find any published definitions of structured methods specific to telecommu-
nications, nor did we find any applications of structured methods specifically to telecommunica-
tions.
Contents

1 Introduction 4
1.1 Accident analysis methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2.1 Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2.2 Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.2.3 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.2.4 Methods and Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.2.5 Entities of the models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.2.6 Modeling Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.3 Structure of this report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2 Research Method 8
2.1 Research Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.2 Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3 Strategy and execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.3.1 Overview of the selection process . . . . . . . . . . . . . . . . . . . . . . . 9
2.3.2 Step 1: Database selection . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.3.3 Step 2: Article selection based on title and abstract . . . . . . . . . . . . 10
2.3.4 Step 3: Article selection based on full text and references . . . . . . . . . 11
2.3.5 Step 4: Data extraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3 Results 13
3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.2 Descriptive statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.2.1 Domains in the corpus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.2.2 Articles per class and per year . . . . . . . . . . . . . . . . . . . . . . . . 14
3.3 Qualitative Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.3.1 Sequential Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.3.2 Epidemiological Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.3.3 Systemic Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.3.4 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.3.5 Generic Accident Analysis Method . . . . . . . . . . . . . . . . . . . . . . 21

4 Discussions and Conclusions 23

4.1 Threats to validity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
4.1.1 Estimation of the size of the validity threat . . . . . . . . . . . . . . . . . 23
4.2 Answers to research questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
4.2.1 Answers to research question 1 . . . . . . . . . . . . . . . . . . . . . . . . 23
4.2.2 Answers to research question 2 . . . . . . . . . . . . . . . . . . . . . . . . 24
4.3 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4.4 Future work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

A Query Results and overview of accident analysis methods 26

A.1 Query Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
A.2 Number of articles per journal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
A.3 Characteristics for 63 methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
A.4 Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
A.5 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
A.6 Reviewed papers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

3
1. Introduction
The European Telecommunication Agency Enisa (European Union Agency for Network and In-
formation Security) publishes an annual report about significant outage incidents in the European
electronic communications sector. The Telecommunications Agencies of the countries constitut-
ing the EU have to report their local significant outage incidents to Enisa. In the Netherlands,
this is the responsibility of the Dutch Telecommunication Agency (Agentschap Telecom, ag).
We have started a project in co-operation with ag (the Linc project – learning from incidents in
telecommunications networks) in order to learn lessons from the incidents the telecommunication
operators are obligated to report to ag. These lessons can help telecommunication operators to
improve their operations and thereby prevent future incidents from happening. To facilitate this
process, ag need to know which information to gather from the telecommunication operators. To
determine this, we want to formulate an accident analysis method and model for use in incidents
in telecommunications that cause service unavailability.
The purpose of this report is to find the state of the art in accident analysis methods as a
starting point for formulating an analysis method that can be applied to incidents and accidents
in telecommunication networks.

1.1. Accident analysis methods

In many domains (e. g. Aviation and Nuclear Energy), incident and accident analysis forms an
integral part of safety and innovation. Many researchers have analyzed incidents and accidents
to gain new insights into system errors and impact of these errors on the safety of stakeholders.
Sometimes the researchers used a rigorous framework to analyze these incidents, and sometimes
they did so without such a framework.
Having such a framework in place makes it easier to compare di↵erent incidents and accidents
and to draw conclusions about common elements in those models. More generally, in order to
draw lessons learned from incident and accident analyses across domains, we review the state of
the art of incident and accident analysis methods. Our goal is to find commonalities across these
methods, which should support drawing lessons learned across di↵erent domains. In addition,
our goal is to identify strengths and weaknesses in the reviewed methods, in order to define a new
method based on the strong elements of the existing methods. The first application domain for
this new method would be telecommunications, as this is the domain we are primarily focused on
as part of our current research, but it should be generic enough to be applicable to all domains
and useful for all practitioners of incident and accident analysis.

1.2. Definitions
So what constitutes an incident and what constitutes an accident? The literature uses multiple
definitions for these terms, while the telecommunications sector uses their own. Generally, the
di↵erence between the two is that an incident is a deviation from the standard that does not lead
to losses, while an accident is an incident that causes loss or harm. Incidents are often defined
as a near-accident. The term near misses is also employed for incidents.

1.2.1. Accidents

Here are some examples of definitions of the concept of accident:

4
Leveson an undesired and unplanned event that results in a loss (including loss of human life or
injury, property damage, environmental pollution, and so on). [145, p. 467]
Harms-Ringdahl an event that causes unintentional damage or injury. [83, p. 13]
DOE Workbook Conducting Accident Investigations an unwanted transfer of energy or an en-
vironmental condition which, due to the absence or failure of barriers or controls, produces
injury to persons, damage to property, or reduction in process output. [260, p A-1]
Doytchev an undesired event or sequence of events causing injury, ill-health or property damage
[54]
From these definitions, it follows that an accident must at least be undesirable. The authors all
agree on the fact that an accident causes damage. This damage ranges from damage to property,
reduction of production, to injury and death. Note that the definition given by the DOE makes
explicit use of entities of the model they use. That definition is therefore specific to their model
and not as generic (or model agnostic) as the other three. Leveson adds the idea that an accident
must be unplanned. The other definitions do not include this extra criterion. We feel that this
unexpected aspect is a valuable addition: a loss that is planned, is not accidental, even though
it may be undesirable. In the remainder of this reportwe use a slightly more general version of
Leveson’s definition of the concept of an accident:
An Accident is an undesired and unplanned event that results in a loss, damage or injury.

1.2.2. Incidents

Here are some examples of the concept of an incident:

Leveson an action that ‘involves no loss (or only minor loss) but with potential for loss under
di↵erent circumstance’ [21]
Harms-Ringdahl (or near-accident) is an event that almost causes unintentional damage or in-
jury. [83, p. 36]
DOE Workbook Conducting Accident Investigations no definition available
Doytchev an unplanned, undesired event that hinders completion of a task and may cause injury
or other damage [54]
Fukuda an event that has the possibility to cause an accident but does not fortunately in actu-
ality, or a slight abnormal event without a substantial obstacle or damage [66]
Three out of these four definitions state that incidents do no or only minimal harm, but they
could have caused greater losses if the circumstances were di↵erent. Doytchev does not limit the
harm that can be caused by an incident, but ties an incident to a specific task that cannot be
completed due to the incident. This seems to be very specific to a model containing tasks and
we feel this is too restrictive. In the remainder of this report, we will use the following definition
of an incident:
An Incident is an undesired and unplanned event that did not result or only minimally resulted
in a loss, damage or injury, due to favorable circumstances. Were the circumstances di↵erent,
it could have developed into an accident.
As an aside, we noted that in medicine, an incident does involve harm - as evidenced by the
following definitions:
Critical Incident An incident resulting in serious harm (loss of life, limb, or vital organ) to the
patient, or the significant risk thereof [63]
Clinical Incident any event or circumstance which has actually, or could potentially, lead to
unintended and/or unnecessary mental or physical harm to a patient. [57]
Medication Incident Any preventable event that may cause or lead to inappropriate medication
use or patient harm while the medication is in the control of the healthcare professional,
patient, or consumer [63]
The incidents in medicine would be covered by our definition of an accident, as (serious) harm
is the result of a medical incident. We have not observed the use of the term accident in
telecommunications. This has been confirmed by the Telecom Operators we have discussed
our findings with. They use the term incident even if the situation causes grave financial and

5
reputational harm. Also in cases in which people may actually have been harmed (e. g. in the case
of unreachability of emergency services due to unavailability of telecommunication networks), the
term incident is used.
In the remainder of this report, we will only consider accidents. Although incidents are interesting
as well, the data we have overwhelmingly contain accident data. Furthermore, we will adhere
to the terminology used in the literature. This means that we will use the term accidents even
though it is common practice within telecommunications to use the term incidents to refer to
events that fall under our definition of accident.

1.2.3. Damage

The concept of damage plays a central part in distinguishing incidents from accidents. It
should be noted that damage is a localized concept: although there may be no damage in
the system under consideration itself, there may be substantial damage in the environment in
which the system operates. In this case, whether a critical event constitutes an incident or an
accident depends on where you place the boundaries of the system. E. g., if telecommunications
service unavailability is avoided by containing the potentially fatal consequences of an event,
this constitutes an incident, even if this means that the containment itself may have financial
consequences (and thus damages) for the telecommunication operator.

1.2.4. Methods and Models

For the purpose of this report, we use the following definitions of methods and models:
Method A sequence of steps to achieve a result
Model A a conceptual structure by which an incident is modeled
An accident analysis method that is based on a sequential accident model will be called a se-
quential (accident analysis) method. Similar definitions apply to epidemiological and systemic
accident analysis methods.

1.2.5. Entities of the models

Although the di↵erent models feature a host of entities, three are central to many of the models
and of the generic models. They are: events, actions, conditions and barriers. Most models do
not provide definitions for these concepts and this implies that not all models use the concepts
interchangeably. This does not seem to pose any problems, as the concepts are largely used in
the same manner, but room for ambiguity remains. We did not perform a thorough analysis of
the use of the concepts for definition purposes, but for our work, we feel that they should be
defined explicitly. Our definitions are modeled after system theoretical concepts.
Event A change of state in the system that is important enough to give it a name.
Action The fact or process of doing something, typically to achieve an aim [194]
Condition A state of the world that enables a certain class of state changes.
Barrier A state of the world that inhibits a certain class of state changes.

1.2.6. Modeling Narrative

In the descriptions of the di↵erent methods in appendix A.3 we use the term modeling narra-
tive. A modeling narrative is a short story that takes the di↵erent entities of a model and places
them in context. This clarifies the relations between the entities.

6
1.3. Structure of this report
Chapter 1 introduces the subject to the reader. In chapter 2 (Research Method) we describe the
scope of our research and how we found the methods that are the subject of the rest of the report.
In chapter 3 (Results) we present the results of our literature review, both quantitatively (3.2)
and qualitatively (3.3). We then return to our research questions and answer them in chapter 4
(Discussions and Conclusions). In that chapter we also discuss possibilities for future research.

7
2. Research Method
This section lists the research questions and how we intended to and did answer them. It describes
the criteria for selecting the relevant bibliographic databases, the selection of possibly relevant
articles, and the pruning method to get to the final list of articles under consideration.

2.1. Research Questions

The questions we pose ourselves for this research are the following:
1. What is the state of the art in incident and accident analysis methods?
a) Which incident analysis methods are in use today?
b) Which incident models are in use today?
c) What are the comparative strengths and weaknesses of these methods?
2. Can we draw up a generic model encompassing all current incident methods and models?
a) What are domain-specific entities, attributes, and relationships in incident models?
b) Can we formulate a generic analysis method and model?

2.2. Approach
We have chosen to cast our net as wide as possible. That means that the scope for this inves-
tigation covers domains as varied as nuclear industry, aviation, space flight, chemical industry,
traffic, telecommunications, outdoor activities and emergency services.
The approach for answering the research questions is as follows:
• We start by defining our inclusion and exclusion criteria for the literature databases and the
articles to be used
• We then define the query we use to interrogate the di↵erent databases at our disposal
• We select the databases and query them
• We then select the articles that are pertinent to our research (see 2.3)
This will provide us with a set of articles that we can subject to the following two top level
research questions:
1. Which method was used in this article?
2. Which model was used in this article?
We then will compare the identified models and methods and try to extract:
1. A generic model in order to answer Research Question 2
2. A specific model per domain in order to answer Research Question 2a
3. A generic method in order to answer Research Question 2b
With this approach, we will be able to maximize our chances of finding commonalities among
methods across domains, draw lessons learned from this, identify strength and weaknesses, and
be able to define a generic incident analysis method and model that can be easily adapted to the
telecommunications domain in the future.

8
2.3. Strategy and execution

2.3.1. Overview of the selection process

Our systematic review started with the selection of data from 108 databases and ended with 63
identified analysis methods. This section describes the selection process. An overview of the
process is drawn in figure 2.3.1.

Step 1 Step 2 Step 3 Step 4

database selection article extraction article selection method extraction
databases articles
methods found
available at relevant articles found selected
UT databases

108 35 1775 247 63

73 268 1260 57 88
new articles unavailable
irrelevant duplicates irrelevant from references articles
databases articles

Figure 2.3.1.: From 108 databases to 63 methods

2.3.2. Step 1: Database selection

One much used guideline in computer science for systematic literature reviews was written by
Kitchenham and Charters [128]. In the guideline, they state that
The aim of a systematic review is to find as many primary studies relating to the
research question as possible using an unbiased search strategy.
This calls for a sound strategy that will help us reach this goal. This section describes the
strategy along with the results of each step.
We will query all bibliographic databases that meet our database inclusion criteria using search
strings for “incident analysis method” or “incident analysis methods” or “accident analysis
method” or “accident analysis methods”. The database inclusion criteria are:
include only databases that are pertinent to our research (this excludes e. g. the Astrophysics
Data System)
include only databases that have articles (this excludes e. g. the Eurostat database, containing
numerical and factual data)
include only databases that allow search on phrases (our search queries sometimes yield hundreds
of thousands of results due to the database selecting all articles that contain just one of the
words in our phrases)
After we have selected the databases we will query them using the search phrase ‘Accident
Analysis Method’ OR ‘Accident Analysis Methods’ OR ‘Incident Analysis Method’ OR ‘Incident
Analysis Methods’. The results of the database selection and the queries are listed in table A.1.1
in the appendix.
The University of Twente has access to 108 databases, of which we queried 35. The other 73
database were excluded based on the three criteria listed above:

9
 1. Not pertinent to our research: 24
2. Not containing articles: 44
3. No phrase search: 5

2.3.3. Step 2: Article selection based on title and abstract

In the remainder of this article we will refer to any text referred to by a bibliographic database
that was found as an article. That means that the word article not only implies Journal Articles,
but also Theses, Technical Reports and so on. In some rare cases it even means Slide Packs.
Articles that are selected for inclusion will have to comply with the following criteria:
include only articles describing Incident or Accident Analysis Methods (i.e. a systematic ap-
proach to in/accident analysis) or an application of such a method to a case
include only articles written in English
include only articles available through the databases queried
include only articles that perform analyses using a clear and defined analysis method (either in
the article itself, or in one of the references) — no analyses on an ad hoc basis
include only articles that actually have analyses of incidents or accidents or that define a method
for analysis of incidents or accidents
After the first selection, we found 1775 articles. Reading all these articles was not possible in the
time available to us. So we decided to perform the first selection based on the title and abstract,
and if this did not yield enough information (e. g. because the abstract was not available) a quick
scan of the text of the article. We decided to err on the side of caution and to include articles that
we could not obviously exclude. After this first, coarse selection, we read the selected articles,
discarding articles that on second pass did not meet the inclusion criteria.
The remainder of this section describes the process by which we assessed the quality of the
selection process.
To ensure objectivity while keeping the extra work to an acceptable minimum, we have picked
several articles that would be categorised by multiple reviewers according to the following setup:
• One assessor [A] will assess all papers
• 20 disjoint clusters of 20 articles each will be created that will be divided between two
assessors [B and C]
• 10 of those clusters will be extended with 5 more articles, and the bottom 10 will be assessed
by a fourth assessor [D]

D D
50 50

B 25 25 C B 30 20 C
175 175 175 175

A A
1325 1325

(a) Venn diagram of intended distribu- (b) Venn diagram of actual distribution
tion

Figure 2.3.2.: Venn diagrams of distribution. Note the numbers pertain only to the set in the
diagram to which they belong. E. g., assessor A has read all 1775 documents, 1325
of which were assessed only by him

The Venn diagram in Figure 2.3.2a clarifies the approach. This way, 50 articles will be assessed
by three assessors (25 by A, B, & D and 25 by A, C, & D ; 400 articles will be assessed by
two authors (175 by A&B, 175 by A&C and 50 by A&D); the starting point of the clusters was

10
 Table 2.3.1.: Agreement on assessment of inclusion criteria
reviewer combination # agreements # di↵erences % agreement
A and B 162 38 81%
A and C 150 50 75%
A and D 80 20 80%
B and D 19 1 95%
C and D 21 9 70%

determined by randomly picking numbers between 1 and 1775 using https://random.org; if a

cluster overlapped an earlier picked cluster, the number was discarded and a new number was
picked.
Ultimately, due to a mistake in assigning the articles to assessors B and C, the numbers changed
a little as can be seen in figure 2.3.2b.
After allocating the 450 articles to reviewers, we individually selected all articles fulfilling the
criteria we defined above based on the titles and abstracts (if available) of those articles. We
created a tool to facilitate this process and to consistently register results. After this exercise,
reviewer A found 268 to be duplicates of other articles, 1276 to be irrelevant and 231 to be
relevant, based on the title and abstract. The reviewers B, C, and D had di↵erent results. Of
the 450 articles that were reviewed by two or more reviewers, the results are summarized in table
2.3.1. With the di↵erent assessments, we followed the approach stated below:
• Any article that has been selected by A will be part of the survey
• Any article that has been rejected by A, but selected by one or more of the other assessors
will once more be assessed by A and then either selected or once more rejected with a
rationale for the rejection
• The rejections and their rationale will then be evaluated by the other assessors, which will
yield the final selection
• The number of articles that were originally rejected, but were selected after the review round,
will give a measure for the quality of the overall selection; see section 4.1 for a discussion of
this set
The result from the collective selection over these 450 articles reviewed by multiple assessors was
that 10 articles missed by assessor A had to be added to the reading stage (step 3) as they were
pertinent to the research based on the title and abstract, while six had to be assessed further to
determine if they were pertinent (categorized as ‘uncertain’). See section 4.1.

2.3.4. Step 3: Article selection based on full text and references

The list of 247 articles (231 from the first selection and 16 from the multi-assessor review) was
the reading list for collecting the analysis methods. After downloading and reading all papers,
the final list of available and relevant articles ended up containing 224 articles – 23 articles
were duplicates of other selected articles or were dropped due to language (some articles both
have an English abstract and title and an abstract and title in the original language. Only
after inspection of the article proper were we able to determine that it was written in another
language than English). Of this list, 65 were unavailable due to restricted access or due to missing
article text (only reference information) so that a total of 88 articles were excluded in this phase.
Furthermore, after reading these articles, we found 57 additional relevant articles (manuals to
analysis methods and definitions of methods discussed in the list of 159 (247 - 88) articles).
Hence, the total corpus under consideration was 216. This list is printed in the bibliography to
this part.
The sixteen articles that were selected as a result of the collective selection do not feature in
this list: they were unavailable to us, written in another language than English or upon closer
inspection did not meet the other inclusion criteria.

11
2.3.5. Step 4: Data extraction

In the articles we found 63 methods. Table A.3.1 in section A.3 of the appendix describes
a number of important properties of these methods: the method described, the domain it is
applied to and the year it was published. Furthermore, per method we extracted the class of
the model and the modelling narrative - which is a very short story describing the entities in the
model and their relations. Of these methods, the 22 that have been mentioned at least three
times have been subjected to further, quantitative analysis in chapter 3.3 (Qualitative Analysis).

12
3. Results

3.1. Introduction
In order to provide some structure, we have divided the analysis methods into four categories.
Three of these have been identified by Hollnagel ([94], [100]) and they form three classes of
methods, based on the accident model that they employ. The fourth is a rest category (‘Other’),
containing methods and models that are either defined very superficially, rendering them impos-
sible to categorize, or are not analysis methods per se.
Sequential Sequential accident models describe the accident as the end point of a string of
causes. This category is called “sequential” by Hollnagel because originally, many methods
restricted themselves to a sequential string of causes. However, in general, there may be
several causes contributing to an incident or accident.
Epidemiological models describe the accident as the product of the interaction among a set of
entities and actors, some of which may be visible, and others invisible. This model is similar
to models of how diseases develop. Key factor in epidemiological types of analysis is the
description of latent factors that contribute to the development of an unsafe act into an
accident.
Systemic Systemic accident models describe the accident as the result of the interaction within
a system and between a system and its context. Feedback loops may play an important role
in these models.
Other There are a host of methods and models that do not belong to one of the categories
mentioned in this list. These are discussed as part of the “other” group.
Table A.3.1 contains an overview of accident analysis methods with some characteristics.

3.2. Descriptive statistics

The full result set of the literature review can be found in appendix A.3. In this chapter, we
describe some characteristics of the corpus of literature we researched. In the next chapter we give
a qualitative analysis of the methods in the appendix.Due to the sheer number of methods found,
we chose to only discuss the top 22 as measured by the number of articles (see Figure 3.2.1).
Appendix A.6 contains the total list of papers reviewed. Please note that in total, 23 methods
were mentioned three times or more. However, Prisma is not an analysis method per se (category
“other”), which is why we won’t include it in the analysis.
From Figure 3.2.1, we conclude that there is a clear distinction between the number 1 (STAMP)
and the rest of the field. This is partially due to four PhD Theses that have been supervised
by Leveson. It is a popular subject for theses anyway: both Master’s (4) and PhD (6) theses
apply it or compare it against other methods. No other method has been the subject of so many
theses.

3.2.1. Domains in the corpus

We have cast our net wide when selecting articles for this review and the corpus of literature we
researched contained a broad spectrum of domains covered by the methods considered. We did
this with two aims: first, to learn as much from di↵erent domains as we could, and second to
improve our chances of finding specific methods used for telecommunications.

13
The graph in Figure 3.2.2 shows that some domains mostly use methods that are more often
discussed in the literature (e. g. mining, maritime), while others mostly use methods that we
encountered only once or twice in the literature (e. g. medical and traffic). This may be due to
the maturity of the practice of accident investigation in the former domains as compared to the
latter domains. But the number of applied methods is low, so we cannot have a more rigorous
statistical discussion based on these numbers. One counter example for this hypothesis is the
low number of Top 22 methods for aviation accidents — a field for which we would expect some
maturity, given the practice of sharing accident and near miss information between countries and
technical aids such as black boxes.
Please note that for nuclear accidents, the number of methods is 0. This is due to our selection
criteria: for nuclear installations, rigorous tests and analyses take place before the installation
is commissioned. But these methods and simulations are all ‘before the fact’ and are more of
a hazard and risk analysis nature, while we limited our research to retrospective methods. For
reasons of completeness, we also added the methods for telecommunications (which is 0, as stated
above).

3.2.2. Articles per class and per year

Figure 3.2.3a describes the distribution of articles in the corpus over time. The trend in these
numbers suggests that accident analysis methods are growing as a field of research. Note that
the queries were executed in May, June and July 2015, hence the lower number of articles in
2015.
As can be seen from these graphs, the general trend is that interest in accident methods is grow-
ing over time (see Figure 3.2.3a), with the sequential methods starting early (3.2.3b), followed
by epidemiological (3.2.3c) and systemic (3.2.3d), in that order. Furthermore, the interest in
individual systemic methods is relatively high, with 33 articles about only 2 methods (on av-
erage 16.5), while that for individual epidemiological methods is lower, with 62 articles about
9 methods (on average 6.9). The average for individual sequential methods is comparable to
the epidemiological (40 articles about 6 methods, averaging at 6.7). This is quite remarkable,
as these methods have been around far longer (from 1941 for epidemiological models and from
1973 for sequential models) than the systemic (from 2004). This is indicative for the academic
interest in the systemic accident models.

14
 10

15

20

25
0

23
STAMP

16
Accimap

15
HFACS

11
FRAM

10
FTA
AEB

9 9 9 9
CREAM/DREAM
MORT
RCA
ECFA & ECFC

8 8
Reason / SCM
SHELL

7 7
Tripod-β
SCAT

5
Domino
STEP 4 4 4
TEM
3CA
3 3 3 3 3 3

CDM
Deviation Analysis / OARU
MES

Number of Articles per Analysis Method

PRISMA
SOL
AcciTree
2 2 2 2 2 2 2 2 2 2 2 2

APS
ATSB
Critical incident Technique
CTM
HPES
IPICA
LEADSTO
MIA
MTO
PG Diagram
Why Because
3D-analysis
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

4M4E
ArcGIS
C-HFACF
CASMET
CBA
CCDM
COA
DWACN
Elementary Event Analysis
Event Trees
HFVA
HSG245
ISIM
Junior
Lee
NACA
NSB
PHARM-2E
PSO
SFA
SINAI
STPA
TapRoot
Task Analysis
Variation Tree
VSM
WAIT

Figure 3.2.1.: The number of times a method was mentioned in the articles researched. Note:
only when actually defined, applied or used in a comparison — not mere mentions.
The methods we discuss in this article are in medium blue, the others in light blue

15
 Number of articles per domain
10
Total
9
Total top 20
8

Figure 3.2.2.: The number of analysis methods per domain. As can be seen from the graph, the
number of more accepted methods (those that are in the top 22) di↵er strongly
per domain.

The number of articles on Articles for sequential methods.

accident analysis methods is growing Median is 1992
25 25

20 20

15 15

10 10

5 5

0 0

(a) All classes (b) Sequential

Articles for epidemiological methods. Articles for systemic methods.
Median is 2003 Median is 2012
25 25

20 20

15 15

10 10

5 5

0 0

(c) Epidemiological (d) Systemic

Figure 3.2.3.: Articles per year for the di↵erent method classes

16
3.3. Qualitative Analysis
This section will discuss the three classes of methods introduced in section 1.2, along with some
other characteristics of accident analysis. The top 22 has representatives of all three classes
along with a few other methods, as can be seen from table 3.3.1. Note, some authors categorise
the Accimap method as Systemic, while others categorise it as Epidemiological. In our opinion,
AcciMap is an epidemiological method, as it does not have the strong, directly influencing links
and couplings that are a part of the Systemic models. The output-input links are in many cases
mediated through actions by humans that have a behavioral variability and skill for improvisation
that is in contradiction with the tight, direct couplings that characterize Systemic models.

Table 3.3.1.: Methods per Class

Class Methods
Sequential Deviation Analysis, ECFA/C, FTA, MES, MORT, RCA, STEP
Epidemiological 3CA, Accimap, AEB, CREAM, Domino Accident Model, Rea-
son/SCM, SCT, SOL, TEM, Tripod-
Systemic FRAM, STAMP
Other CDM, HFACS, SHELL

3.3.1. Sequential Methods

Sequential methods describe sequences of events. Events constitute the main entities of the
models describing accidents in a sequential method. Some methods add barriers that prevent or
inhibit events from happening or from developing into accidents. The accident itself is an event
as well. Other methods use conditions that enable the event.
A typical example of a sequential method is the Fault Tree Analysis - or FTA. The FTA constructs
a tree of events following one another in time. Events can be combined through logic gates
and give rise to or may inhibit other events. FTA recognises 5 types of event: Basic events,
Conditioning events, Undeveloped events, External events and Intermediate events. Figure 3.3.1
shows the FTA model for the sinking of the Titanic [80].
The most notable strength of the sequential methods is that they have been around for a long
time, giving them time to mature. They are easily understood as they paint a sequential picture
of the events leading up to the accident. As a result of this understanding, they can be persuasive
when trying to convince management to allocate budget to preventing accidents from happening.
One weakness is that these methods do not take the socio-technical context into account. They
can only lead to improvements that are clear from the chain of events leading to the accident
and the barriers preventing those. Please note that this is a weakness of the methods, and not
of the models per se, as the models do provide means to model socio-technical factors.
We have created narratives for all sequential models that are used in the methods investigated,
identifying entities and relations and we have combined these into the following narrative de-
scribing an overarching model:
A sequential model can be represented by a causal network (with branches and
merges) of events and states leading up to an accident, which causes an injury;
branches may be AND or OR branches (and merges too). A causal network does
not contain feedback loops. Some events are failures, incidental factors, or deviations
from a norm. Some are determining factors of the accident. Some are the result of
unsafe acts or errors of people. So the network includes events in the social environ-
ment. If an earlier risk assessment has been done, then some of the events in the risk
assessment may have occurred, others may not have occurred.
It should be noted that one sequential method (MORT) specifically uses energy transfers as the
main entity. This methods was developed for the nuclear industry and that explains this choice.

17
 Figure 3.3.1.: An example of an FTA-model, taken from [80]

3.3.2. Epidemiological Methods

Epidemiological methods are also modelled around events, but they add a layer of latent condi-
tions to the model. Latent conditions are conditions that are present in the system well before
the onset of an accident [96], but are not recognized as such by management before the actual
accident occurs. E. g. bad maintenance may cause a sprinkler installation to stop functioning.
This condition may be present for a long time, but will only be evident when a fire starts and the
sprinkler installation malfunctions. Events are generally described as consequences of actions by
actors. These actors are influenced by their environment (organisational goals, safety culture,
limited resources, more or less adequate management and legislation and so forth). Furthermore,
some form of risk control is active through the use of barriers which may function more or less
e↵ectively due to similar environmental factors.
The main benefit of this class of methods is that they take a serious look at the socio-technical
context. They can therefore uncover shortcomings in company culture, safety procedures, leg-
islation et cetera that the sequential methods cannot. They will generally take more time to
complete as the scope of the investigation is larger. And they may take more e↵ort to convince
management to accept the lessons learned as they will sometimes disclose managerial shortcom-
ings. Furthermore, they can be more convoluted, as the context is harder to incorporate into
comprehensive and clear pictures that paint the narrative of the accident.
One of the more prominent methods is the AcciMap method (see Figure 3.3.2). Its model clearly
shows the socio-technical environment in which an accident develops.
In appendix A.3, we have also created narratives for the epidemiological models we found. The
overarching result is:
Actions have (Direct or Indirect) Consequences due to the behavioral variability

18
Figure 3.3.2.: The AcciMap model — an example of an Epidemiological method.
Taken from [246]

always present in a socio-technical system. These consequences are events that can
be critical. If there is no functioning barrier in place, a critical event has an accident
as a result.
To be more specific: actions are triggered by Tasks, Orders, Plans, Production Goals,
and Decisions on di↵erent System Levels. Organizational Influences, such as Man-
agement and the allocation of resources (personnel and equipment), create Local
Conditions that can trigger accidents. These local conditions can both be latent and
overt threats.
Actions and conditions can be visualized using a graph.
Events can be characterized by time, location, action and actor.

3.3.3. Systemic Methods

The systemic methods are characterized by strong links between the di↵erent components of the
system that directly influence each other. This is mirrored by their ontologies. As FRAM and
STAMP use a di↵erent paradigm for analyzing the environment there is little correspondence be-
tween the main entities in the methods. STAMP uses a System-theoretical control cycle model,
containing the process under control, sensors, actuators, controllers and conceptual models gov-
erning the decision taken to control the process. FRAM on the other hand only knows Functions
with several parameters that influence the output of the functions and with interactions between
the functions leading to events. Events are the outputs of the functions and FRAM is created
in analogy with stochastic resonance, where variabilities sometimes enhance each other, leading
to (in FRAM’s case) undesired e↵ects. Figure 3.3.3 shows the way FRAM describes a system
in order to analyze accidents. Figure 3.3.4 shows the way STAMP takes the socio-technical
context into account while showing control-feedback loops throughout the whole socio-technical
system. Please note that due to STAMP’s model, we find the control-feedback loops not only in
the technical part of the diagram, but also in the higher levels. These levels do not exhibit the

19
 Figure 3.3.3.: An analysis using FRAM. Taken from [92]

tight coupling that is present at the technical level, but the model can be used for those levels
nonetheless.
In short, the only obvious similarity between STAMP and FRAM is the way in which they link
di↵erent parts of the system by acknowledging the tight coupling of individual functions and
constituents of the system. Due to the disparate descriptions of these two methods and the fact
that we did not find any more systemic methods, we did not succeed in creating an overarching
narrative. Therefore, we have formulated two narratives for these methods:
FRAM A system interacts with its context through a collection of functions, that can be char-
acterized by input, output, resources it needs, its control and real-time behavior. Functions
interact through these aspects. Please note that this is a functional view of systems that
abstracts away from its internal components and concentrates on logical behavior. It is
similar to the view of systems taken by structured analysis for real-time systems [86], [162].
STAMP A system interacts with its context by means of feedback and feed-forward loops. The
context contains operators that interact with the system, as well as constraints, legislation
and managerial activities.
The systemic methods take more e↵ort to apply than the other classes of methods as they
necessitate a deeper analysis of the regular processes and organisation in order to either map
them on system-theoretical feedback-control loops (STAMP) or functions (FRAM). This extra
e↵ort is in many cases not justifiable considering the benefits of such an analysis. Especially
in situations where the consequences of incidents are relatively minor (no lethal victims, no
major financial consequences), these methods are too heavy. The literature seems to support
this, as the only applications of FRAM and STAMP are as part of the analysis (mostly as an
academic exercise) of aviation accidents [28] and incidents [92] and naval accidents (Herald of
Free Enterprise [204]) for FRAM and Master’s and PhD research projects for STAMP ([89],
[123], [52], [238], [146]). Leveson herself applied STAMP to a friendly fire incident, the loss of a
satellite and a bacterial contamination of a water supply [145], all three examples of accidents
with a high impact, for government organizations that do not need to make a profit and that
make other considerations when choosing an accident analysis method.

20
 Figure 3.3.4.: The general socio-technical control model of STAMP. Taken from [144]

3.3.4. Conclusions

When comparing the three methods and their underlying models, it is convenient to do so
along two axes: type of coupling and contextual awareness (see figure 3.3.5). The historical
development of these methods (from the lower left quarter through the lower right quarter up to
the upper right quarter) shows that the addition of the socio-technical context is so valuable that
in developing models for tightly coupled systems, this context is explicitly taken into account.
We did not find any methods or models that analyze tightly coupled system that did not take
the socio-technical context into account.
Please note the empty quadrant in the top left corner. It reflects the progressive insights in
accident analysis: the earliest, Sequential models only looked at the system itself, without taking
the socio-technical context into account. The Epidemiological models added the socio-technical
context. The Systemic models were developed for tightly linked systems and after the Epidemio-
logical methods introduced the socio-technical context. The developers of the Systemic methods
saw the additional value of the socio-technical context and made it an integral part of their
methods.

3.3.5. Generic Accident Analysis Method

The three methods do share a common approach that adds steps as we go from Sequential
through Epidemiological to Systemic methods:
1. Find all events that have a causal relationship with the accident.
2. Describe the history of the accident by linking these events.
3. Find all conditions that enabled these events, including events that lead to those conditions
(only in Epidemiological and Systemic methods)
4. Identify components, feedback mechanisms and control mechanisms that played a role during
the development of the accident (only in Systemic methods)

21
 Figure 3.3.5.: Comparing the three classes of models along two distinguishing axes

5. Identify at which points the accident could have been prevented and analyze if this can be
generalized
6. Draw conclusions and propose improvement actions

22
4. Discussions and Conclusions

4.1. Threats to validity

The inclusion criteria were defined clearly and during the discussions in the di↵erent assessment
stages, the four assessors agreed on the interpretation of the criteria, which was evidenced by
the discussions during our final assessment. We may have missed some relevant articles by
only reading articles that we assessed to be interesting based on their title and abstract only,
as described in section 2, but the point of the research is to find structured methods. These
methods are usually defined once and applied several times. Missing the article in which the
method is defined will not necessarily mean that the method as such will be missed: application
articles will refer to it and a search of the references will yield the original definition so that the
method will still be included in the research. We therefore think that this threat to validity is
limited.

4.1.1. Estimation of the size of the validity threat

Over all 450 articles that we considered in the multi-reviewer selection, there was a di↵erence
of opinion on 79 articles which were rejected by A (all articles that were included by A were
not considered, as these would be included anyway). After careful re-examination of those
discrepancies, 10 were accepted and of 6 the verdict was postponed due to unclarities in abstracts
(4) or due to access restrictions to the original article (2). If the same ratios apply to those articles
that were assessed by A only (which seems a reasonable assumption because articles were selected
randomly for assessment by B, C, and D), then this means that over the total of 1775 articles,
1775/450 ⇥ 10 ⇡ 39 articles may have been missed, with a further 24 (1775/450 ⇥ 6) falling into
the category ‘uncertain’. We are confident that any significant method for accident analysis will
be discussed or referred to in one of the 247 other selected articles. If we miss a method due to it
not being included in any reference in the selected articles, we feel we may safely conclude that
it is a method that is not widely applied.

4.2. Answers to research questions

The questions we posed ourselves were:
1. What is the state of the art in incident and accident analysis methods?
a) Which incident analysis methods are in use today?
b) Which incident models are in use today?
c) What are the comparative strengths and weaknesses of these methods?
2. Can we draw up a generic model encompassing all current incident methods and models?
a) What are domain-specific entities, attributes, and relationships in incident models?
b) Can we formulate a generic analysis method and model?
We have found the following answers to these questions

4.2.1. Answers to research question 1

The literature recognizes three di↵erent classes of analysis methods and models: the Sequential,
the Epidemiological, and the Systemic. The state of the art of accident analysis methods is
described in table A.3.1. This table describes the methods (Question 1a) in use today and in

23
sections 3.3.1 through 3.3.3 we describe models (Question 1b) and the relative strengths and
weaknesses of these methods (1c).

4.2.2. Answers to research question 2

We found that the individual models do not contain domain specific entities, attributes or rela-
tions (Research Question 2a). But we did find that the entities, attributes and relations are class
specific. We did not find any methods that have been applied to telecommunications networks.
Given the domain independence of the models, the di↵erent models should all be applicable to
accidents in the Telecommunications domain.
We have been able to formulate generic models for two of the three classes of models (Sequential
and Epidemiological). The Systemic models (notably FRAM and STAMP) di↵er in so many
respects that formulating a generic model was not feasible. The generic models we found for the
other two classes are:
Sequential A sequential model can be represented by a causal network (with branches and
merges) of events and states leading up to an accident, which causes an injury; branches
may be AND or OR branches (and merges too). A causal network does not contain feedback
loops. Some events are failures, incidental factors, or deviations from a norm. Some are
determining factors of the accident. Some are the result of unsafe acts or errors of people,
which implies that the network includes events in the social environment.
Epidemiological Actions have (Direct or Indirect) Consequences due to the behavioral variability
always present in a socio-technical system. These consequences are events that can be
critical. If there is no functioning barrier in place, a critical event has an accident as a
result.
Furthermore, we have been able to formulate a generic method for accident analysis. The number
of steps depends on the class of analysis method:
1. Find all events that have a causal relationship with the accident.
2. Describe the history of the accident by linking these events.
3. Find all conditions that enabled these events, including events that lead to those conditions
(only in Epidemiological and Systemic methods)
4. Identify components, feedback mechanisms and control mechanisms that played a role during
the development of the accident (only in Systemic methods)
5. Identify at which points the accident could have been prevented and analyze if this can be
generalized
6. Draw conclusions and propose improvement actions

4.3. Conclusions
The research in accident analysis methods is growing, as evidenced by the number of articles
per year (cf. Figure 3.2.3a). Furthermore, the attention has shifted over time from sequential
methods and epidemiological to systemic methods. Especially, the high volume of articles for
the latter (even though it only involves two methods) is an indication of its relative popularity
in academic circles.
We find that, although the literature in general makes a clear distinction between accident and
incident (the distinction being that accidents are harmful and incidents are not), the domains
of medicine and telecommunications do not adhere to this convention, instead opting to call
incidents what in other domains are called accidents.
We find that many of the methods (41 out of 63) are only mentioned once or twice in the corpus
of literature we studied. Furthermore, we see a clear distinction in the classifications between
the groups: if we disregard the methods that we did not classify (the categories ‘Not applicable’,
‘Passing’ and ‘Unknown’), we find for the Top 23 methods that 17% falls outside the three main
classes, while for the remaining 27 methods, 48% falls outside the three main classes. This is
an indication that many of the less mentioned methods are due to the authors being unfamiliar

24
with the subject and were trying to re-invent the wheel. The great number of methods in the
Sequential and Epidemiological classes may indicate an evolution of methods within those classes.
We did not analyze this any further.
When balancing strengths and weaknesses of the di↵erent analysis methods, we are considering
the classes instead of the individual methods. It should be noted, that as each method uses its
own model, choosing a method implies choosing a model. This in turn influences the outcome
of the incident or accident analysis. According to Lundberg et al.(What you look for is what
you find, [155]), the model (or more specifically, the class of models) defines which causes an
analysis will find. As we are looking at them from the point of view of a telecommunications
company that needs to 1) quickly resolve the incident and restart the service and 2) from a
service continuity point of view, make sure that a similar incident does not happen again, this
will give us information about which class of methods to choose.
The Sequential methods paint very clear pictures that can assist in resolving incidents quickly
after they developed. For troubleshooting purposes, these methods can be lightweight enough
to quickly find the cause of an incident and repair the issue. However, these methods will
miss deeper, structural causes, present in the socio-technical system. Too few resources for
maintenance or a broken safety culture will not be identified by these methods.
The Epidemiological methods however, although taking more time, will tend to find the latent
factors that — after resolution — may strongly help reduce incidents of the type investigated in
the future. We can even imagine that they may uncover a fundamental flaw in the organization
the resolution of which can help prevent a larger class of incidents. The concept of barriers gives
a clear reference point where to apply corrective measures, giving management a clear means to
improve the safety of the system.
We observe that the di↵erent methods are not always clear in their intended audience. Whether
the results of the analysis are meant for architects or management (or other bodies, even) will
influence the level of detail in and the presentation of the conclusions.
We conclude that from a business point of view, the Systemic methods are too expensive to use for
the analysis of accidents and incidents: the costs would seldom outweigh the benefits and these
methods are therefore not efficient enough for regular business activities and accidents or incidents
with relatively few and light casualties. Furthermore, safety is an emergent property in systemic
methods. That makes it harder to formulate corrective measures that can be implemented by
management.
In conclusion, a sequential method may be appropriate during the resolution phase of an incident,
while an epidemiological method is more fitting for a deeper analysis after the incident has been
resolved in order to find latent factors that can be neutralized to prevent incidents from happening
again. Systemic methods will not add enough value to this process to justify the considerable
e↵ort and consequently considerable costs.

4.4. Future work

In order to apply some of the methods found specifically to telecommunications, we may have
to adapt them. This will be the subject of future research. In our future research we will be
applying the current status of accident analysis techniques to telecommunications networks and
we will have to find out if there are specific domain dependent entities and relations that will
be part of a model for telecommunications networks that cannot be found in the more generic
models. From the Top 22 methods, we chose 5 methods that we want to use for this future
research. We feel that these 5 methods are a good representation of the field: they are relatively
easy to apply, take the socio-technical context into account and have clear manuals. The five
methods selected are MORT, Tripod- , FRAM, Fault TreeAnalysis and AcciMap.

25
A. Query Results and overview of accident
analysis methods

A.1. Query Results

The following table contains the results of the execution of the research query on the di↵erent
databases at our disposal.
Table A.1.1.: Query Results

exclusion number
database Type of entries Selected? criteria of hits

ABC Numerical and factual data no No articles na

ACM Digital Library Articles yes 0
ACM The Guide to Comput- Articles yes 6
ing literature
ACS full text Articles yes 0
Analytical Abstracts Online Articles yes 0
ArXiv.org Articles yes 0
Astrophysics Data System Articles no Not pertinent na
(ADS)
Biografisch woordenboek van Articles no Not pertinent na
Nederland
Business Source Elite (EB- Articles yes 6
SCO)
Chemiekaarten Numerical and factual data no No articles na
CiteSeerX Articles yes 87
Civil Engineering Database Articles yes 253
Design and Applied Arts Articles yes 0
(CSA)
Directory of Open Access Articles yes 279
Journals (DOAJ)
Directory of Published Pro- Articles yes 0
ceedings (DoPP)
Documentatiecentrum Ned- Index no Not pertinent na
erlandse Politieke Partijen
(DNPP)
EconLit Articles no No phrase search na
Emerald Journals Articles yes 0
Encyclopedia of Geography Dictionaries and Encyclopedia no No articles na
Encyclopedia of Materials: Dictionaries and Encyclopedia no No articles na
Science and Technology
Encyclopedia of Philosophy Dictionaries and Encyclopedia no No articles na
(2nd edition)
Encyclopedia of Science, Dictionaries and Encyclopedia no No articles na
Technology and Ethics
Encyclopedia of Smart Mate- Dictionaries and Encyclopedia no No articles na
rials
Encyclopedia of Statistical Dictionaries and Encyclopedia no No articles na
Sciences

26
 exclusion number
database Type of entries Selected? criteria of hits

EpistemeLinks Internet resources no No articles na

ERIC Articles no Not pertinent na
Espacenet Patents no No articles na
Essential Science Indicators Numerical and factual data no No articles na
Ethics updates Internet resources no No articles na
EUR-Lex Articles no Not pertinent na
Europa : official website of Internet resources no No articles na
the European Union
Eurostat Numerical and factual data no No articles na
Geo Abstracts Articles yes 0
Geobase Articles yes 2
Google Scholar Articles yes 536
GreenFILE (EBSCO) Articles yes 1
Grijze Literatuur in Neder- Articles yes 0
land (GLIN)
Hydrotheek Articles yes 0
IDEAS Articles yes 0
IEEE Xplore Digital Library Articles yes 211
Instructional Design Internet resources no No articles na
International Abstracts in Articles yes 0
Operations Research
International Encyclopedia Dictionaries and Encyclopedia no No articles na
of Communication
International Encyclopedia Dictionaries and Encyclopedia no No articles na
of the Social Sciences
Intute Internet resources no No articles na
IOPscience Articles no Not pertinent na
IOS Press Articles yes 0
IPL2 (Internet Public Li- Internet resources no No articles na
brary)
Journal Citation Reports Numerical and factual data no No articles na
JSTOR Articles yes 0
Kluwer Navigator Articles yes 0
LexisNexis News(papers) no No articles na
Library Faculty of Geo- Catalogue no Not pertinent na
Information Science and
Earth Observation Cata-
logue Adlib
Library, Information Science Articles no Not pertinent na
& Technology Abstracts
(EBSCO)
MathSciNet Articles no Not pertinent na
MatWeb Numerical and factual data no No articles na
Medline Articles no Not pertinent na
MERLOT (Multimedia Edu- Internet resources no No articles na
cational Resource for Learn-
ing and Online Teaching)
NARCIS Numerical and factual data , Articles no No articles na
National Technical Informa- Articles no No phrase search na
tion Service (NTIS)
Newspaperindex News(papers) no No articles na
NOD Nederlandse Onder- Numerical and factual data no No articles na
zoek Databank
OpenAIRE Articles yes No phrase search na

27
 exclusion number
database Type of entries Selected? criteria of hits

OPmaat Articles no Not pertinent na

ORBIS Numerical and factual data no No articles na
Overheid.nl : officiële publi- Articles no No articles na
caties nederlandse overheid
Oxford Advanced Learner’s Dictionaries and Encyclopedia no No articles na
Compass
Oxford Journals Articles yes 1
Patents database US Patents no No articles na
(USPTO)
Philosopher’s Index Articles no Not pertinent na
PhilSci archive Internet resources no No articles na
Physical Review Online Articles no Not pertinent na
Archive (PROLA)
PiCarta Articles no Too general na
Plastics Technology Online Numerical and factual data no No articles na
PsycArticles Articles no Not pertinent na
Psychology & Behavioral Sci- Articles no Not pertinent na
ences Collection
PsycINFO Articles no Not pertinent na
PubMed Articles no Not pertinent na
Reach Numerical and factual data no No articles na
Rechtsorde.nl Articles no Not pertinent na
Regional Business News News(papers) no No articles na
ResearchProfessional Funding opportunities no No articles na
Routledge Encyclopedia of Dictionaries and Encyclopedia no No articles na
Philosophy
SAGE Journals Online Articles yes 6
ScienceDirect Articles yes 96
SciFinder Articles no Not pertinent na
SciTech Articles no No phrase search na
Scopus Articles yes 20
Siam Journals Online Articles no Not pertinent na
SpringerLink Articles yes 19
Stanford Encyclopedia of Dictionaries and Encyclopedia no No articles na
Philosophy
Staten-generaal Digitaal Articles no Not pertinent na
StatLine Numerical and factual data no No articles na
Stevens’ Handbook of Exper- Dictionaries and Encyclopedia no No articles na
imental Psychology
Taylor & Francis Articles yes 0
The Collection of Computer Articles no Not pertinent na
Science Bibliographies
The encyclopedia of earth Articles no Not pertinent na
The World Factbook Numerical and factual data no No articles na
TRID Online Articles yes 6
Ullmann’s Encyclopedia of Dictionaries and Encyclopedia no No articles na
Industrial Chemistry
Ulrichsweb Numerical and factual data no No articles na
University of Twente Library Catalogue no No articles na
Catalogue
UTpublications Articles yes 0
Web of Science Articles yes 14
Wijsbegeerte in Nederland Articles no Not pertinent na

28
 exclusion number
database Type of entries Selected? criteria of hits

Wiley Online Library Articles yes 6

World Data on Education Numerical and factual data no No articles na
(WDE)
World Energy Base (ET- Articles yes 226
DEWEB)

Total 1775

A.2. Number of articles per journal

The following table contains the number of articles per journal. Note that this is only for papers
that were published in academic journals: theses, conference proceedings and books are not part
of this list.
Table A.2.1.: Number of articles per journal

Journal title Articles

Accident Analysis & Prevention 7
Applied Ergonomics 1
BMC Medical Education 1
BMC Medical Informatics and Decision Making 1
BMC Surgery 1
Chinese Journal of Electronics 1
Chinese Journal of Aeronautics 1
Cognition, Technology & Work 3
Discrete Dynamics in Nature and Society 1
Ergonomics Australia Journal 1
Ergonomics 2
Evidence Based Library and Information Practice 1
Human Factors and Aerospace Safety 2
Human Factors: The Journal of the Human Factors and Ergonomics Society 1
ITOR International Transactions in Operational Research 1
International Journal of Academic Research 1
International Journal of Industrial Ergonomics 1
International journal of occupational hygiene 1
Journal of Construction Engineering and Management 1
Journal of Clinical Engineering 1
Journal of Hazardous Materials 4
Journal of Loss Prevention in the Process Industries 4
Journal of Occupational Accidents Journal of Occupational Accidents 1
Journal of Safety Science and Technology 1
Journal of Scientific & Industrial Research 2
Journal of occupational accidents 2
Japanese Journal of Pharmaceutical Health Care and Sciences 1
Jundishapur Journal of Health Sciences 1
Lecture notes in computer science 1
Physica A: Statistical Mechanics and its Applications 1

29
 Journal title Articles
Procedia Engineering 2
Process Safety and Environmental Protection 1
Psychological bulletin 1
Reliability Engineering & System Safety 4
Reviews of Human Factors and Ergonomics 1
Safety Science Monitor 1
Safety Science 15
Scandinavian Journal of Work, Environment & Health 1
The Ergonomics Open Journal 1
The International Journal of Aviation Psychology 1

A.3. Characteristics for 63 methods

The following table contains the characteristics for the di↵erent methods we found. The di↵erent
characteristics are as follows:
Method The name of the method. In some cases, the method does not have an established
name. In that case, the name of the first author of the article is used (e. g. for Junior ). The
meaning of the abbreviations can be found in section A.4
Type Whether the method is sequential, epidemiological, systemic, or other. Some of the meth-
ods are not analysis methods, but e. g. taxonomies, or are not discussed at all in the article
in which they were mentioned. In these cases, we have put N/A in the type.
Domains The domains in which the method is applied. Note that in some cases, this may only
mean that a comparative article has tested the method in a certain domain (such as in
Strömgren et al. [244]), while in other cases the method has been applied extensively in the
industry.
Steps The number of steps in the method
Number of types of entities The number of di↵erent types of entities in the model
Modelling narrative This places the most important entities into context. Entity names start
with capitals.
Number of publications found The number of articles, manuals, books, PhD theses we found
in the di↵erent databases that discuss, define or apply the method.
Manual present? Does the method have a manual in English that clearly describes how to apply
it in practice?

30
 Table A.3.1.: Overview of all accident analysis methods discussed in this report
# of
# of types publications Manual
Method Type1 Domains2 Weight # steps of entities Modelling narrative found3 present?4 References
3ca Epi ci, es M 3 6 An Agent causes a Change and in the ab- 3 yes [127] [70] [122] [127]
sence of preventive Measures, this causes
an Event with an E↵ect
3D-analysis Oth md L n/a n/a n/a 1 no [167]
4m4e Oth n/a n/a n/a n/a n/a 1 no [66]
Accimap Epi av, ci, ei, H n/a 11 An accident is a Direct Consequence of 16 no [220] [257] [225]
a Critical Event. Such an event is itself
es, md, ml, the direct or Indirect consequence of an
[223] [244] [178]
mt, oa, oc, Action. Often, these actions are taken [76] [222] [254]
as part of fulfilling a Task which in turn
rw, rt, sf is based on an Order from a higher Sys-
[258] [259] [205]
tem Level. Often, orders arise from De- [219] [246] [243]
cisions based on certain Preconditions or
on a Plan. The creation of these plans
[271]
by certain Functions in a socio-technical
31

environment may in turn be triggered by

orders from di↵erent system levels.
AcciTree Epi av H 14 9 n/a 2 no [76] [77]
Aeb Epi av, ci, mt, M 2 6 If an Error Event is not blocked by a func- 9* yes [248] [250] [244] [171]
tioning Barrier, it may cause an Accident.
oc, rw Error events are caused by Actions or by
[247] [102] [96]
previous error events [248]
Aps Seq rt M 5 n/a The sequence of Situations leading up to 2 no [62] [153]
the Accident can be divided into Phases.
in each phase, a situation causes an Event
which in turn creates a new situation

1. Seq.: Sequential; Epi.: Epidemiological; Sys.: Systemic; Oth.: Other; Pas.: Only mentioned in passing;
2. AV: Aviation; CI: Chemical Industry; EC: Ecology; EI: Electrical Industry / Electricity; EN: Energy; ES: Emergency Services; FI: Food Industry;
FS: Financial Services; IN: Industry; MD: Medical; ML: Military; MT: Maritime; NI: Nuclear Industry; OA: Outdoor Activities; OC: Occupational;
RW: Railway; RT: Road Traffic; SF: Space Flight;
3. Number of articles in scientific journals, PhD theses, manuals, et cetera;
4. Does the method have an official manual that can be used to apply it?
*. Some references mentioned the method in their abstracts, but were unavailable to us. These have been counted in the number of references,
but are not part of the literature list.
N.B. In some cases, a characteristic is not applicable to the method. This is indicated by n/a. In other cases, the literature research we performed
did not give us any pertinent information. In those cases, this has been indicated with unk
 Table A.3.1.: Overview of all accident analysis methods discussed in this report (cont’d)
# of
# of types publications Manual
Method Type1 Domains2 Weight # steps of entities Modelling narrative found3 present?4 References
ArcGIS Oth rt n/a n/a n/a n/a 1 no [114]
Atsb Epi rw H 5 9 In an organisation, employees work to at- 2 yes [19] [259] [19]
tain Production Goals. Sometimes, cer-
tain Technical Events and Individual Ac-
tions may cause Incidents. Proper Re-
covery Risk Controls may stop these inci-
dents from developing into Accidents. Or-
ganisations create Preventative Risk Con-
trols to prevent these incidents from hap-
pening in the fist place, but Organisa-
tional Influences may impact these con-
trols and create Local Conditions in which
the occurence of incidents is more proba-
ble
C-hfacf Oth av L n/a n/a n/a 1 no [276]
Casmet Epi mt H 5 4 1 yes [27] [27]
32

Management and the allocation of Re-

sources govern Daily Operations. If this
is done inadequately, Accident Events (in-
cluding a Casualty Event) may develop
Cba Oth unk H unk unk unk 1 no [171]
Ccdm Seq ni M n/a 2 A combination of Failures causes an 1 no [180]
Event

1. Seq.: Sequential; Epi.: Epidemiological; Sys.: Systemic; Oth.: Other; Pas.: Only mentioned in passing;
2. AV: Aviation; CI: Chemical Industry; EC: Ecology; EI: Electrical Industry / Electricity; EN: Energy; ES: Emergency Services; FI: Food Industry;
FS: Financial Services; IN: Industry; MD: Medical; ML: Military; MT: Maritime; NI: Nuclear Industry; OA: Outdoor Activities; OC: Occupational;
RW: Railway; RT: Road Traffic; SF: Space Flight;
3. Number of articles in scientific journals, PhD theses, manuals, et cetera;
4. Does the method have an official manual that can be used to apply it?
*. Some references mentioned the method in their abstracts, but were unavailable to us. These have been counted in the number of references,
but are not part of the literature list.
N.B. In some cases, a characteristic is not applicable to the method. This is indicated by n/a. In other cases, the literature research we performed
did not give us any pertinent information. In those cases, this has been indicated with unk
 Table A.3.1.: Overview of all accident analysis methods discussed in this report (cont’d)
# of
# of types publications Manual
Method Type1 Domains2 Weight # steps of entities Modelling narrative found3 present?4 References
Cdm Oth md, mi, ni M 4 3 Human actions are divided into Activity 3 no [149] [93] [143]
Chunks, which may be physical or cog-
nitive. They transition into eachother.
These transitions may be controlled by
Potential Risk Controls
Coa n/a n/a n/a n/a n/a n/a 1 unk [73]
Cream/Dream Epi es, md, ni, M 4 5 The probable cause(s) of an analysed 9 yes [98] [217] [226] [244]
Event are Consequent-Antecedent Links
rw, rt that trigger Probable Error Modes in
[98] [7] [102] [96]
the Task executed under Common Per- [227] [283]
formance Conditions
Critical incident Oth md M 5 n/a n/a 2 yes [159] [60]
Technique
Ctm Seq n/a L n/a An Accident is the result of a chain of 2 no [122] [141]
33

Events. These events may be Inciden-

tal Factors that together or on their own
cause Branching or a Confluence in the
Event Chain.
Deviation Anal- Seq ci, ei, es, L 3 3 An accident sequence consists of Devia- 3 no [244] [122] [129]
tions from the norm. These deviations are
ysis (OARU) md, ml, ordered chronologically throughout the
mt, oa, three Phases of the sequence (Initiatory,
Concluding and Injury). Underlying De-
rw,rt termining Factors are highlighted.

1. Seq.: Sequential; Epi.: Epidemiological; Sys.: Systemic; Oth.: Other; Pas.: Only mentioned in passing;
2. AV: Aviation; CI: Chemical Industry; EC: Ecology; EI: Electrical Industry / Electricity; EN: Energy; ES: Emergency Services; FI: Food Industry;
FS: Financial Services; IN: Industry; MD: Medical; ML: Military; MT: Maritime; NI: Nuclear Industry; OA: Outdoor Activities; OC: Occupational;
RW: Railway; RT: Road Traffic; SF: Space Flight;
3. Number of articles in scientific journals, PhD theses, manuals, et cetera;
4. Does the method have an official manual that can be used to apply it?
*. Some references mentioned the method in their abstracts, but were unavailable to us. These have been counted in the number of references,
but are not part of the literature list.
N.B. In some cases, a characteristic is not applicable to the method. This is indicated by n/a. In other cases, the literature research we performed
did not give us any pertinent information. In those cases, this has been indicated with unk
 Table A.3.1.: Overview of all accident analysis methods discussed in this report (cont’d)
# of
# of types publications Manual
Method Type1 Domains2 Weight # steps of entities Modelling narrative found3 present?4 References
Domino Acci- Seq in M unk 5 Accidents happen in a Social Environ- 4* no [257] [252] [166]
ment. In this — and possibly due to this
dent Model — environment, a person makes an error,
a Fault of Person. When this results in an
Unsafe Act, this can lead to an Accident,
causing an Injury
Dwacn Oth rw H n/a 2 This is a network modelling technique, 1 no [289]
connecting components (nodes) to ea-
chother through relations (vertices)
Ecfa & c Seq en H 14 n/a Events happen and cause other events. 8 yes [23] [170] [225] [171]
They may be enabled by Conditions and
Causal Factors
[70] [102] [260]
[243] [23]
Elementary Oth unk unk unk unk unk 1* no
Event Analysis
34

Method
Event Trees Seq av L unk 3 An event tree describes an accident as 1 no [13]
a sequence of bifurcations in which each
branch describes a possible outcome of the
branching Event or Action and each leaf
a final Consequence. Events can be oc-
curing or nonoccuring and actions can be
successes or failures.

1. Seq.: Sequential; Epi.: Epidemiological; Sys.: Systemic; Oth.: Other; Pas.: Only mentioned in passing;
2. AV: Aviation; CI: Chemical Industry; EC: Ecology; EI: Electrical Industry / Electricity; EN: Energy; ES: Emergency Services; FI: Food Industry;
FS: Financial Services; IN: Industry; MD: Medical; ML: Military; MT: Maritime; NI: Nuclear Industry; OA: Outdoor Activities; OC: Occupational;
RW: Railway; RT: Road Traffic; SF: Space Flight;
3. Number of articles in scientific journals, PhD theses, manuals, et cetera;
4. Does the method have an official manual that can be used to apply it?
*. Some references mentioned the method in their abstracts, but were unavailable to us. These have been counted in the number of references,
but are not part of the literature list.
N.B. In some cases, a characteristic is not applicable to the method. This is indicated by n/a. In other cases, the literature research we performed
did not give us any pertinent information. In those cases, this has been indicated with unk
 Table A.3.1.: Overview of all accident analysis methods discussed in this report (cont’d)
# of
# of types publications Manual
Method Type1 Domains2 Weight # steps of entities Modelling narrative found3 present?4 References
Fram Sys av, md H 6 7 A system is a collection of interacting 11 yes [101] [257] [204] [92]
Functions. Each function has six Aspects,
which may or may not be relevant to the
[13] [100] [252]
evolution of the system towards an acci- [258] [99] [102]
dent. These are the Input to the func-
tion, the Output of the function, the Pre-
[28] [101]
conditions to start the function, the Re-
sources needed by the function, the Con-
trol that regulates the function and how
Time a↵ects the execution of the function.
Each function is linked to another func-
tion through one of these aspects.
Fta Seq ei, es, mt M n/a 5 The FTA constructs a tree of events fol- 10 yes [267] [132] [244] [171]
lowing one another in time. Combinations
of events (through logic gates) give rise to
[267] [258] [257]
or may inhibit other events. FTA recog- [269] [80] [122]
35

nises 5 types of event.

[54]
Hfacs n/a n/a n/a n/a n/a n/a 15* yes [231] [257] [76] [276]
[272] [232] [93]
[8] [1] [31] [102]
[219] [243] [231]
[230]
Hfva n/a n/a n/a n/a n/a n/a 1 unk [26]
Hpes Pas n/a n/a n/a n/a n/a 2 unk [102] [248]
1. Seq.: Sequential; Epi.: Epidemiological; Sys.: Systemic; Oth.: Other; Pas.: Only mentioned in passing;
2. AV: Aviation; CI: Chemical Industry; EC: Ecology; EI: Electrical Industry / Electricity; EN: Energy; ES: Emergency Services; FI: Food Industry;
FS: Financial Services; IN: Industry; MD: Medical; ML: Military; MT: Maritime; NI: Nuclear Industry; OA: Outdoor Activities; OC: Occupational;
RW: Railway; RT: Road Traffic; SF: Space Flight;
3. Number of articles in scientific journals, PhD theses, manuals, et cetera;
4. Does the method have an official manual that can be used to apply it?
*. Some references mentioned the method in their abstracts, but were unavailable to us. These have been counted in the number of references,
but are not part of the literature list.
N.B. In some cases, a characteristic is not applicable to the method. This is indicated by n/a. In other cases, the literature research we performed
did not give us any pertinent information. In those cases, this has been indicated with unk
 Table A.3.1.: Overview of all accident analysis methods discussed in this report (cont’d)
# of
# of types publications Manual
Method Type1 Domains2 Weight # steps of entities Modelling narrative found3 present?4 References
Hsg245 Pas n/a n/a n/a n/a n/a 1 unk [122]
Ipica Epi ec H 5 unk Extension of rca with elements from 2 no [59] [58]
stamp and Safety Management Method-
ologies
Isim Epi av, en, mt, L 2 8 Information about Tasks, Personel, 1 no [122]
Equipment and Environmental Con-
rw ditions in the sequence of Events is
analysed to find underlying Factors and
unsafe Conditions. The status of relevant
Barriers is then examined
Junior Epi ci M 7 3 An Accident is caused by behavioural 1 no [119]
variability, not human error. Events and
Conditions in which they occur cause ac-
cidents due to the Behavioural Variability
always present in a Socio-technical sys-
36

tem.
Leadsto Seq n/a n/a n/a n/a n/a 2 yes [14] [13] [14]
Lee n/a n/a n/a n/a n/a n/a 1 no [139]
Mes Seq av M unk 3 Events are Actors taking an Action. 3 no [225] [122] [290]
They propell a stable situation into an ac-
cident
Mia Oth md M 7 n/a No real model, more of a meta analysis of 2 no [41] [45]
incident reports

1. Seq.: Sequential; Epi.: Epidemiological; Sys.: Systemic; Oth.: Other; Pas.: Only mentioned in passing;
2. AV: Aviation; CI: Chemical Industry; EC: Ecology; EI: Electrical Industry / Electricity; EN: Energy; ES: Emergency Services; FI: Food Industry;
FS: Financial Services; IN: Industry; MD: Medical; ML: Military; MT: Maritime; NI: Nuclear Industry; OA: Outdoor Activities; OC: Occupational;
RW: Railway; RT: Road Traffic; SF: Space Flight;
3. Number of articles in scientific journals, PhD theses, manuals, et cetera;
4. Does the method have an official manual that can be used to apply it?
*. Some references mentioned the method in their abstracts, but were unavailable to us. These have been counted in the number of references,
but are not part of the literature list.
N.B. In some cases, a characteristic is not applicable to the method. This is indicated by n/a. In other cases, the literature research we performed
did not give us any pertinent information. In those cases, this has been indicated with unk
 Table A.3.1.: Overview of all accident analysis methods discussed in this report (cont’d)
# of
# of types publications Manual
Method Type1 Domains2 Weight # steps of entities Modelling narrative found3 present?4 References
Mort Seq ni M 2 3 Unwantend Energy Transfer takes place 9 yes [130] [171] [70] [269]
due to inadequate Energy Barriers or
Controls. Mort knows Omissions, Risks
[122] [130] [65]
and Management Characteristics [118] [173] [172]
Mto Pas av, ci, ei, n/a n/a n/a n/a 2 no [244] [102]
es, md, mt,
oa, oc, rw,
rt, sf
Naca Pas av n/a n/a n/a n/a 1 no [103]
Nsb Pas rw n/a n/a n/a n/a 1 no [122]
PG Diagram Epi rw M n/a 2 Looks at accidents from Human, Techni- 2 no [186] [95]
cal, Organizational, Social and Environ-
mental/Cultural aspects. Creates a graph
37

with Conditions as nodes and Interac-

tions as vertices
Pharm-2e Epi md unk unk unk unk 1 no [133]
Prisma Oth ci, md n/a n/a n/a Combination of analysis method, classifi- 3 yes [261] [263] [261] [168]
cation and actions for improvement
Pso Oth n/a n/a n/a n/a Optimization algorithm in Machine 1 no [73]
Learning
Rca Seq ci H 4 n/a The rca has four steps, of which one is an 9 yes [214] [170] [223] [171]
ecfc. It does not have an accident model
[59] [214] [45]
[63] [102] [111]
1. Seq.: Sequential; Epi.: Epidemiological; Sys.: Systemic; Oth.: Other; Pas.: Only mentioned in passing;
2. AV: Aviation; CI: Chemical Industry; EC: Ecology; EI: Electrical Industry / Electricity; EN: Energy; ES: Emergency Services; FI: Food Industry;
FS: Financial Services; IN: Industry; MD: Medical; ML: Military; MT: Maritime; NI: Nuclear Industry; OA: Outdoor Activities; OC: Occupational;
RW: Railway; RT: Road Traffic; SF: Space Flight;
3. Number of articles in scientific journals, PhD theses, manuals, et cetera;
4. Does the method have an official manual that can be used to apply it?
*. Some references mentioned the method in their abstracts, but were unavailable to us. These have been counted in the number of references,
but are not part of the literature list.
N.B. In some cases, a characteristic is not applicable to the method. This is indicated by n/a. In other cases, the literature research we performed
did not give us any pertinent information. In those cases, this has been indicated with unk
 Table A.3.1.: Overview of all accident analysis methods discussed in this report (cont’d)
# of
# of types publications Manual
Method Type1 Domains2 Weight # steps of entities Modelling narrative found3 present?4 References
Reason / SCM Epi av M n/a 5 Wrong Decisions by decision makers, in- 8* no [257] [208] [252]
competent Actions from line manage-
ment, unmet Preconditions for produc-
[258] [259] [102]
tion, unsafe Acts in production and in- [166]
adequate Defences ultimately cause acci-
dents
Scat Epi av, ci, ei, M 5 3 Common Categories of Contact (e. g. 5 yes, cf. [244] [244] [269] [122]
with a hazardous situation) can lead to
md, mt, an Accident. The Causes for this Con-
[85] [102]
oc, rt tact are split into Immediate Causes and
Underlying Causes.
Sfa Pas av, ci, md, n/a n/a n/a n/a 1 yes, cf. [244] [244]
oc, rw, rt
Shel(l) Pas av n/a n/a 4 Acronym for Software, Hardware, Envi- 7* no [76] [186] [27]
ronment, Liveware (twice)
[31] [66] [115]
38

Sinai Oth ei n/a n/a n/a Sinai is a compiuter system that facili- 1 no [164]
tates incident analysis in scada systems
Sol Epi av M 5 2 Sol places Events in a timeline by orga- 3 no [225] [117] [274]
nizing events into Event Building Blocks
and ordering them in a Time-Actor dia-
gram. The event building blocks are char-
acterized by time, location, action and ac-
tor. This helps to identify Contributing
Factors for each building block

1. Seq.: Sequential; Epi.: Epidemiological; Sys.: Systemic; Oth.: Other; Pas.: Only mentioned in passing;
2. AV: Aviation; CI: Chemical Industry; EC: Ecology; EI: Electrical Industry / Electricity; EN: Energy; ES: Emergency Services; FI: Food Industry;
FS: Financial Services; IN: Industry; MD: Medical; ML: Military; MT: Maritime; NI: Nuclear Industry; OA: Outdoor Activities; OC: Occupational;
RW: Railway; RT: Road Traffic; SF: Space Flight;
3. Number of articles in scientific journals, PhD theses, manuals, et cetera;
4. Does the method have an official manual that can be used to apply it?
*. Some references mentioned the method in their abstracts, but were unavailable to us. These have been counted in the number of references,
but are not part of the literature list.
N.B. In some cases, a characteristic is not applicable to the method. This is indicated by n/a. In other cases, the literature research we performed
did not give us any pertinent information. In those cases, this has been indicated with unk
 Table A.3.1.: Overview of all accident analysis methods discussed in this report (cont’d)
# of
# of types publications Manual
Method Type1 Domains2 Weight # steps of entities Modelling narrative found3 present?4 References
Stamp Sys av, ci, en, H 9 6 An Operator controls a System through 23 yes [145] [257] [225] [13]
Actuators, responding to readings from
fi, fs, md, Sensors and according to a conceptual
[252] [258] [259]
mt, oa, rt, Model of the system in his head. Safety [124] [193] [131]
Constraints control the di↵erent actions
rw, sf taken by the operator. This cycle goes for
[144] [52] [102]
physical systems and controls, but also for [89] [219] [238]
higher level systems and feedback / feed-
forward loops such as legislation and man-
[123] [145] [146]
agerial supervision [256] [166] [183]
[243] [76]
Step Seq ci, ei, es, n/a 3 Step contains Event Building Blocks, 4 no [92] [244] [269]
linking one Actor to one Action.
ml, mt, [102]
rw, rt
Stpa n/a n/a n/a n/a n/a 1 yes [145] [123]
39

Not an accident analysis method

TapRoot unk unk unk 7 unk unk 1 yes [198] [18]
Task Analysis n/a n/a n/a n/a n/a Task Analysis is a way to assess how peo- 1 unk [54]
ple perform tasks and not an analysis tool
Tem Epi av, md M 3 5 Tem models accidents as Latent and 4* unk [91] [43] [90]
Overt Threats that result in Errors. Er-
ror Management determines at least in
part the Outcome of the error

1. Seq.: Sequential; Epi.: Epidemiological; Sys.: Systemic; Oth.: Other; Pas.: Only mentioned in passing;
2. AV: Aviation; CI: Chemical Industry; EC: Ecology; EI: Electrical Industry / Electricity; EN: Energy; ES: Emergency Services; FI: Food Industry;
FS: Financial Services; IN: Industry; MD: Medical; ML: Military; MT: Maritime; NI: Nuclear Industry; OA: Outdoor Activities; OC: Occupational;
RW: Railway; RT: Road Traffic; SF: Space Flight;
3. Number of articles in scientific journals, PhD theses, manuals, et cetera;
4. Does the method have an official manual that can be used to apply it?
*. Some references mentioned the method in their abstracts, but were unavailable to us. These have been counted in the number of references,
but are not part of the literature list.
N.B. In some cases, a characteristic is not applicable to the method. This is indicated by n/a. In other cases, the literature research we performed
did not give us any pertinent information. In those cases, this has been indicated with unk
 Table A.3.1.: Overview of all accident analysis methods discussed in this report (cont’d)
# of
# of types publications Manual
Method Type1 Domains2 Weight # steps of entities Modelling narrative found3 present?4 References
Tripod- Epi ci H 6 7 An Agent of Change threatens an Object. 7 yes [253] [170] [171] [176]
In the absence of a functioning Barrier,
this may result in an undesirable Event.
[269] [122] [56]
Barrier Failure may have one Immedi- [253]
ate Cause that is triggered by Underly-
ing Causes, depending on certain Precon-
ditions
Variation Tree Pas unk unk unk unk unk 1 no [66]
Vsm Oth n/a n/a n/a n/a n/a 1 no [124]
Wait Pas all M 2 n/a 1 no [122]
Why Because Seq av M iterative 5 Incidents are caused by Events, Non- 2 no [225] [71]
events, Processes, States and Other fac-
tors, which in turn have causes of their
own.
40

1. Seq.: Sequential; Epi.: Epidemiological; Sys.: Systemic; Oth.: Other; Pas.: Only mentioned in passing;
2. AV: Aviation; CI: Chemical Industry; EC: Ecology; EI: Electrical Industry / Electricity; EN: Energy; ES: Emergency Services; FI: Food Industry;
FS: Financial Services; IN: Industry; MD: Medical; ML: Military; MT: Maritime; NI: Nuclear Industry; OA: Outdoor Activities; OC: Occupational;
RW: Railway; RT: Road Traffic; SF: Space Flight;
3. Number of articles in scientific journals, PhD theses, manuals, et cetera;
4. Does the method have an official manual that can be used to apply it?
*. Some references mentioned the method in their abstracts, but were unavailable to us. These have been counted in the number of references,
but are not part of the literature list.
N.B. In some cases, a characteristic is not applicable to the method. This is indicated by n/a. In other cases, the literature research we performed
did not give us any pertinent information. In those cases, this has been indicated with unk
A.4. Abbreviations
3CA Control Change Cause Analysis
AEB Accident Evolution and Barrier Function
APS Accident Prototypical Scenario
C-HFACF Complex Human Factor Analysis and Classification Framework
CASMET Casualty Analysis Methodology for Maritime Operations
CAST Causal Analysis using STAMP
CCDM Cause-Consequence Diagram Method
CIAF Canadian Incident Analysis Framework
COA Change Optimisation Algorithm
COCOM Contextual Control Model
CPC common performance conditions
CREAM Cognitive Reliability and Error Analysis Method
CTM Causal Tree Method
DAM Domino Accident Model
DREAM Driver’s Reliability and Error Analysis Method
ECFA Events and causal factors analysis
ECFC Events and causal factors charting
FRAM Functional Resonance Analysis Method
FTA Fault Tree Analysis
HEP Human Error Probability
HFACS Human Factors Analysis and Classification System
HOE Human and Organizational Errors
HIP Human Information Processing
HPES Human Performance Enhancement System
HRA Human Reliability Analysis
HSG245 Health and Safety Guidance
IAAM Incident or Accident Analysis Method
INPO Institute for Nuclear Power Operations
INRS Institut National de la Recherche et de Sécurité
ISIM Integrated Safety Investigation Methodology
MES Multilinear Events Sequencing
MIA Multi-Incident Analysis
MORT Management Oversight and Risk Tree
MTO Man, Technology, Organisation
NACA National Advisory Committee for Aeronautics
NSB Norske Statesbaner
OARU Integrated safety investigation methodology

41
PRISMA Prevention and Recovery Information System for Monitoring and Analysis
PSF Performance Shaping Factor
PSO Particle Swarm Optimisation
RCA Root Cause Analysis
SCAT Systemic Cause Analysis Technique
SCM Swiss Cheese Model
SFA Safety Function Analysis
SHEL Software, Hardware, Environment, Liveware
SOL Safety through Organizational Learning
STAMP System Theoretical Accident Model and Processes
STEP Sequentially Timed Events Plotting
STPA System-Theoretic Process Analysis
TEM Threat and Error Management
VSM Viable Systems Model
WAIT Work accidents investigation technique
WBA Why-Because Analysis

A.5. References
[21] Colin Paul Burns. “Analysing accident reports using structured and formal methods”.
PhD thesis. University of Glasgow, Feb. 2000.
[28] Paulo Victor Rodrigues de Carvalho. “The use of Functional Resonance Analysis Method
(FRAM) in a mid-air collision to understand some characteristics of the air traffic manage-
ment system resilience”. In: Reliability Engineering & System Safety 96.11 (Nov. 2011),
pp. 1482–1498. issn: 0951-8320. doi: 10.1016/j.ress.2011.05.009.
[52] Airong Dong. Application of CAST and STPA to railroad safety in China. Master’s Thesis.
System Design and Management Program, 2012.
[54] Doytchin E. Doytchev and Gerd Szwillus. “Combining task analysis and fault tree analysis
for accident and incident analysis: A case study from Bulgaria”. In: Accident Analysis &
Prevention 41.6 (2009), pp. 1172–1179. issn: 00014575. doi: 10.1016/j.aap.2008.07.0
14. url: http://linkinghub.elsevier.com/retrieve/pii/S000145750800153X.
[57] Jillan Farmer. Queensland Health Patient Safety: From Learning to Action. Tech. rep.
Brisbane, QLD, Australia, May 2010.
[63] Fluorouracil Incident Root Cause Analysis. Tech. rep. Institute for safe medication prac-
tices Canada, May 2007.
[66] H. Fukuda. “A Study on Incident Analysis Method for Railway Safety Management”. In:
Quarterly Report of RTRI 43.2 (July 2002), pp. 83–86. issn: 0033-9008.
[80] Rachel A. Haga, Joseph H. Saleh, and Cynthia C. Pendley. “Reexamining the titanic with
current accident analysis tool: Multidisciplinary eduation and system safety primer for en-
gineering students”. In: IEEE Global Eng Edu Conf , EDUCON IEEE Global Engineering
Education Conference, EDUCON (2013), pp. 1032–1041. issn: 9781467361101.
[83] Lars Harms-Ringdahl. “Guide to safety analysis for accident prevention”. In: IRS Risk-
hantering AB, Stockholm (2013).
[86] D. Hatley and I. Pirbhai. Strategies for Real-Time System Specification. Dorset House,
1987.
[89] John D. Helferich. “A Systems Approach to Food Accident Analysis”. PhD thesis. 2011.

42
 [92] I. A. Herrera and R. Woltjer. “Comparing a multi-linear (STEP) and systemic (FRAM)
method for accident analysis”. In: Reliability Engineering and System Safety 95.12 (2010),
pp. 1269–1275. issn: 0951-8320.
[94] E. Hollnagel. “Understanding accidents-from root causes to performance variability”. In:
IEEE 7th Human Factors Meeting. New Century, New Trends. Proceedings of the 2002
IEEE 7th Conference on Human Factors and Power Plants. 2002, pp. 1-1 - 1-6.
[96] Erik Hollnagel. Accident analysis and barrier functions. Tech. rep. IFE, Feb. 1999.
[100] Erik Hollnagel and Orjan Goteman. “The functional resonance accident model”. In: Pro-
ceedings of cognitive system engineering in process plant 2004 (2004), pp. 155–161.
[123] Soshi Kawakami. Application of a systems-theoretic approach to risk analysis of high-speed
rail project management in the US. 2014.
[128] Barbara Kitchenham and S. Charters. “Guidelines for performing Systematic Literature
Reviews in Software Engineering”. In: Engineering 2 (2007), p. 1051. issn: 00010782. doi:
10.1145/1134285.1134500.
[144] Nancy Leveson. “A new accident model for engineering safer systems”. In: Safety Science
42.4 (Apr. 2004), pp. 237–270. issn: 0925-7535. doi: 10.1016/s0925-7535(03)00047-x.
[145] Nancy Leveson. Engineering a safer world: Systems thinking applied to safety. MIT Press,
2011.
[146] Tieyu Li. Systems Theoretic Accident Model and Process application : quality control in
medical device manufacturing. Massachusetts Institute of Technology, 2013.
[155] Jonas Lundberg, Carl Rollenhagen, and Erik Hollnagel. “What-You-Look-For-Is-What-
You-Find – The consequences of underlying accident models in eight accident investigation
manuals”. In: Safety Science 47.10 (Dec. 2009), pp. 1297–1311. issn: 0925-7535. doi: 10
.1016/j.ssci.2009.01.004.
[162] D. A. Marca and C. L. Gowan. SADT: Structured Analysis and Design Technique. Mc-
Graw-Hill, 1988.
[194] Oxford Dictionary of English. Oxford University Press, 2010, 2012.
[204] Gesa Praetorius, Monica Lundh, and Margareta Lützhöft. “Learning from the past for
proactivity: A re-analysis of the accident of the MV Herald of free enterprise”. In: Proceed-
ings of the fourth Resilience Engineering Symposium, June 8-10, 2011, Sophia Antipolis.
2011, pp. 217–225.
[238] Melissa B. Spencer. “Engineering Financial Safety: A System-Theoretic Case Study from
the Financial Crisis”. PhD thesis. 2012.
[246] Inge Svedung and Jens Rasmussen. “Graphic representation of accident scenarios: map-
ping system structure and the causation of accidents”. In: Safety Science 40.5 (2002),
pp. 397–417.
[260] Conducting Accident Investigations - Revision 2. U.S. Department of Energy, 2000.

A.6. Reviewed papers

[1] Andreas Lumbe Aas. “Probing Human Error as Causal Factor in Incidents with Major
Accident Potential”. In: 2009 Third International Conference on Digital Society. 2009.
[2] “A Latent Human Error Model in Aviation Maintenance Tasks”. In: Advances in the
Ergonomics in Manufacturing: Managing the Enterprise of the Future. Pp. 236–.
[3] Xinbo Ai, Yanzhu Hu, and Guohong Chen. “A systematic approach to identify the hi-
erarchical structure of accident factors with grey relations”. In: Safety Science 63 (Mar.
2014), pp. 83–93. issn: 0925-7535. doi: 10.1016/j.ssci.2013.11.001.
[4] Jamal H. Al Saadi, Alexandra DUGUAY, and Hassan AL SAABRI. “Going to the Root
of Incidents with Structured Approach”. In: Society of Petroleum Engineers, 2014. isbn:
978-1-61399-338-5. doi: 10.2118/172031-MS.
[5] James Stannard Baker and Hugh Laurence Ross. Concepts and classification of traffic
accident causes. Tech. rep. 1960.
[6] G. Becker et al. “Analysis of the causes of ”human failure” in nuclear power plant oper-
ation”. In: (1996). url: http://inis.iaea.org/Search/search.aspx?orig_q=RN:270
53946.

43
 [7] Denis Besnard et al. “An account of scientific transfer to the industry: the co-development
of an incident analysis tool”. In: 9th Conference of the European Sociology Association.
Dec. 2009. url: http://hal-ensmp.archives-ouvertes.fr/hal-00441216/en/.
[8] Jason Bilbro. An Inter-Rater Comparison of DoD Human Factors Analysis and Classifica-
tion System (HFACS) and Human Factors Analysis and Classification System-Maritime
(HFACS-M). Tech. rep. DTIC Document, 2013.
[9] P. G. Bishop, L. O. Emmet, and C. Johnson. Learning from incidents involving E/E/PE
systems. Sudbury: HSE Books, 2003. isbn: 9780717627905.
[10] Claire Blackett et al. WMSCI 2005: 9th World Multi-Conference on Systemics, Cybernet-
ics and Informatics, Vol 10. Ed. by D. Zinn et al. Orlando, FL: 2005, pp. 431–436. isbn:
978-980-6560-62-8.
[11] Christian Blatter et al. “”A posteriori” analysis of occupational accidents: a new causal
analysis approach”. In: Rail Human Factors around the World: Impacts on and of People
for Successful Rail Operations (2012), p. 20.
[12] Craig Bonaceto et al. “Naturalistic decision making in the air traffic control tower: Com-
bining approaches to support changes in procedures”. In: Seventh International Confer-
ence on Naturalistic Decision Making, Amsterdam, The Netherlands. June 2005.
[13] Tibor Bosse and Nataliya Mogles. “Comparing modelling approaches in aviation safety”.
In: Proceedings of the 4th International Air Transport and Operations Symposium (ATOS
2013), Toulouse, France. Citeseer. 2013.
[14] Tibor Bosse et al. “LEADSTO: a Language and Environment for Analysis of Dynamics
by SimulaTiOn”. In: German Conference on Multiagent System Technologies. Springer,
2005, pp. 165–178.
[15] Kate Branford, Neelam Naikar, and Andrew Hopkins. “Guidelines for AcciMap Analysis”.
In: Learning from High Reliability Organisations. 2009. Chap. 10.
[16] I. Brittain. General description of PWR loss-of-coolant accident analysis methods used in
studies at AEE Winfrith (AEEW). Tech. rep. United Kingdom, 1982, pp. 44–.
[17] F.A. Bukhsh et al. Availability Incidents in the Telecom Domain: A Literature Review.
CTIT report. University of Twente, 2017.
[18] Peter Bullemer and Jason C. Laberge. “Common operations failure modes in the process
industries”. In: Journal of Loss Prevention in the Process Industries 23.6 (Nov. 2010),
pp. 928–935. issn: 0950-4230. doi: 10.1016/j.jlp.2010.05.008.
[19] Analysis, causality and proof in safety investigations. Tech. rep. Australian Transport
Safety Bureau, 2008.
[20] S. R. Burinski et al. Type B accident investigation report on a Personnel Injury Acci-
dent at the Bettis Atomic Power Laboratory February 17, 2004. Tech. rep. West Muffin,
Pennsylvania: U.S. Department of Energy, May 2004.
[21] Colin Paul Burns. “Analysing accident reports using structured and formal methods”.
PhD thesis. University of Glasgow, Feb. 2000.
[22] Daniela Karin Busse. “Cognitive error analysis in accident and incident investigation in
safety-critical domains”. PhD thesis. University of Glasgow, 2002.
[23] J. R. Buys and J. L. Clark. Events and causal factors analysis, in. Tech. rep. Idaho, USA,
1995.
[24] Pietro Carlo Cacciabue. Guide to Applying Human Factors Methods. Springer London,
2004, pp. 293–331. isbn: 978-1-84996-898-0. doi: 10.1007/978-1-4471-3812-9_8. url:
http://dx.doi.org/10.1007/978-1-4471-3812-9_8.
[25] S. Cafiso, G. La Cava, and V. Cutello. “A fuzzy model for road accidents analysis”.
In: NAFIPS. 18th International Conference of the North American Fuzzy Information
Processing Society, 1999. Proceedings of NAFIPS-99: 18th International Conference of
the North American Fuzzy Information Processing Society. 1999, pp. 139–143.
[26] Pascale Carayon and Sara Kraemer. “Using accident analysis methods in computer secu-
rity: The development of the Human Factors Vulnerability Analysis (HFVA)”. In: Proceed-
ings of the XVth Triennial Congress of the International Ergonomics Association and the
7th Joint Conference of Ergonomics Society of Korea/Japan Ergonomics Society. 2003.
[27] Piero Caridis. CASMET - Casualty analysis methodology for maritime operations. Tech.
rep. National Technical University of Athens Department of Naval Architecture and Ma-
rine Engineering, 1999.

44
[28] Paulo Victor Rodrigues de Carvalho. “The use of Functional Resonance Analysis Method
(FRAM) in a mid-air collision to understand some characteristics of the air traffic manage-
ment system resilience”. In: Reliability Engineering & System Safety 96.11 (Nov. 2011),
pp. 1482–1498. issn: 0951-8320. doi: 10.1016/j.ress.2011.05.009.
[29] Li Chang. “Study on Accidents of Military Driver’s Self-Mistakes”. In: 2013 Fifth Interna-
tional Conference on Measuring Technology and Mechatronics Automation. IEEE. 2013,
pp. 1039–1044.
[30] Lu Chen, Yuan Zhao, and Tingdi Zhao. Engineering Asset Management - Systems, Pro-
fessional Practices and Certification. Ed. by Peter W. Tse et al. Lecture Notes in Me-
chanical Engineering. Springer International Publishing, 2015, pp. 1247–1253. isbn: 978-
3-319-09506-6. doi: 10.1007/978-3-319-09507-3_105. url: http://dx.doi.org/10.1
007/978-3-319-09507-3_105.
[31] Shih-Tzung Chen and Yu-Hsin Chou. “Examining Human Factors for marine casualties
using HFACS-maritime accidents (HFACS-MA)”. In: 2012 12th International Conference
on ITS Telecommunications. IEEE. 2012, pp. 391–396.
[32] Wei-ke Chen and Jin-ling Li. “Research on the application of multidimensional association
rule in construction accidents analysis”. In: 2010 IEEE 17Th International Conference on
Industrial Engineering and Engineering Management (IE&EM2010). 2010, pp. 1077–1081.
[33] Ying Chen. “Traffic Crash Modeling and Driver Behavior Analysis on Mountainous High-
ways in China”. In: CICTP 2014. 2014. Chap. 231, pp. 2422–2432. doi: 10.1061/978078
4413623.231. url: http://ascelibrary.org/doi/abs/10.1061/9780784413623.231.
[34] Yu Chen. “Cause Analysis of At-Grade Intersection Accidents and Grading Improvement
Methods Research of Highways in Plain Area”. In: ICCTP 2010. 2010, pp. 565–572. doi:
10.1061/41127(382)60. url: http://ascelibrary.org/doi/abs/10.1061/41127%283
82%2960.
[35] Cheng Cheng, Yan Chen, and Taoying Li. “An AHP method for road traffic safety”.
In: Fourth International Joint Conference on Computational Sciences and Optimization
(CSO), 2011. IEEE. 2011, pp. 305–308.
[36] “Risky Work Environments: Reappraising Human Work Within Fallible Systems”. In: ed.
by Pascal Béguin Christine Owen Ger Wackers. Ashgate Publishing Ltd, 2009. Chap. 9.
Conclusion: Towards Development Work Within Complex and Fallible Systems, pp. 197–
206.
[37] D. K. Chua. “Poisson Model of Construction Incident Occurrence”. In: J Constr Eng
Manage Journal of Construction Engineering and Management 131.6 (2005), pp. 715–
722. issn: 0733-9364.
[38] D. Y. Chung and K. R. O’Kula. Accident Analysis Guidance for Completion of 10 CFR
830-Compliant DSAs. Tech. rep. 2002.
[39] T. J. Cleophas and A. H. Zwinderman. “Incident analysis in cardiovascular care and the
scientific method”. In: Perfusion 24.1 (2011), pp. 4–6. url: http://www.scopus.com/in
ward/record.url?eid=2-s2.0-79952713506&partnerID=40&md5=08ed7a5a9771ad50b
a62475b62302b2d.
[40] Bruce G. Coury, Vernon S. Ellingstad, and Joseph M. Kolly. “Transportation Accident
Investigation: The Development of Human Factors Research and Practice”. In: Reviews
of Human Factors and Ergonomics 6.1 (Nov. 2010), pp. 1–33. issn: 1557-234X. doi:
10.1518/155723410x12849346788624.
[41] Tina Cullimore et al. Multi-Incident Analysis Method. Feb. 2013.
[42] Paulo Victor Rodrigues De Carvalho. “Automation surprises in a mid-air collision”. In:
XVII international conference on industrial engineering and operations management.
2011.
[43] Sidney WA Dekker and Johan Lundstrom. “From threat and error management (TEM)
to resilience”. In: Human Factors and Aerospace Safety 6.3 (2006), p. 261. issn: 1468-
9456(Print).
[44] B. S. Dhillon. Patient Safety – An Engineering Approach. CRC Press, 2012.
[45] Artemis Diamantouros et al. Your patient had a VTE - what went wrong? Apr. 2015.
[46] Yves Dien, Michel Llory, and René Montmayeul. “Organisational accidents investigation
methodology and lessons learned.” In: J Hazard Mater 111.1-3 (July 2004), pp. 147–53.
issn: 0304-3894. doi: 10.1016/j.jhazmat.2004.02.021.

45
[47] “Traffic Safety Evaluation in Long and Hill Slope Road Section Based on Principal Com-
ponent Analysis and Hierarchical Cluster Analysis”. In: Logistics. Chap. 505, pp. 3448–
3454. doi: 10.1061/40996(330)506. url: http://ascelibrary.org/doi/abs/10.1061
/40996%28330%29506.
[48] “Track Access Technology of Traffic Accident Vehicles Based on Video”. In: ICCTP 2009.
Chap. 235, pp. 1–5. doi: 10.1061/41064(358)236. url: http://ascelibrary.org/doi
/abs/10.1061/41064%28358%29236.
[49] “A Security Analysis and Accident Prevention Measure”. In: ICCTP 2010. Chap. 72,
pp. 685–690. doi: 10.1061/41127(382)73. url: http://ascelibrary.org/doi/abs/10
.1061/41127%28382%2973.
[50] “A Situation Assessment Method of Traffic Incident Based on Bayesian Networks”. In:
ICLEM 2010. Chap. 441, pp. 3165–3172. doi: 10.1061/41139(387)442. url: http://a
scelibrary.org/doi/abs/10.1061/41139%28387%29442.
[51] “AR and ESE Methods for Traffic Incident Analysis on Urban Arterials”. In: CICTP
2015. Chap. 32, pp. 352–362. doi: 10.1061/9780784479292.032. url: http://ascelib
rary.org/doi/abs/10.1061/9780784479292.032.
[52] Airong Dong. Application of CAST and STPA to railroad safety in China. Master’s Thesis.
System Design and Management Program, 2012.
[53] Je↵rey J. Dorsch, Mahmoud M. Yasin, and Andrew J. Czuchry. “Application of root cause
analysis in a service delivery operational environment: a framework for implementation”.
In: International Journal of Service Industry Management 8.4 (1997), pp. 268–289.
[54] Doytchin E. Doytchev and Gerd Szwillus. “Combining task analysis and fault tree analysis
for accident and incident analysis: A case study from Bulgaria”. In: Accident Analysis &
Prevention 41.6 (2009), pp. 1172–1179. issn: 00014575. doi: 10.1016/j.aap.2008.07.0
14. url: http://linkinghub.elsevier.com/retrieve/pii/S000145750800153X.
[55] In: Licensing; safety-related design. Ed. by Donald T. Eggen and Michel Banal. Vol. II.
Fast reactor safety and related physics. Office of Scientific and Technical Information.
Oak Ridge, Tenn.: Distributed by the Office of Scientific and Technical Information, U.S.
Dept. of Energy, 1976. url: http://www.osti.gov/servlets/purl/7085003-T1Wl9n/.
[56] Iraj Mohammad Fam, Ali Kianfar, and Mohammad Faridan. “Application of Tripod-Beta
Approach and Map–Overlaying Technique to Analyze Occupational Fatal Accidents in a
Chemical Industry in Iran”. In: International journal of occupational hygiene 2.1 (2010),
pp. 30–36.
[57] Jillan Farmer. Queensland Health Patient Safety: From Learning to Action. Tech. rep.
Brisbane, QLD, Australia, May 2010.
[58] Milos Ferjencik. “An integrated approach to the analysis of incident causes”. In: Safety
Science 49.6 (July 2011), pp. 886–905. issn: 0925-7535. doi: 10.1016/j.ssci.2011.02
.005.
[59] Milos Ferjencik. “IPICA Lite—Improvements to root cause analysis”. In: Reliability En-
gineering & System Safety 131 (Nov. 2014), pp. 1–13. issn: 0951-8320. doi: 10.1016/j
.ress.2014.06.004.
[60] John C. Flanagan. “The critical incident technique.” In: Psychological bulletin 51.4 (1954),
p. 327.
[61] D. Fleury. “Recognition of driving situations and road legibility”. In: 4th workshop of
international cooperation on theories and concepts in traffic safety (ICTCT), Vienna.
1991, pp. 13–20.
[62] Dominique Fleury and Thierry Brenac. “Accident prototypical scenarios, a tool for road
safety research and diagnostic studies”. In: Accident Analysis & Prevention 33.2 (2001),
pp. 267–276.
[63] Fluorouracil Incident Root Cause Analysis. Tech. rep. Institute for safe medication prac-
tices Canada, May 2007.
[64] Veronica L. Foreman et al. “Software in military aviation and drone mishaps: Analysis
and recommendations for the investigation process”. In: Reliability Engineering & System
Safety 137 (May 2015), pp. 101–111. issn: 0951-8320. doi: 10.1016/j.ress.2015.01.0
06.
[65] R. Frei et al. “NRI MORT user’s manual”. In: Ref. NRI-1 (2002), Pub. Noordwijk Risk
Initiative Foundation, The Netherlands. www. nri. eu. com (2002).

46
[66] H. Fukuda. “A Study on Incident Analysis Method for Railway Safety Management”. In:
Quarterly Report of RTRI 43.2 (July 2002), pp. 83–86. issn: 0033-9008.
[67] Ralph Fullwood. “Chemical and Nuclear Accident Analysis Methods”. In: Probabilistic
safety assessment in the chemical and nuclear industries. Butterworth-Heinemann, 1999.
Chap. 3.
[68] Ralph Fullwood. Probabilistic safety assessment in the chemical and nuclear industries.
Butterworth-Heinemann, 1999.
[69] Javier Garcı́a et al. “Analysis of abnormal operating occurrences for Sta. Maria de Garoña
with TRACG”. In: International meeting on LWR fuel performance “nuclear fuel: address-
ing the future”. European Nuclear Society, 2006, pp. 26–30.
[70] Marko Gerbec. “Supporting organizational learning by comparing activities and outcomes
of the safety-management system”. In: Journal of Loss Prevention in the Process Indus-
tries 26.6 (Nov. 2013), pp. 1113–1127. issn: 0950-4230. doi: 10.1016/j.jlp.2013.04.0
09.
[71] Torsten Gerdsmeier, Peter Ladkin, and Karsten Loer. “Analysing the Cali accident with
a WB-Graph”. In: Proceedings of the First Workshop on Human Error and Systems De-
velopment, number GAAG-TR-97-2. Glasgow Accident Analysis Group. 1997.
[72] Ronald E. Gerton. Accident investigation board report on the May 14, 1997, chemical
explosion at the Plutonium Reclamation Facility, Hanford Site, Richland, Washington-
final report. Tech. rep. Westinghouse Hanford Co., Richland, WA (United States), 1997.
[73] Farhad Soleimanian Gharehchopogh and Zahra Asheghi Dizaji. “A new chaos agent based
approach in prediction of the road accidents with hybrid of PSO optimization and chaos
optimization algorithms: a case study”. In: International Journal of Academic Research
6.2 (Mar. 2014), pp. 108–115. issn: 2075-4124. doi: 10.7813/2075-4124.2014/6-2/a.18.
[74] D. W. Golden. “TMI-2 analysis”. In: (1992). url: http://inis.iaea.org/Search/sea
rch.aspx?orig_q=RN:26053155.
[75] Hangjun Gong. “A Study on Comprehensive Evaluation of Road Transportation Safety
Based on Grey Relational Grade”. In: ICTIS 2011. 2011, pp. 770–777. doi: 10.1061/41
177(415)98. url: http://ascelibrary.org/doi/abs/10.1061/41177%28415%2998.
[76] Lei Gong et al. “An integrated graphic–taxonomic–associative approach to analyze hu-
man factors in aviation accidents”. In: Chinese Journal of Aeronautics 27.2 (Apr. 2014),
pp. 226–240. issn: 10009361. doi: 10.1016/j.cja.2014.02.002. url: http://linking
hub.elsevier.com/retrieve/pii/S1000936114000119.
[77] Lei Gong et al. “Implication of Mishaps to Preliminary Hazard Analysis of Hypersonic
Vehicles”. In: Procedia Engineering 80 (2014), pp. 437–444. issn: 1877-7058. doi: 10.10
16/j.proeng.2014.09.102.
[78] Natassia Goode et al. “Injury causation during hiking activities: a systems analysis of
reports from the NZ National Incident Database”. In: Future faces: Outdoor education
research innovations and visions (2013), p. 45.
[79] W. S. Gregory and B. D. Nichols. Methods for air cleaning system design and accident
analysis. Tech. rep. Los Alamos National Lab., NM (USA), 1986.
[80] Rachel A. Haga, Joseph H. Saleh, and Cynthia C. Pendley. “Reexamining the titanic with
current accident analysis tool: Multidisciplinary eduation and system safety primer for en-
gineering students”. In: IEEE Global Eng Edu Conf , EDUCON IEEE Global Engineering
Education Conference, EDUCON (2013), pp. 1032–1041. issn: 9781467361101.
[81] Kari Hakkinen. “Risk reduction within companies by a better understanding of safety”. In:
Technology, Law and Insurance 4.1-2 (1999), pp. 51–54. doi: 10.1080/135993799349117.
url: http://dx.doi.org/10.1080/135993799349117.
[82] Andrew R. Hale and J. Hovden. “Management and culture: the third age of safety. A
review of approaches to organizational aspects of safety, health and environment”. In:
Occupational injury: Risk, prevention and intervention (1998), pp. 129–165.
[83] Lars Harms-Ringdahl. “Guide to safety analysis for accident prevention”. In: IRS Risk-
hantering AB, Stockholm (2013).
[84] Lars Harms-Ringdahl. “Relationships between accident investigations, risk analysis, and
safety management.” In: J Hazard Mater 111.1-3 (July 2004), pp. 13–9. issn: 0304-3894.
doi: 10.1016/j.jhazmat.2004.02.003.
[85] Lars Harms-Ringdahl. Safety analysis: principles and practice in occupational safety. CRC
Press, 2003.

47
 [87] Markus Hayes et al. Type B accident investigation of the March 20, 2003 building 752
stair installation accident at the Sandia national laboratories, New Mexico. Tech. rep.
National Nuclear Security Administration, Apr. 2003.
[88] Herbert William Heinrich. Industrial accident prevention: a scientific approach. Second
Edition. New York & London: McGraw-Hill Book Company, Inc., 1941.
[89] John D. Helferich. “A Systems Approach to Food Accident Analysis”. PhD thesis. 2011.
[90] R. L. Helmreich and D. M. Musson. The University of Texas Threat and Error Manage-
ment Model: Components and examples. Slidepack. 2003.
[91] Robert L. Helmreich, James R. Klinect, and John A. Wilhelm. “Models of threat, error,
and CRM in flight operations”. In: Proceedings of the tenth international symposium on
aviation psychology. 1999, pp. 677–682.
[92] I. A. Herrera and R. Woltjer. “Comparing a multi-linear (STEP) and systemic (FRAM)
method for accident analysis”. In: Reliability Engineering and System Safety 95.12 (2010),
pp. 1269–1275. issn: 0951-8320.
[93] R. R. Ho↵man. “Human Factors Contributions to Knowledge Elicitation”. In: Human
Factors: The Journal of the Human Factors and Ergonomics Society 50.3 (June 2008),
pp. 481–488. issn: 0018-7208. doi: 10.1518/001872008x288475.
[94] E. Hollnagel. “Understanding accidents-from root causes to performance variability”. In:
IEEE 7th Human Factors Meeting. New Century, New Trends. Proceedings of the 2002
IEEE 7th Conference on Human Factors and Power Plants. 2002, pp. 1-1 - 1-6.
[95] Erik Hollnagel. 2014. url: http://erikhollnagel.com/ideas/phenotypes-and-genot
ypes.html.
[96] Erik Hollnagel. Accident analysis and barrier functions. Tech. rep. IFE, Feb. 1999.
[97] “Beyond Procedures”. In: Safer Complex Industrial Environments - a human factors ap-
proach. Ed. by Erik Hollnagel. 2009. Chap. 7, pp. 113–132.
[98] Erik Hollnagel. Cognitive reliability and error analysis method (CREAM). Elsevier, 1998.
[99] Erik Hollnagel. “The changing nature of risk”. In: Ergonomics Australia Journal 22.1-2
(2008), pp. 33–46.
[100] Erik Hollnagel and Orjan Goteman. “The functional resonance accident model”. In: Pro-
ceedings of cognitive system engineering in process plant 2004 (2004), pp. 155–161.
[101] Erik Hollnagel, Jeanette Hounsgaard, and Lacey Colligan. FRAM - the Functional Res-
onance Analysis Method : a handbook for the practical use of the method. [Middelfart]:
Centre for Quality, Region of Southern Denmark, 2014. isbn: 9788799747702.
[102] Erik Hollnagel and Josephine Speziali. Study on developments in accident investigation
methods : a survey of the ”state-of-the-art”. Stockholm: Swedish Nuclear Power Inspec-
torate, 2008.
[103] C. Michael Holloway and C. W. Johnson. “A Look at Aircraft Accident Analysis in the
Early Days: Do Early 20th Century Accident Investigation Techniques Have Any Lessons
for Today?” In: System Safety, 2007 2nd Institution of Engineering and Technology In-
ternational Conference on. IET. 2007, pp. 235–240.
[104] Andrew Hopkins. “Studying organisational cultures and their e↵ects on safety”. In: Safety
Science 44.10 (Dec. 2006), pp. 875–889. issn: 09257535. doi: 10.1016/j.ssci.2006.05
.005. url: http://linkinghub.elsevier.com/retrieve/pii/S0925753506000567.
[105] Carl G. Hoyos and B. M. Zimolong. “Hazard and Safety Analysis”. In: Occupational safety
and accident prevention: behavioral strategies and methods. Elsevier, 2014. Chap. 3.
[106] H. Hu et al. “Quantifying Accident Causative Factors for China’s Freeway Tunnels with
FTA Method”. In: CICTP 2012. 2012. Chap. 231, pp. 2278–2288. doi: 10.1061/978078
4412442.231. url: http://ascelibrary.org/doi/abs/10.1061/9780784412442.231.
[107] He Huang et al. “Research on Accident Inversion and Analysis Method of the Oil and Gas
Pipeline SCADA System”. In: Sixth International Conference on Measuring Technology
and Mechatronics Automation, 2014. 2014, pp. 492–496.
[108] Norimitsu Ichikawa. Statistical accident analysis and electrical fatality rate in Japan, 2002-
2011- causes and preventive measures of fatal electrical accidents. Tech. rep. Kogakuin
University, 2015.
[109] Guidelines for accident analysis of WWER nuclear power plants. Vienna: International
Atomic Energy Agency, 1995.

48
[110] Incorporation of Advanced Accident Analysis Methodology into Safety Analysis Reports.
Tech. rep. International Atomic Energy Agency, 2003. url: http://lib.myilibrary.c
om?id=1244.
[111] Chenglou Ji and Hong Zhang. “Accident investigation and root cause analysis method”.
In: Proceedings of the 2012 International Conference on Quality, Reliability, Risk, Main-
tenance, and Safety Engineering (QR2MSE). 2012, pp. 297–302.
[112] Jia Jia. “Evaluation of Rough Sets Theory on E↵ect Factors in Highway Traffic Accidents”.
In: CICTP 2012. 2012. Chap. 214, pp. 2107–2118. doi: 10.1061/9780784412442.214.
url: http://ascelibrary.org/doi/abs/10.1061/9780784412442.214.
[113] Yonglan Jiao and Bingzhen Sun. “Causation Analysis of Railway Traffic Accident Based
on Rough Set Theory”. In: Traffic and Transportation Studies (2008). 2008, pp. 763–769.
doi: 10.1061/40995(322)71. url: http://ascelibrary.org/doi/abs/10.1061/40995
%28322%2971.
[114] Wang Jinlin et al. “Application of Spatial Data Mining in Accident Analysis System”. In:
2008 International Workshop on Education Technology and Training & 2008 International
Workshop on Geoscience and Remote Sensing. 2008.
[115] Chris Johnson, ed. GIST Technical Report G2002-2. 2002.
[116] Chris W. Johnson. “’Act in Haste, Repent at Leisure’ An Overview of Operational In-
cidents Involving UAVs in Afghanistan (2003-2005)”. In: System Safety, 2008 3rd IET
International Conference on. IET. 2008, pp. 1–6.
[117] Chris W. Johnson, H. A. Oltedal, and C. M. Holloway. “Comparing the identification of
recommendations by di↵erent accident investigators using a common methodology”. In:
IET Conf Publ IET Conference Publications 2012.607 CP (2012). issn: 9781849196789.
[118] W. G. Johnson. The Management Oversight and Risk Tree - MORT. Feb. 1973.
[119] Moizés Martins Junior et al. “Overcoming the blame game to learn from major accidents:
A systemic analysis of an Anhydrous Ammonia leakage accident”. In: Journal of Loss
Prevention in the Process Industries 25.1 (Jan. 2012), pp. 33–39. issn: 0950-4230. doi:
10.1016/j.jlp.2011.06.026.
[120] S. Kang and S. M. Lee. “Introducing alignment based risk indices into the highway traffic
accident analysis”. In: Congress on Computing in Civil Engineering, Proceedings. 2007,
pp. 465–477. doi: 10.1061/40937(261)56. url: http://www.scopus.com/inward/reco
rd.url?eid=2-s2.0-84891330132&partnerID=40&md5=39cd7227ca0067ce9810da0a41
6f7e4a.
[121] N. Karanikas et al. “Evaluating Advancements in Accident Investigations Using a Novel
Framework”. In: Air Transport and Operations Symposium 2015. 2015.
[122] Panagiota Katsakiori, George Sakellaropoulos, and Emmanuel Manatakis. “Towards an
evaluation of accident investigation methods in terms of their alignment with accident
causation models”. In: Safety Science 47.7 (Aug. 2009), pp. 1007–1015. issn: 0925-7535.
doi: 10.1016/j.ssci.2008.11.002.
[123] Soshi Kawakami. Application of a systems-theoretic approach to risk analysis of high-speed
rail project management in the US. 2014.
[124] Konstantinos Kazaras, Tom Kontogiannis, and Konstantinos Kirytopoulos. “Proactive
assessment of breaches of safety constraints and causal organizational breakdowns in com-
plex systems: A joint STAMP–VSM framework for safety assessment”. In: Safety Science
62 (Feb. 2014), pp. 233–247. issn: 0925-7535. doi: 10.1016/j.ssci.2013.08.013.
[125] Cao Kemei et al. “Probability analysis for external reactor vessel cooling e↵ectiveness
under severe accident”. In: Nuclear Power Engineering 30.1 (2009), pp. 1–4.
[126] Jari Kettunen and Kari Laakso. Evaluation of incident analysis practices in the Finnish
nuclear power industry. [Helsinki]: Radiation and Nuclear Safety Authority, 1999. isbn:
9789517123525.
[127] J. Kingston. 3CA — Control change cause analysis manual. The Noordwijk Risk Initiative
Foundation, 2002.
[129] Urban Kjellen and Tore J. Larsson. “Investigating accidents and reducing risks - a dynamic
approach”. In: Journal of occupational accidents 3.2 (1981), pp. 129–140.
[130] Norm W. Knox and Robert W. Eicher. Mort User’s Manual for use with the Management
Oversight and Risk Tree Analytical Logic Diagram. 3rd ed. System Safety Development
Center, Feb. 1992.

49
[131] T. Kohda. “Accident Analysis of Protective Systems Based on System Control Concepts”.
In: (2007), pp. 414–419.
[132] T. Kohda and K. Inoue. “Fault-tree analysis considering latency of basic events”. In:
(2001), pp. 32–35.
[133] Masayo Komoda et al. “Development of cPHARM-2E, a Computerized Medical Incident
Analysis System”. In: Jpn. J. Pharm. Health Care Sci. 32.9 (2006), pp. 867–874.
[134] Tom Kontogiannis, Vrassidas Leopoulos, and Nikos Marmaras. “A comparison of accident
analysis techniques for safety-critical man–machine systems”. In: International Journal of
Industrial Ergonomics 25.4 (2000), pp. 327–347.
[135] Pavel Krömer et al. Mining Traffic Accident Features by Evolutionary Fuzzy Rules. 2013.
[136] Kari Laakso, Pekka Pyy, and Antti L. Lyytikäinen. “Systematic Analysis and Feedback
of Plant Disturbance Data”. In: Reliability Data Collection and Analysis. Dordrecht:
Springer Netherlands, 1992, pp. 181–192. isbn: 978-94-011-2438-6. doi: 10 . 1007 / 978
-94-011-2438-6_11. url: http://dx.doi.org/10.1007/978-94-011-2438-6_11.
[137] Annotated bibliography of human factors applications literature. Tech. rep. Sept. 1984.
url: http://www.osti.gov/servlets/purl/5718044-wmawPN/.
[138] D. H. Lee and S. N. Byun. “A Systematic Accident Scenario Analysis of Child Nursery
Equipment: Stroller Case Study”. In: Proceedings of the IEA 2000/HFES 2000 Congress.
2000, pp. 63–66.
[139] Kwan Suk Lee et al. “Development of a comprehensive analysis model for human error
prevention in industrial fields”. In: The Eighth Pan-Pacific Conference on Occupational
Ergonomics (PPCOE 2007). 2007.
[140] O. Lemke and G. Bosse. “Exemplary application of a formal accident analysis method
[Beispielhafte anwendung einer formalen unfallanalysemethode]”. In: ZEV Rail Glasers
Annalen 130.6-7 (2006), pp. 236–249. url: http://www.scopus.com/inward/record.u
rl?eid=2-s2.0-33746044864&partnerID=40&md5=3f298ad44175e39422f335dd36454a
5e.
[141] Jacques Leplat. “Accident analyses and work analyses”. In: Journal of occupational acci-
dents 1.4 (1978), pp. 331–340.
[142] Jacques Leplat. “Occupational accident research and systems approach”. In: Journal of
Occupational Accidents Journal of Occupational Accidents 6 (1984), pp. 77–89. issn: 1-3.
[143] Sue Leveritt, Tim Horberry, and Tristan Cooke. New Knowledge Elicitation Methods to Cap-
ture Risks Related to Mobile Mining Equipment. Tech. rep. Brisbane, QLD, Australia:
Minerals Industry Safety and Health Centre, University of Queensland, 2010.
[144] Nancy Leveson. “A new accident model for engineering safer systems”. In: Safety Science
42.4 (Apr. 2004), pp. 237–270. issn: 0925-7535. doi: 10.1016/s0925-7535(03)00047-x.
[145] Nancy Leveson. Engineering a safer world: Systems thinking applied to safety. MIT Press,
2011.
[146] Tieyu Li. Systems Theoretic Accident Model and Process application : quality control in
medical device manufacturing. Massachusetts Institute of Technology, 2013.
[147] Xiaolei Li and Tingdi Zhao. “An accident analysis model oriented to complex tasks pro-
cess”. In: Proceedings - Annual Reliability and Maintainability Symposium. 2010.
[148] Xiaolei Li, Tingdi Zhao, and Mei Rong. “A multi-factor coupling event chain model based
on petri nets”. In: (2009), pp. 466–469.
[149] X. Li et al. “Operator Decision Making in the Minerals Industry”. In: The Ergonomics
Open Journal 4.S2-M3 (2011), pp. 103–111. issn: 1875-9343.
[150] Lei Lin, Qian Wang, and Adel Sadek. “Data Mining and Complex Network Algorithms
for Traffic Accident Analysis”. In: Transportation Research Record: Journal of the Trans-
portation Research Board 2460 (2014), pp. 128–136.
[151] T. Lindner et al. “Influential factors on human performance in railways and their inter-
relations”. In: Safety, Reliability and Risk Analysis: Beyond the Horizon (2013), p. 435.
[152] Hao Liu, Ruishan Sun, and Renli Lv. “Qualitative Analysis Method of Civil Aviation
Safety Information Sources”. In: ICTIS 2011. 2011. Chap. 271, pp. 2149–2156. doi: 10.1
061/41177(415)272. url: http://ascelibrary.org/doi/abs/10.1061/41177%28415
%29272.
[153] Massimo Losa and A. Terrosi Axerio. Improving Consistency of RSAR for a Collector
Rural Road. Jan. 2004.

50
[154] Marc Ludmann and Jean-Yves -. Y. Sauvage. “LB LOCA analysis using the Deterministic
Realistic Methodology. Application to the 3-loop plant”. In: (1999). url: http://inis.i
aea.org/Search/search.aspx?orig_q=RN:31009071.
[155] Jonas Lundberg, Carl Rollenhagen, and Erik Hollnagel. “What-You-Look-For-Is-What-
You-Find – The consequences of underlying accident models in eight accident investigation
manuals”. In: Safety Science 47.10 (Dec. 2009), pp. 1297–1311. issn: 0925-7535. doi: 10
.1016/j.ssci.2009.01.004.
[156] Ziyan Luo et al. “A New Accident Analysis Method Based on Complex Network and
Cascading Failure”. In: Discrete Dynamics in Nature and Society 2013 (2013), pp. 1–9.
issn: 1026-0226. doi: 10.1155/2013/437428.
[157] Xiao Ma et al. “Equivalent-Multidimensional Information Assignment Method for Road
Black Spot Identification”. In: ICTIS 2011. 2011, pp. 795–801. doi: 10.1061/41177(415
)101. url: http://ascelibrary.org/doi/abs/10.1061/41177%28415%29101.
[158] Xiao Ma et al. “Modeling and Analysis of Traffic Accidents’ Inducements Based on Fac-
torial Experiment Method”. In: ICCTP 2011. 2011. Chap. 196, pp. 1988–1998. doi: 10.1
061/41186(421)197. url: http://ascelibrary.org/doi/abs/10.1061/41186%28421
%29197.
[159] Jackie MacDonald. “Healthcare Services Managers: What Information do They Need and
Use?” In: Evidence Based Library and Information Practice 2008.3:3 (2008). url: http:
//ejournals.library.ualberta.ca/index.php/EBLIP/article/view/1479.
[160] Francesca Madeddu. Human Error in Critical Systems. Tech. rep. 2015.
[161] Tariq Mahmood et al. “Modeling and Learning Interaction-based Accidents for Safety-
Critical Software Systems”. In: 14th Asia-Pacific Software Engineering Conference. 2007.
[163] K. Marcinkowski, G. Apostolakis, and R. Weil. “A Computer-Aided Technique for Iden-
tifying Latent Conditions (CATILaC)”. In: Cognition, Technology & Work 3.2 (2001),
pp. 111–126. issn: 1435-5558.
[164] J. L. Martinez. “Experience with SINAI an integrated incident analysis system”. In:
CIRED Conference Publication 438. 438. 1997, pp. 4.15.1–4.15.4.
[165] P. Masci et al. “Using PVS to Investigate Incidents through the Lens of Distributed
Cognition”. In: Lecture notes in computer science 7226 (2012), pp. 273–278. issn: 0302-
9743.
[166] Anthony Jurgis Masys. “Fratricide in Air Operations. Opening the Black-Box: Revealing
the ’Social’”. PhD thesis. University of Leicester, 2010.
[167] Peter McCulloch and Ken Catchpole. “A three-dimensional model of error and safety in
surgical health care microsystems. Rationale, development and initial testing.” In: BMC
Surg 11 (2011), p. 23. issn: 1471-2482. doi: 10.1186/1471-2482-11-23.
[168] Martijn W.A. A. Meuwissen. Evaluatie en herontwerp van de DCMR incidentendatabase
met behulp van PRISMA. Technische Universiteit Eindhoven, 2004.
[169] Masashi Miwa, Brian Gozun, and Tatsuo Oyama. “Statistical data analyses to elucidate
the causes and improve the countermeasures for preventing train accidents in Japan”. In:
ITOR International Transactions in Operational Research 13.3 (2006), pp. 229–251. issn:
0969-6016.
[170] Iraj Mohammadfam, Nahid Mansouri, and Hanieh Nikoomaram. “Systemic Accident
Analysis Methods: A Comparison of Tripod- , RCA and ECFC”. In: Jundishapur Journal
of Health Sciences 6.2 (2014), pp. 327–333.
[171] I. Mohammadfam et al. “Development of a Decision-Making Model for Selecting and
Prioritizing Accident Analysis Techniques in Process Industries”. In: Journal of Scientific
& Industrial Research 73.8 (2014), pp. 517–520.
[172] MORT chart. Idaho, Feb. 1992.
[173] MORT - Management Oversight and Risk Tree. Dec. 2002.
[174] Jens G. Munthe Andersen. deuaL mroN ot rette. Feb. 2001.
[175] Mohsen Naderpour, Salman Nazir, and Jie Lu. “The role of situation awareness in acci-
dents of large-scale technological systems”. In: Process Safety and Environmental Protec-
tion 97 (Sept. 2015), pp. 13–24. issn: 0957-5820. doi: 10.1016/j.psep.2015.06.002.
[176] Ismail Nasir. “Development of Incident Investigation System for Process Safety Manage-
ment in Process Industries”. PhD thesis. Universiti Teknologi PETRONAS, 2013.
[177] Kawar Nehal. Accident and Incident Investigation. Dec. 2013.

51
[178] Sharon Newnam and Natassia Goode. “Do not blame the driver: a systems analysis of
the causes of road freight crashes.” In: Accid Anal Prev 76 (Mar. 2015), pp. 141–51. issn:
1879-2057. doi: 10.1016/j.aap.2015.01.016.
[179] D. S. Nielsen. “Use of Cause-Consequence Charts in Practical Systems Analysis”. In:
(1974).
[180] Dan S. Nielsen. The Cause/Consequence Diagram Method as a Basis for Quantitative
Accident Analysis. Tech. rep. Danish Atomic Energy Commission, Risø Research Estab-
lishment, May 1971.
[181] M. Nikbakht, Ali Sayyah, and N. Zulkifli. “Hazard identification and accident analysis on
city gate station in natural gas industry”. In: (2010), pp. 13–17.
[182] Maria Skyvell Nilsson and Ewa Pilhammar. “Professional approaches in clinical judge-
ments among senior and junior doctors: implications for medical education.” In: BMC
Med Educ 9 (2009), p. 25. issn: 1472-6920. doi: 10.1186/1472-6920-9-25.
[183] Ru Niu et al. “Applying system thinking to learn from accident of modern automatic
control systems”. In: Chin J Electron Chinese Journal of Electronics 23.2 (2014), pp. 409–
414. issn: 1022-4653.
[184] XueYuan Niu et al. “An accident analysis of a smart substation”. In: China Int Conf
Elect Distrib , CICED China International Conference on Electricity Distribution, CICED
2014-December (2014), pp. 992–994. issn: 2161-7481.
[185] Z. S. Nivolianitou, V. N. Leopoulos, and M. Konstantinidou. “Comparison of techniques
for accident scenario analysis in hazardous systems”. In: Journal of Loss Prevention in
the Process Industries 17.6 (Nov. 2004), pp. 467–475. issn: 0950-4230. doi: 10.1016/j.j
lp.2004.08.001.
[186] Yuji Niwa. “A proposal for a new accident analysis method and its application to a
catastrophic railway accident in Japan”. In: Cognition, Technology & Work 11.3 (Apr.
2008), pp. 187–204. issn: 1435-5558. doi: 10.1007/s10111-008-0112-5.
[187] Lenna Norros and Maaria Nuutinen. “Learning from accidents: Analysis of normal prac-
tices”. In: Risky work environments: Reappraising human work within fallible systems 17
(2009).
[188] Maaria Nuutinen and Juha Luoma, eds. Human practice in the life cycle of complex
systems : challenges and methods. [Espoo, Finland]: VTT Technical Research Centre of
Finland, 2005. isbn: 9789513866754.
[189] Economic evaluation manual (volume 2). Wellington [N.Z.]: NZ Transport Agency, 2010.
isbn: 9780478352566. url: http://www.nzta.govt.nz/resources/economic-evaluat
ion-manual/volume-1/docs/eem1-jan2010.pdf.
[190] Schenectady Naval Reactors Office. Type B Accident Investigation Board Report on the
July 7, 1997 Industrial Accident at the Knolls Atomic Power Laboratory-Windsor Site.
Tech. rep. U. S. Department of Energy, July 1997.
[191] Helen Omole, Guy Walker, and Gina Netto. “Extracting Cultural Factors from Heli-
copter Accident Reports Using Content Analysis”. In: Advances in Human Aspects of
Transportation: Part I 7 (2014), p. 3.
[192] On-scene Traffic Accident Investigators’ Manual. NCJRS, 1981.
[193] Min Ouyang et al. “STAMP-based analysis on the railway accident and accident spreading:
Taking the China–Jiaoji railway accident for example”. In: Safety Science 48.5 (June
2010), pp. 544–555. issn: 0925-7535. doi: 10.1016/j.ssci.2010.01.002.
[195] Canan Özgen. “An approach to investigate relationship between speed and safety on urban
arterials”. PhD thesis. Middle East Technical University, 2008.
[196] S. K. Palei, N. C. Karmakar, and R. S. M. Reddy. “E↵ects of demography and occupa-
tional traits on consequence of injury of underground coal miners”. In: IEEE International
Conference on Industrial Engineering and Engineering Management. Vol. 2015-January.
2014, pp. 1260–1264.
[197] Fuquan Pan, Jian John Lu, and Qiaojun Xiang. “Influencing Factors for Safety Level of
Service and Its Principal Component Analysis”. In: Logistics. Nov. 2008, pp. 1710–1715.
doi: 10.1061/40996(330)250. url: http://ascelibrary.org/doi/abs/10.1061/4099
6%28330%29250.
[198] Mark Paradies and Linda Unger. TapRoot: The system for root cause analysis, problem
investigation, and proactive improvement. System Improvements, 2000.

52
[199] L’ubomı́r Pekar, Maria Guštafı́ková, and Zuzana Lobotková. “Accident analysis, related
to the train movement in a track section in ŽSR conditions”. In: 10th International Con-
ference 2014 ELEKTRO. 2014, pp. 479–484.
[200] Chunlu Peng, Jian Lu, and Weihao Yin. “An Empirical Study of the Urban Traffic Ac-
cident Causes with Correspondence Analysis Method”. In: ICCTP 2010. 2010, pp. 1299–
1306. doi: 10.1061/41127(382)140. url: http://ascelibrary.org/doi/abs/10.1061
/41127%28382%29140.
[201] Charles Perrow. Normal accidents: Living with high risk technologies. Princeton University
Press, 1984.
[202] Lloyd L. Philipson, Parvis Rashti, and Gerald A. Fleischer. “Statistical analyses of high-
way commercial vehicle accidents”. In: Accident Analysis & Prevention 13.4 (1981), pp. 289–
306.
[203] Katherine L. Plant and Neville A. Stanton. “A Qualitative Exploration of Critical Inci-
dents: Expanding Neisser’s Perceptual Cycle Model”. In: Advances in Human Aspects of
Transportation: Part I. Vol. 7. AHFE Conference, 2014, p. 15.
[204] Gesa Praetorius, Monica Lundh, and Margareta Lützhöft. “Learning from the past for
proactivity: A re-analysis of the accident of the MV Herald of free enterprise”. In: Proceed-
ings of the fourth Resilience Engineering Symposium, June 8-10, 2011, Sophia Antipolis.
2011, pp. 217–225.
[205] Jens Rasmussen. “Risk management in a dynamic society: a modelling problem”. In:
Safety science 27.2 (1997), pp. 183–213.
[206] M. H. Ray, J. D. Michie, and Martin W. Hargrave. “Occupant Risk in Longitudinal
Barrier Collisions”. In: E↵ectiveness of Highway Safety Improvements. 1986.
[207] Gemma J. M. Read, Paul M. Salmon, and Michael G. Lenné. “Sounding the warning
bells: the need for a systems approach to understanding behaviour at rail level crossings.”
In: Appl Ergon 44.5 (Sept. 2013), pp. 764–74. issn: 1872-9126. doi: 10.1016/j.apergo
.2013.01.007.
[208] J. Reason, E. Hollnagel, and J. Paries. “Revisiting the ⌧Swiss cheese model of accidents”.
In: Journal of Clinical Engineering 27 (2006), pp. 110–115.
[209] Sabi Redwood et al. “Does the implementation of an electronic prescribing system create
unintended medication errors? A study of the sociotechnical context through the analysis
of reported medication incidents.” In: BMC Med Inform Decis Mak 11 (2011), p. 29. issn:
1472-6947. doi: 10.1186/1472-6947-11-29.
[210] Bernhard Reer et al. A comparative evaluation of emerging methods for errors of com-
mission based on applications to the Davis-Besse (1985) event. Villigen: Paul Scherrer
Institut, Dec. 1999.
[211] Slim Rekhis and Noureddine Boudriga. “Formal Digital Investigation of Anti-forensic
Attacks”. In: 2010 Fifth International Workshop on Systematic Approaches to Digital
Forensic Engineering. 2010.
[212] M. F. Robbe, E. Treille, and M. Lepareux. “Estimation of the mechanical e↵ects of a core
disruptive accident in a LMFBR”. In: Proceedings of the Ninth International Conference
on Nuclear Engineering, Nice, France, paper. Vol. 9699. 2001.
[213] C. E. Patiño Rodriguez and G. F. M. Souza. “Decision-Making Model for O↵shore O✏oad-
ing Operations Based on Probabilistic Risk Assessment”. In: Vulnerability, Uncertainty,
and Risk. 2011, pp. 385–393. doi: 10.1061/41170(400)47. url: http://ascelibrary.o
rg/doi/abs/10.1061/41170%28400%2947.
[214] James J. Rooney and Lee N. Vanden Heuvel. “Root cause analysis for beginners”. In:
Quality progress 37.7 (2004), pp. 45–56.
[215] Bob Rummer. “Models for Analyzing Logging Safety”. In: Journal of Forest Engineering
7.1 (1995), pp. 63–71. doi: 10.1080/08435243.1995.10702679. url: http://dx.doi.o
rg/10.1080/08435243.1995.10702679.
[216] Center for Chemical Process Safety. “Data Collection and Incident Analysis Methods”.
In: Guidelines for Preventing Human Error in Process Safety. John Wiley & Sons, Inc.,
2010, pp. 247–290. isbn: 9780470925096. doi: 10.1002/9780470925096.ch6. url: http
://dx.doi.org/10.1002/9780470925096.ch6.
[217] Fridulv Sagberg. A methodological study of the Driving Reliability and Error Analysis
Method (DREAM). Oslo: Transportøkonomisk institutt, 2008. isbn: 9788248007951.

53
[218] Simo Salminen. “Safety Analysis: Principles and Practice in Occupational Safety”. In:
Scandinavian Journal of Work, Environment & Health 28.6 (2002), pp. 443–443.
[219] Paul M. Salmon, Miranda Cornelissen, and Margaret J. Trotter. “Systems-based accident
analysis methods: A comparison of Accimap, HFACS, and STAMP”. In: Safety Science
50.4 (Apr. 2012), pp. 1158–1170. issn: 0925-7535. doi: 10.1016/j.ssci.2011.11.009.
[220] Paul M. Salmon et al. “A systems approach to examining disaster response: Using Accimap
to describe the factors influencing bushfire response”. In: Safety Science 70 (Dec. 2014),
pp. 114–122. issn: 0925-7535. doi: 10.1016/j.ssci.2014.05.003.
[221] Paul M. Salmon et al. Human factors methods and accident analysis: Practical guidance
and case study applications. Ashgate Publishing, Ltd., 2011.
[222] Paul M. Salmon et al. “Injury causation in the great outdoors: A systems analysis of led
outdoor activity injury incidents.” In: Accid Anal Prev 63 (Feb. 2014), pp. 111–20. issn:
1879-2057. doi: 10.1016/j.aap.2013.10.019.
[223] P. Salmon et al. “Systems-based accident analysis in the led outdoor activity domain:
application and evaluation of a risk management framework.” In: Ergonomics 53.8 (Aug.
2010), pp. 927–39. issn: 1366-5847. doi: 10.1080/00140139.2010.489966.
[224] P. Salmon et al. “Understanding accident causation in led outdoor activities: development
of an accident analysis framework”. In: Injury Prevention 18.Supplement 1 (Oct. 2012),
A240–A240. issn: 1353-8047. doi: 10.1136/injuryprev-2012-040590w.53.
[225] Jan Sanders. “Automation of Common Cause Analysis: monitoring improvement measure
perfomance and predicting accidents”. In: (2013).
[226] J. Sandin and M. Ljung. “Crash investigations for active safety : meeting new demands
on investigation methodology”. In: 1st International Conference on ESAR ”Expert Sym-
posium on Accident Research” : reports on the ESAR-Conference on 3rd/4th September
2004 at Hannover Medical School (2005), pp. 216–224. issn: 3865092632.
[227] Jesper Sandin. “Aggregating case studies of vehicle crashes by means of causation charts:
an evaluation and revision of the driving reliability and error analysis method”. PhD
thesis. Chalmers University of Technology, 2008.
[228] F. Sanna. “THE STATISTICAL STUDY OF ROAD ACCIDENTS. DAY 1. A BIBLI-
OGRAPHIC REVIEW OF THE MAIN CONTRIBUTIONS TO THE STATISTICAL
STUDY OF THE ROAD ACCIDENT PHENOMENON”. In: AUTOSTRADE 22.4 (1980).
[229] J. H. Scott, Michael G. Stevenson, and R. W. Moore. 1000-MWe LMFBR accident analy-
sis and safety system design study : topical report - accident analysis methods. Lynchburg,
VA: Babcock & Wilcox, Nov. 1970.
[230] Scott A. Shappel and Douglas A. Wiegmann. The human factors analysis and classifica-
tion system–HFACS. Tech. rep. US Federal Aviation Administration, Office of Aviation
Medicine, 2000.
[231] Scott A. Shappell and Douglas A. Wiegmann. “A Human Error Approach to Accident
Investigation: The Taxonomy of Unsafe Operations”. In: The International Journal of
Aviation Psychology 7.4 (1997), pp. 269–291. issn: 1050-8414.
[232] Scott A. Shappell and Douglas A. Wiegmann. “Applying reason: The human factors
analysis and classification system (HFACS).” In: Human Factors and Aerospace Safety
1.1 (2001), pp. 59–86. issn: 1468-9456(Print).
[233] L. I. Hu-sheng. “Safety design and accident analysis method of safety control systems
based on cybernetics [J]”. In: Journal of Safety Science and Technology 3 (2008), p. 005.
[234] S. Sklet. “Methods for accident investigation (ROSS (NTNU) 200208)”. In: Trondheim,
Norway: NTNU (2002).
[235] Snorre Sklet. “Comparison of some selected methods for accident investigation.” In: J
Hazard Mater 111.1-3 (July 2004), pp. 29–37. issn: 0304-3894. doi: 10.1016/j.jhazmat
.2004.02.005.
[236] K. M. A. Solaiman, Md Mamunur Rahman, and Nashid Shahriar. “Collection, analysis &
visualization of road accident data in Bangladesh”. In: Informatics, Electronics & Vision
(ICIEV), 2013 International Conference on. IEEE. 2013, pp. 1–6.
[237] D. S. Song, J. Y. Lee, and D. J. Yoon. “Alternative method of feedwater system malfunc-
tion safety analysis”. In: (Oct. 1999). url: http://inis.iaea.org/Search/search.asp
x?orig_q=RN:33032484.
[238] Melissa B. Spencer. “Engineering Financial Safety: A System-Theoretic Case Study from
the Financial Crisis”. PhD thesis. 2012.

54
[239] Neville A; Ra↵erty Stanton, Laura A, and Alison Blane. “Human factors analysis of
accidents in system of systems”. In: Journal of Battlefield Technology 15.2 (July 2012),
pp. 23–30.
[240] Neville Stanton, Paul M. Salmon, and Laura A. Ra↵erty. Human factors methods: a
practical guide for engineering and design. Ashgate Publishing, Ltd., 2013.
[241] Evica Stojiljkovic, Miroljub Grozdanovic, and Srdjan Glisovic. “Methodological frame-
work for assessment of overall hazard of an accident - a Serbian experience”. In: J Sci
Ind Res Journal of Scientific and Industrial Research 70.3 (2011), pp. 204–209. issn:
0022-4456.
[242] John Stoop and Sidney Dekker. “Accident modelling: from symptom to system”. In:
Human factors: a system view of human, technology and organisation. annual conference
of the europe chapter of the human factors and ergonomics society 2009. 2010.
[243] Margaret Virgina Stringfellow. “Accident analysis and hazard analysis for human and
organizational factors”. PhD thesis. Massachusetts Institute of Technology, 2011.
[244] Mattias Strömgren et al. “A process-oriented evaluation of nine accident investigation
methods”. In: Safety Science Monitor (2013).
[245] Seija Suksi. “Methods and practices used in incident analysis in the Finnish nuclear power
industry”. In: Journal of Hazardous Materials 111.May 2003 (2004), pp. 73–79. issn:
03043894. doi: 10.1016/j.jhazmat.2004.02.007.
[246] Inge Svedung and Jens Rasmussen. “Graphic representation of accident scenarios: map-
ping system structure and the causation of accidents”. In: Safety Science 40.5 (2002),
pp. 397–417.
[247] O. Svenson. “Accident and Incident Analysis Based on the Accident Evolution and Barrier
Function ( AEB) Model”. In: CTW Cognition, Technology & Work 3.1 (2001), pp. 42–52.
issn: 1435-5558.
[248] Ola Svenson. Accident Analysis and Barrier Function (AEB) Method. Tech. rep. Swedish
Nuclear Power Inspectorate (SKI), Netherlands Institute for Advanced Study in the Hu-
manities, and Social Sciences, 2000.
[249] Ola Svenson. “The accident evolution and barrier function (AEB) model applied to inci-
dent analysis in the processing industries”. In: Risk Analysis 11.3 (1991), pp. 499–507.
[250] Ola Svenson, Anna Lekberg, and Anders E. L. Johansson. “On perspective, expertise and
di↵erences in accident analyses: arguments for a multidisciplinary integrated approach”.
In: Ergonomics 42.September 2013 (1999), pp. 1561–1571. issn: 0014-0139. doi: 10.108
0/001401399184893.
[251] Youhua Tang and Zizheng Guo. “Driver Safety Evaluation Model Based on Discriminatory
Analysis”. In: Logistics. 2008, pp. 2021–2027. doi: 10.1061/40996(330)297. url: http:
//ascelibrary.org/doi/abs/10.1061/40996%28330%29297.
[252] John P. Thomas IV. “Extending and automating a systems-theoretic hazard analysis for
requirements generation and analysis”. PhD thesis. Massachusetts Institute of Technology,
2013.
[253] Tripod Beta User Guide. Stichting Tripod Foundation, 2006.
[254] Margaret J. Trotter, Paul M. Salmon, and Michael G. Lenné. “Impromaps: Applying
Rasmussen’s Risk Management Framework to improvisation incidents”. In: Safety Science
64 (Apr. 2014), pp. 60–70. issn: 0925-7535. doi: 10.1016/j.ssci.2013.11.021.
[255] Ryo Ujiie et al. “Application of hierarchical accident model in independent verification and
validation”. In: IEEE Aerosp Conf Proc IEEE Aerospace Conference Proceedings (2010).
issn: 9781424438884.
[256] Peter Underwood. “Examining the systemic accident analysis research-practice gap”. PhD
thesis. 2013.
[257] Peter Underwood and Patrick Waterson. “Accident analysis models and methods: guid-
ance for safety professionals”. In: (2013).
[258] Peter Underwood and Patrick Waterson. “Systemic accident analysis: examining the gap
between research and practice.” In: Accid Anal Prev 55 (June 2013), pp. 154–64. issn:
1879-2057. doi: 10.1016/j.aap.2013.02.041.
[259] Peter Underwood and Patrick Waterson. “Systems thinking, the Swiss Cheese Model and
accident analysis: a comparative systemic analysis of the Grayrigg train derailment using
the ATSB, AcciMap and STAMP models.” In: Accid Anal Prev 68 (July 2014), pp. 75–94.
issn: 1879-2057. doi: 10.1016/j.aap.2013.07.027.

55
[260] Conducting Accident Investigations - Revision 2. U.S. Department of Energy, 2000.
[261] T. W. Van der Schaaf. “PRISMA: A risk management tool based on incident analysis”.
In: (1996).
[262] C. Van Velzen, A. H. Brunsveld-Reinders, and M. S. Arbous. “Incidents related to in-
trahospital transport of patients in the ICU”. In: Critical Care 15.1, P535 (2011). doi:
10.1186/cc9955. url: http://dx.doi.org/10.1186/cc9955.
[263] W. Van Vuuren, C. E. Shea, and Tjerk W. van der Schaaf. The development of an incident
analysis tool for the medical field. Tech. rep. 1997.
[264] Gabriel Dragos, Vasilescu, A. Drăghici, and Constantin Baciu. “Methods for analisys and
evaluation of occupational accidents and diseases risks”. In: Environmental Engineering
and Management Journal 7.4 (2008), pp. 443–446.
[265] K. N. R. Verhoeve et al. 2004. doi: 10.2118/88488-MS.
[266] David Vernez, Didier Buchs, and Guillaume Pierrehumbert. “Perspectives in the use of
coloured Petri nets for risk analysis and accident modelling”. In: Safety science 41.5
(2003), pp. 445–463.
[267] William E. Vesely et al. Fault tree handbook. Tech. rep. DTIC Document, 1981.
[268] Y. Wada. “Industrial safety and application of a chemical accident database - Relational
Information System for Chemical Accidents Database (RISCAD) and accident analysis
method PFA”. In: Synthesiology 6.4 (2013), pp. 219–227. url: https://www.scopus.co
m/inward/record.uri?eid=2-s2.0-84893304390&partnerID=40&md5=d31bbb83fa6c7
6c3de4e09c7451c070b.
[269] Willem A. Wagenaar and Juliette van der Schrier. “Accident Analysis: The goal, and how
to get there”. In: Safety Science 26.1 (1997), pp. 25–33.
[270] Ling Wang, Hua-pu Lu, and Yi Zheng. “Macro Prediction of Traffic Accident in Beijing
Based on Model GM (1, N)”. In: ICCTP 2011. 2011. Chap. 189, pp. 1914–1924. doi:
10.1061/41186(421)190. url: http://ascelibrary.org/doi/abs/10.1061/41186%28
421%29190.
[271] P. E. Waterson and D. P. Jenkins. “Methodological considerations in using AcciMaps and
the Risk Management Framework to analyse large-scale systemic failures”. In: System
Safety 2010, 5th IET International Conference on 15.11 (2002), p. 1111. issn: 1234-9876.
[272] Douglas A. Wiegmann and Scott A. Shappell. A Human Error Analysis of Commer-
ical Aviation Accidents Using the Human Factors Analysis and Classification System
(HFACS). Tech. rep. DTIC Document, 2001.
[273] H.C.A. Wienen et al. Accident Analysis Methods and Models — a Systematic Literature
Review. CTIT report. University of Twente, 2017.
[274] Bernhard Wilpert. SOL–Safety through Organizational Learning. Tech. rep.
[275] John A. Wise and Anthony Debons, eds. Information Systems: Failure Analysis. Vol. 32.
NATO ASI Series. Springer Berlin Heidelberg, 1987, pp. 15–19. isbn: 978-3-642-83093-8.
doi: 10.1007/978-3-642-83091-4_2. url: http://dx.doi.org/10.1007/978-3-642-
83091-4_2.
[276] Jie Wu and Tingdi Zhao. “C-HFAMF: A new way to accident analysis considering human
factor”. In: (2011), pp. 319–322.
[277] Christian Wullems, Geo↵ Dell, and Yvonne Toft. “Improving the railway’s understand-
ing of accident causation through an integrated approach to human factors analysis and
technical safety data recording”. In: Advances in Human Aspects of Transportation: Part
I 7.1 (2014).
[278] Y. Xiao and C. F. Mackenzie. “Micro-Theory Methodology in Critical Incident Analysis”.
In: IEEE International conference on systems man and cybernetics. Vol. 3. 1998, pp. 2545–
2550.
[279] Toshihiro Yamamoto and Yoshinori Miyoshi. “E↵ect of Mixing State on Criticality Safety
Evaluation in MOX Powder and Additive”. In: JAERI - Conf 2005-007. 2005.
[280] Yong-Xin Ye and Yu-Ren Chen. “Traffic Accident Mechanism Analysis Based on Bayesian
Network a Case Study on Jiaxing Segment of Shanghai-Hangzhou Freeway”. In: ICCTP
2011. 2011. Chap. 252, pp. 2523–2533. doi: 10.1061/41186(421)253. url: http://asc
elibrary.org/doi/abs/10.1061/41186%28421%29253.
[281] G. L. Yoder Jr. “US Best Estimate Transient Analysis Licensing”. In: (2002).

56
[282] ZHANG Yong-ping. “Discussion on how to conduct a good drilling about the preliminary
plan for emergency rescue of dangerous chemical accident”. In: Journal of Safety Science
and Technology 4 (2011), p. 045.
[283] Kenji Yoshimura et al. Questionnaire Survey for Adapting Common Performance Condi-
tions to Marine Accidents. 2013.
[284] M. Y. Young and D. S. Love. Tech. rep. 1992.
[285] Dake Zhang and Kang Jiang. “Application of Data Mining Techniques in the Analysis
of Fire Incidents”. In: Procedia Engineering 43 (2012), pp. 250–256. issn: 18777058. doi:
10.1016/j.proeng.2012.08.043. url: http://linkinghub.elsevier.com/retrieve
/pii/S1877705812030548.
[286] Guohui Zhang, Jianyang Zheng, and Yinhai Wang. “Numerical Examinations of Traffic
Accident Characteristics Using Analytical Statistical Methods”. In: CICTP 2012. 2012.
Chap. 358, pp. 3546–3557. doi: 10.1061/9780784412442.358. url: http://ascelibra
ry.org/doi/abs/10.1061/9780784412442.358.
[287] Hao Zhang et al. “Efficient Safety Information Retrieval on Construction Sites: A Prelimi-
nary Methodology”. In: ICSDEC 2012. 2012. Chap. 81, pp. 679–686. doi: 10.1061/97807
84412688.081. url: http://ascelibrary.org/doi/abs/10.1061/9780784412688.081.
[288] Sheng-rui Zhang, Zhen Fang, and Bin Wang. “Cause Analysis of Traffic Accidents on Road
Black Spots Based on Dominance Rough Set Theory”. In: ICTIS 2011. 2011, pp. 687–692.
doi: 10.1061/41177(415)87. url: http://ascelibrary.org/doi/abs/10.1061/41177
%28415%2987.
[289] Jin Zhou et al. “A method for modeling and analysis of directed weighted accident causa-
tion network (DWACN)”. In: Physica A: Statistical Mechanics and its Applications 437
(Nov. 2015), pp. 263–277. issn: 0378-4371. doi: 10.1016/j.physa.2015.05.112.
[290] Dmitri Zotov. Multi Linear Events Sequencing. Tech. rep.

57