From Models to Methods: A Two-Axis Taxonomy of Safety Science Models, Frameworks and Tools (Working Paper Summary)

Prof. Dr. Mehmet Nurullah Kurutkan, Düzce University, Faculty of Business, Department of Health Management, Düzce, Türkiye. ORCID: 0000-0002-3740-4231

Status: working paper, not yet peer reviewed. This page is an English summary of the Turkish manuscript (version 5, November 2026). The full coded inventory is published in the Safety Science Entity Atlas (Türkçe).

Highlights

181 analysis units (146 single entities and 35 lineages); 133 of them are observed in 1,809 screened records.
Two axes separate what an entity is about from what kind of knowledge object it is.
Field and primary function are associated (Cramér’s V = 0.35).
Coder kappa is 0.67 to 0.89 on four dimensions; temporal orientation and usage role are weaker.
Four recurring co-mention communities; behavioural and healthcare units stay on the periphery.

Abstract

Safety science names its knowledge objects inconsistently. Paradigms, theories, models, methods, taxonomies, measurement instruments and standards are usually listed under the same heading of “models”, which hides what each one can and cannot do. This study treats the problem as one of knowledge organisation. It develops a two-axis taxonomy that codes every entity by the field it addresses and by the kind of knowledge object it is, together with its level of analysis, temporal orientation and primary function.

Entities were extracted from 1,809 relevance-screened Web of Science records (1,657 articles and 152 reviews, 1980 to 2026) whose titles name a safety concept together with a model, framework, theory or method. The scheme was refined over six documented critique rounds, the last of which included independent double coding of a stratified sample. The inventory holds 181 analysis units in twelve entity types: 146 single entities and 35 merged lineages, five of them identified by a supplementary search. Of these, 133 are observed in the main corpus, 8 only in the supplementary search, and 40 are known only from the canonical literature.

Two independent coders reproduced field, entity type, level of analysis and primary function with Cohen’s kappa between 0.67 and 0.89. Temporal orientation and secondary usage role were less reliable. Their rules were clarified, and a pre-specified retest on 30 new units improved agreement (Krippendorff’s alpha from 0.45 to 0.66 for orientation and from 0.13 to 0.39 for usage role) without fully meeting the criteria set in advance.

Three findings stand out. First, field and primary function are associated (Cramér’s V = 0.35, a large effect for a table of this size): accident causation units concentrate in explanation and analysis, organisational management units in management and measurement, human factors units in prediction and classification, and healthcare-specific units in classification, measurement and management. The pattern holds in the observed layer and when lineages are excluded. Second, the share of records naming the systemic strands rose steadily from the mid-2000s and levelled off around 2020 (segmented logistic regression, p = 0.009); there is no break in 2015. Third, the co-mention network forms four recurring communities whose within-community association is more than four times chance and robust to threshold changes, while behavioural and healthcare units remain on the periphery at every threshold. A supplementary search with tool, instrument and standard terms did not materially change these structural relations, but it added five entities and showed that instruments, protocols and standards are undercounted.

Keywords: safety science; accident causation models; taxonomy; human factors; patient safety; resilience engineering; systems thinking; bibliometric review

Why a two-axis taxonomy

A single review can place Heinrich’s domino sequence, Reason’s Swiss cheese, STAMP, FRAM, HFACS, SEIPS, the Job Demands-Resources model, the Hospital Survey on Patient Safety Culture and ISO 45001 side by side as “models”. A paradigm, an explanatory theory, a representational model, an analysis method, a classification scheme, a survey instrument and a management standard are not the same kind of thing. They do not answer the same question and cannot be judged by the same criteria.

Earlier inventories are valuable but partial. Those that classify most systematically (Hollnagel, 2004; Katsakiori et al., 2009; Underwood and Waterson, 2013; Hulme et al., 2019) limit themselves to accident models and investigation methods. Those that range more widely (Hale and Hovden, 1998; Swuste et al., 2014; Waterson et al., 2015) are historical or discursive and do not code entities on explicit dimensions. None distinguishes entity type as a coding dimension. The gap is therefore not a lack of classifications but the lack of one that is field-wide, dimensional, type-sensitive and corpus-based at the same time.

The taxonomy follows the two-question principle of Nickerson et al. (2013): one axis for what an entity is about, one axis for what kind of thing it is, and no attempt to collapse one into the other. It is nominal, not hierarchical. No type ranks above another, and an entity may carry a primary type and a documented secondary usage role.

Method in brief

Search. Web of Science Core Collection (SCI-EXPANDED, SSCI, ESCI), 21 September 2026. Thirteen safety anchor terms were combined with nine entity terms within ten words in the title (NEAR/10). English articles and reviews only.
Screening. 2,280 unique articles and 199 reviews were verified against the query and screened with a three-tier relevance rule. 1,657 articles and 152 reviews were kept. Tier decisions for records with generic anchor terms were assisted by a large language model classifier; the author’s blind check of 100 records gave 96% agreement (Cohen’s kappa = 0.92).
Extraction. A curated dictionary of 150 regular-expression patterns was followed by an open pass that collected parenthetical abbreviations and capitalised phrases; candidates occurring three or more times were inspected in context.
Taxonomy development. Six critique rounds, reported round by round with the ending conditions of Nickerson et al. (2013).
Supplementary search. The same anchors combined with tool, instrument, scale, questionnaire, protocol, standard, guideline and checklist terms: 671 screened records, with decision criteria fixed before export.
Analysis. Descriptive cross-tabulations with effect sizes and permutation tests, segmented logistic regression for diffusion, and a co-mention network with Louvain community detection and robustness checks.

The seven coding dimensions

Dimension	Question answered	Values
1. Field	What is it about?	A Accident causation and systemic safety theories; B Safety perspectives; C Human factors and human error; D Sociotechnical systems approaches; E Organisational safety management, culture and risk; F Individual behaviour and psychosocial models; G Healthcare-specific frameworks and tools
2. Conceptual family	In which tradition of thought?	Nineteen sub-fields (A1 to G3)
3. Primary type	What kind of thing is it?	Twelve nominal types (table below)
4. Secondary role	What other documented use does it have?	Any of the twelve types or none; coded only when the entity is explicitly used under that type’s name
5. Level of analysis	Whose behaviour or which unit?	Individual; Team; Organisation; System; Multi-level; Event or process
6. Temporal orientation	When is it applied relative to the adverse event?	Retrospective; Prospective; Real-time; Mixed; Non-directional
7. Primary function	What was it designed for?	Explanation; Classification; Analysis; Measurement; Prediction; Intervention; Management

The twelve entity types and their decision questions

Type	Decision question	Examples	Units
Paradigm	How should safety be looked at?	Safety-II, resilience engineering, Vision Zero, inherent safety	8
Theory	Why or how does it happen?	Normal Accident Theory, high reliability organisation theory	25
Construct	What abstract attribute do we want to measure?	Safety climate, psychological safety	2
Model	How do we represent reality?	Swiss cheese model, SEIPS, Job Demands-Resources model	45
Framework	Which dimensions should be considered?	Vincent framework, hierarchy of controls, CFIR, ALARP	26
Taxonomy	Which class does it fall into?	HFACS, WHO ICPS, Eindhoven classification	9
Method	How do we carry out the analysis or improvement?	FRAM, STPA, HAZOP, FMEA, PDSA	34
Computational modelling approach	How do we represent it algorithmically or by simulation?	Bayesian networks, system dynamics, agent-based models	7
Measurement instrument	How much, at what level?	HSOPSC, Safety Attitudes Questionnaire, MaPSaF	7
Protocol or programme	Which steps are followed in practice?	SBAR, I-PASS, crew resource management, WHO Surgical Safety Checklist	7
Decision or analysis tool	Which judgement does it support?	Risk matrix, Ishikawa diagram, 5 Whys, Global Trigger Tool	7
Standard	Which requirement must be met?	ISO 45001, OSHA Process Safety Management	4

Three coding rules matter most. Types are nominal categories with no ordinal meaning. An entity is assigned to the field where it was developed or essentially belongs, not to every field where it is applied, which is why SEIPS is coded to sociotechnical systems although almost all its applications are in healthcare. A method is not the same entity as its output: FRAM is coded as a method, and “the FRAM model of process X” is an instance of its use.

Main findings

The inventory

The 181 units are distributed across the seven fields as follows: organisational safety management, culture and risk 44 (24.3%); accident causation and systemic safety theories 38 (21.0%); human factors and human error 26 (14.4%); individual behaviour and psychosocial models 23 (12.7%); healthcare-specific frameworks and tools 23 (12.7%); sociotechnical systems approaches 16 (8.8%); safety perspectives 11 (6.1%). Models are the largest type (45), followed by methods (34), frameworks (26) and theories (25).

Corpus prominence

Prominence is the number of screened records that name a unit in the title, abstract or keywords. It indicates salience within publications that name models, not frequency of use. It is highly concentrated: 46 units are named in ten or more records, while 48 are not observed in the main corpus at all. The most prominent units are HFACS and its variants (104 records), resilience engineering (63), Bayesian networks (58), sociotechnical systems theory (54), AcciMap (51), STAMP (47), SEIPS (45), FRAM (44), situation awareness (37) and the generic safety management system (35).

A division of labour between fields

Field and primary function are associated (Cramér’s V = 0.35, permutation p < 0.001). Healthcare-specific units are over-represented in classification, measurement, management and intervention and under-represented in explanation and analysis. Organisational management units are over-represented in management and measurement. Accident causation units are over-represented in explanation and analysis. Human factors units are over-represented in prediction and classification. The safety perspectives and behavioural fields are over-represented in explanation.

No healthcare-specific unit meets the operational definition of a theory. Healthcare is nevertheless the setting of 49% of the screened records and the largest setting in which theories, models and instruments born elsewhere are applied, so the absence concerns the origin of entities, not their use. A sensitivity check moved five units that were born in healthcare but coded elsewhere by subject (SEIPS, the London Protocol, the Yorkshire contributory factors framework, HSOPSC and the Manchester Patient Safety Framework) into the healthcare field. Cramér’s V changed from 0.35 to 0.36, the enlarged field still concentrated in classification, measurement and management, and it still contained no theory.

Diffusion over time

HFACS is an early and stable adopter, at around 6% of records since 2005. The systemic strands (STAMP, AcciMap, SEIPS, resilience engineering, FRAM) rise late and steeply. The share of records naming at least one systemic strand grew from about 5% in 2009 to 2011 to 17.5% in 2021 and then levelled off between 12% and 16% in 2022 to 2025.

Co-mention structure

Among the thirty most prominent units, Louvain community detection yields four communities, recovered in 82% of 50 runs (modularity Q = 0.30): quantification and risk management (HFACS, Bayesian networks, fault tree analysis, quantitative risk assessment, bow-tie, root cause analysis); systemic accident analysis (AcciMap, STAMP, STPA, EAST); sociotechnical work systems (sociotechnical systems theory, cognitive work analysis, macroergonomics, SEIPS); and resilience (FRAM, resilience engineering, Safety-II). The strongest ties are AcciMap with STAMP (25 records) and HFACS with Bayesian networks (19 records). The communities are stable and associated well above chance, but their modularity does not exceed that of random networks with the same degrees, so they are read as overlapping programmes and not as closed clusters.

Reliability of the coding

Two academics from other institutions, who took no part in developing the scheme, independently coded a stratified sample of 55 units (31% of the inventory at that time). Between the two coders, Cohen’s kappa was 0.89 for field, 0.83 for primary type, 0.88 for primary function and 0.76 for level of analysis. Temporal orientation reached only moderate agreement (kappa 0.39 to 0.61) and usage role stayed close to chance (kappa 0.07 to 0.33). After the rules were clarified, a pre-specified retest on 30 new units met its criterion for orientation in two of three coder pairs and did not meet it for usage role. Usage role should therefore be read as a descriptive note and not as a reliable coding dimension.

Sensitivity to search terms

The supplementary search left the field associations and the prominence ranking essentially unchanged (Spearman 0.95). It did change the counts of four types. Measurement instruments, protocols and programmes, decision tools and standards took four to eight times the share of mentions they have in the main corpus. Their counts, and the weight of the organisational management and healthcare fields where they concentrate, are lower bounds.

Limitations

The corpus is defined by a title-level proximity search. It favours precision over sensitivity, so entities that are applied without being named in titles (for example the health belief model or the Job Demands-Resources model) appear with near-zero prominence.
Screening of generically anchored records was assisted by a language model classifier; a residual misclassification rate of a few per cent cannot be excluded.
Frequencies come from pattern matching in titles, abstracts and keywords, not from reading every record.
Reliability rests on a sample. The reported agreement values precede reconciliation, which was carried out by the author, whose codes were the reference being tested. The four main dimensions were not retested after 121 codes were changed in reconciliation and the consistency pass. The coders’ raw coding forms and the reconciliation logs are not included in the current supplement, so readers cannot yet recompute the reliability results.
The corpus is limited to English records in three Web of Science indexes.
Co-mention within a record is a coarse measure of intellectual relation. A citation-based test of the communities has not yet been completed.

A research agenda: six propositions

The design is a census of a title-restricted corpus and not a test, so the following are propositions, not findings. Each states a mechanism, an observable consequence and the condition under which it would be rejected.

Type-appropriate evaluation. Criteria that match an entity’s type measure the properties it was designed to have. In the comparative literature on AcciMap, STAMP, FRAM and HFACS, studies whose criteria match the coded type will agree with one another on the ranking of the entities more than studies that apply another type’s criteria. Rejected if agreement does not differ between the two groups.
Brokers diffuse faster. An entity tied to more than one programme can be adopted for more than one question. A higher participation coefficient in one period will predict a larger rise in share in the next, after controlling for initial share. Rejected if the coefficient is zero or negative.
The plateau is setting-specific. Growth levels off when an entity has saturated the settings where its question is asked. The post-2020 flattening of the systemic strands will be stronger in healthcare and transport than in the process and energy industries. Rejected if the change of slope is the same in all settings.
Quantification follows classification. A classification supplies the discrete states a probabilistic model requires. Computational modelling approaches will be co-mentioned with taxonomies at a higher rate than with models or theories of equal frequency. Rejected if the rates do not differ.
The periphery persists in citation. Behavioural and healthcare entities are published and read in separate journal communities. In the citation network of the same corpus, records naming them will fall outside the core communities. Rejected if the citation network integrates them into the core.
Curriculum lag. Curricula are revised more slowly than the literature changes. In published safety science curricula, coverage will be lowest for the most recently diffused entities and for prospective risk assessment methods. Rejected if coverage is independent of an entity’s diffusion period.

Data availability

The full seven-dimension coded inventory (181 units), the type definitions and the decision questions are published under CC BY 4.0 in the Safety Science Entity Atlas: https://doi.org/10.5281/zenodo.24207407 (all versions: https://doi.org/10.5281/zenodo.23138414). The search strategy, cleaned bibliographic corpora, screening logs, extraction pattern dictionary, coding rules and cross-tabulations are held in a supplementary workbook. The coders’ raw forms, the reconciliation logs and the record-level decisions of the supplementary search are not part of the current supplement.

Use of generative AI

Large language model assistants were used to implement the extraction pipeline, to apply the written screening rule to generically anchored records (verified by the author on a blind sample), to draft and critique successive versions of the coding scheme, to produce figures and to edit the text. They were also used to prepare this English summary. No unit of the reliability sample was coded by a language model. All search decisions, coding rules, contested type assignments and interpretations were reviewed and approved by the author, who takes full responsibility for the content.

Key references

Hale, A. R., & Hovden, J. (1998). Management and culture: The third age of safety. In A.-M. Feyer & A. Williamson (Eds.), Occupational injury: Risk, prevention and intervention. Taylor & Francis.
Hollnagel, E. (2004). Barriers and accident prevention. Ashgate.
Hulme, A., Stanton, N. A., Walker, G. H., Waterson, P., & Salmon, P. M. (2019). What do applications of systems thinking accident analysis methods tell us about accident causation? A systematic review of applications between 1990 and 2018. Safety Science, 117, 164-183. https://doi.org/10.1016/j.ssci.2019.04.016
Katsakiori, P., Sakellaropoulos, G., & Manatakis, E. (2009). Towards an evaluation of accident investigation methods in terms of their alignment with accident causation models. Safety Science, 47(7), 1007-1015. https://doi.org/10.1016/j.ssci.2008.11.002
Nickerson, R. C., Varshney, U., & Muntermann, J. (2013). A method for taxonomy development and its application in information systems. European Journal of Information Systems, 22(3), 336-359. https://doi.org/10.1057/ejis.2012.26
Swuste, P., van Gulijk, C., Zwaard, W., & Oostendorp, Y. (2014). Occupational safety theories, models and metaphors in the three decades since World War II, in the United States, Britain and the Netherlands: A literature review. Safety Science, 62, 16-27. https://doi.org/10.1016/j.ssci.2013.07.015
Underwood, P., & Waterson, P. (2013). Systemic accident analysis: Examining the gap between research and practice. Accident Analysis & Prevention, 55, 154-164. https://doi.org/10.1016/j.aap.2013.02.041
Waterson, P., Robertson, M. M., Cooke, N. J., Militello, L., Roth, E., & Stanton, N. A. (2015). Defining the methodological challenges and opportunities for an effective science of sociotechnical systems and safety. Ergonomics, 58(4), 565-599. https://doi.org/10.1080/00140139.2015.1015622

How to cite this summary: Kurutkan, M. N. (2026). From models to methods: A two-axis taxonomy of safety science models, frameworks and tools (Working paper summary). healthtopic.org. https://healthtopic.org/safety-science-taxonomy-working-paper-summary/