2 performed correctly (as specified in their requirements, i.e., neither failed), but the accident occurred because the system designers did not account for all interactions between the leg deployment and the descent-engine control software.This type of component interaction accident is becoming more common as the complexity of our system designs increases. In the past, our designs were more intellectually manageable and the potential interactions among components could be thoroughly planned, understood, anticipated, and guarded against. In addition, thorough testing was possible and could be used to eliminate system design errors before system use. Modern, high-tech systems no longer satisfy these properties and system design errors are increasingly the cause of major accidents, even when all the components have operated reliably, i.e., have not failed. As Perrow has noted [Perrow, 1999], such systems will also be harder for operators to manage in a crisis situation.The same applies to organizational decision making as illustrated by Rasmussen's analysis of the Zeebrugge ferry mishap [Rasmussen, 1997] shown in Figure 1. Some information about the accident [Sheen, 1987] is necessary to understand the figure. On the day the ferry capsized, the Herald of Free Enterprise was working the route between Dover and the Belgium port of Bruges-Zeebrugge. This was not her normal route and the linkspan at Zeebrugge had not been designed specifically for the Spirit class of vessels. The linkspan used spanned a single deck and so could not be used to load decks E and G simultaneously. The ramp could also not be raised high enough to meet the level of deck E due to the high spring tides being encountered at that time. This limitation was commonly known and was overcome by filling the forward ballast tanks to lower the ferry's bow in the water. The Herald was due to be modified during its refit in 1987 to overcome this problem.Before dropping moorings, it was normal practice for a member of the crew, the Assistant Bosun, to close the doors. The First Officer also remained on deck to ensure they were closed before returning to the wheel house. To keep on schedule, the First Officer returned to the wheel house before the ship dropped its moorings (which was common practice), leaving the closing of the doors to the Assistant Bosun, who had taken a short break after cleaning the car deck upon arrival at Zeebrugge. He had returned to his cabin and was still asleep when the ship left the dock. The captain could only assume that the doors had been closed because he could not see them from the wheel house due to their construction, and there were no indicator lights in the wheelhouse to show door position. There was confusion as to why no one else closed the doors. A few years earlier, one of the Herald's sister ships sailed from Dover to Zeebrugge with the bow doors open, but she made it to the destination without incident. It was therefore believed that leaving the bow doors open should not alone have caused the ship to capsize.Anoth...