Erik Hollnagel - FRAM: The Functional Resonance Analysis Method

FRAM: THE FUNCTIONAL RESONANCE ANALYSIS METHOD

FRAM: The Functional Resonance Analysis Method

Modelling Complex Socio-technical Systems

ERIK HOLLNAGEL

University of Southern Denmark, Denmark

ASHGATE

Erik Hollnagel 2012

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise without the prior permission of the publisher.

Erik Hollnagel has asserted his right under the Copyright, Designs and Patents Act, 1988, to be identified as the author of this work.

Published by

Ashgate Publishing Limited

Wey Court East

Union Road

Farnham

Surrey, GU9 7PT

England

Ashgate Publishing Company

Suite 420

101 Cherry Street

Burlington

VT 05401-4405

USA

www.ashgate.com

British Library Cataloguing in Publication Data

Hollnagel, Erik, 1941

FRAM - the Functional Resonance Analysis Method : modelling complex socio-technical systems.

1. Risk assessment. 2. Errors--Evaluation. 3. Performance technology. 4. Accidents--Prevention.

I. Title
363.1063-dc23

ISBN: 978-1-4094-4551-7 (pbk)

ISBN: 978-1-4094-4552-4 (hbk)
ISBN: 978-1-4094-4553-1 (ebk)

ISBN: 978-1-4094-8703-6 (ebk-ePUB)

Library of Congress Cataloging-in-Publication Data

Hollnagel, Erik, 1941

FRAM, the functional resonance analysis method : modelling complex socio-technical systems / by Erik Hollnagel.

p. cm.

Includes bibliographical references and index.
ISBN 978-1-4094-4552-4 (hardback) -- ISBN 978-1-4094-4551-7 (pbk.) -- ISBN 978-1-4094-4553-1 (ebook) 1. System analysis.

2. Frequencies of oscillating systems. 3. Social systems--Mathematical models. I. Title. II. Title: functional resonance analysis method.

T57.6.H647 2012
003.5--dc23

2011048771

Printed bound in great Britain by the MPG Books Group, UK

The Functional Resonance Analysis Method in the following referred to as the FRAM does in a way itself represent what it tries to describe, namely that sometimes things happen without clearly recognised causes. In contrast to many other safety assessment methods, such as the Fault Tree developed in 1962 to ensure the safety of the Minuteman Intercontinental Ballistic Missile or the bulk of the first-generation Human Reliability Assessment (HRA) methods developed in response to the accident at Three Mile Island in 1979, the FRAM seems to have emerged from a diffuse background or from a confused mind.

The first coherent presentation of the basic principles of the FRAM was in E. Hollnagel (2004), Barriers and Accident Prevention (Farnham: Ashgate). The idea had, however, been around for several years, and been part of various courses given at the University of Linkping. In hindsight there were four main sources of inspiration, namely Floyd Allports 1954 paper about event-structures, Margoroh Maruyamas 1963 paper about the Second Cybernetics, several descriptions of the Structured Analysis and Design Technique, and a notion that stochastic resonance might be a good idea, based on an article in New Scientist from 1996. To that must be added the ever-present and growing dissatisfaction with the way safety issues were addressed, especially how accidents and incidents were explained. This dissatisfaction, shared with many colleagues, itself became the motivation for the development of Resilience Engineering. But that is a different story.

The idea of the FRAM was well received from the very beginning, and the development of the method from the 2004 book until today would not have happened without the interest, questions and contributions of a great many people. Although it is impossible to produce a complete list, I will nevertheless take this opportunity to thank (in alphabetical order) Karen Cardiff, Pedro Ferreira, Ivonne Herrera, Akinori Komatsubara, Jrg Leonhardt, Luigi Macchi, Elaine Pelletier, Shawn Pruchnicki, Rob Robson, Gunilla Sundstrm, Sebastien Travadel, Camilla Tveiten, Rogier Woltjer and last but not least Denis Besnard and the whole FRAMily. With many apologies to those that have not been named.

Erik Hollnagel

Virtually all design is conducted in a state of relative ignorance of the full behaviour of the system being designed.

(Henry Petroski)

When a system is designed there is from the very beginning a need to know how it will function. Indeed, the very reason for system design is to construct an artefact that provides an intended functionality. In Henry Petroskis book about Design Paradigms, from which the above epigraph is taken, the topic was engineering design, and the majority of examples were physical structures and static systems, such as bridges. The behaviour of a bridge is seemingly simple: it just has to be there and to maintain its own structure in order to allow safe passage for whoever or whatever uses it. Yet even in this case there is a relative ignorance of what may possibly happen, as numerous examples of collapsing structures have demonstrated.

While design may not require perfect knowledge it at least requires acceptable ignorance. Partial ignorance is unavoidable in principle as well as in practice, but it should be so little that the consequences are unnoticeable. In other words, we must be reasonably sure that the systems we build will do what they are supposed to do, that they will function reliably as intended and that they additionally will not do anything they are not supposed to do. The latter, in the case of a bridge, means collapsing or falling down. Yet history is full of examples of just that happening from the Dee bridge disaster (1847) to the spectacular collapse of the Tacoma Narrows in 1940 and more recently to the failure of the I-35W Mississippi River bridge (2007).

There are several reasons for this relative ignorance. One is that the properties of the materials may not be known well enough, neither how they will behave under extreme conditions (pressure, temperature, wind and so on) nor how they will behave over time (ageing, degradation). Another is that it is uncertain what external conditions the system will be subjected to. In the case of bridges, the conditions refer to weather, changes in the chemical composition of the air, quality of maintenance, changes in customer characteristics (for example, heavier cars and more traffic) and so on. A third reason is that work usually is done under conditions of insufficient time, information and resources. The only thing we can know for certain is that things will happen that we have never thought of, although that in itself is of limited comfort.

If the situation is difficult for structures and static systems, it is even worse for dynamic systems. (Note, by the way, that so far we only have referred to nominally technical systems, for example, a bridge as a bridge. Even here, the influence of social systems is obvious, for instance in how well the technical system is maintained, how well the components meet the specifications or requirements, how well the system is designed and built and so on.) For dynamic systems it is necessary to consider also the state of the parts and components as well as the dependencies among them. Energy and information must be provided, mass and materials must be moved around, substances will be transformed and so on. This creates literally countless dependencies of which there is relative ignorance, but which nevertheless must work as planned in order for the system to fulfil its purpose. But as it is well-nigh impossible to foresee all possible combinations, even for purely technological systems, surprises abound.