The FRAM Sandbox Facility

Extending the capabilities of the FMV

There is an increasing interest in utilising the FRAM approach for the analysis of what exactly is going on in complex sociotechnical systems in practical high hazard environments. There are, for example, a number of ongoing projects at the moment in aviation, self-driving vehicles and, of course, on the challenges of the COVID 19 pandemic for healthcare responses. But as well as these practical applications there is an increasing interest from the academic community, in extending and developing further, the underpinning concepts, as shown in the recent review (below)

These groups are thus interested in taking the modelling power of the FRAM approach to the next level. Their interests include exploring in more detail how interactions occur and how the effects of variability can be addressed and predicted more formally, as well as enabling dynamic visualisation of processes and the quantification of expected outcomes.

What makes this now more attractive, has been the development of a rigorous model checking methodology, the FRAM Model Interpreter, FMI (Hollnagel, E,) (www.safetysynthesis.com )

To support these developments the FRAM Model Visualiser has also been given extra facilities, which now include an option to use, what is essentially a laboratory sand box to provide research laboratory experimental facilities for different groups to utilise.

From time to time, it is planned to add additional features that are still under development and not officially released as part of the FMV Pro version, but may be made available to groups for the purposes of experimentation and feedback from the users.


Building on the FMI functionality, the metadata feature in the FMV, now provides the ability to calculate metadata values as Functions are activated during the FMI cycles.

The manual details these here

The calculations are expressed as user defined equations that can reference other metadata keys, standard variables, standard mathematical functions, logic conditions, and mathematical operators. One or two resulting metadata values can then be expressed as a coloured visualisation within each function. The colours and value ranges can be customised by the user.

When you Ctrl-Click a Function, or select and press Ctrl-M, the metadata section will appear above the model in the visualiser window and display the extended features.

Key/Value pairs

The first two text boxes are for entering metadata as a list of key/value pairs, as is already available in the standard FMV Pro versions. A Key is entered in the first box shaded grey, but it will not be saved for the selected Function until a Value or an Equation is also entered for that Key. The corresponding Value is entered in the second text box.

When a Key is saved for a Function, It will be shown along with all saved Key names when any other Function is selected. As such, the Key names become common across all Functions. However, the corresponding Values are unique to each individual Function.

Key names can be used as Variable names and referenced in Equations if they start with a capital letter (this is to differentiate between Variables and mathematical functions).


To calculate the Value of a Key for a Function (when it is activated by the FMI) click the ‘=’ button and another text input box will appear for entering an equation.

Equations can contain Key names to reference other Values that appear above them in the same Function, or Standard Variables can be used to reference Values from upstream Functions, connected by couplings that are activated during the FMI cycles. This is explained in further sections.

To turn the equation off, click the ‘=’ button again (this is a toggle button) and the equation will disappear, it is still saved but will not be used to calculate the Value.

Functions/Variables List

The next section is a list of available mathematical functions and variables available for use in Equations. You can switch between these two types by using the Functions/Variables toggle buttons above the list. The Variables list is initially empty but will be populated as you create Keys and make selections within the model.

Display Results

The top colour range is used to display results in the inside top of each function, the bottom range in the inside bottom of each function. Click on any of the three main colour circles to change the colour. The intermediate colours are blended from the three main colours.

The number boxes below the colour ranges are used to convert the Values to the colour range for dsiplay.

The last two text boxes on the right labeled ‘Key 1’ and ‘Key 2’ are for selecting which of the Keys provide values for displaying the results, Key 1 for the top range and Key 2 for the bottom range.


for modelling non-trivial socio-technical systems

Important: Due to COVID 19 the next FRAMily meeting has now been postponed to next April!

Further details on the FRAMily 2020 page!

The FRAMily 2019 group at Malaga

THE DESIGN, management, and analysis of work tacitly assumes that we know how things are done or should be done. Since humans – and organisations – are supposed to follow procedures, rules, and guidelines, the planning and management of work, including accident investigation and risk assessment, assume that compliance is the norm. The purpose of safety analyses, for instance, is to understand why the outcome of an action or a series of actions (an activity, an operation) was unacceptable (adverse) rather than acceptable (successful) – as in event investigation – or how that could possibly happen in the future – as in risk assessment.

IN REALITY work is never completely regular or orderly, except in very special cases. It is therefore inadvisable to assume that work is as we imagine and that compliance guarantees success. Work-as-done (WAD) will always be different from work-as-imagined (WAI) because it is impossible to know in advance what the actual conditions of work will be, not least what the demands and the resources will be. It is therefore also impossible to provide guidelines or instructions that are detailed enough to be followed ‘mechanically.’ An analysis of how a system functions and of how work activities are carried out must therefore begin by establishing how work is actually done and how everyday performance takes place. It is in particular important to understand how things go right as a prerequisite for understanding what has or could go wrong.

THE REASON why everyday performance nevertheless in most cases goes right is that people – and organisations – know or have learned to adjust what they do to match the actual conditions, resources, and constraints - for instance by trading off efficiency and thoroughness. The adjustments are ubiquitous and generally useful. But the very reasons that make them necessary also means that they will be approximate rather than precise. Approximate adjustments are the reason why things usually go right, but by the same token also the reason why things occasionally go wrong. Things do not generally go wrong because of outright failures, mistakes, or violations. They rather go wrong because the variability of everyday performance aggregates in an unexpected manner. This is captured by the principle functional resonance that is the basis for the FRAM.

THE FRAM is a method to analyse how work activities take place either retrospectively or prospectively. This is done by analysing work activities in order to produce a model or representation of how work is done. This model can then be used for specific types of analysis, whether to determine how something went wrong, to look for possible bottlenecks or hazards, to check the feasibility of proposed solutions or interventions, or simply to understand how an activity (or a service) takes place. The FRAM is a method for modelling non-trivial socio-technical systems. It is NOT a risk assessment method and it is not an accident analysis method. Neither is a FRAM model a flow model, a network model, or a graph. But the model produced by a FRAM analysis can serve as the basis for a risk analysis, an event investigation, or for something entirely different.

THE FRAM is based on four principles: the equivalence of failures and successes, the central role of approximate adjustments, the reality of emergence, and functional resonance as a complement to causality. The FRAM does not imply that events happen in a specific way, or that any predefined components, entities, or relations must be part of the description. Instead it focuses on describing what happens in terms of the functions involved. These are derived from what is necessary to achieve an aim or perform an activity, hence from a description of work-as-done rather than work-as-imagined. But functions are not defined a priori nor necessarily ordered in a predefined way such as hierarchy. Instead they are described individually, and the relations between them are defined by empirically established functional dependencies.

We are looking forward to seeing the results of using this new facility and seeing the range and scope of applications and studies significantly extended. Perhaps we will see some examples at the next FRAMily Workshop in Kyoto next year, COVID willing.

© Copyright Erik Hollnagel 2016. All Rights Reserved.