Retrospective analysis



The FRAM Sandbox Facility

Extending the capabilities of the FMV

There is an increasing interest in utilising the FRAM approach for the analysis of what exactly is going on in complex sociotechnical systems in practical high hazard environments. There are, for example, a number of ongoing projects at the moment in aviation, self-driving vehicles and, of course, on the challenges of the COVID 19 pandemic for healthcare responses. But as well as these practical applications there is an increasing interest from the academic community, in extending and developing further, the underpinning concepts, as shown in the recent review (below)

These groups are thus interested in taking the modelling power of the FRAM approach to the next level. Their interests include exploring in more detail how interactions occur and how the effects of variability can be addressed and predicted more formally, as well as enabling dynamic visualisation of processes and the quantification of expected outcomes.

What makes this now more attractive, has been the development of a rigorous model checking methodology, the FRAM Model Interpreter, FMI (Hollnagel, E,) ( )

To support these developments the FRAM Model Visualiser has also been given extra facilities, which now include an option to use, what is essentially a laboratory sand box to provide research laboratory experimental facilities for different groups to utilise.

From time to time, it is planned to add additional features that are still under development and not officially released as part of the FMV Pro version, but may be made available to groups for the purposes of experimentation and feedback from the users.


Building on the FMI functionality, the metadata feature in the FMV, now provides the ability to calculate metadata values as Functions are activated during the FMI cycles.

The manual details these here

The calculations are expressed as user defined equations that can reference other metadata keys, standard variables, standard mathematical functions, logic conditions, and mathematical operators. One or two resulting metadata values can then be expressed as a coloured visualisation within each function. The colours and value ranges can be customised by the user.

When you Ctrl-Click a Function, or select and press Ctrl-M, the metadata section will appear above the model in the visualiser window and display the extended features.

Key/Value pairs

The first two text boxes are for entering metadata as a list of key/value pairs, as is already available in the standard FMV Pro versions. A Key is entered in the first box shaded grey, but it will not be saved for the selected Function until a Value or an Equation is also entered for that Key. The corresponding Value is entered in the second text box.

When a Key is saved for a Function, It will be shown along with all saved Key names when any other Function is selected. As such, the Key names become common across all Functions. However, the corresponding Values are unique to each individual Function.

Key names can be used as Variable names and referenced in Equations if they start with a capital letter (this is to differentiate between Variables and mathematical functions).


To calculate the Value of a Key for a Function (when it is activated by the FMI) click the ‘=’ button and another text input box will appear for entering an equation.

Equations can contain Key names to reference other Values that appear above them in the same Function, or Standard Variables can be used to reference Values from upstream Functions, connected by couplings that are activated during the FMI cycles. This is explained in further sections.

To turn the equation off, click the ‘=’ button again (this is a toggle button) and the equation will disappear, it is still saved but will not be used to calculate the Value.

Functions/Variables List

The next section is a list of available mathematical functions and variables available for use in Equations. You can switch between these two types by using the Functions/Variables toggle buttons above the list. The Variables list is initially empty but will be populated as you create Keys and make selections within the model.

Display Results

The top colour range is used to display results in the inside top of each function, the bottom range in the inside bottom of each function. Click on any of the three main colour circles to change the colour. The intermediate colours are blended from the three main colours.

The number boxes below the colour ranges are used to convert the Values to the colour range for dsiplay.

The last two text boxes on the right labeled ‘Key 1’ and ‘Key 2’ are for selecting which of the Keys provide values for displaying the results, Key 1 for the top range and Key 2 for the bottom range.

Using a FRAM model for retrospective analysis (event analysis)

How to use FRAM for event analysis (retrospective)

Accident analysis as commonly practiced.

The common purpose of an accident investigation / event analysis is to find the causes for the observed outcome(s) (the injury). (In some methods, the purpose is even to find the root causes.) An accident investigation therefore typically starts from the observed (adverse) outcome, and traces the developments backwards in order to find out what went wrong or malfunctioned, i.e., the conditions (events) that were necessary and sufficient for the outcome to happen. The reasoning is usually contra-factual, such as: 'If X had not happened, then this (the accident) would not have happened. Therefore X is the cause of the accident.'

Accident analysis based on functional resonance

In consonance with the principles of Safety-II (q.v.), the purpose of a FRAM analysis is to identify how the system should have functioned for everything to succeed (i.e., “everyday” performance), and to understand the variability of functions which alone or in combination prevented that from happening. This is typically the variability that existed in the situation being analysed, but it could also be the variability that possibly might exist under other conditions.

A FRAM model describes a system’s functions and the potential couplings among functions. The model does not describe or depict an actual sequence of events, i.e., an accident scenario. The basic steps in building a FRAM model of the activity (or performance) that is to be analysed have been described here. The development of the model ended by describing the potential variability.

An accident scenario corresponds to an instantiation of the model. A FRAM model includes a description of the potetial variability of the functions. The instantiation is a “map” of how the potential variability became real (or actual) variability in a given situation. An instantiation shows how functions were coupled under given – favourable or unfavourable – conditions. The analysis of the instantiation of the FRAM model comprises the following steps:

  • Characterise the variability in the actual event of the set of 'foreground' functions and of the set of 'background' functions (context). Consider whether the actual variability was what one could expect ('normal') or whether it was unusual - either by being very large or by being very small ('abnormal'). (In both cases the situation would not be as usually expected, hence potentially affecting the variability of downstream functions.) The variability is expressed by characterising the variability of the Output of each function, either using the simple or the elaborate description.
  • Identify the dynamic couplings (functional resonance) that played a role during the event. This is the actual instantiation of the model, which can be used to understand why the event developed the way it did. In relation to the traditional accident analysis, this instantiation provides an explanation of what happened, although it does not necessarily identify unique or specific causes. The explanation may, for instance, be found in the couplings of the variability of everyday performance.
  • Propose ways to monitor and dampen performance variability (indicators, barriers, design / modification, etc.) In the case of unexpected positive outcome, the search is of course for ways to amplify, in a controlled manner, the variability rather than for ways to dampen it.

We are looking forward to seeing the results of using this new facility and seeing the range and scope of applications and studies significantly extended. Perhaps we will see some examples at the next FRAMily Workshop in Kyoto next year, COVID willing.

© Copyright Erik Hollnagel 2016. All Rights Reserved.