The FRAM Sandbox Facility

Extending the capabilities of the FMV

There is an increasing interest in utilising the FRAM approach for the analysis of what exactly is going on in complex sociotechnical systems in practical high hazard environments. There are, for example, a number of ongoing projects at the moment in aviation, self-driving vehicles and, of course, on the challenges of the COVID 19 pandemic for healthcare responses. But as well as these practical applications there is an increasing interest from the academic community, in extending and developing further, the underpinning concepts, as shown in the recent review (below)

These groups are thus interested in taking the modelling power of the FRAM approach to the next level. Their interests include exploring in more detail how interactions occur and how the effects of variability can be addressed and predicted more formally, as well as enabling dynamic visualisation of processes and the quantification of expected outcomes.

What makes this now more attractive, has been the development of a rigorous model checking methodology, the FRAM Model Interpreter, FMI (Hollnagel, E,) ( )

To support these developments the FRAM Model Visualiser has also been given extra facilities, which now include an option to use, what is essentially a laboratory sand box to provide research laboratory experimental facilities for different groups to utilise.

From time to time, it is planned to add additional features that are still under development and not officially released as part of the FMV Pro version, but may be made available to groups for the purposes of experimentation and feedback from the users.


Building on the FMI functionality, the metadata feature in the FMV, now provides the ability to calculate metadata values as Functions are activated during the FMI cycles.

The manual details these here

The calculations are expressed as user defined equations that can reference other metadata keys, standard variables, standard mathematical functions, logic conditions, and mathematical operators. One or two resulting metadata values can then be expressed as a coloured visualisation within each function. The colours and value ranges can be customised by the user.

When you Ctrl-Click a Function, or select and press Ctrl-M, the metadata section will appear above the model in the visualiser window and display the extended features.

Key/Value pairs

The first two text boxes are for entering metadata as a list of key/value pairs, as is already available in the standard FMV Pro versions. A Key is entered in the first box shaded grey, but it will not be saved for the selected Function until a Value or an Equation is also entered for that Key. The corresponding Value is entered in the second text box.

When a Key is saved for a Function, It will be shown along with all saved Key names when any other Function is selected. As such, the Key names become common across all Functions. However, the corresponding Values are unique to each individual Function.

Key names can be used as Variable names and referenced in Equations if they start with a capital letter (this is to differentiate between Variables and mathematical functions).


To calculate the Value of a Key for a Function (when it is activated by the FMI) click the ‘=’ button and another text input box will appear for entering an equation.

Equations can contain Key names to reference other Values that appear above them in the same Function, or Standard Variables can be used to reference Values from upstream Functions, connected by couplings that are activated during the FMI cycles. This is explained in further sections.

To turn the equation off, click the ‘=’ button again (this is a toggle button) and the equation will disappear, it is still saved but will not be used to calculate the Value.

Functions/Variables List

The next section is a list of available mathematical functions and variables available for use in Equations. You can switch between these two types by using the Functions/Variables toggle buttons above the list. The Variables list is initially empty but will be populated as you create Keys and make selections within the model.

Display Results

The top colour range is used to display results in the inside top of each function, the bottom range in the inside bottom of each function. Click on any of the three main colour circles to change the colour. The intermediate colours are blended from the three main colours.

The number boxes below the colour ranges are used to convert the Values to the colour range for dsiplay.

The last two text boxes on the right labeled ‘Key 1’ and ‘Key 2’ are for selecting which of the Keys provide values for displaying the results, Key 1 for the top range and Key 2 for the bottom range.

FRAM Methodology Developments

A number of centres are using the FRAM methodology and developing ideas to enable it to be used not only in a wider range of applications, but also to validate and extend its acceptance and use by a wider community of both academic and practical proponents.

A major attraction of the approach is that it offers a way of modelling complex systems and systems of systems which does not rely on “levels of abstraction”, which does not get bogged down by the physical details of components, but only requiring careful clarification of what they are supposed to accomplish.

One of the key features of the methodology is the teasing out of the actual variability found in practice (As is – Safety-II), in the various functional interactions. Currently this variability is assigned from experience, aspect by aspect, to track the emergent behaviours that can result in unfortunate consequences (resonances) as well as in the successful completion of tasks.

Several groups are attempting to develop ways to predict the results of these interdependent variations. These include assigning typical variabilities for the different functions (Human, Technological, or Organisational) and propagating the consequences automatically (Rees et al). Others are utilising a MonteCarlo approach to sum the probable effects of the component functions in a particular instantiation (Patriarca et al). A number of people are interested in utilising more formal methods of testing the FRAM instantiation models for validity, completeness etc. (Jin Tian et al, van Kleef, Jeronymo) Other groups are working on ways to quantify the predicted outcomes of the modelled systems using Bayesian Belief Nets, etc. (Slater et al)

But it needs to be emphasised that a FRAM model of a system is merely a systematic description of key functions. It is not a network. And it is not a flow model. Even individual task instantiations with their interdependent links are really emergent configurations, intimately dependent on previous instantiations and developing aspects of other functions.

So it is vital to ensure a consistent and consensus benchmark of what is at the core of the approach to avoid it deteriorating into a plethora of different usages and terminology. We hope to avoid that by having a formal endorsement of validity from a standards panel chaired by Erik.

We are looking forward to seeing the results of using this new facility and seeing the range and scope of applications and studies significantly extended. Perhaps we will see some examples at the next FRAMily Workshop in Kyoto next year, COVID willing.

© Copyright Erik Hollnagel 2016. All Rights Reserved.