Last week’s essay ended with a promise: a method that begins where the cheese slices end. Over Lake Constance, two intact barriers had collided, and the most famous image in safety science had no language for it. But today the language exists. Erik Hollnagel developed it over many years and packed it into a slim, sober book in 2012: FRAM: The Functional Resonance Analysis Method. If you arrive from the Swiss cheese, the first thing you hand in at the door is a habit: the assumption that an analysis begins with what went wrong.
From model to method
When Hollnagel introduced the idea in Barriers and Accident Prevention in 2004, the M in FRAM still stood for “model”: the Functional Resonance Accident Model, one more accident model. Eight years later he rebuilt the acronym, and the accident model became an analysis method. That renaming is not mere cosmetics but the book’s programme. A model like the Swiss cheese brings its picture along (slices, holes, a trajectory), and the analysis consists of sorting the case into that picture. FRAM brings no picture. The method prescribes how to build a model of the activity under investigation; the picture only emerges from the concrete case. Hollnagel calls this a method without a model. What sounds like an academic fine point is the greatest possible distance from the cheese slide, which fits every accident precisely because it knows nothing about any of them.
Why things mostly go right
The foundation is four principles, and the first carries the most weight: success and failure spring from the same source, the everyday variability of work. The same adjustments that carry an operation through the day a thousand times over produce, in rare constellations, an event. If you investigate only the failures, you are studying the exceptions of an operation whose normal case you never understood.
The second principle explains where the variability comes from: people and organisations continuously adjust their performance to conditions, and they do so approximately, never exactly. Information is incomplete, time is short. Be thorough and you become slow; be fast and you become imprecise. Hollnagel had described this trade-off three years earlier as the ETTO principle, the efficiency-thoroughness trade-off. The adjustments are the reason work under real conditions functions at all. And at the same time they are the material events are made of.
Emergence and resonance
That leaves the two principles that give the method its name. Outcomes in complex systems are emergent: they cannot be traced back to a broken component; they arise from the interplay. And the variability of several functions can couple and build up, like oscillations reinforcing each other. That is functional resonance. Each individual fluctuation stays within its normal band, approved or at least tolerated. Only their coincidence produces a signal the system can no longer dampen.
With that, the night of Überlingen has a description: controller and TCAS as two functions, both within specification, whose outputs coupled in a constellation neither of them knew. No hole anywhere. Two barriers in resonance.
The Swiss cheese brings its picture along and lays it over every case. FRAM arrives empty-handed: the picture only emerges from the work as it actually went that day.
What an analysis feels like
In practice the book walks you through four steps. You identify the functions of the activity under investigation and describe each one through six aspects: input, output, precondition, resource, time, control. This is where the hexagons come from, the shapes by which FRAM diagrams are instantly recognised. You then characterise how each function can vary, trace the couplings through which variability travels, and finally ask where it can be dampened. Anyone working through this on a real case for the first time quickly notices how much normal operation you have to understand to do it. It does not work without the people who do the work. And that is where the real gain lies: the diagram is a by-product. The conversation about work as it actually runs would never have happened without the method.
What the book leaves open
The honest part first: this is a textbook. If you expect Dekker’s narrative voice, you will find dry, precise prose with few case examples. The heavier point is the method’s price. A serious FRAM analysis costs days to weeks and needs access to the real work, through observation and conversations rather than through the file. The result is qualitative and depends on the experience of those doing the analysis; standardised quality criteria and validation studies remain thin on the ground to this day. The method also has its own ritual risk: a diagram of forty hexagons can end up admired and inconsequential on a wall just as easily as the cheese slide. And on dampening the variability, the book stays vague. How a recognised resonance turns into an effective measure is largely left to the practitioner.
Add to this a limit worth carrying over from the Swiss cheese essay: not every incident needs FRAM. Missing fall protection needs no functional analysis. FRAM earns its cost where coupling and complexity are real, in other words where the simple explanation has already fallen short more than once.
Who this book is for
The book is worth it for anyone who investigates events or assesses risks in complex operations and has found barrier logic too narrow for the job: safety and quality professionals in healthcare (where the FRAM community is largest today), in air traffic management and in the process industries. If what you want first is the way of thinking, Hollnagel’s Safety-I and Safety-II is the better entry; the FRAM book is for those who want to apply the method. And if last week left you wondering what you actually see through the opened door of the Swiss cheese: this is the first room behind it.
Sources
- Erik Hollnagel – FRAM: The Functional Resonance Analysis Method – Modelling Complex Socio-technical Systems, Ashgate 2012 (main source)
- Erik Hollnagel – Barriers and Accident Prevention, Ashgate 2004
- Erik Hollnagel – The ETTO Principle: Efficiency-Thoroughness Trade-Off, Ashgate 2009
- Erik Hollnagel – Safety-I and Safety-II: The Past and Future of Safety Management, Ashgate 2014