The use of FRAM for accident investigation

Erik Hollnagel
MINES ParisTech, Crisis and Risk Research Centre
Sophia Antipolis, (F)
erik.hollnagel@crc.ensmp.fr
Erik Hollnagel, 2010

FRAM analysis steps

0

Define the purpose of modelling and describe the situation being

analysed. An event that has occurred (incident/accident) or a
possible future scenario (risk).

Identify the essential functions in the event ('foreground' functions

when things go right); characterise each by six basic aspects.

Characterise the actual / potential variability of 'foreground' functions

and 'background' functions (context). Consider both normal and worst
case variability.

Define functional resonance based on potential / actual dependencies

(couplings) among functions.

Propose ways to monitor and dampen performance variability

(indicators, barriers, design / modification, etc.)
Erik Hollnagel, 2010

FRAM analysis steps

0

Define the purpose of modelling and describe the situation being

analysed. An event that has occurred (incident/accident) or a
possible future scenario (risk).

Identify the essential functions in the event ('foreground' functions

when things go right); characterise each by six basic aspects.

Characterise the actual / potential variability of 'foreground' functions

and 'background' functions (context). Consider both normal and worst
case variability.

Define functional resonance based on potential / actual dependencies

(couplings) among functions.

Propose ways to monitor and dampen performance variability

(indicators, barriers, design / modification, etc.)
Erik Hollnagel, 2010

The event: Comair Flight 5191

Objective: Apply FRAM to the Comair flight 5191 accident in Lexington, KY, and
compare to a traditionally performed investigation.

At 06:06 of August 27th, 2006, Comair flight 5191 en route to Atlanta, GA,
crashed after an attempted take-off from Lexington Blue Grass Airport in
Lexington, KY. The aircraft taxied out uneventfully and then inadvertently
proceeded to depart from the shorter general aviation runway (runway 26) as
opposed to the longer air carrier runway (runway 22). The aircraft became
momentarily airborne after it struck an earthen berm, then collided with trees, and
crashed. There was a significant post-crash fire consuming most of the aircraft,
and 49 of the 50 passengers and crew perished.
Erik Hollnagel, 2010

Intended taxi/takeoff path

Actual taxi/takeoff
path

Erik Hollnagel, 2010

NTSB analysis and conclusions

... the probable cause of this accident was the flight crewmembers failure to use
available cues and aids to identify the airplanes location on the airport surface
during taxi and their failure to cross-check and verify that the airplane was on
the correct runway before takeoff. Contributing to the accident were the flight
crews nonpertinent conversation during taxi, which resulted in a loss of
positional awareness, and the Federal Aviation Administrations (FAA) failure to
require that all runway crossings be authorized only by specific air traffic control
(ATC) clearances.
NTSB. (2007). Attempted takeoff from wrong runway, Comair Flight 5191, Bombardier CL-600-2B19,
N431CA, Lexington, Kentucky, August 27, 2006 (Aircraft Accident Report NTSB/AAR-07/05).
Washington, DC: National Transportation Safety Board.

Formal accident investigations usually start with an assumption that the

operator must have failed, and if this attribution can be made, that is the
end of serious inquiry.
(Perrow (1984). Normal Accidents)
Erik Hollnagel, 2010

FRAM analysis steps

Define the purpose of modelling and describe the situation being

analysed. An event that has occurred (incident/accident) or a
possible future scenario (risk).

Identify the essential functions in the event ('foreground' functions

when things go right); characterise each by six basic aspects.

Characterise the actual / potential variability of 'foreground' functions

and 'background' functions (context). Consider both normal and worst
case variability.

Define functional resonance based on potential / actual dependencies

(couplings) among functions.

Propose ways to monitor and dampen performance variability

(indicators, barriers, design / modification, etc.)
Erik Hollnagel, 2010

Identifying Functions: General

An accident investigation typically starts from the observed (adverse)
outcome, and traces the developments backwards in order to find out what
went wrong or malfunctioned.
PURPOSE: The purpose of a FRAM analysis is to identify how the system
should have functioned for everything to succeed (i.e., normal
performance), and then understand the variability which alone or in
combination prevented that from happening.
MODEL: A FRAM model describes a systems functions and the potential
couplings among functions. But the model does not describe or depict a
sequence of events, i.e., the accident scenario.
INSTANTIATION: An accident scenario can be the result of an instantiation
of the model. The instantiation is a map of how functions are coupled
under given favourable or unfavourable - conditions.
Erik Hollnagel, 2010

Identifying Functions: Details

Where to
begin

A FRAM analysis can in principle begin with any function.

The analysis will show the need for other functions to be
included, i.e., functions that are coupled or linked through
various relations. FRAM defines six types of relations.

Level of
description

There is no single, correct level of description. A FRAM

model will typically comprise functions described on
different levels.

Level of detail

If there can be significant variability in a function, then it is

possible to go deeper into the analysis of that function,
and possibly break it down into subfunctions..

System
boundary
(stop rule)

The analysis may go beyond the boundaries of the system

as initially defined. If some function outside the system
can vary and thereby affect other functions inside the
system, then it should be included in the analysis.
Erik Hollnagel, 2010

FRAM analysis steps

Define the purpose of modelling and describe the situation being

analysed. An event that has occurred (incident/accident) or a
possible future scenario (risk).

Identify the essential functions in the event ('foreground' functions

when things go right); characterise each by six basic aspects.

Characterise the actual / potential variability of 'foreground' functions

and 'background' functions (context). Consider both normal and worst
case variability.

Define functional resonance based on potential / actual dependencies

(couplings) among functions.

Propose ways to monitor and dampen performance variability

(indicators, barriers, design / modification, etc.)
Erik Hollnagel, 2010

FRAM functional unit (module)

Time available: This can be
a constraint but can also
be considered as a
special kind of resource. Time
That which is used or
transformed to
produce the output. Input
Constitutes the link to
previous functions.
Precondition
System conditions that
must be fulfilled before a
function can be carried out.

That which supervises or

adjusts a function. Can be
plans, procedures,
guidelines or other
Control functions.
That which is
Output produced by function.
Constitute links to
subsequent functions.
Resource That which is needed or
consumed by function to
process input (e.g.,
matter, energy, hardware,
software, manpower).
Erik Hollnagel, 2010

Normal taxi & takeoff sequence

Review of weather and airport data
Taxi briefing
Takeoff briefing
Engine start
ATC clearance(s)
Taxi Checklist
Taxi to runway
Before takeoff checklist
Wait at the hold short line
Turn onto runway
Takeoff

Erik Hollnagel, 2010

Review of weather and airport data

T

C
Dispatch
er
prepares
flight
informati
on

O
T
R

Review
of
weather
and
airport
data

I
T

NOTAM describing a portion of a

taxiway closed due to construction I
(taxiway Alpha North of runway 26)
missing from flight release, not
included in the ATIS broadcast on the
morning of the accident as required.

C
P

KLEX
NOTAM
generatio
n
P

Erik Hollnagel, 2010

FRAM analysis steps

Define the purpose of modelling and describe the situation being

analysed. An event that has occurred (incident/accident) or a
possible future scenario (risk).

Identify the essential functions in the event ('foreground' functions

when things go right); characterise each by six basic aspects.

Characterise the actual / potential variability of 'foreground' functions

and 'background' functions (context). Consider both normal and worst
case variability.

Define functional resonance based on potential / actual dependencies

(couplings) among functions.

Propose ways to monitor and dampen performance variability

(indicators, barriers, design / modification, etc.)
Erik Hollnagel, 2010

.. failure to use available cues and aids ..

At the time of the accident, the flight
crew had the most recent Jeppesen
chart for LEX, dated January 2006.
This chart showed taxiway A5 and
taxiway A north of runway 8/26.
T
However, at the time of the
accident, taxiway A5 had been
redesignated as taxiway A, and
I
taxiway A north of runway
8/26 had been closed.
T

C
KLEX
NOTAM
generatio
n

C
KLEX
ATIS
Service

O
T

C
P
Dispatch
er
prepares
flight info

C
Review
of
weather
and
airport
data

R
I

The local NOTAM that indicated that

taxiway A north of runway 8/26 was closed, was not
included in the Comair flight planning system or the flight release
paperwork for the flight because the company determined that the
information in the local NOTAM did not affect safety of flight.
Erik Hollnagel, 2010

Beginning to build the larger picture

T

KLEX
taxi
briefing

KLEX
ATC
clearance

O
T
R

Taxi onto
runway

C
P

C
Perform
taxi
checklist

I
T

Taxi to
runway

I
T

C
Perform
before
take-off
checklist

R
P

R
Erik Hollnagel, 2010

NTSB conclusion:
... the probable
cause of this
accident was the
flight crewmembers
failure to use
available cues and
aids ...
Erik Hollnagel, 2010

FRAM analysis steps

Define the purpose of modelling and describe the situation being

analysed. An event that has occurred (incident/accident) or a
possible future scenario (risk).

Identify the essential functions in the event ('foreground' functions

when things go right); characterise each by six basic aspects.

Characterise the actual / potential variability of 'foreground' functions

and 'background' functions (context). Consider both normal and worst
case variability.

Define functional resonance based on potential / actual dependencies

(couplings) among functions.

Propose ways to monitor and dampen performance variability

(indicators, barriers, design / modification, etc.)
Erik Hollnagel, 2010

Conclusions
The outcome of an accident investigation depends on how it is carried out:
What You Look For Is What You Find (WYLFIWYF)
The common (structural) approach is to work backwards from the outcome,
and to look for an acceptable cause or set of causes.
This is supported by institutionalised methods, models, and/or regulations. The
result is a set of failures or malfunctions, that become the target of remedial
action.
An alternative (functional) approach is to account for the normal operations
(successes) and to explain how and why they varied under the conditions
This produces an understanding of how functions (tasks) may depend on each
other, and how performance variability can unexpectedly combine and
propagate, hence how normally successful actions may sometimes fail.
Recommendations are about how and when to dampen or block variability and
how and when to foster it.
Erik Hollnagel, 2010