Safety Risk Management Methodologies (SRM)

FRAM – Functional Resonance Analysis Method

This document was developed by the Safety Management Panel (SMP). It is intended to support safety experts in the application
of risk management methodologies. Any comments to this material should be forwarded to safetymanagement@icao.int.

Version 1.0 – January 2024

 CONTENTS

1. Description ................................................................................................................ 3
1.a) Purpose of the method ............................................................................................. 3
1.b) Theoretical basis ....................................................................................................... 4
1.c) Method overview...................................................................................................... 4
1.d) Key terms and definitions used in this document .................................................... 7
1.e) Tools available .......................................................................................................... 9

2. User factors ................................................................................................................. 10

2.a) Applications ............................................................................................................ 10
2.b) Use cases ................................................................................................................ 10
2.c) Users ....................................................................................................................... 10
2.d) Evaluation of complexity ........................................................................................ 11
2.e) Availability of training ............................................................................................. 11

3. Quality and consistency............................................................................................... 12

3.a) Consistency/differences from SMM concepts, terms, and definitions .................. 12
3.b) Validity and reliability of outputs ........................................................................... 12
3.c) Overall pros and cons ............................................................................................. 13
3.d) Team assessment of usability ................................................................................. 13

4. Additional information ................................................................................................ 14

4.a) Abbreviations .......................................................................................................... 14
4.b) Literature, references ............................................................................................. 14

Appendices ..................................................................................................................... 16
Appendix 1 – Simple FRAM model of an aircraft take-off ............................................. 16
Appendix 2 – Examples of studies using FRAM in aviation ............................................ 17

ICAO guidance on FRAM (v.1.0, 2024) 2

 1. DESCRIPTION

1.a) Purpose of the method

Originally developed for accident investigation purposes, FRAM can be the basis for analysing events, risks,
or system designs in either a retrospective or prospective manner. It is not focussed solely on the failure
cases and their causes and consequences, but also on how to understand complex sociotechnical systems
in order to improve their resilient behaviour.

FRAM analyses aim to:

• Describe the functioning of a system (i.e., everyday work or a particular event); and/or
• Understand how the different human, technological, and organisational functions behave within a
system to achieve its goals, and may be impacted by variability (i.e., variability of a single function
or a combination thereof).

Well-known incident analysis methods and accident models that appeared after WW2 (e.g., Event/Fault
Tree Analysis, Root Cause Analysis, etc.) initially aimed at explaining or anticipating technical failures in a
mechanistic way. This approach was later expanded to human and organisational ‘failures’ using similar
approaches (e.g., Swiss Cheese Model, BowTie, etc.). In contrast, FRAM - along with a few other
methodologies that have embraced systems thinking principles - does not seek to lay out all the cause-
effect chains within a system in a sequential or rigid way. FRAM analyses aim to be the starting point
allowing organisations to develop recommendations on how to monitor and positively influence the
inescapable variability of everyday work, especially when dealing with complex systems.

In terms of graphical outputs, FRAM analyses are quickly recognized by their distinctive web(s) of
interconnected hexagons, each representing a function within the system and/or the situation that is
being analysed (see figures 1 thru 3). FRAM is very different from logic trees or from static engineering
diagrams. It is important to realise that FRAM models are not made of hard-wired hexagons connecting
system components. Rather, FRAM helps in building a model of dynamic, nonlinear interactions and
interdependencies of system functions.

As its name indicates, FRAM is a method rather than a model (i.e., not a template or a mould). However,
using the method will eventually lead to an infographic model of the system that is analysed. This ‘FRAM
model’ therefore refers to a specific system. Since everyday work variability produces different system
states and outcomes, each active state in a process will have its own FRAM model to show these
variations, called instantiations. These instantiations appear as the model is run for the successive steps -
or cycles- of a process or activity. Put very simply, instantiations are comparable (but not identical) to the
frames of film strips. A detailed FRAM model would typically contain several instantiations for different
system states that are displayed one at the time (i.e., one instantiation per system state). Software tools
greatly assist in creating a model and its instantiations, and in navigating through them.

ICAO guidance on FRAM (v.1.0, 2024) 3

1.b) Theoretical basis
FRAM is an analytic tool that evolved from a school of thought on ‘human error’ and safety management
that also fostered Resilience Engineering and Safety-II thinking. More precisely, FRAM is rooted in general
systems theory, psychological and cybernetic research, and the principles of structured software
development. Erik Hollnagel first published its basic principles in 2004, subsequently incorporated his
Safety-II perspective into FRAM, and consolidated its core theoretical elements in his 2012 book (see 4.b
for complete references). FRAM is founded on the following four principles:
1. The equivalence of success and failures – Tasks or activities generally are covered by rules,
procedures, requirements, and “humans-in-the-loop”. Outcomes of these tasks or activities may
be as “good” as expected or not as good as imagined. No matter what these outcomes are, they
happened in very much the same way.
2. Approximate adjustments – Daily work performance is influenced by countless factors and
always contains some element that was unexpected and/or not covered in company
documentation or in training. Consequently, adjustments are inevitable without exception. On
the other hand, resources (e.g., information about the system, time, workforce, budget, etc.) are
nearly always limited or unreliable in some form. Adjustments that are necessary to achieve
system goals will therefore be approximate rather than precise. Such approximate adjustments
play a crucial part in why things predominantly go well and occasionally go wrong.
3. Emergence – Everyday work variability can manifest itself through the functions of a system and
through the approximate adjustments that are made in response. However, the variability in
adjustments is rarely large enough to cause significant issues, even if they’re approximate. On the
other hand, the variability of multiple functions may coincide and mutually affect each other in
unexpected ways. This might lead to unexpected and disproportionately negative or positive
impacts. The relationship between causes and consequences is therefore no longer direct and
proportional, but non-linear. Both good and bad outcomes can then be explained as emerging
from variability, rather than as the result of malfunctions or defects in a specific element of the
system (particularly human).
4. Resonance – Resonance can be observed in one of three possible forms. Classical resonance must
be built-up over time and is typically seen through oscillations of physical systems at certain
frequencies (e.g., resonance between the cords of instruments, or soldiers marching in step
across a suspension bridge, involuntarily leading to increasing oscillations and swaying of the
bridge). In stochastic resonance, random noise pushes an otherwise weak or subliminal signal
over a detection threshold. Finally, functional resonance refers to the variability of performance
in sociotechnical systems (e.g., due to approximate adjustments), thereby allowing to raise the
understanding of emergent and non-linear outcomes with a view to increase predictability and
control (or at least influence). Functional resonance can be seen as the outcome resulting from
the unintended interaction of the everyday variability of multiple functions within a system.

1.c) Method overview

Originally, three types of system functions were identified:
• Technological – these functions are relatively stable,
• Human – these functions vary with high frequency and high amplitude, and
• Organizational – these functions vary with low frequency but high amplitude.

ICAO guidance on FRAM (v.1.0, 2024) 4

FRAM analyses identify system functions, each represented by a hexagon, followed by an analysis of their
couplings, their variability, and by an evaluation of the way in which the different functions interact and
influence the way the system behaves. They generally involve the following four steps:
1. Identification and description of the system’s functions. A system achieves its goal by a series of
functions. FRAM describes a function by a verb, or a verb phrase, to indicate what to do. This type
of modelling resembles a Task Analysis. For instance, the following steps are essential when
making coffee (figure 1): get a recipient, a filter, coffee powder (made at the last minute from
beans or ahead of time), boil water, put the powder in the filter, pour the boiling water on the
powder, and wait for a thorough percolation. In FRAM, all these activities are seen as functions.
T C

To grind
I coffee beans O
into a powder

P R
T C T C T C T C T C
To allow
To place To place To pour water coffee to
coffee To enjoy a
I filter in O I O I on coffee O I percolate O I O
powder in coffee break
coffee maker powder throu gh
filter
filter

P R P R P R P R P R
T C

I To boil water O

P R

Figure 1 – Functions necessary to brew coffee for a coffee break.

Each function can be affected by interactions and interdependencies with any other function in
the system through up to six “aspects”: Input (I), Output (O), Precondition (P), Resource (R),
Control (C), and Time (T). Note that a letter can be found at each corner of the hexagons and that
its position is fixed by convention. Before moving on to the second step, it is necessary to start
identifying any coupling between aspects of functions and to draw those interactions as follows:
• Input (I) and Output (O) indicate the start or finish of a task or function. They may represent
intent, matter, energy, or information.
• A Precondition aspect (P) refers to conditions that should be in place or to an interaction that
is needed before a function is executed. On the other hand, only an Input can initiate or
activate the function. In the example with coffee, the Precondition supplies a confirmation of
the presence of powder in the filter. This then confirms that the function “to place coffee
powder in the filter” has been completed and that the function “to pour water” is ready (or
to be more precise, in a state which can now be activated).
• A Resource aspect (R) can indicate the availability of matter, energy, information, software,
competence, labour, tools, etc. that will be consumed while the function is carried out.
• A Control (C) can confirm the presence of an active plan, schedule, procedure, a set of
guidelines, a program, expectations, etc. that need to be in operation, and actively relayed,
to keep the function on track.
• Time (T) can be a special or limiting form of control, related to the temporal relation and
sequencing of different actions.

ICAO guidance on FRAM (v.1.0, 2024) 5

 These aspects serve to trigger the sequence of events that constitute the way the system will
behave. Their interactions can be thought of as a line of computer code. IF: all the aspects are
present and meet expectations, THEN: that function will execute its process, ELSE: wait.

Functions are thus coupled (or linked) through aspects of different functions. These aspects are
identified with individual descriptions (e.g., boiling water, filter in place) and can link to any other
function in the system that requires the same individual aspect and that shares the same name
(e.g., the Output of a single function can be coupled with several other functions - see figure 3).

T C

To grind
I coffee beans O
into a powder
T C
Coffe e ground
P R To place T C
coffee
I O
powder in Coffe e ma ke r
filter ready To pour water
I on coffee O T C
powder
P R Water poured To allow
T C
coffee to T C
P R I percolate O
To place Filter in place throu gh
Coffe e ma de
I filter in O filter
To enjoy a
coffee maker I O
coffee break
P R

P R
P R
T C
Boili ng wa te r

I To boil water O

P R

Figure 2 – Functions (to brew coffee) and the couplings between them.

2. Identification of performance variability. Performance variabilities are normal in a system. In

FRAM, these variabilities are categorized as internal (endogenous) or external (exogenous)
variabilities. The former refers to the variation caused by the function itself. The latter is generally
impacted by other functions and/or environment, e.g., incorrect readback of the pilot and
adverse weather. Originally an output of a function was considered in terms of timing and
precision. An Output of a function may occur too early, on time, too late, or not at all. At the
same time, it can be described as precise, acceptable, or imprecise in that regard. More precise
behaviours of functions can also be defined quantitatively using metadata.
3. Looking for functional resonance. Functions are coupled (or connected) with each other in FRAM
through the six aspects. Aggregation of variabilities in the functions may cause resonance.
Analysing internal and external variabilities helps to understand how upstream functions impact
downstream functions, and how things turn out to be. In Figure 2, if the filter is not properly
placed (labelled as imprecise), this may lead to the coffee powder and filter falling down when
performing the downstream functions. Fortunately, in most cases, we will double check the filter,
and make it “go well”. If using metadata, the analyst can follow the propagation of variabilities,
prescribed or random, using sampling from dedicated distributions.
4. Management of variability. System functional resonance may bring positive and negative
outcomes. Once the behaviour of the system is sufficiently understood, the basic strategy of
managing variability is to amplify the positive effects and damp the negative ones.

ICAO guidance on FRAM (v.1.0, 2024) 6

1.d) Key terms and definitions used in this document
Term Explanation
Activity “The description of the work that is done (in practice). An activity comprises a
number of functions, usually described in the order in which they were carried
out.”
(FRAM website, 2023)
Aspect (of a function) Each function (or hexagon) is affected by six aspects: Inputs, Outputs,
Preconditions, Resources, Controls, and Time. The presence of an aspect is
required to describe the functioning of a system.
(adapted from the FRAM website, 2023)
Control (of a function) A control supervises or regulates a function so that it results in the desired
output. It can be a plan, a schedule, a procedure, a set of guidelines, an
algorithm, etc. A different type of control is social control, which can be external
(e.g., the expectations of others) or internal (e.g., a kind of self-regulation).

(adapted from the FRAM website, 2023)

Downstream functions Functions that, in a given instantiation of a FRAM model, are logically
subsequent to other functions and may therefore be affected by them. The
‘downstream’ notion is relative rather than absolute since it is impossible to say
with certainty whether a function will be carried out prior to or after another
function.
(adapted from the FRAM website, 2023)
Function A function represents the means that are necessary to achieve a goal or produce
a certain outcome. These can include what people have to do individually or
collectively, what an organisation does, or what a technological system does by
itself or in collaboration with people. Each function is affected by six kinds of
aspects: Input, Output, Precondition, Resource, Control, and Time. A function is
typically represented by a hexagon in graphical renderings of a FRAM model.
(adapted from the FRAM website, 2023)
Functional resonance “Functional resonance is proposed as a way to understand outcomes that are
both non-causal (emergent) and non-linear in a way that makes both
predictability and control possible. Functional resonance can more formally be
defined as the detectable signal that emerges from the unintended interaction of
the everyday variability of multiple signals. The resonance effects that occur can
be seen as a consequence of the ways in which the system functions, and the
phenomenon is therefore called functional resonance rather than stochastic
resonance.”
(Hollnagel, 2012)
Input (of a function) Traditionally, an input (e.g., matter, energy, information) is used or transformed
by the function to produce the output. Its presence or availability serves as a
signal to activate or start a function (e.g., an instruction, a clearance).

(adapted from the FRAM website, 2023)

Instantiation “An instantiation of a FRAM model is a prediction of how a set of functions which
are mutually coupled under given conditions (favourable or unfavourable) or for
a given timeframe, can combine in a specific sequence to simulate the system’s
behaviour for that set of conditions.”
(FRAM website, 2023)

ICAO guidance on FRAM (v.1.0, 2024) 7

 Term Explanation
Output (of a function) Result of what the function does, for instance by processing the input. An output
can represent matter, energy, information, a change of state of the system, or a
signal that starts a downstream function.

(adapted from the FRAM website, 2023)

Precondition (of a function) A function cannot begin before one or more precondition(s) have been
established and the aspect is active. A precondition can be understood as system
state(s) that must be true, or as condition(s) that must be verified before a
function is carried out. It does not itself constitute a signal that starts the
function (i.e., this would be an input).
(adapted from the FRAM website, 2023)
Resilience Engineering “Trans-disciplinary perspective that focuses on developing theories and practices
that enable the continuity of operations and societal activities to deliver essential
services in the face of ever-growing dynamics and uncertainty. It addresses
complexity, non-linearity, inter-dependencies, emergence, formal and informal
social structures, threats, and opportunities.”
(Resilience Engineering Association website, 2023)
Resonance “In physical systems, classical (or mechanical) resonance refers to the
phenomenon that system can oscillate with larger amplitude at some frequencies
than at others. These are known as the system’s resonant (or resonance)
frequencies. At these frequencies even small external forces that are applied
repeatedly can produce large amplitude oscillations, which may seriously
damage or even destroy the system.”
(FRAM website, 2023)
Resource (of a function) Something that is needed or consumed while a function is carried out. This can
include matter, energy, information, competence, software, tools, labour, etc.,
but typically does not include time, which has a special status and is treated as a
separate aspect.
(adapted from the FRAM website, 2023)

Safety-I Perspective that defines safety as a condition where the number of adverse
outcomes is as low as possible, and where systems can be in either one of two
states: either everything works, or something fails. Safety management efforts
therefore focus on finding and fixing ‘errors’ and on constraining performance,
so that systems display minimal variability and don’t drift into failure.
(adapted from Hollnagel, 2014)
Safety-II Perspective that defines safety as a condition where as much as possible goes
well. Since the people’s ability to adjust their activities under varying conditions
is seen precisely as the key to ensuring success, safety management efforts focus
on understanding everyday activities to recognize, monitor, and control
performance variability.
(adapted from Hollnagel, 2014)

Note: in aviation, the Safety-II perspective is sometimes labelled as “Learning

From All Operations” (LFAO).
Stochastic resonance “Enhanced sensitivity of a device to a weak signal that occurs when random
noise is added to the mix. The outcome of stochastic resonance is non-linear,
which simply means that the output is not directly proportional to the input. The

ICAO guidance on FRAM (v.1.0, 2024) 8

 Term Explanation
outcome can also occur – or emerge – instantaneously, unlike classical resonance
which must be built-up over time.”
(FRAM website, 2023)
Time (of a function) The time aspect of a function represents the various ways in which time can
affect how a function is carried out. Time can typically be seen as a form of
control (e.g., in sequencing), as a resource (e.g., in planning), as a precondition
(e.g., in a schedule).
(adapted from the FRAM website, 2023)

Upstream functions Functions that, in a given instantiation of a FRAM model, are expected to happen
before other functions and may therefore affect them. The ‘upstream’ notion is
relative rather than absolute since it is impossible to say with certainty whether
a function will be carried out prior to or after another function.
(adapted from the FRAM website, 2023)
‘Work-as-imagined’ (WAI) “Work-as-imagined is both the work that we imagine others do and the work
that we imagine we or others might do, currently or in the future. The
imagination of human work takes place within organisations, between
organisations, and from outside of organisations. To a greater or lesser extent,
all of these imaginations -or mental models- will be wrong; our imagination of
others’ work is a gross simplification, is incomplete, and is also fundamentally
incorrect in various ways, depending partly on the differences in work and
context between the imaginer and the imagined.”
(Shorrock, 2016)
‘Work-as-done’ (WAD) “Work-as-done is actual activity – what people do. It is characterised by patterns
of activity to achieve a particular purpose in a particular context. It takes place in
an environment that is often not as imagined, with multiple, shifting goals,
variable and often unpredictable demand, degraded resources (staffing,
competency, equipment, procedures, and time), and a system of constraints,
punishments, and incentives, which can all have unintended consequences.
Work-as-done is mostly impossible to prescribe precisely and is achieved by
adjustments, variations, trade-offs, compromises that are necessary to meet
demand.”
(Shorrock, 2016)
Table 1 - Key terms and definitions

1.e) Tools available

Many software options have been developed over the years to support FRAM analyses (myFRAM,
DynaFRAM, etc.). However, the most widespread is the FRAM Model Visualiser (FMV). It is available as a
free web application and can be downloaded through GitHub for installation on a dedicated server (e.g.,
corporate intranet). The GitHub website also contains additional resources such as source code, extensions,
and documentation. One of those extensions is the FRAM Model Interpreter (FMI), which is a systematic
model validation tool to verify whether a FRAM model was correctly built and connected in FMV.
The GitHub site also provides access to a more advanced version of the FMV software which allows
quantification of the functions, behaviours, and interactions using metadata.

ICAO guidance on FRAM (v.1.0, 2024) 9

 2. User Factors

2.a) Applications
FRAM can serve various roles in both backward-looking and forward-looking system analyses. Arguably, it
is also the strongest method to map and compare work varieties, such as the ‘work-as-imagined’ and ‘work-
as-done’ in daily operations of complex systems, and in turn to identify the gaps between the varieties of
work (i.e., work-as-imagined, -prescribed, -done, -disclosed, etc.). This distinctive feature sets FRAM apart
from traditional, linear models and tools (e.g., Fault Tree Analysis, Root Cause Analysis, BowTie, etc.). Out
of the few modern risk management methods and models rooted in systems thinking (e.g., FRAM, STPA),
experience suggests that FRAM is likely the most suitable to model the detailed functioning of systems that
are already in operation (e.g., to capture functional relationships within complex systems).

In the context of retrospective analyses, FRAM is not primarily used to deconstruct the event itself,
although the establishment of a FRAM model is likely to generate insights related to the conditions and
factors leading up to the event. Instead, the FRAM model allows users to portray the operational dynamics
in ‘normal’ operations, when all activities run smoothly and as expected, and usually lead to successful
outcomes. Delving into successful execution allows users to:
• Untangle interdependencies between the functions (that are done in each activity);
• Outline the natural variability of these functions; and
• Uncover the factors behind a divergent outcome (e.g., in an incident).

In the context of prospective analyses to outline future or potential activities (e.g., to propose a new
procedure or guideline, or to (re)design a system), the FRAM model primarily serves as a tool to uncover
potentially crucial linkages between upstream and downstream functions that would not necessarily be
identified by linearly modelling the system (i.e., solely through its components). This exploratory work aids
in identifying connections and dependencies with significant implications for the proposed changes and
their effects on the overall system.

2.b) Use cases

According to a literature review published in 2020, FRAM users span various industries and fields where
the understanding of complex systems, risk management, and performance optimization is essential.
Although aviation is the industry where FRAM has been applied the most, it is not specifically designed for
aviation or for a particular sector of our industry. In terms of numbers of publications, healthcare is the
second domain where FRAM has been used the most to model operations in high stress, high hazard
situations (e.g., emergency/critical care, quantitative prediction of hospital bed availability, etc.). Other
successful applications have been documented in the construction, maritime, extractive, and nuclear
industries, among others (e.g., Formula 1 pitstops). Within aviation (see appendix B), FRAM has already
been used in various settings (e.g., air traffic control, civil aviation authority, maintenance, ground handling,
airline operations control, etc.) and for various purposes (e.g., risk management, accident investigation,
operational optimization, research, etc.).

2.c) Users
Considering FRAM is a method of building generic system models, its holistic approach to system design,
analysis, and operation, is not meant to provide instant answers or to be a decision aid that frontline
workers can quickly revert to when faced with complex problems requiring a rapid response. Instead, the

ICAO guidance on FRAM (v.1.0, 2024) 10

FRAM is a framework which supports system understanding, analysis and improvement. For example,
safety professionals (e.g., safety managers, analysts, and experts) who analyse and manage risks associated
with complex systems. Applying FRAM can assist them in identifying potential sources of risk,
vulnerabilities, and areas where resonances might lead to undesirable events and system states, such as:
• Human factors and ergonomics specialists working in human factors, ergonomics, and usability
engineering to better understand the interactions between humans, technology, and procedures
within various systems. Applying FRAM can assist in designing work environments and processes
that are aligned with human capabilities and limitations, aiming to enhance performance and
reduce errors.
• Process designers and improvement experts responsible for designing and optimizing complex
processes within organizations to model functional dependencies, variability, and potential
resonances. Applying FRAM can assist in creating more resilient and efficient processes to adapt to
changes and unexpected events.
• Change management and decision-making professionals involved in organizational change
management and decision support to assess the potential impacts of changes on complex systems.
Applying FRAM can assist in understanding how changes might propagate through functions and
lead to resonances, in making informed decisions, and in effectively managing transitions.
• Regulatory and compliance authorities to assess and ensure the safety and reliability of complex
systems. Applying FRAM can provide insights into potential risks and vulnerabilities that need to
be addressed to meet regulatory standards.

More recently, the method has begun to explore producing decision aids, with the ability to utilise external
feeds live and historical databases, to follow and predict the way systems will behave under speculative
futures (e.g., digital twins).

2.d) Evaluation of complexity

While FRAM can very easily be applied to model mundane tasks (e.g., preparing a cup of coffee),
challenges start to appear when confronted with complicated systems and activities involving a web of
interdependent functions (e.g., the approach and landing procedures of an aircraft). Although learning
the core theoretical principles and terminology of FRAM should be well within the reach of any aviation
professional, developing the competencies for accurate modelling initially requires a significant
investment in resources. These efforts are likely to be proportional to the complexity of the system(s)
considered since meticulous analyses of functional relationships and inherent variability are crucial to
adequately capture the complexity and nuances in system design or operation. This being said, the
comprehensiveness, usability, and quality of the model obtained will provide insights rarely - if ever -
achieved with traditional, linear methods and tools, in particular when modelling complex systems.

2.e) Availability of training

Several resources are available both online and offline. Guidelines, handbooks, recordings of presentations,
and manuals can be found on websites dedicated to FRAM (see 4.b – references), often for free. Books
(available in English, Japanese, Chinese, and Korean) and scientific articles entirely dedicated to FRAM are
also available for purchase through their respective publishers.

Although FRAM can theoretically be self-taught through the resources mentioned above, due consideration
should be given to meetings and activities organised by the global FRAM community commonly known as
the “FRAMily”. One of its entities, FRAMsynt, is dedicated to providing training on FRAM and organises
workshops, courses, lectures, seminars, etc. (see 4.b – references).

ICAO guidance on FRAM (v.1.0, 2024) 11

 3. Quality and Consistency

3.a) Consistency/Differences from SMM concepts, terms, and definitions

Both FRAM and the Safety-II perspective (that underpins FRAM) introduced several new key concepts,
terms, and definitions that, to this day, were typically not covered in ICAO publications about safety
management. However, there is more complementary than incompatibility between FRAM and the
original ICAO framework for SMS. Put differently, the theoretical foundations used in FRAM (and other
methods) can shed additional light on how complex systems generally work or should work, produce
outcomes, and sometimes fail. From that perspective, FRAM and the literature supporting it complement
and expand the existing toolbox of risk management methodologies that are generally better suited to
simple or complicated systems where linear causality is the norm. Different models and paradigms have
coexisted in safety science for decades. As with other models and tools, there is no universally right or
wrong methodology. The key is to identify which is the most suitable and effective to address the specific
need(s) of an organisation.

3.b) Validity and reliability of outputs

FRAM focuses on the likelihood that whole functions will vary or resonate, rather than zeroing only on
the probability that one or more specific component(s) will malfunction or fail. Therefore, current
quantification efforts of functions, behaviours, and interactions, either within FRAM models (i.e., more
specifically within the FMV application) or through quantitative or semiquantitative methods (e.g., Monte
Carlo simulations) may be challenging to achieve and sometimes difficult to compare with other methods.
However, many publications, including peer-reviewed, scientific journals, have confirmed the value of
using FRAM in analysing complex sociotechnical systems, identifying hazards, and supporting risk
management activities in high-risk industries, including aviation.
To support the validation of FRAM models as being correctly built and connected, an FMV extension
called the FRAM Model Interpreter (FMI) is now incorporated into the community edition of the software
available on the GitHub site (see 1.e – resources available).

ICAO guidance on FRAM (v.1.0, 2024) 12

3.c) Overall pros and cons
Pros & strengths Cons & limitations
• Underpinned by systems theory and fosters a • Requires at least an understanding of systems
deeper understanding of complex systems. thinking principles.
• Core principles are relatively straightforward, but • Detailed system information is needed prior to
their application from simple through complicated analysis.
to complex systems should be done progressively. • Time-consuming, both to practice and once
• Can be used reactively (e.g., investigation) and proficient with the method (e.g., to keep the scale
proactively (e.g., system design), but is better and scope of the analysis consistent)
suited and more effective with existing systems • Representations are not self-explanatory, rather
(i.e., already in operation vs. only at the concept they allow users to better understand the system,
stage). and enable the development of mitigation.
• Effective method for the assessment of
performance variability and gaps between the
varieties of work (e.g., WAI vs. WAD)
• Quantification (e.g., risk probability) is now
provided in different extensions to the standard
method.
• Supported by a global community of practitioners
and academics that offers and regularly updates
both guidance and IT tools.

Table 2 – Perceived strengths and limitations of FRAM

3.d) Team assessment of usability

Originally developed in the early 2000s to investigate accidents, FRAM evolved into a powerful tool to
thoroughly analyse both events and complex systems at all stages of their lifecycle. Being more recent
and having slightly less commonality with “basic” engineering principles than other methodologies, the
number of publications and guidance to support FRAM implementations is currently not as extensive.
However, it has been validated by academics and practitioners as a helpful complement to traditional
analysis techniques. Despite its usefulness to understand normal work, its varieties, and the variability of
a system’s performance, FRAM may not be optimal for tactical risk assessments during high tempo
operations (e.g., flight risk assessment tools, flight operations dispatch) or in (very) small organisations.
Nevertheless, creating or amending a FRAM model and any instantiation typically generates a wealth of
information on the inner workings of a system. This is particularly relevant for complex sociotechnical
systems, as traditional methodologies provide very little to no modelling of emergent system behaviours.

ICAO guidance on FRAM (v.1.0, 2024) 13

 4. Additional information

4.a) Abbreviations

Abbreviations Meaning Notes

FMI FRAM Model Interpreter
FMV FRAM Model Visualizer
FRAM Functional Resonance Analysis Method
WAD Work-as-Done See also 1.d
WAI Work-as-Imagined See also 1.d
WW2 World War 2
Table 3 - Abbreviations

4.b) Literature, references

Diop, I., Abdulnour, G., Komljenovic, D. (2022). The Functional Resonance Analysis Method: A Performance Appraisal
Tool for Risk Assessment and Accident Investigation in Complex and Dynamic Socio-Technical Systems. American
Journal of Industrial and Business Management. Issue 12(02). 195-230

FRAM Website: https://functionalresonance.com/

FRAMily Meetings: https://functionalresonance.com/framily-meetings/

FRAMsynt contact: sensei@functionalresonance.com

GitHub (community software and manuals, open-source code, support): https://github.com/functionalresonance

Hollnagel, E. (2018). FRAM - the Functional Resonance Analysis Method; A brief guide on how to use the FRAM.

Hollnagel, E. (2012). FRAM - the Functional Resonance Analysis Method; modelling complex socio-technical systems.
Ashgate Publishing Ltd.

Hollnagel, E. (2014). Safety-I and Safety-II. The past and future of safety management. Ashgate Publishing Ltd.

Hollnagel, E., Hounsgaard, J., Colligan, L. (2014). FRAM – the Functional Resonance Analysis Method - A handbook for
the practical use of the method. Center for Quality, Southern Region of Denmark.

Hollnagel, E. (2021). The FRAM Model Interpreter. Retrieved from:

https://safetysynthesis.com/onewebmedia/FMI_Plus_V2-1.pdf

Hulme, A., Stanton, N.A., Walker, G.H., Waterson, P., Salmon, P.M. (2019). What do applications of systems thinking
accident analysis methods tell us about accident causation? A systematic review of applications between 1990 and
2018. Safety Science. Volume 117.
Lino, S., Nomoto, H., Hirose, T., Michiura, Y., Ohama, Y., Harigae, M. (2023). Revealing success factors of cooperative
operations in space manned missions: crucial factors in Apollo missions. FRAMily 2023, Copenhagen.

MacKinnon, R., et al, (2023), MacKinnon, R., Barnaby, J., et al. (2023). Adding Resilience to Hospital Bed Allocation,
using FRAM. Medical Research Archives. https://doi.org/10.18103/mra.v11i10.4265.

Nomoto, H., et al. (2023). Machine Learning in FRAM. FRAMily 2023, Copenhagen. Retrieved from:
https://functionalresonance.com/framily-meetings/FRAMily2023/Presentations/MLforFRAM.pdf

ICAO guidance on FRAM (v.1.0, 2024) 14

Patriarca, R., Di Gravio, G., Costantino, F. (2017). A Monte Carlo evolution of the Functional Resonance Analysis
Method (FRAM) to assess performance variability in complex systems. Safety Science, Volume 91.

Patriarca, R., Di Gravio, G., Woltjer, R., Costantino, F., Prætorius, G., Ferreira, P., Hollnagel, E. (2020). Framing the
FRAM: a literature review on the functional resonance analysis method. Safety Science. Volume 129.

Resilience Engineering Association website: https://www.resilience-engineering-association.org

Shorrock, S. (2016). The varieties of human work. Retrieved from: https://humanisticsystems.com/2016/12/05/the-

varieties-of-human-work/

Slater, D., Hollnagel, E., Hill, R., Nomoto, H., Patriarca, R., Smith, R., Adriaensen, A., MacKinnon, R., Hirose, T. (2023).
FRAM: the development of the complex system analysis methodology. Retrieved from:
https://www.researchgate.net/publication/372079036_FRAM_The_Development_of_the_Complex_System_Analysi
s_Methodology

Slater, D., et al. (2021). Optimising the Performance of Complex Sociotechnical Systems in High-Stress, High-Speed
Environments: The Formula 1 Pit-Stop Test Case. Applied Science. Issue 11.

Tian, W., Caponecchia, C. (2020). Using the Functional Resonance Analysis Method (FRAM) in aviation safety: a
systematic review. Journal of Advanced Transportation. Volume 2020. Article ID 8898903.

ICAO guidance on FRAM (v.1.0, 2024) 15

 APPENDICES

Appendix 1 – Simple FRAM model of an aircraft take-off

T C
T C

To prepare to
I O
take-off I To climb O

P R
T C Rota te P R
Clearance Aircraft
required airborne
T C
T C To give
I O
call-ou ts
V1
To request I To rotate O
I clearance O Set take off
for take-off P R thrust

P R
Run commenced
P R T C
Vr speed reache d

Prepare for
take-off To commence
Cleared for I O
take-off run T C
take-off
Run commenced
T C T C
Checklist Engine thrusting
comple te P R To
I O
To complete accelerate
"Before T C Set engin e
I O I thru st for O
take-off "
checklist Prepare for takeoff
To perform take-off P R
I the take-off O
P R procedure P R

P R

Figure 3 – Simple FRAM model of the functions needed for a “generic” take-off, and the couplings between them.

ICAO guidance on FRAM (v.1.0, 2024) 16

Appendix 2 – Examples of studies using FRAM in aviation

Area studied Cases / systems studied Instantiation types Research types

• American Airlines AAL965
• Alaska Airlines ASA261
• Comair flight 5191 Qualitative,
Accident or incident Accidents
• Norwegian Air NAX541 semiquantitative
• Mid-air collision (GL1907 and N600XL)
• Ground collision (SAS686 and D-IEVX)
• Aircraft route change
• Air Transport System
• AUTOPACE project
• ERASMUS project Accident, Qualitative,
Air Traffic Management
• MSAW system Normal operations semiquantitative
• Transfers between ACC and APC units
• Ground collision (USA1493 and
SKW569)
• Landing process
• Weather radar interactive process Qualitative,
Cockpit operation Normal operations
• Airliner approach and landing semiquantitative
• Light sport aircraft take-off
Maintenance • Aircraft maintenance Accident Qualitative
• Operation Control system (OCC)
Airline operations • Ground handling services Normal operations Qualitative
• Large aircraft flight operations
Table 4 – Studies using FRAM in aviation from 2006 to 2019, adapted from Tian and Caponecchia (2020)

ICAO guidance on FRAM (v.1.0, 2024) 17