448
2 BACKGROUND
Ashippingoperationisasocio‐technicalsystemthat
requires many combinations of social and technical
factors to be managed to succeed. There has been a
movementtowardsadaptiveapproachestosafety to
help manage such systems (Borys et al., 2009). This
approachreliesonnotonlymodeling
theelementsin
the system, but the relationships in the system, eg.
how elements interact together (Vicente, 2004).
Becauseofthisshiftinthinking,othertechniques are
being adopted from resilience engineering to help
managecomplexsystemsaswell(Ayyub,2015,2014;
Hollnageletal.,2006).
Additionally,thereisacceptance
thatmanyofthe
conditionsthat operationsare beingsubjectedto are
sodynamicthatitisverydifficulttoprescribeasingle
safetyprotocolto managethem.The Society ofRisk
Analyst’srecentreviewstatesthatinthesecasesitis
bettertohaveadynamicsetofsolutionsto
adaptto
thesedynamicconditions(Avenetal.,2015).Safetyis
then approached by understanding how to best
monitorareasofthesystemandhowtocontrolthem:
inotherwords, by designing systemsthatadapt(or
maintain control) when subjected to dynamic
conditions.
Thereare anumber ofmethods
thatarefounded
on adaptive safety methodologies: the Functional
Resonance Analysis Method (FRAM), Systems‐
Technical Accident Model and Processes (STAMP),
and Human‐Tech approach (Hollnagel, 2012;
Leveson, 2004; Vicente, 2004, respectively). Each
method has the potential to improve safety by
incorporatingsystemsthinkingintothe approach.In
this paper the FRAM
is used to perform an
investigation of ship navigation in the Arctic. The
FRAM was chosen for two reasons: 1) it focuses on
functionality, and 2) it promotes communication
between assessors and workers. To understand
functionality, you must understand the conditions
thatcanbeoperatedin,andtheconditionsthat
cause
problems.Thismeansthataccidenteventsshouldnot
be isolatedfrom thetypicaloperationaloutcomes to
develop understanding of accident mechanisms. By
isolating the accidents, biases may enter the
interpretations of events. Safety solutions should
show consideration of both the event(s) one would
like to prevent and promotion of the
event(s) one
would like to achieve. When understanding
functionality, it is best to obtain an understanding
from the operational perspective. This concept
promotesunderstandingtheworkasitisdone,rather
than as it is imagined by assessors. This can help
reduce the communication gap that exists between
assessors and
operators, thereby, promoting safety
solutionsthataregroundedinreality.
2.1 FRAM
The FRAM is built on identifying functional
resonance. Functional resonance is an analogy to
stochastic resonance, where multiple signals of low
amplitude noise are inputted to a system and, if
resonanceoccurs,theoverallsystemsignalcanhavea
muchgreateramplitude.Infunctionalresonance,the
outputofthesystemfunctionsarevariableandslight
variations between the many functions in a system
have the potential to combine in such a way that
resonance occurs. The resonance will be some
variationoftheoverallsystemperformancethatgoes
beyond
what is typical or expected, regardless of
whether the outcome is viewed as good or bad. By
modeling the system functions and variability in
sufficient detail, safety solutions will emerge that
focusonmonitoringandcontrollingthesystem.
TheFRAMisbasedonfourunderlyingprinciples
(Hollnagel,2012):
Failures and
successes are equivalent in the way
that they happen for the same reason.
Alternatively,itcanbesaidthatthingsgowrong
forthesamereasonsthattheygoright.
Daily performance of socio‐technical systems,
includinghumansindividuallyandcollectively,is
alwaysadjustedtomatchthesystemconditions.
Many of the outcomes of the system that we
notice, and also the ones we don’t notice, are
emergentratherthanresultant.
Relationsanddependenciesmustbedescribedas
they develop in a particular situation and not as
cause‐effectlinks.Thisisdonethroughfunctional
resonance.
The first
step of the FRAM is to describe the
functions of the system and the aspects of the
functions that occur when work happens. Each
functioncanhave6aspectsthatshouldbeconsidered,
asseeninFigure1.
Output:Eachfunctionshouldhaveanoutput(s).If
work is being done
there should be something
producedbythe work. Theoutputsare thenpassed
throughoutthesystemand have theability to affect
otherworkinthesystemin5possibleways.
1 Input:Theinputstartsthefunctions.Iftheinputis
anoutputthatarriveslatefromanotherfunction,it
will affect the functionality of the downstream
function.
2 Preconditions: Preconditions must be available
prior to the function starting, but they do not
initiatethefunction.Theycanlaydormantinthe
systemuntilthefunctionbegins.
3 Resources: These are things that are processed
during the function. To limit
the resources that
considered, focus should be placed on resources
that are consumed and subsequently need to be
resupplied by another function in the system.
Resources such as computers, which are not
consumed, should not considered here. They
would be considered as execution conditions,
which can be assessed when understanding the
functionitself.
4 Time:Otherfunctionaloutputshavethepotential
toaffecttheavailabletimetocarryoutafunction.
5 Control: Other functions may interact with
downstream functions in a way that acts as a
control.
After the system functions and aspects are
described at some level of detail.
The variability
should be considered. Step 2 considers the internal
variabilityofthefunctionandthevarietyofwaysan
output can be produced under dynamic conditions.
Step3assessesthecoupledsystemvariability,which
isthewaythevariationsfromupstreamfunctionscan
affect the downstream functions, and in turn
the