Accident models and analysis methods affect what accident investigators look for, which contributory factors are found, and which recommendations are issued. This paper contrasts the Sequentially Timed Events Plotting (STEP) method and the Functional Resonance Analysis Method (FRAM) for accident analysis and modelling. The main issue addressed in this paper is the comparison of the established multi-linear method STEP with the new systemic method FRAM and which new insights the latter provides for accident analysis in comparison to the former established multi-linear method. Since STEP and FRAM are based on a different understandings of the nature of accidents, the comparison of the methods focuses on what we can learn from both methods, how, when, and why to apply them. The main finding is that STEP helps to illustrate what happened, involving which actors at what time, whereas FRAM illustrates the dynamic interactions within socio-technical systems and lets the analyst understand the how and why by describing non-linear dependencies, performance conditions, variability, and their resonance across functions.

Modern airliner operations consist of an environment with multiple detailed procedures to cover critical abnormal events and with systems that are automated and highly reliable. Complex and unexpected events are rare and may thus present a challenge to the crew to deal with, putting demands on the resilience of the crew. In the EU Man4Gen project a “flexible procedure” was developed as a strategy to assist flight crew in dealing with unexpected events where an existing procedure was not available. This procedure is intended to assist crews in adapting their response to the situation and be more flexible in their application of their procedures and training to increase the effectiveness of their response. This paper describes the procedure and its development within the project based on two sets of flight simulator experiments with operational flight crew. The resulting flexible procedure consists of steps to help crews manage time criticality, manage (un)certainty and finally to plan for contingencies and changes. This forms the basis of the discussion of how procedures can be a source of resilience in the cockpit, rather than forming a barrier to it.

Accident models and analysis methods affect what accident investigators look for, which contributing factors are found, and which recommendations are issued. This paper contrasts the Sequentially Timed Events Plotting (STEP) method and the Functional Resonance Analysis Method (FRAM) for accident analysis and modelling. The main issues addressed in this paper are comparing the established multi-linear method (STEP) with the systemic method (FRAM) and evaluating which new insights the latter systemic method provides for accident analysis in comparison to the former established multi-linear method. Since STEP and FRAM are based on a different understandings of the nature of accidents, the comparison of the methods focuses on what we can learn from both methods, how, when, and why to apply them. The main finding is that STEP helps to illustrate what happened, whereas FRAM illustrates the dynamic interactions within socio-technical systems and lets the analyst understand the how and why by describing non-linear dependencies, performance conditions, variability, and their resonance across functions.

This paper gives an overview and evaluation of the predictive use of the Functional Resonance Accident Model, FRAM (Hollnagel, 2004), a method that is under development and in line with the theoretical framework of Resilience Engineering (Hollnagel et al. 2006). FRAM is based on the premise that both negative and positive events can result from (expected and unexpected) combinations of the variability in the normal performance of complex socio-technical systems. FRAM was used as a qualitative risk assessment method in a nuclear power plant. The process assessed was the transportation of an 80 ton heavy metal cylinder for transportation of used fuel. The study focused on the transportation of the cylinder inside the power plant and in particular the 40 meter lift that is needed to get the cylinder up into the reactor hall. The FRAM analysis was used to propose recommendations at different levels, such as how to improve human-machine interface issues, procedures, information dissemination within the organization, and government guidelines. 

Managing complexity and uncertainty in high risk, socio-technical, systems requires people to continuously adapt. Designing resilient systems that support adaptive behaviour requires a deepened understanding of the context in which the adaptations take place, enablers for successful adaptations and their affect the overall system. Also, it requires a focus on how people actually perform, not how they are presumed to perform according to textbook situations. We propose a framework to analyse adaptive behaviour in everyday situations where systems are working near the margins of safety. The examples that underlie the framework are derived from nine focus groups with representatives working with safety related issues in different work domains, including health care, nuclear, transportation and emergency services. Further, the variety space diagram is developed as a means to illustrate how system variability, disturbances and constraints affect work performance.

The pilot’s task in commercial aircraft operations has changed from flying the aircraft by means of manual control, to increased monitoring of the cockpit. The increase of automation provides a high level of stability and reduces variations and disturbances, leaving crews with little exposure to surprise. Current training programs are similarly focused on dealing with anticipated problems and pre-determined responses, provide little opportunity to prepare for the unexpected and unforeseen. In this paper we frame the research agenda for investigating how pilots cope with surprise and confusion in modern aircraft. An interview study with pilots has been carried out, identifying areas for further investigation regarding manual control, procedure applicability, system knowledge and training for unexpected events. A crew-aircraft control model has been developed to frame the functions and processes to be further investigated.1

This thesis has shown that the concept of constraint management is instrumental in understanding the domains of command and control and aviation safety. Particularly, functional modeling as a means to address constraint management provides a basis for analyzing the performance of socio-technical systems. In addition to the theoretical underpinnings, six studies are presented.

          First, a functional analysis of an exercise conducted by a team of electricity network emergency managers is used to show that a team function taxonomy can be used to analyze the mapping between team tasks and information and communication technology to assess training needs for performance improvement. Second, an analysis of a fire-fighting emergency management simulation is used to show that functional modeling and visualization of constraints can describe behavior vis-à-vis constraints and inform decision support design. Third, analysis of a simulated adversarial command and control task reveals that functional modeling may be used to describe and facilitate constraint management (constraining the adversary and avoiding being constrained by the adversary).

          Studies four and five address the domain of civil aviation safety. The analysis of functional resonance is applied to an incident in study four and an accident in study five, based on investigation reports. These studies extend the functional resonance analysis method and accident model. The sixth study documents the utility of this functional modeling approach for risk assessment by evaluating proposed automation for air traffic control, based on observations, interviews, and experimental data.

          In sum, this thesis adds conceptual tools and modeling methods to the cognitive systems engineering discipline that can be used to tackle problems of training environment design, decision support, incident and accident analysis, and risk assessment.

Understanding how joint systems of people and artifacts perform goal-directed action in a dynamic environment is essential for improving and supporting work. The literature on cognitive systems engineering and its related disciplines identifies the concept of constraint as an essential element in the analysis of systems in dynamic environments. These disciplines however offer differing definitions and ascribe different roles to constraints in (cognitive) systems analysis. This thesis distills from these perspectives on constraints the hypothesis that constraints shape action. It investigates empirically how constraints shape action in studies of two domains characterized by dynamic environments: driving and command and control.

The first study investigates the effect of the constraint of path width on steering behavior. It reviews research on the "law of steering"- the quantitative relationship between human temporal performance and the spatial characteristics of the movement path. It then extends the study of the law of steering to driving in virtual environments, within the field of human-computer interaction. Participants drove a virtual vehicle in a virtual environment on paths whose shape and width were systematically manipulated. Results showed that the law of steering indeed applies to locomotion in virtual environments. On average both the mean and the maximum speeds of the participants were linearly proportional to path width. Such regularity in human performance provides a quantitative tool for (3D) human machine interface design and evaluation.

The second study describes a method for the recognition of constraints in network-based command and control, and illustrates its application in an experimental study in a command and control microworld. The method uses goals-means task analysis to extract the essential variables that describe the behavior of a command and control team. It juxtaposes these variables in state space representations illustrating constraints and regions for opportunities for action. A series of examples shows how state spaces plots of experimental data can aid in the description of behavior vis-a-vis spatial and temporal resource constraints, and discusses how state space representations may be used to improve control in network-based command and control settings.

Both practitioners and scholars with an interest in Resilience Engineering have expressed the need for model- or process-based methods for the assessment of resilience. This paper explores the potential of the Functional Resonance Analysis Method (FRAM; Hollnagel, 2004) to address five key resilience characteristics (buffering capacity, flexibility, margin, tolerance, and cross-scale interactions, as identified by Woods, 2006). Application of FRAM to the Alaska Airlines flight 261 accident and application and evaluation of these resilience characteristics to the functional model shows that FRAM to some extent allows for resilience assessment through these characteristics. Moreover, FRAM-based assessment of resilience challenges the description and definition of these characteristics and enables to ask some specific questions that further develop their assessment.

On January 31, 2000, Alaska Airlines flight 261, an MD-83, crashed into the Pacific Ocean; after airplane pitch control was lost as a result of the in-flight failure of the horizontal stabilizer trim system jackscrew assembly's acme nut threads (NTSB, 2003). Accident investigation revealed a wide range of human, technical, and organizational factors contributing to this tragic event, providing a case where popular linear models and methods have difficulty addressing the full complexity of the processes leading up to the accident. This paper treats each of the steps of analysis according to the Functional Resonance Accident Model (FRAM; Hollnagel, 2004), a systemic non-linear modeling method, and discusses how functional resonance occurred through the variability in functions performed by joint human, technical, and organizational systems. It thereby aims to facilitate a better understanding of how functional variability in design, certification, limited and inadequate maintenance, negligent safety culture, economic factors, and human performance together can resonate and contribute to accidents. In this way it aims to contribute to accident prevention and the engineering of more resilient complex dynamic systems.

Resilience Engineering is a new approach to safety and risk management. Whereas conventional approaches to system safety are dominated by hindsight and emphasize error tabulation and probabilistic risk analysis, Resilience Engineering emphasizes an organisations ability to adjust its functioning, prior to or following changes and disturbances, so that it can sustain operations even after a major mishap or in the presence of continuous stress.

A common description of a resilient system is a system that has:

• the ability to respond, quickly and efficiently, to regular disturbances and threats,
• the ability to monitor continuously for irregular disturbances and threats, and to revise the basis for monitoring when needed, and
• the ability to anticipate future changes in the environment that may affect the system’s ability to function, and the willingness to prepare against these changes even if the outcome is uncertain.

Resilience engineering provides the methods by which a system’s resilience can be gauged or measured, and the means by which a system’s resilience can be improved. Resilience has for many decades proven to be a useful construct in analyzing the persistence, stability and flexibility of ecological systems.

The Resilience Engineering workshop is organised by the Cognitive Systems Engineering Laboratory at the Department of Computer and Information Science, Linköping University. The workshop is an opportunity to discuss Resilience Engineering and its implications for research and practice in, among other disciplines, system safety, risk analysis, system design, and accident analysis

This paper addresses the roles of Information and Communication Technology (ICT) in training for effective emergency management and inter-organisational coordination. Collocation can encourage the development of common ground and trust and, in turn, result in greater efficiency and effectiveness. We expect to find communication and artefact use during collocated training that cannot readily transfer to the ICT used to link distributed work settings. This expectation makes the reliance on ICT and distributed work during emergency management operations suspect. To test these claims, we observed a large-scale, real-time exercise designed to facilitate cooperation among electricity and telecommunications companies. The exercise scenario was similar to the January 2005 windstorm that left much of southern Sweden without electricity or telephone service and revealed the need for better cooperation among utility providers. The observations suggest that while collocation is clearly beneficial, a mismatch in ICT use between collocated training and distributed emergency management operations is likely to be detrimental for preparedness.

The various models and simulations of automobile driving that have been suggested over time have differential explanatory and predictive power. Some address the processes within the driver, others have the joint system of driver and car as a unit of analysis. One of the particular limitations that is not well-addressed in these models is the prospect of semi-autonomy that currently emerges when technology enables the car to take over parts of the driving task. The utility of combined human-machine subsumption architectures in semi-autonomous wheelchair control suggests that the joint subsumption architecture has the potential to address the issue of semi-autonomy in motor vehicles generally. In order to address semi-autonomy in simulated driving, we have explored a joint subsumption model in a 2D top-down view driving simulation in which the human controller is a layer in a subsumption control architecture, extended with a behaviour coordination mechanism that combines simple command fusion with priority-based arbitration. Joint human-machine subsumption seems to be a useful architecture to conduct research concerning semi-autonomy. Several possibilities for future research are sketched.

A critical element to successful command and control (C²) is developing and updating an accurate and lucid model of the interdependencies between functional units, e.g., multiple platoons of artillery and tanks. Two of the challenges to this understanding are (1) the adoption of a detailed description of interdependency and the associated understanding of interdependent functions (Brehmer, 2007) and (2) the application of that description to both own and opponent forces’ opportunities and vulnerabilities to provide for agility (Alberts, 2007). This paper documents a straightforward approach to modeling functional interdependency that addresses these challenges. The Functional Resonance Analysis Method (FRAM; Hollnagel, 2004) is shown to describe the C² functions of the DOODA loop (Brehmer, 2007) and the tactical and operational functions of military activity. FRAM models are applied to own and opponent forces in a computer-based dynamic war-game (DKE) to reveal and characterize both agile and unsuccessful C² practice.

This paper describes a method for the recognition of constraints in network-based command and control, and illustrates its application in a command and control microworld. The method uses Hollnagel-s functional resonance analysis to extract the essential variables that describe the behavior of a command and control team. It juxtaposes these variables in state space plots that explicitly represent constraints and defines regions associated with alternative opportunities for action. Examples show how state space plots of experimental data can aid in the description of behavior vis-à-vis constraints. We discuss how state space representations could be used to improve control in network-based command and control settings.

This paper describes a method for the recognition of constraints in network-based command and control, and illustrates its application in an experimental study in a command and control microworld. The method uses goals-means test analysis to extract the essential variables that describe the behavior of a command and control team. It juxtaposes these variables in state space representations illustrating constraints and regions for opportunities for action. A series of examples shows how state spaces plots of experimental data can aid in the description of bavior vis-é-vis constraints, and discusses how state space representations may be used o improve control in network-based command and control settings.

In this paper, we describe how role-playing exercises can be used to strengthen the resilience of command and control systems in emergency management. Through role-playing exercises, the participants gain experience with adapting to changing demands and risk relative to challenges to their ability to predict future risk, adapt, and recover from harmful events. Role-playing exercises at the same time enable researchers to analyse how resilient behaviour emerges, or how the resilience of complex socio-technical systems may be improved. Two role-playing exercises, one concerning forest fire fighting, the other concerning power grid restoration, are discussed to illustrate these concepts.

This paper is concerned with simple human performance “laws of action” for three classes of tasks—pointing, crossing, and steering, as well as their applications in Virtual Reality research. In comparison to Fitts' law of pointing, the “law of steering”— the quantitative relationship between human temporal performance and the movement path's spatial characteristics—has been notably under investigated. After a review of research on the law of steering in different domains and time periods, we examine the applicability of the law of steering in a VR locomotion task. Participants drove a virtual vehicle in a virtual environment on paths whose shape and width were systematically manipulated. Results showed that the law of steering indeed applies to locomotion in Virtual Environments. Participants' mean trial completion times linearly correlated (r² between 0.985 and 0.999) with an index of difficulty quantified as path length to width ratio for the straight and circular paths used in this experiment. On average both the mean and the maximum speeds of the participants were linearly proportional to path width. Such human performance regularity provides a quantitative tool for 3D human-machine interface design and evaluation. We also propose to use the law-of-steering model in Virtual Reality manipulation tasks such as the “ring and wire” task in the future.