The Analytic Functional Resonance Analysis to Improve Safety Management

1. Introduction

Although over the years, industrial plants have improved their safety management processes, it is evident that safety systems need to be further improved [1]. This need is underlined by the many accidents that have occurred in industrial plants over recent years, arising from human causes, technical causes, or natural causes. Traditional safety management models are designed to identify negative factors and develop systems to mitigate their impact. These models allow to analyze different critical situations, but they seem ineffective for today’s business needs [2]. Particularly, in modern industrial plants, only a few functions are independent of each other. Thus, analyzing them individually may not be the best model. In general, due to the complexity of the systems it is necessary to analyze all functions and tasks. In this perspective, Resilience Engineering (RE) is a useful approach to manage complex systems. This approach is a new way to think about safety and risk management [3]. Unlike the classic risk management approaches that are based on the analysis of a posteriori causes by adopting a linear cause-and-effect approach, the RE adopts a perspective that refers to the theory of complexity. RE aims to revise the analysis models to create processes that are flexible and robust. Functional Resonance Analysis Method (FRAM) proposed by Hollnagel defines complex systems through their functions and studies the interactions between these functions [4]. The main strengthof FRAM method is based on the principle that a variation in the conditions in which an action takes place can lead to improvementsor worseningthat ultimately lead to its success or failure. However, this approach leads to a qualitative resultaimed at highlighting how multiple variables combined can change the outcome of an action in a dynamic environment. The points in favor of this method and of resilience engineering are evident, but they still pose obstacles, sometimes even technical ones to overcome.

Thus, in the present research the FRAM method is used in conjunction with Analytic Hierarchy Process (AHP) to overcome the limits of the FRAM. AHP is a well-known multi-criteria decision support technique developed in the 1970s by the Prof. Thomas L. Saaty [5]. The proposed model overcomes the qualitative limits of the resilience engineering models proposed in the literature. The AHP helps to assess the subjective probability of an event or trigger cause. Furthermore, through the integration of the AHP it allows to evaluate the strength of relationship between the variability of human performance and influence of the external environment. The preset study is a pilot research. The proposed process will be tested in other situations and industrial settings. In fact, the model is extremely flexible and can be applied in different scenario.

The rest of the paper is organized as follows. Section 2 presents a general overview on resilience engineering approach and a brief state of art. Section 3 describes the proposed model based on FRAM and AHP. Section 4 describes a real case study in a petrochemical industry and its results. Finally, in Section 5 conclusion of the proposed “model” and the future research are summarized.

2. General overview on resilience engineering approach

Resilience Engineering (RE) is a multidisciplinary field of study dealing with safety in complex systems that have several interdependent elements from an economic, human, and social point of view [6]. RE is the intrinsic ability of a system to modify its functioning before, during and following a change or disruption, in order to be able to continue the necessary operations both under foreseen and unforeseen conditions [7]. In general, safety is defined as a condition that minimizes the number of negative outcomes. Thus, it is possible to understand the functioning of a system by analyzing its parts. Therefore, in this view the aim is to reduce the number of accidents by reducing their causes. This is the so-called Safety I. In opposition to this vision was developed Safety II. This approach not only focuses on adverse events, but also analyzes everyday work situations in which things are going well [8]. In this perspective, safety is defined positively as an effective daily operating situation, rather than negatively as the absence of accidents. Unlike the classic risk analysis and risk management approaches that are based on the analysis of a posteriori causes by adopting a linear cause-and-effect approach, the RE adopts a perspective that refers to the Theory of complexity[9]. It aims to revise the analysis models to create processes that are flexible and robust Therefore, for the RE, risk management is not aimed at reducing sources of risk, but at strengthening the ability to reduce the variability of performance both in expected and unexpected conditions [10]. In this context, Functional Resonance is a characteristic of a complex system that explains how serious consequences can arise from small variations in the performance of its parts or the environmental conditions in which it operates [11]. The Functional Resonance Analysis Method (FRAM) is a recent method developed to explore how functional variability affects the overall system [12]. An investigation on the SCOPUS, one of the most accredited databases in the scientific community (Scopus is updated periodically and offers around 25,000 articles from more than 5000 international publishers), pointed out that 47 documents have been published from 2010 to 2020. The search query used on Scopus was (TITLE-ABS-KEY (resilience AND engineering) AND TITLE-ABS-KEY (functional AND resonance AND analysis AND method)). the survey result includes only articles in which the string was found in 1) title, or in 2) abstract or in 3) key words. As can be seen from Figure 1 there is a growing interest in this topic. It is interesting to note that there are no publications on Scopus before 2010. This means that it is a new and promising topic.

A country where there is greater scientific interest is Italy (27,6%), followed by Brazil (17%), as it is shown in Figure 2. The publications are mostly articles published in international journals (63,8%) and conference paper (31,9%). Furthermore, the survey pointed out that most of the research is in the engineering area (36,3%) as shown in Figure 3.

A recent study developed by Patriarca et al. [13] highlighted that aviation is by far the most investigated domain with the FRAM with a percentage equal to 24,87%. This is not a surprising result since FRAM was developed in the aeronautical field. Other emerging sectors are healthcare (13,99%) and industrial operations (12,44%) as demonstrated by several publications [14, 15, 16]. Furthermore, some authors pointed out that FRAM does not assess the human behavior and the human performance to analyze the human error [17, 18].

Other publications demonstrated how FRAM is a qualitative approach for accident, risk and system analysis and it does not support quantification [19, 20, 21]. Definitely, FRAM is a qualitative method. Furthermore, it does not support quantification. To overcome this issue, FRAM is used together with the Analytic Hierarchy Process (AHP). Thus, it is possible to measure the subjectivity in establishing the potential variability of functions as suggested by Rosa et al. [22]. The integration of FRAM-AHP is proposed also in other two works. Both applied the hybrid to evaluate construction sustainability [23, 24].

3. Materials and methods

3.1 Functional resonance analysis method (FRAM)

FRAM methodology aims to analyze how the variability of one or more functions can be combined between them and how to prevent their resonance, which could lead to unwanted results [25]. For this purpose, FRAM method studies the system first under normal conditions, after FRAM analyzes the variability that cause to the event unwanted. The aim is obviously to be able to issue recommendations that prevent the repetition of the event. FRAM consists of four steps: 1) Identify system functions; 2) Characterize the potential variability of the functions; 4) Determine the dependencies among functions and 4) Monitor the variability. Some more details about each step are provided below [26].

Step#1 “Identification of the essential functions”.The present step aims to identify the functions or the specific action that are needed to carry out a specific task [27]. Each function is described using the six aspects (as shown in Figure 4): INPUT (I); OUTPUT (O); TIME (T); CONTROL (C); PRECONDITIONS (P) and RESOURCES (R). Functions can have links to each other. They can typically have multiple links and dependencies. From a practical point of view, to represent the variability it is possible to use the FRAM Model Visualiser(FMV). FMV allow to build a graphical representation of a FRAM model.

Step#2 “Identification of variability”.The present step identifies the variability of functions in order to understand how functions can become coupled and how this can lead to unexpected outcomes [28]. The FRAM assume that there are characteristic differences in the variability of technological functions (T), of human functions (M), and of organizational functions (O).

Step#3 “Aggregation of variability and define functional resonance”.This step aims to analyze the variability of functions and how they interacted with each other [29]. The variability of a function depends on couplings among functions. It is not enough to evaluate the variability for the single function. It is necessary to understand how variability can be combined. This is achieved using the upstream-downstream functional coupling. The variability of the function can be the result of couplings of upstream functions that influence downstream functions. Each upstream variable can be connected to its downstream variable using the 5 available inputs (showed in Figure 4). Depending on the type of connection, different variability occurs (see Table 1 as example).

Output variability of upstream function		Possible effects on downstream function
Time	Too early	False start (V+)
		Possible damping (V-)
	In time	Possible damping (V-)
	Too late	Delayed activities (V+)
	Omission	Start imprecision (V+)
Accuracy	Inaccurate	Waste of time (V+)
	Acceptable	No change (V=)
	Accurate	Possible damping (V-)

Table 1.

Example of aggregation of functions (output – input).

Step#4 “Monitor and manage the variability”.The step aims to propose ways to manage the possible occurrences of uncontrolled performance variability – or possible conditions of functional resonance – that have been found by the preceding steps [30]. The purpose is to find critical combinations and reinforce the barriers. The problems of complex systems cannot be eliminated, eliminating the variability of the performances, because this is essential to ensure the reliability of the systems. A sensitivity analysis is performed to evaluate different solutions.

3.2 Analytic hierarchy model

The main feature of Analytic Hierarchy Process (AHP) is to break down a decision-making problem in a hierarchy [31]. AHP uses a mathematical approach based on matrix algebra to “measure” decisions [32]. AHP is characterized by three main phases as described below.

Phase #1 “Define hierarchy”.The aim of the first step is to define the goal and the hierarchy of the decision problem. The decision maker or the experts team identifies a set of criteria for evaluating the ndecision alternatives and assigns a percentage weight to each criterion; then assigns a score that is the impact of the criterion on the decision. The score of each decision alternative is the weighted average of the scores of each criterion on the decision by the weight assigned to each criterion. The top of hierarchy represents the goal of the decision problem. Lower levels represent criteria and sub-criteria in which the decision-making model is broken down. The bottom level represents all alternatives to evaluate in terms of the criteria [33].

Phase #2 “Perform pairwise comparison and relative weight estimation”.After defining the hierarchy, the criteria are compared in pairs, the sub criteria and alternatives are compared in pairs by assigning a score of relative importance to the other. The sum of the weights must be 100%. Saaty suggested an increasing scale of values form 1 (equal importance) to 9 (extreme importance) when comparing two components [34]. The result of the comparison is the so-called dominance coefficienta_ij that represents the relative importance of the component on row (i) over the component on column (j), i.e., a_ij = w_i/w_j.The pairwise comparisons can be represented in the form of a square matrix (n x n), symmetric and diagonal. The number of pairwise comparisons grows quadratically with the number of criteria and alternatives. The score of 1 represents equal importance of two components and 9 represents extreme importance of the component i over the component j. [35].

Phase#3 “Perform consistency index”.Saaty (1990) proposed utilizing consistency index (CI) to verify the consistency of the comparison matrix [36]. The CI could then be calculated by: CI = (λ_max − n)/n − 1. In general, if CI is less than 0.10, satisfaction of judgments may be derived. Figure 5 shows a summary of the main steps and phases of the study.

4. Scenario modeling: a case study on a petrochemical plant

The model was applied in a real case study concerning the management of an emergency in a petrochemical company (see Figure 6). The plant consists of process and service plants. Plant processes include: Predistillation unit; Propane unit; Distillation unit; Catalytic hydrogenation unit and Diesel oil purification. While service facilities include: Diathermic oil system; Steam and hot water production unit; Refinery torch; Hydrogen production unit; Cooling water system and Refinery storage area. The plant preserves extremely dangerous substances in quantities equal to or greater than the limits. Thus, it is a plant with a high risk activity, where it is necessary to analyze all the deviations from the operating standards (emergency conditions) such as: gas leakage, hydrocarbon release, fire, earthquake, flood, sabotage, pollution, etc.

STEP#1 “Identification of the Essential Functions”.The case study analyzes the emergency generated by the loss of propanegas during the transfer from tanker to tank. The goalof the model was to evaluate the variability of performance between upstream activities and downstream activities. An expert teamwas formed. The expert team consisted of 1 safety manager, 1 AHP expert, 1 chemical engineer, 1 mechanical engineering and 1 risk manager. The expert team analyzed the scenario and summarized the main activities are carried out during emptying the propane from the vehicle and placing it in the treatment plant. In fact, propane is a very dangerous hydrocarbon as the compound appears as a colorless and odorless gas, which can however be easily liquefied by compression and therefore highly flammable. Table 2 describes the activities carried out during the emergency and the responsibilities.

Figure 7 shows the FRAM of the emergency management activity. FRAM Model Visualiser (FMV) was used to create a graphical representation of a FRAM model ((https://functionalresonance.com/FMV/index.html).

STEP#2 “Identification of variability”. In the second step the variability of the functions was characterized and highlighted in red inFigure 7. In the scenario analysis, thehuman functionsrevealed more criticality, which could present different variability. In particular, the analysis focused on two main activities and related emergency scenarios:

• Scenario A“activate ESD control”;

• Scenario B“activate hydro-foam cannon”.

According to the analysis, the expert teamcharacterized the environmental conditions in which the operators work. Historically, human performance is investigated through specific performance shaping factors(PSFs), as described below:

• PSF#1 Training and Experience. It refers to the experience and training of the operator(s) involved in the task.

• PSF#2 Procedures and Administrative Controls. It refers to the existence and use of formal operating procedures.

• PSF#3 Ergonomics and Human Machine Interaction. It refers to the adequacy or inadequacy of machine (i.e. computer).

• PSF#4 Time Available. It refers to the adequacy or inadequacy of the time available to complete a task.

• PSF#5 Complexity. It refers to the difficult of the task to perform (simple, easy, difficult, very difficult, difficult beyond standards).

• PSF#6 Workload, Stress and Stressors. It refers to mental stress or excessive workload.

• PSF#7 Work Processes. It refers to the adequacy or inadequacy of safety culture, management policies/support, etc.

STEP#3 “Aggregation of variability and definition of functional resonance”.The AHP hierarchical structure created for characterizing the variability and define functional resonance is shown in Figure 8. AHP model was created using Super Decision Software (http://www.superdecisions.com/). When two items of the “Performance Shape Factor” level are compared with respect to the main goal, the expert answers the question “Which PSF is more important?”. The AHP helps to assess the subjective probability of an event or trigger cause.

Table 3 summarized the weights of variability in which operators are involved according to PSFs. The weights of the factors are defined through AHP. More specifically, it emerges that PSF#1, PSF#4 and PSF#6 present a higher probability of occurrence.

A graphic representation of Table 3 is shown in Figure 9.

Furthermore, the AHP model allows to define the probability of occurrence of the most critical scenario or, as the results show in Figure 10, the most critical scenario is scenario B: Scenario A (47%%) and Scenario B (53%).

STEP#4 “Monitor and manage the variability”.From the numerical analysis FRAM emerges a critical value (considering the values shown in table n) for the “activate hydro-foam cannon” function which must be analyzed to limit its variability, which affects the downstream variable. While the “Activate ESD control” function presents a lower variability.

Considering the most critical PSF or PSF#1 a sensitivity analysis was performed to evaluate the variability of this factor and the robustness of the model. As shown in Figure 11 it emerges that if the vertical line is at 0.5 shows the scenario A is more likely. For any PSFs greater than that, the Scenario B is the more likely.

The general result or PSF#1 highlights that Training and Experienceis a critical point. It is an unsurprising result. In fact, it is clear that training is essential to taught workers to manage complex scenarios at achieving those skills that allow them to work both by reducing risks and protecting personal and community safety. Safety training is the only “measure” that can be validly opposed to situations of residual risk.

5. Conclusions

This is a pilot study that is based on the awareness that the increasingly complexity of industrial plants and the need to analyze safety systems lead researchers to develop new methodological approach. In the present research the main gap of the qualitative approach of FRAM method was overcome with the integration of a multi-criteria decision-making method. The research proposes the integration of the traditional FRAM method with AHP. The integration of AHP with FRAM allows to investigate a new perspective in the field of risk management. The model was applied in a real case study to evaluate the performance of emergency operations in a petrochemical company. Considering the variability of each system function, the research numerically shows the level of variability generated by an upstream function on a downstream function. The results obtained are aimed at identifying function couplings that could generate high variability. Future development of research is the integration technological and organizational aspects, beyond human ones. Moreover, the model can be applied in different socio-technical systems where a high level of complexity requires the use of innovative tools. Thus, the proposed model will be tested in other situations or industrial settings.

Conflict of interest

The authors declare no conflict of interest.