Case study: Timing is everything; FRAM for train departures

In this case study I would like to show a practical application of the Functional Resonance Analysis Method (FRAM) to investigate the process of trains departing the station. The reason for analyzing this process, is that Signal Passed At Danger (SPAD) incidents have a specific category that deals with situations where this incident happens just after leaving the station. So in that case, the first signal seen from the station platform is passed while it shows a red light instead of a green one. The analysis is done based upon the author’s knowledge, public knowledge and conversations with colleague safety professionals in the railway industry.

Process description

I started this assignment with the mental processing of the knowledge I have about this particular process. That boils down to the following (see Figure 1).

After a train stops alongside the platform, the doors open and the passengers can exit and enter the train. At the end of each platform, a white departure light is present that represents the start of the departure procedure. When the conductor sees the white light (2 in Figure 1), he knows he can start the departure procedure. He is then responsible for the safe and efficient closure of all the doors, the last of which is his door [1].

When all the doors are closed, the train driver is triggered by a bright light is his cabin; the doors closed signal (3 in Figure 1). The train driver then has to check if the train track STS signal [2] has turned into green (instead of red), indicating that he can safely depart using the track he is on (1 in Figure 1). He can then commence the next leg in his journey. Both the departure light and the train track STS signal are activated by the automatic signaling system which is driven in time by the overall train timetable. Furthermore the conductor uses a departure procedure to conduct his checks just before departure.

Figure 1 – Departure procedure for trains (thanks to Rob Hoitsma for this picture!)

Introduction to FRAM

FRAM is a method for analyzing socio-technical systems. It uses the concept of functions and their interactions to gain insight into a process. The focus is on the way work is done in practice and the resonance arising from the variability of everyday performance. Figure 2 shows a short description of the aspects of a function. More information can be found on http://functionalresonance.com. And the software to visualize the hexagons can be found on http://functionalresonance.com/FMV/index.html.

Figure 2: The aspects of a FRAM

First iteration of the FRAM model

The process description provides the initial information to start developing the FRAM model. The model should represent as much as possible the actual way the work is done in the process. And while this will always be a simplification by definition, the aim is to capture the most commonly followed process.

Figure 3 shows the first iteration of the model. The software automatically creates white and grey functions, that is a way to distinguish foreground and background functions. Background functions are contextual elements that don’t influence the process under investigation in terms of variability but are seen as relevant to understand and analyze the process. The white functions are the main functions that make up the process. The model shows that the train driver can start driving when he sees a green light, with a precondition of an activated doors closed signal.

Note that not all the nodes/aspects on the hexagons need to be used. You only use the ones that have relevance to the analysis. This follows from the information gathering and fine tuning of the model with a feedback group. And the principle of ‘breadth over depth’ applies, especially at the initial stages of the model development. You can always expand one function into more function to create more detail whenever the information or feedback gives you clues that point to the necessity.

Figure 3: The first iteration of the FRAM

Questions and refinement

The model visually represents the process and can act as a facilitator for further questions about the process. In this case it led to the following questions:

• Which system activates the STS signal and based on what?
• Which system activates the departure signal and based on what?
• How are both signals connected?
• What does the departure procedure for both the conductor and the train driver look like?

There are probably more questions to ask but the answers to these provided sufficient follow-up information to refine the FRAM model.

‘Final’ FRAM model

The answers to the questions gave more insight into the process and the model could then be amended (see Figure 4 for the model).

• The train track STS signal is activated directly via the automatic signaling system. And one additional function became relevant to add. The train dispatcher is located on a central location and he monitors the use of the tracks in real-time. Sometimes, when there is an interruption of some sort, the signaling at a specific location has to be adjusted in time to solve a problem or situation. That’s the added function of manual input into the signaling system.
• The departure signal has a slightly different activation then was assumed in the first iteration. A separate system activates that signal when the STS signal is turned to green. So almost at the same time, the conductor receives his ‘clearance’ to start with the departure procedure while the train driver sees a green light. And that is also the reason for the numbering in Figure 1.
• The conductor then checks the departure time to ensure that he adheres to the schedule (=precondition departure time). And then goes on with the closing of the doors which results in all doors closed and a signal in the cabin. This takes about 15-20 seconds.
• The train driver sees the STS signal turn green but without the confirmation that the doors are closed, he doesn’t act on it. When the signal ‘doors closed’ lights in the cabin, the driver has a confirmation that it is safe to start driving. That’s the reason the input and precondition on the last function are switched. In practice the train drivers act on the signal for the doors expecting all other conditions to be present and not necessarily checking them.
• Furthermore what should be noted is that the train schedule is time-pressed and usually a train arrives and departs within one minute, so the driver has a ‘standard’ pressure for time to keep adhering to the schedule.

Also colors have been used in the model to ease the reading. Yellow represents functions associated with signals and the train dispatcher (he belongs to a separate organization). Blue is the conductor and green is the train driver.

Figure 4: ‘Final’ FRAM model of the departure process

Analysis

After amending the model to reflect the additional information, some interesting points emerge from the visualization of this process.

The most prominent point about this analysis is that the signal ‘doors closed’ is almost always a representation of three items: train track STS signal green, departure signal activated and departure time. So it makes sense that the primary signal for the train driver to start driving is this signal instead of the STS signal itself (which would be the primary signal in work as imagined). And in 99 out of 100 situations, there is absolutely no problem with this practice.

It only becomes a problem when the train dispatcher has to manually revoke the STS signal during the execution of the departure procedure. During the departure procedure the conductor is looking toward the whole train and therefore with his back towards the departure light after he has seen it. And in the last phase he closes his own door and can’t even look at the light. And work as imagined is indeed that the train driver checks his STS signal (precondition) every time after seeing the doors closed light but there is variability in the execution of this check due to the way the process is designed. In almost all situations, he doesn’t need to check it and therefore a form of drift occurred and checking is less likely to occur over time. And there can also be situations were other pressures or distractions add to the variability.

Disclaimer: This is by no means a full analysis of the process and it certainly lacks operational input but hopefully it paints a picture of the use of FRAM in practice. The step toward improving the departure process is one that really needs operational input and unfortunately that is beyond the scope of this article.

Reflections on the use of FRAM

This small ‘project’, to show the use of FRAM in practice, highlights some useful point about how FRAM can benefit us in improving our systems.

• FRAM is first and foremost about creating a generic, work-as-done model of the process under investigation. This directly separates it from traditional ways of investigating incidents. Incident investigations are targeted at a specific situation in which an event took place. A FRAM investigation places the specific situation in the context of the normal execution of the process. That difference is especially relevant when trying to improve. Improvement options can then be placed into the whole as well.
• FRAM facilitates discussion on how the process is executed and what problems are encountered on a day to day basis. The model helps shape the discussion and then the model is not that interesting anymore, it is the ‘messy details of operational life’ that then matter. A rich picture of contextual information can then be gathered which can be used for further reflection. The model is merely a starting point for this discussion.

The underlying theories of FRAM and Safety II help us focus on normal work in everyday situations. It also helps us to look at the local rationality of the people involved. And last but not least, it helps us ask better questions with a positive focus and that leads to a richer understanding and a more constructive and humanistic approach in safety.

[1] In most cases the train driver physically can’t see the departure light.

[2] STS is the Dutch abbreviation for the light indicating that the track is safe to proceed on.