FRAM‐Based Safety Culture Model for the Analysis of Socio‐Technical and Environmental Variability in Mechanised Agricultural Activities

1. Introduction

Operational safety in agricultural mechanised tasks is traditionally characterised by low supervision, adaptation to field conditions and flexibility to meet a wide variety of work organisation models [1]. This scenario often leads to compliance-based approaches that can easily generate latent hazardous conditions derived by external sources of pressure, both from the environment and from socio-technical constraints [2]. The analysis of such tasks, given the high variability of how they are performed and the large number of factors affecting them, demand a more systemic perspective to avoid labelling most of the accidents as generated by human error [3] or by lack of compliance to safety regulations. In these contexts, in fact, safety culture [4] does not stem from formal oversight but emerges from the interaction between socio-technical and environmental constraints such as weather conditions, seasonality, market demands, labour force availability etc. These background conditions continuously influence the operator’s behaviour, leading to little performance adjustments that are necessary to complete the tasks and fulfil productivity’s goals under pressure. Within these boundaries, safety culture then emerges as a product of collective behaviours, attitudes and competencies of the operators, which shape how safety is understood, prioritized, and maintained in organizations [5,6]. Rasmussen’s Risk Management Framework (RMF) [7] offers a powerful lens for understanding and evaluating safety culture, especially in dynamic, high-risk systems. RMF suggests that every organization operates within bounded spaces defined by safety limits, economic constraints, and workload or performance limits. People adaptively move within this space, often without explicit awareness of how close they are to danger. Safety culture is reflected in how these adaptations are made. To prevent drift and reinforce norms, the RMF emphasizes the need for real-time feedback and learning mechanisms from near-misses.

The adaptive navigation within constrained boundaries, as described by Rasmussen, closely aligns with the logic of the so-called the efficiency–thoroughness trade-off (ETTO) [8], which describes a work model in which operators must constantly balance the demand for efficiency with the need for thoroughness in order to perform tasks in a safe way. As proposed by Hollnagel [9,10,11], this trade-off is an intrinsic part of complex, not tractable with reliability models, work systems and contributes to the safety detriment that happens when operations drift away from ideal conditions. The same author illustrates this concept by common work practice that steadily run into latent accident conditions [12,13] in which just even a little mistake can result in accidents:

• routine checks that are skipped because they look like a waste of time if the system is reliable;
• practices that become standard only because they have always done in the same way even if they are dangerous;
• double standards, in which workers know how to carry out an activity, but they also know that, for the organisation, efficiency comes first;
• believing that, as always, verifications have been done before by others and there is no need to check again;
• overlooking of issues, that despite having possible severe consequences, are considered as not important because workers got used to them.

With such shortcuts, considering the supervision in agricultural contexts is often minimal, also limited communication can represent a challenge in delivering safety information and stressors just accumulate. The result mechanised operation made of tight tasks that only allow local small adjustments, with cumulative effects that may exceed the resilience threshold of the whole system and result in incidents.

Such examples, in the past, lead to assess most of accidents as human errors, but especially in agricultural contexts a lack of understanding and information on how accidents have happened was often present [3]. This tendency, however, did not take into account the other side of failure which is success: if all the accidents are due to human errors, then many operations are hazardous and succeed only due to human intervention. To better analyse such contexts, researchers started to look at the bigger picture including safety cultures, finding that background constraints play a key role in increasing the chances for workers to fail and by creating “tight couplings” among activities that leave little or no space for operators to mitigate risks or to perform corrective actions. But nevertheless, even a wider approach that looked at safety culture had its limits and biases: most of accident analyses started to be assessed as generated by culture [14,15,16], simply switching to that from human variability and yet remaining in a model in which accident are due to simple cause-effect dynamics rather than to a mixture of effects that, after being latent for some time, all had their share of responsibility.

To incorporate these dynamics in a risk assessment model, a FRAM-based approach (Functional Resonance Analysis Method) was adopted and a framework structured around four instantiations has been defined, describing the most important working modes: Thoroughness, risk Awareness, Compliance, and Efficiency—collectively referred to, from now on, as the TACE cycle. These modes have been considered to adhere with the ETTO principle and to include two intermediate steps which are the risk awareness, understood here as a key factor in Rasmussen’s RMF, where it governs how individuals perceive their proximity to operational boundaries and proactively influences whether their adaptive behaviour maintains or undermines safety over time, and compliance (which, in British occupational health and safety approaches, could be defined as “as low as reasonably possible” – ALARP – to indicate a cost-benefit approach to reduce risks without affecting competitiveness). Each stage of the TACE cycle reflects a distinct behavioural mode, with increasing tendency to accept variability and reduce safety margins in favour of productivity [17].

The proposed framework was applied to investigate roll-over risks, which is one of the most frequent hazards according Occupational Safety and Health Administration (OSHA) of the United States of America and from precedent research works [18], [19,20,21,22], together with mechanised ploughing operations that instead is a task with a fairly big variety of external stressors that require continuous adjustments in operations.

The resulting analysis allowed for the identification of operational hot spots in which small upstream deviations, if not properly dampened, can escalate into hazardous conditions. The introduction of targeted dampening actions, such as enforced preconditions that must be fulfilled before starting certain operations, is proposed as a low-cost, resilience-oriented countermeasure that strengthens safety culture and operational stability without compromising efficiency.

2. Materials and Methods

The aim of the methodology employed in this research was to explore how different operational modes, driven by external stressors and internal behavioural adjustments, influence functional coupling and the emergence of risk. This approach combines both safety culture factors and safety assessments into an index for ease of use [23]. Ploughing activities were selected as a representative mechanised task due to their exposure to field variability, minimal supervision, and frequent background disturbances.

To support the analysis, four FRAM instantiations were defined, corresponding to distinct safety culture modes, and used to describe how safety detriment evolves over time as critical stressors accumulate. The analysis of functional couplings within these scenarios allowed for the identification of resonance hot spots, to which a semi-quantitative index was assigned based on incident severity [24], internal variability estimations and coupling impact. While variability estimations have been assessed through a scale of values based on expected effects on the function, severity values were instead derived from OSHA real-world fatality reports, The overall quantification was consequently be based on internal variability and external sources of resonance, resulting the identification of dampening solutions to reduce risks, exploring this way any possible mitigation effects and adjustments.

Each methodological step is described in the following subsections, specifying both FRAM analysis and the quantification of its outcomes. It is worth saying that the method aims not only to identify risk conditions, but also to identify how safety deteriorates in response to external constraints: this is why the workflow includes safety cultures as instantiations and the evaluation of mitigation strategies.

2.1. Integration of Safety Cultures and Safety Detriment in Resonance Analysis

The methodology adopted in this study combines a FRAM functional modelling approach with a behavioural drift framework derived from the efficiency–thoroughness trade-off, with the purpose of investigating the most common working modes and safety cultures at once. The objective is to model how background stressors shape operator behaviour and functional variability in mechanised agricultural work, and to evaluate the effects of this variability on the potential for hazardous outcomes.

Ploughing was selected as a representative task due to its exposure to variable terrain, weather constraints, and the prevalence of solo operation. These factors make it well suited to the study of safety culture and variability under real-world conditions.

To characterise behavioural drift, four distinct instantiations of the model were constructed, corresponding to the four modes of operation defined by the TACE. The cycle represents working modes that reflect how safety and productivity are balanced in practice. Each mode implies behavioural orientation to variability, particularly under socio-technical and environmental pressures. The cycle can be seen as a continuum or drift from maximum thoroughness to maximum efficiency, shaped by external constraints and internal adjustments. Given the importance of taxonomy of socio-technical variables in FRAM [25], the four instantiations of the cycle can be defined according the “migration toward the boundary” process described by Rasmussen as follows:

• Thoroughness, which prioritises accuracy and control, where functions are executed with full attention to procedures, safety checks, and environment;
• Risk Awareness, in which an organisation is aware that a proactive approach is required but settles to reasonably achievable standards. It represents a flexible balance between thoroughness and feasibility, where operators still aim to reduce risk as much as possible, but begin to consider workload, time constraints [26], and operational demands;
• Compliance, in which the focus shifts to meeting minimum legal requirements. Safety is maintained to comply with regulations and functions omit non-mandatory checks or redundancy measures. Formally acceptable, this working mode still has vulnerabilities especially to hidden sources of external variability;
• Efficiency, that reflects a performance-oriented working mode where productivity and task completion often override safety considerations. Performance adjustments become aggressive and safety checks can be bypassed as risks become normalised like part of the job. Efficiency operations often emerge under high pressure and are susceptible to functional resonance, especially when background stressors are largely present.

Each mode is meant to reflect, in addition, different safety cultures that often generate a given number and type of hazardous patterns [27,28], behaviours [29], performance variability and resonance propagation. A drift can indeed happen from one to another, and this can be analysed to understand the reasons and the effects behind it: given that external stressors and sources of variability play a key role in the change of culture, a set of possible drifts among instantiations is represented in Table 1.

2.2. Severity Assessment

Apart from defining methods to assess the chances for incidents to happen or to assess hazard priority [31], their severity also needs to be estimated in order to produce an index of resonance. For this purpose, data from the OSHA database has been exploited, focusing on fatal tractor-related accidents relevant to turning, travelling, and field operations.

Severity values were assigned using a 5-level scale (minor, moderate, serious, severe, fatal), derived by reviewing OSHA case reports relevant to tractor overturns, field accidents, and manoeuvring incidents. Each case was categorised according to injury outcome and context and mapped to a numerical score from 1 to 5, as shown in Table 2.

2.3. Variability Propagation, Hot Spots and Resonance Index

In order to provide semi-quantitative assessments for each instantiation, a resonance index (RI) was introduced to estimate the variability associated with each function. While previous approaches focused mainly on timing-related variability, the present analysis extends the coupling impact framework to include deviations in resource availability and precondition fulfilment, in line with the original FRAM formulation. Each input to a function was characterised not only by its timing, but also by the degree to which required resources were available, preconditions were verified, and controls were in place: giving an impact value (I) to each parameter a composite impact score can be obtained. The equation for calculating function resonance index (RI_f) can be described as follows:

$${RI}_f=S_{f}x\prod _{i=1}^n{I}_i$$

(1)

The impact values used in (1) are meant to represent the likelihood in terms of resonance and can represent both an increase of it and dampening effects. Values have then been estimated for each scenario, since the generation of random occurrences with Monte Carlo simulations [32] was unfeasible. Consequently, adjusted for each TACE mode to reflect different behavioural tendencies: for instance, the Efficiency mode was associated with a higher probability of early or omitted inputs, while the Thoroughness mode favoured on-time performance with low deviation likelihood. These values span between 0.85 and 1.50, which represent minimum (dampening) and maximum (high resonance) variability, as shown in Table 3.

It is worth explaining that the values that express variability are not arbitrary: they are meant to keep in account no variability for tasks carried out in the proper way and to make sure that:

• maximum values for internal variability (I=5.06) would have the same weight of maximum severity (S=5);
• standard internal variability functions (I=1.00) would have the same weight of minor severity events (S=1);
• a minor severity event (S=1), with maximum internal variability (I=5.06), would be weighted slightly more than a fatal event (S=5) with standard internal variability (I=1.00);
• a moderate severity event (S=2) with some internal resonance variability (I=1.495), would be evaluated as equivalent to serious event (S=3) with standard internal variability (I=1.00);
• events that have the smallest possible internal variability (plenty of time and resources, full control and double-checked preconditions) would result in halving (I=0.52) the RI of the same function under standard conditions (I=1.00).

A map of the possible values for RI, according to variability indices and severity values, is shown in Figure 1.

After computing local resonance indices (RI) for each function, a propagation analysis was conducted by mapping inter-functional couplings and assigning weighted coefficients to each output-input link. For each coupling, the originating function’s RI was computed together with its other sources of propagation, like other background functions or foreground functions. This way, cumulative effects were analysed across the functional network to identify nodes particularly sensitive to upstream resonance, even in the absence of high local RI. This approach allowed the identification of both resonance origins and propagation amplifiers in a Total Resonance Index (TRI), which has been computed by combining intrinsic variability (local RI_i) propagated resonance received from upstream functions (RIj) and the weight of background functions (W_k).

$$\mathit{TRI}={\mathit{RI}}_i+\mathit{\sum }{\mathit{RI}}_j+\mathit{\sum }{W}_k$$

(2)

For each foreground function, propagated resonance was computed as the sum of the resonance indices (RI) from upstream foreground functions, without applying additional weights, as the intrinsic variability of each function already incorporates amplification effects. Weights for background functions have been assessed based on their occurrences as key factors in accident analysis, with values that correspond to 1.0 for variables that have no occurrences and 1.5 for those with the maximum share among accident scenarios; other cases will be determined based on such two limits according to the following formula (3).

$$W=1+({\displaystyle \frac{occurrences}{\max occurrences}})x0.5$$

(3)

This approach enabled the identification of functions that may not initially present high risk but are exposed to significant amplification due to systemic coupling or, instead, be safer due to the effects of dampening couplings. The computation of these indices has been consequently performed for each TACE scenario, allowing a comparative evaluation of variability amplification across different safety culture modes. As a result, functions exhibiting high resonance indices were considered hot spots, indicating areas of the process where small performance adjustments, driven by background factors, could escalate into hazardous outcomes. The combination of TACE-driven behavioural modes with FRAM coupling analysis and severity data produced a structured analytical workflow that has been implemented to identify and quantify critical points of resonance across the operational task. The overall analytical framework, including the modelling steps, severity integration, scenario definition, and identification of variability hot spots, is summarised in the flowchart shown in Figure 2.

The FRAM model was developed by identifying foreground functions related to core operational phases of the selected farming mechanised activity (e.g., tractor setup, travel to field, turning, ploughing) and background functions reflecting socio-technical and environmental stressors (e.g., soil conditions, weather instability, maintenance status, operator fatigue, time pressure, and equipment availability). These background functions were modelled as either resources or preconditions, depending on their role in enabling or constraining each operational step.

To assess the mitigation potential of dampening actions, the model also introduces precise actions in selected high-risk functions. These adjustments were simulated by reducing the associated coupling impact values, thereby limiting variability propagation and interrupting potential drift patterns. This methodological framework enables both a qualitative exploration of how safety culture affects performance variability and a semi-quantitative evaluation of risk dynamics across different operational modes.

3. Results

The first step of the analysis involved severity assessments and analyses from OSHA accident database [33]. This kind of activity was necessary to both understand fatality rates for tractor overturning hazards and other parameters that have affected the outcome of the accident of that took part in originating it. The database reported 44 cases of roll-over incidents in agriculture and data is summarised in Table 4.

Summary showed that more than one third of the accidents involving farming machinery had overturning as outcome. In most cases (68%) the accident was also fatal for the worker; most of times there was only one person involved, and the age of the tractor driver spans between 23 and 72 years old, with a homogeneous distribution in the classes younger than 40, older than 60 and between 40 and 60. Accident reports, despite being very short in many cases, reported vital information to understand which external sources of variability were present: in most cases, terrain conditions or road surface conditions proved to be a critical issue but load, weather and mechanical failures also had their share among accident causes.

The next step involved the assessment of how a transition from one safety culture to another would have affected field operations. These trade-offs affect the four selected TACE scenarios in both foreground and background functions, highlighting the risks related to resonance amplifications among functions. In the case study of ploughing under delivery time pressure or bad weather/soil conditions, background functions’ influence significantly degraded the operational safety of the foreground functions that characterise farming operations and their resilience [34], making them virtually more fragile and less able to adapt to further changes. A definition of the simplest ploughing activity can be described as a set of foreground functions that start from machinery setup, continues route to the field and starts its tasks; a set of turnings and furrow-side ploughing tasks will be performed until the tractor gests back to warehouse. In this process, a set of background functions will influence it, and they can be listed as:

• Environmental stressors and constraints;
• Socio-technical variables, such as need of maintenance, trained personnel, company constraints;
• Task-related variables related to the activities required to keep the process run smoothly, which can be considered as embedded skills of tractor drivers, such as control tractor’s path and speed while ploughing.

These background functions can have different impacts and variability toward foreground functions, given the way that they are taken into account while working. An overview of the effects of such trade-offs on background functions is shown in Table 5.

After defining how safety cultures affected the background function, foreground functions have been defined to complete the static step of the FRAM model which includes the breakdown of the six variables (input, output, control, preconditions, resources and time) related to each function. It must be remembered that not every function requires variability from each of them, but an input must be stated for each function after the first one in temporal order. The full FRAM model instantiation used in this analysis is shown in Figure 3. It includes all foreground functions, background conditions, and their couplings, with key variables expressed as labels next to the links between functions they refer to. This structure provides the basis for identifying functional variability and assessing how it propagates across different operational scenarios.

A detailed representation of the background and foreground functions is reported in Table 6, a step that was necessary to establish the relationships between them.

The definition of the internal variability on foreground functions has highlighted the effects generated of a wide number of dependencies from environmental or field-related background functions, which is already a hint on how resonance could propagate even in presence of dampening effects. Authors kept the analysis of such links to a simple description, as a “stop rule” for the whole FRAM model; the same standard has been followed previously for background function description as well (bad weather has not been further divided into, i.e., storm or snow) because it would have been difficult to precisely count these specific conditions from accident reports.

In order to assess how functional variability accumulates throughout the process and propagates among functions under different operational attitudes, the variables shown in the breakdown of FRAM functions needed to be assessed for potential resonance.

Table 7 shows the resonance analysis performed on functional couplings, illustrating how variability propagates between pairs of foreground functions under each scenario of the TACE cycle.

Combining severity, weights from background functions (W) and computed aggregated variability coming from upstream functions, TRI values can be obtained for foreground functions. Results are shown in Table 9.

Data shown in Table 9 confirmed a progressive increase in systemic variability from across the TACE scenarios. This trend is especially pronounced in operational functions, that emerge as resonance hotspots across all scenarios. To better understand how each function’s resonance evolved across the four scenarios, Figure 4 displays the TRI values for all functions across the four scenarios.

The trajectories highlight that certain activities are structurally more vulnerable to shifts in organisational priorities and can result in generating higher resonance to the whole process. Tasks related to tractor coupling, for example, despite being less influenced by environmental stressors or field conditions but also being the most influenced by socio-technical variability, were more responsible of resonance compared to other functions except ploughing activities in the efficiency scenario. Given such differences, it is worth showing also the variation of TRI for couplings in the three drifts from Thoroughness to Risk Awareness, from Risk Awareness to Compliance and from Compliance to Efficiency.

Variations shown in Table 10 demonstrate that there is a significant increase of resonance in switching from compliance to efficiency, which is more than 3 times the effect shown in the drift from Risk Awareness to compliance and nearly the 3 times more the change in variability between thoroughness and Risk Awareness working modes. Such changes were also common to all the functions in which couplings played a role in resonance propagation, reaching an even higher increase of TRI.

4. Discussion

The findings of this study highlight the central role of socio-technical and environmental variability in shaping operational safety even during mechanised agricultural tasks, which are commonly characterised by low resonance propagation and a reduced number of workers in the field at the same time. The integration of FRAM allowed to quantify, even if in terms of indices, the impact of background functions as amplifiers of resonance and the effects of safety cultures in safety detriment. Sinche changes in safety culture were observed as the TRI values escalated along resonating functions, the proposed framework might be extended to create an early-warning indicator, enabling timely managerial interventions and facilitating continuous improvement.

The analysis of TACE scenarios showed a non-linear, but steady, increase in the Total Resonance Index as the working modes drifted from thoroughness to efficiency. A particular effect has been observed in the drift from compliance to efficiency, which was also confirmed by the lower degree of total resonance variation between thoroughness and risk awareness and then the compliance-oriented mode; these effects also show how and when preventive resources should be concentrated. Results reflect, generally speaking, a pattern consistent with the RMF where safety boundaries are approached gradually and often unknowingly as performance pressures increase and risk awareness diminishes. Once these boundaries are approached, further improvements in safety become increasingly difficult to achieve, as they would require disproportionate investments to mitigate hypothetical scenarios that are unlikely to manifest within the typical operational life of agricultural machinery.

Another finding is that the performance-oriented operational modes, often prioritising productivity, incur a disproportionately high safety cost. Moreover, the inclusion in the model of background functions, such as soil conditions, weather constraints, time pressure, and availability of skilled personnel, highlighted how latent coupling effects can lead to systemic vulnerabilities that would affect any working mode scenario. These effects, being often not accounted in safety analyses, would remain invisible to most assessments and become latent causes of accidents.

Ease of use, possibility of assessing severity from accident reports and the possibility of assessing resonance propagation through an index are certainly key features of the proposed methodology. On the other hand, it is still a model that would apply to simple instantiations or in processes that can be simplified by rigid stop-rules, to prevent abnormal resonance assessments. Another limitation is given by the oversimplification of certain inputs by fuzzy logic, but additional intermediate values could overcome this issue. Lastly, the exclusive reliance on OSHA reports may limit the results to similar agricultural systems or organisational standards.

5. Conclusions

The proposed model suggests a competitive safety approach as a strategy to show how the so called efficiency wouldn’t sufficiently justify the costs that come from safety detriment and deliberate drift to safety cultures that put productivity first: the concept of compliance is confirmed not to be just a bureaucratic step to perform, but instead a necessary barrier to limit potential losses and eventually switch to proactive safety cultures through dampening functions and anticipatory measures. Solutions like enforced preconditions, targeted operational pauses, and decoupling of hazardous background function from vital foreground functions greatly improve the stability of the workflow, while maintaining high levels of performance.

The introduction of the Total Resonance Index (TRI) allows to better evaluate couplings involving socio-technical background functions under different working modes, presenting the vulnerabilities that are generated by transitions towards more efficient working modes scarifying safety.

Future research could investigate also the effects of other background functions that, instead, can provide dampening effects in real-time, detecting hazardous drifts and increasing the chances to generate dampening effects on resonance or on internal variability. Possible tests could also be run by passing the information about the increase of resonance to tractor drivers as they work, since it might generate a positive response in limiting further negative adjustments.