In an increasingly complex world there is a real, urgent need for methodologies to enable engineers to model complex sociotechnical systems, as these now seem to describe the majority of systems in use today. This is of course exacerbated by the increasing involvement and augmentation with “black box” AI contributions. Hollnagel produced a methodology, (FRAM) which did allow the analyst in-sights into these systems’ behaviour, but the model-based system engineering applications demand numbers and a quantitative ap-proach. In the last 10 years, this original approach developed to model systems as sets of interactive, interdependent “functions”, (abstracted from agent or component details), has been further developed to the point where it can take the basic data and structures from the current component focussed system engineering “models”, and can pull it all together into dynamic models, (as opposed to static, fixed System Theoretic Process Accimaps), from which analysts can discern how they really work in practice, and predict the emergent behaviours characteristic of complex systems. This paper describes how the FRAM methodology has now been extended to provide these extra, essential attributes. It also describes its implementation using an open-source software, freely available for use and verification on the GitHub site.

In his Cynefin classification of system behaviours, Snowden (2007), posits that his Simple (Clear ) and even Complicated system categories are sufficiently understandable to be amenable to the traditional methods of system analysis and modelling. Here, relationships between entities in the system are clear and unambiguous and they behave predictably. So, we can build mathematical “models” to describe how the system is expected to function in different situations. Leaving aside his fourth category, Chaotic, as too hard for the moment, this paper focusses on the third category, Complex systems. Yaneer Bar-Yam [1998] defined "complex systems" as systems that "have multiple interacting components, whose collective behaviour cannot be simply inferred from the behaviour of components." So, the traditional system modelling approach of decomposition into components and attempting to build up a picture of system performance from individual pieces, alone, is no longer appropriate for this class. The problem is that most of the methods we currently employ, and particularly the methods that attempt to make the case that these systems are safe, (such as Fault trees, FMEA. and Root Cause Analysis), rely on this decomposition into components and attempt to make the parts more reliable individually. Even the more systemic approaches, such as Reason’s (1990) Swiss Cheese Model, and Leveson’s System Theoretic Analysis (STPA) (2004), encourage adding layers of protection, barriers, strengthened control loops and better safety critical systems, in the hope that they are making the systems safer. But without a valid model to test the effectiveness of these add-ons, we cannot be sure that they will not have an opposite effect, of making the systems even more complex, unreliable and unpredictable. For complex systems, the careful gathering and documentation of system components and their relationships is still a necessary first step, but we need an additional capacity to model these complex systems to test out and prove they work safely and successfully in the real world. (not just draw fixed component relationships as system “models” (wiring diagrams)) In the last 10 years, an original approach developed by Hollnagel, (2012), to model systems as sets of interactive, interdependent “functions”, (abstracted from and independent of component details), has now been developed to the point where it can take the basic data and structures from the current component focussed system engineering “models”, such as MBSE( Goldberg (1994)), and can pull it all together in a dynamic system model from which analysts can discern how it really works in practice, and predict the emergent behaviours characteristic of complex systems. The paper describes how this methodology developed and how it is currently used to model real situations, to analyse incidents and anticipate events.

Although it’s been some forty years since we started to teach combined modified Fault Tree / Event Tree acyclic digraphs, as much simpler Bow Tie diagrams, their popularity seems undimmed; as their pictorial and focussed discussion prompts, fulfil a valuable function in the safe design and operation of hazardous plants and installations. An excellent review of the current state of the art and an authoritative treatise on the terminology and issues involved has been produced as an internationally recognised standard for using the approach. But just as this model has augmented and helped formalise previous pictorial tools, (such as “Dominoes” and holey “Cheese” slices), this paper suggests and sets out to show how we can build on even this current cornerstone of practice and augment its versatility; with the ability to obtain, what engineers rely on, some more quantitative insights from these pictures. “Layers Of Protection Analysis” (LOPA), has already demonstrated a way of pulling together more quantitative predictions from the pictures. This paper would go further and by concentrating on the function not the physicality of a barrier, outlines a methodology that can extend, not just the quantification ability of the LOPA extension, but present a much more holistic view of how the Barriers, as functions, need to work together, interact and interdepend; often in nonlinear, unexpected ways, to give system designers and operators a much clearer view of actual performance predictions.