Functional Resonance Analysis Method and Human Performance Factors Identifying Critical Functions in Chemical Process Safety

This study compared the results of the application of two different methodological frameworks to identify the critical functions in a chemical industry that affect process safety. The Functional Resonance Analysis Method (FRAM) and Performance Shaping Factors (PSF), the latter involving operators’ active participation, were applied on the same socio-technical process. Three phenotype responses were integrated, based on FRAM, namely timing, precision, and duration. The ergonomics approach was used to identify process functions by observing the operator workday to FRAM. A methodological framework based on human factors had selected the critical key PSF, used as an indicator, to identify the critical activities in the process, by operator’s perceptions. This study demonstrated that some result variability couplings can be different in some aspects in the automated and batch process. The integration of duration phenotypes with integration time and precision can modify the results of variability in the batch process. Human being management adapts and mitigates the risk. Operator competence and knowledge can eliminate function and task time by modifying the work sequence of the process. Comparison of analytical results demonstrated the compatibility of the two analyses.


I. INTRODUCTION
The technological development of computer software and machines to support human performance and decisionmaking necessitates a structured approach. Chemical processes involve substantial quantities of potentially dangerous materials, such as toxins, explosives, and flammable material that are exposed to extreme conditions as high temperature and/or pressure, which can lead to accidents with the loss of human life as well as incurring an economic cost [1].
The evolution of technology has been rapid in the industrial process and human beings are naturally affected. The social part of the system is of vital importance, meaning that not only the technical but also the complete socio-technical structure, should be taken into account. Team members (managers, supervisors, operators, etc.) have to cope with heterogeneous and occasionally conflicting information, as well as the pressure to perform under the stress of a high workload [2].
This study analyzed information from the literature to better understand the advantages, disadvantages, and limitations of Human Reliability Analysis (HRA) tools and their applications [3][4] and to review multiple methods used in HRA. As an HRA example, Functional Resonance Analysis Method (FRAM) is a method that places greater emphasis on interactions that could easily be overlooked with other methods. Hollnagel [5] declared that the FRAM method differs from others because its purpose is to produce a description of how a system works; FRAM's purpose is not to find a cause but to describe what should have happened for the work to succeed.
Complex systems that have interactions involving components of socio-technical systems are usually non-linear and their behavior is difficult to predict. The evolution of technology with new software that is now embedded in many manufacturing processes increases complexity, thus impeding the anticipation of all potential interactions. Today, systems theory is widely used as the basis for systems engineering and process systems engineering [34]. In many publications on the FRAM method, the analytical subjectivity of the evaluator is present and there is no control mechanism to convert theoretical concepts into the practical analysis, to follow the coherent analytical line of FRAM methodology.
In the simplest FRAM solution, when time quantification is used with a statistical treatment to identify critical activities, there is are differences between couplings variability between the output of the upstream function and the components input, precondition, and resource of the downstream functions, in batch and automated processes. In batch processes, where a worker performs the process management, certain adaptations when carried out regularly, eliminate potential variability. There are also limitations when the evaluator has little process knowledge.
The emergence of FRAM has identified areas in the description of functions in the system, as well as aspects characterizing these same functions. However, an understanding of mechanisms of resonance as well as the underlying variability of functions' performance is highly dependent upon the analysts' subjective interpretations and mental models.
To eliminate analytical subjectivity and validate the results of the FRAM Analysis, we created a methodology based on the PSF's factors (Performance Shaping Factors) that affect performance to identify which activities are critical in the analyzed process, according to the perception of the operators. The questionnaire's design was constructed with the industrial operator's ergonomics knowledge and publications of PSF's taxonomy and choose the PSF's and taxonomy contexts.
Many current HRA methods use PSF to describe aspects of human-machine system interactions. These are used to represent situational contexts and causes affecting human performance in different systems [35].
In this study, questionnaires were distributed to area operators to identify the PSF that influences each function in the process. These operators were informed of the purpose of this research and were instructed on how to complete the questionnaire. The objective was to identify critical activities from the operators' perception and to compare them with the results of the FRAM analysis. In other words, the contribution of the key PSF Methodology with the FRAM Method is the identification of the critical activities through the operators' perceptions.
The final spreadsheet comprises all questions and responses. We had 55 lines (PSFs) versus 143 columns. The full questionnaire with all PSFs descriptions, along with responses is in the Supplementary Material, with a brief description in Appendix. PSFs were determined from a review of recent relevant literature, as well as, from consultation with the most experienced operators interviewed. The application of the questionnaire was based on an initial test followed by five meetings with all respondents to explain and clarify how they had to proceed to answer the questions fashionably. The final document was attained by consensus as a result of these meetings.
The sampling size was determined based on an opportunist approach (Convenience or Intentional Sampling) and we had fifteen highly qualified operators to sample and we used this number. At the end of the process, we could only validate eleven questionnaires due to incomplete or not meaningful documents returned being this a valid sample size for the used sampling method. The opportunistic approach (Convenience or Intentional Sampling) was used due to restrictions observed and to have a random sample size that would allow valid statistical analysis was practically unrealistic and not seen in other papers from the reviewed literature. Conducting a random sampling would be somehow difficult having in mind that the focus of the study relied upon a comparison from the application of FRAM methodology and PSFs determination; due to this the population to be sampled was limited to experts in that very specific process and company´s restrictions.
The process in the chemical industry is characterized by the predominance of human management in controlling the operating system. Human intervention in the implementation of change is common in adapting events, adjusting nonstandard activities, and correcting other operational problems. With the contribution of the operator's perception, the present study compared PSF and FRAM's results and had provided an adequate criterion for the choice of the critical activities.
It should be noted that accidents occur as a result of interactions between components, not just from component failures. This work is a contribution, showing the application in the chemical industry in the acid discharging area. The analyzed process is a batch process that depends on the operator's judgment for decision-making. This is an important analytical validation process, widely used in the ergonomic approach, which contributes significantly to decision-making in the application of control measures. Section 2 shows the theoretical base of the FRAM method and PSF framework. Section 3 presents the methodological description of the chemical industry case study of an acid discharging area. Section 4 presents the results. Section 5 presents the discussion. Section 6 presents conclusions

II. ABOUT FRAM -FUNCTIONAL RESONANCE ANALYSIS METHOD
Using the FRAM model is possible to understand and analysis of a past or future event, how something happened (an event), to assess how something may happen (a risk analysis), or to assess the impact of changes/improvements (design). The FRAM can, therefore, be used as part of event analysis, as part of risk assessment, or as part of the design process, but is strictly speaking neither an accident analysis method, a risk assessment method, or a design method [14].
This method is based on four principles [5]: i) Equivalence of failures and successes. Failures and successes come from the same origin, i.e., everyday work variability. This latter allows both things to go right, working as they should, and things go wrong. ii) Principle of approximate adjustments. People as individuals or as a group and organizations adjust their everyday performance to match the partly intractable and under specified working conditions of the large-scale sociotechnical systems. iii) Principle of emergence. It is not possible to identify the causes of every specific safety event. Many events appear to be emergent rather than resultant from a specific combination of fixed conditions. Some events emerge due to the combination of time and space conditions, which could be transient, not leaving any traces. iv) Functional resonance. This resonance is not completely stochastic, because the variability of the signal is not completely random, but it is subject to certain regularities, i.e., recognizable shortcuts or heuristics, that characterize different types of function.
The main steps of a FRAM analysis are: i) Setting the goal for modeling and describing the situation to be analyzed. ii) Identifying the foreground functions (FF) of the process, and characterizing them, according to input, output, preconditions, resources, time, and control. iii) Characterizing the actual/potential variability of functions in the FRAM model, as well as the possible actual variability in one or more instantiations. iv) Considering both normal and worst-case variabilities. v) Defining functional resonances, based on potential/actual couplings among functions. vi) Develop recommendations on how to monitor and manage the variability, either by attenuating variability that can lead to undesirable results, or by enhancing variability, that can lead to desired results [5].
To build a FRAM model is necessary, to begin with, the identification of three types of functions, following the technology, human, organization classification. In a real scenario, beyond this simplification, it would be necessary to have different values for these functions, in line with their real variability. Over the last years, researchers propose different ways to characterize the function variability, with different variability manifestations, defined as phenotypes. Any analysis started from the simplest solution considering only two phenotypes, i.e., timing and precision, to the more elaborate ones adopting multiple phenotypes, i.e., speed, distance, sequence, object, force, duration, direction [5]. In this work, we will add duration with time and precision as phenotypes as they could describe most consequences. A natural extension to other phenotypes, even if it could refine the analysis, does not affect the validity of the method. Quantifying function variability, according to definition, an output can be defined by timing and precision. In terms of timing, an output can occur too early, on time, too late, or not at all. ''Not at all" represents the possibility that output is so late to be used for its purposes or even not produced at all. In terms of precision, the output can be precise, acceptable, or imprecise. If the output is precise, it satisfies entirely the needs and requirements of its downstream function. If it is acceptable, it requires some adjustment in the downstream function, even bigger in case it is imprecise.
A fourth category, wrong, represents an output completely different from the expected ones. In this case, rather than adjustments, the downstream function requires improvisation, amplifying the function variability [36]. Analyzing these instantiations, it is possible to identify critical scenarios, human factors, risks, and variabilities that have a direct and intrinsic relationship with safety. Then a reasonable suggestion is to monitor and mitigate or dampen performance variability (through solution emerges to understand the interactions model indicators, barriers, design/modification, etc.) [37]. For unexpected positive results, one should, of course, look for (controlled) ways to amplify the variability rather than ways to dampen it [5].

A. PERFORMANCE SHAPING FACTORS
To improve safety and therefore reduce undesired events, it is necessary to understand how human performance is affected. The identification and analysis of the performance shaping factors (PSF) are one of the phases of this process. The quality of procedures, training, workplace design, organizational questions, environmental factors, and job conditions must be evaluated to make them compatible with human beings' limitations [38,39].
Some methods were used to collecting and classifying data on human performance at work, relying on the ergonomics approach. Techniques such as activity analysis, ethnographic observations, behavior mapping, and cognitive task analysis should be considered when an ergonomics expert needs information on factors affecting human performance [40]. The sequence of events that leads to an accident result from a complex interaction of components of the socio-technical system.
A methodological framework was proposed to identify the factors that affect the performance of operators of an acid unloading unit. In this phase, the ergonomics approach based on operators' work analysis was used as a supporting tool. Human performance is influenced by various factors, known as "performance shaping factors" (PSF). Understanding PSF has important implications for human reliability analysis (HRA), safety management, and risk management and control. Also, experimental studies have explored the effect of specific PSF indicators [32][33][34], which may provide information useful for quantifying the importance of PSF. As a risk indicator, PSF has several measurable quantitative properties (e.g., frequency, impact). In terms of operators' risk perceptions, we suggest a risk-based approach to identify the key PSF by ranking their risks.
Contextual factors such as high noise, low and high temperatures, and hazardous chemicals are considered to be contributors to unsafe human actions in accident analysis and also give a basis for assessing human factors in safety analysis [41]. Some failure modes are particularly dangerous and can result in severe accidents and damage to humans, the environment, and material assets.
The spectrum of performance shaping factors is large and can be approached in different ways, depending on the type of setting where the classification is performed, such as nuclear, medical, aviation, or chemical [38,39]. Kariuki et al. [42] considered human factors as a basic requirement for determining the safety quality of installations. The weak areas could be identified and improvements determined. This should lead to higher safety and operational efficiency. Factors related to the work environment and job factors within a workplace are usually known as human factors [43,44]. Kim and Jung [45] declared that these criteria, construction of the representative PSF and their subitems, were made using one or mixed method of the following structuring processes of each PSF's properties. The first structuring method is to use the full-set PSF-specific taxonomy. Important subitems for the assessment of each PSF are marked out from others. The second step is to choose representative PSF from PSF groups with similar meanings to organize subitems. Thirdly, other factors from the literature and HRA experts were also incorporated into those processes. The proposed taxonomy would require continual modifications in association with the development of the HRA methodology.

III. DEVELOPED METHODOLOGY
The following methodological framework is illustrated in Figure 1 step by step and detailed in the following subitems.

A. DESCRIPTION OF THE FIELD STUDY, THE DEFINITION OF WORK SITUATIONS TO BE ANALYZED
The activities of the standard procedure were defined and then compared to observations to identify the foreground and background functions in the nominal instantiation. The field study involved an acid unloading unit, commonly used in the chemical industry, where the production process involves batches. The chemical manufacturing company in this study, located in Bahia, Brazil, is the world's second-largest producer of white titanium dioxide pigment (TiO2). It has seven TiO2 plants across five continents, with two plants in the U.S.A., and one each in the UK, France, Saudi Arabia, Australia, and Brazil. Also, each plant has controls that aim to mitigate the shutdowns of the productive process.
Six factors are fundamental for pigment production: water, energy, natural gas, slag, ilmenite, and sulphuric acid. The sulphuric acid unit receives a standard quantity for the production process, then stores and distributes it to other units inside the plant. Programming is performed daily for the acquisition of sulphuric acid to meet the needs of production while maintaining a reserve. Monitoring is carried out using a spreadsheet for production control and sulphuric acid consumption. Communication between acid unloading and other sectors is via radio, e-mail, control and monitoring software, intranet with monitoring spreadsheets, and operational reports.
Background activities to the acid unloading process included activities relating to operator maintenance of the pump hoses, locks, and gaskets; drainage maneuvers of acid lines; sulphuric acid collection for laboratory analysis; inspection of sulphuric acid storage tanks; maneuvers of acid tank levels; cleaning of the work area; daily inspection of emergency eye-wash showers.
Data storage and inventory control involve a supervisory system, where it is possible to follow acid tank levels and input availability. There are also operational reports available on the intranet that present data for the work area. Tanker monitoring was controlled by those responsible for weighing the sulphuric acid vehicles and who are obliged to inform the panel operator in the control room of truck arrival. A camera enables the panel operator to monitor this procedure. The field operators have an important role in this process, as they manually enable access to the loading bay when necessary. They also make operational decisions, exchange operational information with each other and with engineers, and also undertake mechanical and instrument maintenance, to control the operational context. The operation is comprised of: 1 operational technician, 9 operators II and 14 operators I, of which 19 are from maintenance and carry out repairs and maintenance services such as valve and gasket changes.

B. AN ERGONOMICS APPROACH OF THE WORK ENTAILED OBSERVATIONS TO IDENTIFY FOREGROUND AND BACKGROUND FUNCTIONS
The first step leads an ergonomics approach of the work entailed observations, interviews, and analysis to identify foreground (FF) and background functions (BF). In this work, we considered data inputs and used the FRAM Model Visualizer (FMV) version 0.4.1. Preliminary analyses for documentation were performed during repeated visits to the operational facility, using standard procedures and safety risk analysis programs, while abiding by internal safety rules.
These documents served to validate activities and equipment relating to the acid unloading area. The FRAM model is based on observations in the workplace and interviews with operators to select appropriate activities. The analysis involves a study of the socio-technical system of the process, analyzing the productive process: technology, machinery, workstations, software, tools, etc. It also entails retrospective and documental analyses of the operational procedures; identification of the upstream and downstream functions and activities; identification of the characteristic functions from operator interviews (individually, in groups, technical) as well as photographs and videos.
In respect of the safety assessment, data search should conform to the main criterion i.e. the data must be relevant to the work performed. The quantification of time used in the FRAM instantiations helps in the performance evaluation of the observed activities. This specific instantiation involved two tankers arriving consecutively. It should be noted that there is an increase in corrective maintenance functions not listed in the formal procedure and which are not part of the operators' routine.
We analyzed in this work thirteen foreground and three background functions, which will be detailed below.

C. IDENTIFY VARIABILITY PERFORMANCE INCLUDED WITH INTEGRATION DURATION PHENOTYPE THAT CAN REFINE THE ANALYSIS
With the development of the "cup noodles" model, every function in a FRAM model is characterized by an analysis of the potential variability of the upstream production function to other five aspects (Input, Precondition, Resource, Time and Control) of the downstream function [5,44]. Output may cause variability of any of the five aspects, modifying variability performance. Hence, the task of this step is to examine the five aspects (of a function) one by one, within which variability is embedded. It is important to determine if the variability or a combination of aspects can contribute to, or cause, the variable performance of the output.
This work analyzes the potential instantiation at different instances in the process. The resulting variability indicates the functions that can cause a safety restriction. The ability to understand the resonance mechanisms subjacent to the performance variability of the functions is highly dependent on subjective interpretations and mental models. The FRAM Visualizer (FMV) shows this as a line that connects two aspects. This line is not direction-specific (i.e., there is no arrowhead), but the logic is clear that output goes from one function to another. The purpose of the coupling is shown in Figure 2.

D. AGGREGATION OF VARIABILITY TO IDENTIFY CRITICAL ACTIVITIES
Hollnagel [5] described the consequences of upstream on downstream variabilities using only two phenotypes, i.e., timing and precision considering a simple solution. It's important to observe that the consequences of the couplings between the output upstream function and the components of downstream functions are different in an automatized process and a batch process in which the decision-making is a human being. Patriarca et al. [36] declared that: "over the last years, researchers propose different ways to characterize the function variability, with different variability manifestation, the phenotypes: from the simple solution considering only two phenotypes, i.e., timing and precision, to the more elaborate ones adopting multiple phenotypes, i.e., speed, distance, sequence, object, force, duration, direction, timing. Note that this paper will evaluate the original configuration, only identifying time and precision as phenotypes as they can describe most consequences. A natural extension to the other phenotypes, even if it could refine the analysis, does not affect the general validity of the method.

FIGURE 2. Peer-to-peer coupling between Function 1 (FF-1) output to input and precondition of Function 2 (FF-2).
The analytical subjectivity of the evaluator is present and there is no control mechanism to convert theoretical concepts into practical analysis, taking into account the coherent analytical line of FRAM methodology.
In the simplest FRAM solution, when time quantification is used with a statistical treatment to identify critical activities, there is a difference between batch and automated processes. In batch processes, where a worker performs the process management, certain adaptations when carried out regularly, eliminating potential variability. There are also limitations when the evaluator has little process knowledge. Integration of the three temporal characteristics, classifying the FRAM analytical line by type of function and possible output variability concerning timing, precision, and duration, leads to an interpretation of the consequences of upstream and downstream function variabilities. Analyses undertaken between peer-to-peer interconnections were guided by FRAM tables [5]. In various phases of the analytical process, it was important to consider the endogenous and exogenous influences by function types, as well as the possibility of adaptations performed by human management and invariability elimination. Changes in the sequence of functions, such as the task execution time, can be affected by the individual operator's skill level and his/her process knowledge.
This work was carried out by analyzing potential instantiation at different instances in the process, and the resulting variability functions that can cause issues with safety. An understanding of the resonance mechanisms subjacent to the performance variability of the functions is highly dependent on subjective interpretations, and analysis of mental models. FRAM also increases reliability using interaction rules between the upstream output functions and the component aspects of the downstream function in each coupling, further substantiating the analysis. Systemic interpretation focused on a peer-to-peer study of the coupling's component functions, using variability analysis by function type (technological, human, and organizational) and the influence of endogenous and exogenous context variability. An integration Table 1 was created to include aspect duration in the analysis.
Following the FRAM line of interpretation, the consequence between the couplings of the output of the upstream function and the other aspects of the downstream function was analyzed through the integration of the three temporal characteristics. These analyses follow the FRAM model, but there is an observed difference in function components between batch and automated processes. In the automated process, the supervision management software does not account for delays to aspects such as input precondition and resource, unless a prevision had been made in the software design.
In the batch process, management is carried out by individuals who can introduce adaptations and regulations within the socio-technical system. This analytical aspect is not often observed but, in this case, it served to elaborate a specific table for the batch process. Table 1 summarizes the result of the analysis of the batch process, presenting the possibilities of variability for each function, its contributions, and the various consequences of the output couplings of the upstream functions for aspects of the downstream functions.
Some researchers have proposed different ways of characterizing function variability, with different variability manifestations of the outputs, from simple solutions using only two phenotypes (i.e., timing and precision) to more elaborate ones that adopt multiple phenotypes (i.e., speed, distance, sequence, object, force, duration, direction, and timing variability [36,46].

E. APPLICATION OF THE METHODOLOGY TO IDENTIFY THE CRITICAL ACTIVITIES ON THE SOCIO-TECHNICAL PROCESS BY THE PERFORMANCE SHAPING FACTORS CHOSEN HOW INDICATORS
Many human reliability analyses (HRA) methods use performance shaping factors (PSF) to model operator performance. The tendency in HRA is to increase PSF number results. This approach was elicited operators' perceptions of the influence of PSF indicators in the acid discharging area. The top-ranked PSFs in terms of perceived risk score and the PSF at the more frequently identified as the key PSF from the area. Through the key PSF, the affected priority activities were identified. A comparison with the FRAM method indicates that the importance of these key PSF in the operators' perceptions. Up arrow (↑) means that variability is likely to increase; Down arrow (↓), decreasing; () unchanged. In applying the method, the operating procedure prescribed was used. PSF states are defined on different scales depending on the selected method, but they generally range from low to high influence. HRA methods generally guide how to assess the state of a PSF through direct measurement or extrapolation. There are more than a dozen HRA methods that use PSF, but there is no standard set of PSF used among these methods. Within the HRA community, there is a widely acknowledged need for an improved HRA method with a more robust scientific basis [46,[47][48][49][50].

F. CHOICE OF THE CRITICAL PERFORMANCE SHAPING FACTORS BY EACH PROCESS FUNCTION OPERATOR'S ELICITATION
The questionnaire [51] was prepared based on the prescribed operational procedure, analyzing all 10 main functions through a specific classification of the PSF indicators which affect their performance in each function. The criteria used to choose PSF indicators in different categories and groups followed recent publications. A comprehensive list of 55 factors relating to Technological, Organizational, Human (cognitive and physical), and Task Complexity, was compiled and further analyzed. Hereafter we will call them groups. These PSF indicators are listed in Appendix A. Psychometric scaling techniques and pairedcomparison techniques have been used to capture subjective views and expert judgments concerning PSF relevance to human performance in various complex systems [52].
In social sciences, four types of psychometric scales techniques are used: nominal, ordinal, interval, and ratio scales [52]. In this study, a human factor specialist professional, working with experienced operating staff, researched several scientific articles to identify factors that influence human performance. The references used to choose PSF indicators in the different groups and categories followed a study methodology present in several recent scientific publications [45,52,[53][54][55][56][57]. Liu et al. wrote that "PSF indicators are used to measure and assess PSFs and describe the presence, or absence, of a PSF factor" [52].
An absolute value was attributed to each PSF indicator including the value zero which meant that every PSF indicator did not influence the analyzed function. Evaluation was performed using a Likert scale from 0 to 5, where 0 = no influence; 1-very little influence; 2 -little influence; 3medium influence; 4 -high influence; 5 -very high influence [12]. The questionnaires elicited the score of the influence grade for each PSF perceived by each operator. Equation (1) shows the score of the perceived degree of influence for a PSF group: where mean (PSF)g,o is the average score of the degrees of influence of the PSF belonging to the PSFg group; (PSF)i,o is the score of the degree of influence of a PSFi indicator evaluated by the operator o (there were 11 in total), and I is the number of PSF indicators belonging to the PSF group g. Equation (2) shows the score of the perceived degree of influence for a PSF category: where mean (PSF)c,o is the average score of the degrees of influence of the PSF groups belonging to the PSF c category; (PSF)g,i,o is the score of the degree of influence of the PSFi indicator evaluated by the operator o and belonging to the PSFg group; G is the number of PSF groups belonging to the PSF category c.
Equation (3) shows the score of the degree of influence for the PSF of a function f perceived by the operator o: where mean (PSF)f,o is the average score of the degrees of influence of the PSF categories that evaluate the function f; (PSF)c,g,i,o is the score of the degree of influence of the PSFi indicator of the PSF c category and belonging to the PSF g group, evaluated by the operator o, and C is the number of PSF categories.
Lastly, Equation (4) shows the score of the PSF degree of influence over a function f: where mean (PSF)f is the average of the scores of the degrees of influence of the PSF of a function perceived by all the evaluating operators and N is the number of evaluating operators.
Other PSF uses can be found elsewhere [58]. It is also important to cite those other procedures can be considered, for example, using multivariate techniques as correspondence analysis.

G. IDENTIFY THE CRITICAL ACTIVITIES USING \CRITICAL PSF'S BY INDICATORS
The collected data were submitted for statistical analysis and arithmetic means and standard deviations were determined. Averages were chosen as an evaluation parameter given Equations (1-4). Another advantage is that they enable interpretations when mean values are used to compare two or more similar groups. This study states that the level of criticality of a function was identical to PSF influence grade functions. Thus, once the averages of the influence grades for each function have been determined using Equation (4), the function with the highest score is designated as the most critical.

IV. RESULTS
The following results were found: This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.

A. ANALYSIS AND DISCUSSIONS ON THE VARIABILITY OF THE FRAM APPROACH IN THE ACTUAL INSTANTIATION PERFORMED
Functions or activities intended to be used as data in the FRAM Model Visualizer (FMV) were observed with instantiation representing all of the events and the respective coupling of the functions/activities. The timing parameters were based on the times at the beginning of the activity or function, adding precision but also including the duration of the activity as an important characteristic of the aggregation of variability study. Support of the analysis should consider the time of activity performed. Task sequencing affects the elaboration of FRAM instantiation and the quantification of time, depending on the skill and professional experience of the operator, a task can be eliminated from the process analysis.
The operating mode can affect the choice of functions at instantiation. For example, in respect of acid unloading, an experienced operator can receive two tankers simultaneously, eliminating the waiting function, where the operator reviews the operational checklist and carries out other administrative tasks. Less experienced operators prefer to work with one tanker at a time, receiving the second only when the first is already connected to the tank and discharging acid. In this instantiation, two tankers were attended consecutively. It should be noted that an increase in corrective maintenance functions was observed, not described in the formal procedure, but which are undertaken sporadically by the operators.  The function that awaits the unloading of tankers in the unloading bay only occurs when trucks arrive one at a time, enabling the operator to go to the operation room and wait for the tanker to be unloaded. Once there, the operator verifies the checklist and issues documents such as the authorizations required for services in the industrial area and analyses of safety procedures. The substitution function of the pump hose lock of Pump 1 is not a routine task but should occur when the operator identifies a need to change the pump hose, to comply with operational safety standards. The chlorine function analysis in the cooling tower depends on the operational needs of the shift in which it is performed. Figure 3 contemplates each interconnection of the production in the upstream function with aspects of the components in the downstream function, and the consequence resulting from this interconnection. Below, the result of this analytical process, and due to the number of interconnections, certain critical activities, trigger activities, and bottlenecks are identified.

B. ANALYTICAL RESULTS OF THE VARIABILITY BETWEEN THE FOREGROUND FUNCTIONS FF-2 AND FF-3
The coupling variability of the FF-2 output, about the arrival of the first truck, to FF-3 input, involved the difficulty to fill the initial checklist, as presented in Table 1 and illustrated in Figure 3. According to such table, this resulted in timing unacceptable, precision acceptable, duration unacceptable, and all integration, unacceptable. The variability increase in the input aspect of the downstream function occurs due to the integration of temporal characteristics, i.e. timing is associated with duration. The variability is due to the operator wearing chemical protective clothing that has a seat belt without usability. The increase in variability occurs in verifying both the condition of the vehicle and the accuracy of the documentation for the material transported, as this has a significant cognitive element associated with visual observation. The plan is to adopt control measures that would enable the completion of the initial checklist via visual access without writing.

C. ANALYTICAL RESULTS OF THE VARIABILITY BETWEEN FOREGROUND FUNCTIONS FF-4 AND FF-5
Analyzing how occurred the variability coupling between FF-4 output and FF-5 input, resulted in critical couplings. All couplings from FF-4 output became variabilities for the FF-5 input such as: i) connecting the acid transfer pump; ii) initiating the unloading tank truck T1; iii) performing vehicle inspection and filling next checklist; iv) cap removal and quick hose connection. Removal of the carriage locking latches tanker number 1.
The coupling integration result, according to Table 1, tended to increase the variability due to unacceptable timing and acceptable precision. However, the integration with duration resulted unacceptable.
The increase in variability occurs in vehicle inspection procedures. It is necessary to install a control involving a safety sensor in the tank manhole, to monitor if it is open. The sensor alarm must be both visual and audible to alert when the manhole cover is opened since the cover is removed when the tanker is leaving. It is necessary to check whether the valves are open because the acid product passes through the tank's discharge line. This control is currently carried out by the operator without the assistance of a sensor. It is important to create an alarm device to restrict the opening of the protective unloading cap if the valves for restricting the passage of the acid to the pump house remain open. If the operator opens the cap with the valves open, there is the risk of being covered by acid. After acid transfer, an additional procedure was created to enable engaging of the pump in reduced time intervals, thus avoiding residual acid in the hose.

D. ANALYTICAL RESULTS OF THE VARIABILITY BETWEEN THE FOREGROUND FUNCTIONS FF-6 AND FF-7
The coupling of FF-6 output for FF-7 input and pre-condition resulted in a variability increase. The outputs of the FF-6 function are: i) fill checklist and starting vehicle inspection of tanker T2; ii) opening the manhole and installing the safety sensor; iii) tanker T2 safely parking; iv) operator wearing chemical protective clothing and safety belt, following the inspection on tanker T1.
The inputs of the FF-7 function are: i) starting vehicle inspection and tanker T2; ii) opening the manhole and installing the safety sensor; iii) fill the checklist tanker T2, following safely parking and precondition tanker T2 safely parked.
According to Table 1, this analysis resulted in acceptable timing, unacceptable precision but resulted in unacceptable duration integration. This result was the same occurred on the coupling of FF-6 output for the FF-7 precondition.
There is a significant variability increase when another tanker arrives while the first is stationary, at discharging acid area. Safety, therefore, depends on the skill and decisionmaking ability of the operator.

E. ANALYTICAL RESULTS OF THE VARIABILITY BETWEEN THE FOREGROUND FUNCTIONS FF-7 AND FF-8
The variability analysis of the coupling of FF-7 output with FF-8 input resulted in critical couplings. These were the FF-8 inputs: i) connecting the acid transfer pump, initiating the discharge tanker T2; ii) removal of the cap and connection of the hose with quick coupling; iii) removal of the tanker T2 locking latches, following vehicle inspection; iv) and fill checklist tanker T2. There was an increase in variability with timing unacceptable and precision acceptable, but the duration with integration was unacceptable.

F. ANALYTICAL RESULTS OF THE VARIABILITY BETWEEN THE FOREGROUND FUNCTIONS FF-11 AND FF-12
Coupling variability analysis of FF-11 output plus FF-12 input and precondition was performed. The FF-11 output was: i) completed the checklist verifying that all steps have been done in tanker T1; ii) tanker T1 was released with the valves and top cover closed.
As a precondition of FF-12, the first tanker was released with the valves and top cover closed and the checklist was completed by the driver.
This increase in variability is due to the temporal characteristic (or phenotype) timing and association with duration considered critical. The aim is to implement control measures to assist checklist completion using visual access, negating the need for the operator to write anything. If the form is incomplete, a warning alarm must be activated.

G. VARIABILITY ANALYSIS USING FRAM TO IDENTIFY CRITICAL FUNCTIONS
An analysis of the batch process showed the variability possibilities for each function. This instantiation of a FRAM model identified couplings between critical functions. The functions variabilities occur from FF-2 output for FF-3 input due to the difficulty of usability between the writing inspection checklist when the operator wearing chemical protective closing and safety belt. The coupling of the output FF-4 with the FF-5 inputs occurs due to the design station of the acid discharging area. Recommendations were done and accepted after this study. The functions variabilities occur from FF-6 output for FF-7 input due to the difficulty of usability between the writing inspection checklist when the operator wearing chemical protective closing and safety belt. The skill and knowledge's operator are important when two tankers were received simultaneously.
The coupling of the output FF-7 with the inputs of the FF-8 function occurs due to the design station of the acid discharging area. The coupling of the output FF-11 with the FF-12 inputs occurs due to the necessity of automation's controls to complete the checklist.

H. PSF CONTEXT ANALYSES BASED ON THE OPERATIONAL PROCEDURE OF A UNIT FOR AN ACID UNLOADING UNIT
The three background functions are: BF1 -checking the operation of the emergency showers before starting the first discharge of each shift; BF2 -check if the dike drain is closed before unloading the first truck; BF3 -check if the alignment of the sulfuric acid tanks meets what was informed by the previous shift.
Ten foreground functions were identified as follows: FF-1 -check the basic support procedures before starting the first discharge of each shift; FF-2 -reception of the truck; FF-3placing individual protection equipment and inspecting its condition, inspecting fall prevention devices and seat belts; FF-4 -tanker inspection; FF-5 -sample collection: open tank manhole, check if the gasket is damaged and if the product level is correct; FF-6 -connect the pump hose to the tanker; FF-7 -Start the transfer; FF-8 -start the transfer with the security procedure; FF-9 -finishing transfer operation; FF-10 -releasing tanker.

I. CHOICE OF THE PERFORMANCE SHAPING FACTORS THAT CAN AFFECT OPERATORS' PERFORMANCE
The identified critical activities were based on the choice of functions in which critical human factors predominated in the different selected categories. Analysis of the socio-technical process and details of the questionnaires' functions were based on the prescribed procedure.
Quantifying the importance of PSF can help to identify which ones were required to predict critical activities [52]. All factors that can influence human performance, whether technological, environmental, organizational, or those related to Human Task Complexity (cognitive and physical), as well as interactions between these factors are essential. Such interactions are not only to avoid accidents but to promote a safe and productive operational environment.
PSF influence the performance of operators in respect of the safety of their actions and their decision-making. They describe not only the technical part of the system but also aspects related to the characteristics of the operators, their work environment as well as other organizational aspects [55].
The use of task analysis allows to identify operational restrictions such as procedures, interface design, and communication, and to ascertain whether there is enough information available to allow operators to make decisions when necessary [45]. Operator participation is fundamental, with the opportunity for individual operators to share their day-to-day experience and knowledge of the operational area.
After the PSF have been identified, interfaces must be modernized, and employment and design workplace improved. The supervisor will then know where to focus further resources and what type of risk reduction measures should be implemented.
Perceptions of experienced professional operators from the chemical manuHFfacturing company were collected. A total of 15 questionnaires were distributed of which 11 were completed. Table 2 shows the statistical results of the PSF for each function, utilizing 55 PSF based on the classification established for analysis. Table 3 shows the functions listed in decreasing order of criticality. The most critical function is the foreground function FF-1, which involves checking the basic support procedures before starting the first discharge of each shift. The least critical function is the background function BF-2, which involves checking the dike drain is closed before unloading the first tanker. Figure 4 shows the profile of the influence grade of the factors that affect the performance of the analyzed functions. Human factors (physical and cognitive) presented the highest influence, followed by organizational, task complexity, and technological factors. This profile demonstrates the effectiveness of socio-technical analysis based on human factors. However, other mathematical procedures can be done to perform a similar analysis. It is worth noting that in the composition of PSF functions (full line), as shown in Figure 4, the greatest participation is attributed to the human factor, while the lowest participation is attributed to the technological category. This confirms the characteristic of a batch process, where human management overlaps with software management, which is a PSF that belongs to the technological category. A significant contribution from the behavioral aspect validated the profile of the process and strengthened the analysis.

V. DISCUSSION
The results of the batch process analysis using FRAM instantiation, and the results from the questionnaires distributed to operators to identify critical functions in the process have been excellent. The majority of functions considered critical by the FRAM model were identified by the operators. Integration of the three temporal characteristics (phenotypes) by function type showed that duration, a temporal characteristic, can change the variability of a function in the socio-technical process and make certain functions critical, even when the integration of the timing aspect and precision aspect is acceptable or precise.
The next phase was the adoption of effective control measures. For each context analyzed it is necessary to have a specific PSF classification. These were used to represent situational contexts and causes affecting human performance in different systems [35].
In this article, three phenotype responses, based on the FRAM analytical line, were integrated: timing, precision, and duration. These are relevant for defining possible interconnections as well as the variability for each function in a socio-technical system. Macchi [23] carried out a study with an aggregated representation of performance variability, using the temporal characteristics of timing and precision. Ordinal data were proposed to represent the potential of a function to reduce or increase the variability of performance, and the choice of the median as an aggregator. This study integrated the duration phenotype and demonstrated that it can modify the variability of the coupling, specifically when the duration is too short or too long. Patriarca et al. [36] declared that a natural extension to the other phenotypes, even if it could refine the analysis, does not affect the general validity of the FRAM method. Liu et al. [52] created a resource to identify the essential PSF's in the process. Santos et al. [38] identified the factors that affect the performance of operators in the process. The differential of this study was to use the PSF's as critical indicators to identify the critical activities in the process [37,38].
Another finding showed differences in the variability of couplings for both automated and batch processes. The study demonstrated that the coupling between the output aspect of the upstream function for some aspects of the downstream function, such as input, precondition, and resources has different consequences depending on process type. In an automated process, controlled by supervisory software; if operational conditions are not met, the continuation of the process is blocked, unless there is a procedure within the management software that expects unexpected events. However, in batch processes, the task of management control is undertaken by the same individual who carries out the necessary modifications and adaptations, thus enabling the continuation of the process.
The study of the process using PSF, employed a specific research classification, based on literature and, importantly, was constructed in an integrated and consensual manner by both operators and specialists [45,52,[54][55][56][57]. The study differential involved analyzing the process by each function, which enabled the identification of critical functions. This type of analysis in more detail was not present in previous publications [38,52]. The operators' perceptions of the most critical functions were compared with the variability study utilizing the FRAM model and the result was excellent.
In the validation of the statistical approach was used the mean as the statistic parameter relied upon two pillars: a) references as Liu et al. [52]; and b) the Sampling Approach (Convenience or Intentional Sampling). It returned a matrix that having considerations of normality verified allowed us to use the mean as a valid statistic and useful data for the determination of the most influent PSFs. It is important to mention that once we decided to use the Likert Scale, we knew the limitations and different interpretations of the validity of the usage of the mean would imply. Theorists argue pro and con on this use. We had the option to use the median or the relative median to better explore and extract the opinion of the specialists but our option is considered valid too. The Likert Scale and the psychometrics embedded in it are complicated and demanding; they are frequently questioned but they also are very powerful and frequently used. Our sampling method, as opportunistic and not random; the sample size does not allow sophisticated statistical testing because statistical softwares (like SPSS) did not translate or return valid values for not large data sizes, rendering not useful this other approach.
The study also demonstrated that task execution time can be affected by a change in the sequence of functions, as well as the operator's competence and knowledge of the process. There is a need for construction through observation of activities at the site where processes are carried out, observing different shifts and different professionals to compose the instantiations for analysis. There is also a need for the analyst monitoring the operators to have the requisite knowledge of the process. In quantifying the time of activities that are part of the functions, it was identified that in the processes involving human management, adaptations are made to eliminate potential variability; whereas, in processes managed by supervisory software, whether automated or semiautomated, not always it is possible because time is the determining factor. It should be stated that there are analytical differences in the study of variability in certain components.
To reduce the analytical subjectivity, using the methodology of the PSF Framework, questionnaires, based on the taxonomy chosen by specific scientific publications, were elaborated by a study of operators, being chosen the PSF's for each function of the analyzed process. The identification of the most critical functions followed the criterion of the predominance of critical PSF's. The results were compared with the results of the critical functions analyzed by the FRAM method. The resilience of the system depends on the degree of understanding of the interconnections of its components, and the FRAM method proved to be a useful tool to measure these systemic interactions.
The use of the FRAM Model shows an overview of the production process to be analyzed, mapping the function couplings. FRAM builds a detailed model of the process, which explains the interconnections between components of the functions. In this study, we identified which functions were most requested and which could cause bottlenecks or delays to the process, and this macro view was important for process safety. Evaluation of the potential variability of function components, starting with the exogenous and endogenous influence of the context and including variability of components by function type, technological, organizational, and human, amongst othershelps indicate where this potential variability can cause unsafe deviations from procedures, enabling appropriate adjustments to be made. The comprehensive nature of FRAM provides several opportunities for combining FRAM methodology with multiple tools and approaches, thus enabling the analysis of specific problems while retaining an overall socio-technical system perspective [38]. The theoretical basis of FRAM, combined with the philosophy of studying interactions between functions and interconnections, promoting a comprehensible analysis. The variability is sensitive concerning function types and possible adaptations, especially in batch processes, and it is worth reiterating that in a FRAM study, a sound knowledge of the process is essential.

VI. CONCLUSION
The comparison of the FRAM model critical activities with critical activities had found by methodological PSF's analysis makes it possible to approach complex problems from a human perspective, while at the same time maintaining a safe technical relationship with the actual process information supplied by users of the socio-technical system. This is an innovative approach that allows for an alternative perspective on how process safety is interpreted. Through the integration of the three phenotypes responses, theoretical concepts were transferred into practical analyses. In this way, the study of the process follows the coherent analytical line of the FRAM model, thereby decreasing subjectivity. The use of a questionnaire to obtain information on factors that affect human performance proved to be successful, increasing user participation in a socio-technical system and identifying critical activities of the process. The development of future practical studies, utilizing FRAM in conjunction with other tools, can be served to strengthen the socio-technical analytical process.

ACKNOWLEDGMENT
This research received the support of Cristal Pigmentos do Brasil (S.A.) via the participation of professional staff, trained in ergonomics, and who work in the industrial arena. MLAM is also grateful to the Department of Industrial Safety Coordination and Occupational Health from Cristal, who has always been supportive of this research. This study was financed in part by the Coordenação de Aperfeiçoamento de Pessoal de Nível Superior -Brasil (CAPES) -Finance Code 001. Updating and availability of procedures, plans and rules 1 5 10

APPENDIX
Quality of procedures, standards and regulations 1 5 11 Communication and cooperation 1 6 12 Change of pattern (working hours, breaks, crew) 1 6 13 Database and information on maintenance, accident events, updated information on equipment, updated industrial plants Noise, heat and lighting in the operational area 3 3 36 Accessibility in operational areas 3 3 37 Inadequate workplace layout and configuration 3 3 38 Activities with displacement or manual weight lifting 3 3 39 Stress in the (23 x 07) h shift 3 3 40 Stress in the (07 x 15) h shift 3 3