⚡ electrical engineering

A Choquet–Sugeno Framework for Non-Additive Variability Quantification in FRAM: An Aviation Safety Application

This paper proposes a novel Choquet–Sugeno framework integrated with an AI-driven AHP protocol to quantify non-additive variability in the Functional Resonance Analysis Method (FRAM), demonstrating through an aviation safety case study that this approach captures systemic risks invisible to traditional additive models.

Original authors: Joao Guilherme Fowler, Moacyr Machado Cardoso Júnior

Published 2026-08-04

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Joao Guilherme Fowler, Moacyr Machado Cardoso Júnior

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to understand why a complex machine, like a giant spaceship or a busy airport, sometimes crashes. For a long time, safety experts looked at these machines like a row of dominoes. They thought, "If one domino falls (a mistake happens), it might knock over the next one, and eventually, the whole line falls." This is called an "additive" view: you just add up all the little mistakes to find the total danger. But in the real world, things are messier. Sometimes, two small mistakes don't just add up; they multiply. It's like mixing baking soda and vinegar: separately, they are harmless, but together, they create a giant foam explosion. This is called "non-additive" or "resonant" risk.

The paper we are looking at comes from the field of Resilience Engineering, which studies how complex systems (like aviation) handle surprises. It uses a tool called FRAM (Functional Resonance Analysis Method), which maps out all the different jobs a system has to do and how they talk to each other. The big problem with FRAM has always been that it's great at drawing pictures of how things could go wrong, but it's terrible at giving a number to how bad it would be. It's like having a map of a storm but no way to measure the wind speed. This paper tries to fix that by bringing in some fancy math called the Choquet integral and Sugeno measures. Think of these as a super-smart calculator that doesn't just add numbers; it understands that some mistakes make other mistakes much worse, while others might actually cancel each other out. The authors want to know: Can we finally put a precise number on this "explosive" mix-up of errors to help keep planes safe?

The Paper's Big Idea: The "Explosion" Calculator

The authors, João Guilherme Fowler and Moacyr Machado Cardoso Júnior, have built a new framework that mixes the FRAM map with this special math. They call it the Choquet–Sugeno Framework. Instead of just saying, "Mistake A plus Mistake B equals a bad day," their new method asks, "How much do Mistake A and Mistake B amplify each other?"

To test this, they built a digital model of a very specific, high-stakes airport job: clearing a runway for a vehicle to cross while a plane is landing or taking off. This is a dangerous dance where a ground vehicle and a flying machine must not meet. They used their new math to analyze three real-life aviation disasters that happened over 40 years:

Aeroflot Flight 3352 (1984): A plane crashed into maintenance vehicles on the runway in Russia.
LATAM Airlines Peru Flight 2213 (2022): A plane hit a fire truck during takeoff in Lima.
Jazz Aviation Flight 646 (2026): A plane collided with a fire truck while landing in New York (LaGuardia).

What They Found: The Hidden Danger of "Teamwork"

The most exciting thing this paper found is that traditional math misses a huge chunk of the danger.

When the authors calculated the risk using old-school "additive" math (just adding up the mistakes), they got a certain number. But when they used their new Choquet–Sugeno math, the risk score jumped up significantly. They found that the "teamwork" between mistakes—where two functions fail at the same time and make each other worse—accounts for 10.9% to 16.5% of the total risk.

This is a big deal. It means that if you only look at individual mistakes, you are blind to nearly one-sixth of the actual danger. The paper argues that this "invisible risk" is the reason why some accidents happen even when no single person made a catastrophic error. It's the combination of small errors that creates the disaster.

The Star of the Show: The Controller's Brain

In their model, they identified one specific job as the most important "hub" of the entire system: ATC Situational Awareness (F1). This is basically the Air Traffic Controller's ability to know exactly where every plane and vehicle is at all times.

Using a mathematical tool called the Shapley value (which measures how much each part contributes to the whole), they found that this one function is responsible for 36.7% of the total risk. That is more than double the contribution of the next most important job!

The Lesson: If the controller loses their "big picture" (maybe they are tired, distracted, or the radio is bad), the whole system becomes incredibly fragile. The paper suggests that fixing this one area—keeping the controller's attention sharp and their information clear—is the single most effective way to prevent these crashes.

The "Barriers" That Didn't Work

The model also looked at safety systems, like the RIMCAS (a radar system that warns controllers if a vehicle is on the runway). In the 1984 crash, this system didn't exist. In the 2022 and 2026 crashes, it existed but was "degraded" (it wasn't working perfectly, maybe because the vehicles didn't have the right transponders).

The math showed that when the controller's awareness (F1) and the vehicle crossing (F5) both failed, the safety system (F8) was overwhelmed. It's like having a single fire extinguisher in a room where ten fires have started at once. The paper found that the safety barriers were only able to offset a tiny fraction of the risk because the "teamwork" of the failures was so strong. The authors suggest that simply upgrading the technology (like giving vehicles better transponders) is the best way to fix this, but only if the controller's awareness is also protected.

The "Downstream" Trap

Another surprising finding was about Communication and Readback (F7). In many safety models, people think that if a pilot or driver repeats back a message, it acts as a safety net to catch errors. But this paper's model shows that in this specific system, communication is just a messenger, not a guard.

If the controller (F4) makes a mistake and gives the wrong permission, the person repeating it back (F7) just passes that wrong permission along. They can't fix the error because they are just repeating what they were told. The paper argues that we shouldn't waste money trying to make the "messenger" perfect if the "boss" (the clearance decision) is broken.

The Verdict

The authors are very clear: their method is a simulation based on expert opinions and historical data, not a magic wand that solves all safety problems. However, they are confident that their math is solid. They proved that non-additive interactions (the explosive mix of errors) are real and measurable.

By using this new framework, safety managers can stop guessing and start seeing exactly where the "resonance" happens. They can see that LATAM Flight 2213 was the most dangerous case (with a risk score of 0.710) because every single part of the system had a problem at the same time, creating the biggest possible explosion of risk. In contrast, the 1984 crash was deep but narrow; only a few parts failed, so the total "resonance" was lower.

In short, this paper gives us a new lens to look at safety. It tells us that in complex systems, 1 + 1 does not equal 2; sometimes it equals 10. And if we want to keep the skies safe, we need to stop counting the dominoes and start measuring the explosions.

Technical Summary: A Choquet–Sugeno Framework for Non-Additive Variability Quantification in FRAM

Problem Statement
The Functional Resonance Analysis Method (FRAM) is a widely adopted qualitative framework for modeling risk emergence in complex sociotechnical systems, positing that accidents arise from the non-linear "functional resonance" of variabilities across coupled system functions. However, the method's predominantly qualitative nature limits its utility in contexts requiring quantitative risk indices for regulatory compliance and decision support. Existing quantitative extensions of FRAM (e.g., Monte Carlo simulations, Bayesian Networks, or formal probabilistic representations) suffer from a critical structural limitation: they presuppose that contributions from aspects within a function, or from functions themselves, aggregate independently or additively. This assumption contradicts the foundational premise of FRAM, which relies on non-linear, synergistic interactions where the whole exceeds the sum of its parts. Consequently, current methods fail to formally capture the "resonance gain" produced by simultaneous, non-additive degradations, rendering a significant portion of systemic risk invisible to linear models.

Methodology
This paper proposes a formal integration of the Choquet integral with respect to a Sugeno $\lambda$ -measure into the FRAM framework to address the non-additivity gap. The methodology operates through a six-step process:

FRAM Model Construction: The system is defined as a set of functions with six aspects (Input, Output, Preconditions, Resources, Controls, Time). Directed couplings between functions are assigned coefficients representing the proportion of variability transmitted.
Expert Elicitation of Aspect Densities: A structured five-phase protocol, implemented via a custom AI agent, is used to elicit Sugeno densities ( $g_i$ ) for each aspect. This process utilizes the Analytic Hierarchy Process (AHP) on a Saaty 1–9 scale to determine relative weights, enforces a real-time Consistency Ratio (CR < 0.10), and determines the interaction regime (superadditive, additive, or subadditive) to compute the Sugeno parameter $\lambda$ .
Intra-Function Variability Accumulation: For each function, a Variability Accumulation Index (VAI) is computed using the discrete Choquet integral. This aggregates aspect variabilities while accounting for their synergistic or redundant interactions defined by the capacity $\mu$ .
Inter-Function Propagation: Function-level VAIs are propagated across the network using a probabilistic OR operator, modeling how variability flows from upstream to downstream functions.
System-Level Aggregation: A second-order Choquet integral aggregates the propagated VAIs at the system level. This step utilizes system-level densities and interaction coefficients to capture the non-additive resonance between functions.
Interpretation and Intervention: The framework employs Shapley values to decompose the total system risk, identifying dominant functions and quantifying the "resonance gain"—the additional risk attributable solely to non-additive interactions.

Key Contributions

First Formal Integration: This work presents the first integration of the Choquet integral within FRAM function aspects, providing a mathematically rigorous mechanism to quantify non-additive interactions.
Structured Elicitation Protocol: The development of a five-phase AHP-based protocol, executed by an AI agent, allows for the consistent and real-time elicitation of Sugeno capacities, ensuring mathematical coherence and expert validation.
Quantification of Invisible Risk: The framework explicitly quantifies the risk component that is "structurally invisible" to additive models, distinguishing between the depth of individual failures and the breadth of systemic resonance.
Topological Analysis: The application of Shapley values and Murofushi–Soneda interaction indices within the FRAM context allows for the identification of topological hubs and the re-evaluation of function roles (e.g., distinguishing between barriers and transmission nodes).

Results: Runway Vehicle Crossing Clearance Case Study
The framework was validated using a nine-function FRAM model of the runway vehicle crossing clearance process, analyzed against three historical aviation incidents: Aeroflot Flight 3352 (1984), LATAM Airlines Peru Flight 2213 (2022), and Jazz Aviation Flight 646 (2026).

Dominant Risk Driver: The Shapley analysis identified "ATC Situational Awareness" (F1) as the topological hub and dominant risk driver ( $\phi_1 = 0.367$ ), with a coupling degree of 11. This function's degradation was the primary enabler of downstream failures in all three incidents.
Non-Additive Risk Quantification: Non-additive interactions between simultaneously degraded function pairs accounted for 10.9% to 16.5% of the total Choquet risk index for each incident. This "resonance gain" is entirely absent in additive models.
Incident Ranking: The framework ranked LATAM 2213 as the highest-risk incident ( $C_\mu = 0.710$ ), driven by the simultaneous non-zero variability across all nine functions, creating the broadest systemic resonance. Aeroflot 3352 ( $C_\mu = 0.644$ ) demonstrated that deep individual failure without broad systemic coupling results in lower aggregate resonance risk compared to LATAM.
Structural Insights: The model revealed that "Communication & Readback" (F7) acts as a downstream transmission node rather than an upstream verification barrier, as it receives authorization from the clearance function (F4) as its primary input. Additionally, the protective capacity of the RIMCAS system (F8) was found to be insufficient to offset the synergistic amplification of ten active couplings when F8 itself was degraded.

Significance and Claims
The paper claims that this framework addresses a critical methodological gap in quantitative FRAM literature by providing a tractable, theoretically principled tool for resilience quantification that preserves the non-linear resonance logic of the original method. The authors assert that the Choquet integral, elicited through their structured protocol, enables the derivation of a quantitative systemic resilience index that additive models cannot recover.

The significance of the work lies in its ability to:

Formalize Resonance: Move beyond qualitative descriptions to mathematically model the amplification of variabilities.
Prioritize Interventions: Use Shapley decomposition to provide a ranked, quantitative basis for safety interventions that reflects the synergistic structure of risk, rather than treating functions as independent contributors.
Bridge Theory and Practice: Offer a framework implementable in open-source code (base R) that scales to complex models (up to 12 functions) within a single working day of structured elicitation, making non-additive risk analysis accessible to practitioners.

The authors conclude that the integration of the Choquet integral with FRAM is not merely a theoretical refinement but a necessary evolution for safety-critical systems where the interaction of variabilities, rather than their sum, determines system safety.