# A Resilience Engineering Approach for the Risk Assessment of IT Services
## 2 Materials and Methods
### The Functional Resonance Analysis Method (FRAM)  
In brief, the method's scheme and functioning can be summarized in the following main phases:  
1. Definition of the goal of the analysis;
2. Identification and definition of the functions;
3. Definition of the variability of each one of the functions;
4. Variability aggregation;
5. Identification of possible solutions. In the first phase, the objective of the analysis is defined, such as risk assessment or hazard analysis, as well as safety management. The second step concerns the description of the tasks/functions that allow the system's functioning, they include human, technological, and organizational activities, and based on the taxonomy provided by [PERSON] [14], each function is characterized by the following aspects:  
* Input (I), representing the function's starter or transformer;
* Output (O), which is the result of the function's transformation;
* Precondition (P), i.e., what should happen to allow the function's transformation;
* Resource (R), i.e., what is needed for the function's activation or transformation in order to achieve the output;
* Time (T), representing the time constraints that can affect the function;
* Control (C), i.e., the control and monitoring modes of the function. These aspects are usually graphically related to each function by means of a hexagon, as schematized in Figure 1: they represent a certain status of the system, not an activity. It must be noted that if a system is characterized by a sequence of activities, each step of such a sequence can be identified as a function. Conversely, a more specific analysis is needed to bring to light elementary actions/tasks characterizing the system, e.g., by means of tools such as the Hierarchical Task Analysis (HTA) technique that allows the decomposition of complex tasks [40]. In such a context, it must be noted that while the term \"task\" refers to planned working activities (i.e., \"work-as-imaged\"), the term \"activity\" identifies their practical execution (i.e., \"work-as-done\") [41]. The goal of the third step is to define the variability of each one of the functions/tasks that characterize the system. In other terms, the analysis is focused on ascertaining the variability of function output, which is usually classified as:  
* Endogenous or internal variability;
* Exogenous or external variability;
* Influenced by upstream functions, i.e., when a functional upstream-downstream coupling occurs. Based on this, following the taxonomy proposed by [PERSON] [14], the output variability of each function can be estimated considering both time and precision, as reported in Table 1, where the functions (Fu) are classified into the three categories: human (M), technological (T), and organizational (O). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Fu** & **Precise** & **Acceptable** & **Imprecise** \\ \hline T & Normal & Improbable & Improbable \\ M & Possible & Typical & Possible \\ O & Improbable & Possible & Probable \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Classification of the functions in the FRAM method. Figure 1: Scheme of a hexagonal representation of a function in the FRAM method. Then, for each function, the variability can be evaluated following the criteria proposed in Table 2.  
The variability aggregation step aims at verifying if and where functional resonance can occur by means of the analysis of the upstream-downstream couplings, which allows us to understand how the output of each function can be related to the different aspects of the others [42]. At a general level, five different types of upstream-downstream couplings should be considered: between input and output; between output and preconditions; between output and resources; between output and control; and between output and time.