An explorative Bayesian analysis of functional dependencies in emergency management systems

Abstract

The study of emergency or crisis management practices acquires strategical relevance for resilient decision-making under uncertainty. The assessment of system resilience is an asset to identify potential design or operational improvements of a complex socio-technical system, such as an Emergency Management (EM) system. This research aims at analyzing the functional properties of an EM system recurring to a novel integration of the Functional Resonance Analysis Method (FRAM) and Bayesian Belief Networks (BBN). The FRAM is used to model and display the actors and the interactions in the system, while the BBN, dynamically updated when new data becomes available, supports a complementary quantitative assessment. The methodology is iterated in the analysis of an EM procedure, issued by a second-line Emergency Response organization for Oil and Gas (O&G) operators in Norwegian continental shelf. The results of the study show that the proposed stochastic methodology compensates the drawbacks of traditional FRAM modeling, via the outcomes of BBN quantitative analyses. The findings, contextualized in EM, can be transferred to different socio-technical contexts, both military and civil ones.

1 INTRODUCTION

Emergency or crisis management in both civilian and military contexts can be regarded as a complex socio-technical system.¹ Emergency management (EM) consists of a set of components and relationships and mainly deals with collective sense making, team decision making, and coordination among different technical and human agents.² An organization to operate successfully in this context should demonstrate a fundamental capacity, necessary to cope with the emergent situations, that is, resilience.³

Managing or even building resilience is a complex practice that requires a reconsideration of available risk management methods and models. Different approaches are needed to address complex systems’ main peculiarities like uncertainty, high interconnectivity, dynamism, and volatile operating environments. The literature already available suggests that new approaches are necessary to integrate different perspectives (e.g., topological, functional, dynamic) and to guarantee an augmented capacity of dealing with uncertainties and complexity.^{4, 5} These approaches can be either qualitative or quantitative, or hybrid.⁶ A framework made up of three tiers is proposed to classify these approaches. Each tier has its own specific objectives, tools, and methods: (i) Tier I involves the use of existing data, conceptual models, and experts’ elicitation or judgment, in order to make available a comprehensive understanding of system's functioning; (ii) at Tier II, decision analysis methods (such as Multicriteria Decision Analysis) are adopted to reveal the structure of the system, to compare alternatives, or to check scenarios, that later on, in Tier III, can be further investigated. The last tier, Tier III, aims to model real-word systems with the highest fidelity possible, through (e.g.) agent-based models that allow dedicated simulations, system dynamics models, graph theory, or Bayesian Networks. While Tier I and Tier II can make usage of either qualitative or quantitative approaches, Tier III is mostly quantitative by nature.

At any modeling tier, the study of emergency or crisis management resilience acquires a strategical relevance for decision-making. This latter should embrace a systemic perspective to deepen adaptive practices and to seek systemic rather than localized solutions,⁷ according to the discipline of resilience engineering (RE). The need for systemic approaches has been highly debated both in the context of EM² and modern safety management,⁸ and it constitutes the foundation of this manuscript, too. By learning from modern safety management, organizations which deal with emergency or crisis management can adopt a systemic perspective and take advantage of modern analytical methods, too. A Tier II method according to Linkov's classification,⁶ particularly helpful to deal with socio-technical aspects from a systems-theoretic perspective, is the Functional Resonance Analysis Method (FRAM).⁹ To add a quantitative dimension to the study of the resilience potentials of a socio-technical system, a Tier III method like Bayesian Belief Networks (BBN) can be adopted. The notion of resilience potentials is here used to describe the inherent capability of a system to act resiliently against changes or disruptions, learning from past events to improve future performance.

BBNs are relevant for this scope since they utilize an underlying network structure—in our case offered by a FRAM model composed by multiple instantiations—and respective conditional probability tables to apply Bayesian probability concepts, where parent nodes contain prior information for updating beliefs about a node. Similarly, updates about child nodes' states can revise the beliefs available about parent nodes through Bayesian inference. This notion emerged in 1988 and was later refined in 1989 by, respectively, Judea Peral and Richard Neapolitan, as documented in a recent book on the topic.¹⁰

On this basis, this study aims at providing an explorative method to analyze functional properties in complex socio-technical systems, as means to understand the system’ resilience potential through a mixed Tier II—Tier III approach, respectively, FRAM and BBN. The scope of the study goes indeed beyond technical modelling of failures,¹¹ and it does not tackle EM as a decision-making and leadership aspect per se,¹² but it offers an attempt to bridge those aspects investigating their symbiotic links and relations about how humans interact with technical agents to deal with complex operating scenarios.

This modeling attempt is imperfect by definition, yet it remains meaningful since it offers a viable strategy built across the notion of simplexity, that is, a fusion of sufficient complexity of thought with simplicity of action.^{13, 14}

The FRAM is useful to model the actors and the interactions within the system, while a BBN offers the capacity to quantify the resulting relationships, being dynamically updated when new data becomes available. The analysis of an EM procedure, issued after three Covid-19 contagion outbreaks on offshore O&G rigs and described in Cantelmi et al.,¹⁵ has been selected to demonstrate the performance of the proposed methodology. Covid-19 related events are here used to foster learning and preparedness for other scenarios.¹⁶ This case study is intended to provide a proxy measure of system's resilience in terms of system's functional resonance, that is, the possibility that variability becomes unmanageable, in accordance with FRAM theory.

The remainder of the study is organized as follows: Section 2 presents a literature review on the FRAM and BBNs related to the EM context; Section 3 gives an overview on the theoretical foundations of the approach; Section 4 details the proposed methodology; Section 5 illustrates the case study and introduces the results; Section 6 discusses the obtained results and the methodology and finally, the conclusions are summarized in Section 7.

2 LITERATURE REVIEW

The FRAM has been frequently listed as a core method within Resilience Engineering,¹⁷ as proved by the number of scholars using it in the field. Smith et al.¹⁸ stated that resilient elements such as robustness and rapidity can be understood by using a FRAM-based methodology, as proven in the execution of an industrial operation.

With reference to EM, usages of the FRAM can be found in several instances, (e.g.) Oil and Gas (O&G),¹⁹ environmental defence centers (EDCs),²⁰ offshore lifting operations,²¹ petrochemical companies.²² Even more specifically, in a previously published study,¹⁵ the FRAM has been used to investigate how Covid-19 changed some well-established EM procedures, demanding for high levels of organizational resilience.

Starting from the findings of the latest study mentioned, this study aims at assessing the functional properties of an EM procedure which has been issued as a learning opportunity after Covid-19 outbreaks on Oil & Gas rigs offshore. The proposed Tier II/Tier III approach leverages on the integration of quantitative assessment provided by the participatory development of dedicated BBNs.

They are referred Bayesian since their underlying usage of Bayesian statistics, which remains a valuable asset for risk management.²³ In particular, several research efforts have been portrayed with respect to techno-centric risk assessment (see, e.g., the study of under-deposit corrosion²⁴ or explosion in storage tanks²⁵). More recently, the attention shifted toward resilience assessment, often embracing a larger socio-technical unit of analysis. For example, Qiao et al.²⁶ conducted a resilience assessment for the Northern Sea Route based on a Fuzzy BN; Hossain et al.²⁷ adopted a BN to assess the resilience of an interdependent electrical infrastructure system. More closely related to the scope of this study, scholars have also introduced BBN to study emergency management. Liu et al.²⁸ applied BBN to analyze the role of emergency organization elements in the evolution of flood Na-Tech events. Jäger et al.²⁹ designed a decision support system for emergency managers based on a BBN for the hot and cold phases of coastal risk management in UK. Two manuscripts^{30, 31} presented a risk-based framework of dynamic decision making for dam-break EM based on BBN. Finally, Oliveira et al.³² presented a decision support tool to address rare events such as disease outbreaks in a “closed” environment. Specifically, the authors focused on a case study of the Covid-19 outbreak that happened on board the Diamond Princess cruise ship in 2020, by adopting BBN as the core of an intelligent decision support tool to assist EM actions.

Some previous attempts in literature suggest the integration of FRAM, generally to describe system functions and identify potential variabilities and their critical couplings, with a BBN model to quantitatively assess a characteristic or a property of the system under exam. Ramirez-Agudelo et al.³³ introduced a method for FRAM and BN integration to structure and organizing expert knowledge and turning it into a probabilistic model to assess the safety and security of Offshore Wind Farms. Qiao et al.³⁴ assessed resilience when involving maritime liquid cargo emergency response by integrating FRAM and a probabilistic-based BN. Finally, Zinutellina et al.³⁵ utilized FRAM to describe system functions, couplings, and variabilities and a dynamic BN to quantify resilience in a chemical process system, tightly interacting with technical-human-organizational settings.

Nonetheless, to the best of our knowledge, there is no research explicitly dealing with assessing the functional properties of a new EM procedure, issued as a learning opportunity after the management of three real emergency cases. As above mentioned, some scholars attempted to combine the FRAM with BN, still without delving into the analytical aspects and formalizing its application in a reproducible methodology. This study aims to fill this open gap. Furthermore, this work is precisely contextualized in an EM procedure, paving the way to a systematic modelling of interdependencies in a safety-critical highly volatile domain. Consequently, the contribution of the study can listed to: (i) propose a systematic assessment of the potential for functional resonance, as a proxy for system resilience, following the integration of FRAM and BN; (ii) offer an iteration of this approach in EM; and (iii) foster the capacity of optimizing resilience of an EM procedure, by updating BN parameters based on newly available information. This aspect is particularly relevant for scenarios like the ones experienced during early Covid-19 infection management, where information was fragmented and updated dynamically. The operational experience offered by the pandemic is here used to favor learning and provide practical endeavors for assessing performance uncertainty properly.

3 THEORETICAL FOUNDATIONS

3.1 FRAM building steps

The proposed methodology starts by using FRAM, a systems-theoretic approach grounded in resilience engineering (RE), helpful to deal with socio-technical aspects.⁹ FRAM relies on four principles aligned to organizational resilience and RE: equivalence of successes and failures, approximate adjustments, emergence, and functional resonance. The method, assuming that the actions played by individuals or organizations can produce both successes or failures depending on the adjustments adopted on a daily basis, aims at assessing the functional resonance, which could emerge from the couplings and the variabilities of those actions.

The four traditional building steps for a FRAM model are listed below.

• -

  Step 1: identify and describe the essential system functions.

  FRAM describes a complex socio-technical system following a functional perspective, where each function refers to tasks or activities required to produce a certain outcome. Each function is characterized by six fundamental aspects, graphically represented at the corner of a hexagon: Input (I), Precondition (P), Resource (R), Output (O), Control (C), Time (T). In particular, Input is what activates or starts a function and/or that is used or transformed by the function to produce the output. Preconditions refer to those conditions to be satisfied before a function can be carried out. Resource is something that is needed or consumed while the function is performed. Control is what supervises, regulates, or monitors the function such as guidelines, regulations, technical means, or even social expectations. Time refers to the temporal constraints on the function such as duration and starting point. Output is the outcome of a function, the state change, or its result. Functions are interconnected via the aspects placed in the corners of the hexagons.

• -

  Step 2: identify the actual or potential variabilities between functions.

  The performance variability of a function can be categorized in terms of its origin, endogenous, exogenous, and/or interaction variability, and characterized by different phenotypes (e.g., timing, precision, speed, distance, sequence, duration). In line with Hollnagel, in the present study, timing and precision have been chosen among other phenotypes because they represent the simplest solution to describe the consequences of performance variability.⁹ More on the definitions and the use of these two phenotypes can be found in Section 6—Discussion, including a wider modeling perspective that could rely on metadata.

• -

  Step 3: analyze the aggregation of variability.

  In a FRAM model, the “output” of a function interacts or couples with other functions. The output of an upstream function may vary and then transfer the variability to its downstream function(s). Since the aggregation of these variabilities may cause functional resonance in the system and lead to undesired outcomes, all upstream/downstream interactions must be studied in terms of timing and precision.

• -

  Step 4: propose ways to manage variability.

  This last step aims at mapping what should be the most effective strategies to manage, rather than simply reducing, functional variability.

3.2 Bayesian belief network description

A BBN is a probabilistic model consisting in a directed acyclic graph, usually describing an event or a process that occurs stochastically, according to the presence or not of certain causes. In this work, BBNs have been used to add a numerical dimension to FRAM assessment. BBN found its theory on the Bayes theorem, which allows to calculate the probabilities of the causes that determined an event. Let us consider two different variables A (the cause) and B (the event), whose a priori probabilities are indicated as P(A) and P(B), respectively. The posterior probability P(A|B), that is, the probability that the cause A occurs knowing that the event B has already occurred, following the Bayes theorem, is given by:

$$$$\begin{equation}P \left( {A{\mathrm{|}}B} \right) = \frac{{P\left( {B{\mathrm{|}}A} \right)*P\left( A \right)}}{{P\left( B \right)}} \end{equation}$$$$(1)

where in Equation 1, P(B|A) is the conditional probability, which expresses the probability of B given A.

BBN nodes can be distinguished in child, intermediate, or root nodes. The latter ones do not have parents, that is, they do not have incoming edges, and represent independent variables, which are described by their a priori probabilities. Child and intermediate nodes are dependent variables described through conditional probabilities related to their respective parent nodes. Since the BN variables are usually discrete, to determine the probabilities of these two types of nodes, conditional probability tables (CPTs) must be filled for each node, considering each combination of parent states. For example, given a system of discrete binary variables, a node with m parents takes 2 m parameters to fully define the CPT of each possible case. This is usually achieved by fitting given data, or by using expert elicitation and data-driven approaches. In the following Section 4, an approach is presented to reduce the number of parameters, recurring to the Noisy-OR gates.^{36, 37}

BBNs sustain inference, that is, to consider incomplete and uncertain evidence on observed variables, and thus dynamically update the marginal distributions of the missing ones. For this reason, BBNs are useful for reasoning about the specific causes of the observations, and for estimating their consequences.³³

This kind of inference is called forward analysis to distinguish it from backward analysis; the former is implemented on the basis of a priori probabilities and conditional probabilities to predict the occurrence probability of child nodes, while the latter can be used to compute the posterior probabilities of root nodes for the given evidence.²⁶

Generally speaking, BBNs have the following advantages³⁸: (i) small samples and incomplete and noisy data sets can be handled; (ii) BBNs can be developed consistently using experts’ opinions instead of, or in conjunction to, historical data, still preserving their ability to make reliable predictions; (iii) BBNs can readily calculate the probability of events before and after the introduction of evidence and update, as necessary, their diagnosis or prediction; and (iv) visual representations are used to describe the interrelationships among nodes, making those interrelationships intuitive and easy to understand. These properties offer a complementary dimension to the one offered by FRAM.

4 METHODOLOGY

Figure 1 describes the four phases of the proposed methodology, which has been initially proposed over a simple example as a walk-through each modelling phase.

FIGURE 1

The proposed methodology to extend FRAM via BBN.

4.1 Phase 1 - FRAM modeling

According to the basic principles of the FRAM, the functions and the associated couplings should be identified (Step 1) with respect to a specific scope (Step 0). This phase is crucial to construct what will be later used as the underlying network for the BBN analysis. The representativeness of the model (and its corresponding instantiations) should be accounted as paramount to ensure the significance of any subsequent analysis.

Figure 2 depicts a FRAM model referred to a simplified process made up of three agents performing three functions: the green one refers to the accomplishment of a certain action where, to perform the action itself, it is needed some sort of information from the blue agent and some resources from the red one. Accordingly, the aspect “information” has been considered as an Output from the blue agent, while the aspect “resources” has been modeled as a Resource for the green function.

FIGURE 2

The instantiation of the FRAM model used in the walkthrough case.

Moreover, both the functions “Provide information” and “Provide resources” may have different states of variability, that is, phenotypes or metadata. Studying only timing and precision in line with previous steps, a set of states can be identified for each function. In summary, according to the standard building steps of FRAM (cf. Section 3.1), this Phase encompass Step 0 for the scope identification, Step 1 for the identification of the functions, as well as Step 2 and Step 3 to, respectively, model functions’ variability and aggregate their values.

4.2 Phase 2 - BN conversion

The second phase of the methodology deals with the conversion of the FRAM instantiation into a BBN. Each function is associated with a BBN node and corresponds to a variable in the process under examination while each aspect becomes a BBN oriented edge (arrows in Figure 3), which represents a conditional dependence. The instantiation can be described by the following synthetic expressions:

$$$$\begin{equation}G\left( {X,\ E} \right)\end{equation}$$$$(2)

where G represents the graph of a BBN, X the nodes, and E the edges. Following the proposed conversion, G is the FRAM model instantiation under investigation, composed of X nodes, connected via its E couplings.

FIGURE 3

The BBN of the walkthrough case.

Once defined the graph, each type of variability must be associated with one of the states of the referred nodes and a probability value has to be assigned. In this step, a choice of the most relevant functions, to be translated into nodes, can be done to reduce the size and complexity of the network.

Figure 3 depicts the BN of the walkthrough example. The edges are presented in two different colors according to their type: the blue one for the Input, the red one for the Resource.

4.3 Phase 3 - BN parameters setting

By interviewing experts, or using historical data, the probability distribution of root nodes (a priori probabilities), intermediate nodes, and child node (conditional probabilities) are quantitatively determined. In the walkthrough example, a priori probabilities of the nodes “Provide information” and “Provide resources,” for each of the states must be defined. Assuming a set of four states for both functions (i.e., “on time precise,” “delayed precise,” “on time imprecise,” “delayed imprecise”), this means three parameters shall be defined for each root node, since the sum of a priori probabilities for each node must be equal to 1, thus having one parameter being defined by this constraint. Consequently, a total number of six values need to be determined for the root nodes.

The definition of the CPT related to the child node “Do the action” is slightly more complicated, since it contains a total of 32 parameters. This is obtained assuming two possible states for the child node (i.e. Yes, No) and the same four possible states already discussed for each root node, resulting in (2*4*4 = 32). Since the sum of the conditional probabilities referred to the two states of the child node, for a given status of variability of each root node, must equal to 1, the number of independent parameters for the CPT related to the child node is thus 16 in this case.

In summary, for this simple model instantiation and its converted BBN, a total of 22 probability values (6 related to the root nodes and 16 referred to the child node) need to be determined. For much more complex models, the CPT parameters definition is expected to be a demanding issue, raising the problems of consistency of the assessment and resourcefulness to accomplish it. To this extent, the multi-valued Noisy-OR gates^{36, 37} can help to model interactions among variables with multiple states, specifying these interactions via a reduced number of parameters.³⁹ The main advantage of the OR-gate is that the number of parameters is proportional to the number of causes, while it was exponentially correlated in the general case. Therefore, the OR-gate simplifies knowledge acquisition, saves computational space and efforts, and allows evidence propagation in time proportional to the number of parents nodes. In the Noisy-OR gate model, node X represents a characteristic that may be present or absent, and its parents represent phenomena whose presence can produce X. In other words, a link in the OR-gate represents the intuitive notion of causation (“U produces X”). When building a BBN, also for a human expert, it is much easier to answer a question like “What is the probability of X when only U is present?” than many questions that involve complicated combinations of different intertwined cases. By adopting this model, the number of required conditional probabilities can be reduced to the number of a given node's parents.⁴⁰ The parameters for a certain family in the OR-gate will be the conditional probabilities of X given that all causes but one are absent.

Accordingly, in the converted FRAM model (or instantiations), it can be stated that the probabilities are defined as it follows:

$$$$\begin{equation}P \left( {{X}_i} \right) = {\mathrm{initial\ probability\ of}}\ {X}_i \end{equation}$$$$(3)

$$$$\begin{equation}P \left( {{X}_i{\mathrm{|}}parents\left( {{X}_i} \right)} \right) = {p}_{\left( {i{\mathrm{|}}j} \right)} \end{equation}$$$$(4)

where $${p}_{( {i{\mathrm{|}}j} )}$$ is the conditional probability of ​$${X}_i$$ given a specific configuration j of its parent nodes. It should be noted that the “parents of $$( {{X}_i} )$$” in the case of FRAM are the functions connected upstream to the function $${X}_i$$, via their corresponding edges, thus $${p}_{( {i{\mathrm{|}}j} )}$$ can be interpreted in FRAM language as a specific instantiation of the upstream functions.

In the walkthrough example, the probability values of the CPT, 22 in number, can be reduced to six by applying a multi-valued Noisy-OR gates. Tables 1 and 2 show, respectively, the CPT for the child node “Do the action” set as general type node and the Definition Table (DT) for the same node set as a particular Noisy-OR node, that is, Noisy-Max.³⁹ One should note that a Noisy-Max node reduces to a Noisy-OR node if all the nodes are binary.

TABLE 1. CPT for the child node “Do the action” set as general type node.

Provide information	on time_precise
Provide resources	on time precise	delayed precise	ontime imprecise	delayed imprecise
NO	0	0.6	0.62	0.68
YES	1	0.4	0.38	0.32
Provide information	delayed_precise
Provide resources	on time precise	delayed precise	ontime imprecise	delayed imprecise
NO	0.86	0.944	0.9468	0.9552
YES	0.14	0.056	0.0532	0.0448
Provide information	ontime_imprecise
Provide resources	on time precise	delayed precise	ontime imprecise	delayed imprecise
NO	0.9	0.96	0.962	0.968
YES	0.1	0.04	0.038	0.032
Provide information	delayed_imprecise
Provide resources	on time precise	delayed precise	ontime imprecise	delayed imprecise
NO	0.94	0.976	0.9772	0.9808
YES	0.06	0.024	0.0228	0.0192

TABLE 2. DT for the child node “Do the action” set as Noisy-Max node.³⁹

Parent node	Provide information
State	delayed imprecise	ontime imprecise	delayed precise	on time precise
NO	0.94	0.9	0.86	0
YES	0.06	0.1	0.14	1
Parent node	Provide resources
State	delayed imprecise	ontime imprecise	delayed precise	on time precise
NO	0.68	0.62	0.6	0
YES	0.32	0.38	0.4	1

The parameters in the DT of the Noisy-Max node for a parent $${X}_i$$ express the probability of the effect happening, when the cause $${X}_i$$, is present and none of the other causes of the effect, whether modeled or not modeled, is present.

Referring to Table 2, “on time precise” is the distinguished state, that is, the neutral state which represents the absence of anomaly,⁴¹ for both the node “Provide information” and “Provide resources.” The value 0.06 (highlighted in blue) in the DT's first column represents the probability that the green agent will “Do the action” in case of the information will be provided delayed and imprecisely, considering that resources will be provided on time and precisely. Another example: the value 0.32 (highlighted in yellow) in the DT's fifth column represents the probability that the green agent will “Do the action” in case of the resources will be provided delayed and considering that information will be provided on time and precisely. The exact same values can be read in the classical CPT of Table 1, calculated starting from the values inserted in the DT.³⁹

Hereafter, for each value, it should be provided a matching quantitative index, which could be the precise value or a Likert score, in case of discrete assessments.

4.4 Phase 4 - BN running and variability management

Once all the essential parameters were determined, the developed BN model has been simulated to evaluate the characteristic under examination (i.e., a process resilience or, in the simple example, the probability of “doing the action”) through BN inference and to perform belief propagation, causal chain, and sensitivity analysis. In the case study, the software GeNIe has been utilized (Figure 4). This type of calculation and phase of the methodology resembles previous research in various fields.^{42, 43}

FIGURE 4

Exemplary results for the BBN simulation.

4.5 Caveat on the BBN conversion

Even though the phases above are completely reproducible for any FRAM instantiations, they may remain challenging for large scale models. In this case, it becomes necessary to reduce the complicatedness of the instantiations, that is, neglecting unnecessary functions or couplings. To this regard, it is recommended to reflect on the impact of functions into the service provision, distinguishing between supportive dependence and compulsory dependence.³³ In the first case, a function provides services for other functions that have supportive character but are not crucial for the actual operation. In case of compulsory dependencies, a function provides a service that is essential for other functions: in this case, the variability of the supporting function has a direct impact on the service provision of the function which receives its services. Regarding the FRAM, there is no universally accepted distinction of what compulsory or supportive aspects. Previous research suggests that functions can be weighted by experts, determining their impact into the actual process by using the Analytic Hierarchy Process (AHP).⁴⁴ However, in a simplified perspective, supportive dependencies can be those where the downstream connection is “Precondition,” “Resource,” “Control,” or “Time.” For compulsory dependencies, the related FRAM coupling is an “Output-Input” interrelation. It is worth mentioning that this classification of dependences, inspired by the study of Ramírez-Agudelo et al.,³³ is just one possible simplification, made in order to give a priority to the “Input” aspect over the others.

Similarly, another clarification can be proposed. In the walkthrough example, the a priori probabilities of the root nodes have been assigned by experts, the Noisy-Max node “Do the action” has been calculated starting from those probabilities and considering the type of upstream nodes’ dependence. More specifically, following previous research,³³ two influence factors have been introduced: factor F_c for compulsory dependences to be multiplied for the minimum of a priori probabilities of each variability state of the parent nodes with compulsory dependence; factor F_s for supportive dependences to be added to the minimum of a priori probabilities of each variability state of the parent nodes with supportive dependence.

In terms of measurement scales, the Likert type has been adopted, with three states, that is, Low, Medium, and High. Using a 1–5 scale, Table 3 represents possible levels of impact for both compulsory (F_c) and supportive (F_s) dependences. For the sake of simplicity, a medium-level impact for the dependencies has been considered in the walkthrough example.

TABLE 3. Influence factors for different levels of impact.

Parameter	Low (L)	Medium (M)	High (H)
Influence factor Fc (compulsory: I)	1.5	2	5
Influence factor Fs (supportive: R, C, P, T)	0.1	0.3	0.5

• Numbers are used for exemplary purposes. Actual values are context dependent and should be adapted based on the context and the system at hand.

The choice to use only two influence factors and to attribute to them the values of Table 3 represent a limitation for the study which will be discussed in Section 6.

5 RESULTS

This section describes the complete application of the proposed methodology to a real case, presenting its main results.

5.1 Case study

From August 2020 to January 2021, three different episodes of contagion from Covid-19 occurred at some oil rigs off the Norwegian coast. These facts represented a demanding issue for OFFB (Operator's Association for Emergency Response), a second-line Emergency Response organization for O&G operators in Norwegian continental shelf, since the company had to face a new kind of emergence never managed before, without any specific prepared plans or procedures.

Cantelmi et al.¹⁵ explored the adaptive capacity put in place by this leading Norwegian organization in providing EM support, addressing the unexpected challenges (at the time of the event) represented by the handling of Covid-19 infection outbreaks on offshore oil rigs. Their investigation, conducted using FRAM, highlighted the relevance of organizational learning, which allows to handle emergencies by adapting plans to the specific context and by renewing EM procedures derived from lessons learned. More specifically, after the three episodes, a new procedure was developed by OFFB, considering what happened during the Covid-19 emergency. This document represents a guide for handling Covid-19 related incidents offshore. It is structured according to the four traditional operative phases put in place by OFFB's EM: mobilization, alert, combat, and normalization. In the same article,¹⁵ a focus on the second-line operator's responsibilities and tasks for the combat phase has been proposed, formalizing the system in a dedicated FRAM model.

More specifically, according to previous research,¹⁵ the second-line operator is responsible for coordinating operational activities from onshore

• - to requisition relevant resources and coordinate actions, as per the following tasks:
• - to communicate and coordinate activities with all the relevant stakeholders (first and third line, doctors, Logistics Department, helicopter operator, Rig Owner, operators providing transport from the helicopter to the hotel, municipality, quarantine hotels);
• - to manage the practical reception of personnel at the helicopter base, bus transport, and the reception of personnel at their quarantine/isolation hotel(s);
• - to determine, in consultation with the Company Doctor responsible for the rig, whether people need to be accompanied during helicopter transport;
• - to make sure that infection control measures are implemented on arrival at the helicopter base;
• - to ensure that the Operator/Rig Owner assigns personnel who can meet and take care of persons who are transported onshore;
• - to ensure that personnel, who arrive onshore, receive the necessary information and supervision;
• - to ensure that the quarantine hotel receives the information it requires;
• - to ensure that infection control measures are implemented in cases where personnel require a hired car to drive to the quarantine location;
• - to keep first line, third line, the Company Doctor and the municipality updated on the status of personnel who are sent onshore, and shall deal with any questions that may arise.
• - to ensure that essential infection control equipment is obtained, as appropriate;
• - to check with the Company Doctor and the municipality to determine if there is any need for support from the Operator to carry out testing onshore. If necessary, he/she shall make sure that the municipality receives the support it requires for testing.

Starting from this episode, the methodology is indeed instantiated on assessing the functional properties of the new socio-technical orchestration put in place when the newly developed procedure should be performed. The following subsections (4.4, 4.5, 5, 5.1) are designed to assess the resilience potentials of this procedure, where indeed the idea of progressive organizational learning is central.

5.2 Phase 1 - FRAM modeling

The functions and coupling associated with the OFFB's Covid-19 infection management procedure were already identified and qualitatively analyzed within the framework of RE,¹⁵ who focused on the combat phase of the newly introduced OFFB's procedure and formalized second-line responsibilities and tasks through a dedicated FRAM model (Figure 5).

FIGURE 5

FRAM model instantiation of OFFB's Covid-19 EM procedure—combat phase, adapted from Ref. 15.

Thirty-two functions were identified, highlighting the relevant role of the coordination with several actors and the need of specific resources to foster the resilience of the Covid-19 infection management. The present study sets this model as a starting point for the BBN conversion and analyses.

5.3 Phase 2 - BBN conversion

A BBN has been developed listing the foreground functions of the FRAM instantiation. The BBN implementation starts from the single child node of the whole network, called “resilience potentials,” which is intended to give a measure of the OFFB procedure's resilience potentials, that is, the ability of the agents involved in the procedure to sustain operations under changes and disturbances. The success of the procedure implementation depends on how four consecutive actions are conducted to conduct the evacuation of the people infected by Covid-19 from the offshore platforms to the mainland.

These four different actions, corresponding to the functions “managing transport by helicopter” (MTH), “managing reception at helicopter base” (MRHB), “managing transport by bus or rented car” (MTBRC), and “managing reception at hotel” (MRH), contribute significantly to the value of the resilience potentials of the EM procedure and have been translated into the four parent nodes of the “resilience potentials” node.

While transferring the FRAM instantiation into a BN, a simplification was suggested to reduce the size and complexity of the resulting network. Since the resilience potentials are highly influenced by the four “managing” functions, it has been chosen to consider only the functions of the FRAM model that interact directly with those four “managing” functions and to translate them into homonymous nodes of the BN. Most of these nodes describes the coordination with other actors that interact with second-line operator (i.e., first line, third line, doctors, rig owner, municipality, etc.), other nodes are referred to the resources needed for the proper management of the infection contagion (i.e., trained people, infection control equipment, test onshore, etc.).

Moreover, some functions, which are common to all nodes, like “Communication equipment functions regularly” or “Rig owner provides documentation” have not been translated into BBN nodes since their impacts have been assumed negligible, that is, they always occur in a standard way. These assumptions are context dependent and should be considered with care by the analyst when selecting the instantiation being converted into a BBN.

Figure 6 depicts the final BN model where the edges are represented in different colors, according to their dependence: they are blue and red, in order to distinguish the corresponding “input” aspect from the other “resource,” “time,” “control,” and “precondition” aspects, explicating the dependence type (compulsory or supportive), as already introduced in Section 4.1.

FIGURE 6

Final BN model of OFFB's Covid-19 EM procedure.

5.4 Phase 3 - BN parameters setting

By interviewing an operation manager from OFFB, the initial probability distribution of each root node has been assessed, and the related intermediate nodes’ and child node's probabilities have been iteratively determined. More specifically, a team member, who participated in all the three Covid-19 cases and held the OFFB's Emergency Response Manager (ERM) role during the first case, was asked to assess the probability distribution of root nodes and the level impact for the intermediate nodes (via the CPT). Data were also shared with two other experts with a background in crisis management but not working in OFFB. These results were then validated by a fourth researcher, being involved in OFFB temporarily in a sabbatical research period. An additional validation step and consistency check on the values obtained was performed by two researchers with experience in safety and resilience management.

With these premises, on one hand each root node has been modeled considering the variability in terms of timing and precision: therefore, four different values have been assigned by the experts to the four combinations already shared as assumptions in Section 4.1 (i.e., “on time precise,” “delayed precise,” “on time imprecise,” “delayed imprecise”) to determine the a priori probabilities of root nodes. Average values have been considered, where there were discrepancies among experts to share a consensus value.

On the other hand, to model intermediate nodes, which had many parent nodes (i.e., upstream functions), a Noisy-Max node has been used. This choice simplified CPT's filling (e.g., for the node “Obtain support for carrying out testing on-shore” the number of parameters shifted from 4⁵ = 1.024, with four levels of variability of each parent node and five parent nodes, to just 15).

In general, according to the experts’ evaluations, a medium-level impact. Specifically, for the node “Obtain support for carrying out testing on-shore,” the corresponding influence factors F_c = 2 and F_s = 0.3 have been utilized to determine the 15 above mentioned parameters, starting from the a priori probabilities of each parent nodes.

5.5 Phase 4 - BN running and variability management

The a priori probabilities of root nodes and the conditional probabilities of the intermediate nodes and child node have been imported into the developed BBN, which is then simulated with GeNIe software to assess the resilience potentials through inference, and to perform a beliefs propagation, as well as a causal chain and sensitivity analysis (see Figure 7).

FIGURE 7

Results of the BBN model of OFFB's Covid-19 EM procedure.

Resilience potentials score High 34%—Medium 28%—Low 38%, while the four managing functions, mentioned in subsection 5.3, can be ranked sequentially by effectiveness as follows:

• - “managing transport by bus or rented car” (MTBRC): 62%;
• - “managing reception at hotel” (MRH): 57%;
• - “managing reception at helicopter base” (MRHB): 40%;
• - “managing transport by helicopter” (MTH): 32%.

5.5.1 Forward-propagation analysis

The Forward-propagation analysis is implemented to explore the influence mechanism of root nodes on the EM procedure functional properties and resilience potentials. The joint probability of conditional nodes is calculated at the child node “resilience potentials” dynamically and iteratively. It is noticeable that the absolute value of resilience potentials obtained from BN simulation has little numerical significance in absolute terms, and in the present study, the quantified resilience potentials are used to indicate the resilience of the EM procedure: higher scores correspond to higher resilience levels.

The values obtained from the BBN analysis are strictly connected to the a priori probabilities given to the root nodes by the involved experts. More specifically, two root nodes have affected the effectiveness of the two lower values managing functions (i.e., MRHB and MTH): for the “Coordination and Communication (C&C) with 1^st line” the event “on time precise” was scored just 50% and the same event for the root node “C&C with helicopter operator” received a score of 70%. These assessments were accompanied by proper justification, whenever relevant and based on the actual experiences of one of the members who participated in all three episodes. For example, for “C&C with 1^st line”, the identified expert argued that first line mainly communicated with third line instead of second line only in the first hours after the incidents, while for “C&C with helicopter operator,” they reported that the uncertainty, associated with the Covid-19 situation, created an arena for discussion and teamwork. OFFB and helicopter operator needed to find the best possible course of action to deal with Covid-19 in a collaborative way.

Consequently, a gross improvement in the procedure resilience potentials would certainly be obtained by enhancing the communication and coordination with first line and helicopter operator. This fact is easily demonstrated through BBN subsequent runs: by setting effectiveness to 100% for both the root nodes at hand, the resilience potentials increase from High 34%—Medium 28%—Low 38%, to High 44%—Medium 24%—Low 33% while MTH and MRHB raise, respectively, to 50% and 53%.

Different scenarios

To complement the previous analysis, it would be desirable to determine (e.g.) which are the root nodes with the highest impact on the child node and the consequences of improved or deteriorated timing and precision variability.

Therefore, a set of diverse scenarios has been investigated (Table 4). Scenarios have been constructed, assigning a single node at time a value equal to 100% for the “delayed precise” event, while in all the other nodes, the “on time precise” event was set at 100%. It is worth recalling that setting the node status to “delayed precise” to 100% means that the event certainly occurs with a delay, while precision is not affected. The developed BN has been simulated for each scenario, and the variations in the EM procedure resilience potentials and the effectiveness of the four managing functions involved in resilience (MTH, MRHB, MTBRC, and MRH) are summarized in Table 4. These results can be used as a basis to evaluate the impact of the delay of each root node on the EM procedure resilience potentials and over the four managing functions.

TABLE 4. Results of different scenarios.

		Resilience potentials			MTH	MRHB	MTBRC	MRH
ID	Root node “set to delayed precise = 100%”	High	Medium	Low	Effective	Effective	Effective	Effective
1	C&C with Municipality	22%	18%	60%	38%	38%	38%	10%
2	Trained people assigned	23%	35%	42%	40%	40%	40%	40%
3	C&C with Duty Doctor	24%	22%	54%	20%	49%	49%	20%
4	C&C with third line	34%	45%	21%	14%	14%	100%	100%
5	C&C with Helicopter operator	42%	40%	16%	49%	10%	100%	100%
6	C&C with Company Doctor	47%	38%	22%	40%	40%	100%	58%
7	C&C with Logistic Department	63%	23%	14%	29%	91%	91%	91%
8	C&C with Transport operator	64%	28%	8%	100%	100%	20%	100%
9	C&C with Operator/Rig Owner	77%	18%	5%	100%	100%	100%	49%
10	C&C with the hotel	83%	13%	4%	100%	100%	100%	62%
11	C&C with first line	85%	12%	3%	66%	100%	100%	100%
	Managing functions effectiveness mean values				54%	62%	76%	66%

The node, whose delay impacts negatively on the resilience potentials more than others, is “C&C with municipality” followed by “Trained people assigned.” The model confirms the importance of an effective and punctual coordination and communication with the municipality and the need to have readily available and trained people.

From the calculation of the mean values for the managing functions, it is shown that MTH and MRHB are the two functions majorly affected than the others by the delays that can occur in the root nodes. These functions are the first to be conducted following the occurrence of an emergency and the most difficult to coordinate.

5.5.2 Backward-propagation analysis

The backward-propagation analysis also known as reverse inference, target-driven or hypothesis-driven reasoning, is useful for diagnosing and explaining the cause of an accident in a manner that runs counter to a directed graph.

Key root nodes

Based on reverse inference algorithm in BNs, “resilience potentials—Low level” is set to 100%, which means that the EM procedure is set in a condition where it is exposed to unmanageable variability. Root nodes with a value of “on time precise” state less than 80% are called key root nodes and are marked yellow in Figure 8. The percentages, reported in Table 5, are influenced by the experts’ estimates: key root nodes are the same nodes which should be enhanced, to have a gross improvement in the EM procedure resilience potentials, among them the communication and coordination with first line (see subsection 5.5.1).

FIGURE 8

Key root nodes (in yellow).

TABLE 5. Key root nodes for “resilience potentials—Low level” set to 100%.

Root node	“precise on time” state value
C&C with first line	48%
C&C with Helicopter operator	63%
C&C with Transport operator	63%
Trained people assigned	65%
C&C with third line	66%
C&C with Municipality	70%
C&C with Company Doctor	73%
C&C with the hotel	73%

Maximum causal chain

In the present study, a maximum causal chain refers to the most likely path that causes the decreasing of resilience potentials. By using the “strength of influence” tool in GeNIe, the maximum causal chain, shown in bold in Figure 9, can be obtained. The coordination and communication with municipality, to obtain essential ICE (infection control equipment) and implement the ICM (infection control measures), when people are being received at the hotel, is the maximum causal chain of the resilience potentials. The results of this analysis are fundamentally consistent with previous findings.

FIGURE 9

Maximum causal chain (in bold).

Sensitivity analysis

Sensitivity analysis facilitates identifying the nodes that have a high impact on the child note, that is, resilience potential. This assessment is meant to guide the prioritization of specific improvements, when applying the EM procedure. Sensitivity analysis is employed in the present study to distinguish the influence of root nodes on the EM procedure resilience potentials and can be implemented with the backward propagation of the developed BN. The influence mechanism of root nodes on the target node, usually referring to the child node is presented under a given set of conditions. Setting “resilience potentials” as the target node, the root nodes have been ranked according to their sensitivity values (Table 6 and Figure 10).

TABLE 6. Sensitivity values of root nodes for “resilience potentials” set as target.

	Sensitivity
Root node	Max	Avg
C&C with Municipality	0.461	0.143
Trained people assigned	0.357	0.110
C&C with Duty Doctor	0.347	0.086
C&C with third line	0.214	0.061
C&C with Helicopter operator	0.195	0.055
C&C with Company Doctor	0.194	0.032
C&C with Transport operator	0.128	0.029
C&C with Logistic Department	0.095	0.016
C&C with Operator/Rig Owner	0.080	0.019
C&C with first line	0.064	0.018
C&C with the hotel	0.060	0.010

FIGURE 10

Sensitivity analysis: Darker red background indicates root nodes with a higher impact on the “Resilience potentials” target node.

The most sensitive nodes are “C&C with municipality” and “Trained people assigned,” in accordance with the results from scenario analysis and maximum causal chain. Moreover, note that “C&C with Duty doctor” is the third root node in terms of sensitivity analysis, but the last among the key root nodes. This fact is explained by the probabilities given by the experts (i.e., 98% for the event “on time precise”): according to OFFB ERM, the communication and coordination with the duty doctor during the EM process was excellent, but, according to our BN, this node has a high impact for the child node “resilience potentials” and as such, represents a crucial node. This observation may force considering status of duty doctor, checking on working hours, and ensuring a well-trained practitioner able to act promptly and precisely.

As regard the intermediate nodes, the same analysis could be performed to identify the sensitivity level of the root nodes with respect to the four managing functions, selected one at time as target node, to understand which root nodes are the most influencing for each managing functions.

In Table 7, the most three sensitive nodes for each managing function have been reported. “C&C with Municipality” is the only root node which is present in all the sensitivity analysis conducted for the four managing functions: this is a further confirmation of the importance of reliable and punctual coordination and communication with the municipality involved in the EM process.

TABLE 7. Sensitive values of root nodes for the four managing functions, after selecting one at time as target node.

		Sensitivity
Managing function	Root node	Max	Avg
MTH	C&C with third line	0.332	0.142
	C&C with Duty Doctor	0.243	0.091
	C&C with Municipality	0.225	0.105
MRHB	C&C with Helicopter operator	0.454	0.180
	C&C with third line	0.416	0.178
	C&C with Municipality	0.282	0.131
MTBRC	C&C with Transport operator	0.518	0.178
	C&C with Municipality	0.442	0.205
	Trained people assigned	0.437	0.200
MRH	C&C with Municipality	0.588	0.272
	C&C with Duty Doctor	0.448	0.167
	Trained people assigned	0.399	0.182

6 DISCUSSION

This section is organized in three sections: first, details on the case will be provided, second, observations from a larger context are drawn, and finally, limitations and future research is discussed.

6.1 Reflections on the case study

Besides the two root nodes that received the lowest probability values by the experts, in terms of timing and precision (i.e., “C&C with 1^st line” and “C&C with helicopter operator”), the BBN forward and backward propagation analyses reveal that “C&C with municipality” and “Trained people assigned” are the nodes whose delay and precision negatively impact on the resilience potentials more than others. The Bayesian inference highlights the importance of effective and punctual coordination and communication with the municipality and the need to have on time and well-trained people to cope with all the contingencies and difficulties that may arise during an emergency response operation such as Covid-19 outbreaks management on offshore O&G rigs. These results are confirmed by the maximum causal chain of the resilience potentials, which is sequentially constituted by the coordination and communication with municipality, the obtaining of essential ICE, and the implementation of the ICM, when people are being received at the quarantine hotel. Furthermore, the mean values of managing functions effectiveness, calculated from 11 scenarios, show that MTH and MRHB are the two functions that are more affected than the others by the delays that can occur in root nodes. These functions are the first ones to be carried out following the occurrence of the emergency and the most difficult to coordinate.

Some lessons can be learned from these results, with implication for the decision-making process:

1. the need for clear and on time coordination and communication with the municipality involved in the Covid-19 outbreak management;

2. the need for assigning people properly and on time, prioritizing specific actions for training on the job and proceduralized aspects;

3. the attention to the sequencing of actions, which have to be performed close to the occurrence of cases of contagion (i.e., the actions related to MTH and MRHB functions);

4. the need of obtaining essential ICE and implementing the ICM to manage all the phases of the EM process.

6.2 Larger scope reflections

This study provided an explorative method to analyze functional properties as a proxy of resilience potentials in a system that evolves over time with continuous data updates. These episode-based learning items allows drawing cross-industry outcomes as well:

• Timely communication and coordination with stakeholders. After recognizing what are the stakes and how they are related, it is crucial to ensure a strategy to foster coordination among them continuously, prioritizing key actors.
• Strategic assignment of personnel and actions sequencing. Assigning properly personnel and prioritizing critical actions is central for timely and effective response and training.
• Identification of comprehensive management strategies. Successful EM acknowledges that comprehensive management strategies are required to assess various perspectives and to oversee all phases of the emergency management process.

6.3 Limitations and further research

Some simplifications have been adopted, which in fact represent the limitations for this study. For instance, this research has focused on timing and precision phenotypes among the others because they represent the simplest solution to describe the consequences of performance variability. Even though it is a study limitation, it is also the way variability is studied in the majority of socio-technical systems.¹⁷

Reflecting about the timing phenotype, an Output can occur too early, on time, too late, or not at all.⁴⁵ An Output that is not available on time can affect the variability of downstream functions in several different ways. This research has referred to only two different statuses to describe timing: “on time” and “delayed,” while other could be added.

In terms of precision, an Output can be precise, acceptable, or imprecise.⁴⁵ Since the Output provides the coupling between upstream and downstream functions, the meaning of precision is relative rather than absolute. In the present study, two different statuses have been used to describe precision: “precise” and “imprecise.” A precise Output meets the needs of a downstream function: therefore, it will not increase the variability of downstream functions, and may potentially even reduce it. On the other hand, an imprecise Output is incomplete, incorrect, ambiguous, or otherwise misleading: consequently, it cannot be used as it is, but requires interpretation, verification, comparison with other data, or with the situation as such. These are all aspects that can increase the variability of the receiving function, typically by consuming resources and time that could and should have been used for other purposes.

More elements for precision can be added as well. Overall, this development does not contradict other approaches for assessing phenotypes, including metadata management.⁴⁶

Another limitation regards the classification of FRAM dependences, distinguishing between supportive and compulsory. It is worth mentioning that this classification, inspired by previous research,³³ is a simplification made in order to give a priority to the “Input” aspect over the others.

Another simplification has been adopted by choosing only two different influence factors to calculate the CPTs of the intermediate nodes. In future research, a specific influence factor could be associated to each type of FRAM aspects. For example, these factors could be obtained through near-real time data gathering.

One should also note that the a priori probabilities for root nodes and the level of impact for functions dependences have been determined by just few experts: larger samples should be needed for in-depth studies.

Additionally, the acyclic nature of a BBN requires further revisions in case of loops present in the original FRAM model. This point could be solved by recurring to dynamic BBN, where staged functions are presented at different time steps. Further research should also consider adopting a benchmark, that is, comparing the outcomes obtained quantitatively to the value of qualitative assessments.

More research should also be directed toward identifying what is the economical set of parameters and functions to be usable for a consistent systemic analysis (e.g., testing other types of nodes, or reducing the number of phenotypes to be studied, thus the combination of parameters to be modelled in the CPTs).

7 CONCLUSION

The present study proposes a novel comprehensive methodology to assess the resilience potentials of a socio-technical systems via their functional properties. The proposed methodology foresees a first qualitative analysis of the system in accordance with the principles of FRAM, by identifying the functions, their couplings, and linked variabilities. Then, a stochastic BBN model is implemented by converting FRAM functions and aspects of the FRAM instantiation into BBN nodes and edges. BBN parameters, that is, a priori and conditional probabilities, are quantified eliciting experts’ knowledge. Finally, the BBN model is run to quantitatively assess the resilience potentials of the system and conduct forward and backward propagation analyses.

The methodology is instantiated for the analysis in an EM procedure for Covid-19 outbreaks management on O&G rigs offshore. Starting from a FRAM model of the EM system, and a corresponding instantiation with the four main functions (i.e., the “managing” functions) that contribute most to the EM procedure, the resilience potentials and their coupling functions have been transferred into a BBN. The a priori probabilities of root nodes have been assigned by experts’ judgments and the conditional probability tables have been computed quantitatively based on the probability distribution of the root nodes. Finally, the developed BBN for the EM procedure resilience potentials evaluation has been simulated in GeNIe, by which the different scenarios analysis, the key root nodes, the maximum causal chain, and the sensitivity analysis have been performed. The results demonstrate that this methodology can comprehensively identify the active functions involved in the EM procedure and effectively evaluate the EM procedure resilience potentials for the Covid-19 outbreaks management on O&G rigs offshore.

The proposed methodology indeed adds to the toolbox of approaches available for the analysis of a FRAM model yet emphasizes the role of progressive learning in case data are limitedly available or not available. Needless to say, if the FRAM model is not properly designed and meaningful instantiations have not been drawn, and the analyst does not have first an overall understanding of the system properties, whatever analysis will be limited and biased. Accordingly, it is crucial to employ quality enhancement criteria and strategies to ensure the resulting FRAM models, instantiations, and insights afforded by them will be trustworthy.⁴⁷

This work is precisely contextualized in an emergency management procedure, paving the way to a systematic modeling of interdependencies in a safety-critical domain, with possible extensions to security management, too.⁴⁸ From the systematic nature of the investigation that can be obtained from the BBN, the proposed methodology results suitable to be transferred to other civilian or military contexts, for example, technological revision of systems, find and rescue operations, raids, humanitarian assistance. These examples share a common root, being cases where command-and-control mechanisms are in place to enable decision makers exploring the impacts of timing and precision on normal and abnormal operations.

In summary, the nature of the proposed methodology complements one of the weaknesses emerged from a FRAM model analysis, offering a dimension to allow inference management and scenarios assessment.

Open Research

DATA AVAILABILITY STATEMENT

Non confidential data available upon request to authors.