Towards a generic resilience management, quantification and development process: General definitions, requirements, methods, techniques and measures, and case studies

Generic standards on risk management and functional safety (e.g. ISO 31000 and IEC 61508) and similar frameworks proved to be surprisingly efficient to trigger and consolidate a widely accepted and ever more effective best practice frontier for risk control. In particular, this includes fundamental and applied research activities to improve processes and to provide more advanced, interlinked and effective methods for risk control. However, this also included the identification of yet unresolved challenges and lacks of completeness. The present work goes beyond these frameworks to address the need for a joint approach to frame resilience management and quantification for system development and improvement. It is understood as extending classical risk control to creeping or sudden disruptive, unexpected (unexampled) events, as strongly focusing on technical systems and organizational capabilities to bounce back (better) and as providing generic (technical) resilience capabilities for such resilience response performance. To this end, the article presents general resilience requirements, a resilience management process, which systematically refers to a resilience method taxonomy, resilience levels as well as an applicability table of methods to different resilience management steps for each resilience level. Three case studies elucidate the approach: (i) disruption effect simulation for the Swiss energy grid, (ii) data-driven resilience of the urban transport system of Florence, and (iii) Ontario provincial resilience model in Canada. The approach comprises representative existing resilience concepts, definitions, quantifications as well as resilience generation and development processes. It supports the development of further refined resilience management and quantification processes and related improved methods in particular to cover jointly safety and security needs as well as their practical application to a wide range of socio-technical cyber-physical hybrid systems. This will foster credible certification of the resilience of critical infrastructure, of safety and security critical systems and devices