Volcanic risk assessment using probabilistic models is increasingly desired for risk management, particularly for loss forecasting, critical infrastructure management, land-use planning and evacuation planning. Over the past decades this has motivated the development of comprehensive probabilistic hazard models. However, volcanic vulnerability models of equivalent sophistication have lagged behind hazard modelling because of the lack of evidence, data and, until recently, minimal demand. There is an increasingly urgent need for development of quantitative volcanic vulnerability models, including vulnerability and fragility functions, which provide robust quantitative relationships between volcanic impact (damage and disruption) and hazard intensity. The functions available to date predominantly quantify tephra fall impacts to buildings, driven by life safety concerns. We present a framework for establishing quantitative relationships between volcanic impact and hazard intensity, specifically through the derivation of vulnerability and fragility functions. We use tephra thickness and impacts to key infrastructure sectors as examples to demonstrate our framework. Our framework incorporates impact data sources, different impact intensity scales, preparation and fitting of data, uncertainty analysis and documentation. The primary data sources are post-eruption impact assessments, supplemented by laboratory experiments and expert judgment, with the latter drawing upon a wealth of semi-quantitative and qualitative studies. Different data processing and function fitting techniques can be used to derive functions; however, due to the small datasets currently available, simplified approaches are discussed. We stress that documentation of data processing, assumptions and limitations is the most important aspect of function derivation; documentation provides transparency and allows others to update functions more easily. Following our standardised approach, a volcanic risk scientist can derive a fragility or vulnerability function, which then can be easily compared to existing functions and updated as new data become available. To demonstrate how to apply our framework, we derive fragility and vulnerability functions for discrete tephra fall impacts to electricity supply, water supply, wastewater and transport networks. These functions present the probability of an infrastructure site or network component equalling or exceeding one of four impact states as a function of tephra thickness.