Restrictions on the calculation. Although defining risk level as the product of likelihood and consequence is quite common, it is not the only way to do it. However we choose to do it, increasing the likelihood and consequence should never lead to a reduction of risk level. Therefore, the calculation of risk level should ensure the following: The risk level is monotonically increasing in the likelihood and consequence. It does not have to be strictly increasing. Example: For the CORAS fragment in Figure 13, the risk level for the risk of incident U1 harming A1 should be monotonically increasing in l_U1 and c_U1_A1. This is ensured by the script fragment in Figure 25, where the risk level (R1) is defined as the product of l_U and c_U1_A1. Since we are using intervals rather than exact values, it is not obvious what we mean by monotonically increasing. This is defined in Appendix I.
Restrictions on the calculation. Since the calculation of the likelihood of the target node is performed in two steps, there are also two sets of restrictions on the calculation. For the likelihood contribution from a single source node to the target node, the computation should ensure the following: The likelihood contribution from the source node is a sub-interval of the likelihood of the source node multiplied with the conditional likelihood that an occurrence of the source node will lead to the target node.
Restrictions on the calculation. Assuming that all indicators are defined such that a higher value (where FALSE < TRUE for Booleans) indicates a higher likelihood of the node, the likelihood should not decrease due to an increased indicator value. Therefore, the calculation should ensure the following: The likelihood of the node is monotonically increasing in all attached indicators. Example: For the CORAS fragment in Figure 18, the likelihood of S1 should be monotonically increasing in I1 and I2. The two if-then-else statements in the script fragment in Figure 27 ensures that l_S1 has its highest value if both I1 and I2 are TRUE, and its lowest value if both are FALSE, while the middle value is assigned if one of I1 and I2 is TRUE and the other is false.
Restrictions on the calculation. Making the same assumptions regarding indicators being defined such that increased indicator values indicate higher likelihood/risk contributions as in Section 8.3.3, the restriction on the calculation is also similar: The conditional likelihood of the 'leads-to' relation is monotonically increasing in all attached indicators. Example: For the CORAS fragment in Figure 20, cl_S1_to_S2 should be monotonically increasing in I1 and I2. This is indeed ensured by the script fragment in Figure 28.
Restrictions on the calculation. A mitigation proposal should never be turned off due to an increase in the relevant risk level or an increase in the likelihood contribution from the branch to which the mitigation proposal is attached. Therefore, assuming FALSE < TRUE, the computation of a mitigation proposal (i.e. the assignment of the value FALSE or TRUE) should ensure the following: The value of the mitigation proposal should be monotonically increasing in all the risk level assessments and likelihood assessments occurring in the condition of the if-statement. It does not have to be strictly increasing.
