Restrictions on utility function. Increasing the likelihood or the consequence of a risk can never lead to a reduction of the risk level. Therefore, the utility function of a risk node should ensure the following: The value of the risk node is monotonically increasing in both its sub-nodes. It does not have to be strictly increasing. This means that if the value of one of the sub-nodes increases and the other remains unchanged, then value of the risk node should either increase or remain unchanged.
Restrictions on utility function. Since the DEXi tree structure addressed in this chapter has tree levels, it involves two layers of utility functions. The first defines, at the level of the root node (l_S3), the aggregation of the likelihood contributions from all incoming branches (l_S1_to_S3 and l_s2_to_S3). The second defines, at the level of each incoming branch (either l_S1_to_S3 or l_S2_to_S3), the aggregation of the likelihood of the source-node (either l_S1 or l_S2) and the conditional likelihood that an occurrence will lead to the target node (either cl_S1_to_S3 or cl_S2_to_S3). We therefore define two separate restrictions on the utility function. Increasing the likelihood contribution from a branch can never lead to a decreased likelihood for the target node. Therefore, for the aggregation at the level of the root node, the utility function should ensure the following: The value of the root node (l_S3 in Figure 17) is monotonically increasing in all its direct sub- nodes (l_S1_to_S3 and l_S1_to_S3 in Figure 17). It does not have to be strictly increasing. Example: In Figure 17, l_S3 should be monotonically increasing in l_S1_to_S3 as well as l_S2_to_S3. Increasing the likelihood of a source node or the conditional likelihood that an occurrence will lead to the target node can never reduce the likelihood contribution to a target node. Moreover, the impact of the conditional likelihood can only affect the target node to the extent that the source node actually occurs. Therefore, for the aggregation at the level of each incoming branch, the utility function should ensure the following: The value of the likelihood contribution from an incoming branch should be monotonically increasing in the likelihood of the source node as well as the conditional likelihood that an occurrence will lead to the target node. The value of the likelihood contribution from an incoming branch should never be higher than the likelihood of the source node.2 Example: In Figure 17, l_S1_to_S3 should be monotonically increasing in l_S1 and cl_S1_to_S3. Moreover, l_S1_to_S3 should never by higher than l_S1.
Restrictions on utility function. Assuming that all indicator scales have been defined as above, the likelihood of the node can never decrease if an indicator increases. Therefore, the utility function of a node with attached indicators should ensure the following: The likelihood of the node is monotonically increasing in all its attached indicators. It does not have to be strictly increasing. Example: In Figure 19, l_S1 should be monotonically increasing in I1 as well as I2. Notice that we may have cases where a node has incoming branches, as addressed in Section 7.2 in addition to attached indicators. In such cases, the likelihood of the node depends on the incoming branches as well as the attached indicators. The utility function should then fulfil the conjunction of the restrictions from Section 7.2.3 and the restriction presented here. As in the case of several incoming branches to a node, it may be necessary to restructure the model to avoid combinatorial explosion.
Restrictions on utility function. Assuming that all indicator scales have been defined such that low values imply low risk contributions, the conditional likelihood of the 'leads-to' relation can never decrease if an indicator increases. Therefore, the utility function of a 'leads-to' relation with attached indicators should ensure the following: The conditional likelihood of the 'leads-to' relation is monotonically increasing in all its attached indicators. It does not have to be strictly increasing. Example: In Figure 21, cl_S1_to_S2 should be monotonically increasing in I1 as well as I2.
Restrictions on utility function. The scale of a mitigation proposal should include two ordered steps, No and Yes, where No is the low value, indicating the mitigation should not be proposed, and Yes is the high value indicating that the mitigation should be proposed. A mitigation proposal should never be turned off due an increase in the relevant risk level or an increase in the likelihood contribution from the branch to which the mitigation proposal is attached. Therefore, the utility function should ensure the following: The value of the mitigation proposal (on the simple two-step scale No; Yes) should be monotonically increasing in all its direct sub-nodes. It does not have to be strictly increasing. Example: In Figure 23, the value of M1 should be monotonically increasing in R1 and l_S1_to_U1.
