Skip to main content
Risksheet is a generic tool supporting any risk management methodology, including FMEA, HARA, Threat Analysis and Risk Assessment (TARA), STRIDE, and Common Vulnerability Scoring System (CVSS). Nextedy provides solution templates for typical methodologies — pick the closest template, understand its configuration, then adapt it to your process. The functional safety template is the simplest entry point for HARA evaluation.

​
Prerequisites

Before starting, ensure you have:
  • Risksheet installed and licensed in your Polarion project
  • Administrative access to edit the sheet configuration (the file risksheet.json attached per LiveDoc, editable through the YAML editor since v25.5.0)
  • Custom work item types created in Polarion for your HARA structure (for example, Hazard, Risk, Countermeasure)
  • Polarion enumerations defined for your severity, exposure, controllability, and ASIL scales (Administration > Enumerations)
  • Custom fields on the risk work item type, each bound to the appropriate enumeration
  • Familiarity with the configuration editor

​
HARA Structure Overview

A HARA risksheet presents a multi-level visual hierarchy linking hazards to risk assessments and downstream countermeasures. Risksheet’s data model has only two entity types — risk items and task items — while the visual levels array creates any number of hierarchical groupings through cell merging.
diagram
1

Define Data Types

Configure the work item types in dataTypes. A typical HARA uses a risk work item as the primary row and a countermeasure as the downstream task. Add name and zoomColumn so the toolbar shows a label and users land on the right column when creating a new task.
Replace risk and countermeasure with your actual Polarion work item type IDs. The removeStrategy (on dataTypes.risk) controls risk-item removal: delete (permanent), rejected (status flip), recycle_bin (hidden), or hide (v23.7.7+, filtered out).
Countermeasure-specific fields (specification, effectiveness) must live on the countermeasure work item type, not the risk type. Column bindings (plural) determines which work item holds each field — misconfigured columns save data on the wrong item.
2

Configure Levels

Define the visual hierarchy. Every level entry has three required properties: name (label in the navigation/zoom menu), controlColumn (drives cell merging), and zoomColumn (target of the zoom menu).
Consecutive rows with the same value in controlColumn are merged vertically, creating the appearance of a hazard parent with child risk rows — even though every row is the same Polarion work item type.
3

Define Severity and Exposure Scales

Rating scales are not defined inside the sheet configuration. They are Polarion enumerations:
  1. In Polarion, go to Administration > Enumerations and create one enumeration per scale (for example iso26262-severity, iso26262-exposure, iso26262-controllability, iso26262-asil) with stable IDs (S0–S3; E0–E4; C0–C3; QM, ASIL_A–ASIL_D).
  2. Create custom fields on the risk work item type (severity, exposure, controllability, asil), each bound to the matching enumeration.
  3. In the sheet configuration, declare columns of type rating:<enumId> with bindings: <fieldId>. The server loads enum values automatically — there is no ratings block in the sheet configuration.
4

Configure ASIL Determination

ASIL is derived from severity, exposure, and controllability. Use a named formulas entry to compute it:
Reference the formula from the ASIL column:
For regulated environments, externalize matrix logic to the top panel configuration (risksheetTopPanel.vm). The sheet configuration’s formulas block then holds thin wrappers, while the real function lives in the top panel <script> block. This narrows the validation scope when ASIL thresholds change.
5

Apply Conditional Formatting

Highlight ASIL values using a cellDecorators function combined with styles classes. Cell decorators must use toggleClass rather than inline styles because grid cells are reused as the user scrolls.
Attach the decorator to the ASIL column with cellRenderer: asilLevel. The thresholds and colors are entirely up to your organization — Risksheet does not impose any default ASIL palette.
6

Configure Upstream Traceability

Link risk rows to upstream hazards or system functions using itemLink columns. The typeProperties block has six verified sub-properties: linkRole, linkTypes, linkDirection, backLink, itemTemplate, and queryFactory. linkTypes is a comma-separated string of work item type IDs, not an array.
To restrict the autocomplete to a shared hazard library, add typeProperties.document: '02 - Risk Management File/Hazards Library'. For cross-project autocomplete, set typeProperties.project to a space-separated list (for example $projectId GlobalLibrary); $projectId resolves to the current project at runtime. See Configure Upstream Traceability Columns.
7

Configure Countermeasure Columns

Add downstream columns. Bind the task link column to task.title, and add a field column for any countermeasure-specific custom field:
To enable subsheet navigation — the countermeasure link opens a child risksheet — set dataTypes.task.linkToRisksheet: true and dataTypes.task.document: <path/to/child>. To target a specific document for new tasks, use dataTypes.task.createInDocument (v24.8.1+) or dataTypes.task.createInCurrentDocument: true. See Configure Multiple Downstream Types for multi-type patterns.

​
Adapting for Other Standards

The same patterns apply to other standards:
  • ISO 14971 (medical devices) — replace the ASIL enumeration with a risk acceptability enumeration; use P1/P2 enumerations for hazardous-situation and harm probabilities.
  • Aviation FHA (ARP 4761) — configure hazard and failure-condition work item types with the appropriate severity classifications.
  • Custom matrices — define your own Polarion enumerations and formulas, bind columns of type rating:<yourEnumId>.

​
Review Workflow

Risksheet supports three review managers under reviews: comment-based, work item-based, and approval-based. The approval review creates approval-tagged comments on the document; note that it does not trigger Polarion’s formal document approval state transitions (draft → reviewed → approved). For full document-state integration, use Polarion’s workflow on the LiveDoc itself.

​
Verification

After saving your configuration:
  1. Reload the LiveDoc in your browser.
  2. Confirm the hierarchy: hazards merged at Level 1, risk rows at Level 2.
  3. Severity, exposure, and controllability columns display values from your Polarion enumerations.
  4. The ASIL cell computes automatically and applies the color from the cellDecorators function.
  5. Create a countermeasure from the task toolbar (using the name from dataTypes.task) and verify the link role.
All data resides in Polarion work items — Risksheet visualizes and edits Polarion data but does not store anything separately. Authorization, history, and audit are Polarion’s.

​
See Also

Last modified on July 10, 2026