Skip to main content

​
Prerequisites

Before starting, ensure you have:
  • Risksheet installed and licensed in your Polarion project
  • Administrative access to edit risksheet.json
  • Custom work item types created in Polarion for your HARA structure (e.g., Hazard, Risk, Harm, Countermeasure)
  • Familiarity with the configuration editor

​
HARA Structure Overview

A HARA Risksheet typically uses a multi-level hierarchy linking hazards to risk assessments and countermeasures. diagram

​
Step 1 — Define Data Types

Configure the work item types in the dataTypes section of risksheet.json. A typical HARA uses a hazard as the upstream item, risk as the primary item, and countermeasure as the downstream task: 
{
  "dataTypes": {
    "risk": {
      "type": "risk",
      "role": "has_risk",
      "removeStrategy": "delete",
      "rejectedAction": "reject",
      "rejectedStatus": "rejected",
      "rejectedResolution": "invalid"
    },
    "task": {
      "type": "countermeasure",
      "role": "mitigates",
      "showInMenu": true
    }
  }
}
Replace risk and countermeasure with your actual Polarion work item type IDs.
Ensure countermeasure-specific fields (like specification or effectiveness) are configured under the countermeasure work item type, not the risk item. Column configuration controls which work item type holds each field. Misconfigured columns cause data to be saved on the wrong item type.

​
Step 2 — Configure Levels

Define the hierarchical structure. Level 1 represents the hazard or hazardous situation, Level 2 represents individual risk assessments: 
{
  "levels": [
    {
      "controlColumn": "hazardId",
      "showInMenu": true
    },
    {
      "controlColumn": "riskItemId",
      "showInMenu": true
    }
  ]
}

​
Step 3 — Set Up Severity and Probability Scales

Define severity and probability rating scales in the ratings section. For ISO 26262 automotive HARA, severity maps to ASIL-relevant classifications: 
{
  "ratings": {
    "severity": [
      { "id": "S0", "name": "S0 - No injuries", "description": "No injuries" },
      { "id": "S1", "name": "S1 - Light injuries", "description": "Light and moderate injuries" },
      { "id": "S2", "name": "S2 - Severe injuries", "description": "Severe and life-threatening injuries (survival probable)" },
      { "id": "S3", "name": "S3 - Life-threatening", "description": "Life-threatening injuries (survival uncertain), fatal injuries" }
    ],
    "probability": [
      { "id": "E0", "name": "E0 - Incredible", "description": "Incredible" },
      { "id": "E1", "name": "E1 - Very low", "description": "Very low probability" },
      { "id": "E2", "name": "E2 - Low", "description": "Low probability" },
      { "id": "E3", "name": "E3 - Medium", "description": "Medium probability" },
      { "id": "E4", "name": "E4 - High", "description": "High probability" }
    ]
  }
}

​
Step 4 — Configure Probability Calculation

HARA workflows often calculate overall probability from sub-factors. You can use a formula to multiply P1 (exposure) and P2 (controllability): 
{
  "formulas": {
    "calcProbability": "function(info){ var p1 = info.item['p1']; var p2 = info.item['p2']; if(p1 && p2) return p1 * p2; return null; }"
  }
}
When both P1 and P2 sub-factors are provided, the formula calculates probability automatically. If only one factor is present, the formula returns null, allowing manual input in the probability field as a fallback. Automatic calculation combined with manual override in the same cell is not supported simultaneously.

​
Step 5 — Configure Risk Matrix Lookup

Use a formula to determine risk level from the severity/probability combination. This maps to your organization’s risk acceptance criteria: 
{
  "formulas": {
    "riskLevel": "function(info){ var s = info.item['severity']; var p = info.item['probability']; var matrix = {'S3_E4':'ASIL D','S3_E3':'ASIL C','S3_E2':'ASIL B','S2_E4':'ASIL C','S2_E3':'ASIL B','S2_E2':'ASIL A','S1_E4':'ASIL B','S1_E3':'ASIL A','S1_E2':'QM'}; return matrix[s+'_'+p] || 'QM'; }"
  }
}
Apply conditional formatting to highlight ASIL levels: 
{
  "cellDecorators": {
    "asilLevel": "function(info){ var val = info.value; $(info.cell).toggleClass('asilD', val==='ASIL D'); $(info.cell).toggleClass('asilC', val==='ASIL C'); $(info.cell).toggleClass('asilB', val==='ASIL B'); $(info.cell).toggleClass('asilA', val==='ASIL A'); }"
  },
  "styles": {
    ".asilD": { "background-color": "#f8eae7 !important", "color": "#ab1c00 !important" },
    ".asilC": { "background-color": "#fff3d2 !important", "color": "#735602 !important" },
    ".asilB": { "background-color": "#e3f2fd !important", "color": "#0d47a1 !important" },
    ".asilA": { "background-color": "#eaf5e9 !important", "color": "#1d5f20 !important" }
  }
}
ASIL LevelColorRisk Significance
ASIL DRedHighest integrity requirement
ASIL CYellowHigh integrity requirement
ASIL BBlueModerate integrity requirement
ASIL AGreenLow integrity requirement

​
Step 6 — Configure Upstream Traceability

Link risk items to upstream hazards or system functions using itemLink columns: 
{
  "columns": [
    {
      "id": "hazardId",
      "header": "Hazard",
      "type": "itemLink",
      "binding": "linkedWorkItems",
      "level": 1,
      "canCreate": true
    }
  ]
}
Risksheet can load existing upstream items from other projects or documents via typeProperties configuration. However, the Risksheet starts empty and requires risk records to be created first — it cannot auto-populate rows with existing items from another document.
For details on upstream column configuration, see Configure Upstream Traceability Columns.

​
Step 7 — Configure Countermeasure Columns

Add downstream columns for countermeasures with fields specific to the countermeasure work item type: 
{
  "columns": [
    {
      "id": "countermeasureTitle",
      "header": "Countermeasure",
      "type": "taskLink",
      "binding": "title",
      "canCreate": true
    },
    {
      "id": "cmSpecification",
      "header": "Specification",
      "type": "string",
      "binding": "customField_specification"
    }
  ]
}
For configuring multiple downstream types or countermeasure-introduces-risk link roles, see Configure Multiple Downstream Types.

​
Adapting for Other Standards

The same HARA configuration patterns apply to other risk assessment standards:
  • ISO 14971 (Medical Devices) — replace ASIL levels with risk acceptability categories and use P1/P2 for probability of hazardous situation and probability of harm
  • Aviation FHA — configure hazard and failure condition work item types with severity classifications per ARP 4761
  • Custom probability/severity matrices — define your own ratings scales and formulas for risk level calculation using any matrix dimensions

​
Verification

After saving your configuration:
  1. Reload the Risksheet document in your browser
  2. You should now see the HARA hierarchy with hazards at Level 1 and risk items at Level 2
  3. Severity and probability columns should display your configured rating scales
  4. Risk level cells should display calculated ASIL (or custom) values with color-coded formatting
  5. Confirm you can create countermeasures from the context menu

​
See Also

KB ArticlesSupport TicketsSource Code
  • RisksheetProjectProperties.java
  • PolarionAppConfigManager.java
  • AppConfig.ts
  • risksheet.json
  • AddTaskCommand.ts