> ## Documentation Index
> Fetch the complete documentation index at: https://learn.nextedy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure HARA Workflows

> Set up a Hazard Analysis and Risk Assessment (HARA) workflow in Nextedy RISKSHEET with custom work item types, severity and probability scales, risk matrix calculations, and countermeasure tracking for functional safety.

export const LastReviewed = ({date}) => {
  if (!date) return null;
  const formatted = new Date(`${date}T00:00:00Z`).toLocaleDateString("en-US", {
    year: "numeric",
    month: "long",
    day: "numeric",
    timeZone: "UTC"
  });
  return <p className="mt-10 text-sm text-gray-400 dark:text-zinc-500 not-prose">
      Last reviewed on {formatted}
    </p>;
};

Risksheet is a generic tool supporting any risk management methodology, including FMEA, HARA, Threat Analysis and Risk Assessment (TARA), STRIDE, and Common Vulnerability Scoring System (CVSS). Nextedy provides solution templates for typical methodologies — pick the closest template, understand its configuration, then adapt it to your process. The functional safety template is the simplest entry point for HARA evaluation.

## Prerequisites

Before starting, ensure you have:

* Risksheet installed and licensed in your Polarion project
* Administrative access to edit the sheet configuration (the file `risksheet.json` attached per LiveDoc, editable through the YAML editor since v25.5.0)
* Custom work item types created in Polarion for your HARA structure (for example, Hazard, Risk, Countermeasure)
* Polarion enumerations defined for your severity, exposure, controllability, and ASIL scales (Administration > Enumerations)
* Custom fields on the risk work item type, each bound to the appropriate enumeration
* Familiarity with the [configuration editor](/risksheet/guides/configuration/using-config-editor)

## HARA Structure Overview

A HARA risksheet presents a multi-level visual hierarchy linking hazards to risk assessments and downstream countermeasures. Risksheet's data model has only two entity types — risk items and task items — while the visual `levels` array creates any number of hierarchical groupings through cell merging.

<Frame>
  <img src="https://mintcdn.com/none-17b4493f/yWl5nA2D0IzEnZC1/risksheet/diagrams/guides/risk-management/hara-configuration/diagram-1.svg?fit=max&auto=format&n=yWl5nA2D0IzEnZC1&q=85&s=2678b7e0bdb141bdc546458b043ee53b" alt="diagram" style={{ maxWidth: "520px", width: "100%" }} width="520" height="240" data-path="risksheet/diagrams/guides/risk-management/hara-configuration/diagram-1.svg" />
</Frame>

<Steps>
  <Step title="Define Data Types">
    Configure the work item types in `dataTypes`. A typical HARA uses a risk work item as the primary row and a countermeasure as the downstream task. Add `name` and `zoomColumn` so the toolbar shows a label and users land on the right column when creating a new task.

    ```yaml theme={null}
    dataTypes:
      risk:
        type: risk
        role: has_risk
        removeStrategy: rejected
      task:
        type: countermeasure
        role: mitigates
        name: Countermeasure
        zoomColumn: countermeasureTitle
    ```

    Replace `risk` and `countermeasure` with your actual Polarion work item type IDs. The `removeStrategy` (on `dataTypes.risk`) controls risk-item removal: `delete` (permanent), `rejected` (status flip), `recycle_bin` (hidden), or `hide` (v23.7.7+, filtered out).

    <Warning title="Field assignment">
      Countermeasure-specific fields (specification, effectiveness) must live on the countermeasure work item type, not the risk type. Column `bindings` (plural) determines which work item holds each field — misconfigured columns save data on the wrong item.
    </Warning>
  </Step>

  <Step title="Configure Levels">
    Define the visual hierarchy. Every level entry has three required properties: `name` (label in the navigation/zoom menu), `controlColumn` (drives cell merging), and `zoomColumn` (target of the zoom menu).

    ```yaml theme={null}
    levels:
      - name: Hazard
        controlColumn: hazardId
        zoomColumn: hazardId
      - name: Risk
        controlColumn: riskItemId
        zoomColumn: riskItemId
    ```

    Consecutive rows with the same value in `controlColumn` are merged vertically, creating the appearance of a hazard parent with child risk rows — even though every row is the same Polarion work item type.
  </Step>

  <Step title="Define Severity and Exposure Scales">
    Rating scales are **not** defined inside the sheet configuration. They are Polarion enumerations:

    1. In Polarion, go to **Administration > Enumerations** and create one enumeration per scale (for example `iso26262-severity`, `iso26262-exposure`, `iso26262-controllability`, `iso26262-asil`) with stable IDs (`S0`–`S3`; `E0`–`E4`; `C0`–`C3`; `QM`, `ASIL_A`–`ASIL_D`).
    2. Create custom fields on the risk work item type (`severity`, `exposure`, `controllability`, `asil`), each bound to the matching enumeration.
    3. In the sheet configuration, declare columns of type `rating:<enumId>` with `bindings: <fieldId>`. The server loads enum values automatically — there is no `ratings` block in the sheet configuration.

    ```yaml theme={null}
    columns:
      - id: severity
        header: Severity (S)
        type: rating:iso26262-severity
        bindings: severity
        level: 2
      - id: exposure
        header: Exposure (E)
        type: rating:iso26262-exposure
        bindings: exposure
        level: 2
      - id: controllability
        header: Controllability (C)
        type: rating:iso26262-controllability
        bindings: controllability
        level: 2
    ```
  </Step>

  <Step title="Configure ASIL Determination">
    ASIL is derived from severity, exposure, and controllability. Use a named `formulas` entry to compute it:

    ```yaml theme={null}
    formulas:
      determineAsil: "function(info){ var s = info.item['severity']; var e = info.item['exposure']; var c = info.item['controllability']; if(!s || !e || !c) return null; var matrix = {'S3_E4_C3':'ASIL_D','S3_E4_C2':'ASIL_C','S3_E3_C3':'ASIL_C','S3_E3_C2':'ASIL_B','S2_E4_C3':'ASIL_C','S2_E4_C2':'ASIL_B','S2_E3_C3':'ASIL_B','S1_E4_C3':'ASIL_B','S1_E4_C2':'ASIL_A'}; return matrix[s+'_'+e+'_'+c] || 'QM'; }"
    ```

    Reference the formula from the ASIL column:

    ```yaml theme={null}
    columns:
      - id: asil
        header: ASIL
        type: rating:iso26262-asil
        bindings: asil
        formula: determineAsil
        level: 2
    ```

    <Tip title="Complex matrices belong in the top panel">
      For regulated environments, externalize matrix logic to the top panel configuration (`risksheetTopPanel.vm`). The sheet configuration's `formulas` block then holds thin wrappers, while the real function lives in the top panel `<script>` block. This narrows the validation scope when ASIL thresholds change.
    </Tip>
  </Step>

  <Step title="Apply Conditional Formatting">
    Highlight ASIL values using a `cellDecorators` function combined with `styles` classes. Cell decorators must use `toggleClass` rather than inline styles because grid cells are reused as the user scrolls.

    ```yaml theme={null}
    cellDecorators:
      asilLevel: "function(info){ var val = info.value; $(info.cell).toggleClass('asilD', val==='ASIL_D'); $(info.cell).toggleClass('asilC', val==='ASIL_C'); $(info.cell).toggleClass('asilB', val==='ASIL_B'); $(info.cell).toggleClass('asilA', val==='ASIL_A'); }"

    styles:
      ".asilD": "{background-color: #f8eae7 !important; color: #ab1c00 !important;}"
      ".asilC": "{background-color: #fff3d2 !important; color: #735602 !important;}"
      ".asilB": "{background-color: #e3f2fd !important; color: #0d47a1 !important;}"
      ".asilA": "{background-color: #eaf5e9 !important; color: #1d5f20 !important;}"
    ```

    Attach the decorator to the ASIL column with `cellRenderer: asilLevel`. The thresholds and colors are entirely up to your organization — Risksheet does not impose any default ASIL palette.

    | ASIL Level | Suggested Color | Integrity Requirement |
    | ---------- | --------------- | --------------------- |
    | ASIL D     | Red             | Highest               |
    | ASIL C     | Yellow          | High                  |
    | ASIL B     | Blue            | Moderate              |
    | ASIL A     | Green           | Low                   |
  </Step>

  <Step title="Configure Upstream Traceability">
    Link risk rows to upstream hazards or system functions using `itemLink` columns. The `typeProperties` block has six verified sub-properties: `linkRole`, `linkTypes`, `linkDirection`, `backLink`, `itemTemplate`, and `queryFactory`. `linkTypes` is a **comma-separated string** of work item type IDs, not an array.

    ```yaml theme={null}
    columns:
      - id: hazardLink
        header: Hazard
        type: itemLink
        bindings: linkedWorkItems
        level: 1
        canCreate: true
        typeProperties:
          linkRole: relates_to
          linkTypes: hazard,hazardousEvent
          linkDirection: back
          backLink: true
          itemTemplate: "$item.id - $item.title"
          queryFactory: hazardQuery
    ```

    To restrict the autocomplete to a shared hazard library, add `typeProperties.document: '02 - Risk Management File/Hazards Library'`. For cross-project autocomplete, set `typeProperties.project` to a space-separated list (for example `$projectId GlobalLibrary`); `$projectId` resolves to the current project at runtime. See [Configure Upstream Traceability Columns](/risksheet/guides/columns/upstream-traceability).
  </Step>

  <Step title="Configure Countermeasure Columns">
    Add downstream columns. Bind the task link column to `task.title`, and add a field column for any countermeasure-specific custom field:

    ```yaml theme={null}
    columns:
      - id: countermeasureTitle
        header: Countermeasure
        type: taskLink
        bindings: task.title
        canCreate: true
      - id: cmSpecification
        header: Specification
        type: string
        bindings: task.customField_specification
    ```

    To enable subsheet navigation — the countermeasure link opens a child risksheet — set `dataTypes.task.linkToRisksheet: true` and `dataTypes.task.document: <path/to/child>`. To target a specific document for new tasks, use `dataTypes.task.createInDocument` (v24.8.1+) or `dataTypes.task.createInCurrentDocument: true`. See [Configure Multiple Downstream Types](/risksheet/guides/risk-management/multiple-downstream-types) for multi-type patterns.
  </Step>
</Steps>

## Adapting for Other Standards

The same patterns apply to other standards:

* **ISO 14971 (medical devices)** — replace the ASIL enumeration with a risk acceptability enumeration; use P1/P2 enumerations for hazardous-situation and harm probabilities.
* **Aviation FHA (ARP 4761)** — configure hazard and failure-condition work item types with the appropriate severity classifications.
* **Custom matrices** — define your own Polarion enumerations and `formulas`, bind columns of type `rating:<yourEnumId>`.

## Review Workflow

Risksheet supports three review managers under `reviews`: comment-based, work item-based, and approval-based. The approval review creates approval-tagged comments on the document; note that it does **not** trigger Polarion's formal document approval state transitions (draft → reviewed → approved). For full document-state integration, use Polarion's workflow on the LiveDoc itself.

## Verification

After saving your configuration:

1. Reload the LiveDoc in your browser.
2. Confirm the hierarchy: hazards merged at Level 1, risk rows at Level 2.
3. Severity, exposure, and controllability columns display values from your Polarion enumerations.
4. The ASIL cell computes automatically and applies the color from the `cellDecorators` function.
5. Create a countermeasure from the task toolbar (using the `name` from `dataTypes.task`) and verify the link role.

All data resides in Polarion work items — Risksheet visualizes and edits Polarion data but does not store anything separately. Authorization, history, and audit are Polarion's.

## See Also

* [Configure FMEA Workflows](/risksheet/guides/risk-management/fmea-configuration) — FMEA-specific configuration patterns
* [Set Up Risk Matrices](/risksheet/guides/risk-management/risk-matrices) — custom risk matrix configuration
* [Configure Downstream Tasks](/risksheet/guides/risk-management/downstream-tasks) — mitigation and countermeasure tracking
* [Configure Multiple Downstream Types](/risksheet/guides/risk-management/multiple-downstream-types) — multiple countermeasure types
* [Apply Conditional Formatting](/risksheet/guides/styling/conditional-formatting) — additional cell styling
* [Configure Calculated Columns](/risksheet/guides/columns/calculated-columns) — formula syntax reference

<LastReviewed date="2026-06-24" />