Appendix: risk calculation dictionary

The calculation dictionary specifies what the canonical demonstrator represents so a reader can reproduce the cases and challenge their use. Each fixture is an explicitly illustrative annual event representation. The model does not estimate its parameters from source documents or observations. The supplied cause, event and consequence text identifies the intended mechanism; numeric fields describe the stipulated chance, event loss, conditional effects, shared availability and recurring cost. The publication's decision routes rely on those meanings as well as the exact computation.

Probability input is stored as a percentage value for the stated gross annual event. The engine converts that representation to a fraction for its calculations. Computed residual event probability is already a fraction. Printed input and output fields therefore use different formatting conventions, preserved in the scalar ledger. An event probability is not a rate of repeated occurrences. If the operational question concerns several losses during the year, the analyst must define a count and consequence model rather than force it into an annual chance field.

Impact is the gross monetary loss of the stated event, in USD thousand. The field does not establish who bears that loss or whether it overlaps another risk. Those are incidence assumptions preserved in the narrative record. The same numeric impact could describe contribution loss, repair expense or another claim, but those meanings are not interchangeable. The distinct-loss and duplicate-claim fixtures demonstrate why the author must state the relationship among claims before interpreting the model's aggregate. The engine's addition cannot resolve that semantic boundary.

Prevention is a conditional reduction in event chance when the common support state is available. Mitigation is a conditional reduction in event severity in that same state. Reliability in the input and sweep names means the supplied shared availability, not an independently estimated probability that every control works. The manuscript uses availability to keep that interpretation visible. If the functions have different support dependencies, partial states or changing conditional performance, the binary common-state mechanism should be reassessed. Its exact implementation does not make it universally applicable.

Annual control cost is a recurring resource scalar. It is added across entered risks and subtracted from avoided annual expectation to obtain net annual control value. It is not an initial investment, insurance payment, loan service or expenditure authority. The fictional diligence cap is separate from that model field. A committee deciding installation would need an appropriate cash, resource and timing appraisal. The annual comparison can identify an optional economic condition but cannot establish the affordability or authority for the next act.

Within each risk, the engine constructs an unavailable and an available operating state. The unavailable state's weight is the complement of shared availability, and its event chance and severity remain gross. The available state's weight is shared availability, and its event chance and severity reflect the conditional prevention and mitigation. Weighted expected-loss contributions from the states are added. This construction preserves the dependency between the conditional functions and common operating support. It does not require a distribution of actual observed operating states because the fixture states are stipulated.

The residual event chance is the weighted chance across those operating states. Residual event-conditional severity is residual expectation divided by that positive chance. This conditional severity describes the events remaining under the mixture; it does not merely reproduce the severity in the available state. When residual event chance is absent, the conditional quantity is undefined. A reader should not replace an undefined conditional object with a convenient favourable value. The relevant question becomes whether the claimed prevention and omitted event paths are supportable.

Gross annual expectation is gross chance multiplied by gross event loss. Avoided expectation is the gross result less residual expectation. Net annual control value is avoided expectation less annual control cost. The aggregate outputs add the supplied risk-level expectations and costs. The expectations of distinct additive claims can be added without a cross-risk independence assumption. Their sum does not provide a joint distribution or a simultaneous consequence probability. The incidence ledger and any capacity appraisal remain separate work.

An annual gross mean and residual mean can display the same rounded amount even when a small avoided expectation exists. Subtracting those rounded quantities would then erase the benefit and could reverse the net-value interpretation after annual control cost is charged. The engine evaluates the shared-availability avoided-loss identity directly and sums its rational values before converting results for display. Its JSON output retains exact numerator and denominator records beside a decimal approximation, including the aggregate net control value. These records describe the canonical decimal spelling of each validated input number; digits lost when JSON is first parsed cannot be reconstructed. Inspect the direct avoided-loss and net-value fields when checking a very small margin. None of this additional numerical precision calibrates the event chance, control effect or loss incidence. Those remain supplied assumptions whose adequacy needs operating evidence.

The break-even availability output solves the supplied annual cost comparison with gross event and conditional effects fixed. If an achievable shared availability cannot recover the annual cost, the engine returns an undefined threshold and a warning. If annual cost is absent, its convention returns a zero threshold. The free ineffective-control fixture demonstrates why this convention cannot be read as protective adequacy. It avoids no loss despite the favourable-looking threshold. The threshold's scope is economic recovery under fixed inputs, not acceptance of consequence or assurance of operation.

Stress changes the gross annual chance, event severity and shared availability using the supplied settings before recomputing the mechanism. Gross chance remains within a valid annual-probability bound and shared availability remains nonnegative; boundary warnings must be retained. The scenario multipliers and drop are authored inputs, not an estimated joint distribution. A stressed expectation therefore describes the conditional changed mechanism. It is not a loss percentile, a repeated-event count or the probability that the scenario occurs. The publication's warning record holds those unsupported interpretations.

The reliability sweep applies hypothetical common availability values to the supplied risks while retaining their other inputs and annual costs. Each output point reports expected loss and expected loss plus recurring control cost. The manuscript figures select those exact scalars without duplicating domain calculation in the plotting code. In a multirisk case the sweep applies one common hypothetical availability to the entered risks; it does not estimate their joint state dependence. The graph's connectors organise discrete tests and should not be read as measured operating trajectories.

The model input validator protects required types, nonblank text, finite numeric values, allowed bounds and unique names. Those protections prevent several malformed calculations. They do not validate the truth of a probability, the relevance of an efficacy estimate, the distinctness of a monetary claim or the authority to implement a response. The deliberately duplicated incidence case therefore remains a meaningful negative semantic test even though its input passes. Technical validation is necessary for reproduction, but a decision record needs further evidence and interpretation checks.

The reproduced base output supplies residual expectation of USD 92.00 thousand and net annual value of USD 78.00 thousand. The dictionary tells the reader which objects those values describe. A real appraisal could use the same computation only after establishing an appropriate mechanism and input basis. It would still need authority and implementation evidence for its next act. The distinction between reusable computation and case-specific evidence is essential to the method's practical limits.

Use reproduction as the start of a diagnostic sequence. If the exact input fails to reproduce the retained output, investigate calculation lineage before discussing meaning. If it reproduces but differs from an independent expected boundary, investigate whether the mechanism or expectation is misunderstood. If both agree, examine whether the operating assumptions and consequence incidence support the intended use. The final check asks which action the supplied condition permits. The next appendix contains cases where identical favourable arithmetic has different dispositions, so a reproduced number cannot bypass these later questions. Each stage can fail independently and directs a different repair.

Reproduction should begin from the exact fixture rather than rounded printed values. The paired output and bindings identify every selected scalar used by the manuscript or figure. The canonical app module and schema define the computation and accepted representation. A live run must match the frozen output exactly before the published comparison is treated as reproduced. A changed engine, input or schema requires a new receipt. These identities establish computational lineage; they do not establish actual parameter truth or replace the claim-level source and mechanism review.

The reader should inspect methods, limitations and warnings in the full output object, not only its metrics. The publication tables select decision-relevant fields and disclose the cases' interpretive boundaries. The downloadable objects preserve the rest of the computation so that selection can be challenged. A missing warning in a summary would be a reporting failure even if the underlying calculation were correct. The probability-cap case makes the warning's decision consequence explicit: the annual chance result remains usable for its supplied representation, while a count interpretation is held.