These are illustrative scenarios, not actual project or supplier data. Inputs and method boundaries govern each result.
Illustrative study
Shared safeguard: stated availability
Expose the available/unavailable state mixture and distinguish event frequency from event-conditional severity.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Compare availability with zero, full and improved operation; probability and severity stress are separate inputs.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
Availability proposal with additional annual cost
Compare a proposed improvement in shared availability with its distinct annual resource cost. The proposal is not evidence of effective operation.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Hold probability, severity and conditional effectiveness constant; compare availability and control cost with the source case.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
A stronger safeguard that fails the optional net-value condition
The same loss reduction as the availability proposal cannot recover its declared annual cost. Mandatory obligations remain a separate condition.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Compare this higher cost with the lower-cost proposal and inspect full-availability break-even feasibility.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
Installed safeguard unavailable
Failure of shared availability preserves gross loss despite installed prevention and mitigation specifications.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Compare zero availability with stated and fully available operation; no empirical outage frequency is supplied.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
Fully available conditional boundary
Give the conditional effectiveness boundary without claiming that full annual availability can be achieved.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Compare the supplied ideal boundary with uncertain and unavailable operation.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
A different all-available mechanism masquerading as marginal control adjustment
Exhibit a deliberately different all-available configuration. Its loss is not a valid substitute for the original joint-availability mixture.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Compare the declared48% and30% conditional effectiveness with the original80% and50% shared-state inputs; do not transfer outputs across mechanisms.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
Paid safeguard with no conditional effect
Distinguish operating availability from an intervention that actually affects probability or consequence.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Compare zero effectiveness with the source mechanism while retaining positive annual cost.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
Equal expectation with much larger conditional consequence
The expected-loss totals match the source case under a different probability/severity pair; expected loss cannot establish tolerable single-event consequence.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Contrast event probability and severity with the source pair; no tail percentile or maximum cumulative loss is calculated.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
High-probability stress with disclosed saturation
Demonstrate capped stressed event probability and its warning; the stress is a deterministic scenario, not a frequency estimate.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Compare base and stressed probability, severity and availability, retaining the cap rather than silently exceeding unit probability.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
Two separately additive expected-loss ledgers
Sum separately supplied additive expected losses without inferring cross-risk independence or a joint tail distribution.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Check each expected-loss ledger and hold incidence separate; a common driver may alter a joint consequence even when expectation sums remain valid.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
Two names count the same claim twice
A deliberate invalid-incidence example: the engine adds two declared claims but cannot know they represent one economic loss. Hold the aggregate interpretation.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Remove duplicated incidence conceptually before appraisal; the saved intentionally defective register is retained as a falsifier, not an endorsed estimate.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
Zero cost does not establish protective value
A zero break-even availability output follows zero annual cost while avoided loss remains zero. Do not translate that boundary convention into assurance.
What changes
- Parameter: Declared mechanism and resource assumptions
- Test: Compare avoidance and residual loss, not the break-even field alone; mandates and implementation remain independent.
Limits of the study
- All probabilities, USDk event losses, conditional effectiveness, shared availability and annual costs are author-stipulated illustrative inputs; none is empirically estimated.
- The model has one annual event probability per named risk and one shared Bernoulli availability state within that risk. It does not calculate multiple-event counts, joint cross-risk tails, maximum loss, legal acceptance, insurance settlement or observed control reliability.
- Separate USDk/year annual control cost and expected-loss outputs; a deterministic stress is not a confidence bound.
Open this case in the model↗Illustrative study
Illustrative zero-chance boundary: base and stress
Separate an unavailable event-conditional quantity from a defined zero annual expectation.
What changes
- Test: Zero-chance conditioning boundary
- Intervention: Set only the supplied gross event probability to zero.
- Held constant: The default first risk row, conditional control effects, shared availability, severity, resource cost and all other stress settings.
Limits of the study
- A zero supplied event probability is an illustrative assumption, not evidence of actual safety.
- The one-event annual expected-loss model supplies no tail, count, correlation, insurance or regulatory conclusion.
Open this case in the model↗Illustrative study
Illustrative zero-chance boundary: stress only
Separate an unavailable event-conditional quantity from a defined zero annual expectation.
What changes
- Test: Zero-chance conditioning boundary
- Intervention: Set only the supplied stress probability multiplier to zero.
- Held constant: The default first risk row, conditional control effects, shared availability, severity, resource cost and all other stress settings.
Limits of the study
- A zero supplied event probability is an illustrative assumption, not evidence of actual safety.
- The one-event annual expected-loss model supplies no tail, count, correlation, insurance or regulatory conclusion.
Open this case in the model↗