WARRaNT Consortium (Horizon Europe RIA 101202581)
WARRaNT ontology for dependability-aware vessel operations, causal dependability modelling, assurance, Dependability Index, scenarios, mitigation, and Digital Twin integration. Covers DAVOM, CDM, Assurance, DI, Scenario, Mitigation, and DT modules. Horizon Europe RIA 101202581.
WARRaNT Knowledge Graph Ontology
causes assurance degradation
has assurance attribute
has assurance score
has attribute value
has penalty
has weight
updates assurance score
Traceability: the Deviation, Hazard, or UnsafeControlAction that triggered this AssuranceDegradation.
was triggered by
acts on
degrades
Tags a Deviation individual with a HAZOP guideword from the cdm:DeviationType controlled vocabulary.
has deviation type
has environmental condition
has operational context
influences
is critical under
is evaluated as
is performed under
issues
may cause
may lead to
modifies impact of
modifies likelihood of
prevents
provides feedback
realises
updates
was observed under
authorizes
carries data flow
controls
dependency source
dependency target
Simple traversal relation between operational entities. Use reified Dependency when weight, criticality, or redundancy level must be recorded.
depends on
executes
has component
has data flow
has function
has operator role
has subsystem
is supported by
operates
participates in
performs role
provides data to
requires operator role
supervises
supports decision of
supports function
uses communication link
applies to
An AssuranceScore feeds into the node-level DI calculation.
contributes to
A node DI contributes to the system-level DI_sys aggregation.
contributes to system
has DI state
Associates the node DI with its PropagatedRisk value R̃_i(t).
has propagated risk
has threshold
The upstream DI node j in the propagation edge j→i.
propagation source
The downstream DI node i in the propagation edge j→i.
propagation target
uses calculation method
has layer
has view
monitors
Documents that the DT receives live updates from analytical services, sensors, or operator inputs.
receives update from
represents state of
stores result
supports decision
Range constrained to warrant:VisualisableEntity (defined in warrant-core.ttl). Do NOT use dt:VisualisableEntity.
visualises
activates
addresses
has expected effect
is triggered by
matches rule
performs mitigation
recommends
uses
captures
consumes
The terminal step of the production chain. A DetectionEvent identifies a specific Deviation individual.
detection event detects
SPARQL shortcut traversal property only. Domain is DetectionEvent (not AnalyticalService or Measurement directly). Production pattern: use obs:producesDetectionEvent + obs:detectionEventDetects.
detects
estimates
has data quality
Associates a metric with an operational entity (Component, System, VesselFunction, HumanOperatorRole, DataFlow, CommunicationLink).
has dependability metric
has measurement
Source of a measurement, observation, or analytical output.
has source
indicates
measures
observes
presents
Range is Status or VirtualSensorOutput. cdm:Deviation is NOT in the range — deviations are reached only via the DetectionEvent production path.
produces
produces detection event
A measurement provides evidence contributing to a detection event.
supports detection
supports detection of
affects
causes
has execution state
has scenario execution
has scenario parameter
has scenario result
has trigger
has attribute value number
has penalty value
The computed assurance score A_v(t). Stored by the external calculation service.
has score value
has weight value
has acceptability
has impact
has likelihood
has risk level
has severity
has description
A stable identifier string for the entity (e.g. VF-RN-001, COMP-GNSS-RX-001).
has identifier
has name
has version
valid from
valid to
has confidence
has criticality
Structural weight of this dependency, mirrored at the DI level by di:hasRiskPropagationWeight on a RiskPropagationEdge.
has dependency weight
has latency
has redundancy level
calculated at
The risk sensitivity coefficient β for this node in DI_i = A_i - β·R̃_i.
has beta weight
The computed node DI_i(t) value.
has DI value
has lower threshold
The computed R̃_i(t) value.
has propagated risk value
The weight w_ji on this propagation edge, corresponding to davom:hasDependencyWeight on the structural Dependency.
has risk propagation weight
The computed DI_sys(t) value.
has system DI value
The aggregation weight γᵢ for this node in DI_sys = Σ γᵢ·DI_i.
has system weight
has upper threshold
has confidence value
Key or URI pointing to the raw measurement record in an external time-series store. Prevents the KG from being used as a telemetry database.
has external record reference
Identifier of the metric's data stream in the external telemetry platform.
has external time series id
has quality value
has sampling rate
has timestamp
Unit of measurement as a string. Future alignment: obs:hasUnit ≈ qudt:unit.
has unit
has value
has execution timestamp
Human-readable outcome description of the scenario execution.
has result summary
A dependability quality dimension: reliability, safety, cybersecurity, resilience, availability, maintainability.
Assurance Attribute
The normalised value x_v^(k) for a specific assurance attribute of a node.
Assurance Attribute Value
A reduction in assurance score caused by a Deviation, Hazard, or UnsafeControlAction.
Assurance Degradation
Abstract superclass for all assurance-related entities.
Assurance Entity
The computed assurance state A_v(t) of a node. Feeds into the DI calculation via di:contributesTo.
Assurance Score
The weight βₖ for an assurance attribute in the node assurance formula.
Assurance Weight
Availability
An input to the external assurance calculation (e.g. a normalised attribute value, weight).
Calculation Input
Cybersecurity
Evidence supporting or undermining an assurance claim. Informative alignment: assr:Evidence ≈ gsn:Evidence.
Evidence
Maintainability
A quantified penalty applied to an assurance attribute value due to a specific event.
Penalty
Reliability
Resilience
Safety
Sudden, unwanted, unplanned event or sequence that has led to harm (Rausand & Haugen, 2020).
Accident
Abstract superclass for all entities in the causal dependability chain.
Causal Entity
Causal Scenario
Control Structure
Controlled Process
Controller
An abnormal condition relative to expected operation or data. Tag with cdm:hasDeviationType using a named cdm:DeviationType individual. Do NOT create Deviation subclasses — that pattern is deprecated.
Deviation
Controlled vocabulary of HAZOP guidewords. Use cdm:hasDeviationType to tag a Deviation individual.
Deviation Type
Feedback
A system state or condition that may lead to an accident or loss.
Hazard
DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:INCONSISTENT instead. Will be removed in v0.2.0.
Inconsistent Deviation (DEPRECATED)
INCONSISTENT
DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:LATE instead. Will be removed in v0.2.0.
Late Deviation (DEPRECATED)
LATE
DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:LESS instead. Will be removed in v0.2.0.
Less Deviation (DEPRECATED)
LESS
Unacceptable outcome: property damage, environmental damage, loss of life, or loss of mission.
Loss
DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:MORE instead. Will be removed in v0.2.0.
More Deviation (DEPRECATED)
MORE
DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:NO instead. Will be removed in v0.2.0.
No Deviation (DEPRECATED)
DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:NOISY instead. Will be removed in v0.2.0.
Noisy Deviation (DEPRECATED)
NOISY
The controller's internal model of the controlled process state. A ProcessModelFlaw arises when this model diverges from the actual state.
Process Model
A divergence between the controller's process model and actual process state, leading to an unsafe control action.
Process Model Flaw
Evaluation of a hazard in terms of likelihood, impact, and severity.
Risk
A constraint that, if violated, may lead to a hazard.
Safety Constraint
DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:SPOOFED instead. Will be removed in v0.2.0.
Spoofed Deviation (DEPRECATED)
SPOOFED
DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:UNAVAILABLE instead. Will be removed in v0.2.0.
Unavailable Deviation (DEPRECATED)
UNAVAILABLE
A control action that is missing, incorrect, late, early, stopped too soon, or applied too long (STPA terminology).
Unsafe Control Action
DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:UNTRUSTED instead. Will be removed in v0.2.0.
Untrusted Deviation (DEPRECATED)
UNTRUSTED
DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:WRONG instead. Will be removed in v0.2.0.
Wrong Deviation (DEPRECATED)
WRONG
Abstract superclass for all human agents: HumanOperator and HumanOperatorRole. Intentionally separate from warrant:OperationalEntity to enforce the principle that human operators are not components. The range of dt:visualises includes this class so that operator roles can be visualised by the Digital Twin.
Agent Entity
Abstract superclass for entities that store calculation inputs, weights, results, and traceability. Numerical computation is always external; the KG stores only the artefacts.
Calculation Entity
Abstract superclass for operational context elements: voyage segments, operational modes, and environmental conditions.
Context Entity
A contextual factor that influences deviations, hazards, risks, assurance scores, DI values, and scenario outcomes. Not a vessel component.
Environmental Condition
Abstract superclass for all observation, measurement, and evidence entities.
Evidence Entity
A reference to an external standard, regulation, or guideline (e.g., IMO circular, IACS UR, DNV class notation, EMSA framework). Used to link KG elements to normative requirements without importing their content.
External Reference
Infrastructure Condition
Network Coverage Condition
A description of the operational state or setting in which a vessel function is executed.
Operational Context
Abstract superclass for all operational entities in a vessel system: components, systems, functions, data flows, and communication links. Human operators are NOT subclasses of this class; use warrant:AgentEntity instead.
Operational Entity
A controlled vocabulary class for the mode of vessel operation. Named individuals (not subclasses) enumerate the modes. Belongs here in the core/context module, NOT in the CDM module.
Operational Mode
Sea State Condition
Traffic Condition
Visibility Condition
Abstract marker class for any ontology entity that may be visualised by the Digital Twin. The range of dt:visualises is constrained to warrant:VisualisableEntity. This class is defined here in the core module — do NOT redefine it in the digital-twin module.
Visualisable Entity
A leg of a voyage characterised by a specific route segment, transit zone, or operational phase (e.g. port approach, lock transit, open sea). Belongs here in the core/context module, NOT in the CDM module.
Voyage Segment
Weather Condition
Actuator Component
Communication Component
Communication Dependency
A communication channel supporting data exchange, control, monitoring, or coordination between vessel, shore, or external entities. First-class operational entity; may have dependability metrics.
Communication Link
Communication System
A physical, software, cyber, data, communication, or sensor element. Human operators are NOT components; use warrant:AgentEntity subclasses instead.
Component
A command or intervention issued by a controller or authorised operator.
Control Action
Control Dependency
Cyber Component
Cyber Dependency
Cyber-Physical System
Data Component
Data Dependency
A flow of data between systems, components, services, operators, or digital-twin elements. First-class operational entity; may have dependability metrics.
Data Flow
A typed, reified dependency node. Use when weight, criticality, latency, or redundancy level must be recorded alongside the dependency relationship.
Dependency
Functional Dependency
A person performing an operational role. Subclass of warrant:AgentEntity, NOT davom:Component. Example: a remote ROC operator or an onboard boatmaster.
Human Operator
A functional role associated with human operation (e.g. RemoteOperatorRole, OnboardBoatmasterRole). Subclass of warrant:AgentEntity, NOT davom:Component. Multiple HumanOperator individuals may perform the same role.
Human Operator Role
A dependency modelling the oversight relationship between a HumanOperatorRole and a system or function (e.g. ROC operator supervises remote navigation).
Human Supervision Dependency
Interface Component
Operational Dependency
A defined sequence of operational or mitigation steps that may be executed by a HumanOperatorRole.
Operational Procedure
An HMI through which a human operator receives information or provides input.
Operator Interface
Organisational System
Physical Component
Power Dependency
Procedure Dependency
Sensor Component
Software Component
Software System
A decomposition of a system into a more specific functional or technical unit.
Subsystem
A technical, software, cyber-physical, communication, or organisational system supporting one or more vessel functions.
System
Technical System
The maritime asset or operational vessel represented in the KG.
Vessel
An operational capability that the vessel must provide (e.g. remote navigation, fire detection).
Vessel Function
Metadata describing the formula used to compute a DI value. Numerical computation is external; this stores method identity and version.
DI Calculation Method
DI Threshold
A recorded event of a DI value being updated by the external calculation service.
DI Update Event
Stores γᵢ, the system aggregation weight for node i in the DI_sys formula.
DI Weight
Abstract superclass for all DI-related entities.
Dependability Entity
Node-level DI for a VesselFunction: DI_i(t) = A_i(t) - β·R̃_i(t). Computed externally; inputs, weights, and result stored in the KG.
Dependability Index
Operational state of a DI node. MUST be represented as named individuals (di:NormalState, di:DegradedState, etc.). Subclassing DependabilityIndexState is PROHIBITED.
Dependability Index State
Dependability Index Value
Stores R̃_i(t) = Σ w_ji·R_j(t), the risk propagated into node i from upstream dependency nodes.
Propagated Risk
A reified edge encoding the risk propagation weight w_ji from upstream DI node j to downstream DI node i. Mirrors the structural dependency in davom:Dependency.
Risk Propagation Edge
Top-level DI_sys aggregating all node DIs: DI_sys(t) = Σᵢ γᵢ·DI_i(t).
System Dependability Index
A specialised DigitalTwinView for operator decision-support: presents DI state, recommended mitigations, and scenario results side-by-side.
Decision Support View
A digital representation of a vessel or system. Executes scenarios, visualises DI and failover procedures, monitors operational entities, and receives live updates from analytical services.
Digital Twin
A configurable view displayed on the DT interface (e.g. vessel overview, function health panel, scenario panel).
Digital Twin View
Transient execution state during a scenario run. Lifecycle: PENDING → RUNNING → COMPLETED | FAILED.
Scenario Execution State
A rendering layer within a DigitalTwinView. Instances declare which KG entities they render via dt:visualises (e.g. DI heatmap layer, hazard overlay, alert layer).
Visualisation Layer
A human-directed advisory recommendation presented to the operator. All PoC mitigation instances must use this class.
Advisory Action
A defined fallback or recovery process. In the WARRaNT v0.1.0 PoC, failover procedures are visualised or advisory — they are NOT automatically executed.
Failover Procedure
A subclass of MitigationAction representing a future automation-executable action. Defined for semantic completeness and forward compatibility. All WARRaNT v0.1.0 PoC instances MUST use mit:AdvisoryAction or mit:FailoverProcedure instead. Informative alignment: mit:MachineActionableAction ≈ saref:Command (SAREF4ENER).
Machine-Actionable Action
An action that reduces risk, assurance degradation, or DI degradation.
Mitigation Action
Abstract superclass for all mitigation-related entities.
Mitigation Entity
A rule matching a Deviation, Hazard, or DependabilityIndexState and recommending a MitigationAction.
Mitigation Rule
Recovery Effect
Redundant Resource
API Connector
Alert
A computational service that consumes metrics and produces Status, VirtualSensorOutput, or DetectionEvents. It does NOT produce Deviation directly — use the DetectionEvent production path.
Analytical Service
Availability Metric
Confidence Level
Cybersecurity Metric
Data Quality Indicator
Data Quality Metric
A source of measurements, observations, operator inputs, analytical outputs, or evidence. Subclasses include Observer, AnalyticalService, and system-level data producers.
Data Source
Dependability Metric
An interpreted event produced by a DetectionRule, AnalyticalService, or VirtualSensor indicating that a Deviation has been detected. This is the ONLY production path to Deviation: AnalyticalService → producesDetectionEvent → DetectionEvent → detectionEventDetects → Deviation. obs:detects is a SPARQL shortcut only.
Detection Event
Detection Rule
Diagnostic Service
Observation-module superclass for all observation and evidence entities.
Evidence Entity (Observation)
A human-reported observation about a metric, status, or deviation.
Human Observation
Human Performance Metric
Log Collector
An observed value of a metric at a specific time. Raw high-frequency measurements are stored externally; only semantic events and latest states live in the KG. Use hasExternalRecordReference to link to the external store.
Measurement
A dependability-relevant measurable property of an operational entity (Component, System, VesselFunction, DataFlow, CommunicationLink, or HumanOperatorRole). Components have metrics; they do not generate metrics.
Metric
An entity that observes, measures, or estimates a metric. Informative alignment: obs:Observer ≈ sosa:Sensor (W3C SOSA/SSN).
Observer
Operator Input
Performance Metric
Probe
Reliability Metric
Safety Metric
Sensor
Status
Software-based observer that estimates a metric from other data streams. Informative alignment: obs:VirtualSensor ≈ sosa:Sensor (software-only variant).
Virtual Sensor
Virtual Sensor Output
Cyberattack Scenario
Degraded Operation Scenario
Deviation Trigger
Environmental Scenario
Event Trigger
Failure
Failure Scenario
A simulated what-if case: cyberattack, failure, degraded operation, environmental, or unsafe control. The external scenario engine executes it.
Scenario
A specific execution instance of a Scenario, with state, timestamps, and result.
Scenario Execution
Stores the outcome of a ScenarioExecution: result metadata, timestamps, and references to DI states and deviation events produced during execution. Owned by this module; the DT module references but does not redefine it.
Scenario Result
Scenario Trigger
Threat
Unsafe Control Scenario
Conflicting or incoherent data from multiple sources.
Later than expected.
Less than intended quantity, flow, or signal.
More than intended quantity, flow, or signal.
No flow, no signal, function absent.
Excessive noise or degraded signal quality.
Data injected or manipulated by an adversary (cyberattack).
Component, service, or signal unavailable.
Source, identity, or integrity cannot be verified.
Wrong direction, content, or target.
Vessel is under human control with active decision-support assistance from the Digital Twin or an analytical service.
Assisted Operation Mode
Vessel is operating autonomously without active human control. Relevant to LL3 NOVA.
Autonomous Operation Mode
One or more vessel functions are operating below normal capability; reduced-dependency fallback procedures are active.
Degraded Operation Mode
A transient mode during transfer of control between ROC operator and onboard boatmaster, or between automation and human. Relevant to LL4 Use Case 2 (uncontrolled handover at Kreekraksluizen).
Handover Mode
Vessel is under direct manual control by onboard crew.
Manual Operation Mode
Vessel is under control of a remote operator via a Remote Operation Centre (ROC). Relevant to LL4 Seafar ROS.
Remote Operation Mode
DI indicates a critical level requiring immediate attention or action.
Critical
DI below normal threshold; function remains operational with reduced capability.
Degraded
DI indicates function failure.
Failed
DI within normal operating bounds.
Normal
DI indicates an unsafe operational condition requiring emergency response.
Unsafe