WARRaNT Consortium (Horizon Europe RIA 101202581) 2026-06-05 WARRaNT KG Ontology WARRaNT ontology for dependability-aware vessel operations, causal dependability modelling, assurance, Dependability Index, scenarios, mitigation, and Digital Twin integration. Covers DAVOM, CDM, Assurance, DI, Scenario, Mitigation, and DT modules. Horizon Europe RIA 101202581. WARRaNT Knowledge Graph Ontology 0.9-poc causes assurance degradation has assurance attribute has assurance score has attribute value has penalty has weight updates assurance score Traceability: the Deviation, Hazard, or UnsafeControlAction that triggered this AssuranceDegradation. was triggered by acts on degrades Tags a Deviation individual with a HAZOP guideword from the cdm:DeviationType controlled vocabulary. has deviation type has environmental condition has operational context influences is critical under is evaluated as is performed under issues may cause may lead to modifies impact of modifies likelihood of prevents provides feedback realises updates was observed under authorizes carries data flow controls dependency source dependency target Simple traversal relation between operational entities. Use reified Dependency when weight, criticality, or redundancy level must be recorded. depends on executes has component has data flow has function has operator role has subsystem is supported by operates participates in performs role provides data to requires operator role supervises supports decision of supports function uses communication link applies to An AssuranceScore feeds into the node-level DI calculation. contributes to A node DI contributes to the system-level DI_sys aggregation. contributes to system has DI state Associates the node DI with its PropagatedRisk value R̃_i(t). has propagated risk has threshold The upstream DI node j in the propagation edge j→i. propagation source The downstream DI node i in the propagation edge j→i. propagation target uses calculation method executes has layer has view monitors Documents that the DT receives live updates from analytical services, sensors, or operator inputs. receives update from represents state of stores result supports decision Range constrained to warrant:VisualisableEntity (defined in warrant-core.ttl). Do NOT use dt:VisualisableEntity. visualises activates addresses has expected effect is triggered by matches rule performs mitigation recommends uses captures consumes The terminal step of the production chain. A DetectionEvent identifies a specific Deviation individual. detection event detects SPARQL shortcut traversal property only. Domain is DetectionEvent (not AnalyticalService or Measurement directly). Production pattern: use obs:producesDetectionEvent + obs:detectionEventDetects. detects estimates has data quality Associates a metric with an operational entity (Component, System, VesselFunction, HumanOperatorRole, DataFlow, CommunicationLink). has dependability metric has measurement Source of a measurement, observation, or analytical output. has source indicates measures observes presents Range is Status or VirtualSensorOutput. cdm:Deviation is NOT in the range — deviations are reached only via the DetectionEvent production path. produces produces detection event A measurement provides evidence contributing to a detection event. supports detection supports detection of affects causes has execution state has scenario execution has scenario parameter has scenario result has trigger has attribute value number has penalty value The computed assurance score A_v(t). Stored by the external calculation service. has score value has weight value has acceptability has impact has likelihood has risk level has severity has description A stable identifier string for the entity (e.g. VF-RN-001, COMP-GNSS-RX-001). has identifier has name has version valid from valid to has confidence has criticality Structural weight of this dependency, mirrored at the DI level by di:hasRiskPropagationWeight on a RiskPropagationEdge. has dependency weight has latency has redundancy level calculated at The risk sensitivity coefficient β for this node in DI_i = A_i - β·R̃_i. has beta weight The computed node DI_i(t) value. has DI value has lower threshold The computed R̃_i(t) value. has propagated risk value The weight w_ji on this propagation edge, corresponding to davom:hasDependencyWeight on the structural Dependency. has risk propagation weight The computed DI_sys(t) value. has system DI value The aggregation weight γᵢ for this node in DI_sys = Σ γᵢ·DI_i. has system weight has upper threshold has confidence value Key or URI pointing to the raw measurement record in an external time-series store. Prevents the KG from being used as a telemetry database. has external record reference Identifier of the metric's data stream in the external telemetry platform. has external time series id has quality value has sampling rate has timestamp Unit of measurement as a string. Future alignment: obs:hasUnit ≈ qudt:unit. has unit has value has execution timestamp Human-readable outcome description of the scenario execution. has result summary A dependability quality dimension: reliability, safety, cybersecurity, resilience, availability, maintainability. Assurance Attribute The normalised value x_v^(k) for a specific assurance attribute of a node. Assurance Attribute Value A reduction in assurance score caused by a Deviation, Hazard, or UnsafeControlAction. Assurance Degradation Abstract superclass for all assurance-related entities. Assurance Entity The computed assurance state A_v(t) of a node. Feeds into the DI calculation via di:contributesTo. Assurance Score The weight βₖ for an assurance attribute in the node assurance formula. Assurance Weight Availability An input to the external assurance calculation (e.g. a normalised attribute value, weight). Calculation Input Cybersecurity Evidence supporting or undermining an assurance claim. Informative alignment: assr:Evidence ≈ gsn:Evidence. Evidence Maintainability A quantified penalty applied to an assurance attribute value due to a specific event. Penalty Reliability Resilience Safety Sudden, unwanted, unplanned event or sequence that has led to harm (Rausand & Haugen, 2020). Accident Abstract superclass for all entities in the causal dependability chain. Causal Entity Causal Scenario Control Structure Controlled Process Controller An abnormal condition relative to expected operation or data. Tag with cdm:hasDeviationType using a named cdm:DeviationType individual. Do NOT create Deviation subclasses — that pattern is deprecated. Deviation Controlled vocabulary of HAZOP guidewords. Use cdm:hasDeviationType to tag a Deviation individual. Deviation Type Feedback A system state or condition that may lead to an accident or loss. Hazard DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:INCONSISTENT instead. Will be removed in v0.2.0. Inconsistent Deviation (DEPRECATED) true INCONSISTENT DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:LATE instead. Will be removed in v0.2.0. Late Deviation (DEPRECATED) true LATE DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:LESS instead. Will be removed in v0.2.0. Less Deviation (DEPRECATED) true LESS Unacceptable outcome: property damage, environmental damage, loss of life, or loss of mission. Loss DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:MORE instead. Will be removed in v0.2.0. More Deviation (DEPRECATED) true MORE DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:NO instead. Will be removed in v0.2.0. No Deviation (DEPRECATED) true NO DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:NOISY instead. Will be removed in v0.2.0. Noisy Deviation (DEPRECATED) true NOISY The controller's internal model of the controlled process state. A ProcessModelFlaw arises when this model diverges from the actual state. Process Model A divergence between the controller's process model and actual process state, leading to an unsafe control action. Process Model Flaw Evaluation of a hazard in terms of likelihood, impact, and severity. Risk A constraint that, if violated, may lead to a hazard. Safety Constraint DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:SPOOFED instead. Will be removed in v0.2.0. Spoofed Deviation (DEPRECATED) true SPOOFED DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:UNAVAILABLE instead. Will be removed in v0.2.0. Unavailable Deviation (DEPRECATED) true UNAVAILABLE A control action that is missing, incorrect, late, early, stopped too soon, or applied too long (STPA terminology). Unsafe Control Action DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:UNTRUSTED instead. Will be removed in v0.2.0. Untrusted Deviation (DEPRECATED) true UNTRUSTED DEPRECATED. Use cdm:Deviation with cdm:hasDeviationType cdm:WRONG instead. Will be removed in v0.2.0. Wrong Deviation (DEPRECATED) true WRONG Abstract superclass for all human agents: HumanOperator and HumanOperatorRole. Intentionally separate from warrant:OperationalEntity to enforce the principle that human operators are not components. The range of dt:visualises includes this class so that operator roles can be visualised by the Digital Twin. Agent Entity Abstract superclass for entities that store calculation inputs, weights, results, and traceability. Numerical computation is always external; the KG stores only the artefacts. Calculation Entity Abstract superclass for operational context elements: voyage segments, operational modes, and environmental conditions. Context Entity A contextual factor that influences deviations, hazards, risks, assurance scores, DI values, and scenario outcomes. Not a vessel component. Environmental Condition Abstract superclass for all observation, measurement, and evidence entities. Evidence Entity A reference to an external standard, regulation, or guideline (e.g., IMO circular, IACS UR, DNV class notation, EMSA framework). Used to link KG elements to normative requirements without importing their content. External Reference Infrastructure Condition Network Coverage Condition A description of the operational state or setting in which a vessel function is executed. Operational Context Abstract superclass for all operational entities in a vessel system: components, systems, functions, data flows, and communication links. Human operators are NOT subclasses of this class; use warrant:AgentEntity instead. Operational Entity A controlled vocabulary class for the mode of vessel operation. Named individuals (not subclasses) enumerate the modes. Belongs here in the core/context module, NOT in the CDM module. Operational Mode Sea State Condition Traffic Condition Visibility Condition Abstract marker class for any ontology entity that may be visualised by the Digital Twin. The range of dt:visualises is constrained to warrant:VisualisableEntity. This class is defined here in the core module — do NOT redefine it in the digital-twin module. Visualisable Entity A leg of a voyage characterised by a specific route segment, transit zone, or operational phase (e.g. port approach, lock transit, open sea). Belongs here in the core/context module, NOT in the CDM module. Voyage Segment Weather Condition Actuator Component Communication Component Communication Dependency A communication channel supporting data exchange, control, monitoring, or coordination between vessel, shore, or external entities. First-class operational entity; may have dependability metrics. Communication Link Communication System A physical, software, cyber, data, communication, or sensor element. Human operators are NOT components; use warrant:AgentEntity subclasses instead. Component A command or intervention issued by a controller or authorised operator. Control Action Control Dependency Cyber Component Cyber Dependency Cyber-Physical System Data Component Data Dependency A flow of data between systems, components, services, operators, or digital-twin elements. First-class operational entity; may have dependability metrics. Data Flow A typed, reified dependency node. Use when weight, criticality, latency, or redundancy level must be recorded alongside the dependency relationship. Dependency Functional Dependency A person performing an operational role. Subclass of warrant:AgentEntity, NOT davom:Component. Example: a remote ROC operator or an onboard boatmaster. Human Operator A functional role associated with human operation (e.g. RemoteOperatorRole, OnboardBoatmasterRole). Subclass of warrant:AgentEntity, NOT davom:Component. Multiple HumanOperator individuals may perform the same role. Human Operator Role A dependency modelling the oversight relationship between a HumanOperatorRole and a system or function (e.g. ROC operator supervises remote navigation). Human Supervision Dependency Interface Component Operational Dependency A defined sequence of operational or mitigation steps that may be executed by a HumanOperatorRole. Operational Procedure An HMI through which a human operator receives information or provides input. Operator Interface Organisational System Physical Component Power Dependency Procedure Dependency Sensor Component Software Component Software System A decomposition of a system into a more specific functional or technical unit. Subsystem A technical, software, cyber-physical, communication, or organisational system supporting one or more vessel functions. System Technical System The maritime asset or operational vessel represented in the KG. Vessel An operational capability that the vessel must provide (e.g. remote navigation, fire detection). Vessel Function Metadata describing the formula used to compute a DI value. Numerical computation is external; this stores method identity and version. DI Calculation Method DI Threshold A recorded event of a DI value being updated by the external calculation service. DI Update Event Stores γᵢ, the system aggregation weight for node i in the DI_sys formula. DI Weight Abstract superclass for all DI-related entities. Dependability Entity Node-level DI for a VesselFunction: DI_i(t) = A_i(t) - β·R̃_i(t). Computed externally; inputs, weights, and result stored in the KG. Dependability Index Operational state of a DI node. MUST be represented as named individuals (di:NormalState, di:DegradedState, etc.). Subclassing DependabilityIndexState is PROHIBITED. Dependability Index State Dependability Index Value Stores R̃_i(t) = Σ w_ji·R_j(t), the risk propagated into node i from upstream dependency nodes. Propagated Risk A reified edge encoding the risk propagation weight w_ji from upstream DI node j to downstream DI node i. Mirrors the structural dependency in davom:Dependency. Risk Propagation Edge Top-level DI_sys aggregating all node DIs: DI_sys(t) = Σᵢ γᵢ·DI_i(t). System Dependability Index A specialised DigitalTwinView for operator decision-support: presents DI state, recommended mitigations, and scenario results side-by-side. Decision Support View A digital representation of a vessel or system. Executes scenarios, visualises DI and failover procedures, monitors operational entities, and receives live updates from analytical services. Digital Twin A configurable view displayed on the DT interface (e.g. vessel overview, function health panel, scenario panel). Digital Twin View Transient execution state during a scenario run. Lifecycle: PENDING → RUNNING → COMPLETED | FAILED. Scenario Execution State A rendering layer within a DigitalTwinView. Instances declare which KG entities they render via dt:visualises (e.g. DI heatmap layer, hazard overlay, alert layer). Visualisation Layer A human-directed advisory recommendation presented to the operator. All PoC mitigation instances must use this class. Advisory Action A defined fallback or recovery process. In the WARRaNT v0.1.0 PoC, failover procedures are visualised or advisory — they are NOT automatically executed. Failover Procedure A subclass of MitigationAction representing a future automation-executable action. Defined for semantic completeness and forward compatibility. All WARRaNT v0.1.0 PoC instances MUST use mit:AdvisoryAction or mit:FailoverProcedure instead. Informative alignment: mit:MachineActionableAction ≈ saref:Command (SAREF4ENER). Machine-Actionable Action An action that reduces risk, assurance degradation, or DI degradation. Mitigation Action Abstract superclass for all mitigation-related entities. Mitigation Entity A rule matching a Deviation, Hazard, or DependabilityIndexState and recommending a MitigationAction. Mitigation Rule Recovery Effect Redundant Resource API Connector Alert A computational service that consumes metrics and produces Status, VirtualSensorOutput, or DetectionEvents. It does NOT produce Deviation directly — use the DetectionEvent production path. Analytical Service Availability Metric Confidence Level Cybersecurity Metric Data Quality Indicator Data Quality Metric A source of measurements, observations, operator inputs, analytical outputs, or evidence. Subclasses include Observer, AnalyticalService, and system-level data producers. Data Source Dependability Metric An interpreted event produced by a DetectionRule, AnalyticalService, or VirtualSensor indicating that a Deviation has been detected. This is the ONLY production path to Deviation: AnalyticalService → producesDetectionEvent → DetectionEvent → detectionEventDetects → Deviation. obs:detects is a SPARQL shortcut only. Detection Event Detection Rule Diagnostic Service Observation-module superclass for all observation and evidence entities. Evidence Entity (Observation) A human-reported observation about a metric, status, or deviation. Human Observation Human Performance Metric Log Collector An observed value of a metric at a specific time. Raw high-frequency measurements are stored externally; only semantic events and latest states live in the KG. Use hasExternalRecordReference to link to the external store. Measurement A dependability-relevant measurable property of an operational entity (Component, System, VesselFunction, DataFlow, CommunicationLink, or HumanOperatorRole). Components have metrics; they do not generate metrics. Metric An entity that observes, measures, or estimates a metric. Informative alignment: obs:Observer ≈ sosa:Sensor (W3C SOSA/SSN). Observer Operator Input Performance Metric Probe Reliability Metric Safety Metric Sensor Status Software-based observer that estimates a metric from other data streams. Informative alignment: obs:VirtualSensor ≈ sosa:Sensor (software-only variant). Virtual Sensor Virtual Sensor Output Cyberattack Scenario Degraded Operation Scenario Deviation Trigger Environmental Scenario Event Trigger Failure Failure Scenario A simulated what-if case: cyberattack, failure, degraded operation, environmental, or unsafe control. The external scenario engine executes it. Scenario A specific execution instance of a Scenario, with state, timestamps, and result. Scenario Execution Stores the outcome of a ScenarioExecution: result metadata, timestamps, and references to DI states and deviation events produced during execution. Owned by this module; the DT module references but does not redefine it. Scenario Result Scenario Trigger Threat Unsafe Control Scenario Conflicting or incoherent data from multiple sources. INCONSISTENT Later than expected. LATE Less than intended quantity, flow, or signal. LESS More than intended quantity, flow, or signal. MORE No flow, no signal, function absent. NO Excessive noise or degraded signal quality. NOISY Data injected or manipulated by an adversary (cyberattack). SPOOFED Component, service, or signal unavailable. UNAVAILABLE Source, identity, or integrity cannot be verified. UNTRUSTED Wrong direction, content, or target. WRONG Vessel is under human control with active decision-support assistance from the Digital Twin or an analytical service. Assisted Operation Mode Vessel is operating autonomously without active human control. Relevant to LL3 NOVA. Autonomous Operation Mode One or more vessel functions are operating below normal capability; reduced-dependency fallback procedures are active. Degraded Operation Mode A transient mode during transfer of control between ROC operator and onboard boatmaster, or between automation and human. Relevant to LL4 Use Case 2 (uncontrolled handover at Kreekraksluizen). Handover Mode Vessel is under direct manual control by onboard crew. Manual Operation Mode Vessel is under control of a remote operator via a Remote Operation Centre (ROC). Relevant to LL4 Seafar ROS. Remote Operation Mode DI indicates a critical level requiring immediate attention or action. Critical DI below normal threshold; function remains operational with reduced capability. Degraded DI indicates function failure. Failed DI within normal operating bounds. Normal DI indicates an unsafe operational condition requiring emergency response. Unsafe