Thanks. Sounds a bit fiddly.
The chance of a settlement being attacked is calculated as follows:
Base%=2+Food+Water10
Reduction%=Population2+Defense
Attack chance=max(Base%−Reduction%,2%)
The final attack chance can never go below 2%. The food and water in these formulas also include that stored in the workbench, meaning that the attack chance may increase for settlements with excess production.
Example: If a settlement has 7 food, 6 water, 2 defense, and a population of 5, the attack chance is calculated as follows:
Base=2+7+610=3.3
Reduction=52+2=4.5
Attack chance=max(3.3%−4.5%,2%)=max(−1.2%,2%)=2%
Exception: a settlement with no population will not be attacked, regardless of the quantity of water or food stored at the settlement.
The defense of a settlement without player intervention is determined by comparing the defense strength (defense rating + population) + a random number between 1 and 100 and the attack strength ((food + water in the settlement) +/-50%) + a random number between 1 and 100. The defense strength is capped at 100, so it's not useful to have more than (100 - population) defense when not responding to settlement attacks. The amount of food + water and the attack strength is also capped at 100, so the maximum attack strength is 50-100 (100 +/-50% = 50-150, capped at 100). When the random numbers are added to the attack strength and defense strength, the total attack value is capped at 150 but not the defense which can go up to 200. This means that high defense is more likely to win, but even when it's maxed out there is still a fair (30.6%, roughly 1/3) chance to lose to an attack on a "rich" settlement.