Combined analysis of unique and repetitive events in quantitative risk assessment.

HAL Id: hal-01484951

https://hal.archives-ouvertes.fr/hal-01484951

Submitted on 8 Mar 2017

HAL is a multi-disciplinary open access

archive for the deposit and dissemination of

sci-entific research documents, whether they are

pub-lished or not. The documents may come from

teaching and research institutions in France or

abroad, or from public or private research centers.

L’archive ouverte pluridisciplinaire HAL, est

destinée au dépôt et à la diffusion de documents

scientifiques de niveau recherche, publiés ou non,

émanant des établissements d’enseignement et de

recherche français ou étrangers, des laboratoires

publics ou privés.

Combined analysis of unique and repetitive events in

quantitative risk assessment.

Roger Flage, Didier Dubois, Terje Aven

To cite this version:

To link to this article : DOI :

10.1016/j.ijar.2015.12.008

URL :

http://dx.doi.org/10.1016/j.ijar.2015.12.008

To cite this version :

Flage, Roger and Dubois, Didier and Aven, Terje

Combined analysis of unique and repetitive events in quantitative risk

assessment. (2016) International Journal of Approximate Reasoning,

vol. 70. pp. 68-78. ISSN 0888-613X

O

pen

A

rchive

T

OULOUSE

A

rchive

O

uverte (

OATAO

)

OATAO is an open access repository that collects the work of Toulouse researchers and

makes it freely available over the web where possible.

This is an author-deposited version published in :

http://oatao.univ-toulouse.fr/

Eprints ID : 17135

Combined

analysis

of

unique

and

repetitive

events

in

quantitative

risk

assessment

R. Flage

a,∗

,

D. Dubois

b

,

T. Aven

a

a_{UniversityofStavanger,Norway} b_{IRIT–CNRSUniversitédeToulouse,France}

a b s t r a c t Keywords: Riskassessment Unique Repetitive Impreciseprobability Possibilitytheory

For riskassessment tobe a relevanttool inthe studyofany type ofsystem or activity, it needsto be based on a framework that allows for jointly analyzing bothunique and repetitive events. Separately, unique events may be handled by predictive probability assignments on the events, and repetitive events with unknown/uncertain frequencies aretypically handled by theprobability of frequency(or Bayesian) approach.Regardless of the nature of the events involved, there may be a problem with imprecision in the probability assignments. Several uncertainty representations with the interpretation of lower and upper probability have been developed for reflecting such imprecision. In particular,severalmethodsexistforjointlypropagatingpreciseandimpreciseprobabilistic input in the probability of frequency setting. In the present position paper we outline a framework for the combined analysis of unique and repetitive events in quantitative risk assessment using both precise and imprecise probability. In particular, we extend anexistingmethodforjointlypropagatingprobabilistic andpossibilisticinputbyrelaxing theassumptionthatalleventsinvolved havefrequentistprobabilities;insteadweassume that frequentist probabilities may be introduced for some but not all events involved, i.e. some events are assumed to be uniqueand require predictive – possibly imprecise –probabilistic assignments, i.e. subjective probability assignments on the uniqueevents without introducing underlying frequentist probabilities for these. A numerical example related to environmental risk assessment of the drilling of an oil well is included to illustratetheapplicationoftheresultingmethod.

1. Introduction

TheKaplanand Garrick[30]approachfordescribingriskhas forseveraldecades servedasacornerstonetothefieldof quantitative engineering risk assessment.According to thisapproach, risk is equalto and expressed bythe set of triplets consisting of (accident) scenarios, the likelihoods λ of these scenarios and their consequences. Three likelihood settings are mentioned by Kaplan [29]: repetitive situation with known frequency (λ= f , where f is a frequentist probability), unique situation (λ=p,where p is asubjective probability),and repetitivesituation with unknown frequency(λ=H(f), where H isasubjectiveprobability distributionon theunitinterval offrequencies).Thelast mentionedsetting istypically

*

Corresponding author at: Department of Industrial Economics, Risk Management and Planning, Faculty of Science and Technology, University of Stavanger,4036Stavanger,Norway.Tel.:+4751831908.

dealt withusingtheso-called probabilityoffrequencyapproach,whereinknowledgeaboutallpotentiallyoccurringevents involved is assumedtoberepresentedbyuncertainfrequentistprobabilitiesofoccurrence, andtheepistemic uncertainties about the true values of the frequentist probabilities are described using subjective (also referred to as judgmental or knowledge-based)probabilities.Ofcourse,thefirstcaseaboveisaspecial caseofthethird.

A repetitive event is an event whose occurrence or not can be embedded into a hypothetically infinite sequence of similarsituations (technically:anexchangeablesequence),whereasauniqueevent cannotbecausesuchasequencecannot reasonably be envisaged.As an example ofarepeatable event, consider thetossingof adie. Wecan envisagetossing the die over and over again under similar conditions, thus generating a limiting frequency of the event that the die shows ‘1’ (say). On the other hand, asan example ofa uniqueevent, consider thecase ofa particular electionfor choosing the president of a country. We cannot reasonably envisage a hypothetically infinite number of repetitions of this particular election, because among other issues, candidates are not all the same from one election to the other. Hence, we cannot introduce a frequentist probability of some candidate winning, but we rather just directly assign a predictive subjective probability of thisevent. Determiningwhether to treatanevent as repeatable orunique isoften a judgementcall bythe analyst;werefertoSection7foradiscussionofthisissue.

As another example, consider an oil and gas company performing an environmental risk assessment of the activity drilling awildcatoil well.If thereisoil atthedrillinglocation,somemight beinclinedtoargue thata numberoffactors (suchasthephysicalcharacteristics ofthereservoir,e.g.thereservoirpressure ataparticularpointinspaceand time;and the performance of technical barrier systems, e.g. whether a particular barrier element functions on demand) come into play to generate a frequentist probability of an oil spill due to a blowout or well-leak (since the reservoir pressure at a particularpointinspacechangesovertime,andthebarrierelementisnotperfectlyreliable).Ontheotherhand,ifthereis no oil present inthereservoir, thefrequentistprobability ofablowoutofoil iszero. Oilor nooil isa fixedbut unknown state oftheworld–itisnot subjecttorandomness.The situationcannot berepeated suchthat insomecasesthereisoil inthisparticularreservoir,whileinothersthereisnot.

Asafinalexample,totheextentthat ProbabilisticRiskAssessment(PRA)issuitableforterrorismrisk,aterroristattack isalsoauniqueevent. Itishowevernotafixedbutas-yet-unrevealedevent, likepresenceofoilintheenvironmentalrisk assessmentexample.Yetarelativefrequentistprobabilityofaterrorist attackcannotbemeaningfullydefined[7].

The quantitative risk assessment setting can be formally summarized as follows: We are interested in a quantity Z

(possibly a vector) and introduce amodel g(X) with input quantities X= (X1,X2,. . . ,Xn) to predict Z .The quantities Z

and X couldbethetotal numberand avectorofthenumberoffatalities due todifferent accidentscenarios,respectively. Alternatively, for a particular explosion accident scenario, Z and X could be the explosion pressure and a set of factors (quantities) affecting the explosion pressure, respectively. Or Z could be an indicator quantity for some overall event of interest, e.g.blowoutinanoffshoreQuantitativeRiskAssessment (QRA)setting ormeltdowninanuclearQRA/PRAsetting, and X couldbeaset ofindicatorquantitiesfor eventsthat, throughvariouscombinations,could leadtotheoccurrence of theoverallevent,respectively.

In the present paper we focus on the last setting. Hence, for our purpose Z and X are 0–1-valued unknown

quan-tities where Z equals 1 if some high level event A takes place and 0 otherwise, i.e. Z = I(A). Corresponding to

X= (X1,X2,. . . ,Xn) are the lower level events B= (B1,B2,. . . ,Bn), in the sense that Xi=I(Bi), i=1,2,. . . ,n, where I is theindicator functionequalto1if itsargumentistrue and0otherwise. Thisis asettingcommonly dealt withusing basicriskanalysismodelssuchasfaulttrees(comprisingtopeventsandbasicevents)andeventtrees(comprisinginitiating events, branchingeventsandendevents).

Intheprobabilityoffrequencyapproachone wouldbydefaultintroduceafrequentistprobability f oftheevent A,and a set offrequentistprobabilities q= (q1,q2,. . . ,qn) ofthebasic events B accordingto thestructure ofanevent model g.

A frequentistprobabilityexpressesthefractionoftimestheeventofinterestoccurswhenrepeatingthesituationconsidered overandoveragaininfinitely.Thesettingthenyields f=g(q),andbyestablishingasubjectiveprobabilitydistributionover thevectorq andpropagatingitthroughthemodel g,aprobabilitydistributionofthefrequencyprobability f isestablished. Particular attention mightthenbeputon theexpected value of f ,which isassumed tobe alsothepredictive probability of A,i.e. E[f]=P(A).

Inthepresentpaper,followingKaplanandGarrick[30],werelaxtheassumption thatfrequentistprobabilitiesof occur-rence can bedefined forall eventsinvolved. Insteadwe consider asetting where frequentist probabilitiescan bedefined for some but notallevents involved –someevents areassumed to beuniqueand theiruncertainty canonly beassessed usingpredictivesubjectiveprobabilityassignments,ormoregenerally,aswillbeargued,asimpreciseprobabilities.

Themaincontributionofthepresentpaperistheformulationofaset-upforthecombinedanalysisofuniqueand repet-itive eventsinquantitativerisk assessmentthat extendstheKaplanand Garrick[30]methodologytoasettingallowingfor imprecise probabilities,that either represent epistemic uncertaintyon frequentist probabilities,orrepresent expert uncer-taintyconcerninguniqueevents.Theimpreciseprobabilityapproachhasbeenarguedtobeamorefaithfulrepresentationof partial informationthan uniquedistributions.As aparticularcase,thepaperdescribes theextension, tothejointpresence of unique and repetitive events, of an existing method for jointly propagating probabilistic and possibilistic inputs to be applicablein suchasetting. Sothispaper contributestoabetter understandingofhow toarticulate thejoint presenceof aleatoryand epistemicuncertaintyinriskassessment.

Table 1

Frameworksandmethodsforthestudyofdifferenttypesofeventsusingdifferenttypesofprobability. Events

Repeatable Unique Repeatable and unique Subjective probabilities Precise Bayesian framework

Imprecise Hybrid methods Interval analysis Present paper method

both repeatable and uniqueevents, as wellas to theircombination. Imprecise probability methods canalso handle these settings:Unique eventprobabilitiesarehandledbyinterval analysis(e.g.Moore[38])when(someof)theprobabilitiesare imprecise. Effortshave been made to develop hybrid methodsfor handling repeatable events usingprecise and imprecise probabilitiesjointly(e.g.[13,25,12,37]).Thepresentpaperextendstheseeffortsbyaddressingthesettingofbothrepeatable and uniqueevents.

The remainder of this paper is organized as follows. In Section 2, we introduce and discuss the notion of subjective probability.InSection 3, weformalizetheset-upfor combinedanalysisofuniqueandrepetitiveeventsusingtheBayesian framework,andinSection4,weextendtheset-uptothecaseofimpreciseprobabilities.InSection5andSection6,a hybrid probabilisticandpossibilisticmethodispresentedandapplied,respectively.Itcanbeviewed asaspecial caseoftheset-up described inSection 4.In Section 7, we discussthe findingsofthe paper,and Section 8gives asummary and some final remarks.

2. SubjectiveprobabilitiesandtheKaplan–Garricksettingrevisited

Thereexist differentinterpretationsofasubjectiveprobability,seee.g.[6]for arecent overviewofprobability interpre-tationsinariskandsafetysetting.Hereweconsidertwocommoninterpretations:Asubjectiveprobability P(A)interpreted with reference to astandard isthe numbersuch that theuncertainty about theoccurrence of A is considered equivalent with the uncertainty about the occurrence ofsome standardevent, e.g. drawing,at random, a red ball from an urn that contains P(A)×100% redballs([30,32,33],seealso[10]).Alternativelythesubjectiveprobability P(A)canbeinterpretedas theamountofmoneythattheassignerwouldbewillingtobetifhe/shewouldreceiveasingleunitofpaymentiftheevent

A weretooccur,and nothingotherwise. Theagentmustalsoaccepttheoppositebet,exchangingroles betweenbuyerand seller. Hencethe probabilityof anevent bythisinterpretation is the(fair)price atwhich theassigner isneutral between buyingandselling aticketthatisworthoneunitofpaymentiftheeventoccurs,andworthnothingifnot[42].Thisisthe viewadvocated alreadyinthe1930’sbyDeFinetti[15].

Which interpretation to use is a debated topic; see [28,29,41,2,6,18]. This discussion is however beyond thescope of the present paper and will not be addressedin the following.What is important here isthat boththe “random drawing from anurn”analogyandthebetting viewforcetheassigner/analysttoprovideuniqueprobabilitiesfordescribinghis/her state of beliefs. Subjective probabilitiesare based on an axiom assuming that precisemeasurements of uncertainties can be made;seee.g. [10, p.31]. However,many researchers havequestioned thisassumptionof and requirementfor precise measurementsofuncertainties(e.g.[16,40,44];seealso[23,22]).Inmanysituations,thebasisforassigningtheprobabilities could beweak. A specific number can beassigned, but the rationalefor it can be questioned– strong assumptions may beneeded tojustifyaconcretenumber. Theassignedprobabilityisprecise,but suchaprecisionmaybeconsideredrather arbitrary.One may,for example, subjectivelyassess that twodifferent situationshave probabilitiesequalto0.7 say,but in onecasetheassignmentissupportedbyasubstantialamountofrelevantdata,whereas,intheother,byeffectivelynodata at all.Thestrength ofknowledge, theprobabilitiesarebasedon, isnot atallreflectedbytheassigned number(Avenand Zio[8]).

Theseconsiderations haveledto theuseofalternative approachesand methods forrepresenting theuncertainties [22, 18]. Here our focus is on interval probabilities or, more generally, imprecise probabilities. Imprecise probability theory generalizes probabilitybyusinganinterval [P(A),P(A)]torepresentuncertaintyabout anevent A,withlower probability

P(A)and upperprobability P(A)=1−P(A),where0≤P(A)≤P(A)≤1 and A is thecomplementofset A.

Inlinewiththeuncertaintystandardinterpretationofasubjectiveprobability[33]weinterpretanimprecisioninterval, say [0.2,0.5] for the event A, asfollows: The analyststates that his/her assigned degreeof beliefis greaterthan the urn chance of0.20(thedegreeofbeliefofdrawing oneparticular balloutofanurn comprising5balls) andless than theurn chance of0.5. Theanalyst isnotwilling tomake anyfurther judgments.Then theinterval [0.2,0.5] canbeconsidered an imprecision interval for the hypothetical urn probability P(A). In contrast, following Walley’s betting interpretation [44], thelower probabilityisinterpretedasthemaximumprice forwhich onewouldbewillingtobuyabet whichpays1if A

occurs, and0if notand theupperprobabilityastheminimumpricefor whichonewould bewillingto sell thesamebet. Inthiscase,thelower bound0.2isdirectlyinterpretedasthedegreeofbeliefin A,thedegreeofbeliefofitscomplement being 0.5.Iftheupperand lowerprobabilitiesareequal,weareledtopreciseprobabilitiesàlaDeFinetti.

Theuseofimprecisionintervalsisadebatedtopicalsointheappliedprobabilityliterature;seeforexampleLindley[33]

probability.” The above discussion emphasizing theemergence ofgeneralizations of subjective probability and theuse of intervals fordescribingincompleteinformationmakeKaplanand Garrick’semphaticstatementontheexclusivepositionof probabilitytheoryinbeliefrepresentationindeed debatable.However,weleavethisdiscussion here.

Forthepurposeofthepresentworkwesimply assumethattheanalystseitheraccepttheprecisesubjectivestance(the Bayesian approach), or adopt an approach basedon impreciseprobabilities. The former approachis a special case of the latter,butwechoosetotreattheseapproachesseparatelyastheyarebasedondifferentideasanditiseasiertounderstand the general case byfirst castingthe analysiswithin the simplerBayesianframework. For anextension of theKaplan and Garrick risk perspective, which allowsfor alternativeways of representing uncertainties, includingimpreciseprobabilities, seeAven[3].

3. CombinedanalysisofuniqueandrepetitiveeventsusingtheBayesianframework

InthissectionwepresentaformoftheKaplan–Garrickset-upforthecombinedanalysisofuniqueandrepetitiveevents according to a Bayesianapproach. We do so first for a setting involvingtwo events, before introducing the moregeneral setting involvinga complex combination of events. The set-up is based on precise probabilities inthis section. Imprecise probabilitiesareconsideredinSection4.

3.1. Two-eventcase

Let A denote an event whose occurrence depends on the outcome of a unique event U and of a repeatable event R

in sucha waythat A occurs if both U and R occur. Furthermore, define X=I(U) and Y =I(R), where I is theindicator functionwhichequals1ifitsargumentistrueand 0otherwise.Thenwehave

I

(

A

) =

X Y

.

Supposethatanexpertsuppliesasubjectiveprobability p forU ,i.e. p=P(U)=P(X=1)andknowstheprecisefrequentist probability f of R,i.e. f =F(R)=F(Y =1);here P isasubjectiveprobabilitymeasureand F afrequentistone.Toproceed werelyonthefollowingtwoprinciples:

1. Acomplex event made upof alogical combination ofrepeatable and non-repeatable events isnon-repeatable (as we areinterestedintheparticularoccurrenceof R takingplacealongwiththeuniqueoccurrenceofU ).

2. Thesubjectiveprobabilityoftheoccurrenceofarepeatable eventshouldbemeasuredbyitsrealfrequencyifthelatter isknown (theHackingfrequencyprinciple[26]).

Based on the above principles and assuming independence between U and R, we can consider p f as the subjective

probabilityof A.Toseethis,notethat

P

(

A

) =

E

[

X Y

] =

P

(

X Y

=

1

) =

P

(

U

∩

R

) =

P

(

U

|

R

)

P

(

R

) =

P

(

U

)

F

(

R

) =

p f

.

Inthiscalculation,thesubjectiveprobability P(R)ismeasuredbymeansofthefrequencyofoccurrenceof R, F(R),during theuniqueexperimentwhere U isobservedornot.Thisinterpretationisimplicitwhenwecomputetheproduct p f .

Actually the probability P(A) should be written P(A| f) as f is assumed known. If this assumption is dropped, we obtain theunconditionalprobabilityoftheevent A:

P

(

A

) =

Z

P

(

A

|

f

)

dH

(

f

) =

Z

p f dH

(

f

) =

p

·

E

(

f

),

(1)

where H is asubjectiveprobabilitydistributionof f and E(f)isitsmeanvalue.

3.2. Complexcombinationofevents

More generally, let A denote an event whose occurrence depends on the outcome of n unique events U =

(U1,U2,. . . ,Un) and m repetitive events R= (R1,R2,. . . ,Rm) through a function g. For example, A could be the top

event and (U,R) thebasic events of afault tree.Or A could beanend event and (U,R) the initiatingevent and barrier failureeventsofaneventtree.Defineavectorofunknown quantities X= (X1,X2,. . . ,Xn)andavectorofrandom quantities Y= (Y1,Y2,. . . ,Ym),and letXi=I(Ui),i=1,2,. . . ,n,and Yi=I(Ri), j=1,2,. . . ,m.Thenwehave

I

(

A

) =

g

(

X

,

Y

).

Let p= (p1,p2,. . . ,pn) bethesubjectiveprobabilitiesoftheuniqueevents U ,andlet H(f) denotethesubjective

probabil-ity distributionof f ,where weextendthedefinitionof f from nowon tobeavector f = (f1,f2,. . . ,fm) and fi=F(Ri)

is the frequentist probability of theevent Ri. We assume that theanalysts’ uncertainties about f are not dependent on

P

(

A

) =

E

£

E

£

g

(

X

,

Y

) |

f

¤¤ =

Z

Ω E

£

g

(

X

,

f

)

¤

dH

(

f

) =

Z

Ω

X

x g

(

x

,

f

)

p

(

x

)

dH

(

f

)

=

X

x p

(

x

)

Z

Ω g

(

x

,

f

)

dH

(

f

) =

X

x p

(

x

)

E

£

g

(

x

,

f

)¤.

Moreoverthesubjectiveprobability p(x)isoftheformQ

i:xi=1pi·

Q

i:xi=O(1−pi),whichsincexi isBooleancanbewritten

Q

i=1,...,n(xipi+ (1−xi)(1−pi)).

4. Combinedanalysisofuniqueandrepetitiveeventsusingimpreciseprobabilities

We now extend the set-up presented in Section 3 from a precise probability framework to an imprecise probability framework.Theobjectiveistoestablishaninterval[P(A),P(A)],with P(A)≤P(A).Thisintervalrepresents,inthepresence ofuniqueevents,thedegreeofbeliefin A fortheexpert,and, byduality,thedegreeofbeliefinitscomplement (A).Total ignorance isobtainedif bothdegreesofbeliefare0.

4.1. Two-eventcase

ConsiderthesettingintroducedinSection 2.1involvingtwoevents,andfirstassumingthattheprecisefrequentist prob-ability f isknown and that p=P(U) and p=P(U) arelowerand upperprobabilitiesoftheuniqueeventU ,respectively. Notethat, underWalley’sgamble-basedapproach,thesubjectiveinterval[p,p]representstheanalyst’sstateofbeliefabout

U anddoesnotcontain a“truesubjectiveprobability”thatwould representtheanalyst’sopinion inanaccurateway[44]. Thesameholdsfortheotherinterpretationdescribed inSection2,wheretheanalyst’suncertaintyaboutU iscomparedto that relatedtoastandardevent.

In the simple case oftwo events, assuming independence, we just have to multiply thesubjective probability bounds and thefrequentistprobabilitytoobtain

£

P

(

A

),

P

(

A

)¤ = [

p

·

f

,

p

·

f

].

Inthecasethatthefrequentistprobability f isunknown,stillassumingindependencebetweenU and R andnowalsothat theprobabilityofU isnotaffectedbyknowingornotknowingthevalueof f ,weobtain

£

P

(

A

),

P

(

A

)¤ = [

p

_·

f

,

p

_·

f

].

where f =E[f]and f =E[f],derivedfromtheloweranduppercumulativedistributionfunctionson f ,respectively.

4.2. Complexcombinationofevents

Based onanimpreciseprobability representationoftheuncertainindividualelements ofthevectors f and X wewant to establishboundson P(A). Weassume independenceeverywhere, i.e.betweentheelementsof X ,betweentheelements of Y and between X and Y . The subjective probability p(x) is then on the format P(X1=x1)P(X2=x2). . .P(Xn=xn), xi∈ {0,1}, i=1,2,. . . ,n, which can be evaluated using interval analysis Moore [38]. It is assumed that the subjective

assessmentof P(Xi=xi)isspecifiedbyaprobabilityinterval[pipi].

In the most general case, the imprecise knowledge about the frequencies f is represented by a credal set, that is, a convex set of probabilities F. For specified values x of X the function g(X,f) is a product of the individual elements of f and hencestraightforward to evaluate. Instead ofintegrating g(x,f) interms of H(f) we may consider directlythe integral E[g(x,f)]defined attheendofSection3(integratedover f ):By obtainingbounds on P(g(x,f)≥

α

) wecanuse thewell-knownresultthatforanon-negativeunknownquantity W itsexpected valueisgiven by(e.g.[39])

E

[

W

] =

Z

P

(

W

≥

w

)

dw

,

so thatletting P

¡

g

(

x

,

f

) ≥

α

¢ =

inf

©

P

¡

g

(

x

,

f

) ≥

α

¢ :

P

∈

F

ª,

and P

¡

g

(

x

,

f

) ≥

α

¢ =

sup

©

P

¡

g

(

x

,

f

) ≥

α

¢ :

P

∈

F

ª

wecancomputethebounds

and E

£

g

(

x

,

f

)¤ =

1

Z

0 P

¡

g

(

x

,

f

) ≥

α

¢

d

α

.

(3)

Insomecases(whenthelowerprobabilityis2-monotone,orisabelieffunction)wehaveequalities:

E

£

g

(

x

,

f

)¤ =

inf P∈FE

¡

g

(

f

,

x

)¢;

E

£

g

(

x

,

f

)¤ =

sup P∈F E

¡

g

(

f

,

x

)

¢

and thesequantitiesareChoquetintegrals.

Next,wecancomputeupperand lowerprobabilitiesusingintervaloptimizationtechniques[38,35]:

P

(

A

) =

inf

½

X

x E

£

g

(

x

,

f

)

¤

Y

i=1,...,n

¡

xipi

+ (

1

−

xi

)(

1

−

pi

)¢ :

pk

∈ [

pkpk

],

k

=

1

, . . . ,

n

¾

(4) and P

(

A

) =

sup

½

X

x E

£

g

(

x

,

f

)

¤

Y

i=1,...,n

¡

xipi

+ (

1

−

xi

)(

1

−

pi

)¢ :

pk

∈ [

pkpk

],

k

=

1

, . . . ,

n

¾

(5) wherethesumisover x suchthat g(x,f)>0.Notethattheseexpressionsaregenerallynoteasytocompute,becausetheir monotonic behavior intermsofprobabilities pk isnoteasytoguess. Generally,weknowthat theoptimumisattainedfor

one of the bounds of [pkpk] but in the worst case, we must tryall of them, which is of exponential complexity in the

number n of non-repeatable events. See Jacob et al. [27] for detailedcalculations and an algorithm for the computation of such kinds of intervals. Strangely enough, there is almost no older literature on interval calculations with imprecise probabilitiesonBooleanexpressions,stemminge.g.,fromfaulttrees.

5. Hybridprobabilisticandpossibilisticapproach

Likeimpreciseprobabilitytheory,possibilitytheorydiffersfromprobabilitytheory(whereasingleprobabilitymeasureis used)inthatitusesapairofdualset-functions,herecalledpossibilityandnecessitymeasures,torepresentuncertainty.The possibilityfunction

π

isthebasicbuildingblockofpossibilitytheoryandforeachs inaset S,

π

(s)expressesthedegreeof possibility ofs beingthetruevalueofsomeunknownquantity X .When

π

(s)=0 forsome s,theoutcomes isconsidered impossible, whereaswhen

π

(s)=1 forsome s,theoutcome s ispossible,i.e.isjust unsurprising,normal,usual[17].This is a much weaker statement than a probability equal to 1. As one of the elements of S is the true value, it is assumed that

π

(s)=1 for at least one s. Possibility distributions on numerical spaces often takethe form of fuzzy intervals [19], namely,

π

is an upper semi-continuous mapping from the reals to the unit interval such that V_α= {v:

π

(v)≥

α

} is a closedintervalforall0<

α

≤1.Hence,possibilitytheoryisasuitablerepresentationofuncertaintyinsituationswherethe availableinformationtakestheformofnestedsubsetswithvariousconfidencelevels.Twosetsarenestedifoneofthesets isasubsetoftheother and,byextension, setsinasequencearenestedifeachsubsequentsetiscontainedinthenext.

The possibility function

π

induces a pair of necessity/possibility measures [N,5], and the possibility of an event A,

5(A),isdefined by

5(

A

) =

sup

s∈A

π

(

s

),

(6)

and theassociatednecessitymeasure,N(A),by

N

(

A

) =

1

− 5(

A

) =

inf

s∈/A

¡

1

−

π

(

s

)¢.

(7)

Then eachcut V_α ofa continuous fuzzy intervalcan viewed asaninterval containing thequantityofinterest with confi-dencelevel N(V_α)≥1−

α

.

Let P(

π

) bethe familyof probability measures suchthat for allevents A, N(A)≤P(A)≤ 5(A). It isknown [20] that

P(

π

)= {P:P(Vα)≥1−

α

, 0<

α

≤1}.Then it can beproved that set functions N and 5 are coherent lower and upper previsionsinthesense ofWalley[44],namely[14]:

N

(

A

) =

inf

P∈P(π)P

(

A

)

and

5(

A

) =

_Psup_∈P(π)P

(

A

).

Whenuncertaintyabout f isdescribedusingpossibilitytheory,theextensionprinciple(e.g.[46])canbeusedtogenerate apossibilitydistribution

π

g for g(x,f) forspecifiedvaluesofx.Ittakes thefollowingform[19]:

π

g

(

z

) = 5

¡©

f

:

g

(

x

,

f

) =

z

ª¢ =

sup f:g(x,f)=z

min

¡

π

1

(

f1

), . . . ,

π

m

(

fm

)

¢

Thiscomputationcomesdowntoperformingintervalcomputationson

α

-cutsViα ofpossibilitydistributions

π

i,whichyield

the

α

-cuts of

π

g.Fromaprobabilisticpointofview,thechoiceofasinglethreshold

α

foralldistributions

π

i presupposes

completedependencybetweenthepossibilitydistributions,whichcorrespondstothesamelevelofconfidenceforallinputs, used byasingleexpert.Alternatively,one maychoosevariousthresholds forcuttingthe

π

i, andcombine intervalanalysis

with Monte-Carlomethods, thus obtaining arandom set for g(x,f). Thismakes sense if the

π

i’s comefromindependent

sources. The results of applying theextension principlesare not directly comparablewith the results of treatingthe

π

i’s

as independent random sets. See Dubois and Prade [21] for the relation between fuzzy and random set arithmetics,and Baudrit etal.[12,11]for thetheoreticalfoundationsand implementationof ahybridpossibilistic–probabilistic propagation methodusingintervalanalysisand Monte-Carlomethods.

Thenboundsoftheform N(g(x,f)≥

α

)≤P(g(x,f)≥

α

)≤ 5(g(x,f)≥

α

)canbegenerated,fromwhichboundsonthe integral E[g(x,f)] canbeobtainedusing(2)and(3)as[11]:

E

£

g

(

x

,

f

)¤ =

1

Z

0 N

¡

g

(

x

,

f

) ≥

α

¢

d

α

=

inf P∈P(πg) E

¡

g

(

f

,

x

)¢,

(8) and E

£

g

(

x

,

f

)¤ =

1

Z

0

5

¡

g

(

x

,

f

) ≥

α

¢

d

α

=

sup P∈P(πg) E

¡

g

(

f

,

x

)¢.

(9)

Inthenextsectionweprovideanumericalexample oftheproceduredescribedabove.

6. Numericalexample

Wenowreturntotheoil-drilling exampleintroducedinSection 1,anddefinethefollowingevents:

A=Blowout

U1=Oil atdrillinglocation

U2=Well kickbarrierfailuretypeI

R1=Well kick

R2=Well kickbarrierfailuretypeII

Weassumethat ablowoutwilloccur underthecombinedcircumstancesthat thereisoilatthedrillinglocation,awell kick occurs during the drilling, and either one or both of the barriers in place to avoid that a well kickdevelops into a blowoutfails,i.e., A=U1∩R1∩ (U2∪R2).Accordingtoprinciple(1)describedinSection3.1,theevent A isauniqueevent

(being madeupofalogicalcombinationofrepeatableandnon-repeatableevents).Thenwehave

I

(

A

) =

g

(

X

,

Y

) =

X1Y1

¡

1

− (

1

−

X2

)(

1

−

Y2

)¢ =

X1

(

1

−

X2

)

Y1Y2

+

X1X2Y1

(decomposing intodisjointevents)andconsequently

g

(

x

,

f

) =

x1f1

¡

1

− (

1

−

x2

)(

1

−

f2

)¢ =

x1

(

1

−

x2

)

f1f2

+

x1x2f1

,

so that g

¡(

1

,

1

),

f

¢ =

f1

,

g

¡(

0

,

1

),

f

¢ =

0

,

g

¡(

1

,

0

),

f

¢ =

f1f2

,

g

¡(

0

,

0

),

f

¢ =

0

Regarding dependence between the set of events (U1,U2,R1,R2), clearly P(U1|U2,R1,R2)= P(U1) and P(R1|R2,U2)=

P(R1), since U1 and R1 occur before the conditional events in these probabilities. Also, clearly P(U2|U1,R1,R2) =

P(U2|R1,R2) and P(R2|U1,U2,R1)=P(R2|U2,R1), since theoccurrence of R1 makes U1 superfluous. However, we may

notalwayshave P(U2|R1,R2)=P(U2)and P(R2|R1,U2)=P(R2),sincetheprobabilityofabarrierfailuremaydifferduring

Fig. 1. Possibility distributions of f1(top), f2(middle) and f1f2(bottom).

Fig. 2. Cumulative (top)andcomplementarycumulative(bottom)NecessityandPossibilitydistributions of f1f2.(Forinterpretationof thereferencesto colorinthisfigure,thereaderisreferredtothewebversionofthisarticle.)

failure having occurred. Nevertheless,we assume independence here asa simplification judged asreasonable. Finally, we have P(R1)=P(R1|U1)P(U1)+P(R1|not U1)P(not U1)= f1p1+0(1−p1)= f1p1.Usingpreciseprobabilitiesweobtain

P

(

A

) =

X

x

p

(

x

)

E

£

g

(

x

,

f

)¤ =

p1p2E

[

f1

] +

p1

(

1

−

p2

)

E

[

f1f2

],

Notethatthesystem g isamonotonesystemwithrespecttoitsarguments,buttheparameters(p1,p2,E[f1],E[f1f2])that

we obtain through the analysis are not directly those of elementary events, namely (p1,p2,E[f1],E[f2]). It is, however,

easyto checkthat inthisparticularcase P(A) isincreasingwith E[f1]and E[f1f2](as patentintheexpressionabove)as

wellaswith p1 and p2.Indeed, P(A)alsoreads p1(p2(E[f1]−E[f1f2])+E[f1f2]),and E[f1]≥E[f1f2].Sotheupperand

lower probabilitiesof A areobtainedas

P

(

A

) =

p

1p2E

[

f1

] +

p1

(

1

−

p2

)

E

[

f1f2

],

P

(

A

) =

p1p2E

[

f1

] +

p1

(

1

−

p2

)

E

[

f1f2

].

Note that themonotonicity of thefunction g is notalways guaranteed. It wouldnot hold if the Boolean expressionof A

contains an elementary event and its negation(for example an exclusive OR). In that case the computation ofthe upper and lower probabilities can betricky (it may become exponential in complexity with the number of variables, see[27]). This phenomenonusually doesnot appear infault-treeswherethetop event isjust adisjunctionofconjunctionsand the interval analysisisstraightforward.

Wenowassumethattheloweranduppervaluesof p1and p2are[p₁,p1]= [0.4,0.6]and[p₂,p2]= [0.01,0.2],

respec-tively. Furthermore, we assume that the rangeand core values ofthe possibility distributions

π

(f1) and

π

(f2) are given

by the triplets (0.1,0.2,0.3) and (0.2,0.5,0.7), respectively. These possibility distributions are shown in Fig. 1, together with the possibility distribution

π

(f1f2) resulting from the combination of

π

(f1) and

π

(f2). The distribution

π

(f1f2)

was calculated byapplication oftheextension principle,whichis equivalenttoperforming intervalanalysis onthe

α

-cuts

V_α= [v_α,v_α]= {v:

π

(v)≥

α

}, asalready explained. The interpretation of thepossibility distributions inFig. 1 is as fol-lows: Theprobability that thequantity inquestion, say f1, belongsto Vα is P(f1∈Vα)≥1−

α

. For example, lookingat thetopdistributionofFig. 1,weseethatthereisa50%orgreaterprobabilitythat f1belongstotheinterval [0.15,0.25].

The cumulative and complementary cumulative possibility and necessitydistributions of f1f2 inducedby

π

(f1f2) are

approximately 0.6 (cf. theleft/greencumulative possibility distribution);and theprobability P(f1f2≤0.15) isseen tobe

less than1andgreaterthanapproximately0.5(cf. theright/redcumulativenecessitydistribution).

Use ofEquations(8) and (9)yields [E[f1],E[f1]]= [0.15,0.25] and [E[f1f2],E[f1f2]]= [0.055,0.15],and sofinallyby

means ofEquations (4)and(5)weobtain

£

P

(

A

),

P

(

A

)¤ = [

0

.

02038

,

0

.

102

].

Hence,theimprecisesubjectiveprobabilityofablow-outisapproximately[0.02,0.1],which,undertheuncertaintystandard interpretation, can be interpreted to mean that the degree of belief in a blowout is greater than that of drawing one particular ball outofan urncontaining 50balls, and less than that ofdrawing oneparticular ball fromanurn containing 10 balls; cf. Section 2. Alternatively, in the Walley spirit,the degree of belief in a blow-out is very small (0.02) and the degreeofbeliefintheabsenceofblow-outisverylarge(0.9).

7. Discussion

Theframeworkdescribedinthepresentpaperisbasedonadistinctionbetweenuniqueandrepetitiveevents,i.e.events areassumedtobeofonekindortheother.Decidingwhenthesituationisrepetitive,respectivelyunique–orrather decid-ingwhicheventstomodelasrepetitiveandwhichonestotreatasunique–ishowevernotnecessarilystraightforward.The question ofwhen to introduceprobability modelsand frequentist probabilities(chances) insteadofusing predictive prob-ability assignmentsisaddressed byAven[4](see also [5]),whoarguesthat introducingfrequentistprobabilities(chances) should only bedone whenthequantities of interestare frequentistprobabilitiesand/or when systematicinformation up-dating isimportanttomeettheaimoftheanalysis.

Whento usepreciseandimpreciseprobabilityisalsonotnecessarilyobvious.As discussedbyFlage[24](seealsoAven etal.[9]),arecurringargumentappearstobethatprobabilityisanappropriaterepresentationofuncertaintyonlyifalarge enough amount ofdatais availableto baseit on. However,it isnot obvioushow tomake suchaprescription operational ([24],p. 33):‘Considertherepresentation ofuncertaintyabout theparameter (s)ofa probabilitymodel. Ifa largeenough amount of dataexists, there wouldbeno uncertainty about theparameter (s) and hence no needfor arepresentation of such uncertainty. When isthereenough data tojustify probability,but not enoughto accuratelyspecify thetrue value of the parameter inquestion and, thus, makeprobability,as anepistemic concept, superfluous?[. . .]Also, dependingon the relevance oftheavailableobservations,different[amountsofdata]couldbejudged assufficientindifferentsituations.’

The latter point was also made by one of the reviewers of the present paper. He/She stated that reducing the issue to a question of sample size misses much of the discussion on this topic, and points out that (we allow ourselves to cite the referee comments) ‘In fact, the nature of the data is also quite important. For instance, imprecise methods are particularlyusefulwhen theplus-or-minusranges for datavaluesarenon-negligible,whenthereis statisticalcensoringor missingdata,orwhenthereisstructuraluncertaintyabout shapesofdistributions,theirdependencies,orthecorrect form of the expression or model being evaluated.’ Nevertheless, under some assumption such as unimodal distributions, it is possibletoderiveapossibilitydistributionfromasingleobservation(assumingthelatteristhemode),usingaprobabilistic inequality[36].

AsstatedinSection3,werelyontwoprinciplesrelatedtotheeventsandprobabilitiesinvolved,thatleadustoconsider non-repeatableanycomplexeventsinvolvingatleastanon-repeatableone,andtoadmitthat thefrequencyofarepeatable event isused asthesubjectiveprobabilityofanyofitsoccurrence.

The first principle is self-evident, since the complex event occurs if and only if the non-repeatable events occur.The second principle is well-known in Bayesian statistics, where the probability of an event in an exchangeable sequence of random quantities istaken asequalto thelimitingfrequency (sometimesreferredtoas achance(e.g. [43]) orpropensity (e.g.[34])ofthat eventinthesamesequence,i.e. P(A|p)=p,where p isthechanceof A.

ReturningtotheformalsettingintroducedinSection1,withthemodel g(X)usedtopredictaquantityofinterest Z ,the methods in thepresent paper only consider parameter uncertainty, i.e. uncertaintyabout X , and neglects model (output) uncertainty, i.e. uncertaintyabout the difference g(X)−Z .In thisvein,we mayconsider theuseof set-valuedmodels in ordertocopewithlackofknowledgeabout functiong.

8. Summaryandfinalremarks

Thispaperdevelops aframework forcombinedanalysisof uniqueand repetitiveeventsin quantitativerisk assessment usingbothpreciseandimpreciseprobability.Westartfromasubjectiveprobability(Bayesian)settinginvolvingoneeventof eachtype,andthengeneralize toasettinginvolvingacomplexcombinationofthetwotypesofeventswiththeirassociated uncertainty represented by a combination of subjective probability and imprecise probability. One way of representing imprecise probabilityis through possibilitytheory, and weextend anexisting method forjointly propagatingprobabilistic andpossibilisticinputtofitthedevelopedframework.Finally,anumericalexamplerelatedtoenvironmentalriskassessment ofthedrillingofanoilwellisincludedtoillustratetheapplication oftheproposedmethod.

that thedefined complexfunctionofuniqueand repetitiveevents isanuncertainquantityontheunitinterval, i.e.a non-negativeuncertainquantity,whichmeansthat wecanrelyonthewell-knownresultthattheexpectationofanon-negative uncertainquantityistheintegraloveritscomplementarycumulativedistributionfunction.

Thedescribedframeworkcanbeextendedandappliedinvariousways.Inthepresentpaperwehaveconsideredthecase of possibility theory as representation of uncertainty in terms oflower and upper probability.Other representations also existforthispurpose,forexamplethetheoryofbelieffunctions(alsoknownasevidence theoryorDempster–Shafertheory [40]) asanalternativetotheoriesof impreciseor intervalprobability[44,45]. Anexample whereincompleteknowledgeof frequencies ismodeledbybelieffunctionsonthefrequencyrange[0,1] insteadofpossibilitydistributionsisin[31].While belief functions are just special cases of lower probabilities corresponding to random sets, it turns out that on Boolean frames like {0,1}, they are mathematically equivalent. So it is tempting to represent a plain probability interval for a Boolean variable bya random set on {0,1}. On this basis, imprecise probabilitiesof final events of an event tree can be efficientlyobtained,andmoregeneralreliabilityanalysismethodscanbedevised[1].Theobtainedresultsdifferfromthose ofintervalanalysisbecausetheunderlying independenceanalysisarenotthesame.Thecomparisonofthetwoapproaches isworthstudyingfurther.

Furthermore,itisconceivabletoextendtheframeworktoincludefinitepopulations,i.e.thesettingbetweenuniqueand repetitiveevents.

Acknowledgements

ForR.FlageandT.AventheworkonthepaperhasbeenfundedbytheResearchCouncilofNorwaythroughtheResearch Centre forArctic Petroleum Exploration(ARCEx)(grantnumber228107) and thePETROMAKS2 programme(grantnumber grantnumber228335/E30).Thefinancialsupportisgratefullyacknowledged.

References

[1] F.Aguirre,S.Destercke,D.Dubois,M.Sallak,C.Jacob,Inclusion-exclusionprincipleforbelieffunctions,Int.J.Approx.Reason.55 (8)(2014)1708–1727. [2] T.Aven, Ontheneedforrestricting theprobabilisticanalysisinriskassessmentstovariability,RiskAnal. 30 (3)(2010)354–360,with discussion,

pp. 381–384.

[3] T.Aven,Ariskconceptapplicableforbothprobabilisticandnon-probabilisticperspectives,Saf.Sci.49(2011)1080–1086.

[4] T.Aven,Onwhentobaseeventtreesandfaulttreesonprobabilitymodelsandfrequentistprobabilitiesinquantitativeriskassessments,Int.J.Perform. Eng.8 (3)(2012)311–320.

[5] T.Aven,FoundationsofRiskAnalysis,Wiley,Chichester,2012.

[6] T.Aven,G.Reniers,Howtodefineandinterpretaprobabilityinariskandsafetysetting,Saf.Sci.51 (1)(2013)223–231.

[7] T.Aven,O.Renn,Theroleofquantitativeriskassessmentsforcharacterizingriskanduncertaintyanddelineatingappropriateriskmanagementoptions, withspecialemphasisonterrorismrisk,RiskAnal.29 (4)(2009)587–600.

[8] T.Aven,E.Zio,Someconsiderationsonthetreatmentofuncertaintiesinriskassessmentforpracticaldecisionmaking,Reliab.Eng.Syst.Saf.96 (1) (2011)64–74.

[9] T. Aven, P. Baraldi, R. Flage, E. Zio, Uncertaintyin risk assessment: therepresentation andtreatment of uncertainties byprobabilisticand non-probabilisticmethods,Wiley–Blackwell,Chichester.

[10] J.M.Bernardo,A.F.M.Smith,BayesianTheory,Wiley,Chichester,1994.

[11] C.Baudrit,I.Couso, D.Dubois,Jointpropagationofprobabilityandpossibilityinriskanalysis:towardsa formalframework,Int.J.Approx.Reason. 45 (1)(2007)82–105.

[12] C.Baudrit,D.Dubois,D.Guyonnet,Jointpropagationandexploitationofprobabilisticandpossibilisticinformationinriskassessment,IEEETrans.Fuzzy Syst.14 (5)(2006)593–608.

[13] J.A.Cooper,S.Ferson,L.Ginzburg,Hybridprocessingofstochasticandsubjectiveuncertaintydata,RiskAnal.16 (6)(1996)785–791. [14] G.DeCooman,D.Aeyels,Supremumpreservingupperprobabilities,Inf.Sci.118(1999)173–212.

[15] B.DeFinetti,Laprévision:sesloislogiques,sessourcessubjectives,Ann.Inst.HenriPoincaré7(1937)1–68. [16] A.P.Dempster,Upperandlowerprobabilitiesinducedbyamultivaluedmapping,Ann.Math.Stat.38(1967)325–339. [17] D.Dubois,Possibilitytheoryandstatisticalreasoning,Comput.Stat.DataAnal.51(2006)47–69.

[18] D.Dubois,Representation,propagationanddecisionissuesinriskanalysisunderincompleteprobabilisticinformation,RiskAnal.30(2010)361–368. [19] D.Dubois,E.Kerre,R.Mesiar,H.Prade,Fuzzyintervalanalysis,in:D.Dubois,H.Prade(Eds.),FundamentalsofFuzzySets,in:Handb.FuzzySetsSer.,

Kluwer,Boston,MA,2000,pp. 483–581.

[20] D.Dubois,L.Foulloy,G.Mauris,H.Prade,Probability-possibilitytransformations,triangularfuzzysets,andprobabilisticinequalities,Reliab.Comput. 10(2004)273–297.

[21] D.Dubois,H.Prade,Randomsetsandfuzzyintervalanalysis,FuzzySetsSyst.42 (1)(1991)87–101.

[22] D.Dubois,H.Prade,Formalrepresentationsofuncertainty,in:D.Bouyssou,D.Dubois,M.Pirlot,H.Prade(Eds.),Decision-MakingProcess–Concepts andMethods,ISTELondon&Wiley,2009,pp. 85–156,Chap. 3.

[23] D.Dubois,H.Prade,P.Smets,Representingpartialignorance,IEEETrans.Syst.ManCybern.26 (3)(1996)361–377.

[24] R.Flage,Contributionstothetreatmentofuncertaintyinriskassessmentandmanagement,PhDThesisUiSno.100,UniversityofStavanger,Norway, 2010.

[25] D.Guyonnet,B.Bourgine,D.Dubois,H.Fargier,B.Côme,J.P.Chilès,Hybridapproachforaddressinguncertaintyinriskassessments,J.Environ.Eng. 129(2003)68–78.

[26] I.Hacking,LogicofStatisticalInference,CambridgeUniversityPress,Cambridge,UK,1965.

[27] C.Jacob,D.Dubois,J.Cardoso,UncertaintyhandlinginquantitativeBDD-basedfault-treeanalysisbyintervalcomputation,in:S.Benferhat,J.Grant (Eds.),Int.Conf.onScalableUncertaintyManagement,SUM2011,Dayton,Ohio,in:Lect.NotesComput.Sci.,vol. 6929,Springer,2011,pp. 205–218. [28] S.Kaplan,Willtherealprobabilitypleasestandup?,Reliab.Eng.Syst.Saf.23 (4)(1988)285–292.

[29] S.Kaplan,Thewordsofriskanalysis,RiskAnal.17(1997)407–417.

[31] P.Limbourg,R.Savic,J.Petersen,H.-D.Kochs,FaulttreeanalysisinanearlydesignstageusingtheDempster-Shafertheoryofevidence,in:T. Aven, J.E. Vinnem(Eds.),Risk,ReliabilityandSocietalSafety,Taylor&FrancisGroup,London,2007,pp. 713–722.

[32] D.V.Lindley,Thephilosophyofstatistics,Statistician49 (3)(2000)293–337. [33] D.V.Lindley,UnderstandingUncertainty,Wiley,Hoboken,NJ,2006.

[34] D.V.Lindley,L.D.Phillips,InferenceforaBernoulliprocess(aBayesianview),Am.Stat.30 (3)(1976)112–119.

[35] W.A.Lodwick,Fundamentalsofintervalanalysisandlinkagetofuzzysettheory,in:W.Pedrycz,A.Skowron,V.Kreinovich(Eds.),HandbookofGranular Computing,JohnWiley&SonsLtd.,2008.

[36] G. Mauris,Inferringa possibilitydistributionfromvery fewmeasurements,in: D.Dubois,etal. (Eds.),SoftMethods forHandlingVariabilityand Imprecision,SMPS2008,in:Adv.SoftComput.,Springer,2008,pp. 92–99.

[37] V.Montgomery,Newstatisticalmethodsinriskassessmentbyprobabilitybounds,PhDthesis,DurhamUniversity,2009,http://www.npi-statistics.com/ vm-thesis.pdf.

[38] R.Moore,MethodsandApplicationsofIntervalAnalysis,SIAMStud.Appl.Math.,Philadelphia,1979. [39] S.M.Ross,StochasticProcesses,2nded.,Wiley,1996.

[40] G.Shafer,AMathematicalTheoryofEvidence,PrincetonUniversityPress,1976.

[41] Interpretationsofprobability,in:StanfordEncyclopediaPhilosophy(SEP),http://plato.stanford.edu/entries/probability-interpret/,2011. [42] N.D.Singpurwalla,ReliabilityandRisk:ABayesianPerspective,Wiley,Chichester,2006.

[43] N.D.Singpurwalla,A.G.Wilson,Probability,chanceandtheprobabilityofchance,IIETrans.41(2009)12–22. [44] P.Walley,StatisticalReasoningwithImpreciseProbabilities,ChapmanandHall,London,1991.