domain: info math

text:
Ayeley Tchangani
email: ayeley.tchangani@iut-tarbes.fr

Decision Support System for Complex Systems Risk Assessment with Bayesian Networks

Introduction

Systems that engineers and scientists face today, whether for their design, modeling, analysis, or management, and in particular for the management of the risks of their dysfunction, are increasingly complex. This complexity is due, among other things, to the need to increase the capacities or performance of these systems by networking them, creating interactions that can lead to unpredictable behavior. Complexity is a word that encompasses a set of concepts whose meaning is highly dependent on the context 3;4;13;22 . The definition of a complex system varies depending on the discipline to which it applies. Nowadays, scientific advances are considerably highlighting this notion of complexity in fields as varied as chemistry, physics, biology, economics, human sciences, etc. In its meaning, complex describes a system or component that, with respect to its design or function, is difficult to understand and verify. Over the past decade, the analysis of complex systems (complexity) has been identified as distinct from studies conducted traditionally in the mathematical and physical sciences [START_REF] Weng | Complexity in biological signaling systems[END_REF] . In order to better understand the reactions associated with a phenomenon or mechanism, modeling of behaviors and interactions plays an important role. However, the diversity of systems in terms of architecture, function, environment makes it impossible to formulate general laws to model all of them. In order to best define these systems and model them as closely as possible to reality, understanding and characterization of their complexity is essential. A complex system is made up of many entities whose interactions produce the emergence of a global behavior that cannot be explained solely on the basis of the individual properties of its constituents 10;12 . Often, the interactions of individuals with each other overlap with individual behaviors. Define the interactions for which it is the headquarters is an important key for understanding and controlling the evolution of a complex system. These interactions are first of all temporal, i.e., they evolve over time. They are also multi-scale, i.e., they operate at different levels on the system. In a network, for example, an entity considered elementary may act on a system located at a higher level of which it is a part: this is known as feedback. These feedback phenomena, which are not always explicit, lead to global behaviors that are said to be non-linear. The non-linearity means that they are not simply proportional to the individual behaviors of the basic components. This can lead to cascade phenomena, also known as domino effects, and bifurcations in the evolution of the system leading to sudden and difficult qualitative changes to analyze, understand and predict. Complex Systems approach therefore consists in focusing on dynamic interactions in all their diversity. The complexity attributes basically addressed in this chapter are related to the number of components of a system and principally their interactions that may lead to a cascade effect in the case of the failure of one of them; the main interaction considered here is influence. Influence is materialized by the fact that components interact in hierarchy to form a system so that it can be described by a directed acyclic graph (DAG). The main purpose of the chapter is to model and analyze complex systems in terms of risk they may face. This task needs to be addressed using sound mathematical tools; given the uncertainty that may affect these systems, graphical probabilistic tools such as Bayesian networks (BN) 14;16;17 and their extentions are well suited for treating the influence. In reality, any human decision is risky in the sense that the outcomes of these decisions are subject to uncertainty of all kinds (random, epistemic, fuzzy, imprecise, etc.). This assertion, confronted with the requirement for transparency, for the scientific quasi-truth of any decision, whether particular or public, on the part of citizens, consumers, or users of the tools made available to them by researchers, calls for a treatment or construction of a decision-making framework that inspires a certain degree of confidence regarding the outcome of the decisions taken. The construction of any framework that should help human beings to make the most appropriate decisions is based on the use of appropriate scientific tools. The choice of these tools is based on the attributes of the decisions to be made and thus of the framework to be built such as:

• the multiplicity of actors involved in the decision-making process;

• the multiplicity of objectives targeted by the decisions;

• the multiplicity of attributes or criteria characterizing the alternatives of decisions in relation to the targeted objectives;

• especially the uncertainty that characterizes both the elements of the decision problem (objectives approximately expressed) and the relationships between these elements (attributeobjective relationships that are uncertain or not clearly defined).

In the perspective of integrating uncertainty into decisions of all kinds in order to minimize the risk that the decision-maker runs, researchers are constantly looking for the most efficient tools for modeling and treating uncertainty. To this end, Bayesian networks, since their introduction in 1988 by Judea Pearl [START_REF] Pearl | Probabilistic Reasoning in Intelligent Systems[END_REF] , have proven themselves as a tool for modeling and treating uncertainty and thus the possibility of using them to build a decision-making framework where risk is an important dimension. Thus in this chapter we will try to show how the tools built over time and still under construction around Bayesian technology can be effectively exploited in risky decision support processes.

Bayesian Technology

A Bayesian Network is a directed acyclic graph (DAG) that represents relationships (in general causal relationships) between elements in a certain knowledge domain; each element represents a random variable associated with a probability table characterizing its parameters, the random variable is also called a node in BN representing. The causal relationship is represented by an adge which is a directed link from one variable called parent to the other variable known as a child. Propagation of local evidence or information through the network relies on Bayes theorem 2 , see 17;6 . The strength of relationships called parameters of the BN are collected in conditional probability tables for nodes that do have parents and/or a priori probability tables for nodes without parents. Thanks to their capacity to apprehend uncertainty and complex relationships and to take into account other dimensions involved in risk management, such as time, the large size of the systems to be managed, and multidimensionality, extensions of BNs have been introduced such as:

• dynamic Bayesian networks (DBN) to take into account the effect of time 14 ,

• object oriented Bayesian networks (OOBN) to apprehend the large size of the systems 7 ,

• multi-dimensional Bayesian networks or extended object-oriented Bayesian networks (EOOBN) [START_REF] Liu | Object oriented Bayesian network for complex system risk assessment[END_REF] .

These are the tools that we will use in a risk management perspective.

BN Model for Event Oriented Risk Management

This part is based on [START_REF] Tchangani | A model to support risk management decision-making[END_REF] and its purpose is to establish a meta-model for risk management where risk is due to the occurence of an udesirable event. The Meta-Model for Risk management consists of an influence diagram (ID) which is an extension of Bayesian networks to allow evaluating alternative decisions and not only relationships as in BN. They are simple visual representations of a decision problem under uncertainty. Influence diagrams offer an intuitive way to identify and display the essential elements, including decisions, uncertainties, and preferences, and how they influence each other. It shows the dependencies among the variables more clearly than a decision tree. The subsequent paragraphs will present all the different variables that will be used by the ultimate influence diagram model in the established framework.

Variables Identification

To identify and define all the variables to be used in the risk management model (the ultimate influence diagram), we propose to follow the risk management flow chart depicted on Figure 1, which is explained as follow.

• First of all, the analyst or decision maker must identify all the risk factors, in fact all the events that may have a negative impact on the performance of the entity by using risk assessment approaches evoked previously. We consider that this process will lead to a finite discrete set E of events. • The second stage consists in assessing the variables defining the state of the system that is identifying all the things (economic, social, technological, institutional, cognitive, cultural conditions, etc.) that influence the vulnerability or resiliency (capacity of the entity to resist or not to an adverse event) of the entity given an undesirable event; we consider that a finite discrete set S has been identified.

• In the third stage, one will evaluate the consequences (characterization of negative impact on the entity; complete failure of the system, approximate running of the system, dangerous situation for users, etc.) on the entity if some of the previous events do occur; these consequences depend also on the state of the entity. We consider that a finite discrete set C of consequences is identified.

• The fourth stage is dedicated to defining desires by decision maker; desires are things one wants to affect through management decisions and actions; they define the criteria on which managements decisions will be based and consist most of the time in putting conditions or constraints over consequences (or aggregate indicators) such as damage cost during earthquake must be low, avoid power supply failure during an earthquake, etc. This process will generally lead to identifying the previously mentioned desires set D.

• Finally control variables or management actions are defined; these are things that can be realized in order to achieve desires. Examples: respect anti-seismic norms when constructing, educate population with regard appropriate reaction to adopt during an earthquake, build modern facilities, etc. Once again, we consider that a finite discrete set A of actions is available to decision maker.

Relationships Identification

To identify all the relationships that may exist between previously defined variables, we propose to use a meta-matrix analysis. The entry (I, J) of such a meta-matrix is a directed acyclic graph describing the influence of variables of set I on the variables of set J. The meta -matrix of our model is a 5 × 5 matrix of causality, influence, correlation, etc. graphs between previously identified sets E (events), S (entity state), C (consequences), D (desires) and A (actions) as shown by Figure 2, where blank entries mean no direct influence of the corresponding sets. These graphs are presented and explained in the following points.

• Events graph (E -Egraph): this graph defines causal relationships that may exist between events; to identify these relationships one must answer questions such as: which event may lead to which one ? For instance an earthquake may cause a tsunami or stones falling in mountainous regions.

• State graph (S -Sgraph): represents potential influence that may exist between the variables defining the state of the entity.

• Consequences graph (C -Cgraph): defines relationships between consequences. For instance, human consequences during an earthquake may be decomposed into economic consequences, infrastructures consequences, cultural consequences, etc. To define this graph one can use a bottom up analysis, going from a particular consequence and identifying all the consequences that lead to it.

• Desires graph (D -Dgraph): is similar to consequences graph.

• Actions graph (A -Agraph): this graph defines how one action may influence another one or how the success of an action may depend on another one.

• Events-Consequences graph (E -Cgraph): defines how uncontrollable variables rep- resenting events will impact the consequences.

• Sate-Consequences graph (S -Cgraph): this graph signifies that the importance of consequences depends on the state of the entity in terms of vulnerability or resiliency.

• Consequences-Desires graph (C -Dgraph): is straightforward as desires are defined as conditions or constraints over consequences.

• Actions-Events graph (A -Egraph): this graph represents the risk prevention actions as for some events there may exist actions that reduce their likelihood.

• Actions-State graph (A -Sgraph): describes how some actions influence the state of the entity; indeed this graph represents the risk mitigation actions effects.

From the meta-matrix, defining a meta-model in terms of meta-Bayesian network is straightforward and is given by Figure 3 to control sequence where we add a constraints graph that has an influence on actions in order to take into account unavoidable resources limitation and other physical and feasibility requirements for actions. Of course when facing a real problem, the meta-model of Figure 3 must be instantiated with knowledgeable variables to obtain a real Bayesian network to support making decision.

Usage of the Model

The overall model can be used in two senses: deductive or inductive. In deductive sense, by specifying some local evidence or occurence of an event X in the model, one can propagate it using inference algorithms of Baysian networks to estimate the resultant risk R d (X) on each desire d and then aggregate them (using appropriate aggregator according to pursued objective) to obtain the overall resultant risk R(X). In the inductive sense, by giving some requirements concerning acceptable risk for each desire, one can back propagate this information to determine the most appropriate actions to set up. One must notice that this model can be used by portion in the sense that the user can be interested in only a subset of variables and do the propagation processes.

Illustrative Case Study in Natural Risk Management

Let us consider (interested readers can find details of this application in [START_REF] Tchangani | A model to support risk management decision-making[END_REF] ) a problem of developing a model that can be used by authorities of a country or a region (that may face an earthquake events) to support making sound decisions before, during and after an earthquake. Using steps and tools presented previously a Bayesian Meta-Model for Risk Management as sketched by Figure 3 has been obtained arround following variables. • Event: eartnque that can take two status (yes/no)

• Entity state characterization: it is characterized through four variables (in practice there may be more variables):

-Population awareness of the phenomenon: this is a qualitative appreciation of how well the concerned population know that an earthquake can occur in the region;

-Infrastructure conditions: a region where infrastructures (buildings, roads, dams, etc.) are built when respecting anti-seismic norms will probably resist better during an earthquake than a region that does not respect these norms;

-Emergency systems: this variable describes the quantity and qualities of resources developed by the region authorities to monitor adverse events (network of sensors to detect tectonic movements, geographic information systems, communication systems, etc.) and to efficiently react during an event (emergency equipment, quality and quantity of emergency trained agents, etc.);

-Education level: a well educated population will be more receptive to prescribed behaviour during an earthquake than a non educated one.

• Consequences characterization: Consequences taken into account are economic consequences, social consequences, infrastructures consequences, and environmental consequences.

-Economic consequences: four variables characterize economic consequences * Loss of jobs and know how: this can be considered to be a mean or long term consequence. * Macro-economic consequences: destruction of industrial infrastructures and others will lead to negative macro-economic consequences. * Relocation (of population) cost: this is an immediate consequence that will be influenced by some variables related to emergency systems and infrastructure conditions. * Evacuation (of population) cost: this is also an immediate consequence as the previous one and will be characterized almost in the same way.

-Social consequences: five variables were identified as social consequences * Lives loss: It will depend on some state of the entity variables and other consequences (consequences on buildings for instance). * Impact on the revenue: economic consequences such as jobs loss will lead to a reduction in revenue of the population that will increase social dependency for instance. * Impact on the social dependency: reduction in the revenue may increase social dependency among the population. * Impact on education level: lives loss, revenue reduction and social dependency may lead to a negative impact on the education level. * Post event social consequences: these consequences could consist in changes in cultural habits (migration of people from rural area to towns that will raise some problems such as criminality) or an impact on the structure of the population (reduction of active members of the population), etc.

-Infrastructure consequences: three main variables describe these consequences * Loss of energy infrastructures: this variable, will be a descendant of variables such as dams, power plants, power lines, etc. * Consequences on buildings: damages caused to buildings will depend on the intensity of the earthquake as well as the nature of the buildings (are the buildings constructed when respecting anti-seismic norms or not?) and they will impact on lives loss that will depend on the usage of the building (office, home, industrial building, etc.). * Loss of communication resources: the loss of communication infrastructures such as roads, bridges, airports, ports or electronic communication infrastructures will result in negative socioeconomic consequences.

-Environmental consequences: they are viewed through three variables * Impact on water resources: contamination of rivers and underground water by dangerous products from an exploded chemical or nuclear plants. * Impact on agriculture resources: flooded areas may become impracticable for agriculture or crops may be destroyed by fire, floods or a tsunami will ultimately affect economic and social consequences. * Climate consequences: destruction of forests by fire resulted from an earthquake or by a tsunami can have a long term consequences on the climate.

• Actions identification: four main actions have been identified that can be used to manage earthquake risk.

-Prepare population: this action could take different forms: educate the population; inform and train the population to have a good response in the case of an earthquake.

-Set up and organize emergency systems: create a network of sensors to pre-detect an earthquake event in order to alert population by different media for instance.

-Prepare after event: subscribe insurance to face after events problems.

-Take legislative decisions: vote laws and norms to be respected when constructing some infrastructures (buildings, dames, power plants, roads, bridges, etc.).

• Constraints specification: contraints may be financial, technical, geographical or time of the day.

-Financial constraints: the considered country or region may face serious financial resources limitation in order to undertake actions defined previously.

-Technical constraints: the region or country may lack technical skills to train emergency agents; to construct and organize an efficiency emergency system.

-Geographic constraints: the accessibility of a region that face a natural disaster by emergency resources may be very difficult (mountains region for instance).

-Period of the day: according to the period of the day an earthquake takes place, it will be more or less easy to organize emergency systems and rescue people.

• Desires formulation: desires may be defined by thresholds on consequences level or constraints satisfaction by some consequences (have low level lives loss, prevent infrastructures collapse, prevent occurrence of hunger, etc.).

Once variables are identified and their relationships sketched, one can consider building the entire model. This can be done by implementing existing Bayesian network learning and inference algorithms 17;6 to construct one's own decision support system or one can use existing decision support software based on Bayesian network technology such as that of [START_REF]Hugin Expert Software[END_REF] and 15 , the principal ones in our knowledge. Figure 4 shows an extract of a model that could be set up to support decision making and planning regarding risk related to an earthquake event in a building; the focused consequence in this extracted model is human damage. Note that variables in this model can be considered as macro variables that can be decomposed into more elementary variables depending on the level of abstraction decision makers accept. We did not find it necessary to consider specifying modalities of variables nor conditional probability tables as this is just an illustration of what can be obtained as structure of a risk management decision model in a particular case using the developed approach. When necessary, by using a team of experts, specification of these parameters can be done without major difficulties and value nodes can be added so that one can optimize or prioritize actions by simulation.

BN for Risk Management in Industrial Systems

To illustrate the possibility of using Bayesian networks for risk assessment and management in the industrial field, let us consider (an academic problem that an author uses in his risk management class) the launch monitoring system for an Ariane rocket. The success of an Ariane launch is based on the transmission of flight parameters from the satellite antennas in Libreville to the graphics station or TMAE console at the Kourou space center (see Figure 5 below).

Suppose we are interested in the possibility that the system may fail (i.e., data is not available in Kourou) after 5 years of operation and that the technical data of the elements of the transmission chain are given in the table of Figure 6. It is assumed that each element can take only two modes OK (the element is functionning) or OFF (the element failed). The quantitative data MTTF (Mean Time To Failure, it is assumed that the time to failure follows exponential laws) of the elements are shown in the table of Figure 6. Note that these collected data are just indicative. The Bayesian network model (built using Netica software) of the combinations of the basic events (failure of the elements of the transmission chain) to the dreaded event, which is the absence of flight parameter data at Kourou after 5 years of operation, is given in Figure 7. In terms of risk management, the previous Baysian model of Figure 7 can be used for prediction (determining the probable state of the system given the state of certain basic elements), diagnosis (determining the probable state of the elements given the observed state of the system) and certain indicators that enable decisions to be made regarding intervention on systems (maintenance, replacement, improvement, predictive maintenance, risk analysis, etc.). To this end let us define following parameters and variables.

• x i (t) is the inoperability status of component i at time instant t that is binary in this case and given by Equation ( 1)

x i (t) = 1 if component C i is OF F at time t 0 if component C i is OK at time t , (1)
• So that the inoperability status of the overall system can be resumed by its inoperability vector x(t) as shown by Equation ( 2)

x(t) = x 1 (t) x 2 (t) ... x n (t) , (2)
• The ultimate analysis goal is to determine ϕ(x(t)) that represents the inoperability status of the system at time t defined by Equation ( 3)

ϕ(x(t)) = 1 if system S is OF F at time t 0 if system S is OK at time t , (3)
The main risk indicator I S (t) in terms of risk management is the probability of faillure of the system (launch faills) given by Equation ( 4)

I S (t) = Pr {ϕ(x(t)) = 1} , (4)
Besides I S (t) as indicator of risk, some parameters can be useful for risk management such as following ones.

• Criticality of a component: a vector x(t) is critical at time t for component

C i if it verifies Equation (5) ϕ((1 i , x(t))) = 1 and ϕ((0 i , x(t))) = 0, (5)
where, (× i , x(t)) means that the component C i is in its status × (0 or 1) at time t. It means that if component C i is inoperable at time instant t then the system will be inoperable and if it is functioning the system will be functioning.

• Risk augmentation factor RAF i (t) of component i: relative increase of the probability of inoperability of the system knowing that the basic component C i is inoperable given by Equation ( 6)

RAF i (t) = I S/xi(t)=1 (t) -I S (t) I S (t) , (6)
where, I S/xi(t)=1 is the probability of inoperability of the system given that the component C i is totally inoperable.

• Risk diminution factor RDF i (t) of component i: relative decrease of the probability of inoperability of the system knowing that the component C i is operating given by following Equation ( 7)

RDF i (t) = I S (t) -I S/xi(t)=0 (t) I S (t) , (7)
where, I S/xi(t)=0 is the probability of inoperability of the system given that the component C i is totally operable.

• Vessely-Fussel or diagnosis importance factor V F i (t) of component i: probability that the basic component C i is inoperable knowing that the system is inoperable defined by Equation ( 8)

V F i (t) = Pr {x i (t) = 1/ϕ(x(t)) = 1} , (8)
• Birnbaum's factor BF i (t) of component i: probability that vector x(t) is critical for component C i at time instant t defined by ( 9)

BF i (t) = I S/xi(t)=1 (t) -I S/xi(t)=0 (t), (9)
• Lambert or critical component factor LF i (t) (diagnosis) of component i: probability that the vector x(t) is critical for component C i and the system is inoperable or the probability that the inoperability of component C i is the cause of the inoperability of the system that is given by Equation ( 10)

LF i (t) = Ψ i (t) Pr {x i (t) = 1} , (10)
where Ψ i (t) is given by ( 11)

Ψ i (t) = I S/xi(t)=1 (t) -I S/xi(t)=0 (t) I S (t) , (11)

DBN for Risk Management of Industrial Systems

Brief Presentation of DBN

Dynamic Bayesian networks [START_REF] Murphy | Dynamic Bayesian Networks: Representation, Inference and Learning[END_REF] derive from an extension of Bayesian networks (see, 16;17 and references therein) that describe probabilistic relationships between variables of a knowledge domain in order to take into account time behavior. Dynamic Bayesian networks (DBNs) are directed acyclic graphical models of stochastic processes, see [START_REF] Murphy | Dynamic Bayesian Networks: Representation, Inference and Learning[END_REF] , and they generalize Hidden Markov Models (HMMs) and Linear Dynamical Systems (LDSs) by representing the hidden and observed state in terms of state variables, which can have complex interdependencies. The graphical structure provides an easy way to specify these conditional interdependencies, and hence to provide a compact parameterization of the model. A dynamic Bayesian networks is completely defined by two components:

• Its structure that is a directed acyclic graph (DAG) where nodes represent variables and directed arcs represents influential relationships between these variables.

• Its parameters that represent conditional probability density (CPD) functions in the case of a continuous variable (the allowed values of the variable belong to a continuous set) or conditional probability table (CPT) in the case of a discrete variable (the allowed values of the variable belong to a discrete set that will be in general a finite set).

A dynamic Bayesian network structure consists of an intra slices directed acyclic graph and an inter slices directed graph; slices represent time instants to describe dynamic behavior of the system. Intra slice graph models the instantaneous relationships of nodes (a Bayesian network) and the inter slice graph represents the dynamics of the nodes. Intra slice parameters are conditional probability density functions and/or conditional probability tables of the corresponding Bayesian network and inter slice parameters represent the dynamics of variables on one hand and their relationships with the variables that influence their behavior on the other hand. The advantage of the Bayesian network model over the Markov chain representation for instance, besides the fact that the model is more compact and/or the possibility to consider the influence of the history up to some complexity, is that the transition matrix P can be learnt (estimated) from the expert knowledge and/or experimental data or parameters depending on external dynamic signals. BN and DBN have been widely used to assist decision making processes in domains such as dependability, product heath management and maintenance, see for instance 10;20 and references therein. Dynamic Bayesian networks are of particular interest for modeling interactions whose effects are delayed as is usually the case for physical systems. Indeed, in this case the interactions are modeled by the inter-slice relations in the Dynamic Bayesian network while the functional relations form the static Bayesian network at the level of a slice. Of course, the indicators or measures of importance defined in the safety of operation literature such as those in Equations ( 4) to (10) are easily calculable in a DBN model by running the model.

Illustrative Case Study

Consider a power supply system 18 for a server consisting of a power supplier (P), a circuit breaker (C) and two parallel circuits (active redundancy) each consisting of a cable (C1/2) and a transformer (T1/2) as shown in Figure 8.

The main objective is to model this system in order to prognosis the possibility of inoperability of the server due to a lack of electrical energy. FTA analysis of this system leads to 6 minimal cut sets: two of order 1 (the number of elements in the cut set) in terms of P (main power supplier) and C (circuit bricker) and four of order 2 consisting in T 1T 2 (transformers), T 1C2 (transformer 1 and cable 2), T 2C1 (transformer 2 and cable 1) and finally C1C2 (cables) and the DBN model of the system is given by Figure 9. Let us consider the following dynamic scenario: it is admitted that nominal failure rate of all components are considered to be λ 0 i = 10 -3 /T U where TU stands for time unit; but the real failure rate of the two transformers depend on a time varying disturbance signal w(t), with a nominal value w 0 , according to the law given by Equation ( 12) and the main purpose is to study the influence of this signal on the I S (t) (see Equation ( 4)) of the system. Dynamic Bayesian Network model of this system is shown on Figure 9 where S(t) represents the status of whether the server is supplied of power or not. In terms of prognostics, I S (t) is a good indicator to determine for instance the remaining useful life RU L α (t 0 ) at each time instant t 0 at caution or boldness rate α (probability that the system being operational); indeed by setting up the rate α, RU L α (t 0 ) is given by Equation ( 13)

λ Ti (t) = λ Ti (t -1) + β Ti (w(t) -w 0 ), λ Ti (0) = λ 0 i (12)
RU L α (t 0 ) = I -1 S (1 -α) -t 0 ( 13
)
where I -1 S (1 -α) is the inverse of I S (t) defined by ( 14)

I -1 S (1 -α) = {T : I S (T ) = 1 -α} (14)
the main challenge therefore is to calculate this indicator I S (t).

Let us denote by RU L α w0 (t 0 ) and RU L α w(t) (t 0 ) the remaining useful life from time instant t 0 at the caution or boldness index α in nominal behavior of the external signal (w 0 ) and when transformers are subjected to external signal w(t) respectively. Consider now the following conditions:

• nominal behavior of external signal is w 0 = 0,

• w(t) and consequently λ Ti (t) behave like the curve shown on Figure 10 (a) and Figure 10 (b) with β Ti = 10 -3 . By running the DBN model given by Figure 9, we obtain result shown on Figure 11 for I S (t) where the red curve corresponds to perturbed case whereas the blue one corresponds to nominal behavior of external disturbance signal w(t).

From this Figure 11 we can see that at caution or boldness index of α = 10%, the nominal and the disturbed RULs at time instant t 0 = 20 are given by RU L 0.1 w0 (20) ≈ 750 -20 = 730 T U and RU L 0.1 w(t) (20) ≈ 250 -20 = 230 T U. In terms of decision making, given the b ehavior of external signal w(t), decision maker can either maintain the caution or boldness level of 10% and then shorten the mission time from 730 to 230 or maintain the mission time of 730 by diminishing the caution from 10% to almost 0%.

EOOBN for Risk Management

Using BN techniques for modelling risk assessment processes becomes increasingly complex when the size of the system increases. For a large-scale system with many interacting elements, constructing a BN to represent its behaviour may be very tricky. Meanwhile, when the size of network grows, the model visibility reduces and the update of parameters becomes burdensome. For this reason, Object Oriented (OO) techniques might be a relevant alternative to reduce the complexity by highlighting a generic pattern representative of the various dimensions of the problem. An Object Oriented Bayesian Network (OOBN) is a direct application of the object paradigm 1;7 . The OOBN takes advantage of classic BN, but introduces the concept of instance nodes. An instance node is an abstraction of a part of a network that can be used as an elementary component to represent the whole structure. The notion of encapsulation allows the transmission of all properties of the network fragment. An OO network can be viewed as a hierarchical description or model of a problem. This makes the modelling easier since the OOBN fragments at different levels of abstraction are more readable. An OOBN model can be built by asking experts' opinions or using learning techniques. Authors of 8 and 23 give some insights into OOBN structure learning. The construction of such a model can be facilitated by an ontology representation [START_REF] Liu | Modelling a large scale system for risk assessment[END_REF] . Once the structure of the system is defined, the CPTs (also called parameters) have to be parameterized. The paper 9 extends the parameters learning algorithm to the objects that have the same structure based on OO assumptions. The parameters being identical reduce the number of parameters to be specified or learnt. Modelling a complex system by an OOBN allows not only reducing the design work but also updating calculations. However, most of the existing works dealing with this topic consider that parameters do not change from an object to another, which most often is not a realistic assumption in a real-world problem modelling ( ) context. As our main goal is to use OOBN for the representation of a large, repeatable and inherited system, this shortcoming must be remedied. In the following section, we will describe a proposed extension of OOBN paradigm that we refer to as EOOBN.

S I t 0 0.1 0 ( ) w RUL t 0.1 ( ) 0 ( ) w t RUL t 0 t 1 , ( ) (0.9) S w t I - 0 1 , (0.9)

Extended Object Oriented Bayesian Network

Most of existing works dealing with OOBN consider that parameters do not change from an object to another, which most often is not a realistic assumption in a real world problem modeling context. To overcome this shortcoming the notion of Extended Object Oriented Bayesian Network or multi-dimension BN (MBN) is introduced. The basics of this model are briefly recalled in the following paragraphs, see 10 and 12 for details.

Construction of an EOOBN

In this section, we present an EOOBN approach which introduces much more flexibility, such as the possibility of instantiating parameters according to the considered object and taking into account dynamic behaviour of the system.

Basic Definitions. To overcome the limitations of classical OOBN associated with the structure building mentioned in 23 and 7 and the difficulty to take into account dynamic interactions pointed out in [START_REF] Koller | Object-oriented Bayesian networks[END_REF] , we propose here an extended OOBN to ease parameter variation and dynamic consideration process. The approach is easy to adapt by collaboration mechanism and to propagate observations in a large system. The main components of an EOOBN are listed as follows.

Class, Object, Communication Channel and Virtual Node. Below, we will consider two levels in EOOBN: definition of a class is made at structure level (i.e., the nodes and their connexions in the object) and the object itself will be instantiated both through the input values and with respect to its parameters at the object level, which are likely to evolve with context or time.

• Class: A class (C) is the structure part (S) in a BN independent of the CPT parameters values. It has three kinds of nodes, namely, input nodes, output nodes and internal nodes.

Only the input and output nodes are visible from outside the class.

• Object: An object (OS, P ) in the EOOBN is an instantiation of the corresponding class.

There are two parts in an object: the structure (S) which inherits from the class and the parameters (P ) which will be defined by experts or learning processes. Instantiating a class consists in setting its parameters through a learning process or an expert opinion.

• Communication channel: The input and output build the communication channel for an EOOBN. It supports the process of exchanging information within the object and requires the following conditions to be satisfied:

-Input nodes cannot have parents inside the class.

-Input node is a reference node which is the projection of an output.

-Internal nodes cannot have neither parents nor children outside the class.

-Output nodes cannot have children inside the class.

Figure 12 presents the class which follows the four conditions above for an EOOBN with input nodes V in1 and V in2 , output nodes V out1 and V out2 , and internal nodes V 1 and V 2 . The class characterizes only the structure of the network. A class can be used only after its instantiation. The EOOBN not only inherits all the advantages of the classical OOBN such as hierarchy or encapsulation, but also offers more flexibility in terms of quantification. The possibility of having different parameter values from an object to another offers the possibility for different objects of the same category to have different parameters. The necessity to follow the behaviour of real-world systems appeals for introducing dynamicity in the model. This can be done by extended classical DBN in OO frame as shown in the following paragraph. Although in 1 a DBN simulation approach is given based on a self-reference node in an object, the dynamic simulation is done by adding a reference link (from dynamic output node to dynamic input node) inside the class; a confusion might appear when trying to add the dynamic part within a large OOBN. To overcome this issue, we introduce the virtual nodes in the EOOBN to simulate the dynamic part.

• Virtual node. The virtual node is a communication channel for the class/object. It usually stands for the temporal node.

-The virtual node is either an input node or an output node in the class/object.

-It is associated with the dynamic node in the class/ object as a communication channel with the next time-slice.

-The transition model represents the parameters between the virtual input and dynamic node; Conditional probabilities between a dynamic node and its virtual output are equalled to 1.

After the instantiation the class one obtain a dynamic object that can be used to study the dynamic behaviour of the considered system.

Construction Method. The construction of a dynamic EOOBN can be done by carrying out the following steps:

• Formalize the structure S of a system (by splitting the system into different classes C).

• Design the structure of each class (C) with respect to S and without considering the dynamic part.

• Identify the dynamic node in class N ti and add virtual input and output nodes to the time-dependi variables.

• Instantiate the class by introducing the parameters corresponding to the object.

• Connect the objects through their communication channels.

The instantiation of a class requires to be able to quantify its parameters. This can be obtained from expert opinions or learning processes. Due to the spatial characteristics of EOOBN such as the repeatable structure of certain objects, the parameter learning maybe different from the classical learning process. The learning problem for EOOBN will be addressed in a future work. The EOOBN flexibility is mainly explained on one hand by the concepts of class and objects allowing, as previously mentioned, parameter variations but also, in another hand, by its aptitude to accept the introduction of system dynamic behaviour. The definition of class not only enables the independence of its constitutive variables but also local independent computation for each object. The EOOBN models proposed in this article will be always structured according to global and object levels. In order for existing inference algorithms to be used for EOOBN assessment, some adjustments are required that will be presented in the next section.

A specific propagation method has been developped for EOOBN [START_REF] Liu | Object oriented Bayesian network for complex system risk assessment[END_REF] . In terms of usage of this model for risk informed decision making, the following type of decision can be considered:

• Pre-active decisions: preparing things to prepare the system to face potential threats; the model can be used to identify weak points with regard to identified threats in a large-scale system to search for appropriate defence mechanism.

• Reactive decisions: real-time decision-making when the adverse event takes place. Indeed by simulating, the system decision-makers can deduce what will happen at a particular place knowing that something abnormal does happen somewhere else.

• Pro-active decisions: the model can be used to look for actions that may be set up to avoid some catastrophic situations.

Case Study

Main developpments of this part are in [START_REF] Liu | Object oriented Bayesian network for complex system risk assessment[END_REF] . In this section, the construction method has been applied to build an EOOBN within the framework of a cement manufacture process. The cement production process is made of seven steps:

• 1. Obtaining the raw material from a quarry through a blasting machine.

• 2. Proportioning, blending and grinding.

• 3. Preheating the material in a tower.

• 4. Heating in a kiln.

• 5. Cooling the clinker.

• 6. Grinding finish.

• 7. Bagging thanks to a packaging machine.

Every step of the process is supported by operation machines and operators. It is assumed that every step relies on a single machine and that only the qualified intermediate product can be transferred to the next step. Every machine has its own operation conditions. The fabrication process in each step is a complex physical chemistry dynamic reaction, and the use of an EOOBN is relevant for its simulation. It will enable among other things to take into account of the uncertain environment, considering individually each material or human resource without simplifying the system with too many hypothesis while embracing the whole system whatever its size.

• Step 1: Formalize the structure of a system (by splitting the system into different classes).

According to the previous description, the manufacturing process is split into seven blocks corresponding each to the different steps previously defined. A BN-based general machine model is proposed for each asset; the general model will be treated further as a class in the EOOBN.

• Step 2: Design the structure of each class with respect to system and without considering the dynamic part. A machine involves seven basic variables which are listed as follows:

-Machine state (MS)

-Upstream state -Operator skill (OS) -Controller -Product quantity
-Amount of quality product (also called downstream product (DP))

The machine yield relies on the capacity of the asset to produce a quantity of product with the required quality. Initial quantity of products (P) likely to be generated will depend on the OS, the MS and the upstream product (UP) input. The final quantity or DP will be a proportion of this initial amount of products (P) respecting the quality criteria that will depend not only on OS and MS, but as well on the aptitude of the system to detect possible defects through a control (C).

• Step 3: Identify the dynamic node in the class and add the virtual input and output nodes associated with it around the dynamic variable. this case study, the MS variable is considered as dynamic since it loses efficiency over time. The corresponding virtual input and output nodes are then introduced to obtain the dynamic class.

• Step 4: Instantiate the class by introducing the parameters corresponding to the object.

To characterize the specificity of each machine, different parameters are identified and used to instantiate the objects. At this level, the knowledge comes generally from learning processes or expertise; but in the present case, the machine parameters are arbitrarily decided by the authors. To characterize the specificity of each machine, different parameters are identified and used to instantiate the objects. At this level, the knowledge comes generally from learning processes or expertise; but in the present case, the machine parameters are arbitrarily decided by the authors.

• Step 5: Connect the objects through their communication channels. Two communication channels appear in the case study corresponding respectively to the: intermediate product flow and Dynamic of machine state (MS) model.

From the model established (see [START_REF] Liu | Object oriented Bayesian network for complex system risk assessment[END_REF] for details), various key performance indicators can be estimated such as the probability associated with the modalities of the variables of machine 7.

In particular, the form of degradation over time of the MS combined with a time-dependent productivity slowdown is observed. The selected case study considered here only few modalities for each variable, but obviously the results could be significantly refined by taking into account more discrete variation intervals for each variable. It is also possible to introduce various evidences whose propagation in the network will help reducing uncertainties and ease the decision-making. The EOOBN simulates the system as a whole without any restrictive assumption. Splitting a big system into different homogeneous sub-models helps reducing the calculation and consequently the computation time while considering the unicity of each asset. As a benefit, one can also consider the advantage of dissociating the different dimensions characterizing the behaviour of a system. Here, the model is based on two dimensions representing the spatio-temporal evolution of a process, but the methodology we propose is not limited and can accept an infinite number of dimensions to be handled simultaneously.

Conclusion

This chapter provided an overview of how to use different Bayesian technology tools to model and analyze risk management problems. In terms of Bayesian technology, three main variants have been presented, namely Basic Bayesian Networks (BN), Dynamic Bayesian Networks (DBN), Object Oriented Bayesian Networks (OOBN) and their extension (EOOBN) recently developed in the author's research team. On the applications side, case studies in various domains such as industry, risk management problems in the face of nature have been visited. The work presented in this chapter shows the possibilities of Bayesian technology in the processes of analysis, evaluation and risk management. The models established in this chapter, address the problem of how to obtain the information or knowledge necessary to solve risky decision problems. Risk is a topic of utmost importance for decision makers, whether it is the risk related to unknown diseases, the risk related to industrial activities, the risk related to malicious activities, risk reltated to natural events, etc., and therefore this topic must be considered by scientific methods. This chapter has shown, in some respects, that tools built around Bayesian technology can effectively contribute to understanding these risk-related decision problems. In a decision-making process, there is no worse adversary than uncertainty because it leads to feverishness, fear and apprehension on the part of decision-makers. The adequate treatment of this uncertainty is therefore a commendable contribution to the decision support processes and this chapter has tried to answer this imperative through Bayesian technology.

Acronyms

Figure 1 :

 1 Figure 1: Risk management process flow chart.

Figure 2 :

 2 Figure 2: Meta-matrix to identify relationships between variables.

Figure 3 :

 3 Figure 3: Bayesian meta-model for risk management.

Figure 4 :

 4 Figure 4: Example of an instance of Bayesian meta-model for risk management.

Figure 5 :

 5 Figure 5: Structure of considered illustrative system.

Figure 6 :

 6 Figure 6: Quantitative parameters of elements of Kourou application.

Figure 7 :

 7 Figure 7: Bayesian network model risk assessment of Kourou launch problem.

Figure 8 :

 8 Figure 8: Scheme of illustrative case study.

Figure 9 :

 9 Figure 9: Dynamic Bayesian network model of considered illustrative application.

  (a): w(t) (b): failure rate of transformers

Figure 10 :

 10 Figure 10: Simulated behavior of external signal w(t) and transformers failure rate.

Figure 11 :

 11 Figure 11: Results obtained by running the DBN model for the considered scenario.

Figure 12 :

 12 Figure 12: Basic structure of a class in EOOBN.

Constraints Actions State of the system Consequences

		Technical		Financial
		Skills		Resources
		Anti_Sismic	Emergency	Prepare
		Laws	System	Population
	Anti_Sismic	Building	Emergency	Bulding	Education	Anti_Sismic
	Rspect	Age	Resources	Usage	Level	Training
					Population
					Awereness
			Building
	Event (Erthquake)	Infrastructure	Damage	Emergency	Human Damage
		Damage		Efficiency