Roger Flage1

Piero Baraldi

Enrico Zio

Terje Aven

Roger Flage
email: roger.flage@uis.no.

Probability and possibility based representations of uncertainty in fault tree analysis

Keywords: risk analysis, epistemic uncertainty, fault tree analysis, possibility-probability (probability-possibility) transformation

Expert knowledge is an important source of input to risk analysis. In practice, experts might be reluctant to characterize their knowledge and the related (epistemic) uncertainty, using precise probabilities. The theory of possibility allows for imprecision in probability assignments. The associated possibilistic representation of epistemic uncertainty can be combined with, and transformed into a probabilistic representation; in the present paper we show this with reference to a simple fault tree analysis. We apply an integrated (hybrid) probabilistic-possibilistic computational framework for the joint propagation of the epistemic uncertainty on the values of the (limiting relative frequency) probabilities of the basic events of the fault tree, and we use possibility-probability (probability-possibility) transformations for propagating the epistemic uncertainty within purely probabilistic and possibilistic settings. The results of the different approaches (hybrid, probabilistic, possibilistic) are compared with respect to the representation of uncertainty about the top event (limiting relative frequency) probability. Both the rationale underpinning the approaches and the computational efforts they require are critically examined.

We conclude that the approaches relevant in a given setting depend on the purpose of the risk analysis, and that further research is required to make the possibilistic approaches operational in a risk analysis context.

INTRODUCTION

In engineering risk analysis, a distinction is commonly made between aleatory (stochastic) and epistemic (knowledge-related) uncertainty [START_REF] Apostolakis | The concept of probability in safety assessments of technological systems[END_REF][START_REF] Aven | Foundations of Risk Analysis: A Knowledge and Decision-Oriented Perspective[END_REF][START_REF] Helton | Guest editorial: treatment of aleatory and epistemic uncertainty in performance assessments for complex systems[END_REF] . Aleatory uncertainty refers to variation in populations. Epistemic uncertainty refers to lack of knowledge about phenomena, and usually translates into uncertainty about the parameters of a model used to describe random variation.

Whereas epistemic uncertainty can be reduced, aleatory uncertainty cannot, and for this reason it is sometimes called irreducible uncertainty [START_REF] Helton | Guest editorial: treatment of aleatory and epistemic uncertainty in performance assessments for complex systems[END_REF] .

Limiting relative frequency probabilities are typically used to describe aleatory uncertainty, and subjective probabilities have traditionally been used to describe epistemic uncertainty. (In the following, probability refers to the limiting relative frequency concept whenever preceded by the term frequency, and to the epistemic/subjective concept whenever used alone.) For example, NUREG-1855 [START_REF]NUREG-1855 -Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making[END_REF] , which provides guidance on how to treat uncertainties associated with probabilistic risk assessment (PRA) in a risk-informed decision-making context, states that (epistemic) parameter uncertainty in PRA may be described using subjective probability.

However, several alternatives to probability as representation of epistemic uncertainty have been suggested. These include imprecise or interval probability [START_REF] Coolen | On the use of imprecise probabilities in reliability[END_REF][START_REF] Coolen | Imprecise probability: A concise overview[END_REF][START_REF] Utkin | Imprecise reliability: An introductory overview[END_REF][START_REF] Walley | Statistical Reasoning with Imprecise Probabilities[END_REF][START_REF] Weichselberger | The theory of interval-probability as a unifying concept for uncertainty[END_REF] , probability bounds (p-box) (10,11) , fuzzy set theory [START_REF] Unwin | A fuzzy set theoretic foundation for vagueness in uncertainty analysis[END_REF][START_REF] Zadeh | Fuzzy sets[END_REF] , fuzzy probability [START_REF] Zadeh | Probability measures of fuzzy events[END_REF] , the theory of possibility [START_REF] Dubois | Possibility theory and statistical reasoning[END_REF][START_REF] Dubois | Possibility Theory: An Approach to Computerized Processing of Uncertainty[END_REF][START_REF] Zadeh | Fuzzy sets as a basis for a theory of possibility[END_REF] and the theory of belief functions [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] , also known as evidence theory or the Dempster-Shafer theory of evidence.

Specifically, it has been suggested that a possibilistic representation of epistemic uncertainty may be more adequate when sufficiently informative hard data are not available for statistical analysis and thus one has to resort to information provided by experts, mostly of qualitative nature.

Indeed, expert statements are an important source of input to risk analysis. However, an expert often does not have sufficiently refined knowledge or opinion to characterize epistemic uncertainty in terms of a probability (distribution). In these cases, the two measures of likelihood, namely possibility and necessity measures, offered by the possibility theory may be interpreted as lower and upper probabilities in the representation of imprecision in the experts' probability assignments.

The possibilistic representation of uncertainty can both be combined with and transformed into the traditional probabilistic representation. In this respect, an integrated ('hybrid') computational framework has been proposed for jointly propagating probabilistic and possibilistic representations through a model [START_REF] Baudrit | Joint propagation of probabilistic and possibilistic information in risk assessment[END_REF] . This framework has previously been tailored to event tree analysis [START_REF] Baraldi | A combined Monte Carlo and possibilistic approach to uncertainty propagation in event tree analysis[END_REF] and fault tree analysis [START_REF] Flage | Handling epistemic uncertainties in fault tree analysis by probabilistic and possibilistic approaches[END_REF] , allowing for the epistemic uncertainties on basic event frequency probabilities to be represented and propagated using both probability and possibility distributions.

Furthermore, procedures for the transformation from a possibilistic representation to a probabilistic one, and vice versa, have been suggested [START_REF] Dubois | On possibility/probability transformations[END_REF] . The transformations are not one-toone, and going from possibility (probability) to probability (possibility) some information is introduced (lost) in the transformation procedure. However, certain principles can be adopted so that there is minimum loss (introduction) of (artificial) information.

In the present paper, we extend the previous work on the hybrid procedure by applying some of the possibility-probability (probability-possibility) transformations of the literature. The different results obtained are then compared, focusing on the representation of uncertainty about the top event frequency probability, in relation to the rationale of the approaches as well as the computational efforts required. More broadly, the purpose of the paper is to review available options of epistemic uncertainty representations and evaluate their rationale and appropriateness in relation to risk analysis.

To keep the analysis simple and thus retain a clear view of each step, the object of study is a fault tree with only two basic events linked to the top event through an OR-gate. We then avoid that computational challenges related to FTA (see e.g. [START_REF] Epstein | Can we trust PRA? Reliability Engineering & System Safety[END_REF][START_REF] Cepin | Analysis of truncation limit in probabilistic safety assessment[END_REF] ) interferes with the analysis. The basic events are assumed to be independent and to have unknown frequency probabilities of occurrence. Uncertainty about one of the basic event frequency probabilities is described probabilistically, and uncertainty about the other possibilistically.

In a fault tree analysis case study [START_REF] Rao | Epistemic uncertainty propagation in reliability assessment of complex systems[END_REF] with a similar objective as the present paper, uncertainty quantification based on Dempster-Shafer theory is explored when some model parameters are assigned probability distributions and the remainder fuzzy membership functions. The representation and propagation of uncertainty about basic event frequency probabilities in fault tree analysis using evidence theory is considered in [START_REF] Limbourg | Modelling uncertainty in fault tree analyses using evidence theory[END_REF] . In [START_REF] Tanaka | Fault tree analysis by fuzzy probability[END_REF][START_REF] Liang | Fuzzy fault tree analysis using failure possibility[END_REF][START_REF] Huang | A fuzzy set approach for event tree analysis[END_REF] basic event frequency probabilities are treated as trapezoidal fuzzy numbers and the extension principle is applied to compute the frequency probability of occurrence of the top event. In order to deal with repeated basic events in fault tree analysis, a simple method for fuzzy fault tree analysis based on the α-cut method, also known as resolution identity, is presented in [START_REF] Soman | Fuzzy fault tree analysis using resolution identity and extension principle[END_REF] . A formal probabilistic (Bayesian) procedure for the use of expert opinions in the context of fault tree analysis is presented in [START_REF] Rao | Epistemic uncertainty propagation in reliability assessment of complex systems[END_REF] assuming expert input in the form of means and standard deviations of lognormally distributed failure rates.

The remainder of the paper is organized as follows. In Section 2, the fault tree studied is described. In Section 3, a brief review of the computational procedure for the integrated (hybrid) probabilistic and possibilistic propagation of epistemic uncertainty in the fault tree is described.

In Section 4, the possibility-probability (probability-possibility) transformations considered are described. In Section 5, the results of the fault tree analysis using the hybrid and transformationbased approaches are presented. Section 6 offers a discussion of the results and some conclusions.

FAULT TREE AND BASIC EVENT UNCERTAINTIES

We consider a simple fault tree comprised of two independent basic events, B 1 and B 2 , linked to the top event A through an OR-gate (Figure 1). Letting q denote the frequency probability of the top event, and q i the frequency probability of basic event i, i = 1, 2, we have

= 1 + 2 -1 2 . ( 1
)
We assume that the basic event frequency probabilities q 1 and q 2 are uncertain, and that uncertainty about q 1 is described using a beta probability density p 1 with parameter values α and β as specified in Table I (see also Figure 2), while uncertainty about q 2 is described using a triangular possibility distribution π 2 with lower support limit b, core c and upper support limit d as specified in Table I (see also Figure 3). Three cases are considered: high, medium and low uncertainty (Table I). The distribution parameter values have been chosen to obtain distributions which clearly reflect increasing uncertainty when going from the low to high uncertainty cases.

The probability distributions have increasing entropy, and the possibility distributions all have the same core value and overlapping support intervals of increasing size. As an example, B 1 could denote failure of an item for which failure data exists, and B 2 an event for which no data exists and where the triangular possibility distribution is constructed based on expert statements alone.

HYBRID UNCERTAINTY PROPAGATION

In the hybrid approach [START_REF] Baudrit | Joint propagation of probabilistic and possibilistic information in risk assessment[END_REF] , propagation of uncertainty is based on a combination of the Monte Carlo technique [START_REF] Kalos | Basics[END_REF] and the extension principle of fuzzy set theory [START_REF] Zadeh | Fuzzy sets[END_REF] . The main steps of the procedure are:

 repeated Monte Carlo samplings of the probabilistic quantities; and

 fuzzy interval analysis to process the uncertainty associated with the possibilistic quantities.

More specifically, consider the functional relationship y = g(x), where x = (x 1 , ..., x k , ..., x n ) is a vector of n parameters. Assume that uncertainty about k of the parameters, say (x 1 , ..., x k ), is described by probability distributions (F 1 , ..., F k ), and uncertainty about the remaining nk parameters, (x k+1 , ..., x n ), by possibility distributions (π k+1 , ..., π n ). For a vector of fixed values of (x 1 , ..., x k ), obtained by Monte Carlo sampling, the extension principle defines the possibility distribution of y as

= sup x,g x =u min +1 +1 , … , . (2)
Considering the simple fault tree described in Section 2, for fixed quantities q and q 1 in Equation

(1) we have

2 = -1 1-1 ,
and hence trivially by Equation ( 2),

( ) = 2 -1 1-1 , for q 1 ≤ u ≤ 1.
We see that for each Monte Carlo sampling of q 1 , an associated possibility distribution of q is obtained (Figure 4). The possibility distributions resulting from the hybrid procedure are combined using Dempster's rule [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] to obtain the belief function Bel(u) = Bel([0, u]) and the plausibility function

Pl(u) = Pl([0, u]), 0 ≤ u ≤ 1, defined by = 1 =1 , (3)
where

N i (u) = N i ([0, u])
is the necessity measure of [0, u] arising in the ith Monte Carlo sampling, and

= 1 Π =1 , (4)
where

Π i (u) = Π i ([0, u])
is the possibility measure of [0, u] arising in the ith Monte Carlo sampling. The belief and plausibility functions above can then be interpreted as bounding cumulative distributions.

In general, Equation ( 2) is equivalent to performing interval analysis on the alpha-cuts of the possibility distributions (π k+1 ,...,π n ) [START_REF] Baudrit | Joint propagation of probabilistic and possibilistic information in risk assessment[END_REF] . The uncertainty propagation procedure is then:

 Sample a set of m vectors of (x 1 ,...,x k ) values from the probability distributions (F 1 ,...,F k ).

 Determine a α-cut levels of the possibility distributions (π k+1 ,..., π n ).

 For a given Monte Carlo sampling (step 1) and α-cut (step 2), determine the lower and upper value of y.

 Repeat step 3 for all m Monte Carlo samplings and all a α-cut levels; as seen above, a possibility distribution of y is obtained for each Monte Carlo sampling, as collection of all the lower and upper values found in 3.

 The m possibility distributions of y obtained from step 3 are combined using Equations

(3) and (4).

It is important to be aware that underlying the extension principle is an assumption of a metadependence between the possibilistic quantities involved [START_REF] Baudrit | Joint propagation of probabilistic and possibilistic information in risk assessment[END_REF] : There is potentially two levels of dependence among the possibilistic quantities: a (meta-)dependence between information sources, and a (stochastic) dependence between the quantities themselves. The hybrid propagation method assumes stochastic independence between the group of probabilistic quantities and the group of possibilistic quantities. The extension principle is equivalent to performing interval analysis on α-cuts and, as a result, imposes an assumption about strong dependence between the information sources (experts) supplying the input possibility distributions.

POSSIBILITY-PROBABILITY (PROBABILITY-POSSIBILITY)

TRANSFORMATIONS

Using possibility-probability (probability-possibility) transformations, uncertainty propagation can be performed within a single calculus, i.e. using Monte Carlo sampling when transforming possibility distributions into probability distributions and using fuzzy methods when transforming probability distributions into possibility distributions.

In this Section we first review the transformations considered, and then describe their implementation on the fault tree case described in Section 2.

Review of transformation methods

We consider transformations from possibility distributions into probability distributions and vice versa. The transformations are based on given principles and ensure a consistent transformation to the extent that there is no violation of the formal rules (definitions) connecting probability and possibility when possibility and necessity measures are taken as upper and lower probabilities, and so that the transformation is not arbitrary within the constraints of these rules. Nevertheless, as noted in [START_REF] Dubois | On possibility/probability transformations[END_REF] :

... going from a probabilistic representation to a possibilistic representation, some information is lost because we go from point-valued probabilities to interval-valued ones;

the converse transformation adds information to some possibilistic incomplete knowledge.

This additional information is always somewhat arbitrary.

Given the interpretation of possibility and necessity measures as upper and lower probabilities, a possibility distribution π induces a family P(π) of probability measures. There is not a one-to-one relation between possibility and probability, and a transformation of a possibility distribution π into a probability measure P can therefore only ensure that a) P is a member of P(π); and b) P is selected among the members of P(π) according to some principle (rationale); e.g.

'minimize the information content of P', in some sense.

Analogously, a transformation from a probability measure P into a possibility distribution π can only ensure that A) P(π) includes P; and B) P(π) is selected according to some principle (rationale); e.g. 'minimize loss of information', in some sense.

We will be working with probability densities, and in the following p denotes the probability density associated with a probability measure P.

Different possibility-probability (probability-possibility) transformations have been suggested in the literature. In [START_REF] Dubois | On possibility/probability transformations[END_REF] it is argued that the following should be basic principles for such transformations:

I. The probability-possibility consistency principle

The family P(π) is formally defined as = : ∀ ⊆ , Π , i.e. as the set of probability measures P such that for all events A in the space X on which π is defined, the probability of A is less than or equal to the possibility of A. As suggested in [START_REF] Dubois | On possibility/probability transformations[END_REF] it seems natural to require a transformation to select P from P(π). This is referred to as the probability-possibility consistency principle, formulated as Π , ∀ ⊆ .

II. Preference preservation

A possibility distribution π induces a preference ordering on X, such that π(x) > π(x') means that the outcome x is preferred to x'. A transformation should therefore satisfy

> ′ ⇔ > ( ′).
Several transformations have been suggested based on the two principles above. In the following we briefly review some of these, presenting the continuous versions of their definitions.

The following two principles are described in [START_REF] Dubois | On possibility/probability transformations[END_REF] :

(i) Possibility to probability: The principle of insufficient reason

The principle of insufficient reason specifies that maximum uncertainty on an interval should be described by a uniform probability distribution on that interval. The sampling procedure for transforming a possibility distribution into a probability distribution according to this principle is:

 sample a random value α* in (0, 1] and consider the α-cut level L α* = {x : π(x) ≥ α*}; and

 sample x* at random in L α* .
In the continuous case, the density p t resulting from a transformation of π is given by

= | | ( ) 0 , ( 5
)
where |L α | is the length of the alpha-cut levels of π. To motivate this, note that = () 1 0

.

From step 1 in the sampling procedure above we have p(α) = 1, and from step 2 we have

= 1 | | .
For the integration space we note that p(x|α) = 0 for α > π(x). It can be noted that p t is the centre of gravity of P(π). The transformation in Equation ( 5) applies to upper semicontinuous, unimodal and support-bounded π.

(ii) Probability to possibility: The principle of maximum specificity Define a function h : [l, m] → [m, u], where l, m and u are, respectively, the lower support limit, mode and upper support limit of the probability distribution to be transformed.

Then, the most specific possibility distribution π t (in the sense of minimizing the area under π) that dominates a given probability density p is given by

= ℎ( ) = -∞ + +∞ ℎ( ) = + (ℎ ), (6)
where • = 1 -• and ℎ = max : . The transformation in Equation ( 6) is illustrated graphically in Figure 5. It is interesting to observe that for this transformation, we have

, ℎ = ( , ℎ ) Π( , ℎ = 1,
i.e. the transformation prescribes equality between the necessity of a given α-cut and the probability of the same α-cut. The transformation in Equation ( 6) applies to unimodal, continuous and support-bounded probability densities p. Moreover, in [START_REF] Dubois | Probability-possibility transformations, triangular fuzzy sets, and probabilistic inequalities[END_REF] it is noted that:

This criterion is not necessarily adapted to the transformation of a subjective probability distribution reflecting an expert opinion.

The following transformation has been suggested [START_REF] Dubois | A definition of subjective possibility[END_REF] when the probabilities to be transformed are subjective:

(iii) Probability to possibility: The principle of minimal commitment

The principle of minimal commitment is based on the assumptions that an agent's knowledge is minimal, and that an elicited subjective probability measure is actually induced by a belief function representing the actual state of knowledge of an agent. The principle prescribes selection of the least informative belief function among those associated with a given probability measure. It has been shown [START_REF] Dubois | A definition of subjective possibility[END_REF] that this belief function is unique and consonant, and thus induced by a possibility distribution. The transformation is given in [START_REF] Dubois | Probability-possibility transformations, triangular fuzzy sets, and probabilistic inequalities[END_REF] only for the discrete case:

= min , ,
where ρ i is the probability mass associated with outcome i. According to [START_REF] Dubois | On possibility/probability transformations[END_REF] , the continuous counterpart of Equation ( 7) is

= min ( ), ( ) +∞ -∞ . ( 8
)
The transformation in Equation ( 8) is illustrated graphically in Figure 6. In [START_REF] Dubois | On possibility/probability transformations[END_REF] it is concluded that:

Further research is needed in the continuous case. Especially it is interesting to investigate for which class of pdf and possibility distributions the transformations make sense.

Three approaches for converting probability distributions into 'equivalent' triangular or trapezoidal fuzzy sets are considered in [START_REF] Anoop | Conversion of probabilistic information into fuzzy sets for engineering decision analysis[END_REF] . The transformations involve two steps, namely the transformation of the probability distribution in question into a fuzzy set, which is then transformed again into the 'equivalent' triangular or trapezoidal fuzzy set by curve fitting to a standard distribution class.

(iv) Probability to possibility: Normalization of probability density

The membership function of the fuzzy set resulting from the first step of the transformation is given by

= sup , (9)
i.e. by normalisation of the probability density. For the second step, the following three approaches are considered: least square curve fitting, conservation of uncertainty (in an entropy-sense), and minimization of the Hausdorff distance.

The distribution resulting from Equation ( 9), when taken to be a possibility distribution, does not in general adhere to the probability-possibility principle [START_REF] Dubois | Fuzzy Sets and Systems: Theory and Applications[END_REF] .

Other transformation principles are also referred to in [START_REF] Dubois | On possibility/probability transformations[END_REF] , e.g.:

(v) Possibility to probability: The maximum entropy principle Select the P in P(π) which maximizes entropy. In general, this transformation violates the preference preservation constraint.

Implementation on the fault tree in Section 2

In the present paper, we apply transformations (i)-(iv), though transformation (iv) is only considered as a reference for the possibility distributions resulting from transformations (ii) and

(iii), and unlike in [START_REF] Anoop | Conversion of probabilistic information into fuzzy sets for engineering decision analysis[END_REF] we will work directly with μ p rather than with a standard distribution class fitted to μ p .

Transformations (ii) and (iii) only apply to probability densities with bounded support. In the present work, we only deal with the beta probability density defined on the interval [0,1].

Transformation (i) only applies to unimodal possibility distributions, thus excluding common distribution classes such as the trapezoidal and uniform ones. In the present work we only deal with the triangular possibility distribution, for which Equation ( 5) yields:

2 = - 1 -ln(1 -2 ( )), (10)
noting that |L α | = d + α (c -d) -[b -α (b -c)] = -(d -b)(1 -α).
In the computations we have used the sampling procedure described in Section 4.1, rather than a sampling procedure from the above density.

RESULTS

In this Section we first present the results of applying transformation (i) to the triangular possibility distributions for q 2 , and transformations (ii)-(iv) to the beta probability densities of q 1 .

Then the results of applying the hybrid approach are presented, along with the results of the transformation-based approaches.

In the computations we have considered a = 10 3 alpha-cuts and m = 10 3 Monte Carlo samplings.

Transformation of basic event frequency probability distributions

We first consider the application of transformation (i) to the triangular possibility distribution π 2 of the basic event frequency probability q 2 (Figure 7, top). The probability densities resulting from the transformation (Figure 7, middle) tend to infinity for q 2 = 0.2, i.e. at the core of the transformed possibility distributions; cf. Equation (10). Looking at the cumulative distributions (Figure 7, bottom), we obtain a visual impression of the probability distribution resulting from the transformation as the center of gravity of the family of probability distributions induced by the possibility distribution. We now consider the application of transformations (ii)-(iv) to the beta probability distribution p 1 of the basic event frequency probability q 1 (Figure 8, top) into possibility distributions (Figure 8, middle). As can be seen for the cumulative distributions (Figure 8, bottom), the possibility distributions resulting from transformations (ii)-(iv) serve as bounds for the transformed probability distribution. However, as noted in Section 4.1, adherence to the probability-possibility consistency principle is not generally guaranteed for transformation (iv).

Fault tree: Hybrid approach and transformation-based approaches

The results of applying the hybrid approach and an approach based on transformation (i) are shown together in Figure 9. As can be seen, the probability distribution resulting in the transformation-based approach lies between the lower and upper cumulative distributions of the hybrid approach.

Figure 9 Cumulative distributions for the top event frequency probability q; hybrid approach (solid lines) and probabilistic approach based on transformation (i) (dashed line); high uncertainty (top), medium uncertainty (middle) and low uncertainty (bottom).

In the hybrid approach, the probability distribution of q 1 and the possibility distribution of q 2 are combined to yield what may be interpreted as lower and upper probability distributions, respectively. Hence, the limiting cumulative distributions for q resulting from the hybrid approach can be used to derive lower and upper values of the probability that the top event frequency probability lies in an interval, say [0, u]. For example, for the fault tree studied, in the large uncertainty case, we find that Bel(q ≤ 0.35) = 0.05 and Pl(q ≤ 0.35) = 0.83: thus, it can only be said that the probability P(q ≤ 0.35) is in the interval [0.05, 0.83]. Alternatively, we may consider some percentiles obtained from the two limiting cumulative distributions, say the 95 percentiles Q 95 lower = 0.45 and Q 95 upper = 0.37. The former is defined by derived, upon which a transformation from any representation of uncertainty (possibility, upper and lower probabilities, belief functions etc.) into the pignistic probability function is based.

The focus on decisions and need for expected utility theory and hence probability is also emphasized in [START_REF] Lindley | The probability approach to the treatment of uncertainty in artificial intelligence and expert systems[END_REF] :

Why do we want to study uncertainty? Aside from the intellectual pleasure it can provide, there is only one answer: to be able to make decisions in the face of uncertainty. Studies that do not have the potentiality for practical use in decision making are seriously inadequate. An axiomatic treatment of decision making shows (Savage, 1954; DeGroot, 1970) that maximization of expected utility is the only satisfactory procedure. This uses, in the expectation calculation, the probabilities and these, and only these, are the quantities needed for coherent decision making by a single decision maker. Only the utilities, dependent on the consequences, not on the uncertainties, need to be added to make a rational choice of action. How can one use fuzzy logic or belief functions to decide? Indeed, consider a case where Bel(A) + Bel(not A) < 1. Because you have so little belief in either outcome do you, like Buradin's ass, starve to death in your indecision between A and its negation? Reality demands probability. [START_REF] Lindley | The probability approach to the treatment of uncertainty in artificial intelligence and expert systems[END_REF] Considering that the transformation can be made both ways, from probability to possibility, and vice versa, the question arises: when should the transformation be made into probability, and when into possibility? Emphasizing decision theory and expected utility theory, as seen above, the answer would be always into probability, so long as a decision is involved. Others might argue the conservativeness of making the transformation into possibility, as the possibilistic representation is weaker than the probabilistic one.

The hybrid approach also results in a weaker representation than a purely probabilistic one, yet stronger than a transformation-based possibilistic approach. The latter results in a possibility distribution as output, and hence probability intervals on the form [0, v] or [w, 1], where v and w are numbers between 0 and 1. In the hybrid approach, on the other hand, a probability interval could be of the form [v, w], where v and w are numbers between 0 and 1 and v < w.

Looking at the issue of uncertain representation in the framework of risk analysis, we may distinguish between two goals of a risk analysis:

1. Provide input to an expected utility analysis (alternatively, cost-benefit analysis)

Provide decision support by giving insights into the uncertainties that are involved

If an expected utility analysis (cost-benefit analysis) is the ultimate goal, then probability is required, and the choice is between the pure and transformation-based probabilistic approaches.

A comparison of these is beyond the scope of the present paper.

On the other hand, if the goal is to provide decision support by giving insights into the uncertainties that are involved, and under the premise that uncertainty has been quantified using both probability and possibility, then the choice is between either of the transformation-based approaches and the hybrid approach. The transformation-based approaches add or remove information. This is an unattractive feature given the goal of the analysis. In contrast, the hybrid approach does not alter the uncertainty descriptions given as input. It does, however, introduce a knowledge dependency assumption, as pointed out in [START_REF] Baudrit | Joint propagation of probabilistic and possibilistic information in risk assessment[END_REF] :

The extension principle [...] is equivalent to performing interval analysis on α-cuts and hence assumes strong dependence between information sources (observers) supplying the input possibility distributions, since the same confidence level is chosen to build these αcuts.

As a consequence of the dependence between the choice of confidence levels, one cannot interpret the calculus of possibilistic variables as a conservative counterpart to the calculus of probabilistic variables under stochastic independence. [START_REF] Baudrit | Joint propagation of probabilistic and possibilistic information in risk assessment[END_REF] Computationally, the hybrid approach is more demanding than any of the transformation-based approaches (Table III). From the discussion above, we may conclude that the approaches of uncertainty representation relevant in a given setting depend on the purpose of the risk analysis. On the other hand, the present paper is of an explorative naturefurther research is required to make the possibilistic representation and approaches operational in a risk assessment context. In this respect, we may suggest a methodological development in relation to the hybrid computational framework: firstly, considering that in the context of risk assessment we are interested in uncertainty about the events involvedthe top event in a fault tree analysisit would be interesting to determine lower and upper values of the top event probability, and not only upper and lower cumulative distributions of its frequency probability. Secondly, a more general setting than the one considered here is where the frequency probability concept is introduced for some but not all basic events, and uncertainty about the non-frequency-probability-based events is treated by direct (predictive) epistemic uncertainty assignments. This would be the required setting for unique events, meaning events for which a large population of similar situations cannot be meaningfully defined.

Figure 1

 1 Figure 1 Simple fault tree.

Figure 2

 2 Figure 2 Beta probability densities of q 1 .

Figure 3

 3 Figure 3 Triangular possibility distributions of q 2 .

Figure 4

 4 Figure 4 Possibility distributions of q resulting from Equation (2) and 10 Monte Carlo samplings of q 1 .

Figure 5

 5 Figure 5 Transformation (ii); the value of the possibility function π t at x, π t (x), equals the shaded area.

Figure 6

 6 Figure 6 Transformation (iii); the value of the possibility function π t at x equals the shaded area.

Figure 7

 7 Figure 7 Transformation of triangular possibility distribution (top, solid line) into the associated probability density (middle, dashed line) using transformation (i); corresponding cumulative distributions also shown (bottom).

Figure 8

 8 Figure 8 Transformation of beta probability density (top, solid line) into the associated possibility distribution (middle) using transformation (ii) (dotted line), transformation (iii) (dashed line) and transformation (iv) (dash-dotted line); corresponding cumulative distributions also shown (bottom).

Table III

 III Computation times for the hybrid and transformation-based approaches for the fault tree in Section 2. On a 3 GHz dual core computer with 3.5 GB RAM.

	Method	Computation time a
	Hybrid	105 seconds
	Transformation (i)	0.29 second
	Transformation (ii)	2.19 seconds
	Transformation (iii) 4.20 seconds
	Transformation (iv) 0.99 seconds

a

lower = 0.95, and hence

ACKNOWLEDGEMENTS

The authors are grateful to two anonymous reviewers for useful comments and suggestions to an earlier version of the paper.

The work presented in this paper was performed in part while R. Flage was visiting Politecnico di Milano in the period March -June 2009. He would like to acknowledge Politecnico di Milano and co-authors E. Zio and P. Baraldi for making his stay possible, and memorable. For R. Flage and T. Aven the work on the paper has been funded by the Research Council of Norway through the PETROMAKS research programme. The financial support is gratefully acknowledged.

For P. Baraldi and E. Zio the work has been partially funded by the "Foundation pour une Culture de Securite Industrielle" of Toulouse, France, under the research contract AO2006-01.

In a risk analysis context, Q 95 lower is the interesting quantity since it guarantees that the probability that the true value of q is lower than Q 95 lower , P(q ≤ Q 95 lower ), is greater than or equal to 0.95. Thus, it can be interpreted as a conservative assignment of the percentile with respect to the imprecision arising from the input. If the interval [0, Q 95 lower ] is considered, the hybrid approach also provides an upper value for P(q ≤ Q 95 We see that the interval [0.95, 1] reflects the imprecision about P(q ≤ 0.45) that results from the use of the possibility distribution π 2 as a representation of uncertainty of q 2 .

Applying transformations (ii)-(iv), we see that in the high uncertainty case (Figure 10, top), the lower cumulative distribution resulting from the hybrid approach crosses the lower cumulative distributions resulting from all the transformation-based approaches. In the medium and low uncertainty cases (Figure 10, middle and bottom, respectively), on the other hand, the cumulative distributions resulting from the hybrid approach stay between those resulting from the transformation-based approaches.

Figure 10 Cumulative distributions for the top event frequency probability q; hybrid approach (solid lines) and possibilistic approach based on transformation (ii) (dotted lines), transformation (iii) (dashed lines) and transformation (iv) (dash-dotted lines) ; high uncertainty (top), medium uncertainty (middle) and low uncertainty (bottom).

Table II gives a comparison of the 5 and 95 percentile values of the distribution functions shown in Figure 9 and Figure 10. We see that the bounds are broader in the transformation-based approaches (ii-iv) compared to the hybrid approach. This is due to: a) the transformation of the precise probability distributions taken directly as input in the hybrid approach into the imprecise possibility distributions in the transformation-based approaches, and b) the use of the extension principle for the propagation of the uncertainty from the basic event probabilities into the top event probability in the transformation based approach. The latter introduces a dependence between the possibilistic variables which result in broder bounds [START_REF] Baudrit | Joint propagation of probabilistic and possibilistic information in risk assessment[END_REF] .

DISCUSSION AND CONCLUSIONS

Considering probability and possibility as applied in the present paper, we may distinguish between three different approaches to the treatment of epistemic uncertainties:

1. A pure approach 2. A transformation-based approach

A hybrid approach

By a pure approach is meant that uncertainty about all basic event frequency probabilities is quantified directly using the same representationeither probability or possibility. We do not consider such an approach in the present paper; the premise is that the uncertainty about the basic event frequency probabilities has been quantified using probability for one of the basic events and possibility for the other.

By a transformation-based approach is meant that uncertainty about each basic event frequency probability is quantified using either probability or possibility, and in the end all probability distributions involved are transformed into possibility distributions, or vice versa. By applying such transformations, information is added or removed, depending on which direction the transformation is made. Starting from a possibility distribution, transformation (i) returns a probability distribution, and thus adds to the information that has been given as input.

Transformations (ii) and (iii) return, respectively, the most specific and least committed possibility distributions compatible with a given probability distribution, and thus reduce on the information given as input. Of course, additional assumptions are required, on the form of transformation principles.

What would be the purpose of applying such transformations in a practical decision-making setting? The motivation in [START_REF] Smets | Constructing the pignistic probability function in a context of uncertainty[END_REF] is that decision-making requires expected utility theory, which again requires probability. In [START_REF] Smets | Constructing the pignistic probability function in a context of uncertainty[END_REF] it is distinguished between a so-called credal level, where beliefs are 'entertained' and quantified by any representation, and a so-called pignistic (from greek pignus, meaning a bet, in reference to the betting interpretation of probability) level, where beliefs are used to take decisions, and where probability is required. Based on special bets and some coherence requirements, a so-called generalized insufficient reason principle can be