Uncertainty Analysis of the Estimated Risk in Formal Safety Assessment

Abstract

An uncertainty analysis is required to be carried out in formal safety assessment (FSA) by the International Maritime Organization. The purpose of this article is to introduce the uncertainty analysis technique into the FSA process. Based on the uncertainty identification of input parameters, probability and possibility distributions are used to model the aleatory and epistemic uncertainties, respectively. An approach which combines the Monte Carlo random sampling of probability distribution functions with the a-cuts for fuzzy calculus is proposed to propagate the uncertainties. One output of the FSA process is societal risk (SR), which can be evaluated in the two-dimensional frequency–fatality (FN) diagram. Thus, the confidence-level-based SR is presented to represent the uncertainty of SR in two dimensions. In addition, a method for time window selection is proposed to estimate the magnitude of uncertainties, which is an important aspect of modeling uncertainties. Finally, a case study is carried out on an FSA study on cruise ships. The results show that the uncertainty analysis of SR generates a two-dimensional area for a certain degree of confidence in the FN diagram rather than a single FN curve, which provides more information to authorities to produce effective risk control measures.

1. Introduction

Formal safety assessment (FSA), aimed at enhancing maritime safety, is a structured and systematic methodology. FSA comprises five steps: identification of hazards (step 1), risk analysis (step 2), risk control options (step 3), cost–benefit assessment (step 4) and recommendations for decision-making (step 5). The purpose of the risk analysis in step 2 is a detailed investigation of the causes and initiating events and consequences of the more important accident scenarios identified in step 1. The output from step 2 can be used to identify the high-risk areas so that the effort can be focused to produce effective risk control measures in step 3 of the FSA [1].

There are several methods that can be used to perform a risk analysis, and different types of risk (i.e. risks to people, the environment or property) can be addressed according to the scope of the FSA. Risk analysis methods comprise multivariate statistical techniques [2], event tree models [3], fault tree models [4], risk contribution tree models [5], risk matrixes [6], failure mode and effect analyses [7], fishbone diagrams [8] and Bayesian networks [9]. The scope of the FSA, types of hazards identified in step 1, and the level of data available will all influence which method works best for each specific application.

In most FSA application studies, the event tree model is used to perform the risk analysis and societal risk (SR) is often taken as the risk indicator [10,11]. SR reflects the average risk, in terms of fatalities, experienced by a whole group of people exposed to an accident scenario. It is common to represent SR by the frequency–fatality (FN) curve in a two-dimensional FN diagram, which shows the relationship between the cumulative frequency of fatality events and the number of fatalities. The evaluation of the FN curve is carried out by assessing the cumulative frequency of fatality events and the number of fatalities at the same time [12].

In the context of FSA and the usage of risk analysis, concerns have been raised regarding the accuracy of the methodology, in particular with respect to the uncertainty of input parameters [13]. Without assessing the significance of the uncertainty in the risk analysis process, the reliability of the risk analysis cannot be examined, which may produce risk control measures in low effect or in vain [14,15]. In fact, the uncertainty analysis is required to be carried out in the process of FSA by revised guidelines for FSA for use in the International Maritime Organization (IMO) rule-making process [1]. The IMO is the United Nations specialized agency with responsibility for the safety and security of shipping and the prevention of marine pollution by ships [16]. Although the existence of uncertainties in the FSA process is well recognized, there are few studies which quantitatively address the uncertainties [17]. The purpose of this article is to introduce the suitable uncertainty analysis technique into the process of FSA according to the characteristics of the event tree model, which is used to perform the risk analysis in most FSA application studies.

In general, uncertainty is considered to be of two different types: aleatory and epistemic uncertainties. The aleatory uncertainty arises from randomness due to inherent variability, and the epistemic uncertainty refers to imprecision due to a lack of knowledge or information [18,19]. Both types of uncertainty are very common in the risk analysis process of FSA. For example, accident frequencies can often be considered as parameters with aleatory uncertainty due to inherent variability [20]. In addition, the number of fatalities of each accident scenario, which are obtained by expert elicitation procedures can be taken as parameters with epistemic uncertainty due to incorporating diffuse information by experts [21].

In the recent FSA application studies, both types of uncertainty are represented by means of probability distributions, which are built by the statistical analysis method of Poisson data and expert statements [17]. When sufficiently informative data are available, probability distributions are correctly used to represent the aleatory uncertainty. However, when the available information is very scarce, even if the elicitation of expert knowledge is used, a probabilistic representation of epistemic uncertainty may not be possible [22].

As a result of the limitations associated with a probabilistic representation of epistemic uncertainty, a number of alternative representation frameworks have been proposed. These include fuzzy set theory [23], possibility theory [24], interval analysis [25] and evidence theory [26]. In addition, several approaches have been proposed to propagate the two types of uncertainty, such as a possibilistic Monte Carlo approach [27], a possibilistic-scenario-based approach [28], and an evidence-theory-based hybrid approach [29]. Among them, possibility theory has received growing attention because of its representation power and its relative mathematical simplicity [30]. Therefore, possibility theory is used to characterize the epistemic uncertainty in this article. Correspondingly, the possibilistic Monte Carlo approach is selected to propagate aleatory and epistemic uncertainties in the risk analysis process of FSA.

The possibilistic Monte Carlo approach can be used to address the uncertainty of the cumulative frequency of fatality events calculated by the event tree model, which is one component of the FN curve. For the purpose of examining the reliability of the risk analysis, the uncertainty of the number of fatalities, which is the other component of the FN curve, should also be taken into consideration [31,32]. In order to make it possible to do so, a confidence-level-based SR is proposed, which is represented by a two-dimensional area for a certain degree of confidence in the FN diagram rather than a single FN curve.

An important aspect of modeling uncertainties lies in the appropriate selection of the time window, which is used for the inclusion of data [33]. The traditional empirical approach can lead to either a too conservative or non-conservative estimates of the magnitude of uncertainties based on the arbitrary choice of the length of time window [17]. To reduce the subjectivity of the selection of time window, a method for time window selection is proposed by analyzing the uncertainty and the stability of statistical data.

The contributions of the present study are summarized as follows. First, since uncertainty studies of the risk analysis process of FSA are few, the uncertainty analysis technique is introduced, considering the aleatory and epistemic uncertainties of input parameters. Second, confidence-level-based SR is presented to represent the SR uncertainty in two dimensions so as to identify the high-risk areas in the two-dimensional FN diagram. Third, a method for time window selection is proposed to avoid either too conservative or non-conservative estimates of the magnitude of uncertainties, which is an important aspect of modeling uncertainties.

The remainder of the paper is structured as follows. In Section 2, the risk analysis process of FSA is described. Section 3 discusses the process of aleatory and epistemic uncertainty modeling, time window selection and the representation of SR uncertainty. In Section 4, the uncertainty propagation procedure in the event tree model is described. The case study is discussed and the validation of the proposed methods is made in Section 5. Findings and limitations are provided in the last section.

2. Risk Analysis Process of FSA

The risk analysis process of FSA is carried out by analyzing accident frequencies and accident consequences separately. Accident frequencies can be determined by means of statistical analysis on the historical accident data and accident consequences are often analyzed by the event tree model. When more information about the causes of accidents is provided, the determination of accident frequencies can be performed by the fault tree model, which can show the causal relationship between events which singly or in combination occur to cause the occurrence of a type of accident or unintended hazardous outcome [1]. If the available information about accident frequencies and accident consequences is very scarce, the risk matrix method will be adopted to perform a risk analysis [34]. A risk matrix displays the basic properties, “consequence” and “frequency” of an adverse risk factor and the aggregate notion of risk by means of a graph. As both the consequence and frequency in the risk matrix are measured by a category scale, applications of the risk matrix are limited in practice [35]. As mentioned in the introduction section, the event tree model is used to perform the risk analysis in most FSA application studies according to the level of data available.

The event tree model is an inductive logic and diagrammatic method for identifying the various possible outcomes of a given initial event. The frequency of each particular outcome can be considered as the product of an initial event frequency and the conditional probability of the subsequent events along the related branch. Based on these frequencies of outcomes, one can compute the cumulative frequency of outcomes by summing up all of the frequencies of particular outcomes [36]. The structure of the event tree model, in terms of its branches, is determined by input parameters, which are event frequencies and outcomes caused by a chain of events. Some event frequencies are estimated by sufficient statistical data, which can be statistically verified. The other event frequencies and all outcomes caused by a chain of events are obtained based on qualitative considerations and expert judgement because the available information is very scarce [37].

As mentioned in the introduction section, SR is often taken as the risk indicator in the risk analysis process of FSA. When dealing with SR, outcomes caused by a chain of events and frequencies of these outcomes in the event tree model refer specifically to the number of fatalities (N) and the exact frequencies of N fatalities. It is common to represent SR by the FN curve in the FN diagram, which shows the cumulative frequencies of events causing N or more fatalities on the vertical axis against the number of fatalities (N) on the horizontal axis. Based on the outcomes and their frequencies in the event tree model, the cumulative frequencies of events causing N or more fatalities can be calculated by adding all the exact frequencies of N or more fatalities and plotted in the form of an FN curve [38].

When the number of fatalities (N) is set to 0, there is no need to calculate the frequency of N fatalities because the abscissa of the FN curve starts at the non-zero value of fatalities on the horizontal axis and increases gradually [38]. In other words, the FN curve shows the relationship between the cumulative frequencies of events causing N or more fatalities and non-zero values of fatalities (N) in a two-dimensional diagram. In most FSA application studies, accident consequences are specified by expert judgement considering casualty reports, observation in model tests, as well as numerical investigations because of the uncertainty and the potentiality of the accident occurrence [17]. It should be noted that the focus of this article is on the uncertainty analysis of the estimated risk in FSA studies, which has been carried out. Thus, the event tree model and all its input parameters have already been provided and described in FSA application studies.

3. Handling Uncertainties in the Risk Analysis Process

3.1. Aleatory and Epistemic Uncertainty Modeling

When using the event tree model to perform the risk analysis in step 2 of the FSA, input parameters are event frequencies and outcomes caused by a chain of events. These input parameters can be categorized into two types in the uncertainty analysis. If the uncertainty of input parameters arises from randomness due to inherent variability, these input parameters can be categorized as input parameters with aleatory uncertainty, such as event frequencies estimated by sufficient statistical data [17]. When the uncertainty of the input parameters refers to imprecision due to a lack of knowledge or information, these input parameters can be categorized as input parameters with epistemic uncertainty, such as event frequencies and outcomes obtained by expert judgement [39].

Aleatory and epistemic uncertainties require different mathematical representations. Probability distributions are assigned to represent aleatory uncertainties when there is sufficient information for statistical analysis. In the situation that the available information is very scarce, even if one adopts the elicitation of expert knowledge to incorporate diffuse information, possibility distributions are used to model the epistemic uncertainty.

The probabilistic uncertainty modeling depends upon the selection of the probability distribution of input parameters, which can be propagated using the Monte Carlo technique along the related branch in the event tree model. Since beta distribution is a suitable model for the random behavior of percentages and proportions defined on the interval [0, 1] [40], it was selected as the probability distribution for event frequencies with aleatory uncertainty in this study. Beta distribution is parametrized by two shape parameters, denoted by ${\alpha }_1$ and ${\beta }_1$. The mean (µ) of beta distribution can be expressed by [40]:

$$\mu =\frac{{\alpha }_1}{{\alpha }_1+{\beta }_1}$$

(1)

In order to determine the two parameters of beta distribution, we adopt the assumption that the occurrence of events in the event tree model of FSA is Poisson-distributed [17]. Based on the Poisson distribution assumption, the confidence interval of the number of times an event occurs can be calculated by [41]:

$$\begin{array}{l}{\lambda }_U=\frac{{\chi }_{1-\omega /2}^2(2n+2)}{2}\\ {\lambda }_L=\frac{{\chi }_{\omega /2}^2(2n)}{2}\end{array}$$

(2)

where ${\lambda }_U$ and ${\lambda }_L$ are the upper boundary and lower boundary of the confidence interval for the mean value of a Poisson distribution, respectively; $n$ is the number of times an event occurs in an interval, such as the number of marine accidents; ω is defined as the significance level of the statistics; ${\chi }_{1-\omega /2}^2(2n+2)$ is the $(1-\omega /2)$th quantile of the chi-squared distribution with $(2n+2)$ degrees of freedom; ${\chi }_{\omega /2}^2(2n)$ is the $(\omega /2)$th quantile of the chi-squared distribution with $(2n)$ degrees of freedom; and ${\chi }_{1-\omega /2}^2(2n+2)$ and ${\chi }_{\omega /2}^2(2n)$ can be found in the table of chi-squared distribution.

Then the mean value of event frequencies and the corresponding confidence interval can be estimated by:

$$\begin{array}{c}\theta =n\cdot \frac{1}{S}\\ {\theta }_U={\lambda }_U\cdot \frac{1}{S}\\ {\theta }_L={\lambda }_L\cdot \frac{1}{S}\end{array}$$

(3)

where θ is defined as the mean value of event frequencies; ${\theta }_U$ and ${\theta }_L$ are the upper boundary and lower boundary of the confidence interval of θ, respectively; and S is the product of the number of experiments and an interval of time, such as ship years. It should be noted that the assumption that the occurrence of events is Poisson-distributed does not conflict with the selection of beta distribution to model the aleatory uncertainty of event frequencies, because the objects modeled are different.

Then the two parameters of beta distribution can be determined when the mean value (θ) and bounds of the confidence interval (${\theta }_U$ and ${\theta }_L$) calculated by the Poisson distribution are regarded as the beta distribution’s mean value (µ) and the bounds of the confidence interval under the same confidence level [17]. The confidence interval of the beta distribution, which is parametrized by ω, ${\alpha }_1$ and ${\beta }_1$ can be obtained by the software @RISK [42]. In other words, under the constraints of Equation (1), the two parameters of beta distribution can be estimated roughly through the enumeration method to make the confidence interval of the beta distribution deviate slightly from the confidence interval calculated by the Poisson distribution under the same confidence level (ω).

For input parameters with epistemic uncertainty, we use symmetric triangular distributions to model the epistemic uncertainty. As described in Section 2, values for these input parameters are estimated by expert judgement as crisp values. According to the interpretation of uncertainty in these parameters, value ranges of these input parameters can also be estimated roughly. Based on the crisp values and their approximate ranges, symmetric triangular distributions can be formed by introducing an as small as possible uncertainty. When there are more interpretations of these input parameters, the selection of other possibilistic distributions is possible. Using different possibilistic distributions to model the epistemic uncertainty will lead to relatively small differences in uncertainty quantifications. The symmetric triangular distribution was parametrized by three parameters, denoted by lower limit ${\alpha }_2$, upper limit ${\beta }_2$ and mode ${\gamma }_2$. Also, ${\gamma }_2$ equals the average value of ${\alpha }_2$ and ${\beta }_2$. We used the crisp values of input parameters as the mode ${\gamma }_2$, which has a membership value of one. Then we assigned symmetric triangular distributions to input parameters with epistemic uncertainty according to the interpretation of uncertainty in these parameters.

3.2. A Method for Time Window Selection

Although the length of time window is an important factor for modeling the uncertainty of input parameters, it has received little empirical study. The time window can be taken as the time interval for which historical data are collected [43]. The longer the time window is, the more informative the data for statistical analysis, and the more accurate uncertainty modeling is. There are also indications that more recent statistics represent a more conclusive database than old statistics reflecting recent technical or operational developments, new requirements, or specific arrangements on ships being analyzed. To coordinate the contradiction described above, the uncertainty and the stability of statistical data are used as the two indexes to determine the optimal length of time window, over which the uncertainty of input parameters cannot be estimated too conservatively or non-conservatively.

When event frequencies are listed in time order, a time series can be built up. Through the uncertainty analysis of the time series, each individual value of a time series is no longer an exact value but an interval of possible values, which is defined as an uncertain time series. The confidence interval of each individual value of the time series under a certain level of confidence can be calculated according to Equations (2) and (3).

With respect to the stability of statistical data, the sliding window method is used to implement the segmentation of uncertain time series, which aggregates the relatively concentrative confidence interval. Each of the segments represents a level of event frequencies. The sliding window method takes the first point in time as the first segment and continues to expand until the value at a certain point in time goes beyond the confidence interval of a previous segment. This point in time is taken as the beginning of the next segment. The above process repeats until it comes to the end of the uncertain time series. When a segment only contains one point in time, this point in time should be placed into the adjacent segment which has a smaller difference with the value at this point in time according to the orderliness and the continuity of the time series. After the segmentation of the uncertain time series, the closest segmentation to the research date is taken as the optimal time window used for modeling the uncertainty of the input parameters.

Whether the value at a certain point in time goes beyond the confidence interval of a previous segment is the condition for the segmentation. According to the orderliness and the continuity of the time series, when the value at a certain point in time goes beyond the confidence interval of a previous segment under a certain level of confidence, it means that the value at a certain point in time changes a lot compared with the previous segment. In other words, the value at a certain point in time still changes aside from the random fluctuation of data and it is reasonable to consider this point in time as the beginning of the next segment under a certain level of confidence.

3.3. The Representation of Societal Risk Uncertainty

As described in the introductory section, SR is often taken as the risk indicator in most FSA application studies and it is common to represent SR by the FN curve. The evaluation of the FN curve can be carried out by assessing the cumulative frequency of events causing N or more fatalities, denoted by F(N), and the number of fatalities, denoted by N, at the same time. In order to examine the reliability of the FN curve evaluation, confidence level based SR is put up to consider F(N) and N as fuzzy variables and to represent the SR uncertainty in two dimensions in the FN diagram. Specifically, α-cuts of F(N) and N are taken as the confidence interval in the process of quantifying the SR uncertainty according to the possibility theory.

In the possibility theory, for each set A contained in the universe of discourse U_C of the variable C, the α-cut of C is defined as A_α and it is possible to obtain the confidence level of the interval A_α by the possibility measure $\Pi (A)$ and the necessary measure $N(A)$ from the possibilistic distribution $\pi (c)$ of C, by [18]:

$$\begin{array}{l}\Pi (A)=\underset{c\in A}{\max }\left\{\pi (c)\right\}\\ N(A)=1-\Pi (\overline{A})\forall A\subseteq U_c\\ N(A)\le P\left\{c\in A\right\}\le \Pi (A)\end{array}$$

(4)

If we replace A with A_α, then we have:

$$N(A_a)\le P\left\{c\in A_a\right\}\le \Pi (A_a)$$

(5)

According to the definition of the possibility measure $\Pi (A)$ and the necessary measure $N(A)$, we get $N(A_a)=1-a$ and $\Pi (A_a)=1$. Through proper simplification, we thus have

$$P\left\{c\in A_a\right\}\ge 1-a$$

(6)

As can be seen from Equation (6), A_α can be taken as the confidence interval with a confidence degree of (1 − α). Thus, uncertainties of SR can be quantified as confidence intervals, α-cuts of F(N) and N, on the vertical and horizontal orientation in the FN diagram, respectively. It should be noted that α-cuts of F(N) and N can be plotted on the same FN diagram with the same degree of confidence.

4. Uncertainty Propagation Procedure

Let us consider the event tree model whose output is a function f(x₁, x₂, ..., x_I, y₁, y₂, …, y_J) of (I + J) input variables, which are ordered in such a way that the first I variables are described by random variables (X₁, X₂, …, X_I) and the following J variables are characterized by fuzzy numbers (Y₁, Y₂, …, Y_J). The propagation of such mixed uncertainty information can be performed by the Monte Carlo technique combined with the α-cuts for fuzzy calculus [44]. The uncertainty propagation procedure is described as the following steps:

Step 1. Sample the r-th realization $(x_1^r,x_2^r{,}_{\dots },x_I^r)$ of the random variables (X₁, X₂, …, X_I);

Step 2. Select a possibility value α $\in$ [0:Δα:1] (Δα is the step size, e.g., 0.05) and the corresponding α-cuts $(\underset{\_}{{{\displaystyle y}}_1^a},\overline{{{\displaystyle y}}_1^a}),(\underset{\_}{{{\displaystyle y}}_2^a},\overline{{{\displaystyle y}}_2^a}),\dots ,(\underset{\_}{{{\displaystyle y}}_J^a},\overline{{{\displaystyle y}}_J^a})$ of fuzzy numbers (Y₁, Y₂, …, Y_J);

Step 3. Compute the smallest and largest values of ${{\displaystyle f}}^r({{\displaystyle x}}_1^r,{{\displaystyle x}}_2^r,\dots ,{{\displaystyle x}}_I^r,{{\displaystyle y}}_1^a,{{\displaystyle y}}_2^a,\dots ,{{\displaystyle y}}_J^a,{{\displaystyle z}}_1,{{\displaystyle z}}_2,\dots ,{{\displaystyle z}}_K)$, denoted by $\underset{\_}{{{\displaystyle f}}_a^r}$ and $\overline{{{\displaystyle f}}_a^r}$, respectively, considering all values located within the α-cut interval for each fuzzy number.

Step 4. Return to step 2 and repeat for another α-cut. After having repeated steps 2–3 for all the α-cuts of interest, the fuzzy random realization ${{\displaystyle \pi }}_r^f$ of f(x₁, x₂, …, x_I, y₁, y₂, …, y_J, z₁, z₂, ..., z_K) is obtained as the collection of the values $\underset{\_}{{{\displaystyle f}}_a^r}$ and $\overline{{{\displaystyle f}}_a^r}$;

Step 5. Return to step 1 to generate a new realization of the random variable. An ensemble of realizations of fuzzy intervals $({{\displaystyle \pi }}_1^f,{{\displaystyle \pi }}_2^f,\dots ,{{\displaystyle \pi }}_r^f)$ is obtained, where r is the number of realizations for random variables (X₁, X₂, …, X_I);

For each value of α, an imaginary horizontal line is drawn. This line crosses each of the individual fuzzy intervals $({{\displaystyle \pi }}_1^f,{{\displaystyle \pi }}_2^f,\dots ,{{\displaystyle \pi }}_r^f)$ twice, and therefore $([\underset{\_}{f_a^1}\overline{f_a^1}],[\underset{\_}{f_a^2}\overline{f_a^2}],\dots ,[\underset{\_}{f_a^r}\overline{f_a^r}])$ is obtained. The confidence interval of f(x₁, x₂, …, x_I, y₁, y₂, …, y_J, z₁, z₂, …, z_K) for the confidence value (1 − α) can be determined by a $(\alpha /2)$ probability of getting lower and higher values of $(\underset{\_}{f_a^1},\underset{\_}{f_a^2},\dots ,\underset{\_}{f_a^r})$ and $(\overline{f_a^1},\overline{f_a^2},\dots ,\overline{f_a^r})$, respectively [45].

5. Case Study

The approaches for uncertainty modeling and propagation illustrated in Section 3 and Section 4 have been applied to the risk analysis of cruises in the FSA report from the European Maritime Safety Agency [17] and the FSA proposal for cruise ships by Denmark [20] (hereafter both of the reports are called the FSA report for cruises).

5.1. The Event Tree Model

From the statistical analysis of the historical cruise accidents, it is noted that the risk level is dominated by collision, grounding and fire/explosion scenarios resulting in the loss of lives. Therefore, the event tree in the FSA report for cruises, which contains three types of cruise accidents is used and shown in Figure 1.

As can be seen from Figure 1, event frequencies and consequences are represented by notations. The input parameters of the event tree model include all the notations in Figure 1 except frequencies of fatalities (F1–F49), which are calculated as the product of initial event frequency and conditional probability of the subsequent events along the related branch. As discussed in Section 2, input parameters are estimated based on the informative data available or on expert judgement, which are provided and described in the FSA report for cruises.

5.2. Time Window Selection

The method for time window selection is only applied to the sum of the number of collisions, that of grounding and that of fire/explosion. No similar analysis is carried out separately in this study because the number of accidents in each casualty type is relatively small. Applying the method to the casualty type separately will reduce statistical reliability.

The number of cruise accidents and cruise ships for each year 2001–2012 are provided in the FSA report for cruises. Therefore, the accident frequency for cruises for each year 2001–2012 and the corresponding confidence interval for the confidence value 0.9 can be calculated by Equations (2) and (3). The accident frequencies and boundaries of the confidence interval are represented by short dashes and line segments in Figure 2, respectively. To represent the change of accident frequencies more vividly, the upper boundaries and lower boundaries of the confidence interval are connected with a line.

The sliding window method is used to implement the segmentation of uncertain time series of accident frequencies in Figure 2. Firstly, the year 2001 is taken as the first segmentation. According to Figure 2, the accident frequencies of the year 2001 and the year 2002 were 0.0382 and 0.0533, and the confidence interval of the first segmentation was [0.0166 0.0754]. Since the accident frequency of the year 2002 was in the confidence interval of the first segmentation, it was placed into the first segmentation. Based on Equations (2) and (3), the confidence interval of the first segmentation was changed to [0.0284 0.0709]. As the accident frequency of the year 2003 was 0.0278, which goes beyond the confidence interval of the first segmentation, the year 2003 becomes the beginning of the next segmentation. The above process repeats until it comes to the end of an uncertain time series.

After the segmentation of uncertain time series, we find that there is a segment that only has the year 2010. According to Section 3.2, the year 2010 should be placed into the previous segment, which has a smaller difference than the accident frequency of the year 2010. Finally, four segments were determined, which were 2001–2002, 2003–2004, 2005–2010, and 2011–2012. As shown in Figure 3, each segment is represented by a rectangle. The closest segment to the research date, 2011–2012, was taken as the optimal time window used for modeling the uncertainty of accident frequencies.

In order to verify its superiority, the method proposed was compared with the traditional empirical approach, which extends the length of time window as far as possible. When applying the traditional empirical approach, the most recent twelve years (2001–2012) were selected as the statistical time window. Then the accident frequency and its confidence interval for the confidence value 0.9 were calculated as 0.0375 and [0.0314 0.0445] according to Equations (2) and (3). As can be seen in Figure 3, the most recent two years (2011–2012) were selected as the optimal statistical time window in this study. The corresponding accident frequency and its confidence interval for the same confidence value 0.9 were calculated as 0.0117 and [0.0051 0.0231] based on Equations (2) and (3). The size of the confidence interval can be considered as the outcome of the uncertainty quantification. It should be noted that the more informative data there are for uncertainty modeling, the smaller the size of the confidence interval becomes, and the more the accurate uncertainty modeling is. Although more informative data are used to model the uncertainty of the accident frequency and the size of the confidence interval is slightly smaller, the traditional empirical approach does not take into account that the accident frequency continued to decline in the most recent six years (2007–2012), which can be seen in Figure 2. Thus, the time window obtained by the method proposed in this study is a more appropriate time interval for modeling the uncertainty of the accident frequency because recent developments in the ships being analyzed are reflected as much as possible while not enlarging the size of the confidence interval much.

5.3. Uncertainty Modeling of Input Parameters

All the input parameters in the event tree model can be categorized into two types in the uncertainty analysis based on the method used for estimating these input parameters. When there are sufficient statistical data to estimate them, input parameters can be categorized as input parameters with aleatory uncertainty. If input parameters are obtained by expert judgement, they can be considered as input parameters with epistemic uncertainty. As discussed in Section 3.1, the aleatory and epistemic uncertainties are modeled by probability distributions and possibility distributions, respectively. Although all the input parameters have uncertainties, only 65 input parameters are considered in the process of uncertainty modeling because they are in the related branches of the event tree, which correspond to non-zero values of fatalities.

There are 14 input parameters which are categorized as input parameters with aleatory uncertainty and one of them is the input parameter P11, which denotes the probability of a cruise ship struck when it is involved in a collision accident. According to the FSA report for cruises, 32 cruise ships were struck when 62 cruise ships were involved in collision accidents in the time window (2011–2012). Therefore, the value of P11 was estimated as 0.516. When the values given above were put into Equations (2) and (3), the confidence interval of P11 could be calculated as [0.376, 0.693] for the confidence value 0.9. Then ${\alpha }_1$ and ${\beta }_1$ of the beta distribution could be roughly estimated at 11 and 10.3, respectively, using the software @risk to make the mean value of beta distribution equal to 0.516 and its confidence interval deviate slightly from [0.376, 0.693], according to Section 3.1. The same computations were performed to build the beta distributions of other input parameters with aleatory uncertainty.

Table 1. The parameters of beta distributions.

Notations of Input Parameters	Parameters of Beta Distribution (${\mathit{\alpha }}_1$, ${\mathit{\beta }}_1$)
P1	(0.3, 218.5)
P11	(11, 10.3)
P14	(2.8, 1.5)
P2	(2.2, 413.6)
P21	(44, 32.4)
P24	(3.4, 39.1)
P25	(7, 7.3)
P29	(4, 1.5)
P212	(6.7, 1.5)
P214	(3.3, 1.3)
P217	(3.6, 3.3)
P224	(31.5, 31.1)
P230	(15, 3.8)
P3	(0.3, 218.5)

Explanations of input parameters can be found in the event tree in Figure 1.

reports the parameters of the beta distributions of input parameters with aleatory uncertainty.

With respect to input parameters with epistemic uncertainty, 51 input parameters were identified. P19 is one of the input parameters with epistemic uncertainty, which represents the probability of a cruise ship sinking when it is involved in collision accidents. The value of P19 is provided as 0.14 by expert judgement in the FSA report for cruises and it is set to the mode ${\gamma }_2$ of symmetric triangular distribution. Since ${\gamma }_2$ is equal to the average value of ${\alpha }_2$ and ${\beta }_2$, the parameters of the symmetric triangular distribution of P19 are simply set as (0, 0.14, 0.28). The same processes of possibilistic uncertainty modeling were executed to build the symmetric triangular distribution of other input parameters with epistemic uncertainty. The parameters of the symmetric triangular distribution of input parameters with epistemic uncertainty are reported in

Table 2. The parameters of symmetric triangular distribution.

Notations of Input Parameters	Parameters of Symmetric Triangular Distribution (${\mathit{\alpha }}_2$, ${\mathit{\gamma }}_2$, ${\mathit{\beta }}_2$)
P19, P111	(0, 0.14, 0.28)
P113	(0, 0.18, 0.36)
P15	(0, 0.33, 0.66)
P17	(0, 0.071, 0.142)
P233, P237	(0, 0.087, 0.174)
P235, P239	(0, 0.083, 0.166)
P241, P243, P245, P247	(0, 0.18, 0.36)
P27	(0.62, 0.81, 1)
P219	(0.7, 0.85, 1)
P222	(0, 0.15, 0.3)
P228	(0, 0.33, 0.66)
P32	(0, 0.06, 0.12)
P33	(0, 0.03, 0.06)
P34	(0, 0.01, 0.02)
P37	(0.6, 0.8, 1)
P312, P315	(0, 0.4, 0.8)
P310, P313, P316	(0, 0.3, 0.6)
P311, P314, P317	(0, 0.3, 0.6)
P322	(0.6, 0.8, 1)
N1, N23, N29	(0.6, 0.8, 1)
N49	(0.05, 0.075, 0.1)
N2, N5, N10, N11, N16, N17, N24, N30	(0.025, 0.05, 0.075)
N47	(0.005, 0.025, 0.045)
N48	(0.00125, 0.005, 0.00875)
N44,N45,N46	(0.0005, 0.00125, 0.002)
N40,N41,N42,N43	(0, 0.0005, 0.001)

Explanations of input parameters can be found in the event tree in Figure 1. Parameters of symmetric triangular distributiosn of fatalities denotes the percentages of people on board died.

.

5.4. Uncertainty Propagation

Before the propagation of aleatory and epistemic uncertainties in the event tree model, the general method with crisp input parameters (hereafter called the general method) was processed as a comparison. According to the event tree model in the FSA report for cruises, the exact frequency of N fatalities per accident category can be obtained, which is shown in

Table 3. Frequency of N fatalities per accident category and the cumulative frequency F(N) for cruise ships.

N (Fatalities)	Collision (1/ship*year)	Grounding (1/ship*year)	Fire/Explosion (1/ship*year)	Total (1/ship*year)	F(N) (1/ship*year)
3	-	-	4.92 × 10−5	4.92 × 10−5	3.04 × 10−4
8	-	-	3.25 × 10−5	3.25 × 10−5	2.55 × 10−4
34	-	-	1.06 × 10−5	1.06 × 10−5	2.22 × 10−4
168	-	-	1.25 × 10−5	1.25 × 10−5	2.12 × 10−4
337	2.13 × 10−5	1.61 × 10−4	-	1.82 × 10−4	1.99 × 10−4
505	-	-	2.65 × 10−6	2.65 × 10−6	1.74 × 10−5
5384	3.17 × 10−6	1.17 × 10−5	-	1.47 × 10−5	1.47 × 10−5

. In order to plot the FN curve of cruise ships, the cumulative frequencies F(N) causing N or more fatalities needs to be derived by adding all the exact frequencies of N or more fatalities, which are also shown in Table 3.

After probability distributions and possibility distributions were assigned to the input parameters, the uncertainty propagation approach was applied to the event tree model. With respect to the input parameters with aleatory uncertainty (X₁, X₂, …, X_I), the sampling realization size was set to 1000. For each of these realizations, 21 α-cut values (Δα = 0.05) were set for the input parameters with epistemic uncertainty (Y₁, Y₂, …, Y_J). The ensemble of fuzzy interval realizations $({{\displaystyle \pi }}_1^f,{{\displaystyle \pi }}_2^f,\dots ,{{\displaystyle \pi }}_{1000}^f)$ for scenarios where 80% of people on board died in the event tree is taken as an example to demonstrate the process of the uncertainty propagation, which is illustrated in Figure 4.

When α is set to 0.1 in Figure 4, an imaginary horizontal line can be drawn that crosses each of the individual fuzzy intervals $({{\displaystyle \pi }}_1^f,{{\displaystyle \pi }}_2^f,\dots ,{{\displaystyle \pi }}_{1000}^f)$ twice, and therefore $([\underset{\_}{f_{0.1}^1}\overline{f_{0.1}^1}],[\underset{\_}{f_{0.1}^2}\overline{f_{0.1}^2}],\dots ,[\underset{\_}{f_{0.1}^{1000}}\overline{f_{0.1}^{1000}}])$ is obtained. Then the confidence interval of the cumulative frequencies F(N) of scenarios where 80% of people on board died can be determined as [8.36 × 10⁻⁷, 1.12 × 10⁻⁴], for the confidence value 0.9 when there is a 5% probability of respectively getting lower and higher values of $(\underset{\_}{f_{0.1}^1},\underset{\_}{f_{0.1}^2},\dots ,\underset{\_}{f_{0.1}^{1000}})$ and $(\overline{f_{0.1}^1},\overline{f_{0.1}^2},\dots ,\overline{f_{0.1}^{1000}})$. In addition, the confidence interval of the number of fatalities for scenarios where 80% of people on board died is calculated as [4173, 6595] for the confidence value 0.9 when 6730 people are assumed on board according to the FSA report for cruises.

The process for determining the overlapping areas of the rectangle, which represents two-dimensional uncertainty in the FN diagram, is depicted in Figure 5, Figure 6 and Figure 7. Figure 5 represents the uncertainty of the cumulative frequencies F(N), whereas Figure 6 represents the uncertainty of the cumulative frequencies F(N) and the number of fatalities C. Figure 7 shows the final result of two-dimensional uncertainty in the FN diagram, in which confidence boundaries are denoted by dot dash lines. FN criteria are also plotted in Figure 5, Figure 6 and Figure 7, which can be considered as reference FN curves. Based on the comparison with the FN criteria, the FN curve can be evaluated. The FN criteria include the upper criterion and the lower criterion, which are used and provided in the FSA report for cruises. If any part of the FN curve crosses the upper criterion, it indicates that the part of the FN curve is intolerable, which needs to be brought down by risk control measures. The FN curve derived from the general method with crisp input parameters is also shown in Figure 5, Figure 6 and Figure 7, and is denoted by the solid line.

The following observations can be drawn from Figure 7. First, the general method provides a single FN curve, whereas the proposed methods generate a two-dimensional area for a certain degree of confidence in the FN diagram, which provides more information to authorities in the process of producing risk control measures. Second, the FN curve derived from the general method lies within the boundaries of the two-dimensional uncertainty area and they have similar variation trend. It indicates the good application of the proposed methods in the risk analysis process of the FSA. Third, the FN curve is evaluated and regarded as tolerable because it lies wholly below the upper criterion. However, two parts of the uncertainty area cross the upper criterion, as can be seen in Figure 7. It means that more detailed analysis is deserved in these areas so as to ensure the reliability of the risk assessment.

6. Conclusions

Uncertainty analysis has been conceived as a necessary step in the FSA process. In this article, uncertainty analysis technique was introduced considering the aleatory and epistemic uncertainties of the input parameters. In addition, confidence-level-based SR was proposed to represent the uncertainty of SR in two dimensions when identifying the high-risk areas in the two-dimensional FN diagram. Considering that accurate uncertainty modeling lies in the appropriate selection of the time window, a method for time window selection is proposed, which provides the theoretical foundation and reduces the subjectivity for determining the length of time window in the uncertainty modeling process. Finally, a case study was carried out on the FSA study on cruise ships. The proposed methods suit the risk analysis process of the FSA and can provide more information to authorities so that the effort can be focused to produce effective risk control measures.

A word of caution is in order with respect to the assumptions underlying the uncertainty analysis procedure. First of all, the uncertainty propagation method is developed by assuming independence among the probabilistic and possibilistic variables, and independence within the probabilistic variable set. Then dependence is introduced among the possibilistic variables, because the same confidence level in possibilistic variables is used to build the α-cuts. These assumptions are worth further investigation both from the theoretical and practical points of view.