<figure><img src="image_1.png" /></figure>

HAL
open science

# Adaptation of the Rules of the Models of Games with Nature for the Design of Safety Systems

Adrian Gill, Piotr Smoczyński

► To cite this version:

Adrian Gill, Piotr Smoczyński. Adaptation of the Rules of the Models of Games with Nature for the Design of Safety Systems. 2nd International Conference on Information Technology in Disaster Risk Reduction (ITDRR), Oct 2017, Sofia, Bulgaria. pp.67-80, 10.1007/978-3-030-18293-9_7. hal-02280314

HAL Id: hal-02280314

https://inria.hal.science/hal-02280314

Submitted on 6 Sep 2019

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Adaptation of the Rules of the Models of Games with Nature for the Design of Safety Systems

Adrian Gill and Piotr Smoczyński

Poznan University of Technology, Pl. Skłodowskiej-Curie 5, 60-965 Poznań, Poland
adrian.gill@put.poznan.pl

**Abstract.** The article presents a manner of formulating the problem of designing safety systems in terms of decision-making problems solved with the use of the models of the so-called games with nature. The models of this type are very frequently used to make decisions under conditions of uncertainty. The situation also occurs in the process of designing safety systems. For the purposes of solving the problem, the appropriate understanding of the basic components of the models of games with nature, i.e. the game strategy and the state of nature, was assumed. In this context, a definition of a system and a safety system was provided, along with an interpretation of the relationships between safety system elements (risk reduction measures) and domain elements (hazard factors/sources, hazards), on account of which these systems are designed. The specificity of the functioning of safety systems also required a modification of the decision rules applied within the models used. The modification was illustrated with the example of Wald's rule. A general concept of formulating the problem of designing safety systems as a decision-making problem was presented, along with the general algorithm of selecting risk reduction measures for safety systems with the use of the modified rules of the models of games with nature. Next, a mathematical model of the research problem was provided, including: creation of the risk reduction measure efficacy matrix, creation of the hazard source – hazard relationship matrix, determination of the payoff matrix, and the modification of decision rules. Usually, there is a need to select more than one risk reduction measure. An already developed original concept of sequential selection of these measures was used. The application of the rule adaptation proposed here was illustrated with an example of a fire protection system for railway vehicles. Hazard sources were identified and hazards related to electrical systems in railway vehicles were formulated. A list of examples of risk reduction measures which may form a safety system was presented.

**Keywords:** safety systems, games with nature, risk reduction measures

## 1 Introduction

The need for the selection of the appropriate combination of risk reduction measures in reference to potential states of analysis domains poses a certain decision-making problem for the safety system designer. Their ill-considered selection may lead to the creation of extensive systems involving high maintenance costs or make it impossible to
bring the risk value to an acceptable level. A reasonable approach is to make the choice based on the achieved ‘goodness’ level of the solution. For instance, it would be reasonable to achieve a solution which changes the degree of exposures coming from hazard factors (hazard sources) in the most favourable way or makes it possible to achieve the highest possible degree of risk reduction.

The problem lies in searching for a solution if the probabilities (probability distribution) of hazard factor occurrence or activity are unknown. We may assume that there is – as far as this activity is concerned – a certain kind of uncertainty under-stood (as cited in [17]) as a kind of randomness, whose probability distribution is unknown. In this case, the selection of risk reduction measures is paramount to making a decision under conditions of uncertainty.

It is possible to solve the problem with the use of mathematical models describing conflict situations, i.e. the class of models of the so-called games with nature [12, 17]. This requires the adaptation of the decision rules used within these models to the distinctive decision-making problem.

The article presents the manner of adapting known models of games with nature to the process of designing safety systems. It consists in formulating the decision-making problem in the appropriate way and introducing a certain logical condition to the decision rules. The modification of the rules was illustrated with the example of Wald’s rule. Moreover, an already developed original concept of sequential selection of risk reduction measures presented in [5] was used.

# 2 Materials

## 2.1 HS-H-RRM relationships

The basis for the solutions presented herein is the interpretation of the relationships between the main elements of the hazard identification process, i.e. between hazard sources (HS; also called hazard factors or risk sources [2]), hazards (H), and safety system elements, i.e. risk reduction measures (RRMs).

The term ‘hazard’ is crucial for risk management. However, its meaning is not well established. Mostly, a hazard is understood as a state or condition of the analysis domain, leading to loss or damage [8, 21]. The definitions generally indicate the need to identify the causes (sources) of hazards and the damage related to hazard activation. The international standard for machinery safety, EN-ISO 12100:2010, states that ‘the term hazard can be qualified to define its origin (mechanical hazard, electrical hazard) or the nature of the potential harm (electric shock hazard, cutting hazard, toxic hazard, fire hazard)’.

It could be pointed out that each hazard can be attributed to one or several different causes (sources), and that all the causes must occur at the same time to activate the hazard. Thus we get a concept of hazard sources as a general term, which we use in this paper to express the causes of hazards. A hazard is therefore a coincidence of a specific combination of hazard sources, however its occurrence – hazard activation – is not a certain event. We understand the term hazard source as each physical, chemical, biological, psychophysical, organisational or personal formation (HS definition – among
others in [6, 13]), whose presence in the given analysis domain or whose condition or properties are the cause for the formulation of a hazard.

Identifying hazard sources, formulating hazards, and showing the amount of damage (losses) that may emerge as a result of hazard activation is called hazard identification [6, 21]. In order to formulate a hazard, information concerning just one source is enough in most cases. However, hazard formulation usually becomes possible only on the basis of knowledge about several hazard sources. Fig. 1 presents a risk analyst who looks at the analysis domain, realises the occurrence of two hazard sources (HS1 and HS2), and formulates a hazard (H) as a possibility of the occurrence of consequences (losses or damage) when the third hazard source emerges (HS3).

<figure><img src="image_3.png" /><figcaption>Fig. 1. Graphical interpretation of the relationships between the basic elements of hazard identification – hazard sources (HS), the hazard (H), and the consequences of hazard activation.</figcaption></figure>

## 2.2 Safety systems

The system theory says that a system exists when there are interdependent but related components achieving a valued pre-set objective or purpose or function [11]. The systems may be supported further by principles and based on the theories and information applicable to the situation. Therefore, a safety system (SS) can be defined as a set of cooperating elements, which form a unit oriented towards purpose [4]:

$$SS = D(SSC, A, R), SSC = [SSC_1, ..., SSC_n], A = [A_1, ..., A_m], R = [R_1, ..., R_r], \quad (1)$$

where: SSC is a set of safety system components, A is a set of attributes (properties), R is a set of relationships between the safety system components and the attributes, D is an entity – existing whole (not necessarily space-time, often in the world of ideas or symbols). The definition of a safety system provided by [21] indicates what an SSC may be and suggests what its attributes are: ‘A system is a combination of people, procedures, facilities, and/or equipment all functioning within a given or specified working environment to accomplish a specific task or set of tasks’.
When the aim of the system is the rationalisation of the risk of hazards in analysis
domains so that an acceptable or tolerable risk level is provided for the hazards identi-
fied within them, it can be called a safety system.

Safety system elements can perform certain special functions – the so-called safety
functions (SFs). In practice, this consists in these elements having an impact on the
factors whose presence, condition or properties cause the formulation of hazards. The
impact occurs in various ways. Defining the safety function, Harms-Ringdahl [9] states
that: ‘A safety function is a technical, organisational or combined function that can
reduce the probability and/or consequences of accidents and other unwanted events in
a system’.

The effect of the impact of safety system elements is therefore a reduction of one or
more values which are the components of risk measures. This is why these elements
are called risk reduction measures. It should be added that the impact of these measures
usually comes down to the elimination of hazard sources, breaking their impact path-
way (i.e. isolating the source or isolating the receiver on which the source has an im-
pact), and informing about hazard source activity. In reference to the exposure limiting
measures, the term ‘barrier’ is used (for instance according to the Commission Imple-
menting Regulation (EU) 2015/1136): ‘technical, operational or organizational risk
control measure outside the system under assessment that either reduces the frequency
of occurrence of a hazard or mitigates the severity of the potential consequence of that
hazard’.

In most cases, risk reduction measures are also systems and in this context, we can
speak of safety system subsystems.

## 2.3 Games with nature

Decision-making under conditions of uncertainty is an important research problem, in
particular in economic sciences, attempting to describe the behaviour of market partic-
ipants. A certain variant of this issue are the so-called ‘games with nature’, in which
one of the ‘players’ is the natural environment [24]. In models of this type, the so-called
game strategy or decision-maker (player) strategy is selected. A strategy is, in general,
one of the available ways of proceeding in the given situation. It has become customary
to call such situations – created by the environment (nature) – states of nature.

The game strategy is selected in accordance with one or several decision rules:
Wald's rule, Savage's rule, Hurwicz's rule, Bayes' rule [25, 26]. The strategy selection
decision is made based on the so-called payoff matrix (benefit matrix, etc.). It is as-
sumed that the decision-maker is able to identify the acceptable decision area, possible
states of nature, and achievable results. The decision-maker does not know the proba-
bility distribution of the occurrence of the given states of environment in the future or
does not want to use the available knowledge.

**Wald's rule.** One of the several generally known rules used in ‘games with nature’ is the strategy of minimising the maximum risk, proposed by Wald [22] in the 1940s. In
spite of the passage of time, it is still being developed [23] and applied, both in economics [19] and to solve more thematically distant problems, e.g. in residential building construction [20].

Assuming that the choice is made based on Wald's rule, the smallest value (minimum payoff) should be determined for each strategy (each line) of the payoff matrix, and then the strategy for which the minimum payoff/benefit is the biggest should be selected. A strategy may be considered as optimal with respect to Wald's criterion if:

$$g_w = \max_i \{ \min_j g_{ij} \} \qquad (2)$$

where w denotes the number of the strategy considered to be optimal.

Decision-making in accordance with Wald's rule may involve two stages:

Step 1 – The lowest possible payoff (lowest possible benefit), i.e. the minimum for each line, is selected for each strategy.

Step 2 – Out of all the strategies, strategy number w is selected, for which the payoff value is the maximum out of the possible lowest values of this payoff.

# 3 Results

## 3.1 General concept of the problem

The key issue is to formulate the problem of selecting risk reduction measures as a decision-making problem (conflict situation) possible to solve with the use of the models of games with nature. It was therefore assumed that the game strategy will be the application of the appropriate RRM having an impact on the hazard source. States of nature are considered to be hazards identified in the analysis domain. In this case, the selection of the risk reduction measure is treated as a selection of one of the game strategies. In the context of supporting the process of selecting these measures with decision-making procedures, the following assumptions were formulated:

- hazard risk reduction measures are known,

- hazard sources present in the domain analysis are known,

- the efficacy of the hazard risk reduction measures is known,

- a hazard risk reduction measure has an impact on one or more hazard sources present in the domain analysis,

- the degree of efficacy of the hazard risk reduction measure assumes values from the set of positive real numbers within the range of $\langle 0; 1 \rangle$,

- a hazard is formulated as a coincidence of hazard sources,

- one hazard source may be the cause of identification of several hazards,

- the number of risk reduction measures and the number of hazard sources is finite,

- the aim of the safety system under design is to limit the risk of all the identified hazards,

- no other risk reduction measure is selected for a hazard whose sources are already being limited by a different measure.
Figure 2 presents the general algorithm of risk reduction measure selection according to the proposed concept. A detailed description of the individual steps of this algorithm was presented further in the article (section 3.2).

<figure><img src="image_4.png" /><figcaption>**Fig. 2.** General algorithm of risk reduction measure (RRM) selection for safety systems with the use of modified rules of games with nature.</figcaption></figure>

The basis for the concept is the assumption that the payoff obtained by the designer of the safety system is the appropriate risk reduction. The risk reduction values obtained in the case of the selection of the *i*-th RRM and the occurrence of the *j*-th hazard source were therefore adopted as elements of the payoff matrix. In order to determine this matrix, information about the efficacy of risk reduction measures and information about the connections between hazard sources and hazards is needed. It is proposed that this information be presented also in the form of appropriate matrices.

Usually, due to a considerable number of hazard sources or the level of risk of these hazards, there is a need to select more than one risk reduction measure. In accordance with the concept developed and presented in [5], this may be done in two ways. The first one consists in the appropriate formulation of the decision-maker's strategy in the form of a specific combination of measures. The second one consists in selecting the
game strategy several times, taking into consideration the selected rule or several different decision rules. The second way will be used in this paper.

## 3.2 Mathematical model

**Creation of the RRM efficacy matrix.** Let E be a matrix mapping the possible actions of the designer of the safety system with regard to the hazard sources identified within the analysis domain. Matrix E is a rectangular matrix with the following form:

$$E = [e_{ij}]_{m \times n}, i = 1, 2, \dots, m; j = 1, 2, \dots, n \quad (3)$$

where $e_{ij}$ denotes the efficacy of the i-th RRM with regard to the j-th hazard source.

The efficacy of the RRM may be expressed as a combination of two variables [18]:

- the probability of RRM effect/activation,

- hazard source vulnerability to the effect of the given RRM.

It should be noted that the probability of the RRM having an effect is independent from the hazard source affected by the given RRM. And vulnerability is a feature of the hazard source and is understood here in the manner proposed in [1] as an extent to which the given RRM may positively impact this source.

The above definition may also be presented in a more illustrative way. For example, if we apply a certain RRM to 10 identical hazard sources whose vulnerability to this RRM equals 0.7, then statistically, seven hazard sources will be neutralised and three will remain active.

Drawing on the above explanations, the following events may be defined:

- A – RRM activation,

- B – positive reaction of the hazard source to the effect of the RRM,

- C – RRM fulfilling its function.

In the statistical sense, event B depends on event A. If $P(B|\bar{A}) = 0$, then the probability of the product of events A and B equals [3]:

$$P(A \cap B) = P(C) = P(B|A) \cdot P(A). \quad (4)$$

Assuming that:

$$P(A) = p \quad \text{and} \quad P(B|A) = v, \quad (5)$$

value $e_{ij}$ – of the efficacy of a single RRM affecting the given hazard source may be expressed with the following formula:

$$e_{ij} = p_i \cdot v_{ij} \quad (6)$$

where $p_{ij}$ denotes the probability of the effect of the i-th RRM, $v_{ij}$ denotes the vulnerability j-th hazard source to the effect of the i-th RRM.
**Creation of the hazard source (HS) – hazard (H) relationship matrix.** Because the previously specified relationships occur between hazard sources and hazards (see section 2.1), matrix **H** – a matrix of relationships between HS – H elements may be determined. Therefore, let matrix **H** assume the following form:

$$H = [r_{jk}]_{n \times l}, \quad j = 1, 2, \dots, n; \quad k = 1, 2, \dots, l \qquad (7)$$

where $r_{jk}$ denotes the value of risk determined for the k-th hazard.

For the decision-making purposes related to the optimisation of the structure of safety systems, the form of risk measure as a value of the following function [13] is assumed:

$$R: H \to V \subset \mathbf{R}, \qquad (8)$$

which assigns values from a certain subset V of a set of real numbers **R** to hazards from set H.

The mathematical risk measure model usually includes several components whose values (levels) are determined in the risk analysis process according to specific criteria. In accordance with the typical definitions of risk (see for example [2, 10, 16, 21]), the components usually belong to two groups – a group of components expressing the possibility of the so-called hazard activation or materialisation and a group of components expressing losses after the activation of the hazard [14]. When the levels of all the risk components are determined, the total risk of the k-th ($k = 1, 2, \dots, l$) hazard may be notated as follows:

$$R(h_k) = f_1(r_1(h_k), r_2(h_k), \dots, r_m(h_k)), \quad k = 1, 2, \dots, l. \qquad (9)$$

where $r_i(h_k)$ is the i-th component of the risk of the k-th hazard.

So assuming one of the typical forms of the risk function and the fact that the elimination of a single hazard source is enough to not activate the hazard, value $r_{jk}$ may be determined as follows:

$$\bigvee_{j=1,2,\dots,n} \bigwedge_{k=1,2,\dots,l} r_{jk} = f(p_k, s_k) \Leftrightarrow r_{jk} = p_k \cdot s_k \qquad (10)$$

where: $p_k$ is the value of the probability of activation of the k-th hazard, $s_k$ is the value of the results (damage/losses) of the activation of the k-th hazard.

If the events of the occurrence or activity of hazard sources are independent, then value $p_k$ may be determined as follows:

$$p_k = \prod_{j}^{n} q_{jk} \qquad (11)$$

where $q_{jk}$ is the probability of the occurrence or activity of the j-th hazard source of the k-th hazard.
**Payoff matrix determination.** Let matrix **G** be the payoff matrix (benefit matrix, etc.). Matrix elements $g_{ik}$ denote the decision-maker's benefit in the form of the values of risk reduction obtained in the case of selecting the *i*-th risk reduction measure for the *j*-th hazard source. Using matrices **E** and **H** defined before, matrix **G** is determined as follows:

$$G = H \times E \qquad (12)$$

Another step is the selection of the risk reduction measure with the use of the selected rule or several decision rules.

**Decision rule modification.** In the typically formulated decision-making problems which are solved using methods of games with nature, there is rarely a lack of benefits related to the occurrence of the established states of nature. In the case of the functioning of risk reduction measures, it is the other way round. Each risk reduction measure is usually dedicated to a single hazard source and does not affect other sources. This leads to zero values often occurring in matrix **E** and respectively in matrix **G**.

In such case, direct application of rule (1) may not lead to a solution being obtained. And so Wald's rule was modified by the introduction of a certain condition which makes it possible to establish the value of the solution with the occurrence of zero values of risk reduction measure efficacy. Using relationship (2), this was notated as follows:

$$g_w: \bigvee_{g_{ij}>0} g_w = \max_i \min_j g_{ij} \qquad (13)$$

where *w* denotes the number of the line of payoff matrix **G** corresponding to the number of the risk reduction measure whose selection is considered to be optimal.

**Risk reduction measure selection.** The last stage is the selection of a specific decision rule or the application of their selected sequence. Therefore, the not too optimistic variant may be assumed for instance, consisting in the occurrence of the least beneficial situation for the decision-maker, i.e. the hazard for which the least effective RRM was selected will be activated. Even in such situations, it is desirable that the system designer obtain the maximum benefit. It is therefore proposed to provisionally apply conservative rules, i.e. Wald's rule for example.

# 4 Case study

The application of the proposed concept was illustrated with an example of a fire protection system for railway vehicles. Fires in railway vehicles are a special type of events, as the vehicles usually move with considerable speed and the breaking distance often exceeds several hundred metres. Moreover, in trains, fires develop differently than e.g. in buildings, which is due to a number of factors, including the elongated shape of the vehicle, good thermal insulation accumulating heat and causing a large temperature increase because of the low heat capacity of the vehicle. In such conditions, fire and smoke spread very quickly and evacuation from the vehicle which is on fire is
difficult. It is hindered by narrow corridors, doors not opening while the vehicle is moving, and unopenable windows used in air-conditioned trains. Additional difficulties in carrying out rescue operations occur when the accident takes place in an area which is hard to reach, e.g. far from access roads, on a bridge, and particularly in a tunnel.

In connection with thus specified analysis domain, hazard sources were identified (Table 2), and based on them, hazards were formulated (Table 1). The scope of losses or damage related to the activation of these hazards is very broad and arises out of the previously mentioned determinants of the domain analysis.

<table><caption>**Table 1.** Hazards related to electrical systems in railway vehicles.</caption><thead><tr><th>ID*</th><th>Hazards</th></tr></thead><tbody><tr><td>H1</td><td>Possibility of losses related to a fire caused by a short-circuit of wires in the control cabinet</td></tr><tr><td>H2</td><td>Possibility of losses related to a fire caused by heating of electrical system equipment in passenger compartments</td></tr><tr><td>H3</td><td>Possibility of losses related to a fire caused by sparking of electrical connections</td></tr><tr><td>H4</td><td>Possibility of losses related to a fire caused by accidental arson (butt-end)</td></tr><tr><td>H5</td><td>Possibility of losses related to smoke</td></tr></tbody></table>

<table><caption>**Table 2.** Hazard sources related to electrical systems in railway vehicles and the probability of their activity/occurrence.</caption><thead><tr><th>j</th><th>ID*</th><th>q**</th><th>Hazard sources</th><th>H1</th><th>H2</th><th>H3</th><th>H4</th><th>H5</th></tr></thead><tbody><tr><td>1</td><td>HS1</td><td>0.10</td><td>damaged wire insulation layer caused by vibrations</td><td>x</td><td></td><td></td><td></td><td></td></tr><tr><td>2</td><td>HS2</td><td>0.01</td><td>contamination (dust, dirt, grease, etc.) e.g. in ventilating ducts</td><td>x</td><td>x</td><td></td><td></td><td>x</td></tr><tr><td>3</td><td>HS3</td><td>0.39</td><td>electric power of devices (e.g. air-conditioning)</td><td>x</td><td>x</td><td></td><td></td><td></td></tr><tr><td>4</td><td>HS4</td><td>0.01</td><td>actions of people – passengers</td><td></td><td></td><td></td><td>x</td><td></td></tr><tr><td>5</td><td>HS5</td><td>0.06</td><td>thermal output of the electrical system equipment</td><td>x</td><td></td><td></td><td></td><td>x</td></tr><tr><td>6</td><td>HS6</td><td>0.05</td><td>sparking of electrical connections</td><td></td><td>x</td><td></td><td></td><td></td></tr></tbody></table>

Very often, before any losses or damage occur, the effect of the coincidence of hazard sources is the occurrence of the so-called undesirable events (UEs). The term is used to describe events which may cause losses or damage (definition – ]6, 13]). An example of an undesirable event is mechanical or chemical damage to the insulation layer of the electrical system wires in the vehicle. The reason for mechanical damage may be a coincidence of the following hazard sources: vibrations, contamination (e.g. particles of sand), deformations, and wire displacement. Reasons for chemical damage may in-

<footnote>* hazard identifier</footnote>

<footnote>* hazard source identifier</footnote>

<footnote>** probability of the occurrence of hazard sources assumed based on [15] among others</footnote>
clude chemical compounds (such as oils, greases, fuels, liquids). Connecting undesira-
ble events with corresponding hazard sources should lead to the formulation of a haz-
ard. This was presented in diagrammatic form in Figure 3.

<figure><img src="image_5.png" /><figcaption>**Fig. 3.** A fragment of the relationships between the elements of the identification of hazards con-cerning electrical systems in railway vehicles, where: UE1 – mechanical damage to the outer layer of wires, UE2 – a fire caused by a short-circuit of wires in the control cabinet, UE3 – a fire caused by heating of electrical system equipment in passenger compartments, HS7 – contamina-tion e.g. particles of sand, (HS and H identifiers in accordance with Table 1 and 2).</figcaption></figure>

<table><caption>**Table 3.** Risk reduction measures related to electrical systems in railway vehicles.</caption>
  <thead>
    <tr>
      <th>ID*</th>
      <th>Risk reduction measures</th>
      <th>HS1</th>
      <th>HS2</th>
      <th>HS3</th>
      <th>HS4</th>
      <th>HS5</th>
      <th>HS6</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td>RRM1</td>
      <td>Fuses with a fault indicator</td>
      <td></td>
      <td></td>
      <td>x</td>
      <td></td>
      <td></td>
      <td></td>
    </tr>
    <tr>
      <td>RRM2</td>
      <td>Cable ducts</td>
      <td></td>
      <td>x</td>
      <td>x</td>
      <td></td>
      <td></td>
      <td></td>
    </tr>
    <tr>
      <td>RRM3</td>
      <td>Pictographs and information about fines</td>
      <td></td>
      <td></td>
      <td></td>
      <td>x</td>
      <td></td>
      <td></td>
    </tr>
    <tr>
      <td>RRM4</td>
      <td>Voice information</td>
      <td></td>
      <td></td>
      <td></td>
      <td>x</td>
      <td></td>
      <td></td>
    </tr>
    <tr>
      <td>RRM5</td>
      <td>Regular maintenance (cleaning)</td>
      <td></td>
      <td></td>
      <td>x</td>
      <td></td>
      <td></td>
      <td></td>
    </tr>
    <tr>
      <td>RRM6</td>
      <td>Ventilation of enclosed spaces</td>
      <td></td>
      <td></td>
      <td></td>
      <td></td>
      <td>x</td>
      <td></td>
    </tr>
    <tr>
      <td>RRM7</td>
      <td>Insulation of wires from cross-linked polymers</td>
      <td></td>
      <td></td>
      <td>x</td>
      <td></td>
      <td></td>
      <td></td>
    </tr>
    <tr>
      <td>RRM8</td>
      <td>Spring connectors</td>
      <td></td>
      <td></td>
      <td></td>
      <td></td>
      <td></td>
      <td>x</td>
    </tr>
  </tbody>
</table>

Using the information presented in Table 1 and 2, the following HS – H (hazard source – hazard) relationship matrix was prepared:

$$
\mathbf{H} = \begin{bmatrix}
7.80 & 0 & 0 & 0 & 0 \\
7.80 & 0 & 1.37 & 0 & 3.00 \\
7.80 & 0 & 1.37 & 0 & 0 \\
0 & 0 & 0 & 10.00 & 0 \\
0 & 60.00 & 0 & 0 & 3.00 \\
0 & 0 & 1.37 & 0 & 0
\end{bmatrix} \quad (14)
$$

<footnote>* risk reduction measure identifier</footnote>
Risk values in matrix **H** were calculated in accordance with the relationship of (10) and (11), using the values of probability $q_{jk}$ provided in Table 2, and the following values of the results (damage/losses) of hazard activation were assumed: $s_1 = 20,000$, $s_2 = 1,000$, $s_3 = 70,000$, $s_4 = 1,000$, $s_5 = 5,000$.

Using the information presented in Table 2 and 3 and relationship (6), the following RRM efficacy matrix was prepared:

$$ E = \begin{bmatrix} 0 & 0 & 0.99 & 0 & 0 & 0 \\ 0.90 & 0.95 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0.60 & 0 & 0 \\ 0 & 0 & 0 & 0.70 & 0 & 0 \\ 0 & 0.80 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0.90 & 0 \\ 0.95 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0.85 \end{bmatrix} \quad (15) $$

Next, in accordance with relationship (12), the payoff matrix **G** was determined:

$$ G = \begin{bmatrix} 7.72 & 0 & 1.35 & 0 & 0 \\ 14.43 & 0 & 1.30 & 0 & 2.85 \\ 0 & 0 & 0 & 6.00 & 0 \\ 0 & 0 & 0 & 7.00 & 0 \\ 6.24 & 0 & 1.09 & 0 & 2.40 \\ 0 & 54.00 & 0 & 0 & 2.70 \\ 7.41 & 0 & 0 & 0 & 0 \\ 0 & 0 & 1.16 & 0 & 0 \end{bmatrix} \quad (16) $$

The result of the first iteration of the calculation algorithm in which rule (13) was used is the value of 7.41, indicating RRM number 7, which is the insulation of wires from cross-linked polymers. In accordance with the assumptions of the method presented herein, no other RRM is selected for a hazard whose sources are already being limited by a different measure. Therefore, as can be inferred from Table 1 and 2, the application of RRM7 will make it possible to deactivate hazard H1. This should be included in matrix **H** by zeroing the values in the first column. Thus modified matrix **H** can be 'passed forward' for another iteration if there are still some hazards remaining whose risk has to be mitigated.

As part of the case study presented herein, further iterations were performed, again with the use of modified Wald's rule. The result is the numbers of the following risk reduction measures which the safety system should include: insulation of wires from cross-linked polymers (RRM 7), voice information (RRM 4), ventilation of enclosed spaces (RRM 6), cable ducts (RRM 2), and regular maintenance – cleaning (RRM 5).
# 5 Final remarks

The application of the rules of the models of games with nature (decision rules) makes it possible to make decisions under conditions of uncertainty in a relatively easy manner. Such situation occurs in the process of designing safety systems, as the possibilities of the occurrence of certain domain states for which safety systems are established and designed are usually unknown or only assumed. However, it is not possible to apply the algorithms of the presented decision rules directly. Above all, it is necessary to determine the basic components of the models, i.e. the game strategy and the state of nature. The game strategy should be the application of the appropriate risk reduction measure having an impact on the hazard source(s). States of nature should be defined as hazards identified in the analysis domains. The selection of the risk reduction measure can then be treated as a selection of one of the game strategies.

In the typically formulated decision-making problems which are solved using methods of games with nature, there is rarely a lack of benefits resulting from the selection of a game strategy in reference to states of nature. It is different in the case of functioning of safety systems, as the risk reduction measure may not have an impact on some of the hazard sources. In other words, zero values often occur in the efficacy matrix and respectively in the payoff matrix. This is solved by the introduction of a logical condition which does not take into consideration the lack of impact and the zero values in the payoff matrix. This particularly concerns decision rules in which the 'min' operator is used.

The presented specific nature of the functioning of safety systems often necessitates the selection of not just one measure, but their appropriate combination. This may be solved by applying the so-called sequential selection, which consists in selecting the game strategy several times, taking into consideration one selected rule or several different decision rules. In accordance with the assumptions of the method presented herein, no other risk reduction measure is selected for a hazard whose sources are already being limited by a different measure. It should be kept in mind that this should be included in the payoff matrix by zeroing the values in the appropriate column of this matrix. Thus modified payoff matrix can be 'passed forward' for another iteration if there are still some hazards remaining whose risk has to be mitigated.

As an example of the adaptation of the rules of the models of games with nature for the design of safety systems, the case of fire protection systems in railway vehicles was selected. This is a special type of the so-called high-risk domains, as the activation of the hazards identified there can manifest itself in disastrous consequences. The example is a study case, but it shows the consecutive steps of problem solving in detail. It also makes it possible to draw a conclusion about the substantial utility of the proposed approach. The maximum effect (reduction of the risk of all the hazards) is achieved with the use of the least effective (and maybe the least expensive) measures. Moreover, the structure of the safety system may be limited, which considerably simplifies its management, and in particular may significantly influence its maintenance costs.
## Acknowledgements

The research work financed with the means of statutory activities of Faculty of Machines and Transport, Poznan University of Technology, 05/52/DSPB/0259.

## References

1. Adger, W.N.: Vulnerability. Glob. Environ. Chang. 16, 3, 268–281 (2006).

2. Aven, T.: Risk Analysis. (2015).

3. Aven, T., Heide, B.: Reliability and validity of risk analysis. Reliab. Eng. Syst. Saf. 94, 11, 1862–1868 (2009).

4. Cempel, C.: Teoria i inżynieria systemów-zasady i zastosowania myślenia systemowego. ITE Radom, Radom (2008).

5. Gill, A.: Koncepcja zastosowania reguł decyzyjnych w doborze środków redukcji ryzyka zagrożeń. Pr. Nauk. Politech. Warsz. Transp. 181–190 (2013).

6. Gill, A., Kadziński, A.: Hazard identification model. In: Proceedings of 20th International Scientific Conference. Transport Means (5-7 October 2016, Juodkrante, Lithuania). pp. 885–890 Kaunas University of Technology (2016).

7. Gill, A., Smoczyński, P.: Layered model for convenient designing of safety system upgrades in railways, Saf. Sci., doi: 10.1016/j.ssci.2017.11.024, in press.

8. Girdner, N., Ieee: An Integrated System Safety Model of the National Airspace System. Annu. Reliab. Maintainab. Symp. 2016 Proc. (2016).

9. Harms-Ringdahl, L.: Analysis of safety functions and barriers in accidents. Saf. Sci. 47, 3, 353–363 (2009).

10. Harms-Ringdahl, L.: Guide to safety analysis for accident prevention. IRS Riskhantering AB (2013).

11. Hughes, B.P. et al.: System theory and safety models in Swedish, UK, Dutch and Australian road safety strategies. Accid. Anal. Prev. 74, 271–278 (2015).

12. Jędrzejczyk, Z. et al.: Badania operacyjne w przykładach i zadaniach. PWN, Warszawa. (2002).

13. Kadziński, A.: Studium wybranych aspektów niezawodności systemów oraz obiektów pojazdów szynowych. (2013).

14. Kadziński, A. et al.: The concept of method and models for risk management of hazards generated at railway crossings. In: Proceedings of 20th International Scientific Conference. Transport Means (5-7 Oct. 2016, Juodkrante, Lithuania), Kaunas, Lithunania. pp. 297–302 (2016).

15. Majchrzyk, D., Tarka, I.: Kable i przewody elektryczne przeznaczone do taboru szynowego. Pr. Inst. Kolejnictwa. 149, 14–21 (2016).

16. Meyer, T., Reniers, G.: Engineering Risk Management. De Gruyter.

17. Sikora, W.: Badania operacyjne. Polskie Wydawnictwo Ekonomiczne (2008).

18. Sun, Y. et al.: Multilayered Impact Evaluation Model for Attacking Missions. Ieee Syst. J. 10, 4, 1304–1315 (2016).

19. Tsenina, E.V. et al.: Indication of competitiveness of the potential of the region through hurwitz and wald criteria. Glob. J. Pure Appl. Math. 12, 1, 325–335 (2016).

20. Turskis, Z. et al.: Multi-criteria Optimization System for Decision Making in Construction Design and Management. Eng. Econ. 1, 1, 7–17 (2009).

21. Vincoli, J.W.: Basic Guide to System Safety, Third Edition. John Wiley & Sons Inc. (2014).
22. Wald, A.: Statistical Decision Functions Which Minimize the Maximum Risk. Ann. Math. 46, 2, 265–280 (1945).

23. Wu, X., Du, R.: A solution to decision making under uncertainty. J. Theor. Appl. Inf. Technol. 45, 1, 320–324 (2012).

24. Yemets, O.A., Ustian, N.Y.: Games with combinatorial constraints. Cybern. Syst. Anal. 44, 4, 575–581 (2008).

25. Yemets, O.A., Ustian, N.Y.: Games with combinatorial constraints. Cybern. Syst. Anal. 44, 4, 575–581 (2008).

26. Zavadskas, E.K. et al.: Development of Software for Multiple Criteria Evaluation. Informatica. 14, 2, 259–272 (2003).