International Journal
on Marine Navigation
and Safety of Sea Transportation
Volume 5
Number 3
September 2011
337
1 INTRODUCTION
The risk prediction model consists of a dangerous
event (DE) module and the event consequence mod-
ule. The DE connects the two modules - it initiates
consequences of particular causes. In the case of
propulsion risk (PR), the event DE is immediate loss
of the propulsion capability by the ship, i.e. an im-
mediate catastrophic failure (ICF) of its propulsion
system (PS) (Brandowski 2005, Brandowski et al.
2007, 2008, 2009a). The event may be caused by the
PS element failures or operator errors.
It is assumed that the model parameter identifica-
tion will be based on opinions of the ship power
plant operators, hereinafter referred to as experts.
The opinions will be formulated mainly in a linguis-
tic form, supported to a minimum extent by numeri-
cal data.
The ship PS is well developed. In the example of
a simple PS presented below, it consists of 11 sub-
systems (SS) and these of 92 sets of devices (SD)
including several hundred devices (D) altogether.
The PS sizes, the expert ability to express the opin-
ions necessary to construct a propulsion risk model
and the limited number of experts that the authors
managed to involve in the study influenced the mod-
el form.
The expert investigation methods used in the PR
modelling were presented in publications (Bran-
dowski 2005; Brandowski et al. 2007, 2008, 2009a;
Nguyen 2009)
2 THE PROPULSION RISK PREDICTION
MODEL
The PR model form is determined by data that can
be obtained from experts. It is assumed that they
elicit:
− Annual numbers N of the system ICF type fail-
ures;
− System operating time share in the calendar time
of the system observation by the expert t
(a)
%.
− Linguistic estimation of the share of number of
PS fault tree (FT) cuts in the failure number N
during a year.
− Linguistic estimation of chances or chance pref-
erences of the occurrence of system ICF specific
consequences, on the condition that the event it-
self occurs.
Those opinions are a basis for the construction of
a system risk prediction model.
The following assumptions are made as regards
the system risk model:
− The system may be only in the active use or
stand-by use state. The system ICF type events
may occur only in the active use state.
− The formal model of a PS ICF event stream is the
Homogeneous Poisson Process (HPP). It is
Fuzzy–neuron Model of the Ship Propulsion
Risk
A. Brandowski, A. Mielewczyk, H. Nguyen & W. Frackowiak
Gdynia Maritime University, Poland
ABSTRACT: A prediction model is presented of the ship propulsion risk, i.e. a risk of the consequences of
loss of the ship propulsion capability. This is an expert model based on opinions elicited by the ship power
plant operators. The risk level depends, among other things, on the reliability state of the ship propulsion sys-
tem components. This state is defined by operators in a linguistic form. The formal risk model parameters are
determined by means of a neural network. The model may be useful in the ship operation decision processes.
338
a renewal process model with negligible renewal
duration time. This assumption is justified by the
expert opinions, which indicate that catastrophic
failures (CF) of some systems may occur quite
frequently, even several times a year, but in gen-
eral they cause only a relatively short break in
normal system operation. Serious consequences
with longer breaks in the system operation are
less frequent. Also the exponential time between
failures distribution, as in the case of HPP, is
characteristic of the operation of many system
classes, including the ship devices (Modarres et
al. 1999, Podsiadlo 2008). It is appropriate when
defects of the modeled object and the operator er-
rors are fully random, abrupt and no gradual,
without wear and/or ageing-type defects. This
corresponds with the situation where inspection
and renewals are regularly carried out and prevent
that type of defects.
The following assumptions were made with ref-
erence to the model:
− The HPP parameter is determined in a neural
network from data elicited by experts. The net-
work can be calibrated with real data obtained
from the system (or a similar systems) operation.
− The failure consequences are determined from
data on the chances of occurrence elicited in the
expert opinions.
− The operators perform predictions of the system
reliability condition and PR, i.e. of the system
ICF specific consequences, based on subjective
estimations of the analysed system component
condition.
For given ICF event a fault tree (FT) is construct-
ed, where the top event is an ICF type PS failure and
the basic events are the system minimum cut or cut
failures. The notion of minimum cut is generally
known. Cut is defined as a set of elements (devices)
fulfilling a specific function which loss of that func-
tion results in a system ICF. In the case of minimum
cut, failures of the same system elements may ap-
pear in more than one minimum cuts. Therefore,
they are not disjoint events in the probabilistic sense.
Besides, obtaining reliable expert opinions on the
minimum cut failures is almost unrealistic. Also in
the case of a PS ICF event cause decomposition to
the minimum cut level the number of basic events in
the FT increases considerably - the top event de-
composition is deeper. The more basic events it con-
tains, the more data are needed to tune the neural
network in a situation when the number of compe-
tent experts available is generally very limited. In
the case of cuts (not minimum cuts), they can be ar-
ranged to form a complete set of events. The failure
numbers are then easier to estimate by experts as the
cuts include more devices. Such failures are serious
events in the ship operation process, very well re-
membered by the experts. Besides, there are general-
ly fewer cuts than minimum cuts in the FTs.
Cuts have defined reliability structures (RS). If
those structures and the number of cut failures with-
in a given time interval are known, then the number
of failures of particular devices in the cuts can be de-
termined.
The diagram of a model in Figure 1 illustrates the
PR prediction within a period of time t
(p)
. The sys-
tem operator inputs estimated reliability states of the
cut elements (block (1) of the model). The elements
are devices (D) of the all system cuts. The estimates
are made by choosing the value of the linguistic var-
iable LV = average annual number of ICF events
from the set {minimum, very small, small, medium,
large, very large, critical} for the individual Ds. The
operator may be supported in that process by a data-
base.
Having the reliability states of the FT cuts and
their RS structures, average numbers N
ik
of these cut
ICF failures are determined by “operator algorithm”
(block (2)). The appropriate methods are presented
in section 3 of this paper. They are input data to the
neural network.
Data of
prediction
period
t
(p)
, τ
(a)
(5)
Reliability
states of FT cut
elements (1)
Neuron network
(3)
Consequence
probability (7)
Chances of
consequences
(8)
Process HPP (6)
System state
(4)
Risk (8)
Number of ICF
failures of FT cuts
(2)
Figure 1. Diagram of the fuzzy-neuron model of risk prediction
The neural network, performing generalized re-
gression, determines the system ICF type failure an-
nual number N in the numerical and linguistic values
(block (3)). In the first case, the network determines
the respective value of an LV variable singleton
membership function, and in the second case - a cor-
responding linguistic value of that function. In both
cases 7 values of the LV were adopted. The network
may be more or less complex depending on the
number of cuts and the FT structure.
339
The neural network is built for a specific PS, ac-
cording to its properties and size. Each cut at the FT
lowest level implies an entry to the network. The
network error decreases with the increasing amount
of data. We are interested in teaching data with er-
rors fulfilling some statistical standards and that de-
pends on the number and appropriate choice of ex-
perts.
If there is disproportion between the number of
entries and the teaching data lot size, then the system
FT may be divided at the lower composition levels
and then the component networks "assembled"
again. In the ship PR risk prediction example here
below, the ship PS was decomposed into subsystems
(SS) and those into sets of devices (SD).
The system reliability condition, according to its
operator, i.e. annual number N of its ICFs, is pre-
sented in a linguistic form by giving the LV value
determined in block (3) (block (4)).
Input to the model is risk prediction calendar time
t
(p)
[year] and the modeled PS active use time coeffi-
cient τ
(a)
. The prediction time is chosen as needed, in
connection with the planned sea voyages.
The PS active use time coefficient:
()
= (
()
100)
()
(1)
where t
(a)
% = propulsion system active use time as
a share of prediction calendar time t
(p)
(approximate-
ly equal to the share of ship at sea time).
The value of τ
(a)
coefficient is determined by op-
erator from the earlier or own estimates.
The probability of the system ICF event occur-
rence within the prediction time t
(p)
is determined by
a size K vector (block (6)):
(2)
where
()
= / [1/year] = intensity function (rate
of occurrence of failures, ROCOF) related to the ac-
tive use time, where N = number of the system ICFs
within t = 1 year of observation, with the active use
time coefficient τ determined by neural network; k =
number of ICFs.
Vector (2) expresses the probability of occurrence
of k = 1,2,…,K system ICFs within the prediction
time t
(p)
interval.
Probability of occurrence of specific consequenc-
es on the condition of the analysed system ICF oc-
currence:
{
C ICF
}
, (3)
where C = C1 ∩ C2 = very serious casualty C1 or
serious casualty C2 (IMO 2005).
This probability value is input by the operator
from earlier data obtained from expert investigations
for a specific ship type, shipping line, ICF type and
ship sailing region. The values may be introduced to
the prediction program database.
The consequences C are so serious, that they may
occur only once within the prediction time t
(p)
, after
any of the K analysed system ICFs. The risk of con-
sequence occurrence after each ICF event is deter-
mined by vector whose elements for successive k-th
ICFs are sums of probabilities of the products of
preceding ICF events, non-occurrence of conse-
quences C of those events and occurrence of the
consequences of k-th failure (block (7)):
C, t
(
)
= [P C ICF}
P{ICF
(1 PC ICF)
: x = 1,2, … , K, (4)
Risk (4) is presented in block (8).
3 OPERATOR'S ALGORITHM
3.1 Cut models
The algorithm allows processing of the subjective
estimates of numbers of device D failures, creating
FT cuts, into numerical values of the numbers of
failures of those cuts. They are the neural network
input data. The algorithm is located in block (2) of
the prediction model. The data are input to the mod-
el during the system operation, when devices change
their reliability state. Additionally, the algorithm is
meant to aid the operator in estimating the system
condition.
The numerical values of the numbers of failures
in cuts are determined by computer program from
the subjective linguistic estimates of the numbers of
failures of component devices D. The estimates are
made by the system operators and based on their
current knowledge of the device conditions. This is
simple when cut is a single-element system, but may
be difficult with complex RS cuts. The algorithm
aids the operator in the estimates. Specifically, it al-
lows converting the linguistic values of D device
ICF events into corresponding numerical values of
the cuts. The data that may be used in this case are
connected with cuts - the universe of discourse (UD)
of linguistic variables LV of the cut numbers of fail-
ures for defined RSs. These numbers are determined
from the expert investigations.
Cuts are sets of devices with specific RS - sys-
tems in the reliability sense. They may be single- or
multi-element systems. They are distinguished in the
model because they can cause subsystem ICFs and
in consequence a PS failure. Annual numbers of the
cut element (device) ICFs change during the opera-
340
tion process due to time, external factors and the op-
erational use.
The conversion problem is presented for the case
when in the system FT cuts of subsystems (CSS) are
distinguished and in them cuts of sets of devices
(CSD). The following CSD notation is adopted:
CSD
= {e
, l = 1,2, … , L
},, (5)
where CSD
ik
= k-th cut of i-th subsystem,
k =1.2,…,K, i = 1,2,…,I; e
ikl
= l-th element of k-th
CSD, l = 1,2,…, L.
The CSD cut renewal process parameters, i.e. in-
tensity functions λ (ROCOF), are determined from
the expert investigations of the system PS. In this
case, they are applied only to the ICFs causing the
loss of CSD function. Annual numbers of failures N,
whose functions are intensity functions λ, are deter-
mined. It may be assumed that the numbers elicited
by experts are average values in their space of pro-
fessional experience gained during multi-year sea-
manship. Then the asymptotic intensity function
takes the form (Misra 1992):
(
)
, (6)
where N = average number of the analysed system
failures during the observation time t; τ = active use
time coefficient; t = 1 year = calendar time that the
estimate of the number of failures is related to.
We are interested in the dependence on the num-
ber of CSD cut ICFs to the number of such failures
of the cut elements. It is determined from the formu-
las of the relation of systems, of specific reliability
structures, failure rate to the failure rates of their
components. It should be remembered that in the
case of a HPP the times between failures have expo-
nential distributions, whose parameter is the mod-
eled object failure rate, in the analysed case equals
to the process renewal intensity function λ. The for-
mulas for the ship system CSD cut reliability struc-
tures are given below.
In the case of a single-element structure, the an-
nual numbers of the cut failures and device failures
are identical.
=
, ∈
{
1,2, … ,
}
, ∈
{
1,2, … ,
}
, = 1, (7)
where N
ik
= annual number of failures of k-th cut in
i-th subsystem; N
ikl
= annual number of failures of
l-th device.
In a series RS, the number of system failures is a
sum of the numbers of failures of its components.
=
+
+ +
+ +
(8)
A decisive role in that structure plays a "weak
link", i.e. the device with the greatest annual number
of failures. The CSD cut number of failures must
then be greater than the weak link number of fail-
ures.
In a two-element parallel RS, we obtain from the
average time between failures formula (Misra,
1992):
=
(9)
If one element in that structure fails then it be-
comes a single element structure. Similar expres-
sions can be easily derived for a three-element paral-
lel structure.
In the structures with stand-by reserve, only part
of the system elements are actively used, the other
part is a reserve used when needed. The reserve is
switched on by trigger or by the operator action. The
trigger and the system functional part create the se-
ries reliability structure. When the trigger failure rate
is treated as constant and only one of the two ele-
ments is actively used (L = 2), then:
=
+
, (10)
where
= annual number of trigger failures.
In the case of a three-element structure (L = 3)
with two stand-by elements, we obtain:
=
+
. (11)
In the load-sharing structures, as the expert data
on the number of failures in the case when entire cut
load is taken over by one device are not available,
a parallel RS (equation (9)) is adopted.
In operation, the CSD cut elements may become
failure and cannot be operated. If in a two-element
RS with stand-by reserve one element is non-
operational then it becomes a single element struc-
ture. If in a three-element RS with stand-by reserve
one element is non-operational then it becomes a
two-element structure with one element in reserve. If
in that structure two elements are non-operational
then it becomes a single-element structure. Identical
situation occurs in the case of element failures in the
parallel RS systems.
3.2 Fuzzy approach to the cut failure number
estimate problem
Our variables LV are estimates of the average lin-
guistic annual numbers of ICFs failures N
ik
of cuts
CSD
ik
and N
ikl
devices D
ikl
, i = 1,2, ,I, k =
1,2,…,K, l = 1,2, …,L. We define those variables
and their linguistic term-sets LT-S. We assume sev-
en-element sets of those values: minimum, very
small, small, medium, high, very high, critical. We
assume that these values represent the reliability
state of appropriate objects.
341
From the expert investigations we obtain the uni-
verse of discourse values UD
ik
of individual cuts.
Each of those universes is divided into six equal in-
tervals. We assume that the boundary values
,
, … ,
of those intervals are singleton member functions of
the corresponding linguistic variable values LV
ik
.
The universe of discourse values UD
ik
are the var-
iability intervals of the numbers of failures of cuts
CSD
ik
appearing on the left hand sides of equations
(7) – (11). In the case of a single element RS, paral-
lel RS and with stand-by reserve composed of iden-
tical elements in terms of reliability, we can easily
determine the minimum and maximum numbers of
element failures.
,
and their universes of discourse UD
ikl
and then the
singleton seven-element member functions:
,
, … ,
.
If all the cut elements remain in the minimum
state then the cut is also in the minimum state. If all
the cut elements remain in the critical state then the
cut is also in the critical state. The situation is more
difficult when the cut elements are not identical in
terms of reliability. Then expert opinion-based heu-
ristic solutions must be applied.
4 CASE STUDY
The example pertains to the prediction of a seagoing
ship propulsion risk. Determination of the probabil-
ity of loss of propulsion capability is difficult be-
cause of the lack of data on the reliability of PS ele-
ments and of operators. This applies in particular to
the risk estimates connected with decisions made in
the ship operation phase.
The object of investigation was a PS consisting of
a low-speed piston combustion engine and
a constant pitch propeller, installed in a container
carrier operating on the Europe - North America
line.
The FT of analysed PS is shown in the Figure 2.
For reasons of huge number of SDs the structure of
fuel oil subsystem is only described within the low-
est FT level. The object was decomposed into sub-
systems (SS) (propulsion assembly and auxiliary in-
stallations necessary for the PS functioning - 11 SSs
altogether) and the subsystems into sets of devices
((SD) - 92 sets altogether). Each SS makes the CSS
cut and each SD – the SDC cut. In considered case
the system FT consists of alternatives of those cuts.
In general such FT structure doesn’t have to appear
in the case of PS.
The FT allowed the building the neural network.
The sets of input signals for the network were as-
signed.
Using the code (IMO, 2005), five categories of
ICF consequences were distinguished, including
very serious casualty C1, serious casualty C2 and
three incident categories. Consequences of the alter-
native of first two events were investigated (C = C1
∩ C2).
The consequences are connected with losses.
They may involve people, artifacts and natural envi-
ronment. They are expressed in physical and/or fi-
nancial values. Detailed data on losses are difficult
to obtain, particularly as regards rare events like the
C1 and C2 type consequences. They cannot be ob-
tained from experts either, as most of them have
never experienced that type of events. In such situa-
tion, the risk was related only to the type C conse-
quences of an ICF event.
4.1 Acquisition and processing of expert opinions
The experts in the ICF event investigation were ship
mechanical engineers with multi-year experience (50
persons). Special questionnaires were prepared for
them, containing definition of the investigated ob-
ject, SS and SD schemes, precisely formulated ques-
tions and tables for answers. The questions asked
pertained to the number of ICF type events caused
by equipment failures or human errors within one
year and the share of time at sea in the ship opera-
tion time (PS observation time by expert). These
were the only questions requiring numerical an-
swers.
Figure 2. Fault tree of a ship propulsion system ICF
Legend: PS – propulsion system; ICF – immediate
catastrophic failure;
SS
i
– subsystem, i =1 -fuel oil subsystem, 2 -sea water
cooling subs.; 3 – low temperature fresh water cooling
subs.; 4 – high temperature fresh water cooling subs.; 5 –
startig air subs.; 6 – lubrication oil subs.; 7 – cylider
lubrication oil subs.; 8 - electrical subs.; 9 – main engine
subs.; 10 – remote control subs.; 11 – propeller + shaft
line subs.
SD
1k
– set of devices; ik = 11 - fuel oil service tanks; 12
– f. o. supply pumps; 13 – f. o. circulating pumps; 14 – f.
o. heaters; 15 -filters; 16 – viscosity control arrangement;
17 - piping’s heating up steam arrangement.
D’s ICF
SD
11
ICF
SD
ik
ICF
SD
17
ICF
PS ICF
SS
1
ICF
SS
11
ICF
SS
i
ICF
....
….
……..
…….
…………...
...
...
...
342
Other questions were of a linguistic character and
pertained to the share of ICF type failures of indi-
vidual SSs in the annual number of the PS ICF type
events and the share of ICF failures of individual SD
sets in the annual numbers of SS failures. In both
presented cases the experts chose one of five values
of the linguistic variables: very great, great, medi-
um, small, very small. The elicited linguistic opin-
ions were compared in pairs and then processed by
the AHP method (Saaty 1980; Nguyen 2009). The
obtained distribution of subsystem shares complies
with the engineering knowledge. The greatest shares
are due to the main engine and the electric power
and fuel supply systems and the smallest - due to the
propeller with shaft line.
The experts in the ICF event consequence field
were ship mechanical engineers and navigation of-
ficers (37 in number). A similar questionnaire was
prepared with questions about preferences of 5 pos-
sible consequences (C1 - very serious casualty, C2 -
serious casualty and 3 types of incidents) of the ICF
type event occurrence. The casualty types were de-
fined in accordance with the code (IMO, 2005). The
experts could choose from the following prefer-
ences: equivalence, weak preference, significant
preference, strong preference, absolute preference,
and inverse of these preferences (Saaty, 2005; Ngu-
yen 2009). After processing of the so obtained data
by the AHP method, a normalized vector of shares
of the ICF type event consequences was obtained.
4.2 Some results
The PR model was subjected to a broad range of
tests. Some of the results are presented below. Fig-
ures 3 and 4 present the probability of the occur-
rence of defined numbers ICF type events of PS in
dependence on the prediction time, when PS is in
excellent and critical reliability states. The number
of ICF events from 1 to 5 was adopted for each of
those states. The probability was performed for the
prediction time t
(p)
= 1, 3 and 6 months. The dia-
grams 3 and 4 indicate that the occurrence of ICF
events and their numbers are significantly greater
when PS is in the critical state than in excellent state.
Figure.3. Probability of the ICF type events versus the numbers
of those events for the selected times of risk prediction. PS re-
liability state is excellent.
Figure 4. Probability of the ICF type events versus the number
of those events for the selected times of risk prediction. PS re-
liability state is critical.
Figure 5. Propulsion risk versus the numbers of ICF events for
selected prediction times. PS reliability state excellent.
Figures 5 and 6 presents the PR risk, i.e. the risk
of type C consequences after occurrence of an ICF
event, for the prediction times t
(p)
= 1, 3 and 6
months, when PS is in the excellent and critical for
states. The diagrams show increased risk with dete-
riorating PS reliability.
Figure 6. Propulsion risk versus the numbers of the ICF events
for selected times of prediction. PS reliability state is critical
5 SUMMARY
A fuzzy-neural model of risk prediction has been
developed, based on the knowledge acquired from
0,659
0,275
0,057
0,287
0,358
0,224
0,093
0,082
0,205
0,257
0,214
0,134
0
0,1
0,2
0,3
0,4
0,5
0,6
0,7
0 1 2 3 4 5
P{ICF, k} -probability
k - number of ICF events
1 month
3 months
6 months
0,0062
0,006
0,0159
0,0164
0,0152
0,0247
0,0284
0,0269
0,0248
0
0,005
0,01
0,015
0,02
0,025
0,03
1 2 3 4
{C,
k
} - propulsion risk
k - number of ICF events
1 month
3 monts
6 monts
0,0224
0,0248
0,0234
0,0292
0,0436
0,0464
0,0445
0,0413
0,0167
0,0346
0,0506
0,0511
0,0508
0
0,01
0,02
0,03
0,04
0,05
0,06
1 2 3 4 5
{C,
k
} - propulsion risk
k - number of ICF events
1 month
3 months
6 months
343
experts. It is a model of homogeneous Poisson re-
newal process, where parameters are determined by
means of a neural network. The model parameter es-
timation data were acquired from experts - the mod-
eled system operators. Their opinions were elicited
in a numerical form as regards the events observed
by them many times and in a linguistic form in the
cases where their knowledge might be less precise.
The neural network was tuned with the elicited opin-
ions. The network may be calibrated with data col-
lected in the system operation process. In this way
the Homogeneous Poisson Process can be adapted to
real operating conditions - it becomes non-
homogeneous in steps. The model allows prediction
of the risk of dangerous events consequences, which
may occur due to different systems.
In the expert investigations we have to rely on da-
ta obtained from experts and models are constructed
from that data. The adequacy and type of obtained
information depends on the form and adequacy of
the data. The expert competence level must not be
exceeded. In the case reported here, it might have
happened in the estimates of occurrence of the ICF
event consequences. In the authors' opinion, the
competence level was not exceeded as the remaining
data are concerned, as the choice of experts was
careful.
The expert-elicited data have an impact on the
level of adequacy of models used in the investiga-
tions - like data like model. A number of simplifying
assumptions had to be made. Some of them are the
following: two states of the use of modeled objects,
failures possible only in the active use state, homo-
geneity of the Poisson renewal process, the cut no-
tion, definition of the ICF event consequences etc.
Results of the propulsion risk estimates quoted in
section 4 are not questionable as regards the order of
magnitude of the numbers. Events from the subset of
C consequences occur at present in about 2% of the
ship population (20 ships out of 1000 in a year). This
applies to ships above 500 GT. There are at present
about 50 thousand such ships (Graham, 2009; Podsi-
adlo 2008). The results are also adequate in terms of
trends of changes in the investigated values, which
are in compliance with the character of the respec-
tive processes.
It has to be taken into account that results of
a subjective character may be (but not necessarily)
subject to greater errors than those obtained in a real
operating process. The adequacy of such investiga-
tions depends on the method applied, and particular-
ly on the proper choice of experts, their motivation,
as well as the type of questions asked. In the expert
investigations the fuzzy methods are especially use-
ful, as they allow the experts to express their opin-
ions in a broader perspective.
In the authors' opinion, the main difficulty in the
neural network application for modeling is the ne-
cessity of having a considerable amount of input and
output data for tuning the models. In the prospective
investigations the data are generally in short supply.
They may be gathered after some time in the operat-
ing process of the respective objects, but that may
appear to be too late.
There is a chance of further developing and using
the risk prediction program, developed under the
project, aboard ships and not only for the propulsion
systems. It could be coupled with the existing
equipment renewal management or operating man-
agement programs.
The investigations presented in the paper were
supported by Ministry of Science and Higher Educa-
tion in the frame of a study project.
REFERENCES
IMO, MSC-MEPC.3/Circ.1. 2005. Casualty-related matters.
Reports on marine casualties and incidents. Revised har-
monized reporting procedures – Reports required under
SOLAS regulation I/21 and MARPOL 73/78, articles 8 and
12.
Brandowski A. 2005. Subjective probability estimation in risk
modeling (in Polish). Problemy Eksploatacji 3/2005 (58).
Zeszyty Naukowe Instytutu Technologii Eksploatacji Ra-
dom.
Brandowski A., Frackowiak W., Mielewczyk A. 2007. Subjec-
tive reliability estimation of a seagoing ships. Proceedings
of ESREL2007 Conferece. Stravanger.
Brandowski A., Frackowiak W., Nguyen H., Podsiadlo A.
2008. Subjective propulsion risk of a seagoing ship. Pro-
ceedings of ESREL2008 Conference. Valencia.
Brandowski A., Frackowiak W., Nguyen H., Podsiadlo A.
2009. Risk estimation of a sea-going ship casualty as the
consequence of propulsion loss. Proceedings of
ESREL2009 Conference. Prague.
Brandowski A. 2009. Estimation of the probability of propul-
sion loss by a seagoing ship based on expert opinions.
Polish Maritime Research 1/2009. Gdańsk University of
Technology. Gdańsk.
Saaty T.L. et al.1980. The Analytic Hierarchy Process. New
York.McGraw-Hill.
Nguyen H. 2009. Application of AHP method in the risk etima-
tion of ship systems (in Polish). Polish Maritime Research
1/2009. Gdańsk 2009.
Modarres M., Kaminskiy M., Krivtsov. 1999. Reliability Engi-
neering and Risk Analysis. New York, Basel: Marcel Dek-
ker, Inc.
Misra K. B. 1992. Reliability Analysis and Prediction. A
Methodology Oriented Treatment. ELSEVIER. Amster-
dam, Oxford, New York, Tokyo.
Piegat A. 1999. Fuzzy modeling and contol (in Polish). Aka-
demicka Oficyna Wydawnicza EXIT. Warszawa.
Graham P. 2009. Casualty and World Fleet Statistics as at
31.12.2008. IUMI Facts & Figures Committee..
Podsiadło A. 2008. Analysis of failures in the engines of main
ship propulsion (in Polish). Internal study of Gdynia Mari-
time University. Gdynia.
