_{1}

^{*}

Critical systems are typically complex systems that are required to perform reliably over a wide range of scenarios, or multistate world. Seldom does a single system exist that performs best for all plausible scenarios. A robust solution, one that performs relatively well over a wide range of scenarios, is often the preferred choice for reduced risk at an acceptable cost. The alternative with the maximum expected utility may possess vulnerabilities that could be exploited. The best strategy is likely to be a hybrid solution. The von Neumann-Morgenstern Expected Utility Theory (EUT) would never select such a solution because, given its linear functional form, the expected utility of a hybrid solution cannot be greater than that of every constituent alternative. The continuity axiom and the independence axiom are assessed to be unrealistic for the problem of interest. Several well-known decision models are analyzed and demonstrated to be potentially misleading. The linear disappointment model modifies EUT by adding a term proportional to downside risk; however, it does not provide a mathematical basis for determining preferred hybrid solutions. The paper proposes a portfolio allocation model with stochastic optimization as a flexible and transparent method for defining choice problems and determining hybrid solutions for critical systems with desirable properties such as diversification and robustness.

Broadly speaking, critical systems are systems necessary for mission success and whose failure poses a significant danger to life and property. They are typically complex systems required to perform reliably over a wide range of scenarios. For example, critical infrastructures are characterized as follows [1, p. 30]:

“Our critical infrastructures are particularly important because of the functions or services they provide to our country. Our critical infrastructures are also particularly important because they are complex systems: the effects of a terrorist attack can spread far beyond the direct target, and reverberate long after the immediate damage.”

Seldom does a homogeneous system exist that performs best for all scenarios of interest. The focus of the paper is on choosing the “preferred” solution given a set of alternatives for scenarios with probabilities and consequences that have been assessed either objectively or subjectively. Following the risk-uncertainty classification of Luce and Raiffa [

Von Neumann and Morgenstern (vNM) [

“There are certain patterns of preference held by reasonable people for good reasons that simply do not agree with the axioms of expected utility theory and which suggest the need for serious reappraisal of the normative foundations of decision making under risk.”

In recent years, several alternative theories of decision making under risk have been proposed to explain behavioral departures from EUT. The original prospect theory [

From the perspective of complex systems and Analysis of Alternatives (AoA), a key limitation of EUT is that it is a compensatory model. The poor performance of a system or bad outcome of a decision for one scenario can be mathematically compensated for by the other scenarios. Consequently, an alternative with the Maximum Expected Utility (MEU) may possess vulnerabilities for some scenarios that competitors in the commercial world and adversaries in the military world could exploit [

Markowitz [18, p. 207] makes an interesting and convincing argument against maximizing the expected return from the field of investment portfolio theory:

“An investor who sought only to maximize the expected return would never prefer a diversified portfolio. If one security had greater return than any other, the investor would place all of his funds in this security.”

The above argument readily generalizes to the selection of critical systems. Given a set of alternatives, the best strategy for FARness in a multistate world is likely to be a hybrid solution, or diversified portfolio. However, a Decision Maker (DM) who is an Expected Utility (EU) maximizer would never select a diversified portfolio; s(he) would select the MEU alternative.

This paper has three objectives:

1) Identify the differences between the EUT axioms and robust critical system requirements.

2) Investigate the validity of several well-known decision models as decision aids for choosing robust critical systems.

3) Develop a realistic and mathematically valid method for defining and selecting robust critical systems.

The remainder of the paper is structured as follows. Section 2 reviews the classical paradigm for AoA in a multistate world. A simple sensor selection problem is used to illustrate the limitations of EUT for critical systems. Section 3 critically analyzes the EUT axioms with a focus on the continuity and independence axioms. Section 4 presents a paradox for the selection hybrid systems. Section 5 discusses different notions of robustness. The minimax regret and the maximin criteria are shown to be potentially misleading criteria for robustness. Section 6 briefly reviews DT. The linear disappointment model is shown to provide a credible risk-based robustness metric. Section 7 proposes an approach based on portfolio allocation with stochastic optimization as a flexible and transparent method for defining choice problems and determining hybrid solutions with desirable properties such as diversification and robustness. Section 8 provides some concluding remarks.

The AoA problem is modeled with a decision matrix,

1) The utility of a set of r mutually exclusive outcomes with probabilities _{ }is characterized by a vNM EU function4

2) The preference for each alternative A_{i }is represented by its EU,

3) The Rational Individual should choose the alternative with the MEU,

The validity of the above equations requires additive independence. This is unlikely to be a realistic assumption for complex systems and Systems of Systems (SoS) because there are significant interactions among attributes with the result that the whole is greater the sum of the parts. The use of simulation is preferred for realism, especially for complex systems such as SoS [

The outlined process, as further discussed in the subsequent sections, may also mislead practitioners to overlook hybrid solutions with desirable properties such as FARness.

As an example, consider a modified version of the decision problem in [20, p. 36]. To make it more concrete, it is assumed that the alternatives are 4 hypothetical sensors for a border surveillance system. For the purpose of the paper, each sensor is approximated by a cookie-cutter model [_{0 }and probability of detection PoD that depends on three states of nature,. The cookie-cutter data are specified in

The Rational Individual who equates PoD with utility is considered to be “risk neutral”. S(he) would use Equation (1) with the values in _{3}. The Rational Individual who is either risk-averse or risk-seeking would argue that utility rather than PoD is the appropriate measure of sensor usefulness. In accordance with EUT, s(he) would base his/her preferences on the MEU.

Utility is associated with the performance of an alternative or the consequences of an act. The evaluation of a person’s utility is a highly challenging task and for greater realism it should be experimentally solicited without invoking analytical mathematical functions [

1) PoD = 0.5 is identified as the reference level with u(0.5) = 0. Other values are assessed relative to it.

2) Outcomes associated with PoD > 0.5 are considered gains. The corresponding utilities have a diminishing characteristic of gain satiation. For ease of perception, a scale is established with u(1.0) = 10.

3) Outcomes associated with PoD < 0.5 are considered losses. In accordance with loss aversion, the shape of the utility function is steeper than for PoD > 0.5. A lower PoD threshold may be specified to screen out unacceptable alternatives. It is assumed that u(0) = –30.

4) The utilities of a few intermediate PoD values are determined by probing the DM about his/her indifference or willingness to bet a PoD_{i} sensor for a 50-50 gamble between a sensor with PoD_{h} > PoD_{i} and a sensor with PoD_{l}_{ }< PoD_{i}. For example, consider a DM indifferent between a PoD = 0.06 sensor and a 50-50 gamble of a PoD = 0.5 sensor or nothing, i.e. sensor with PoD = 0. This equates to

Other intermediate points are determined the same way.

5) The resulting data are depicted in

The utility values for _{1} and A_{2} have unequal EUs. This reflects the fact that the utility function given by Equation (4) captures some aspects of risk aversion. The Rational Individual would select A_{3}. The rational individual, however, might disagree with this choice because of the poor performance of A_{3} in state S_{3}. S(he) would argue that this choice is not robust because it is vulnerable to attacks by adversaries who may have acquired this information [

As with all theoretical models, EUT has limitations. Different but logically equivalent sets of axioms have been proposed. Most rely extensively on the concept of monetary lotteries. In a 1921 lecture entitled, “Geometry and Experience,” Einstein [24, p. 233] states:

“As far as the propositions of mathematics refer to reality, they are not certain; as far as they are certain, they do not refer to reality.”

The above comment is equally relevant with “decision theory” substituted for “mathematics”.

This section follows Luce and Raiffa’s formulation [

Consider a generic scenario, a set of n alternatives

, and r basic consequences. In accordance with the ordering axiom, the consequences can be arranged in order of decreasing preference and numbered accordingly: Every alternative can then be thought of as a lottery associated with an r-tuplet of basic consequences and probabilities q7:

For each outcome C_{i}, the Rational Individual8 is indifferent between C_{i} and an alternative involving just C_{1} and C_{r}:

C_{i} and are two different entities: can be any outcome of an equivalence class with certainty equivalent C_{i} [

Context is of the essence for validity of the continuity axiom. Taken literally, the Rational Individual should be indifferent between receiving an amount of money and the lottery for some probability p. Following this observation, Luce and Raiffa [2, p. 27] write:

“When put in such bold form, some, whom we would hesitate to charge with being “irrational”, will say No... Even though the universality of the assumption is suspect, two thoughts are consoling. First, in few applications are such extreme alternatives as death present.”

Critical systems and decisions often impact life and death issues. The DM who is a rational individual cannot invoke the above loophole. S(he) needs to mindfully assess low probability events with potentially dire consequences such as serious injuries, death, and heavy financial losses. The emotionally charged aspects of such decisions render the use of the continuity axiom impractical and unrealistic.

3.3. The Independence Axiom^{9}

For every alternative in the set A, the Rational Individual is indifferent to the substitution of an equivalent outcome

for C_{i}:

The independence condition given by Equation (7a) is more apparent if expressed in terms of the combination in common with arbitrary alternatives G or H. The independence axiom then reduces to its common form,

It follows from the EUT continuity and transitivity axioms that

The probabilistic outcomes on the right-sides of Equations (7b) and (7c) are the mutually exclusive basic outcomes associated with Q, G and H. It would be wrong to think of them as mixtures of outcomes.

The independence axiom requires that when comparing probabilistic alternatives, the Rational Individual views the “common part” as irrelevant and preserves the original preference in accordance with Equations (7a)- (7c). This is a valid assumption if and only if there are no interaction effects including psychological influences between G and Q or H and Q. The use of decision trees is often presented as a graphical justification for the independence axiom. This argument is flawed because the folding back procedure substitutes the certainty equivalent for branches at nodes and thereby implicitly assumes that outcomes are independent. De Neuville [26, p. 366] writes:

“The axiom implies that the substitutions can occur regardless of the other opportunities in front of a person and, thus, regardless of how these substitutions alter the probabilistic distribution of the consequences.”

In conclusion, the independence axiom is in conflict with probability calculus and the rational individual who makes decisions based on the complete risk curve rather than simply the EU [

The Chew weighted utility theory [

For , the weak substitution axiom reduces to the independence axiom, Equation (7b). The Chew weighted utility theory includes EUT as a special case. For it admits the presence of complementarities of A_{i} and A_{j} with A_{k}. It, therefore, provides a resolution of the Allais paradox [

The Chew weighted utility function for a probabilistic mixture of two alternatives H and G has the following linear functional form:

is a vNM utility function; is an additional weight function that enables it to accommodate the preference patterns of several key EUT paradoxes including the Allais paradox [

As discussed in Section 2, the EUT linear functional form causes the ranking of alternatives to be relatively insensitive to low probability scenarios. This is in conflict with the way rational individuals often choose options for a wide range of problems with low probability but catastrophic consequences. These include, but are not limited to, global environmental risks, national security, and critical infrastructures. Chichilnisky [

where and is an additive measure with a functional form yet to be specified. Chichilnisky [

The Section 2.2 sensors are considered for a border surveillance system of length 4R_{0}. The problem is which two sensors to select to maximize the detection probability of potential intruders. It is assumed that the latter possess no intelligence of sensor performance; they try to infiltrate the border at random locations and times.

For the Rational Individual,

S(he) would then conclude that the homogeneous combination is preferable to the hybrid combination. By extending this reasoning to all sensor combinations, the Rational Individual concludes that the best combination consists only of the highest utility sensor, i.e. A_{3}. The rational individual would disagree with this solution because it lacks diversity and it is highly vulnerable to infiltration given the low PoD in scenario S_{3} (see

Given 4 alternatives, there are 10 possible two-sensor combinations to consider. Each combination may be represented by a two-dimensional vector with the PoD utility as elements. A two-dimensional utility function is needed to represent preferences over the combinations such that

By analogy to the determination of the sensor utility function in Section 2.2, it is assumed that is given by treating Equation (4) as a function of the joint variable xy:

The multiplicative form xy has advantages over the linear form. It more realistically accounts for two-sensor vulnerabilities. Furthermore, the indifference or isoutility curves represent simple convex preferences1^{0}.

The utilities for the 10 two-sensor combination are computed using Equation (13) and averaged over the 3 scenarios. The results are presented in

1). The MEU solution, _{,} does not consist of the two MEU alternatives. It draws on the synergistic interaction between the two alternatives._{}

2) exhibits diversification [

3) The robust combination A_{4}-A_{4} ranks last. This result combined with the above two demonstrates that convex preferences exhibit diversification but that diversification is not equivalent to robustness.

A resolution of the two-sensor paradox is that EUT needs to be modified to be compatible with preference for robust and hybrid solutions. Options include 1) replacing the independence axiom with a modification such as the weak substitution axiom, or 2) introducing corrections to EUT such as DT (see Section 6).

In semi-layman parlance, robust solutions perform reasonably well and have acceptable outcomes over a wide range of plausible scenarios without assuming that “everything goes right”. The importance of robustness as a criterion for good decisions is reflected by the fact that DMs often purposefully forgo the MEU option for ones that perform well over a wide range of scenarios and are relatively insensitive to uncertainties. The professional literature contains different notions of robustness with variations that depend on the application domain.

The following three notions of robustness are of interest for critical systems consideration.

1) Lempert et al. [^{1}.

2) Krokhmal et al. [^{2}. They note that “in this regard, risk management in military applications is similar to other fields such as finance, nuclear safety, etc., where decisions targeted at achieving the maximal expected performance may lead to an excessive risk exposure.”

3) Ullman [

This section examines Savage’s minimax regret rule as a regret-based robustness criterion. Risk-based robustness is addressed in Section 6.

Savage’s minimax regret rule is a recommendation that under uncertainty a person should choose the alternative that minimizes the maximum difference from the highest achievable utility in each scenario. The anticipated regret for choice A_{i} in scenario S_{j} depends on the other alternatives:

where is a vNM utility. Equation (15a) represents the largest possible loss for A_{i} in state S_{j} relative to the best alternative. The minimax regret choice is the alternative with the smallest regret over all of the scenarios:

The minimax regret rule leads to the comparison of the _{3} is the recommended alternative; but, it performs poorly in S_{3}. The rational individual who seeks a robust solution is likely to reject it. The well balanced A_{4} ranks_{ }3^{rd}. These results raise serious doubts about the usefulness of the minimax regret rule as a robustness criterion1^{3}.

The maximin criterion, also known as Wald’s minimax for losses, recommends selecting the alternative with the maximum minimum utility, A_{4} (see

The term “disappointment” has psychological connotetions that are not relevant in the context of the paper. Nevertheless, it is used in the paper because it is entrenched in the decision theory literature.

Bell [

Several DT models have been proposed as corrections to EUT. Bell [

the outcome obtained against the outcomes that they failed to get had other scenarios realized. They hypothesized that the level of disappointment associated with outcome O_{i} depends explicitly on the probabilities and utilities of the outcomes that are preferred, i.e. the outcomes ^{14}. The disappointment associated with alternative A_{j} given the realization of scenario S_{i}, is modeled as follows:

where is a positive function of with; is the probability of scenario S_{k}.

For the purpose of this paper, in Equation (16) is assumed to be a linear function. The overall disappointment is then obtained by averaging Equation (16) over all the m scenarios. This simplified version of the Delquié and Cillo Linear Disappointment Model (LDM) [

where d is a positive constant that captures the rational individual’s sensitivity to disappointment.

Equation (17) has several notable properties:

1) The functional form is similar to the vNM EU but with rank-dependent weighted probabilities.

2) The second term represents downside risk1^{5} relative to the best possible outcome. It provides a credible measure of risk-based robustness.

3) The parameter d can be varied to reflect varying degrees of risk tolerance and thereby identify alternatives with unacceptable consequences.

The two-sensor paradox of Section 4 is analyzed using the LDM. Given that disappointment is explicitly accounted for, the analysis uses the

The results are consistent with a rational preference for diversification and the notion of risk-based robustness. The two-sensor combinations change rank as d varies. For d > 0.7, A_{4}-A_{4} rank 1^{st} and A_{2}-A_{4} ranks 2^{nd}. A_{3}-A_{3}_{ }changes rank from 1^{st}_{ }for d = 0 to last for d > 0.6. To reach a final decision, a risk-averse DM would peruse _{.}A_{2}-A_{4} or A_{4}-A_{4} depending on preferences for risk tolerance and diversification.

The LDM1^{6} analysis is simpler and more intuitive than the utility theory two-dimensional preference analysis of Section 4.2. It can readily be extended to complex combinations of multiple constituents. However, all available DT models lack a mathematical basis for developing complex hybrid solutions or portfolios. Such an approach is presented in the next section.

As discussed in Sections 4-6, a risk-adverse DM is likely to prefer a hybrid solution that performs relatively well over all scenarios of interest rather than a homogeneous solution consisting solely of the MEU alternative. Consider a situation of n alternatives and m mutually exclusive probabilistic scenarios. A hybrid solution may be thought of as a portfolio characterized by a multidimensional probability distribution function [

where is the decision vector of allocation variables with x_{i} being the A_{i} allocation fraction. The multidimensional function is a generalized discrete probability distribution with values being probability distributions functions (pdf) rather than point estimates. is a pdf that models the A_{i} outcome1^{7} for scenario S_{j}.

The determination of the decision vector x may be specified in terms of the following stochastic optimization problem:

Maximize the z^{th} percentile of P_{HS}(x), Equation (19a), subject to the normalization, scenario performance, and affordability constraints, Equations (19b)-(19d):

The values z and f are percentiles1^{8} that a DM specifies in accordance with his/her risk tolerance; a_{j} is his/her lowest acceptable value for the f^{th} percentile for performance in scenario S_{j}; C_{i} is the A_{i} cost; N_{0} is the number of required systems; and B_{0} is the available budget. Equation (19d) can accommodate pdfs for C_{i} with an agreed-to percentile for the cost constraint [

The above formulation provides a flexible and transparent way for the analyst and DM to define the choice problem and generate mixed solutions with desirable properties such as diversification and robustness1^{9}.

The above approach is applied to the design of a robust border surveillance system of N_{0} sensors using the four

The hybrid solution is robust: 1) the associated cumulative distribution is narrower than those of the homogeneous alternatives, 2) the minimum PoD = 0.4, and 3) there is a 80% probability that the PoD ³ 0.5 for the identified scenarios. Given the

The solution to this example is obvious. Nevertheless, it illustrates the significant advantages and benefits of portfolio allocation with stochastic optimization for developing robust critical systems. Solving complex realworld problems will require tools with integrated Monte Carlo simulation and stochastic optimization capabilities. They are available in commercial and proprietary versions. For information purposes, Crystal Ball^{®} with OptQuest^{®} was applied to the illustrative example. OptQuest^{®} is a general purpose optimizer developed to effectively solve complex stochastic, nonlinear, and combinatorial optimization problems [

The paper begins by analyzing the suitability of EUT for AoAs of critical systems in a multistate world. The concept of robust solutions is discussed within the context of multiple scenarios. Several well-known models are compared for a simplified example of choosing sensors for a hypothetical border surveillance system. Portfolio allocation with stochastic optimization is proposed and demonstrated to be a valid and realistic method for defining robust critical systems.

Some of the key conclusions are:

1) The EUT is inadequate for critical systems AoA because MEU alternatives may possess vulnerabilities that could be exploited and/or are susceptible to common-cause failures. The continuity axiom is unrealistic given the emotionally charged aspects of critical decisions. The independence axiom is in conflict with the rational individual who is not an expected utility maximizer and prefers to make decisions using risk curves.

2) The two-sensor paradox raises serious doubts about the validity of the minimax regret rule as a robustness criterion for decision making under risk and the belief that it is superior to the maximin rule. Both have serious problems and are potential misleading for choosing critical systems.

3) If the utility is linear in the probabilities, the EU of a hybrid solution cannot be greater than the EU of every constituent alternative. A GEUT and nonlinear utility functions are required to exhibit robustness and diversification.

4) The LDM simply modifies the vNM EU by adding a term proportional to downside risk. The results of the two-sensor selection example confirm that it is a promising model for choosing robust homogeneous solutions. However, the LDM and other available DT models do not provide a mathematical basis for developing hybrid solutions.

5) Portfolio allocation with stochastic optimization provides a flexible and transparent approach for defining the choice problem and determining hybrid solutions for critical systems with desirable properties such as diversification and robustness. The best combination does not necessarily consist of the alternatives with the highest EUs; it draws on the strengths and complementarities that any of the alternatives can provide.

6) The composition of the hybrid solution is determined by optimizing a specified percentile of the system performance subject to robustness and cost constraints. Performance and cost uncertainties can be modeled using realistic pdf’s.

Ultimately, the selection of robust solutions depends on the identified alternatives. Critical systems require analysis that is mindful of the following considerations: 1) the limitations of EUT and GEUT models; 2) risk-mitigation properties such as FARness; and 3) the importance of hybrid solutions as options. Given the availability of commercial and proprietary tools with integrated Monte Carlo simulation and stochastic optimization capabilities, the future direction is the implementation of the proposed portfolio allocation with stochastic optimization as a practical design and analysis tool for complex systems and SoS on actual projects.

This work was stimulated by a Naval Postgraduate School capstone project prepared by the 2008 Cohort from the Naval Surface Warfare Center Dahlgren Division (NSWCDD) and the Naval Undersea Warfare Center Division Newport [

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[

[