A Robust Bayesian Approach to an Optimal Replacement Policy for Gas Pipelines

In the paper, we address Bayesian sensitivity issues when integrating experts’ judgments with available historical data in a case study about strategies for the preventive maintenance of low-pressure cast iron pipelines in an urban gas distribution network. We are interested in replacement priorities, as determined by the failure rates of pipelines deployed under different conditions. We relax the assumptions, made in previous papers, about the prior distributions on the failure rates and study changes in replacement priorities under different choices of generalized moment-constrained classes of priors. We focus on the set of non-dominated actions, and among them, we propose the least sensitive action as the optimal choice to rank different classes of pipelines, providing a sound approach to the sensitivity problem. Moreover, we are also interested in determining which classes have a failure rate exceeding a given acceptable value, considered as the threshold determining no need for replacement. Graphical tools are introduced to help decision makers to determine if pipelines are to be replaced and the corresponding priorities. Entropy 2015, 17 3657


Introduction
We consider the problem addressed in [1,2] about the replacement policy of low-pressure cast iron (CI) pipelines used in a metropolitan gas distribution network by the assessment of the rate of occurrence of gas escapes or leaks (denoted as failures) obtained through integration of historical data and knowledge of company experts.In the cited works, homogeneous subnetworks were identified and ranked according to their failure rates, using a methodology based on field data, experts' qualitative judgments and Bayesian inference; the failure rate was considered as the priority index for the replacement policy (of an entire subnetwork, rather than a single section).In the current paper, we consider the same criterion for the replacement policy, presenting a sounder approach to deal with the uncertainty associated with the experts' judgments and providing practical tools to visualize the consequences of such uncertainty and to help in making decisions through an iterative process.
The considered gas distribution network was developed in a large urban area during the last century, and thereby, it is characterized by very different technical and environmental features (material, diameter of pipelines, laying location, etc.).It consists of thousands of kilometers of pipelines of low, medium and high pressure.The main concerns about the replacement plan were related to the low-pressure network (20 mbar over atmospheric pressure).As regards the low-pressure pipelines, several materials have been used to develop the network: traditional cast iron (CI), treated cast iron (TCI), spheroidal graphite cast iron (SGCI), steel (ST) and polyethylene (PE).
Since CI pipelines have a higher failure rate than other materials, even ten-times greater (see [2]), and cover more than a fourth of the whole network, the authors paid more attention to this material and studied its subnetworks in more detail.The low-pressure CI network consists of about 6000 different sections of pipelines whose lengths range from 3 to 250 m for a total of 320 km.
It should be noted that medium-and high-pressure steel pipelines are less critical, since automatic devices stop the gas flow if pressure decreases.Moreover, medium-and high-pressure pipelines are laid deeper in the ground, with more care about the laying procedure, so that they are less subject to accidental stress.
Using the failure rate as an index of replacement priority and taking advantage of studies developed in other similar companies and available in the literature (e.g., [3]), factors directly involved in the failure of a low-pressure CI pipeline were identified.The preliminary data analysis highlighted three critical failure factors (laying location, diameter and laying depth) characterized by two levels each, so that eight pipeline classes were obtained; see Table 1.
Since the structural failure of CI pipelines is a rare phenomenon, Cagno et al. [1] felt it appropriate to model failure events with a Poisson process.As a matter of fact, CI pipeline failures seem to be scarcely sensitive to both wear and closeness to leak points (an assumption confirmed by available data taking into account a useful life phase varying from 50 to 100 years), whereas they are mostly affected by accidental stress.Due to these considerations, a time and space homogeneous Poisson process was used for each class i (cf., Table 2), with unit intensity (or failure rate) θ i (i.e., per km and year).Thus, the failure probability of a single section in a planning period k is calculated as: where s j is the length of the j-th section (km) and t k is the k-th planning period (year).In the analyzed case, the planning period t k was taken as a year, since the planning frequency was annual.Therefore, the likelihood function of each pipeline class will be: being x the number of failures over the network (of length s = j s j ) of pipelines characterized by the same parameter θ i .
Table 1.Significant levels of factors related to failure.

Laying location Sidewalk Street
Table 2 shows the maximum likelihood estimate (MLE) of the annual failure rate for different combinations of factors and highlights both the influence of laying location (higher failure rates in street locations) and the interactions between factors (e.g., the varying influence of laying depth as a function of diameter).Each MLE is calculated as the ratio between the total number of failures and the length multiplied by the observation period (six years).Note that with the company's previous method of assessing tendency to failure, the small diameter was considered the most critical factor, whereas the laying location was one of the least important factors, so that it was clearly against the historical data analysis, giving misleading results.
Maximum likelihood estimation might lead to surprising and misleading results: for the pipelines in Class 8, there were only three failures in six years over 2.81 km, and according to the MLE (see Table 2), this class (with a large diameter, laid deeply under the street) was the one most subject to failures.The MLE is affected by the very short length of the network in Class 8 and very sensitive to the number of observed failures, whereas the conclusion is very different when we consider the experts' judgments, as well.
In Section 2, we will consider a quantile class (a special case of generalized moment-constrained class) obtained from experts' beliefs about failure rates.We claim that it is quite impossible to get a unique prior out of experts' judgments, and here, we present a method, based on classes of priors, addressing the issue, which is rarely used in applications and hardly known in engineering literature.As a consequence of the choice of a class of priors, there is a set of possible values that could be taken as estimates of the failure rate in each subnetwork; this is typically described in robust Bayesian analysis as a sensitivity problem with respect to the choice of the prior.We could consider the set of all posterior means obtained when varying the prior in the class.The choice of the posterior mean corresponds, in the language of Bayesian decision analysis, to the selection of the optimal action that minimizes the posterior expected loss under a squared loss function.Under a class of priors and, possibly, of loss functions (which are the two major ingredients in the Bayesian approach along with the sampling model), the search for a class of optimal actions/estimates could lead to considering all of those actions for which there exist at least one prior and one loss, such that they minimize the corresponding posterior expected loss; this would be called the set of the Bayes actions.Another approach, fully justified from a foundational point of view, as stated, e.g., in [4], consists of finding all of those actions for which there exists no other action performing better (dominating), in terms of not a greater posterior expected loss, when considering all possible combinations of priors and loss functions; those actions are called non-dominated.In Section 3, for each subnetwork, we will compute the set of non-dominated actions under its class of priors for a fixed, squared loss function.The goal would be to obtain disjoint non-dominated sets, implying that the subnetwork with the largest estimates (i.e., the non-dominated actions) has a worse failure rate than the others, regardless of the choice of the prior.The subnetworks would be ranked not according to the value of a unique estimate, like in [2], but considering if the non-dominated sets are overlapping or disjoint.Should all of the non-dominated sets be disjoint, then ranking would be obvious.If the non-dominated sets do not allow us to order the failure rates (i.e., there is overlap between sets of different subnetwork), we propose the choice of the least sensitive action as the optimal solution of the sensitivity problem, as in [5].The use of non-dominated and least sensitive actions is definitely new in reliability, combining foundational justification with ease of interpretation when looking at the plots provided in the paper.The plots presented in the paper are a useful innovation in Bayesian robustness, since they allow for immediate, visual evaluation, even by non-statisticians, of the consequences of the uncertainty in specifying the prior distributions.
Furthermore, the paper deals not only with the comparison of different classes of pipelines to suggest a replacement order, but also with the problem of determining which classes have a failure rate θ exceeding a given threshold θ, deemed as the largest "acceptable or assumable" level with no need for replacement.Such an aspect, not considered in [1,2], is relevant in determining if different experts' opinions, combined with historical data, lead to an agreement about the need or not of replacements.
Further remarks and a discussion will conclude the paper in Section 4.
Summarizing the major aspects of the paper, it is worth mentioning, first of all, that the work stems from a case study where experts are unable to express quantitative judgments on the quantity of interest (failure rates of eight subnetworks) and their qualitative assessments are transformed into a unique value for each rate, for each person.Cagno et al. [1] used the values assessed by the experts, like "samples" from prior distributions, conveniently chosen by the statisticians (namely gamma and lognormal ones).Other methods are possible to combine the opinion of experts; a relevant one is due to Albert et al. [6].We are considering a different approach, which has roots in the Bayesian robustness literature, reviewed in [7].Coherently, with such an approach, we are considering a class of priors compatible with the unique information provided by the experts, i.e., a set of values for each failure rate.This aspect is important, since we believe that in real-life applications of the Bayesian approach, it is important to be as much as possible adherent to the experts' opinions and try to avoid (or limit) adding arbitrary assumptions.The class proposed in the paper, relying on quantiles, is definitely more realistic than the ones considered in [2].For the problem at hand, the use of the quantile class on the parameter of a Poisson process was a consequence of the available experts' assessments: opinions on the failure rates.In general, we believe that experts are more keen to provide information on observable quantities, like the number of gas escapes in a given time frame and a network of known length.The generalized moment-constrained class, studied in [8], is very powerful, since it allows considering all of the priors compatible with elicited values of moments and/or quantiles of observable quantities.There are cases in which elicitation on the parameters is possible, especially when the parameter has a physical meaning: in our case, it is the failure rate per unit of time and space and an expert (more statistically educated than the ones here) could make assessment on, say, the median and the quartiles of its distribution, just by splitting intervals with the same probability.The analysis performed in the paper can be read also in a different way with respect to how it is presented here, mimicking an actual, interactive process of the assessment of prior beliefs by just one expert and studying the consequences.We start with the assessment of upper and lower bounds on the rates (corresponding here to the largest and smallest values given by the experts), and the obtained ranks of subnetworks are unsatisfactory because of the many overlaps among ranges.The expert is asked to refine his/her assessments first by specifying three and then seven quantiles until the posterior ranges are no longer (or definitely less) overlapping.The use of the graphical tools presented in the paper would be very helpful in such a process of interactive assessment.If it is impossible to get a clear ranking using the expert's opinions or, more simply, if point estimates are needed, then we believe an optimality criterion should be used (and two are presented here and compared).

Bayesian Approach
Sensitivity analysis is an important issue in Bayesian analysis and decision theory.In many fields, it is worth studying how changes in the input parameters affect the output from a model.The issue stems naturally from the difficulty in eliciting experts' judgments, and the case at hand is typical.Experts were able neither to assess "exact" prior distributions on the parameters θ i , nor some features, like their quantiles.The experts were able to provide only qualitative judgments, which were expressed through pairwise comparison of all subnetworks about the propensity of a failure occurring in one class rather than in another.The AHP (analytic hierarchy process) methodology, proposed by [9], was used to obtain rates of occurrence of gas escapes in each subnetwork, whereas further manipulations lead to gamma conjugate priors on θ i 's.In more detail, each expert was presented with a picture of the eight possible configurations (small/large diameter, deep/not deep in the ground, walkway/traffic) and then asked to compare them pairwise.In particular, he/she was asked if, given the occurrence of a gas escape, it was more likely in a subnetwork with respect to another.Calling A and B the two subnetworks, the question was if the occurrence in A was equally/a little more/much more/clearly more/definitely more/a little less/much less/clearly less/definitely less likely than in B. A number was associated with each answer: 1, 3, 5, 7, 9, 1/3, 1/5, 1/7, 1/9, respectively.A square matrix of size eight was obtained out of the pairwise comparisons, and the eigenvector associated with its largest eigenvalue provided the probabilities P 1 , . . ., P 8 that the gas escape had occurred in each subnetwork (mathematical details can be found in [9]).Given an estimate of the unit failure rate θ * of the entire city network, then the guess of the j-th expert on the failure rate of the i-th subnetwork was given by θ (j) i = θ * P i , i = 1, . . ., 8, using the coloring theorem (see [10]).The set of all of those guesses, for each expert and each subnetwork, is the opinions used in the current paper.In [1], they were used as a sample from a gamma prior distribution whose parameters were obtained matching mean and variance with sample mean and sample variance, respectively.The described procedure is subject to criticism, since the selected prior does not reflect the actual knowledge.Therefore, a class of priors, compatible with the prior knowledge, is entertained to solve the problem.
The consideration of classes of priors and loss functions is the starting point for much of the developments in robust Bayesian analysis; see [11] and [7].Excellent surveys of sensitivity analyses with respect to the prior are [11,12] and [13], whereas sensitivity with respect to the loss function has been considered in [14][15][16], among others.The main differences among works in Bayesian sensitivity are about the choice of the classes and the sensitivity measures.

Choice of Prior Distributions
In [1], the experts' opinions were synthesized into one value for the mean and variance of the prior distribution on each failure rate, computing the Bayes estimates (i.e., the posterior mean) using both gamma and lognormal priors.
The work in [2] compared two classes of gamma priors with mean and variance in intervals around the synthesized values from the experts' opinions.The classes lead to different, but similar, ranges on the posterior mean of each class.
In [17], other prior classes were considered.They considered, for each class i, the family of priors: where c is a positive constant, within the same interval for all of the classes, and m i and σ 2 i , ∀i, are the mean and the variance, respectively, obtained in [2].Then, they kept the same (gamma) distribution form for priors, and they considered, for each class, the family of priors: where each π c has mean m i and variance c.
Finally, they studied, for each class i, the family of all of the probability measures sharing the same mean m i and variance σ 2 i as in [2].They obtained the family of priors: a special case of the moment-constrained class, described later.This class, unlike the previous ones, is a first attempt to use the experts' opinions without arbitrary assumptions, like the choice of a gamma distribution.The current work goes even further, since it considers the opinions as they are (after manipulation by AHP) through quantiles of the empirical distribution of the experts' opinions rather than summarizing measures, like mean and variance.The generalized moments class was studied by [8] and further explored in [18], and it is defined as follows: Γ = {π(θ) : where H i are given π-integrable functions and α i (i = 1, . . ., n) are fixed real numbers.Sometimes, the moment conditions are given by equalities.In those works, the aim is to find the range of a quantity of interest F (π) = Θ F (θ)π(θ|x)dθ, when π varies over a class of prior distributions Γ.
Generalized moment classes cover a great variety of classes that are of interest for robust Bayesian analysis.For H i (θ) = θ i , we have ordinary moment conditions on π; for H i (θ) = I C i (θ), we have conditions on the prior probability of sets C i ; and with equalities, we have the quantile class; see, e.g., [19][20][21].
In [1,2], the opinions from fourteen experts were collected using an "ad hoc" questionnaire, and priors were obtained.An estimate of the failure rate for the eight pipeline classes was obtained for each expert, and the sample mean and variance of those estimates were matched with the mean and variance of the entertained priors, obtaining the values of the hyperparameters.The ranges of the experts' (prior) failure rates are shown in Figure 1.Differences among experts can be easily detected from the plot, especially about Classes 3 and 7. Furthermore, it is worth noticing that, for all of the experts, the failure rate in Class 6 is lower than the ones in Classes 3, 4 and 7, whereas the rate of failure in Class 2 is less than in Class 3. Based just on prior opinions, there is no replacement order shared by all of the experts, although there are strong indications about the worst (3 and 7) and best (6) classes.
The previous works could raise some concerns about the proper use of experts' judgments.The choice of a functional form for the prior (gamma or lognormal) is quite arbitrary, since it corresponds to mathematical convenience and not to actual knowledge.The classes of priors entertained in [17] are quite simplistic, even the one determined by sample mean and variance.Here, we propose the use of sample quantiles, out of the empirical distribution of the estimates provided by experts, so that, e.g., we will consider classes of priors with the median corresponding to the sample median of the experts' estimates.Therefore, we will consider the quantile class, Γ = {π : where n i=1 α i = 1 and {C i , i = 1, . . ., n} is a partition of the parameter space Θ.Firstly, the class is obtained considering only three sample quantiles from the distribution of experts' assessed values.Since the range of the non-dominated sets is not "small" enough to avoid overlaps and allow us to make a clear-cut ranking of the classes, we will consider a more restricted class with seven quantiles.In that case, ranking will be more evident especially for the worst and best classes, but some overlaps will be present.Those findings could be sufficient for a decision maker (DM) about planning the replacement of the entire worst subnetwork (not just simply sections) of pipelines, whereas a precise ranking could be obtained introducing a criterion to select one representative value for each class.Here, we will consider two criteria developed in a Bayesian decision analysis framework: the posterior regret (see [22]) and, mostly, the least sensitive action (see [5]).

Estimation of Failure Rate
In this section, we introduce the statistical notions used to perform the estimation of the failure rates in the subnetworks and, consequently, rank them according to the need of replacements.For the readers willing to skip the necessary mathematical details of the section, we would like to point out that, among all possible values a of the failure rate in a set A (namely, the set of positive real numbers), we are using experts' opinions and historical data to find a class of estimates (or a unique value) that satisfy some optimality criteria, aimed to reduce the incurred loss (here, more generally from a class, whereas a unique, squared loss function will be considered in the actual pipeline replacement problem).The former will lead us to the set of non-dominated actions, whereas the latter to the least sensitive action.
We consider the standard Bayesian decision theoretic framework for statistical problems; see, e.g., [23].Let X be an observation from a distribution P θ with density p θ (x).π(θ) denotes a prior distribution belonging to a class of distributions Γ and L a loss function belonging to a class of loss functions L, such that for all a ∈ A, there exists θ a , with L(a, θ a ) = min θ∈Θ L(a, θ) = 0.
Let π x (θ) denote the posterior density when x (possibly a sample) is observed, m π (x) the marginal density, l(θ) the likelihood function and ρ(π, L, a) the posterior expected loss of a, i.e., As a consequence of this model, the solution concept is the set of non-dominated alternatives, or actions, (N D(A)).
and there is a pair (L 0 , π 0 ), such that: When there precision in beliefs and preferences, the solution is given by the Bayes action.Arias-Nicolás et al. [24] modeled beliefs through a class of probability and preferences through a class of convex loss, showing the relation between Bayes actions and the non-dominated set.In [21], the non-dominated set is computed for some classes of probability distributions and loss functions.
In most papers about Bayesian robustness, the range of the posterior expectation of a quantity of interest, F (θ), has been proposed as a measure of sensitivity.If F (θ) = θ, then the range of the posterior mean is obtained, which is the Bayes alternative when the preferences are modeled by the quadratic loss function; see e.g., [25].If F (θ) = I C (θ), the range of the posterior probability of a credible set C is obtained; see [12,[26][27][28][29], among others.
However, the use of measures based on the range can provide misleading conclusions in the sensitivity analysis with respect to the prior or loss function; see e.g., [14].Different approaches have been proposed, e.g., selecting the "best" (with respect to some criterion) optimal alternative.In these situations, the election of alternatives as the conditional Γ-minimax [25,30] and the posterior regret Γ-minimax [22,31] actions could be useful as a way of selecting a single robust solution.
However, these actions could lead to a huge relative increase in posterior expected loss with respect to Bayes actions.Therefore, we propose another measure [5], which is not dependent on the unit of measurements and which generalizes the relative sensitive measure given by [32].
Definition 3. Given a pair (L, π) ∈ L × Γ, let S(π, L, a) be the sensitivity of an alternative a with respect to the pair (L, π), defined as the difference between the posterior expected losses of a and the Bayes action, a * (L,π) , with respect to the optimal expected loss, i.e., . S(π, L, a) can be viewed as the difference in the posterior expected loss when a is used instead of the optimal action a * (L,π) , measured in terms of the optimal posterior expected loss.This measure is an extension of the one defined in [32].
For this sensitivity measure, it is possible to consider the following:

S(π, L, a)
It is easy to see that the LS action (a minimax action, because of its definition) might not be Bayes for any pair (L, π) ∈ L × Γ.However, it is true that the LS action must be a non-dominated alternative.
There is no general algorithm able to compute least sensitive actions in a general class.In [5], an algorithm for classes of convex loss functions is presented.Based on [8], the following result can help computations for some classes of distribution priors, like, for example, the generalized moment-constrained and ǫ-contaminated classes, among others.Proof.It is easy to see that: Conversely, let k and ( L, π) be the values where the supremum is achieved.Then, k must be a Bayes alternative for ( L, π), because for all pairs (L, π) ∈ L × Γ, it holds: . Thus: Note that the denominator in the right-hand side does not depend on a (L,π) , and we do not need the calculation of m π .Now, we use this proposition to determine the sensitivity of the optimal action for the generalized moment-constrained class.
If the moments conditions of Γ are given by equalities, then Condition 1 becomes an equality, as well.A similar result can be obtained considering ǫ-contaminated classes where the contaminating class is determined by generalized moment constraints.
If we consider a quantile class (2), we have the following result: Corollary 1.Let Γ be a quantile class defined as in (2) and L a class of loss functions.Then, for each a, k ∈ A, Proof of Corollary 1.This result follows from the previous proposition and Theorem 1 in [19].

Replacement Policy of Pipelines
The works in [1,2,17] estimated the failure rates (under quadratic loss function), using different priors and classes of prior distributions, and they obtained very similar rankings, slightly different with respect to the ones obtained through maximum likelihood estimation, as discussed earlier.

Posterior Ranking of Pipelines
We start by considering the quantile class (2) determined by the three quartiles of the empirical distribution of beliefs from the same fourteen experts considered in [1,2], i.e., we choose α i = 1/4, i = 1, ..., 4. The Type 2 quantile algorithm discussed in [33] is employed to obtain the quantiles.Since we have the goal of ranking the classes, we need a unique value for the estimation of the failure rate in each class.We choose an optimal solution compatible with the "relative least sensitive" criterion (detailed in [5]).The optimal solution belongs to the set of non-dominated actions, so the first step consists of determining such a set.Since the preferences are modeled by a class of convex loss functions, the non-dominated actions belong to the interval delimited by the infimum and the supremum of the Bayes alternatives; see [24].Note that considering a quadratic loss function, the posterior expected loss of an alternative a is (a − µ πx ) 2 + V πx , being µ πx and V πx the posterior mean (Bayes alternative) and variance (optimal posterior expected loss), respectively.The posterior regret and the sensitivity of a can be computed by the expressions: and: Then, applying the previous results, the supremum (infimum) of the posterior means can be computed by: The non-dominated set for each class is illustrated in Figure 2 and Table 4, where the range (the difference between supremum and infimum, typically considered in Bayesian robustness) is presented, as well.
In a "classical" robust Bayesian analysis, the major interest would be on Classes 3 and 8, since their ranges are quite large, denoting a lack of robustness with respect to the choice of the prior distribution, unlike Class 6, where the range is very small.Further elicitation on those classes would be necessary to reduce those ranges.Here, the focus is quite different: we are interested in ranking classes, possibly through non-overlapping ranges, regardless of their size.From Figure 2, it can be easily seen that Classes 3 and 7 are the ones in major need of replacement, although the order of replacement between Class 7 and Class 8 is not so clear because of overlapping non-dominated sets.It is worth mentioning that Class 8 is the one suggested as the worst according to the MLE.From the figure, it is evident that Class 6 has the lowest failure mean, like in the MLE case, and it should be the last to be replaced.To be able to decide the replacement priority of the other classes, we choose an optimal alternative inside the non-dominated set: we opt for the least sensitive alternative, which outperforms other optimality criteria, like posterior regret gamma-minimax (PRGM), as discussed later.The proposed procedure is perfectly coherent with a robust Bayesian approach: a measure of robustness (e.g., the range) is provided, and any prior can be chosen if the measure is "small", whereas a prior is chosen according to some optimality criterion and reported along with the robustness measure when this is "large".Then, for all a ∈ N D(A), we calculate the sensitivity of a. Applying the previous results, we obtain: We know that the supremum is achieved within the set of Bayes alternatives, i.e., the posterior means of discrete measures with one point in the closure set of each C i .Then: , and we calculate the least sensitive action and its sensitivity for each pipelines class (see Table 5).In accordance with the criterion of the least sensitive alternative in each class, we observe that the pipelines in Class 3 are the first ones that should be replaced.This conclusion will be reinforced later when we will consider the class determined by seven quantiles.However, the optimal alternative in Class 3 is more sensitive than the optimal one in Class 7: this is due to a higher relative increase in posterior expected losses with respect to Bayes actions in Class 3 than in Class 7 and, to a lesser extent, related to the different size of the range, as discussed earlier.We observe also that the results vary slightly with respect to the ones obtained with the posterior regret Γ-minimax.The most significant changes are in Class 8 and, to a lesser extent, Class 1.In particular, pipelines in Class 8 are ranked seventh according to the least sensitive action criterion and fourth when considering posterior regret Γ-minimax actions.Note that, considering quadratic loss functions, the computation of the PRGM action just depends on the Bayes alternative values (see Expression ( 4)).The PRGM action is always the middle point of the set of non-dominated actions; see [22].However the value of the LS action depends on both the Bayes alternatives and their posterior expected losses (see Expression (5)).In Class 8, the non-dominated set is [0.0495, 0.1330], and the PRGM is the middle point 0.091, which has a sensitivity of 27.51.The supremum of the relative increase in posterior expected loss of the PRGM action is achieved for the discrete distribution π ∈ Γ concentrated at θ 1 = 0.04, θ 2 = 0.045, θ 3 = 0.049 and θ 4 = 0.06; its posterior mean is µ πx = 0.051, and its posterior variance (or posterior expected loss) is V π = 0.000058.However, the LS action for this class is 0.0618, which has a sensitivity of 2.03.The supremum of the relative increase in posterior expected loss of this action is achieved for the distribution in Γ concentrated at θ 1 = 0.02, θ 2 = 0.04, θ 3 = 0.045 and θ 4 = 0.16; its posterior mean is 0.1325, and the posterior variance is 0.002.As was mentioned earlier, the choice of PRGM actions can be unsuitable, since these actions can provide very large relative posterior expected losses for the possible prior distributions; see [5].Note that, in this case, the relative sensitivity measure takes in to account both the Euclidean distance between Bayes alternatives and the posterior variance (the optimal expected loss).The squared root of the relative sensitivity shows how many times the Euclidean distance is greater than the standard deviation.Then, for example, in Class 8 and in the worst case (when the supremum of the relative increase in posterior expected loss is achieved), the distance between PRGM action and the Bayes action is more than five-times larger than the standard deviation.Therefore, the PRGM action would be unlikely, if the distribution with posterior mean µ πx = 0.051 and posterior variance V π = 0.000058 were the correct one.However, and in the worst case, the distance between the least sensitive action and the corresponding Bayes action is "only" less than 1.5-times the standard deviation.
Regarding the relative sensitive measure, there is a lack of robustness in Classes 1, 3, 5 and 8, mainly.These classes, except Class 5, are the ones with the largest sets of non-dominated actions.We would like to point out that the LS action (0.0746) in Class 5 has a relative sensitivity of 5.0056, meaning that the supremum of relative increase in posterior expected loss of this action (and of all actions) is greater than 500%; the supremum is achieved for a distribution with posterior mean 0.0612 and posterior variance 0.000036.Despite some clear findings, there is still some uncertainty about rankings of failure rates, so that we need to find ways to reduce it: we will increase the number of quantiles matching the empirical ones and consider a quantile class with seven quantiles (see Table 6).We note from Figure 3 and Table 7 that the non-dominated set for each pipelines decreases significantly (in particular, for Classes 1, 3 and 8, as discussed above).Now, it is evident (even graphically) that pipelines in Class 3 are the first ones to be replaced, followed by those in Class 7.However, due to overlapped non-dominated sets, the order of replacement is not clear between Classes 4 and 8 (the two classes with the largest failure rates after Classes 3 and 7).Something similar occurs with Classes 1 and 2 (actually, the non-dominated set of the former contains the latter).The most reliable pipelines (with lower posterior failure mean) are in Classes 6 and 5, although the latter slightly overlaps with Class 1.At this point, a decision maker, in charge of the actual replacement of the pipelines, could decide either to stop the analysis (and act) or take further steps.In the former case, he/she would be certain that historical data and experts' judgments are providing clear indications about the pipelines to replace first, regardless of the actual prior chosen in the Bayesian analysis (in fact, any prior in the quantile class will identify Classes 3 and 7 as the worst ones, in the same order).In the latter case, he/she could decide either to get a more restrictive class (e.g., with more quantiles) or to select a criterion to choose an action within each non-dominated set and rank classes or pipelines according to those values.For illustrative purposes, we decide not to refine the class further and to choose actions according to the criterion of the relative sensitivity measure.Table 8 shows the least sensitive actions and their sensitivity for a quantile class with seven quantiles and compares them with the posterior regret Γ-minimax.We can observe that the ranking according to the two criteria almost coincides (just Classes 1 and 2 swap).The most significant change with respect to the three quantile class occurs in Class 8: earlier, it was ranked either seventh or fourth, whereas now, it is third.Probably, the use of more quantiles increased the probability assigned by the experts to higher values of the failure rate.

Threshold Exceedance
The works in [1,2,17] were interested only in the comparison of different classes of pipelines to suggest which class needed replacement first.Here, we are addressing a different problem, as well, i.e., if a class should be replaced or not.The gas company is not only interested in which pipelines should be replaced first, but also in those that should be replaced to ensure sufficient safety.Therefore, we propose to determine the supremum, over a class of prior distributions, of the posterior probability of exceeding a critical failure rate, and we compute sup π∈Γ P π [θ > θ|x], where θ is the "acceptable or assumable" failure rate.
We consider also the maximum allowed posterior risk α, so that no replacement is required for pipelines in a class where: for a given posterior distribution π x .
In our case, we are dealing with a class of priors Γ, and (6) should hold for all of the priors in Γ.Under such circumstances, there should be no need to replace the pipelines regardless of the chosen prior in the class, making the decision less affected by the arbitrariness in the choice of a unique prior.In the same way, we can consider computing the infimum of the posterior probability P π [θ > θ|x].If the infimum is greater than a critical value β, then we could conclude that the pipelines in that class should be substituted.
Therefore, for all classes, we compute the supremum (infimum) of the posterior risk for any value θ of "acceptable" failure rates.In this case, we consider the class of priors determined by seven quantiles, like in the previous section.Using an argument similar to Corollary 1, we have:  Considering, as an example, Class 1 in Figure 4, it can be seen that, for an allowed posterior risk α = 0.2 and a critical value of β = 0.7, the infimum is above β when θ < θβ = 0.055, whereas the supremum is below α when θ > θα = 0.098.Therefore, if a DM decides that a value of θ smaller than 0.055 is deemed critical, then the pipelines should be replaced, since the opinion of each expert leads to exceedance of the critical value.Similarly, if the DM assumes θ greater than 0.098, then each prior, based on individual expert's opinion, leads to the decision of not replacing the pipelines.No clear-cut decision is possible when the DM chooses θβ < θ < θα .In this case, either a smaller class of priors could be entertained or other aspects should be taken in to account by the DM, like choosing an optimal action (e.g., PRGM or least sensitive action), as discussed earlier.
Similarly, from Class 8 in Figure 5, it can be seen that, for a critical value β = 0.7, the infimum of the posterior regret is above it when θ < θβ = 0.047.Therefore, the pipelines should be replaced if the DM decides that the value of θ is smaller than 0.047.In this case, the supremum is below an allowed posterior risk α = 0.2, when θ > θα = 0.16.Therefore, if the DM assumes θ is greater than 0.16, this leads to the decision of not replacing the pipelines.Note that, in all classes in Figure 4, the DM should assume a minimum "acceptable" failure rate θα above all failure rates from the experts' beliefs, to make a decision of not replacing the pipelines.
Results for all classes are summarized in Tables 9 and 10.In particular, Table 9 shows the estimation of (minimum) acceptable failure rates θ, verifying Condition (6), for selected values of maximum allowed posterior risk α.It is important to highlight that both the acceptable failure rates and the maximum allowed posterior risk should be set by the DM, and they can depend not only on financial factors, but also on social, environmental and budgetary aspects in each class.Table 10 shows the estimation of (maximum) acceptable failure rates θ, for which the infimum of posterior probability P π [θ > θ|x] is greater than some critical values β.Based on the tables and the plots, it is possible to determine if there are classes of pipelines that need replacement or not.From Table 9, we can observe that, for a maximum allowed posterior risk α = 0.2 and regardless of the prior, the pipelines in Classes 1, 3 and 7 need no replacement if the values 0.098, 0.320 and 0.185 (or greater values) correspond to an acceptable failure rate, respectively.Note that only in such classes (all corresponding to shallow pipelines), for α = 0.2, the "acceptable" failure rates are not exceeding the ones corresponding to the medians obtained from the experts' judgments.Therefore, it is worth noticing that more than half of the experts expect that these "acceptable" failure rates will be exceeded.
As an example, we consider the pipelines in Class 3 (the worst class): the historical data reflect 15 failures over 14.09 km over a six-year period.However, the median of the failure rates from experts' beliefs is 0.32, corresponding to approximately 27 failures in such a network over the same period, significantly above the historical data.In this class, for all prior distributions in Γ (the class determined by seven quantiles), the probability P [θ > θ|x] is less than α = 0.2 when θ exactly coincides with the prior median 0.32.Therefore, if the DM considers the values for α = 0.2 and θ = 0.32 "acceptable" for Class 3, there is no need to replace the pipelines in the class.
For the same maximum allowed posterior risk α = 0.2, the pipelines in Class 6 (the best class) need no replacement if θ = 0.05 is considered as an acceptable failure rate.The estimation for the acceptable failure in this class is obviously smaller than the corresponding ones in Class 3.However, as we mentioned earlier, the values θ and α should be set by the DM, and they could be different across the classes, because of many factors, like the costs of replacing deep or shallow pipelines and the risks associated with gas escapes in the two environments.
Looking at Table 10, a similar discussion could be done, observing, for example, that the pipelines in Classes 2, 6 and 8 should be replaced for values of θ equal to 0.056, 0.030 and 0.040, respectively, when choosing a minimum critical value β = 0.80.
So far, we have considered θ and α fixed by the DM a priori, but the previous plots and tables could be a helpful tool for the DM in determining the values of θ and α corresponding to his/her preferences.

Discussion
In this paper, we have illustrated a methodology that addresses and can overcome the major criticisms about the Bayesian approach, i.e., arbitrariness in the choice of the prior distribution and difficulty in properly using the information provided by the experts.Taking a robust Bayesian approach, we have been able to relax the assumption about a unique prior, and we used the information gathered from the experts to build classes of priors compatible with their knowledge.We have shown how decisions can be made by managers by looking at very simple plots expressing a set of non-dominated actions or by selecting optimality criteria that provide unique values used in ranking pipelines according to their need for a replacement.The proposed methodology improves upon previous works [1,2,17], since it is less dependent on the statistician's choice on the functional form of the prior distribution (or classes of them) and closer to what the experts actually elicited.The procedure could be implemented in a more interactive way, where experts could be asked more and more information to get finer and finer classes, whose effects should be interactively presented to the experts/decision makers through the tables and the figures shown in this paper.
The proposed approach can find application in many other fields where classes of priors can be specified on parameters and quantities of interest could be compared and ranked a posteriori.Classes of priors could be the result of opinions of different experts or imprecise assessment of a unique expert, whereas the quantity of interest could be the posterior predictive probability of at least a 5% yearly gain, or the expected gain for different investments to choose from, or the expected number of failures, over a five-year period, of washing machines from different brands.The method works better when it is possible to obtain more and more information from the experts, at a relatively inexpensive price, like here, when moving from three to seven quantiles and obtaining narrower sets, with no overlap among the ones of major interest.The method is useful also in determining for which systems (here, gas subnetworks; and investments and brands in the above) is more crucial to get further information and avoid overlaps.
We have also proposed a robust Bayesian approach on the selection of pipelines to be replaced or not, regardless of their ranking, based on the exceedance of acceptable failure rate and risk.We have provided tables and figures that could be helpful in making decisions, loosening the dependence on the selected prior distributions.

Figure 1 .
Figure 1.Range of prior failure rates for the different pipelines classes.

Definition 4 .
a ls is the least sensitive (LS) alternative for L × Γ if:S(a ls ) = inf a∈A S(a),where S(a) will denote the sensitivity of an action a with respect to L × Γ, i.e., S(a) = sup (L,π)∈L×Γ

Figure 2 .
Figure 2. Range of posterior non-dominated set for the different pipelines classes (three quantiles).

Figure 3 .
Figure 3. Range of posterior non-dominated set for the different pipelines classes (seven quantiles).

Figure 5 .
Figure 5. Supremum and infimum of the posterior risk for any value θ in Classes 2, 6 and 8.

Table 2 .
Classes of pipelines, according to low/high (L/H) levels of factors.

Table 3 .
Quartiles of expert's prior failure rate for each class.

Table 4 .
Non-dominated set for the different pipelines classes (three quantiles).

Table 5 .
Least sensitive and posterior regret actions for each class (three quantiles).

Table 6 .
Quartiles of expert's prior failure rate for each class.

Table 7 .
Non-dominated set for the different pipelines classes (seven quantiles).

Table 8 .
Least sensitive and posterior regret actions for each class (seven quantiles).
which depends on the value θ.The infimum is obtained similarly.Figures4 and 5present suprema (and infima) for some classes and any value of "acceptable" failure rate.The corresponding medians obtained from the experts' prior judgments are also represented by means of a vertical line, Me.Supremum and infimum of the posterior risk for any value θ in Classes 1, 3 and 7.