Layers of protection analysis using possibility theory