On the use of expected values in safety management