lable at ScienceDirect

Journal of Natural Gas Science and Engineering 25 (2015) 124e133

Contents lists avai

Journal of Natural Gas Science and Engineering

journal homepage: www.elsevier .com/locate/ jngse

A comprehensive risk evaluation method for natural gas pipelines bycombining a risk matrix with a bow-tie model

Linlin Lu a, Wei Liang a, *, Laibin Zhang a, Hong Zhang a, Zhong Lu b, Jinzhi Shan b

a College of Mechanical and Transportation Engineering, China University of Petroleum, Beijing, 102249, Chinab Petrol China Beijing Gas Pipeline Co. Ltd., Beijing, China

a r t i c l e i n f o

Article history:Received 8 January 2015Received in revised form20 April 2015Accepted 21 April 2015Available online 15 May 2015

Keywords:Bow-tie modelRisk matrixFuzzy methodNatural gas pipeline

* Corresponding author.E-mail addresses: lulinlin1211@163.com, lw@cup.e

http://dx.doi.org/10.1016/j.jngse.2015.04.0291875-5100/© 2015 Elsevier B.V. All rights reserved.

a b s t r a c t

Leakage from natural gas pipelines causes severe economic loss and significantly affects social securityconsidering the gas' combustibility and the difficulties in detecting leakage. This study proposes acomprehensive risk evaluation method by combining a risk matrix with a bow-tie model. First, a bow-tiemodel is built, considering the risk factors that may lead to an accident using a fault tree; the conse-quences of unwanted events are then described in an event tree. Second, a fuzzy method is used tocalculate the failure probabilities. Third, the severity of an accident is evaluated through an index systemthat includes personal casualties, economic losses and environmental disruptions. Finally, a risk matrixconsisting of a probability ranking criterion and a consequence ranking criterion is proposed to reach anintegrated quantitative conclusion of a bow-tie model. A case study of an underwater pipeline carryingnatural gas has been investigated to validate the utility of the proposed method.

© 2015 Elsevier B.V. All rights reserved.

1. Introduction

Leakage from natural gas pipelines can cause devastating acci-dents due to the flammability of the gas, which is transported athigh pressures. In recent years, accidents in natural gas pipelineshave occurred too often and have drawn significant public atten-tion. Thus, the implementation of safety measures followed by acomprehensive risk evaluation is critical to maintain a level of riskbelow the acceptable criteria. The risk evaluation of pipelinescurrently includes a quantitative risk analysis (QRA) and an acci-dent consequence analysis (ACA).

In a QRA, Muhlbauer (2004) proposed an integrated andcontinuously improving risk evaluation framework for pipelinesthat has become the guideline for pipeline risk assessment. Thepurpose of this framework is to evaluate a pipeline's risk exposureto the public and to identify ways to effectively manage that risk.Ma et al. (2013a) used geographical information systems (GIS) tocalculate the quantitative risk of urban natural gas pipeline net-works. The proposed QRA process incorporated an assessment ofthe failure rates of integrated pipeline networks, a quantitativeanalysis model of accident consequences, and assessments of in-dividual and societal risks. Jo and Ahn (2005) also used GIS to assessthe quantitative risk of natural gas pipelines. Han andWeng (2010)

du.cn (W. Liang).

proposed a quantitative assessment index system that included acausation index, an inherent index, a consequence index and theircorresponding weights for urban natural gas pipelines. The failureprobability calculation is an important part of a QRA. Yuhua andDatao (2005) used a fuzzy fault tree to investigate the risk factorsand calculate the failure probabilities of natural gas pipelines.Shahriar et al. (2012) applied a fuzzy approach to calculate the fuzzyprobabilities (i.e., likelihood) of a basic event in a fault tree for oiland gas pipelines. There are also other relevant works in the liter-ature, such as that of Ma et al. (2013b) and Jamshidi et al. (2013),that investigate the QRAs of pipelines.

In an ACA, an event tree has been shown to be an efficient tool.As the first step in the multidimensional risk analysis of a hydrogenpipeline, Lins and de Almeida (2012) built an event tree thatincluded all possible accident scenarios including punctures andruptures of the pipeline. To calculate the safety distances around apipeline transporting liquefied gas and pressurized natural gas,Sklavounos and Rigas (2006) used an event tree analysis as a formaltechnique to determine the possible outcomes of an accidental fuelgas release. Event tree analysis is also widely used to identifydangerous scenarios with regard to hydrogen pipelines (Lins and deAlmeida, 2012), dynamic analyses for transient systems (Zamalievaet al., 2013) and accident analyses of different hazardous materials(Vílchez et al., 2011).

QRA and ACA are related and dependent on each other becauserisk identification is the first step of consequence analysis. The

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 125

bow-tie model is an innovative approach and a good combinationof QRA and ACA and is thus widely used in safety analysis (Ferdouset al., 2013) and risk management (Chevreau et al., 2006). However,one of the limitations in the existing implementation of the bow-tiemodel is a lack of quantitative conclusions; many researchers haveinvestigated the construction of bow-tie models but not theirquantification.

To achieve a quantitative conclusion from a bow-tie model, aquantitative risk matrix that includes ranking probability criteriaand consequence severity criteria is proposed in this study toquantify the probability and consequence of a given accident. Thepurpose of this study is to develop a comprehensive approach toidentify the risk factors and evaluate the severity of the conse-quences of an unexpected event. The procedure of the proposedapproach is presented in Section 2. This procedure includes foursteps: the construction of the bow-tie model, the fuzzy probabilitycalculation, the consequence analysis of an accident and a riskmatrix analysis. In Section 3, an application of the proposedapproach is presented for the risk analysis and consequenceassessment of an underwater pipeline. Section 4 then presents theconclusions of the study.

2. Procedures

The procedure of the proposed risk evaluation method is shown

Fig. 1. Schematic diagram of b

in Fig. 1 and consists of a risk analysis and a consequence assess-ment in terms of a building fault tree and an event tree, respec-tively. In the risk analysis, a fuzzy method is applied to convert anatural linguistic expression into a failure probability. In theconsequence assessment, an index system is introduced to furtherassess the consequence in terms of environmental cost, personalinjury and economic loss. In the end, to reach a comprehensiveconclusion, the risk matrix method is applied to combine the re-sults of the risk analysis and the consequence assessment.

2.1. Construction of a bow-tie model

A bow-tie model is widely applied in risk analyses, includingprobability calculations (Khakzad et al., 2013), human error riskanalysis (Deacon et al., 2010, 2013), dynamic risk analysis (Khakzadet al., 2012), etc. A bow-tie model is comprised of a fault tree, whichrepresents the risk factors of a failure, and an event tree, whichrepresents the consequences of a failure. Both the fault tree and theevent tree are effective graphical methods and are widely used insafety analyses of complex systems; this makes a bow-tie model tohave significant potential in this field. Fig. 2 shows the basicstructure of a bow-tie model. X, E and T are the primary, interme-diate and top events of the fault tree, respectively, and I and C standfor the ignition (or safety barrier) and the accident consequence inan event tree, respectively.

uilding a bow-tie model.

Fig. 2. Basic structure of a bow-tie model.

Fig. 3. Membership functions.

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133126

2.2. Calculation of a fuzzy probability

To evaluate the failure probability of the top event in a fault tree,the probabilities of the primary events must be known in advance.Because it is difficult to obtain detailed statistical probability data ofprimary events, a fuzzy method that consists of 3 steps is proposedas shown below:

Step 1: Collect a natural linguistic expression of a risk factorstatus.Step 2: Convert the natural linguistic expression to a fuzzynumber.Step 3: Convert the fuzzy number to a failure probability.

Further explanations of the above steps are described below.In step 1, the likelihood of occurrence of a primary event is

described in a natural linguistic expression by experienced expertsfrom different fields (e.g., operation, maintenance, management,installation and design). This likelihood of occurrence can becategorized into five levels: Very Low (VL), Low(L), Medium(M),High(H) and Very High(VH). Considering the different opinionsgiven by experts, a multi-expert scoring method is frequently rec-ommended. The weights of the experts are defined based on theircapabilities, and their capabilities are often evaluated by an analytichierarchy process (AHP).

In step 2, a numerical approximation approach is proposed toconvert the linguistic expression to a corresponding fuzzy number(Chen et al., 1992). Fuzzy numbers can be expressed by fuzzymembership functions. Triangular and trapezoidal fuzzy member-ship functions are generally preferred in fuzzy theory. The trian-gular fuzzy number is defined as A ¼ (a,b,c), and its membershipfunction is shown in Eq. (1). Similarly, the trapezoidal fuzzy numberis defined as A ¼ (a,b,c,d), and its membership function is shown inEq. (2):

f ðxÞ ¼

8>>>>>>><>>>>>>>:

0 x> ax� ab� a

a< x � b

c� xc� b

b< x< c

0 x> c

(1)

f ðxÞ ¼

8>>>>>>>>>><>>>>>>>>>>:

0 x> ax� ab� a

a< x � b

1 b< x< c

d� xd� c

c< x<d

0 x> d

(2)

In this study, the triangular fuzzy membership is used. Themembership functions and their corresponding figures of the fivedifferent levels are shown in Eqs. (3)e(7) and Fig. 3. The subscriptsVL, L, M, H, and VH in Eqs. (3)e(7) and Fig. 3 represent the fivedifferent levels of the linguistic expression, as described above.

fVLðxÞ ¼

8>>><>>>:

1 0< x � 0:1

0:2� x0:1

0:1< x � 0:2

0 otherwise

(3)

fLðxÞ ¼

8>>>>><>>>>>:

x� 0:10:15

0:1< x � 0:25

0:4� x0:15

0:25< x � 0:4

0 otherwise

(4)

fMðxÞ ¼

8>>>>><>>>>>:

x� 0:30:2

0:3< x � 0:5

0:7� x0:2

0:5< x � 0:7

0 otherwise

(5)

fHðxÞ ¼

8>>>>><>>>>>:

x� 0:60:15

0:6< x � 0:75

0:9� x0:15

0:75< x � 0:9

0 otherwise

(6)

fVHðxÞ ¼

8>>><>>>:

x� 0:80:1

0:8< x � 0:9

1 0:9< x � 1

0 otherwise

(7)

The corresponding fuzzy numbers are defined as follows:

fVL ¼ ½0;0;0:1;0:2�; fL ¼ ½0:1;0:25;0:4�; fM ¼ ½0:3;0:5;0:7�;fH ¼ ½0:6;0:75;0:9�; fVH ¼ ½0:8;0:9;1;1�:In fuzzy environments, the basic operations of fuzzy numbers

such as their addition, subtraction, multiplication and division aregenerally implemented through l-cut. For the given l 2 [0,1], thel-cut for the fuzzy numbers A and B can be described as:

Al ¼ fx; x2R; fA � lg ¼hal1; b

l1

i

Bl ¼ fx; x2R; fB � lg ¼hal2;b

l2

i

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 127

Thus, the corresponding l-cuts of the fuzzy numbers are definedas:

f lVL ¼ ½0;0:2� 0:1l�; f lL ¼ ½0:15lþ 0:1;0:4� 0:15l�;f lM ¼ ½0:2lþ 0:3;0:7� 0:2l�; f lH ¼ ½0:15lþ 0:6;0:9� 0:15l�;f lVH ¼ ½0:1lþ 0:8;1�

The basic operations of fuzzy numbers can be expressed by theirl-cut (Jin et al., 2003):

Að þ ÞB ¼ Al þ Bl ¼hal1 þ al2; b

l1 þ bl2

i

Að � ÞB ¼ Al � Bl ¼hal1 � al2; b

l1 � bl2

i

Að � ÞB ¼ Al � Bl ¼hal1 � al2; b

l1 � bl2

i

al1 � 0; al2 � 0

Að÷ÞB ¼ Al÷Bl ¼hal1÷b

l2; b

l1÷a

l2

i

al1 � 0; al2 >0

Different experts often have different opinions of the sameprimary event; thus, it is necessary to integrate their opinions into asingle opinion. There are many methods to aggregate fuzzynumbers, such as the Max-min Delphi method proposed byIshikawa et al. (1993), the Arithmetic method proposed by Lin andWang (1997) and the Linear Opinion Pool proposed by Clemen andWinkler (1999). The Linear Opinion Pool is recommended in thisstudy and is shown in Eq. (8):

fi ¼Xnj¼1

wejAij; i ¼ 1;2;…;m; j ¼ 1;2;…;n (8)

where fi is the integrated fuzzy number of event i, wej is the weightof expert j, Aij is the fuzzy number for event i given by expert j,m isthe total number of events and n is the total number of experts.

In step 3, themethod of converting the fuzzy number to a failureprobability consists of two parts: the conversion from the fuzzynumber to a fuzzy possibility score and the conversion from thefuzzy possibility score to a failure probability. The preferredmethod of transforming a fuzzy number to a fuzzy possibility scoreis the maximizing set and minimizing set method proposed byChen (1985). A fuzzy possibility score is defined as:

FM ¼ FMR þ 1� FML

2(9)

where FMR and FML represent the right and left utility scores of thefuzzy number, respectively; these values are defined as:

FMR ¼ sup½fMðxÞ∧fmaxðxÞ� (10)

FML ¼ sup½fMðxÞ∧fminðxÞ� (11)

The symbol sup in Eq. (10) describes the y-value of the co-ordinates of the intersection point of fM with from the right side offmax. Similarly, in Eq. (11), sup describes the y-value of the co-ordinates of the intersection point of fM with from the left side offmax.

fmax(x) and fmin(x) represent the fuzzy maximizing and

minimizing sets, respectively, and are defined as:

fmaxðxÞ ¼�x 0 � x � 10 otherwise (12)

fminðxÞ ¼�1� x 0 � x � 10 otherwise

(13)

The fuzzy possibility score can be converted to a failure proba-bility by the empirical equation proposed by Onisawa (1988, 1990):

F ¼8<:

1

10kFMs0

0 FM ¼ 0(14)

k ¼�1� FMFM

�1=3

� 2:301 (15)

In this section, the natural linguistic expressions given by ex-perts are expressed as fuzzy numbers. The operations of the fuzzynumbers are expressed by the corresponding l-cuts operations.This method transforms natural linguistic expressions into failureprobabilities.

2.3. Consequence analysis

Generally, the consequence assessment system can be catego-rized into personal casualties, economic losses and environmentaldisruptions. Personal casualties are always applied to evaluate theconsequence caused by combustion, explosion or poisoning, andrefers to the potential damage to surrounding persons (not onlyworkers but also residents). Accidents can damage equipment,cause a loss of materials, produce delays or suspend production.Economic losses consist of maintenance costs, reinstallationcharges for damaged equipment and direct losses due to produc-tion shutdown and are recorded in the relevant currency. Envi-ronmental disruptions consist of the amount of pollutants or theexpense applied to the removal of pollutants. Environmental dis-ruptions also draw significant attention from the media and thepublic, and the resulting damage to a company's reputation istypically much more important than the resulting economic losses.The basic factors that should be considered in a consequenceassessment are shown in Table 1 (Yongji, 2004).

If an accident may result in three probable consequences, thetotal loss of the accident is calculated using Table 2 and Eq. (16)(Yongji, 2004). The total loss of an accident is defined as:

C ¼X3i¼1

ðPiSi þ PiCi þ PiEiÞ (16)

where C is the total loss of an accident, Pi is the probability ofconsequence i, Si is the personal casualty loss of consequence i, Ci isthe economic loss of consequence i and Ei is the environmentaldisruption loss of consequence i.

2.4. Risk matrix

The risk matrix used in this study can be categorized into twocategories: 2� 2and 5� 5. The 2� 2matrix is shown in Table 3, andthe 5 � 5 matrix is shown in Fig. 4. The failure probability can becategorized into two levels in the 2 � 2 matrix: notable andnegligible. Similarly, the consequence can be categorized as eitheracceptable or unacceptable. The risks are categorized into threelevels: high, medium and low. The failure probability and the

Table 1Factors to be considered in a consequence assessment.

Personal casualty Economic loss Environmental disruption

Assessment system of combustion and explosionThe factors leading to personal

casualties may include combustion,direct shock wave, indirectshock wave, and indirect casualties.

The factors leading to economiclosses may include maintenance costsof damaged equipment,reinstallation charges of damaged equipment,direct losses due to production shutdown,and reputation losses.

The factors leading to environmentaldisruption may include the leakageof toxic gas and smoke.

Assessment of poisoningThe factors leading to personal casualties

may include leakage of toxic gas,leakage of suffocating gas, andimpaction of pressurized fluid.

The factors leading to economic losses mayinclude maintenance costs of damagedequipment, direct losses due to productionshutdown, and reputation losses.

The factors leading to environmentaldisruption may include theleakage of gas and other hydrocarbons.

Table 2Total loss calculation for an event tree.

No. P Sub index Contribution to the total loss

Personal casualty Economic loss Environmental disruption Personal casualty Economic loss Environmental disruption

1 P1 S1 C1 E1 P1 � S1 P1 � C1 P1 � E12 P2 S2 C2 E2 P2 � S2 P2 � C2 P2 � E23 P3 S3 C3 E3 P3 � S3 P3 � C3 P3 � E3

Table 32 � 2 risk matrix.

Level of failure probability Risk level and the corresponding measurement

Notable probabilityP > 10�5 (Level 2, 3, 4, 5)

Medium riskStrengthened detection andmonitoring are required to reduce risk.

High riskMeasurement that can reduce riskshould be conducted immediately.

Negligible probabilityP < 10�5 (Level 1)

Low riskCheck if the evaluated factors havechanged due to operational condition changes.

Medium riskConsider the possibility of conversionfrom a low-probability event to a high-probability event.

Level of consequence Acceptable consequence(Very low)

Unacceptable consequence(Low, Medium, High, Extremely high)

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133128

associated consequence with the risk in the 5 � 5 matrix can becategorized into 5 levels, as shown in Fig. 4. Level I is “very lowrisk”, which indicates that no measurement should be taken; levelII is “low risk”, which indicates that the pipeline can be run regu-larly with increased monitoring and maintenance; level III is“medium risk”, which indicates that a detailed analysis and coun-termeasures should be performed to reduce the risk of the situa-tion; level IV is “high risk”, which indicates that a maintenanceproject should be launched in the near future to avoid an accident;

Fig. 4. 5 � 5 risk matrix.

level V is “very high risk”, which predicts on-going leakage andindicates that a maintenance project must be implemented as soonas possible.

The quantitative and qualitative ranking criteria and their cor-responding regarding failure probabilities are shown in Table 4. InTable 5, the ranking criteria of the consequences are expressed interms of economic loss (Hong et al., 2007).

3. Risk evaluation of an underwater pipeline

3.1. Bow-tie model application

3.1.1. Identification of risk factorsThe risk factors of an underwater pipeline are different from

those of a buried pipeline. The object of interest in this section is thenatural gas transmission pipeline (Lines 1 and2) from Tianjin City,China to Hebei province, China, which belongs to the China NationalPetroleum Corporation (CNPC). Line 1 was built in 2003 with adesigned pressure of 10 MPa, a diameter of 711 mm and a length of43.8 km. Line 2 was built in 2005 with a designed pressure of10 MPa, a diameter of 711 mm and a length of 43.4 km. These twopipelines were initially buried underground but are now submergedin water due to a change in the path of a nearby river. Based on thestatistical data provided by the pipeline's management, the depth ofthe water is 1.5 me6.0 m, and the total length of the submergedsection of the pipeline exceeds 25% of its total length in 2011. Fig. 5shows the field condition of these pipelines before and after being

Table 4Ranking criterion of failure probability.

Level Failure probability (per year) Explanation

Quantitative criterion Qualitative criterion

5 >10�2 Regarded as leakage Leakage may occur in a few samples4 10�3~10�2 Extremely high risk of leakage Leakage may occur in significantly of samples3 10�4~10�3 High risk of leakage Leakage beyond service time may occur in a few samples2 10�5~10�4 Low risk of leakage Leakage beyond service time may occur in significantly of samples1 <10�5 No leakage Nearly no leakage

Table 5Ranking criterion of consequence severity.

No. Amount of loss (thousand $) Level

1 <1.6 Very low2 1.6e16 Low3 16e160 Medium4 160e1600 High5 >1600 Extremely high

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 129

submerged. Because these pipelines were laid underground initially,no additional protection measurements, such as crossing the pipe-line, were implemented. Water impaction typically leads to hangrisk, and hangmay eventually yield rupture. Considering this specialsituation and its complex underwater environment, a safety analysisis required to avoid severe accidents.

The undesirable event of gas release is selected as the top eventin the fault tree analysis. Leakage in the pipelines can be caused bytwo events: rupture and puncture. Considering the circumstance ofthe underwater pipeline, the primary causes for these eventsinclude interference from a third party, corrosion, incorrect oper-ation, fatigue, an inherent defect, etc. All of the factors mentionedabove may lead to gas release; thus, they are considered to be in-termediate events in the fault tree. The root reasons for the topevents are regarded as the primary events. The fault tree of theunderwater pipeline consists of 26 primary events, as shown inFig. 6. Further descriptions of the primary events are shown inTable 6.

3.1.2. Consequence of pipeline leakageNatural gas is toxic and combustible, and may lead to a

poisoning accident or a combustion and explosion (i.e., deflagra-tion) accident if preventive or protective measures are not taken toavoid or mitigate these accidents. Therefore, the final accidents inthe event tree of the natural gas leakage are expressed as apoisoning accident and a combustion and explosion accident, asshown in Fig. 7. The probability of immediate ignition of flammablegases depends on the release flow rate m0 (BEVI, 2009). In Fig. 7,P1 ¼ 0.2 if m0 < 10 kg/s; P1 ¼ 0.5 if 10 kg/s < m0 < 100 kg/s; and

Fig. 5. Field conditions of the pipeline before be

P1 ¼0.7 ifm0 > 100 kg/s. For allocating the ignition probability, onlythe net flow rates to the atmosphere must be considered.

3.2. Failure probability

To avoid the biased opinions of some experts, a multi-expertscoring method and the AHP method are recommended and usedin this Section. The assessment index system for the experts' ca-pabilities is shown in Fig. 8. A brief introduction of every expertused in this study is shown in Table 7.

Using an AHP analysis to define expert weights:

we ¼ ð0:2573; 0:1213; 0:2681; 0:3532ÞTo integrate the different opinions of the experts into a

comprehensive opinion, the Linear Opinion Pool method proposedby Clemen and Winkler (1999), as shown in Eq. (8), is applied. Theprimary event X3-1is discussed here as an example. The linguisticexpressions given from the 4 experts are low, medium, mediumand very low, respectively. The integrated fuzzy number is thusdescribed as follows:

f ðxÞ ¼ maxðwe1$fLðxÞ∧ðwe2 þwe3Þ$fMðxÞ∧we4$fVLðxÞÞ¼ ½ð0:12lþ 0:14Þ; ð0:45� 0:15lÞ�

The corresponding membership function of the above fuzzynumber f(x) is defined as:

f ðxÞ ¼

8>>>>>>><>>>>>>>:

x� 0:140:12

0:14< x � 0:26

1 0:26< x � 0:30

0:45� x0:15

0:30< x � 0:45

0 otherwise

Fig. 9 shows the fuzzy number and its associated membershipfunction.

Then, the left and right utility scores of the fuzzy number werecalculated by using Eq. (10) and Eq. (11):

ing submerged and after being submerged.

Fig. 6. Fault tree of the underwater pipeline.

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133130

Table 6Description of the primary events.

No. Description

X3-1 Risk of underwater pipeline interference due to ship anchorX3-2 Risk of underwater pipeline interference due to sabotageX3-3 Risk of underwater pipeline interference due to fishingX3-4 Risk of underwater pipeline interference due to river dredgingX5-1 Risk of underwater pipeline failure due to incorrect operationX5-2 Risk of underwater pipeline failure due to incorrect maintenanceX6-1 Risk of underwater pipeline fatigue due to fluctuation of internal pressureX7-1 Risk of underwater pipeline corrosion due to corrosion mediumX9-1 Risk of underwater pipeline fatigue due to fluid impactX10-1 Risk of underwater pipeline stress corrosion crack due to stress concentrationX10-2 Risk of underwater pipeline stress corrosion crack due to residual stressX10-3 Risk of underwater pipeline stress corrosion crack due to large internal stressX11-1 Risk of underwater pipeline corrosion fatigue due to pressure surgeX11-2 Risk of underwater pipeline corrosion fatigue due to an external loadX12-1 Risk of underwater pipeline fatigue due to failure of protectionX12-2 Risk of underwater pipeline fatigue due to hangingX14-1 Inherent risk of underwater pipeline due to structure defectX14-2 Inherent risk of underwater pipeline due to material defectX15-1 Inherent risk of underwater pipeline due to poor installationX15-2 Inherent risk of underwater pipeline due to a poor weldX15-3 Inherent risk of underwater pipeline due to a poor grooveX15-4 Inherent risk of underwater pipeline due to mechanical damageX17-1 Risk of underwater pipeline corrosion due to failure of inner protectionX18-1 Risk of underwater pipeline corrosion due to failure of cathode protectionX18-2 Risk of underwater pipeline corrosion due to failure of external corrosionX18-3 Risk of underwater pipeline corrosion due to soil corrosion

Fig. 7. Event tree of pipeline leakage.

Fig. 8. Index system of AHP for expert capability.

Table 7Introduction of the experts consulted in this case study.

No. Education background Job title Service time(years)

Expert 1 Junior college Professor 22Expert 2 Bachelor Associate-professor 8Expert 3 Doctor Professor 18Expert 4 Bachelor Associate-professor 30

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 131

FMR ¼ 0:3870; FML ¼ 0:7680

Given these left and right scores, the fuzzy possibility score ofthe fuzzy number was calculated based on Eq. (9):

FM ¼ 0:3095

Finally, the fuzzy failure probability was calculated based on Eq.(14) and Eq. (15):

F ¼ 0:00098

The failure probability of the primary event X3-1 was deter-mined to be 0.00098. The linguistic expressions of the other pri-mary events from the experts are shown in Table 8; theirprobabilities were also calculated and are also shown in Table 8.

If the probabilities of all of the primary events have beendetermined, the failure probability of the top event can be calcu-lated based on the quantitative analysis technique of the fault tree;

Fig. 9. Membership function of X3-1.

Table 8Probabilities of primary events.

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133132

this result is 2.44 � 10�2. Based on the information in Table 4, therisk level of these pipelines is Level 5, which implies that leakage islikely occurring in these pipelines.

3.3. Consequence of leakage

To assess the consequence of the pipeline leakage, an evaluationindex system is recommended in Section 2.3. The historical acci-dent record is also a good reference for this system. One punctureaccident occurred in 2011 due to a scratch during construction; thecorresponding primary event is X14-1 in the fault tree. This eventresulted in a leakage hole with a diameter of less than 1mm. Due tothe small size of the leakage hole and the relatively quick detection,this accident did not lead to a severe poisoning or combustion andexplosion event. However, the total loss of this accident exceeded$48,000, including $16,000of maintenance costs and more tha-n$32,000of environmental disputation costs. Experts from thepipeline management reached an agreement that the total lossshould be set between $16,000 and $160,000, which correspondswith Level Medium in Table 3.

4. Results

As discussed above, the failure probability of the event investi-gated is Level 5, and its consequence level is medium. Therefore, itcan be concluded that the risk level is high based on the 2 � 2 riskmatrix, and level IV based on the 5� 5 risk matrix. The result of thesafety evaluation is that the pipeline is a high risk, and thus, amaintenance project should be implemented and completed assoon as possible to avoid or mitigate a serious leakage accidentfrom occurring.

5. Conclusion

Risk evaluation plays a critical role in pipeline management.Leakage from a natural gas pipeline may lead to a devastating ac-cident and significant economic losses because natural gas diffuses

and combusts easily. Therefore, a comprehensive risk evaluationmethod that helps to define and reduce the risk level of a pipeline isnecessary. Thus, this study establishes a comprehensive risk eval-uation framework by combining a bow-tie model with a risk matrixto define the risk level of a pipeline for pipeline management.

The bow-tie model is a quantitative model in this study that iscomposed of an integrated quantitative methodology of risk anal-ysis and a quantification consequence assessment system. Thequantitative methodology of risk analysis provides a quantificationof risk probabilities using a fuzzy method that converts naturallinguistic expressions into failure probabilities. The quantificationof the possible consequences is determined by an index systemwith three different categories: personal casualties, economic los-ses and environmental damage. A quantitative conclusion of thebow-tie model is reached based on the above procedures; a riskmatrix that includes ranking probability and consequence severitycriteria is also proposed to define the risk level of system.

This study proposes a comprehensive risk evaluation frameworkthat can be applied in natural gas pipeline. A case study of a naturalgas underwater pipeline in CNPC is investigated in detail. The casestudy showed that the combination of the bow-tie model and therisk matrix creates an effective method for the comprehensive riskevaluation. This method can help pipeline management compre-hensively identify risk factors and to assess their consequences.Through the proposed integrated safety analysis method, risks ofpipeline use can be reduced.

Acknowledgment

This study was supported by the National Science and Tech-nology Major Project of China (Grant No. 2011ZX05055).

References

BEVI Reference Manual version 3.2. Bilthoven: RVIM.Chen, S.J.J., Hwang, C.L., Beckmann, M.J., et al., 1992. Fuzzy Multiple Attribute De-

cision Making: Methods and Applications. Springer-Verlag New York, Inc.Chen, Shanhuo, 1985. Ranking fuzzy numbers with maximizing set and minimizing

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 133

set. Fuzzy Sets Syst. 17 (2), 113e129.Chevreau, F.R., Wybo, J.L., Cauchois, D., 2006. Organizing learning processes on risks

by using the bow-tie representation. J. Hazard. Mater. 130 (3), 276e283.Clemen, R.T., Winkler, R.L., 1999. Combining probability distributions from experts

in risk analysis. Risk Anal. 19 (2), 187e203.Deacon, T., Amyotte, P.R., Khan, F.I., et al., 2013. A framework for human error

analysis of offshore evacuations. Saf. Sci. 51 (1), 319e327.Deacon, T., Amyotte, P.R., Khan, F.I., 2010. Human error risk analysis in offshore

emergencies. Saf. Sci. 48 (6), 803e818.Ferdous, R., Khan, F., Sadiq, R., et al., 2013. Analyzing system safety and risks under

uncertainty using a bow-tie diagram: an innovative approach. Process Saf.Environ. Prot. 91 (1), 1e18.

Han, Z.Y., Weng, W.G., 2010. An integrated quantitative risk analysis method fornatural gas pipeline network. J. Loss Prev. Process Ind. 23 (3), 428e436.

Hong, Liu, Tang, Yuxia, Cheng, Yuhe, 2007. Study on the classification of dangerousHazard evaluation based on risk management method. China Saf. Sci. J. 17 (6),145e150.

Ishikawa, A., Amagasa, M., Shiga, T., et al., 1993. The Max-Min Delphi method andfuzzy Delphi method via fuzzy integration. Fuzzy Sets Syst. 55 (3), 241e253.

Jamshidi, A., Yazdani-Chamzini, A., Yakhchali, S.H., et al., 2013. Developing a newfuzzy inference system for pipeline risk assessment. J. Loss Prev. Process Ind. 26(1), 197e208.

Jin, Chaoguang, Lin, Yan, Ji, Zhuoshang, 2003. Application of event tree analysisbased on fuzzy sets in risk analysis. J. Dalian Univ. Technol. 43 (1), 97e100.

Jo, Young-Do, Ahn, Bum Jong, 2005. A method of quantitative risk assessment fortransmission pipeline carrying natural gas. J. Hazard. Mater. 123 (1), 1e12.

Khakzad, N., Khan, F., Amyotte, P., 2012. Dynamic risk analysis using bow-tieapproach. Reliab. Eng. Syst. Saf. 104, 36e44.

Khakzad, N., Khan, F., Amyotte, P., 2013. Quantitative risk analysis of offshore dril-ling operations: a Bayesian approach. Saf. Sci. 57, 108e117.

Lin, C.T., Wang, M.J.J., 1997. Hybrid fault tree analysis using fuzzy sets. Reliab. Eng.Syst. Saf. 58 (3), 205e213.

Lins, P.H.C., de Almeida, A.T., 2012. Multidimensional risk analysis of hydrogenpipelines. Int. J. Hydrog. Energy 37 (18), 13545e13554.

Ma, L., Cheng, L., Li, M., 2013a. Quantitative risk analysis of urban natural gaspipeline networks using geographical information systems. J. Loss Prev. ProcessInd. 26 (6), 1183e1192.

Ma, L., Li, Y., Liang, L., et al., 2013b. A novel method of quantitative risk assessmentbased on grid difference of pipeline sections. Saf. Sci. 59, 219e226.

Muhlbauer, W.K., 2004. Pipeline Risk Management Manual: Ideas, Techniques andResources. Access Online. Elsevier.

Onisawa, T., 1990. An application of fuzzy concepts to modelling of reliabilityanalysis. Fuzzy Sets Syst. 37 (3), 267e286.

Onisawa, T., 1988. An approach to human reliability in man-machine systems usingerror possibility. Fuzzy Sets Syst. 27 (2), 87e103.

Shahriar, A., Sadiq, R., Tesfamariam, S., 2012. Risk analysis for oil & gas pipelines: asustainability assessment approach using fuzzy based bow-tie analysis. J. LossPrev. Process Ind. 25 (3), 505e523.

Sklavounos, S., Rigas, F., 2006. Estimation of safety distances in the vicinity of fuelgas pipelines. J. Loss Prev. Process Ind. 19 (1), 24e31.

Vílchez, J.A., Espejo, V., Casal, J., 2011. Generic event trees and probabilities for therelease of different types of hazardous materials. J. Loss Prev. Process Ind. 24 (3),281e287.

Yongji, W., 2004. Quantitative risk assessment for failure of oil and gas pipelines.Acta Pet. Sin. 25 (5), 108e112.

Yuhua, Dong, Datao, Yu, 2005. Estimation of failure probability of oil and gastransmission pipelines by fuzzy fault tree analysis. J. Loss Prev. Process Ind. 18(2), 83e88.

Zamalieva, D., Yilmaz, A., Aldemir, T., 2013. A probabilistic model for online scenariolabeling in dynamic event tree generation. Reliab. Eng. Syst. Saf. 120, 18e26.