You are on page 1of 10

Journal of Natural Gas Science and Engineering 25 (2015) 124e133

Contents lists available at ScienceDirect

Journal of Natural Gas Science and Engineering
journal homepage: www.elsevier.com/locate/jngse

A comprehensive risk evaluation method for natural gas pipelines by
combining a risk matrix with a bow-tie model
Linlin Lu a, Wei Liang a, *, Laibin Zhang a, Hong Zhang a, Zhong Lu b, Jinzhi Shan b
a
b

College of Mechanical and Transportation Engineering, China University of Petroleum, Beijing, 102249, China
Petrol China Beijing Gas Pipeline Co. Ltd., Beijing, China

a r t i c l e i n f o

a b s t r a c t

Article history:
Received 8 January 2015
Received in revised form
20 April 2015
Accepted 21 April 2015
Available online 15 May 2015

Leakage from natural gas pipelines causes severe economic loss and significantly affects social security
considering the gas' combustibility and the difficulties in detecting leakage. This study proposes a
comprehensive risk evaluation method by combining a risk matrix with a bow-tie model. First, a bow-tie
model is built, considering the risk factors that may lead to an accident using a fault tree; the consequences of unwanted events are then described in an event tree. Second, a fuzzy method is used to
calculate the failure probabilities. Third, the severity of an accident is evaluated through an index system
that includes personal casualties, economic losses and environmental disruptions. Finally, a risk matrix
consisting of a probability ranking criterion and a consequence ranking criterion is proposed to reach an
integrated quantitative conclusion of a bow-tie model. A case study of an underwater pipeline carrying
natural gas has been investigated to validate the utility of the proposed method.
© 2015 Elsevier B.V. All rights reserved.

Keywords:
Bow-tie model
Risk matrix
Fuzzy method
Natural gas pipeline

1. Introduction
Leakage from natural gas pipelines can cause devastating accidents due to the flammability of the gas, which is transported at
high pressures. In recent years, accidents in natural gas pipelines
have occurred too often and have drawn significant public attention. Thus, the implementation of safety measures followed by a
comprehensive risk evaluation is critical to maintain a level of risk
below the acceptable criteria. The risk evaluation of pipelines
currently includes a quantitative risk analysis (QRA) and an accident consequence analysis (ACA).
In a QRA, Muhlbauer (2004) proposed an integrated and
continuously improving risk evaluation framework for pipelines
that has become the guideline for pipeline risk assessment. The
purpose of this framework is to evaluate a pipeline's risk exposure
to the public and to identify ways to effectively manage that risk.
Ma et al. (2013a) used geographical information systems (GIS) to
calculate the quantitative risk of urban natural gas pipeline networks. The proposed QRA process incorporated an assessment of
the failure rates of integrated pipeline networks, a quantitative
analysis model of accident consequences, and assessments of individual and societal risks. Jo and Ahn (2005) also used GIS to assess
the quantitative risk of natural gas pipelines. Han and Weng (2010)
* Corresponding author.
E-mail addresses: lulinlin1211@163.com, lw@cup.edu.cn (W. Liang).
http://dx.doi.org/10.1016/j.jngse.2015.04.029
1875-5100/© 2015 Elsevier B.V. All rights reserved.

proposed a quantitative assessment index system that included a
causation index, an inherent index, a consequence index and their
corresponding weights for urban natural gas pipelines. The failure
probability calculation is an important part of a QRA. Yuhua and
Datao (2005) used a fuzzy fault tree to investigate the risk factors
and calculate the failure probabilities of natural gas pipelines.
Shahriar et al. (2012) applied a fuzzy approach to calculate the fuzzy
probabilities (i.e., likelihood) of a basic event in a fault tree for oil
and gas pipelines. There are also other relevant works in the literature, such as that of Ma et al. (2013b) and Jamshidi et al. (2013),
that investigate the QRAs of pipelines.
In an ACA, an event tree has been shown to be an efficient tool.
As the first step in the multidimensional risk analysis of a hydrogen
pipeline, Lins and de Almeida (2012) built an event tree that
included all possible accident scenarios including punctures and
ruptures of the pipeline. To calculate the safety distances around a
pipeline transporting liquefied gas and pressurized natural gas,
Sklavounos and Rigas (2006) used an event tree analysis as a formal
technique to determine the possible outcomes of an accidental fuel
gas release. Event tree analysis is also widely used to identify
dangerous scenarios with regard to hydrogen pipelines (Lins and de
Almeida, 2012), dynamic analyses for transient systems (Zamalieva
et al., 2013) and accident analyses of different hazardous materials
(Vílchez et al., 2011).
QRA and ACA are related and dependent on each other because
risk identification is the first step of consequence analysis. The

X. Section 4 then presents the conclusions of the study. a quantitative risk matrix that includes ranking probability criteria and consequence severity criteria is proposed in this study to quantify the probability and consequence of a given accident. the fuzzy probability calculation. Fig. the risk matrix method is applied to combine the results of the risk analysis and the consequence assessment. respectively. 2 shows the basic structure of a bow-tie model. which represents the consequences of a failure. an application of the proposed approach is presented for the risk analysis and consequence assessment of an underwater pipeline. to reach a comprehensive conclusion. this makes a bow-tie model to have significant potential in this field.1. many researchers have investigated the construction of bow-tie models but not their quantification. However. the consequence analysis of an accident and a risk matrix analysis. E and T are the primary. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 bow-tie model is an innovative approach and a good combination of QRA and ACA and is thus widely used in safety analysis (Ferdous et al. etc. personal injury and economic loss. Lu et al. Construction of a bow-tie model A bow-tie model is widely applied in risk analyses.. and an event tree.. 2012).L. In the risk analysis. intermediate and top events of the fault tree. dynamic risk analysis (Khakzad et al. Procedures The procedure of the proposed risk evaluation method is shown 125 in Fig. Schematic diagram of building a bow-tie model. This procedure includes four steps: the construction of the bow-tie model. a fuzzy method is applied to convert a natural linguistic expression into a failure probability. Fig. and I and C stand for the ignition (or safety barrier) and the accident consequence in an event tree. The procedure of the proposed approach is presented in Section 2. In the end. 2013) and risk management (Chevreau et al. 2013).. To achieve a quantitative conclusion from a bow-tie model. which represents the risk factors of a failure.. human error risk analysis (Deacon et al. respectively. In Section 3. 2010. In the consequence assessment. 1. Both the fault tree and the event tree are effective graphical methods and are widely used in safety analyses of complex systems. one of the limitations in the existing implementation of the bow-tie model is a lack of quantitative conclusions. respectively.. . 2. A bow-tie model is comprised of a fault tree. The purpose of this study is to develop a comprehensive approach to identify the risk factors and evaluate the severity of the consequences of an unexpected event. 2. 1 and consists of a risk analysis and a consequence assessment in terms of a building fault tree and an event tree. an index system is introduced to further assess the consequence in terms of environmental cost. 2006). 2013). including probability calculations (Khakzad et al.

. 8 1 > > > < 0:2  x fVL ðxÞ ¼ > 0:1 > > : 0 Fig. 1. 0:9. 3. a multi-expert scoring method is frequently recommended.d). / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 In this study. 2. the probabilities of the primary events must be known in advance. 0:25. Low(L). In step 2. (3)e(7) and Fig. L.2.126 L. In step 1. Further explanations of the above steps are described below. H. M.c). . subtraction.b. Basic structure of a bow-tie model. as described above. Fuzzy numbers can be expressed by fuzzy membership functions. management. the likelihood of occurrence of a primary event is described in a natural linguistic expression by experienced experts from different fields (e. bl1 (1) b<x<c x>c x>a a<x  b (2) c<x<d x>d (5) otherwise a<x  b b<x<c (4) otherwise i h Bl ¼ fx. 0:2. (2): f ðxÞ ¼ 8 0 > > > > xa > > > <b  a cx > > > > > c b > > : 0 8 0 > > > > x  a > > > > >b  a > < 1 f ðxÞ ¼ > > > d  x > > > > > d  c > > : 0 8 x  0:1 > > > > > < 0:15 fL ðxÞ ¼ 0:4  x > > > 0:15 > > : 0 8 x  0:3 > > > > > < 0:2 fM ðxÞ ¼ 0:7  x > > > 0:2 > > : 0 8 x  0:6 > > > > > < 0:15 fH ðxÞ ¼ 0:9  x > > > 0:15 > > : 0 fVH ðxÞ ¼ 8 x  0:8 > > > < 0:1 > > > : 0 < x  0:1 0:1 < x  0:2 otherwise 0:1 < x  0:25 0:25 < x  0:4 0:3 < x  0:5 0:5 < x  0:7 0:6 < x  0:75 0:75 < x  0:9 (6) otherwise 0:8 < x  0:9 1 0:9 < x  1 0 otherwise (7) The corresponding fuzzy numbers are defined as follows: fVL ¼ ½0. 1: In fuzzy environments. the trapezoidal fuzzy number is defined as A ¼ (a. Step 2: Convert the natural linguistic expression to a fuzzy number. (1). 0. 0:4. Calculation of a fuzzy probability To evaluate the failure probability of the top event in a fault tree. Similarly. 2. fH ¼ ½0:6. a fuzzy method that consists of 3 steps is proposed as shown below: Step 1: Collect a natural linguistic expression of a risk factor status. fL ¼ ½0:1. Considering the different opinions given by experts.. 0:1.1]. 0:5. the l-cut for the fuzzy numbers A and B can be described as: i h Al ¼ fx. bl2 x>a (3) Fig. 1992). a numerical approximation approach is proposed to convert the linguistic expression to a corresponding fuzzy number (Chen et al. the basic operations of fuzzy numbers such as their addition. and its membership function is shown in Eq. fVH ¼ ½0:8. maintenance. x2R. 3. The membership functions and their corresponding figures of the five different levels are shown in Eqs. and VH in Eqs. High(H) and Very High(VH).c. Because it is difficult to obtain detailed statistical probability data of primary events.b. Triangular and trapezoidal fuzzy membership functions are generally preferred in fuzzy theory. installation and design). Membership functions.g. 3 represent the five different levels of the linguistic expression. The triangular fuzzy number is defined as A ¼ (a. and their capabilities are often evaluated by an analytic hierarchy process (AHP). The subscripts VL. 0:9. For the given l 2 [0. fM ¼ ½0:3. Step 3: Convert the fuzzy number to a failure probability. (3)e(7) and Fig. Medium(M). The weights of the experts are defined based on their capabilities. multiplication and division are generally implemented through l-cut. 0:7. fB  lg ¼ al2 . 0:75. operation. fA  lg ¼ al1 . x2R. Lu et al. This likelihood of occurrence can be categorized into five levels: Very Low (VL). and its membership function is shown in Eq. the triangular fuzzy membership is used.

al2  fmin ðxÞ ¼ x 0 0x1 otherwise 1x 0 0x1 otherwise (12) (13) The fuzzy possibility score can be converted to a failure probability by the empirical equation proposed by Onisawa (1988. m. bl1 þ bl2 i h Að  ÞB ¼ Al  Bl ¼ al1  al2 . 0 i h Að÷ÞB ¼ Al ÷Bl ¼ al1 ÷bl2 . fmax(x) and fmin(x) represent the fuzzy maximizing and The risk matrix used in this study can be categorized into two categories: 2  2and 5  5. the natural linguistic expressions given by experts are expressed as fuzzy numbers.4. sup describes the y-value of the coordinates of the intersection point of fM with from the left side of fmax. If an accident may result in three probable consequences. bl1  bl2 al1  0. respectively. explosion or poisoning. Si is the personal casualty loss of consequence i. and the resulting damage to a company's reputation is typically much more important than the resulting economic losses.3. Personal casualties are always applied to evaluate the consequence caused by combustion. The risks are categorized into three levels: high. …. 2. …. bl1  bl2 127 1  FM FM FM s0 (14) FM ¼ 0 1=3  2:301 (15) In this section. medium and low. Similarly. The failure probability can be categorized into two levels in the 2  2 matrix: notable and negligible. 2003): i h Að þ ÞB ¼ Al þ Bl ¼ al1 þ al2 . (16) (Yongji. The Linear Opinion Pool is recommended in this study and is shown in Eq. reinstallation charges for damaged equipment and direct losses due to production shutdown and are recorded in the relevant currency.. 1 fVH The basic operations of fuzzy numbers can be expressed by their l-cut (Jin et al. Pi is the probability of consequence i. 0:2  0:1l. The operations of the fuzzy numbers are expressed by the corresponding l-cuts operations. Ci is the economic loss of consequence i and Ei is the environmental disruption loss of consequence i. and the 5  5 matrix is shown in Fig. bl1 ÷al2 al1  0. economic losses and environmental disruptions. j ¼ 1. Risk matrix The symbol sup in Eq. Accidents can damage equipment. fLl fmax ðxÞ ¼ ¼ ½0:15l þ 0:1. the corresponding l-cuts of the fuzzy numbers are defined minimizing sets. 2. The preferred method of transforming a fuzzy number to a fuzzy possibility score is the maximizing set and minimizing set method proposed by Chen (1985). cause a loss of materials. i ¼ 1. The 2  2 matrix is shown in Table 3. Aij is the fuzzy number for event i given by expert j. Lu et al. Consequence analysis Different experts often have different opinions of the same primary event. fM l ¼ ½0:1l þ 0:8. the Arithmetic method proposed by Lin and Wang (1997) and the Linear Opinion Pool proposed by Clemen and Winkler (1999). 0:9  0:15l. these values are defined as: FMR ¼ sup½fM ðxÞ∧fmax ðxÞ (10) FML ¼ sup½fM ðxÞ∧fmin ðxÞ (11) where C is the total loss of an accident. In step 3. The basic factors that should be considered in a consequence assessment are shown in Table 1 (Yongji. such as the Max-min Delphi method proposed by Ishikawa et al. fHl ¼ ½0:15l þ 0:6. 0:7  0:2l. The failure probability and the . 2. the consequence assessment system can be categorized into personal casualties. 0:4  0:15l. (8): Generally. in Eq. (1993). The total loss of an accident is defined as: fi ¼ n X wej Aij . the method of converting the fuzzy number to a failure probability consists of two parts: the conversion from the fuzzy number to a fuzzy possibility score and the conversion from the fuzzy possibility score to a failure probability. the consequence can be categorized as either acceptable or unacceptable. al2 > 0 2. (11). A fuzzy possibility score is defined as: FM ¼ FMR þ 1  FML 2 C¼ 3 X ðPi Si þ Pi Ci þ Pi Ei Þ (16) i¼1 (9) where FMR and FML represent the right and left utility scores of the fuzzy number. Similarly. Environmental disruptions consist of the amount of pollutants or the expense applied to the removal of pollutants. 2004). the total loss of the accident is calculated using Table 2 and Eq. it is necessary to integrate their opinions into a single opinion. This method transforms natural linguistic expressions into failure probabilities. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 Thus. There are many methods to aggregate fuzzy numbers. and refers to the potential damage to surrounding persons (not only workers but also residents). m is the total number of events and n is the total number of experts. wej is the weight of expert j. 4. l ¼ ½0:2l þ 0:3. thus. (10) describes the y-value of the coordinates of the intersection point of fM with from the right side of fmax. and are defined as: as: l fVL  ¼ ½0. Economic losses consist of maintenance costs.L. 1990): 8 < 1 F ¼ 10k : 0  k¼ i h Að  ÞB ¼ Al  Bl ¼ al1  al2 . n (8) j¼1 where fi is the integrated fuzzy number of event i. Environmental disruptions also draw significant attention from the media and the public. produce delays or suspend production. 2004). respectively.

Acceptable consequence (Very low) Negligible probability P < 105 (Level 1) Level of consequence associated consequence with the risk in the 5  5 matrix can be categorized into 5 levels. The object of interest in this section is the natural gas transmission pipeline (Lines 1 and2) from Tianjin City. In Table 5. level III is “medium risk”. The factors leading to economic losses may include maintenance costs of damaged equipment. Risk evaluation of an underwater pipeline 3. as shown in Fig. Level I is “very low risk”. Personal casualty Assessment system of combustion and explosion The factors leading to personal casualties may include combustion. and reputation losses. No.128 L. 5) Medium risk Strengthened detection and monitoring are required to reduce risk. 4. Line 1 was built in 2003 with a designed pressure of 10 MPa. and impaction of pressurized fluid. a diameter of 711 mm and a length of 43. China to Hebei province. Line 2 was built in 2005 with a designed pressure of 10 MPa.1. Table 2 Total loss calculation for an event tree. Low risk Check if the evaluated factors have changed due to operational condition changes. which belongs to the China National Petroleum Corporation (CNPC). Assessment of poisoning The factors leading to personal casualties may include leakage of toxic gas. which indicates that no measurement should be taken. level II is “low risk”.. 4. Unacceptable consequence (Low.5 me6. leakage of suffocating gas. which indicates that a detailed analysis and countermeasures should be performed to reduce the risk of the situation. 3. and reputation losses. Identification of risk factors The risk factors of an underwater pipeline are different from those of a buried pipeline. 4. High. a diameter of 711 mm and a length of 43. The quantitative and qualitative ranking criteria and their corresponding regarding failure probabilities are shown in Table 4. 3. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 Table 1 Factors to be considered in a consequence assessment. These two pipelines were initially buried underground but are now submerged in water due to a change in the path of a nearby river. The factors leading to environmental disruption may include the leakage of gas and other hydrocarbons. 3. Medium. Lu et al. which indicates that a maintenance project should be launched in the near future to avoid an accident. and indirect casualties.4 km. direct losses due to production shutdown.8 km. which indicates that the pipeline can be run regularly with increased monitoring and maintenance. direct losses due to production shutdown. China. Extremely high) level V is “very high risk”.1. level IV is “high risk”. which predicts on-going leakage and indicates that a maintenance project must be implemented as soon as possible. 2007). the ranking criteria of the consequences are expressed in terms of economic loss (Hong et al. Level of failure probability Risk level and the corresponding measurement Notable probability P > 105 (Level 2. Bow-tie model application Fig. Fig.0 m. 5 shows the field condition of these pipelines before and after being . Medium risk Consider the possibility of conversion from a low-probability event to a high-probability event. reinstallation charges of damaged equipment. direct shock wave. Based on the statistical data provided by the pipeline's management. 5  5 risk matrix.1. indirect shock wave. the depth of the water is 1. and the total length of the submerged section of the pipeline exceeds 25% of its total length in 2011. The factors leading to environmental disruption may include the leakage of toxic gas and smoke. 1 2 3 P P1 P2 P3 Sub index Contribution to the total loss Personal casualty Economic loss Environmental disruption Personal casualty Economic loss Environmental disruption S1 S2 S3 C1 C2 C3 E1 E2 E3 P 1  S1 P 2  S2 P 3  S3 P1  C1 P2  C2 P3  C3 P1  E1 P2  E2 P3  E3 Table 3 2  2 risk matrix. High risk Measurement that can reduce risk should be conducted immediately. Economic loss Environmental disruption The factors leading to economic losses may include maintenance costs of damaged equipment.

and may lead to a poisoning accident or a combustion and explosion (i. 3.2. deflagration) accident if preventive or protective measures are not taken to avoid or mitigate these accidents. (11): Fig. The primary event X3-1is discussed here as an example. P1 ¼ 0. 7. 8. Further descriptions of the primary events are shown in Table 6. medium.e. and hang may eventually yield rupture. The undesirable event of gas release is selected as the top event in the fault tree analysis. thus. Consequence of pipeline leakage Natural gas is toxic and combustible. Considering the circumstance of the underwater pipeline. Therefore. 3. 2009). such as crossing the pipeline. 0:1213. Field conditions of the pipeline before being submerged and after being submerged. Because these pipelines were laid underground initially. as shown in Fig. no additional protection measurements. etc. is applied. and Leakage may occur in a few samples Leakage may occur in significantly of samples Leakage beyond service time may occur in a few samples Leakage beyond service time may occur in significantly of samples Nearly no leakage P1 ¼ 0. Then. No. the primary causes for these events include interference from a third party. Failure probability To avoid the biased opinions of some experts. Leakage in the pipelines can be caused by two events: rupture and puncture. as shown in Fig. Water impaction typically leads to hang risk.2 if m0 < 10 kg/s. as shown in Eq. the final accidents in the event tree of the natural gas leakage are expressed as a poisoning accident and a combustion and explosion accident.L. they are considered to be intermediate events in the fault tree. The linguistic expressions given from the 4 experts are low.6 1. P1 ¼ 0. Level 5 4 3 2 1 Failure probability (per year) Explanation Quantitative criterion Qualitative criterion >102 103~102 104~103 105~104 <105 Regarded as leakage Extremely high risk of leakage High risk of leakage Low risk of leakage No leakage Table 5 Ranking criterion of consequence severity. (8).7 if m0 > 100 kg/s. corrosion. respectively. an inherent defect. . were implemented. 7. a safety analysis is required to avoid severe accidents. The root reasons for the top events are regarded as the primary events. medium and very low. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 129 Table 4 Ranking criterion of failure probability. Amount of loss (thousand $) Level 1 2 3 4 5 <1. For allocating the ignition probability.. only the net flow rates to the atmosphere must be considered. 6. 0:3532Þ To integrate the different opinions of the experts into a comprehensive opinion. 0:2681. The assessment index system for the experts' capabilities is shown in Fig. the Linear Opinion Pool method proposed by Clemen and Winkler (1999). Using an AHP analysis to define expert weights: we ¼ ð0:2573. (10) and Eq.5 if 10 kg/s < m0 < 100 kg/s. 5. A brief introduction of every expert used in this study is shown in Table 7. The probability of immediate ignition of flammable gases depends on the release flow rate m0 (BEVI.6e16 16e160 160e1600 >1600 Very low Low Medium High Extremely high submerged. The fault tree of the underwater pipeline consists of 26 primary events. In Fig. The integrated fuzzy number is thus described as follows: f ðxÞ ¼ maxðwe1 $fL ðxÞ∧ðwe2 þ we3 Þ$fM ðxÞ∧we4 $fVL ðxÞÞ ¼ ½ð0:12l þ 0:14Þ.1. Considering this special situation and its complex underwater environment. the left and right utility scores of the fuzzy number were calculated by using Eq. Lu et al. All of the factors mentioned above may lead to gas release. 9 shows the fuzzy number and its associated membership function.2. ð0:45  0:15lÞ The corresponding membership function of the above fuzzy number f(x) is defined as: f ðxÞ ¼ 8 x  0:14 > > > > 0:12 > > > < 1 > 0:45  x > > > > > 0:15 > : 0 0:14 < x  0:26 0:26 < x  0:30 0:30 < x  0:45 otherwise Fig. incorrect operation. fatigue. a multi-expert scoring method and the AHP method are recommended and used in this Section.

Lu et al.130 L. . 6. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 Fig. Fault tree of the underwater pipeline.

00098. Index system of AHP for expert capability. If the probabilities of all of the primary events have been determined. FML ¼ 0:7680 Given these left and right scores. Table 7 Introduction of the experts consulted in this case study. Lu et al. 9. the fuzzy failure probability was calculated based on Eq. the fuzzy possibility score of the fuzzy number was calculated based on Eq. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 131 Table 6 Description of the primary events. (14) and Eq. Expert Expert Expert Expert 1 2 3 4 Education background Job title Service time(years) Junior college Bachelor Doctor Bachelor Professor Associate-professor Professor Associate-professor 22 8 18 30 Fig. Fig. 7. Description X3-1 X3-2 X3-3 X3-4 X5-1 X5-2 X6-1 X7-1 X9-1 X10-1 X10-2 X10-3 X11-1 X11-2 X12-1 X12-2 X14-1 X14-2 X15-1 X15-2 X15-3 X15-4 X17-1 X18-1 X18-2 X18-3 Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Inherent risk of underwater Inherent risk of underwater Inherent risk of underwater Inherent risk of underwater Inherent risk of underwater Inherent risk of underwater Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline Risk of underwater pipeline interference due to ship anchor interference due to sabotage interference due to fishing interference due to river dredging failure due to incorrect operation failure due to incorrect maintenance fatigue due to fluctuation of internal pressure corrosion due to corrosion medium fatigue due to fluid impact stress corrosion crack due to stress concentration stress corrosion crack due to residual stress stress corrosion crack due to large internal stress corrosion fatigue due to pressure surge corrosion fatigue due to an external load fatigue due to failure of protection fatigue due to hanging pipeline due to structure defect pipeline due to material defect pipeline due to poor installation pipeline due to a poor weld pipeline due to a poor groove pipeline due to mechanical damage corrosion due to failure of inner protection corrosion due to failure of cathode protection corrosion due to failure of external corrosion corrosion due to soil corrosion FMR ¼ 0:3870.L. No. their probabilities were also calculated and are also shown in Table 8. . The failure probability of the primary event X3-1 was determined to be 0. Event tree of pipeline leakage. (9): FM ¼ 0:3095 Finally. No. Membership function of X3-1. 8. the failure probability of the top event can be calculated based on the quantitative analysis technique of the fault tree. (15): F ¼ 0:00098 Fig. The linguistic expressions of the other primary events from the experts are shown in Table 8.

Consequence of leakage To assess the consequence of the pipeline leakage. and combusts easily. 3.J. economic losses and environmental damage. A case study of a natural gas underwater pipeline in CNPC is investigated in detail. the risk level of these pipelines is Level 5. which corresponds with Level Medium in Table 3. risks of pipeline use can be reduced. Due to the small size of the leakage hole and the relatively quick detection. the total loss of this accident exceeded $48.. Lu et al. Ranking fuzzy numbers with maximizing set and minimizing . this accident did not lead to a severe poisoning or combustion and explosion event. the failure probability of the event investigated is Level 5.3. The quantitative methodology of risk analysis provides a quantification of risk probabilities using a fuzzy method that converts natural linguistic expressions into failure probabilities.. it can be concluded that the risk level is high based on the 2  2 risk matrix. The case study showed that the combination of the bow-tie model and the risk matrix creates an effective method for the comprehensive risk evaluation. 1985. The bow-tie model is a quantitative model in this study that is composed of an integrated quantitative methodology of risk analysis and a quantification consequence assessment system. this study establishes a comprehensive risk evaluation framework by combining a bow-tie model with a risk matrix to define the risk level of a pipeline for pipeline management. Hwang. Chen.000. Experts from the pipeline management reached an agreement that the total loss should be set between $16.000. Acknowledgment This study was supported by the National Science and Technology Major Project of China (Grant No. 4. The historical accident record is also a good reference for this system. Therefore. Chen. This event resulted in a leakage hole with a diameter of less than 1 mm. Thus. Leakage from a natural gas pipeline may lead to a devastating accident and significant economic losses because natural gas diffuses BEVI Reference Manual version 3. Therefore. including $16. Springer-Verlag New York. Inc.. This study proposes a comprehensive risk evaluation framework that can be applied in natural gas pipeline. M.J. and its consequence level is medium. a maintenance project should be implemented and completed as soon as possible to avoid or mitigate a serious leakage accident from occurring. Shanhuo. Beckmann. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 Table 8 Probabilities of primary events. Through the proposed integrated safety analysis method. 1992. the corresponding primary event is X14-1 in the fault tree. and level IV based on the 5  5 risk matrix.J.44  102. However.132 L. This method can help pipeline management comprehensively identify risk factors and to assess their consequences. which implies that leakage is likely occurring in these pipelines. an evaluation index system is recommended in Section 2. S. et al. C. this result is 2.. 5.2. The result of the safety evaluation is that the pipeline is a high risk. Fuzzy Multiple Attribute Decision Making: Methods and Applications. A quantitative conclusion of the bow-tie model is reached based on the above procedures. a risk matrix that includes ranking probability and consequence severity criteria is also proposed to define the risk level of system. Results As discussed above. The quantification of the possible consequences is determined by an index system with three different categories: personal casualties. One puncture accident occurred in 2011 due to a scratch during construction.000 and $160.L. 2011ZX05055). a comprehensive risk evaluation method that helps to define and reduce the risk level of a pipeline is necessary. and thus. Based on the information in Table 4. Bilthoven: RVIM. Conclusion References Risk evaluation plays a critical role in pipeline management.000of maintenance costs and more than$32.3.000of environmental disputation costs.

187e203. Loss Prev. 37 (3). A. 2006.. Organizing learning processes on risks by using the bow-tie representation.. 26 (6). 58 (3)..I. 13545e13554.. Lins. 17 (2). A framework for human error analysis of offshore evacuations. T.. 2005. J. 145e150... J. P. 59. Onisawa. Yuhe. Sci.R. Young-Do. F. 1988. Clemen. Saf. D. 2013. V. Sci.. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 set. 91 (1). Chevreau.. Rigas. Developing a new fuzzy inference system for pipeline risk assessment. Process Ind. 19 (2). J. N. Eng. Liang. 2012.. China Saf. W. 83e88. 2012.T. Yilmaz. A probabilistic model for online scenario labeling in dynamic event tree generation. W..Y.H. J. M. Winkler. Loss Prev. T. J. P... R. Saf. J. Eng. Loss Prev. 2013. F. . 2004. 2013. A. Amyotte. 27 (2).T. Khan. R. 25 (3). F. R. Casal. Environ. Yakhchali. Energy 37 (18). Onisawa.. Reliab. Jo.C. Yongji. R.. 276e283. et al. Saf. Muhlbauer. 281e287. S. Application of event tree analysis based on fuzzy sets in risk analysis. 2013. Shiga. Risk analysis for oil & gas pipelines: a sustainability assessment approach using fuzzy based bow-tie analysis. The Max-Min Delphi method and fuzzy Delphi method via fuzzy integration. 319e327.. Process Saf. A. Hazard. Estimation of failure probability of oil and gas transmission pipelines by fuzzy fault tree analysis. Zamalieva. Pipeline Risk Management Manual: Ideas.... 1e18. 505e523.. Saf... 23 (3). 1183e1192. 18 (2). 104. Hong. Process Ind. Sci. Saf.. 2013a.. Yuhua. Datao. Yazdani-Chamzini.. Jamshidi. Wybo. 197e208. Prot. 1997.. 2010. Ma. 24 (3). J. 113e129. 17 (6). Han. A novel method of quantitative risk assessment based on grid difference of pipeline sections. 133 Lin. Process Ind. 123 (1). 241e253. 1e12.. Reliab.L. 2005. 2006. Syst. Reliab.A. J. M.. Quantitative risk analysis of urban natural gas pipeline networks using geographical information systems. C. 2012... Cauchois. Syst.R. 1993..T. Espejo. Techniques and Resources. L. Ferdous. Li.L. 2010. Ji. 55 (3). Mater. Amyotte. Sci. N. Risk Anal. et al. Int. 18e26. Z. L. J. F. Eng. Loss Prev. T. 108e112. Technol. Yan.. 97e100. W. Amagasa. 2013.. P. 205e213. 51 (1). D. 87e103. Dalian Univ. 120. A. Fuzzy Sets Syst.R. 24e31. Shahriar. Sci. Multidimensional risk analysis of hydrogen pipelines. S. An application of fuzzy concepts to modelling of reliability analysis. 428e436. Fuzzy Sets Syst. Vílchez. J. Dong... Wang.K.. Saf. L. 2007. Lin. Lu et al. Process Ind. Tang. 803e818. J. Sadiq. 2013b.I. Bum Jong. Khan. 1999.. S. Fuzzy Sets Syst. Loss Prev.. 130 (3). A. Process Ind.. Chaoguang. Tesfamariam. Generic event trees and probabilities for the release of different types of hazardous materials. L. Sadiq. Fuzzy Sets Syst. Jin.. Ahn. Ma. 2011. 267e286. An approach to human reliability in man-machine systems using error possibility. Estimation of safety distances in the vicinity of fuel gas pipelines. P. Loss Prev.. Elsevier. 19 (1). Khan. Sklavounos. An integrated quantitative risk analysis method for natural gas pipeline network. Ishikawa. T.. Khakzad. Process Ind. Acta Pet.. 57. Yuxia. 1990.. Loss Prev. Dynamic risk analysis using bow-tie approach..J.J. Saf. Mater. Hydrog.. et al.. Liu. 25 (5). Access Online. Hybrid fault tree analysis using fuzzy sets. Analyzing system safety and risks under uncertainty using a bow-tie diagram: an innovative approach. Human error risk analysis in offshore emergencies. et al.. F.. J. Study on the classification of dangerous Hazard evaluation based on risk management method. J... Khan. 43 (1). Cheng.. Deacon. T. A method of quantitative risk assessment for transmission pipeline carrying natural gas.. Weng.. P. T. Y. Combining probability distributions from experts in risk analysis. Cheng. Hazard. Amyotte. Deacon.L.. 26 (1). 219e226. F. R.. Yu. F. A. Zhuoshang.H. Sin. Amyotte. Khan. 48 (6). Khakzad.G. de Almeida. Quantitative risk analysis of offshore drilling operations: a Bayesian approach. J. 36e44. Aldemir.. 2004.. 2003. M. Li. Quantitative risk assessment for failure of oil and gas pipelines. 108e117. Process Ind. et al. J. Syst.