Reliability Engineering and System Safety 215 (2021) 107791

Contents lists available at ScienceDirect

Reliability Engineering and System Safety

journal homepage: www.elsevier.com/locate/ress

A novel risk evaluation method for fire and explosion accidents in oil depots
using bow-tie analysis and risk matrix analysis method based on cloud
model theory
Shuyi Xie a, Shaohua Dong a, *, Yinuo Chen a, Yujie Peng a, Xincai Li b
a
College of safety and ocean Engineering, China university of petroleum, Beijing 102249, China
b
Development Department of Huabei Oilfield company, PetroChina Huabei Oilfield company, Renqiu 062552, China

A R T I C L E I N F O A B S T R A C T

Keywords: Due to the catastrophic impact of Fire and Explosion Accidents in Oil Depots (FEAOD), the prevention and
Fire and explosion accidents control of such accidents is the most critical part of risk management. In this study, a Bow-tie (BT) model was
Risk assessment built for FEAOD, while a quantitative risk assessment and consequence assessment was performed in conjunction
Cloud model
with the risk matrix. Then, due to the uncertainty and ambiguity of the probability data of Basic Events (BEs)
Group cloud decision-making
Delphi iteration process
during the expert elicitation process, this study creatively proposed a Cloud-Analytic Hierarchy Process (Cloud-
AHP) algorithm and Group Cloud Decision-Making (GCDM) algorithm based on the Fuzzy Cloud Membership
Function (FCMF). Finally, combined with the probability estimation algorithm and the sensitivity analysis, a
novel risk quantitative assessment algorithm for a BT model was developed based on Cloud Model (CM) theory.
The discretion, ambiguity, and randomness were considered during the evaluation process, and a more scientific
assessment fusion result of Decision makers (DMs) was obtained, while the Delphi iteration process further
reduced personal errors. A case study of an oil depot in Dalian was investigated. The results showed that the
proposed method more accurately identified the weak links in the safety system, providing a theoretical basis for
the risk prevention and control.

1. Introduction
The tanks of large oil depots usually contain a considerable amount
of crude oil. With the constant improvement of tank design and con­
struction technology, as well as the continuous fortification of oil depot
integrity management, oil depots in China are moving in the direction of
large-scale and intensive designs, which can provide longer-term stra­
tegic petroleum reserves. However, the expansion of the oil depot scale
is accompanied by the aggravation of risk prevention and control tasks.
Historical accident statistics indicate that fire and explosion accidents
are the most frequently occurring incidents in petroleum refineries, oil
terminals, and oil depots [1]. These types of accidents have severe
consequences, as evidenced by the disaster of December 11, 2005, at the
Buncefield Oil Storage Depots (B.O.S.D.) [2], the massive tank fire of
October 23, 2009, at the Caribbean Petroleum Refinery [3], and the fire
and crude oil pollution accident of July 16, 2011, at the Dalian oil depot
[4], all of which have caused severe environmental pollution, casualties,
and the loss of assets. Therefore, it is crucial to conduct a comprehensive
safety assessment of the oil depot and maintain the risk level below what
is generally acceptable [54] via real-time safety prevention and control
measures.
Many qualitative and quantitative risk assessment techniques are
available, such as Failure Mode and Effect Analysis (FMEA), the Hazard
and Operability study (HAZOP), Fishbone Diagram Analysis (FDA), FTA,
and Event Tree Analysis (ETA). FTA and ETA, as two effective risk
assessment methods, can provide a qualitative analysis of risk factor
identification and a quantitative assessment of the possibility of un­
wanted events [5]. The BT model is a common platform that couples
FTA and ETA by considering a common top event known as a critical
event while combining quantitative risk analysis and accident conse­
quence assessment. Moreover, compared with FTA and ETA, the BT
model has its unique advantages. It clearly illustrates the possible
combination of primary events that would lead to the top event and the
safety barriers’ failure that would escalate the top event to a particular
consequence [52]. As a result, it is widely used in safety analysis and risk
management [6]

* Corresponding author.
E-mail address: shdong@cup.edu.cn (S. Dong).

https://doi.org/10.1016/j.ress.2021.107791
Received 5 April 2020; Received in revised form 13 April 2021; Accepted 16 May 2021
Available online 28 May 2021
0951-8320/© 2021 Elsevier Ltd. All rights reserved.
S. Xie et al.
Fig. 1. The principle of accident risk prevention and control based on the BT method.
In the quantitative risk analysis research, Wang [7] and Shi et al. [8]
evaluated the probability of FEAOD by constructing a fault tree based on
expert elicitation and fuzzy logic. Badida [9], Dong [10], and Hu et al.
[11] also applied the fuzzy fault tree method to quantitatively evaluate
the natural disaster risk, fault risk, and leakage risk of oil and gas
pipelines. Hosseini et al. [12] constructed a quantitative risk assessment
model for fire accidents in natural gas processing plants by using fuzzy
FTA, where the domino effect and various possibilities of fire accidents
are simulated and calculated. FTA also plays an essential role in the
quantitative risk assessment of oil storage facilities when encountering
lightning strikes [13,14], earthquakes [15], and other accidents.
Furthermore, the event tree has been proven to be an efficient tool
during accident consequence analysis. Fu et al. [16] used ETA to
calculate the consequences of LNG-fueled vessel leakage events in
various scenarios, and qualitatively compared the results with that of the
European Union research, showing good consistency. Alileche et al. [17]
studied the domino effect of FEAOD, taking into account the impact of
meteorological conditions and safety barriers, while quantitatively
evaluating the accident consequences based on ETA. In addition, ETA is
also widely used to analyze the consequences of accidents in the fields of
aviation [18], environmental protection [19], and nuclear energy [20].
This research indicates the presence of two challenges in current
quantitative risk assessment. On the one hand, quantitative risk analysis
research is mostly based on expert elicitation and fuzzy logic theory,
while expert participation is considered an essential component of the
fuzzy state assumption process [21]. Due to differences in the individual
abilities of experts, the importance of their opinions during the
decision-making process also varies. To solve this problem, most of the
current research introduces weighting factors and uses AHP to calculate
the weights of experts. However, this method has its limitations. Based
on constant weight theory, the distribution of weights is not scientifi­
cally rigorous [22], and the following problems exist: (i) When
2
Reliability Engineering and System Safety 215 (2021) 107791
determining the comparison matrix of the weight of Decision-Makers
(DMs), their ambiguity, randomness, and dispersion during the evalu­
ation process are inevitable; (ii) The individual ability of DMs expressed
by precise numerical values is also not convincing [23]. On the other
hand, due to the lack of the BE probabilistic data required for traditional
FTA, expert elicitation and fuzzy logic methods are used to estimate the
probability of each BE in the fault tree. In the current research, scholars
[7,8,32–34] are all based on the Type-1 Fuzzy Set (T1 FS) (such as
triangular fuzzy numbers, and trapezoidal fuzzy numbers) to quantify
the linguistic terms given by DMs to complete the quantitative risk
assessment. The T1 FS quantifies the membership of the elements to
exact values between 0-1. However, exact membership functions do not
exist, and all contain uncertainty and ambiguity. Therefore, it is con­
tradictory to accurately model uncertain things like linguistic terms
[24].
This paper introduces the CM theory to solve the two uncertainty
problems mentioned above. The CM theory was proposed by Li et al. and
denoted the main method for solving the uncertainty problem [25]. The
CM can combine the fuzziness, randomness, and discreteness of things
under the condition of uncertainty to realize the quantitative description
of uncertainty indicators. Currently, the CM is widely used in research
fields, such as environmental protection, water quality assessment, and
risk assessment [27–31]. Cui [26] and Zhang et al. [27] also proposed an
improved AHP based on the CM while researching mineral resource
sustainability assessment and environmental factor vulnerability
assessment. However, the numerical values of the Weight Cloud Models
(WCMs) indicate that the entropy (En) and hyper entropy (He) is too
large, meaning that the calculation results display more extensive
dispersion, and the conclusions are not exceptionally scientific and
objective. Based on CM theory, the Cloud-AHP algorithm and GCDM
algorithm based on FCMF are creatively proposed in this paper. This
realizes the fuzzy evaluation of the DM weights based on the CM scale
S. Xie et al. Reliability Engineering and System Safety 215 (2021) 107791

Table 1 concept. The uncertainty of the given element belonging to a fuzzy

The arithmetic and power operation rules of clouds. concept was unique and precise, which was inconsistent with the spirit
Operator Ex En He of traditional fuzzy theory [53]. Therefore, the CM defined by Li et al.
√̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅ √̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅ mainly reflected the fuzziness and randomness of probability in the
C1+C2 Ex1+Ex2 En1 2 + En2 2 He1 2 + He2 2
√̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅ √̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅ objective world or human knowledge and the correlation between them.
C1-C2 Ex1-Ex2 En1 2 + En2 2 He1 2 + He2 2 Based on the research and development of the CM, the CM theory was
C1×C2 Ex1×Ex2 further expanded to include cloud operation, cloud transformation, the
|Ex1 Ex2 | × |Ex1 Ex2 | ×
virtual cloud, uncertainty reasoning, and more. Due to the ability to
√̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅ √̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅
)̅
(
En1 2
) (
En2 2
) (
He1 2
) (
He2 2 capture the fuzziness and randomness of the knowledge representation
process, CM theory is widely used in information science, data mining,
+ +
Ex1 Ex2 Ex1 Ex2
C1÷C2 Ex1/Ex2
|
Ex1
|× |
Ex1
|×
and multi-criteria group decision-making processes of complex systems.
Ex2 Ex2 In the CM, U was set as a quantitative universe, which was repre­
√̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅ √̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅
)̅
sented by a precise numerical value, and C was a qualitative concept of
( ) ( ) ( ) (
En1 2 En2 2 He1 2 He2 2
+ +
Ex
√̅̅̅̅ 1 m− 1 Ex 2 √̅̅̅̅ Ex1 m− 1 Ex2 U. Assuming that the quantitative value was x∈U, where x was a random
C1^m Exm
1 m × Ex1 × En1 m × Ex1 × He1
√̅̅̅ √̅̅̅ implementation of the qualitative concept C, the degree of certainty of x
λEn1 λHe1
for concept C could be expressed as μ(x)∈[0,1], which was a stable
λ×C1 λEx1

and the fuzzy modeling of DM linguistic terms based on FCMF, respec­
tively. Furthermore, the scientific expression of the weight of DMs, as
well as the objective estimation of probability data are realized. Then,
the risk assessment is completed via the constructed BT model and risk
matrix of FEAOD, the key factors of the prevention and control measures
are identified through the sensitivity analysis, and the minimum safety
requirements for different risk levels are proposed. The research results
show that the proposed method helps identify the weak links in the
safety system and maximize the efficiency of risk prevention and control
management.
2. Research method
2.1. BT model
The BT approach is an analytical method based on the fault tree, and
the event tree, describing the complete process of an accident from its
root causes to its consequences [35], and is widely used in risk assess­
random number.
μ: U→[0, 1] ∀x ∈ U x→μ(x) (1)
As a transformation model for qualitative concepts and quantitative
expressions, the overall characteristics of a qualitative concept in a CM
were represented by three numerical values: expectation (Ex), En, and
He. Ex denoted the measure of the basic certainty of a qualitative
concept and could best represent the characteristics of the qualitative
concept. En represented the measure of the scope of the uncertainty of a
qualitative concept and was determined by the fuzziness and random­
ness of the qualitative concept while reflecting the degree of deviation of
the real membership degree from the Ex. He was a measure of the un­
certainty of En, reflecting the cohesion degree of the uncertainty of cloud
drops in the universe of discourse, and was determined by the fuzziness
and randomness of En. This study used a standard CM based on the
normal distribution and the Gaussian MF, which could express many
uncertain phenomena in the natural and social sciences.
The standard CM was represented as follows:
(x− Ex)2

(2)
−
ment research. This technique establishes corresponding safety barriers
′
μi (x) = e 2(En )2

on the evolution path to achieve the purpose of preventing, controlling,

and mitigating risk accidents. The preventive barriers are used to reduce
the probability of accidents, while control and mitigation barriers are
used to reduce the severity of consequences and the duration of acci­
dents, to limit their escalation. The principle of accident risk prevention
and control based on the BT method is shown in Fig. 1. The corre­
sponding safety barriers are established during the process of accident
development, which could eliminate hazard sources, prevent deterio­
ration, and reduce consequences.
The BT method could be used to intuitively and accurately analyze
the causes and consequences of accidents, helping people to take
effective measures to prevent accidents and control their consequences.
Although the BT model could organize the complex systems, and qual­
itatively analyze the causes of risks, it is difficult to achieve quantitative
risk assessment. Therefore, to quantify the risk of FEAOD, it is necessary
to combine the BT model with the risk matrix, to obtain the optimal risk
management and control scheme.
2.2. Cloud model (CM) theory
2
Where x ∼ N(Ex, (En ) ), En ∼ N(En, He2 ), μi (x) ∈ [0, 1], i = 1, 2, …, n.
′ ′
2.2.2. Operation rules of clouds
The properties of the CM indicated that En and He could explicitly
express fuzziness and uncertainty, and the CM has the property of being
consistency with human subjective cognition. However, to overcome the
limitations of individual randomness and personal knowledge, the
general evaluation process often needs to rely on the group decision-
making process. Therefore, the operation rules and aggregation algo­
rithms of clouds needs to be introduced. After quantifying the evalua­
tions of multiple DMs, the GCDM process could be performed to obtain
the evaluation results that integrated the opinions of all DMs.
Given the two CMs in the same universe of discourse: C1 and C2, their
numerical values are C1 (Ex1, En1, He1) and C2 (Ex2, En2, He2), respec­
tively. The arithmetic operation rules of C1 and C2 and the power
operation rule of C1 are defined as follows [47] (Table 1). When the En
and He of one cloud are both zero, the cloud algebraic operations are
simplified into the algorithms between the cloud and the precise value
[36].

2.2.1. Cloud model

2.2.2.1. Determination of WCMs based on Cloud-AHP. The probabilities
The CM is a new theory of formal expression and concept analysis
of the BEs were obtained based on expert elicitation and fuzzy logic.
proposed by Li et al. [25], which is based on traditional fuzzy theory and
Although the DMs had extensive experience in preventing FEAOD, they
probability statistics. Membership function (MF), as the basis of tradi­
might display different preferences regarding each BE, which could
tional fuzzy theory, could be used to measure the uncertainty of ele­
result in significant changes in the probability values. Consequently, a
ments belonging to fuzzy concepts. According to the traditional fuzzy
weighting factor was introduced to distinguish the relative quality of the
theory, once the MF was determined, a unique and accurate membership
evaluation results of various DMs. In this study, an improved AHP
degree could be calculated for any given element in the universe to
method based on the CM theory known as Cloud-AHP was proposed to
measure the uncertainty of the element belonging to the relevant

3
S. Xie et al. Reliability Engineering and System Safety 215 (2021) 107791

Table 2 (2) Taking square roots of these parameters

Scale criteria of the CM. √̅̅̅̅̅̅̅
(7)
′
Exi = n Exi
Relative CM scale Description
importance √̅̅̅
1
(8)
′ 1
1 C1=(1,0,0) i and j are equally important Eni = ⋅(Exi )n− 1 ⋅Eni
3 C3=(3,0.33,0.05) i is slightly more important than n
j √̅̅̅
5 C5=(5,0.33,0.05) i is obviously more important 1
(9)
′ 1

than j Hei = ⋅(Exi )n− 1 ⋅Hei

n
7 C7=(7,0.33,0.05) i is strongly more important
than j
9 C8=(9,0.33,0.05) i is absolutely more important
than j
(3) Parameters are combined according to the AHP formula
1/3 C1/3=(1/3,0.33/9,0.05/9) j is slightly more important than ∑
n
i (10)
′ ′ ′ ′
Exi = Ex1 + Ex2 + ⋯ + Exi
1/5 C1/5=(1/5,0.33/25,0.05/ j is obviously more important i=1
25) than i
1/7 C1/7=(1/7,0.33/49,0.05/ j is strongly more important ∑
n √̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅
49) than i (11)
′
Eni = (En1 ′ )2 + (En2 ′ )2 + ⋯ + (Eni ′ )2
1/9 C1/9=(1/9,0.33/81,0.05/ j is absolutely more important i=1
81) than i
( ) ∑
n √̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅
1 1 Enij Heij (12)
′
Hei = (He1 ′ )2 + (He2 ′ )2 + ⋯ + (Hei ′ )2
Note: =C , ,
C(Exij , Enij , Heij ) Exij (Exij )2 (Exij )2 i=1

quantify the relative importance of each DM.

First, based on the traditional AHP index scale, which uses a nature (4) Normalize, and the numerical values of the WCM can be obtained
number between 1 and 9 to decide the relative importance of different as follows:
factors [42–43], this study built a relative importance CM scale based on ′
Exi
the cloud theory to analyze the individual abilities of the DMs [41]. The W(Exi ) = ∑
n (13)
nine CM scale criteria defined according to the indicator scale are shown Exi ′
in Table 2. i=1

Since the abilities of different DMs were measured by their personal √̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅
√ ⎛∑ ⎞2̅
experience (E), knowledge, information source, and impartiality of the
n
√ ′
√ ( ) En
evaluation, after establishing the CM scale criteria, the corresponding
′
Exi √ Eni ′
2
⎜i=1 i ⎟
W(Eni ) = ∑ ⋅√
√ +⎜ ⎝ ∑
⎟
⎠ (14)
judgment matrix (Cn×n) was established based on the four evaluation
n ′ n
Exi
Exi ′ Exi ′
indicators, as shown in Eq. (3). Finally, the weight of each indicator and i=1 i=1

the uncertainty of the weight are expressed by the Weight Cloud Models
(WCMs), and the numerical values of WCMs can be determined by the
Cloud-AHP algorithm.

⎛ ⎞
C11 (Ex11 , En11 , He11 ) C12 (Ex12 , En12 , He12 ) ⋯ C1n (Ex1n , En1n , He1n )
⎜ C21 (Ex21 , En21 , He21 ) C22 (Ex22 , En22 , He22 ) ⋯ C2n (Ex2n , En2n , He2n ) ⎟
Cn×n ⎜
=⎝ ⎟
⎠ (3)
⋮ ⋮ ⋱ ⋮
Cn1 (Exn1 , Enn1 , Hen1 ) Cn2 (Exn2 , Enn2 , Hen2 ) ⋯ Cnn (Exnn , Ennn , Henn )

√̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅
The formulation derivation process of the Cloud-AHP algorithm are √ ⎛∑ n ⎞2
√
as follows: √( ′ )2′
⎜
Hei ′
⎟
Exi √ Hei
W(Hei ) = ∑
n ⋅√
√ Exi ′ +⎜ ⎝∑
i=1
n
⎟
⎠ (15)
(1) According to the formula of the analytic hierarchy process and
′ ′
Exi Exi
the arithmetic rules of the cloud model, the product of each row
i=1 i=1

of the judgment matrix is calculated as follows:

∏
n
Exi = Exij (4) Finally, when the WCMs for the four evaluation indicators, as well as the
WCM for each indicator corresponding to each DM, were obtained, the
j=1

√̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅
√ n ( ) aggregated WCM could be calculated using Eq. (16).
∏
n √∑ Enij 2
Eni = Exij √ (5) WDMi = WE × WE,DMi + WK × WK,DMi + WIS × WIS,DMi + WI × WI,DMi (16)
j=1 j=1
Exij
where WDMi is the final aggregated WCM of the i-th DM, WE is the WCM
√̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅̅
∏
n √ n (
√∑ Heij 2
) corresponding to E, WE,DMi is the WCM for the indicator “E” of the i-th
Hei = Exij √ (6) DM, K is knowledge, IS is information source, and I is impartiality.
j=1 j=1
Exij

4
S. Xie et al. Reliability Engineering and System Safety 215 (2021) 107791

Table 3 2.2.3. GCDM algorithms

Numerical values of the FCMF. Two types of CM aggregation algorithms were used for analysis:
Linguistic judgments Ex En He Synthetic Cloud Aggregation (SCA) algorithms and Weighted Average
Cloud Aggregation (WACA) algorithms. The SCA algorithm synthesized
Very low VL 0.1 0.1/3 0.01
Low L 0.2 0.1/3 0.01 the opinions of the CM to be aggregated and reflected a more general
Relatively low RL 0.35 0.2/3 0.02 concept coverage. However, the WACA algorithm considered the weight
Medium M 0.5 0.1/3 0.01 ratio of each cloud in the universe of discourse, which could more
Relatively high RH 0.65 0.2/3 0.02 accurately reflect the GCDM results.
High H 0.8 0.1/3 0.01
Very high VH 0.9 0.1/3 0.01
Suppose that there were n clouds Ci (Exi, Eni, Hei), i=1, 2,…,n, in the
same universe of discourse U, then the synthetic cloud of these clouds

Fig. 2. Fuzzy Cloud Membership Function.

Fig. 3. Boundary value of FPS.

5
S. Xie et al. Reliability Engineering and System Safety 215 (2021) 107791

Table 4
Risk matrix of the FEAOD.
Safety risk matrix Ranking criteria of failure probability
1 2 3 4 5

Ranking criteria of consequence severity Consequence level Amount of loss (thousand $) <10-5 10-5~10-4 10-4~10-3 10-3~10-2 >10-2
(per year) (per year) (per year) (per year) (per year)
A 0~1.4×105
B 1.4×105~
1.4×106
C 1.4×106~
7.1×106
D 7.1×106~
1.4×107
E >1.4×107

overcome the problem that DMs were uncertain about their judgments
Table 5 while improving the persuasiveness of evaluation results. This study
Minimum safety requirements for different risk levels. creatively proposed the FCMF and defined a fuzzy cloud set for each
Risk Description Minimum safety requirements linguistic term in the evaluation. The FCMF quantifies expert linguistic
level terms into three numerical values of the CM (Ex, En, He). Firstly, the
Safe The risk is below the lower The existing risk management calculation of Ex is obtained based on the evaluation criteria of AHP and
limit of acceptable risk of the procedures are effective. the fuzzy mathematics theory [38], and then En and He of FCMF can be
ALARP principle calculated based on the CM theory (e.g., the rule of ‘3En’ of the CM, see
Low Widely accepted risks Implement existing management details to [39]). Table 3 shows the mapping relationship between the
procedures and keep existing safety
measures intact and effective to
language terms and the FCMF. The natural language terms ‘Very low’,
prevent further escalation of risks. ‘Low’, ‘Relatively low’, ‘Medium’, ‘Relatively high’, ‘High’, and ‘Very high’,
General Tolerable risks Further reduce risks and establish respectively were expressed as VL, L, RL, M, RH, H, and VH. The FCMF of
reliable monitoring and alarm each evaluation level is shown in Fig. 2.
facilities or high-quality management
After obtaining the failure probability evaluation of each BE using
procedures.
Large High risks, intolerable risks Further reduce risks, the new the Delphi method, the evaluation of the DMs was transformed into the
installations should reduce risks corresponding CMs through FCMF. The aggregated CMs were obtained
during the design phase, and the in- through the SCA algorithm and the WACA algorithm. The CMs of the
service installations should take group opinions and the individual opinions were plotted together
measures to reduce risks, further
graphically for comparison, and the clouds of the individual opinions
improve the reliability of the
emergency shutdown device deviating from the group opinions were obtained and recorded. A severe
Major Very high risks, intolerable Risks must be reduced, the new deviation of the individual opinion cloud from the synthetic cloud model
risks installations should reduce risks Cs, signified a substantial problem with the evaluation data, meaning
during the design phase, and in-
that the discreteness between the evaluation results was significant, and
service installations should take
immediate measures to reduce risks the generated aggregated CM was meaningless. By providing feedback
until they cease, ensure the reliability regarding the defect in the evaluation results to the DMs for adjustment
of emergency maintenance and repair until the results met the requirements, the feedback iteration process
facilities. was used to improve the consistency of the evaluation. The GCDM
method and the Delphi iteration process solved the randomness of in­
was defined as follows [44]: dividual judgment and the limitation of knowledge while reducing in­
dividual DM errors.
⎧
1∑ To provide useful outcomes for the quantitative evaluation of FTA,
n
⎪
⎪ Exs = Exi
⎪
⎪
⎪
⎪ n i=1 the results of the GCDM of each BE were first mapped to obtain a Fuzzy
⎪
⎪
⎨ [ ] Possibility Score (FPS) through defuzzification. The FPS represented the
1 { } (17)
⎪ Ens = max{Exi + 3Eni } − min Exj − 3Enj most likely score that an event may occur [40], and there were many
⎪ 6 i defuzzification methods based on fuzzy set theory, such as mean max
⎪ j
⎪
⎪
⎪
⎪
⎪
⎩ 1 ∑ membership, centroid method, the weighted average method, center of
Hes = Hei
n the largest area, and more. However, there was currently no defuzzifi­
cation method based on CMs. In this study, the centroid line method was
Considering the differences between the individual capabilities of the proposed to defuzzify the results of the GCDM based on CM theory.
DMs, their evaluation results also presented different weighting factors. As shown in Fig. 3, the centroid of the cloud denotes the center of the
The weights of the n DMs were WDM1 (ExDM1, EnDM1, HeDM1), (
√̅̅
)
WDM2(ExDM2, EnDM2, HeDM2),..., WDMn(ExDMn, EnDMn, HeDMn), respec­ CM, whose coordinates are Ex, 42 . The line passing through the
tively. The weighted average CM could be calculated using Eq. (18) with √̅̅
the arithmetic rules of the cloud model [44]. centroid u = 42 is the centroid line of the CM. It can be seen from Fig. 3,
∑
n the cloud droplets were densely distributed above the centroid line and
Cwa = wi Ci (18) sparsely distributed below the centroid line. In the CM theory, [Cmin,
i=1 Cmax] represents the numerical range of the comment set of the classic
set theory to establish the corresponding mathematical relationship
2.2.4. Failure probability analysis based on CM [40]. Therefore, Cmax and Cmin were used as the boundary values of FPS
Compared with traditional fuzzy theory, the CM displayed unique in the FCMF based on the fuzzy theory. To ensure the reliability of the
advantages in describing language terms. Its description of linguistic risk assessment, the maximum value of the interval Cmax was considered
terms did not depend on a single numerical value, which could well the final FPS value.

6
S. Xie et al. Reliability Engineering and System Safety 215 (2021) 107791

Fig. 4. Schematic diagram of the proposed method.

The traditional FTA could obtain an accurate failure probability 2.3. Consequence analysis
through quantitative analysis, while inconsistency was evident between
the real possibility data and the FPS. As a result, the following conver­ The consequences of an accident can be divided into economic losses
sion function was introduced to transform the FPS into the Possibility and social losses. The economic loss is the most general, direct, common,
Value (PV) [7, 46]: and important manifestation of the consequences of an accident, which
⎧ includes environmental damage, as well as casualties and the loss of
⎨ 1 (FPS ∕ = 0) assets. The economic loss of the accident can be used directly to assess
PV = 10k (19)
⎩ the severity of the consequences. [6,37]
0(FPS = 0) The FEAOD was evaluated and researched to determine the severity
of the consequences of the accidents and further identify the risk levels
Where
of the accidents. Therefore, when calculating the economic loss of the
(
1 − FPS
)1/3 accidents, the so-called ‘non-economic loss’ must be converted into
k= × 2.301 (20) ‘economic loss’ to calculate the consequences of the accident [45]. The
FPS
consequences of the accident were assessed using the constructed event
tree, while the economic loss was obtained using Eq. (21) [6].

7
S. Xie et al.
Fig. 5. The BT model of FEAOD.
∑n
C= (Pi Ei + Pi Ai + Pi Si ) (21)
i=1
where C is the total economic loss attributed to FEAOD, Pi is the possi­
bility of the accident Ci, Ei, Ai, and Si are the environmental losses, asset
losses, and casualties of accident Ci, respectively.
2.4. Risk matrix
This study introduced a risk matrix for the risk evaluation of FEAOD.
The risk value of the traditional risk matrix was calculated by the
probability and severity of the accident, as shown in Eq. (22).
R=f ×C (22)
where R is the risk value of the accident, while f and C denote the
possibility and the severity of the accident, respectively.
This paper proposed the standard of a risk matrix for the FEAOD, as
shown in Table 4. According to the potential annual accident losses and
considering the socially acceptable standards of hazardous chemical
companies, the risks were classified into low risk, general risk, large risk,
and major risk. Based on the ‘Safety Production Accident Report’ and the
‘Chinese Investigation and Handling Rules’ [51], the severity of the con­
sequences was divided into five levels labeled A, B, C, D, and E from light
to severe, and the possibility level was divided into five levels labeled 1,
2, 3, 4, and 5 from small to large [48].
However, the FEAOD was low-probability and high-consequence
accidents. When evaluated via the traditional risk matrix, the risk
level was often lower. Therefore, to prevent FEAOD more effectively, it
was necessary to increase one level of the risk for better prevention and
control of FEAOD based on the risk assessment level. Furthermore,
minimum safety requirements were proposed for different risk levels in
accordance with the As Low As Reasonably Practicable (ALARP) prin­
ciple [54], as shown in Table 5.
The specific procedures for the proposed risk evaluation method are
shown in Fig. 4.
3. Case study
The selected case study involves the oil depot in Dalian, consisting of
20 crude oil storage tanks with a total reserve of 1.85 million cubic
meters, that was struck by a static spark and caught fire in 2010 [49].
3.1. Construction of the BT model
The BT model is widely used in risk assessment. It consists of a fault
tree and an event tree, representing the risk factors of the failures and
the consequences of the accident, respectively. The BT model is based on
8
Reliability Engineering and System Safety 215 (2021) 107791
FEAOD, as shown in Fig. 5. “X,” “M,” and “T” constitute the BE, inter­
mediate event, and top event of the FTA, respectively. I1-I3 represents
the control and mitigation barriers in the event tree, and C1-C4 repre­
sents the accident consequences of the event tree.
During the analysis of the fault tree, FEAOD was considered as the
top event, which was divided into two intermediate events by an AND
gate, namely “the ignition sources” and “vapor-air mixtures within
explosive range”. The two intermediate events were further resolved
into events that could cause them. There were six ignition sources in the
oil depot: “open fires,” “static sparks,” “electrical apparatus sparks,”
“spontaneous combustion,” “impact sparks,” and “lightning sparks,” all
of which could ignite explosive mixtures [7]. Therefore, these six events
were connected to the “ignition sources” through an OR gate. In addi­
tion, the entrained air in-tank and the leakage of oil and gas out-tank can
produce explosive mixtures, and thus these two types of intermediate
events were connected to the “vapor-air mixtures within explosive
range” by an OR gate [50]. Based on the intermediate events mentioned
above, the fault tree was developed continuously until the BE terminated
all branches. Finally, the complete fault tree is shown in Fig. 6(a)-6(d),
contained 42 BEs that might cause the FEAOD.
3.2. Traditional FTA analysis
The qualitative and quantitative evaluation of the fault tree
commenced after the completion of the BT model. The Minimum Path
Sets (MPSs) refer to the minimum combination of the BEs, ensuring that
the top event does not occur. According to the definition of MPS, if one
of the MPS does not occur, the top event T will not occur, and the injury
accident will be controlled. The probability of the top event could be
calculated from the probability of the MPSs qi by Eq. (23) [8].
∑ ∑ ∏
k
P(T) = 1 − (1 − qi ) + (1 − qi ) − ...
r=1 1≤r≤sXi ∈Pr ∪Ps
∏
− ( − 1)k− 1 k
(1 − qi ) (23)
r=1
Xi ∈P1 ∪P2 ⋯∪Pr
where Pr is the particular MPS, r and s represent the ordinal of the MPS, i
is the ordinal of the BEs, and k is the number of MPS. Xi∈Pr represents
the i-th BE belonging to the r-th MPS, and Xi∈Pr∪Ps represents the i-th BE
belonging to the r-th or s-th MPS.
A total of ten MPSs were obtained through the constructed fault tree,
including 4 MPSs of order 24, 4 MPSs of order 22, 1 MPS of order 8 and 1
MPS of order 4. The MPSs are shown as follows:
MPS1 = {X1,X2,X3,X4,X5,X6,X7,X8,X9,X10,X11,X12,X13,X17,X18,X19,
X20,X22,X23,X24, X25,X26,X27,X28};
MPS2 = {X1,X2,X3,X4,X5,X6,X7,X8,X14,X15,X16,X17,X18,X19,X21,X22,
X23,X24,X29,X30, X31,X32};
S. Xie et al. Reliability Engineering and System Safety 215 (2021) 107791

Fig. 6. The fault tree model of FEAOD.

MPS3 = {X1,X2,X3,X4,X5,X6,X7,X8,X9,X10,X11,X12,X13,X17,X18,X19, MPS9 = {X33,X34,X35,X36 };

X21,X22,X23,X24, X25,X26,X27,X28}; MPS10 = {X33,X34, X37,X38,X39,X40,X41,X42 };
MPS4 = {X1,X2,X3,X4,X5,X6,X7,X8,X9,X10,X11,X12,X13,X17,X18,X19, Therefore, the construction of the fault tree provided a method for
X20,X22,X23,X24, X29,X30,X31,X32}; measuring the probability of FEAOD, while identifying the key BEs to
MPS5 = {X1,X2,X3,X4,X5,X6,X7,X8,X14,X15,X16,X17,X18,X19,X20,X22, ensure that the top event did not occur. Furthermore, Eq. (23) indicates
X23,X24,X25,X26, X27,X28}; that the quantitative analysis required the gathering of the exact failure
MPS6 = {X1,X2,X3,X4,X5,X6,X7,X8,X14,X15,X16,X17,X18,X19,X20,X22, data of each BE to calculate the probability of the top event. However,
X23,X24,X29,X30, X31,X32}; for the FEAOD fault tree, it was challenging to accurately estimate the
MPS7 = {X1,X2,X3,X4,X5,X6,X7,X8,X9,X10,X11,X12,X13,X17,X18,X19, probability of each BE due to insufficient field data. In fact, many BEs
X21,X22,X23,X24, X29,X30,X31,X32}; might have no precise failure data due to its inherent uncertainty and
MPS8 = {X1,X2,X3,X4,X5,X6,X7,X8,X14,X15,X16,X17,X18,X19,X21,X22, imprecision. Therefore, this study proposed a method based on Cloud-
X23,X24,X25,X26, X27,X28}; AHP and GCDM to overcome the limitations of traditional FTA.

9
S. Xie et al.
Fig. 6. (continued).
3.3. Quantitative risk analysis based on Cloud-AHP and the GCDM
method
3.3.1. Calculation of the weights of the DMs based on Cloud-AHP
The research above showed that traditional FTA found it challenging
to obtain accurate probability data of BEs. Consequently, to solve this
problem, this study used the Delphi method to evaluate the probability
10
Reliability Engineering and System Safety 215 (2021) 107791
data of the BEs. Three experts were invited to conduct the assessment,
including a senior field engineer, an experienced tank manager, and a
tank integrity management expert.
To more accurately reflect the relative importance of DM assessment
during the process of GCDM, this paper proposed a Cloud-AHP method
to calculate the weighting factor of each DM. First, for the four in­
dicators reflecting the ability of DMs, namely experience, knowledge,
S. Xie et al. Reliability Engineering and System Safety 215 (2021) 107791

Table 6 information sources, and impartiality, and based on the CM scale

The specific steps of Cloud-AHP (Taking ‘Experience’ as an example). defined by Table 2, the priority relationship cloud matrix that consti­
The product of each row of the judgment matrix tutes the four indicators is shown as Eq. (24). Then, the comparison
matrices of the ability corresponding to each DM were established. CE,
Exi 15 0.6 0.1111
Eni 1.9242 0.0770 0.0173 CK, CIS, and CI respectively represented the cloud comparison matrix of
Hei 0.2915 0.0117 0.0026 experience, knowledge, information sources, and impartiality of the
Square roots DMs, which were shown as Eqs. (25–28).
Exi’ 2.4662 0.8434 0.4807 ⎡ ⎤
Eni’ 0.1827 0.0625 0.0432 (1,0,0) (2,0.33,0.05) (2,0.33,0.05) (3,0.33,0.05)
Hei’ 0.0277 0.0095 0.0065 ⎢ (1/2,0.33/4,0.05/4) (1,0,0) (2,0.33,0.05) (3,0.33,0.05) ⎥
Parameters combined C=⎢ ⎣ (1/2,0.33/4,0.05/4) (1/2,0.33/4,0.05/4)
⎥
∑n (1,0,0) (1,0,0) ⎦
i=1 Exi
′
3.7904 (1/3,0.33/9,0.05/9) (1/3,0.33/9,0.05/9) (1,0,0) (1,0,0)
∑n
i=1 Eni
0.1978
(24)
′

∑n
i=1 Hei
′
0.0300
⎡ ⎤
Normalization (1, 0, 0) (5, 0.33, 0.05) (3, 0.33, 0.05)
W(Exi) 0.6506 0.2225 0.1268 CE = ⎣ (1/5, 0.33/25, 0.05/25) (1, 0, 0) (3, 0.33, 0.05) ⎦
W(Eni) 0.0590 0.0202 0.0132 (1/3, 0.33/9, 0.05/9) (1/3, 0.33/9, 0.05/9) (1, 0, 0)
W(Hei) 0.0089 0.00031 0.0020
(25)
⎡ ⎤
(1, 0, 0) (3, 0.33, 0.05) (1/4, 0.33/16, 0.05/16)
Table 7 CK = ⎣ (1/3, 0.33/9, 0.05/9) (1, 0, 0) (1/2, 0.33/4, 0.05/4) ⎦
The numerical values of the WCMs corresponding to each indicator. (5, 0.33, 0.05) (2, 0.33, 0.05) (1, 0, 0)
Indicator Description WCM (26)
Experience Technical titles, working years (0.4728,0.0812,0.0123)
Knowledge Professional Certificate, educational (0.2978,0.0512,0.0078)
background ⎡ ⎤
(1,0,0) (3,0.33,0.05) (1/3,0.33/9,0.05/9)
Information The official statistical data and (0.1301,0.0208,0.0031)
CIS = ⎣ (1/3,0.33/9,0.05/9) (1,0,0) (2,0.33,0.05) ⎦
source relevant references
Impartiality Independence of the evaluation (0.0993,0.0123,0.0019) (3,0.33,0.05) (1/2,0.33/4,0.05/4) (1,0,0)
(27)

Fig. 7. The WCM of each indicator.

Table 8
The numerical values of the WCMs corresponding to each DM.
Indicator DM 1 DM 2 DM 3

Experience (0.6506,0.0590,0.0089) (0.2225,0.0202,0.0031) (0.1268,0.0132,0.0020)

Knowledge (0.2627,0.0274,0.0041) (0.1591,0.0211,0.0032) (0.5782,0.0729,0.0110)
Information source (0.3313,0.0362,0.0055) (0.2894,0.0377,0.0057) (0.3793,0.0494,0.0075)
Impartiality (0.2894,0.0389,0.0059) (0.3313,0.0504,0.0076) (0.3793,0.0510,0.0077)

11
S. Xie et al.
Fig. 8. The WCM of each DM under four indicators.
⎡ ⎤
(1,0,0) (2,0.33, 0.05) (1/3,0.33/9,0.05/9)
CI = ⎣ (1/2,0.33/4, 0.05/4) (1, 0,0) (2,0.33, 0.05) ⎦ WDM1=(0.3780,0.0406,0.0006)
(3,0.33/9,0.05/9) (1/2,0.33/4,0.05/4) (1,0, 0)
(28)
The cloud comparison matrix above was calculated using the Cloud-
AHP algorithm, and taking the indicator ‘Experience’ as an example,
show the specific calculation process of the Cloud-AHP algorithm, which
was shown in Table 6. The WCM of each indicator was shown in Table 7.
By plotting the WCMs together graphically, Fig. 7 clearly shows the
relative importance of the weight of each indicator. It can be seen that
the indicator ‘Experience’ is a relatively important indicator among the
four indicators, and the weights of the indicator ‘Information source’ and
‘Impartiality’ are relatively low.
Through the constructed cloud matrix under four indicators of the
DMs [Eqs. (25) to (28)], the numerical values of the WCMs corre­
sponding to each DMs were determined, as shown in Table 8. Fig. 8
shows the importance of each DM under four indicators clearly. Finally,
the WCMs of the four indicators calculated above and the WCM of each
12
Reliability Engineering and System Safety 215 (2021) 107791
DM under four indicators were integrated by Eq. (16). After the
normalization, the final WCMs of three DMs were obtained, as shown in
Fig. 9.
WDM2=(0.2743,0.0406,0.0006)
WDM3=(0.3476,0.0470,0.0007)
3.3.2. GCDM and Delphi iteration process
Based on the FCMF proposed by Table 3, the DM’s language evalu­
ation of the probability data for each BE was converted into the corre­
sponding CMs, while the SCA and WACA algorithms for DM evaluation
were performed using Eqs. (17) and (18), respectively. The calculation
results are shown in Table 9.
Comparison of the individual evaluation clouds and group aggrega­
tion clouds of each BE indicated that the personal opinion clouds of the
following five BEs deviated significantly from the group decision clouds:
X3, X4, X39, X40, and X42 (Figs. 10(a)- 14(a)). There should be feedback
to the DMs regarding the flawed evaluation corresponding to the five
BEs above, and the re-evaluations should be continued until the con­
sistency of the evaluation set meets the requirements. After Delphi
feedback, the evaluation sets of the five BEs were revised: X3 (M, RL,
S. Xie et al.
Fig. 9. The final WCM of each DM.
RL), X4 (RL, L, RL), X39 (RL, RL, M), X40 (L, VL, VL), and X42 (RL, RL,
L). Fig. 10(b)-14(b) show the comparison CM diagrams of the individual
opinions and GCDM results of these BEs after the Delphi iteration pro­
cess, respectively. Finally, the evaluation set was fused by the weighted
average, and the final GCDM result is shown in Table 10.
3.3.3. Defuzzification and sensitivity analysis
(1) Quantitative analysis of the FTA
The GCDM result of each BE was defuzzified by the centroid line
algorithm to obtain the FPS corresponding to each BE, after which the
probability data of each BE was obtained with Eqs. (19) and (20), as
shown in Table 10. Based on the FTA quantitative analysis technology,
the probability of the top event was calculated as 2.18×10-5. The
ranking criteria of the failure probability in Table 4 indicate a proba­
bility degree of level 2 in this case, implying a probable occurrence of
FEAOD.
(1) Sensitivity analysis
The sensitivity analysis identified the BEs that contributed most to
the top event, and was, therefore, prioritized. In the absence of proba­
bilistic data, the importance of each BE was generally analyzed based on
the structural importance degree. In this case, the probability data of the
BEs were obtained, and the probability importance degree Ig(i) was
introduced, assessing the influence of the change in the probability of
each BE on that in the probability of the top event [8], as shown in Eq.
(29):
∂P(T)
Ig (i) = (29)
∂qi
where P(T) is the probability of the top event, qi is the probability of the
i-th BE, and Ig(i) is the first-order partial derivative of the top event
probability to qi. The ranking of probability importance degree is shown
in Table 10.
13
Reliability Engineering and System Safety 215 (2021) 107791
3.3.4. Consequence analysis
To evaluate the consequences of FEAOD, the selected case study
involved a FEAOD that occurred in Dalian in 2010, where an oil tank in
the depot with a capacity of 62900 barrels flashed during the loading
process. The causes of the accident were as follows: Due to the unloading
process of the oil tank in which the accident occurred, the liquid level
was too low. There was a gas phase space between the floating disk and
the oil surface, causing air to enter and mix with the light hydrocarbon
components in the crude oil, resulting in the formation of explosive gas
in the oil tank. In addition, the oil flow velocity was too high, and the
significant amount of subsequent static electricity could not be dis­
charged in time. Consequently, this generated an electrostatic spark that
caused an explosion, resulting in oil leakage and pool fire. Due to proper
emergency measures, the domino effect of the fire accident was pre­
vented. The BEs corresponding to the cause of the accident was X9, X33,
and X34 in the BT model. The accident resulted in the scrapping of the
oil tank and its ancillary facilities, while the thermal radiation from the
pool fire caused the failure of the surrounding sensors and valves.
However, there was no serious environmental pollution and no casu­
alties. The total economic loss caused by the accident amounted to $
1.13 × 107, which corresponded to Level D of the consequence level in
the risk matrix.
3.4. Determination of accident risk levels
Based on the case study mentioned above, the possibility level of the
FEAOD is delineated as level 2, and the level of consequence is repre­
sentative of Level D. The final risk level obtained in the risk matrix is
general. However, upgraded prevention and control measurements
should be used for FEAOD. In this research, the minimum safety re­
quirements regarding the “Large” risk level should be taken to prevent
accidents.
4. Results and discussion
The Cloud-AHP algorithm is proposed in this paper. According to the
four evaluation indicators of the individual ability of DMs, the cloud
comparison matrices were constructed based on the CM scale, and
S. Xie et al. Reliability Engineering and System Safety 215 (2021) 107791

Table 9
The GCDM results for BEs based on expert elicitation.
BEs Description Judgment of DMs Cs Cwa
DM1 DM 2 DM 3

X1 Smoking RL L RL (0.3,0.0417,0.0167) (0.3088,0.0424,0.0106)

X2 Combustibles near the tank are not cleaned up L L RL (0.25,0.0417,0.0133) (0.2521,0.0344,0.0084)
X3 Repair welding insulation nail without blind plate M RL L (0.35,0.05,0.0133) (0.3545,0.0365,0.0075)
X4 No blind plate for maintenance pipeline L L M (0.3,0.05,0.01) (0.3043,0.0326,0.0058)
X5 Vehicles without flame arresters L VL VL (0.1333,0.0167.0.01) (0.1378,0.0219,0.0058)
X6 Friction between fiber and body VL L VL (0.1333,0.0167.0.01) (0.1274,0.0219,0.0058)
X7 Friction between shoes and ground VL L VL (0.1333,0.0167.0.01) (0.1274,0.0219,0.0058)
X8 Close to the high voltage charged body L L VL (0.1667,0.0167.0.01) (0.1652,0.0230,0.0058)
X9 High oil flow velocity L VL L (0.1667,0.0167.0.01) (0.1726,0.0234,0.0058)
X10 Rough inner wall of pipeline VL VL L (0.1333,0.0167.0.01) (0.1348,0.0223,0.0058)
X11 Friction between splashing oil and air L VL VL (0.1333,0.0167.0.01) (0.1378,0.0219,0.0058)
X12 Fluid percussion to mental material VL L VL (0.1333,0.0167.0.01) (0.1274,0.0219,0.0058)
X13 No conductive particles in the liquid VL L VL (0.1333,0.0167.0.01) (0.1274,0.0219,0.0058)
X14 Without electrostatic ground VL L VL (0.1333,0.0167.0.01) (0.1274,0.0219,0.0058)
X15 Broken ground wire VL VL L (0.1333,0.0167.0.01) (0.1348,0.0223,00058)
X16 No-standard ground resistance L VL L (0.1667,0.0167.0.01) (0.1726,0.0234,0.0058)
X17 Non-explosion proof monitor or detector VL VL VL (0.1,0.0333,0.01) (0.1000,0.0208,0.0058)
X18 Electronic communication and photography equipment VL VL L (0.1333,0.0167.0.01) (0.1348,0.0223,0.0058)
X19 Other non-explosion proof electrical equipment L VL L (0.1667,0.0167.0.01) (0.1726,0.0234,0.0058)
X20 Poor heat dissipation L VL VL (0.1333,0.0167.0.01) (0.1378,0.0219,0.0058)
X21 Produced spontaneously combustible materials L L RL (0.25,0.0417,0.0133) (0.2521,0.0344,0.0084)
X22 Electrostatic spontaneous combustion L VL L (0.1667,0.0167.0.01) (0.1726,0.0234,0.0058)
X23 Impact of mental tools L VL L (0.1667,0.0167.0.01) (0.1726,0.0234,0.0058)
X24 Wearing iron spike shoes VL VL VL (0.1,0.0333,0.01) (0.1000,0.0208,0.0058)
X25 Direct lightning flash VL VL L (0.1333,0.0167.0.01) (0.1348,0.0223,00058)
X26 Reaction thunder L VL VL (0.1333,0.0167.0.01) (0.1378,0.0219,0.0058)
X27 Spherical thunder VL VL VL (0.1,0.0333,0.01) (0.1000,0.0208,0.0058)
X28 Lightning surge invasion L L VL (0.1,0.0333,0.01) (0.1652,0.0230,0.0058)
X29 Without lightning protection system L VL VL (0.1333,0.0167.0.01) (0.1378,0.0219,0.0058)
X30 Lightning protection design flaws VL VL L (0.1333,0.0167.0.01) (0.1348,0.0223,00058)
X31 Unqualified ground resistance L VL VL (0.1333,0.0167.0.01) (0.1378,0.0219,0.0058)
X32 Broken arrester RL L L (0.25,0.0417,0.0133) (0.2567,0.0348,0.0088)
X33 Entrained air in tank L VL VL (0.1333,0.0167.0.01) (0.1378,0.0219,0.0058)
X34 Existence of oil vapor in tank RL L RL (0.3,0.0417,0.0167) (0.3088,0.0424,0.0106)
X35 Weather poorly ventilated VL VL VL (0.1,0.0333,0.01) (0.1000,0.0208,0.0058)
X36 Ventilation breakdown L VL VL (0.1333,0.0167.0.01) (0.1378,0.0219,0.0058)
X37 Operational error RL VL L (0.2167.0.0583,0.0133) (0.2293,0.0341,0.0088)
X38 Oil hole not closed VL VL L (0.1333,0.0167.0.01) (0.1348,0.0223,00058)
X39 Lax seal around openings L H L (0.400,0.1000,0.0100) (0.3646,0.0398,0.0058)
X40 Corrosion leakage L VL H (0.3667,0.1167.0.0100) (0.3811,0.0433,0.0059)
X41 Flexible connection pipeline rapture RL L L (0.25,0.0417,0.0133) (0.2567,0.0348,0.0088)
X42 Breath valve failure H RL L (0.4500,0.1000,0.0133) (0.4679,0.0444,0.0075)

Fig. 10. The individual and group decision clouds of BE-X3.

14
S. Xie et al. Reliability Engineering and System Safety 215 (2021) 107791

Fig. 11. The individual and group decision clouds of BE-X4.

Fig. 12. The individual and group decision clouds of BE-X39.

different weights were assigned to different DMs. Among them, Tables 7
and 8 show the WCM of each evaluation indicator and the numerical
values of the WCM of each DM corresponding to each evaluation indi­
cator. Finally, the WCMs of the three DMs were WDM1=
(0.3780,0.0406,0.0006), WDM2 = (0.2743,0.0406,0.0006), and WDM3 =
(0.3476,0.0470,0.0007). Fig. 9 shows the final WCMs for DMs, indi­
cating that the evaluation of DM1 was relatively important, while DM2
was relatively low. The introduction of CM theory increased the di­
mensions of comparative indicators, causing the description of the in­
dividual abilities of the DMs to no longer rely on a precise value, which
could more accurately describe the relative importance between various
factors and improve the persuasiveness of the calculation results. The
relevant figures show that the WCMs were more abundant in the
expression of weight distribution. In addition, the En and He of the
weighted CM obtained by the Cloud-AHP algorithm were significantly
lower than the existing algorithms [41], indicating that the data
dispersion was effectively eliminated during the evaluation process, and
the reliability of the evaluation results was guaranteed.
(1) Regarding expert elicitation research involving the calculation of
the probability data of the BEs, the FCMF was proposed, which
abandoned the traditional concept of the membership. Based on
the natural similarity between the CM and subjective cognitive
uncertainty, the CM derived from FCMF mapping of the language
terms of DMs is intuitive, easy to understand, and convenient for
computing integration. Table 9 shows the GCDM results based on

15
S. Xie et al. Reliability Engineering and System Safety 215 (2021) 107791

Fig. 13. The individual and group decision clouds of BE-X40.

Fig. 14. The individual and group decision clouds of BE-X42.

the SCA algorithm and the WACA algorithm. The use of CMs to
express the opinions of DMs could better reflect the ambiguity
and randomness in the expression of subjective concepts.
Furthermore, the CM was easy to express graphically, simplifying
the subsequent steps (comparison of individual opinions and
GCDM results, and the Delphi iteration process). A defuzzifica­
tion method of the CM based on the centroid line method was also
proposed, and the defuzzification results and the probability data
of each BEs are shown in Table 10. As a result, a systematic risk
evaluation algorithm was formed.
(2) Since the probabilistic data were obtained based on expert elic­
itation, this paper proposed a GCDM algorithm and the Delphi
iteration process in terms of dealing with interpersonal uncer­
tainty. The GCDM method adequately solved the problem of
interpersonal uncertainty and overcame personal knowledge
limitations, while the Delphi iteration process reduced personal
errors (personal randomness). As can be seen from Figs. 10 to 14,
the DMs who provided flawed opinions revised their opinions
after receiving feedback from the comparison of their individual
opinions and the GCDM results, to make the decision result more
reasonable.
(3) Figs. 5–6 and Table 4 show the BT model and risk matrix for
FEAOD. The quantitative risk assessment of the FTA shows that
the probability of FEAOD, in this case, is 2.18 × 10-5, which is
lower compared to the probability 4.3 × 10-2 obtained from
1,530 oil depot fire accidents worldwide. This is due to the
continuous advancement in the integrity management of oil de­
pots in China in recent years, as well as the improvement of staff

16
S. Xie et al. Reliability Engineering and System Safety 215 (2021) 107791

Table 10 group decision problems. The CM is used to model the language

The final results of the GCDM and sensitivity analysis. terms of DMs, solving the problem of contradiction in the existing
BEs GCDM result FPS PVs sensitivity ranking methods for the accurate modeling of fuzzy concepts. The intro­
duction of GCDM and the Delphi iteration process has overcome
X1 (0.3088,0.0424,0.0106) 0.3823 1.99E-03 4
X2 (0.2521,0.0344,0.0084) 0.3140 1.03E-03 6 the limitations of individual knowledge and experience, reducing
X3 (0.4067,0.0438,0.0096) 0.4722 4.09E-03 3 personal errors and obtaining a more reasonable decision result.
X4 (0.3088,0.0424,0.0106) 0.3706 1.80E-03 5 (3) This study proposes a BT model and a risk matrix for FEAOD. A
X5 (0.1378,0.0219,0.0058) 0.1722 1.31E-04 12 case study involving an oil depot in Dalian is examined to
X6 (0.1274,0.0219,0.0058) 0.1487 7.65E-05 14
X7 (0.1274,0.0219,0.0058) 0.1603 1.01E-04 13
determine its risk level, as well as the weak links in the risk
X8 (0.1652,0.0230,0.0058) 0.1927 1.95E-04 10 management and control system. The proposed method can assist
X9 (0.1726,0.0234,0.0058) 0.2083 2.56E-04 37 oil depot managers in identifying critical risk factors while
X10 (0.1348,0.0223,0.0058) 0.1808 1.56E-04 38 assessing the consequences of accidents, and effectively
X11 (0.1378,0.0219,0.0058) 0.1784 1.48E-04 39
improving the efficiency of risk prevention and control manage­
X12 (0.1274,0.0219,0.0058) 0.1579 9.55E-05 40
X13 (0.1274,0.0219,0.0058) 0.1474 7.41E-05 41 ment of oil depots.
X14 (0.1274,0.0219,0.0058) 0.1593 9.86E-05 32
X15 (0.1348,0.0223,00058) 0.1732 1.34E-04 31 Future research will start with the dynamic characteristics of risk and
X16 (0.1726,0.0234,0.0058) 0.2010 2.26E-04 30 further explore these in the context of oil depots based on the theoretical
X17 (0.1000,0.0208,0.0058) 0.1352 5.35E-05 16
X18 (0.1348,0.0223,0.0058) 0.1751 1.39E-04 11
framework provided above. A dynamic risk assessment and decision
X19 (0.1726,0.0234,0.0058) 0.2075 2.53E-04 8 support model for oil fire and explosion accidents will be constructed to
X20 (0.1378,0.0219,0.0058) 0.1638 1.09E-04 29 ensure the safety of oil depot operations further.
X21 (0.2521,0.0344,0.0084) 0.2944 8.33E-04 42
X22 (0.1726,0.0234,0.0058) 0.1967 2.10E-04 9
X23 (0.1726,0.0234,0.0058) 0.2095 2.62E-04 7 CRediT authorship contribution statement
X24 (0.1000,0.0208,0.0058) 0.1374 5.69E-05 15
X25 (0.1348,0.0223,00058) 0.1736 1.35E-04 21 Shuyi Xie: Methodology, Writing – original draft, Writing – review &
X26 (0.1378,0.0219,0.0058) 0.1770 1.44E-04 20 editing, Formal analysis. Shaohua Dong: Funding acquisition, Super­
X27 (0.1000,0.0208,0.0058) 0.1358 5.44E-05 22
X28 (0.1652,0.0230,0.0058) 0.2002 2.23E-04 19
vision. Yinuo Chen: Writing – original draft, Visualization. Yujie Peng:
X29 (0.1378,0.0219,0.0058) 0.1649 1.12E-04 36 Data curtion. Xincai Li: Investigation.
X30 (0.1348,0.0223,00058) 0.1746 1.37E-04 35
X31 (0.1378,0.0219,0.0058) 0.1851 1.69E-04 34
X32 (0.2567,0.0348,0.0088) 0.3139 1.03E-03 33 Declaration of Competing Interest
X33 (0.1378,0.0219,0.0058) 0.1743 1.37E-04 2
X34 (0.3088,0.0424,0.0106) 0.3809 1.97E-03 1
X35 (0.1000,0.0208,0.0058) 0.1295 4.54E-05 18 The authors declare that they have no known competing financial
X36 (0.1378,0.0219,0.0058) 0.1851 1.69E-04 17 interests or personal relationships that could have appeared to influence
X37 (0.2293,0.0341,0.0088) 0.2974 8.62E-04 26 the work reported in this paper.
X38 (0.1348,0.0223,00058) 0.1778 1.47E-04 28
X39 (0.4021,0.0454,0.0100) 0.4772 4.25E-03 23
X40 (0.1378,0.0219,0.0058) 0.1991 2.19E-04 27 Acknowledgments
X41 (0.2567,0.0348,0.0088) 0.3083 9.72E-04 25
X42 (0.2978,0.0399,0.0100) 0.3769 1.90E-03 24 This work is financially supported by the National Key R&D Program
of China (2017YFC0805800) and the National Natural Science Foun­
professionalism. The results of the sensitivity analysis are shown dation of China (51874322). The authors thank the anonymous referees
in Table 10, revealing the key factors involved in the risk pre­ for their helpful comments and suggestions, which were very useful in
vention and control management of FEAOD. Through the improving the paper.
consequence analysis and risk evaluation by the risk matrix, the
final risk level of the oil depot was obtained, and the minimum Reference
safety requirements for its risk prevention and control were
[1] Fan JY. "Collection of oil tanks accident analysis". Beijing: China Petrochemical
given. The evaluation results can guide oil depot risk manage­
Press; 2005.
ment and decision-making. [2] Taveau Jérôme. “The Buncefield explosion: were the resulting overpressures really
unforeseeable?”. Process Saf Prog 2012;31(1):55–71.
[3] Baker QA. “Caribbean petroleum VCE case history”. Loss Prevent Bull 2019;269.
5. Conclusions
[4] Zhang XingX-quanQ, Heng MA, Hui-qiang ZHIZ. “Thought about Dalian” 7• 16“
fire——discussion about problem of” Code for Design of Oil Depot“ and
This paper proposes a new risk assessment method for FEAOD. Based modification suggestion [J]”. Fire Sci Technol 2010;9.
on the results of the study, the conclusions are as follows: [5] Shahriar Anjuman, Sadiq Rehan, Tesfamariam Solomon. “Risk analysis for oil & gas
pipelines: a sustainability assessment approach using fuzzy based bow-tie
analysis”. J Loss Prev Process Ind 2012;25(3):505–23.
(1) Based on the natural resemblance of the CM to the subjective [6] Lu Linlin. “A comprehensive risk evaluation method for natural gas pipelines by
cognitive uncertainty and calculation simplicity, a Cloud-AHP combining a risk matrix with a bow-tie model”. J Nat Gas Sci Eng 2015;25:124–33.
[7] Wang Daqing, Zhang Peng, Chen Liqiong. “Fuzzy fault tree analysis for fire and
algorithm is proposed, which uses the CM scale to model the explosion of crude oil tanks”. J Loss Prev Process Ind 2013;26(6):1390–8.
uncertainty of personal judgment during the decision-making [8] Shi Lei, Shuai Jian, Xu Kui. “Fuzzy fault tree assessment based on improved AHP
process. The WCMs obtained by the proposed method are sub­ for fire and explosion accidents for steel oil storage tanks”. J Hazard Mater 2014;
278:529–38.
stantially lower than the traditional algorithms in terms of En and [9] Badida Pavanaditya, Balasubramaniam Yakesh, Jayaprakash Jayapriya. “Risk
He. In the case of the enriched weight distribution, the data evaluation of oil and natural gas pipelines due to natural hazards using fuzzy fault
dispersion generated during the evaluation process, based on the tree analysis”. J Nat Gas Sci Eng 2019;66:284–92.
[10] Yuhua Dong, Datao Yu Y. “Estimation of failure probability of oil and gas
CM, is mostly eliminated.
transmission pipelines by fuzzy fault tree analysis”. J Loss Prev Process Ind 2005;
(2) A systematic probability data evaluation algorithm based on the 18(2):83–8.
fuzzy cloud membership function is proposed. This method can [11] Hu Lunhu. “Risk assessment of uncertain random system—Level-1 and level-2 joint
propagation of uncertainty and probability in fault tree analysis”. Reliab Eng Syst
more objectively fuse the opinions of DMs when dealing with
Saf 2020;198:106874.

17
S. Xie et al.
[12] Hosseini Navid, Givehchi Saeed, Maknoon Reza. “Cost-based fire risk assessment in
natural gas industry by means of fuzzy FTA and ETA”. J Loss Prev Process Ind
2020;63:104025.
[13] Wu Dongyin, Chen Zhen. “Quantitative risk assessment of fire accidents of large-
scale oil tanks triggered by lightning”. Eng Fail Anal 2016;63:172–81.
[14] Necci Amos. “Accident scenarios triggered by lightning strike on atmospheric
storage tanks”. Reliab Eng Syst Saf 2014;127:30–46.
[15] Fabbrocino Giovanni. “Quantitative risk analysis of oil storage facilities in seismic
areas”. J Hazard Mater 2005;123:61–9. 1-3.
[16] Fu Shanshan. “Framework for the quantitative assessment of the risk of leakage
from LNG-fueled vessels by an event tree-CFD”. J Loss Prev Process Ind 2016;43:
42–52.
[17] Alileche Nassim. “Thresholds for domino effects and safety distances in the process
industry: a review of approaches and regulations”. Reliab Eng Syst Saf 2015;143:
74–84.
[18] Lower Michał, Magott Jan, Skorupski Jacek. “Analysis of Air Traffic Incidents using
event trees with fuzzy probabilities”. Fuzzy Sets Syst 2016;293:50–79.
[19] Piadeh Farzad, Ahmadi Mohsen, Behzadian Kourosh. “Reliability assessment for
hybrid systems of advanced treatment units of industrial wastewater reuse using
combined event tree and fuzzy fault tree analyses”. J Cleaner Prod 2018;201:
958–73.
[20] Jeong Kwan-Seong. “Estimation on probability of radiological hazards for nuclear
facilities decommissioning based on fuzzy and event tree method”. Ann Nucl
Energy 2011;38(11):2606–11.
[21] Bonano EJ. “Application of risk assessment and decision analysis to the evaluation,
ranking and selection of environmental remediation alternatives”. J Hazard Mater
2000;71(1–3):35–57.
[22] Lin Chunjin. “A new quantitative method for risk assessment of water inrush in
karst tunnels based on variable weight function and improved cloud model”.
Tunnelling Underground Space Technol 2020;95:103136.
[23] Yao Jiping. “Assessment of lake eutrophication using a novel multidimensional
similarity cloud model”. J Environ Manage 2019;248:109259.
[24] Dong Yucheng, Li Cong-Cong, Herrera Francisco. “Connecting the linguistic
hierarchy and the numerical scale for the 2-tuple linguistic model and its use to
deal with hesitant unbalanced linguistic information”. Inf Sci 2016;367:259–78.
[25] Yu Liu, Deyi Li L. “Statistics on atomized feature of normal cloud model”. J Beijing
Univ Aeronaut Astronaut 2010;36(11):1320–4.
[26] Cui Chao-Qun. “China’s regional sustainability assessment on mineral resources:
Results from an improved analytic hierarchy process-based normal cloud model”.
J Clean Prod 2019;210:105–20.
[27] Zhang Hongyang. “Uncertainty analysis of impact factors of eco-environmental
vulnerability based on cloud theory”. Ecol Indic 2020;110:105864.
[28] Wang Dong. “A multidimension cloud model-based approach for water quality
assessment”. Environ Res 2016;149:113–21.
[29] Yang Zhe, Wang Yufeng. “The cloud model based stochastic multi-criteria decision
making technology for river health assessment under multiple uncertainties”.
J Hydrol 2020;581:124437.
[30] Liang Xiaobin. “Risk assessment for long-distance gas pipelines in coal mine gobs
based on structure entropy weight method and multi-step backward cloud
transformation algorithm based on sampling with replacement”. J Clean Prod
2019;227:218–28.
[31] Zhang Shanghong. “Evaluation of water cycle health status based on a cloud
model”. J Clean Prod 2020;245:118850.
[32] Lavasani SeyedMiri. “Utilisation of Fuzzy Fault Tree Analysis (FFTA) for quantified
risk analysis of leakage in abandoned oil and natural-gas wells”. Ocean Eng 2015;
108:729–37.
18
Reliability Engineering and System Safety 215 (2021) 107791
[33] Liu Pei. “Fault tree analysis combined with quantitative analysis for high-speed
railway accidents”. Saf Sci 2015;79:344–57.
[34] Limbourg Philipp, De Rocquigny Etienne. “Uncertainty analysis using evidence
theory–confronting level-1 and level-2 approaches with data availability and
computational constraints”. Reliab Eng Syst Saf 2010;95(5):550–64.
[35] Vileiniskis Marius, Remenyte-Prescott Rasa. “Quantitative risk prognostics
framework based on Petri Net and Bow-Tie models”. Reliab Eng Syst Saf 2017;165:
62–73.
[36] Wu Yunna. “Optimal investment selection of industrial and commercial rooftop
distributed PV project based on combination weights and cloud-TODIM model
from SMEs’ perspectives”. J Cleaner Prod 2019;234:534–48.
[37] Ding Long, Khan Faisal, Ji Jie. “Risk-based safety measure allocation to prevent
and mitigate storage fire hazards”. Process Saf Environ Prot 2020;135:282–93.
[38] Carpitella Silvia. “A combined multi-criteria approach to support FMECA analyses:
a real-world case”. Reliab Eng Syst Saf 2018;169:394–402.
[39] Xie Shuyi. “Risk assessment of an oil depot using the improved multi-sensor fusion
approach based on the cloud model and the belief Jensen-Shannon divergence”.
J Loss Prev Process Ind 2020;67:104214.
[40] Li Deyi, Liu Changyu, Gan Wenyan. “A new cognitive model: cloud model”. Int J
Intell Syst 2009;24(3):357–75.
[41] Yan Fei. "A novel hybrid approach for landslide susceptibility mapping integrating
analytical hierarchy process and normalized frequency ratio methods with the
cloud model". Geomorphology 2019;327:170–87.
[42] Saaty Thomas L. “A scaling method for priorities in hierarchical structures”. J Math
Psych 1977;15(3):234–81.
[43] Saaty Thomas L. “Decision making with the analytic hierarchy process”. Int J Serv
Sci 2008;1(1):83–98.
[44] Yang Xiaojun, Yan Liaoliao, Zeng Luan. “How to handle uncertainties in AHP: the
Cloud Delphi hierarchical analysis”. Inf Sci 2013;222:384–404.
[45] Li Xinhong, Chen Guoming, Zhu Hongwei. “Quantitative risk analysis on leakage
failure of submarine oil and gas pipelines using Bayesian network”. Process Saf
Environ Prot 2016;103:163–73.
[46] Onisawa Takehisa. “An application of fuzzy concepts to modelling of reliability
analysis”. Fuzzy Sets Syst 1990;37(3):267–86.
[47] Yan Fang, Xu Kaili. “Methodology and case study of quantitative preliminary
hazard analysis based on cloud model”. J Loss Prev Process Ind 2019;60:116–24.
[48] Liu H, Tang Y-X, Cheng Y-H. “Study on the classification of dangerous Hazard
evaluation based on risk management method”. China Saf Sci J (CSSJ) 2007;6:25.
[49] Guo Song. “Cause analysis of the fire and explosion during crude oil desulfurization
in China”. J Loss Prev Process Ind 2013;26(6):961–7.
[50] Zhou Jianfeng, Reniers Genserik. “Probabilistic Petri-net addition enabling
decision making depending on situational change: the case of emergency response
to fuel tank farm fire”. Reliab Eng Syst Saf 2020:106880.
[51] Safety Law. “Production Safety Accident Reporting and Investigation and Handling
Regulations.” Proclamation of the National Defense Science. Technol Ind Commiss
People’s Republ China 2008;6:181–4. 26.
[52] Khakzad Nima, Khan Faisal, Amyotte Paul. “Dynamic risk analysis using bow-tie
approach”. Reliab Eng Syst Saf 2012;104:36–44.
[53] Liu Changyu, Gan Wenyan, Wu Tao. "A comparative study of cloud model and
extended fuzzy sets". In: International Conference on Rough Sets and Knowledge
Technology. Springer; 2010.
[54] Langdalen Henrik, Bjorheim Abrahamsen Eirik, Selvik Jon Tømmerås. “On the
importance of systems thinking when using the ALARP principle for risk
management”. Reliab Eng Syst Saf 2020;204:107222.