Safety, Reliability and Risk Analysis: Beyond the Horizon – Steenbergen et al.

(Eds)
© 2014 Taylor & Francis Group, London, ISBN 978-1-138-00123-7

Hierarchical Bayesian model for gas transmission network reliability

T. Iešmantas & R. Alzbutas

Lithuania Energy Institute, Kaunas, Lithuania

ABSTRACT: Gas transmission pipeline network is of great importance to any country using natural
gases in its various technological processes. However, the usefulness cannot overshadow the threat posed
to people and property by the grid failures. In order to quantify these risks, several widely recognized
pipeline incident databases have been established: OPS, EGIG, UKOPA, to name a few. Each database
contains data about pipelines operated in different geographical regions with varying soil types, under
different maintenance environments. In addition, definitions of incident vary across data samples. Hence,
direct integration or pool of data into one analysis and sample raises suspicions about the validity of
resulting inferences. The purpose of this paper is to move beyond the qualitative pipeline accident data-
base comparison and to draw guidelines for quantitative integration of all available statistical information
to improve reliability evaluation. We will review five natural gas transmission pipeline network accident
databases and develop a methodology based on hierarchical Bayesian model of pipeline reliability data
while taking into consideration varying incident criteria.

1  INTRODUCTION i.e. statistical information carried by one database

Gas transmission pipeline network is of great
importance to any country using natural gases in
its various technological processes. However, the
usefulness cannot overshadow the threat posed to
people and property by failures in the system. The
importance of recognizing such events has been
already expressed in EU Council Directive 96/82/
EC (for more on this see works by Papadakis et al.
(1999) and Papadakis (2000)). Upon the gas leak-
age event if ignited jet fire, flash fire or explosion
could be an outcome (Jo & Ahn, 2002). In addi-
tion to this kind of risk, leakage of significant size
could lead to cascading events (Han and Weng,
2010), i.e. loss of pressure and flow rate at the
failed node or pipeline will lead to reduced param-
eters in other parts of the network, hence failing to
achieved required performance measures.
In order to quantify these risks, several widely
recognized pipeline incident databases have been
established. Organizations that initiated these
databases are: US Department of Transporta-
tion Pipeline and Hazardous Materials Safety
Administration Office of Pipeline Safety (further
OPS), European Gas pipeline Incident data Group
(EGIG), United Kingdom Onshore Pipeline Oper-
ators’ Association (UKOPA), Canadian National
Energy Board (NEB). Even though these data-
bases are quite extensive (some more than other),
its accident data seems to be never used together,
was not used to support information contained in
another. Qualitative comparisons like Papadakis’
(2010) do not fill the gap as well. This is under-
standable since each database contains data about
pipelines operated in remote geographical regions
with varying soil types, under different data collec-
tion criteria. Hence, direct integration of data into
one analysis and sample raises suspicions about
the validity of resulting inferences.
On the other hand, the data in one database
are not completely different from the sample in
another database. No matter in which country it is
operated, pipelines still bear some resemblance to
each other: coating, diameter, maximum pressure,
type of transported material, etc. Hence, the fail-
ure rates are similar at some degree as well. Impor-
tant question should be raised: how to extract that
information arising out of similarity and use it to
support inferences for another natural gas pipeline
network reliability assessment?
The purpose of this paper is to move beyond
the qualitative pipeline accident database com-
parison and to draw guidelines for a quantitative
integration of all available statistical information
to improve reliability evaluation. In Section 2, we
will review four natural gas transmission pipeline
network accidents databases and describe the spe-
cificity of Lithuanian natural gas transmission
pipeline reliability data; section  3 is devoted for
development of methodology based on hierarchical

1101
Bayesian model of pipeline reliability data when
taking into consideration various data collection
criteria; finally, all available statistical data in data-
bases will be jointly analyzed in order to improve
inferences as well as forecasts for Lithuanian trans-
mission network reliability.

2  A REVIEW OF PIPELINE ACCIDENT

DATABASES

Mostly used and cited international pipeline inci-

dents databases are as follows:
Figure  1.  Influence of collection criteria to incidents
• OPS (data from 1970 to 1990  in (Golub et al. frequency (OPS database).
2010), from 1991 to 2011  in PHMSA online
database);
• EGIG (EGIG report, 2008);
• UKOPA (McConnell and Haswell, 2011);
• NEB (Michael Baker Jr., 2008).
However, these databases are not identical and
differ in covered time periods, incident criteria,
geographical location of pipeline networks, etc.
Main differences and similarities are summarized
in the following table.
As we can see, the data collection criteria highly
differ for OPS database—whole time series is
divided into three regions (Figure 1), which cannot
be analyzed as a one sample without taking into
consideration those differences.
Incident criteria can be though of as the basis Figure  2.  Incidents frequency change over time for
for screening out insignificant events or applying Lithuanian natural gas transmission network.
censoring procedure.
It is important to realize, that the data repre-
sented by these databases do not cover every coun- sion network might be questionable. On the other
try and the usage of it to analyze samples from hand, samples from small countries like the one
another, not covered by database, gas transmis- from Lithuanian gas pipeline network are not rep-
resentative enough and there is no other choice but
to use the international experience.
Table  1.  International pipeline databases: Similarities Regarding Lithuanian gas transmission pipeline
and differences. network, data are quite scattered due to relatively
short length of the pipelines and due to informa-
Name
tion collection about accidents that resulted to gas
(Location) Incident criteria
explosions or fires. The criterion was changed in
OPS PHMSA (USA) 1970–1983: 2004 and since then all incidents resulting to gas
damage higher than 5000 $; leakage are recorded. To obtain more clear dem-
1984–2002: onstration and to avoid the profusion of zero
damage higher than 50000 $; frequencies we pooled incidents data as well as
2003–2012: pipeline lengths into 5-years bins (Figure 2).
damage higher than 50000 $; Current state-of-the-art situation of pipeline
leaks above 43000 m3. reliability analysis involves physical (cracking,
EGIG (Europe) All detectable unintentional degradation, etc.) analysis (stochastic/determin-
gas releases. istic) or statistical investigation. In the follow-
UKOPA (Great Britain) All detectable unintentional ing sections we confine ourselves to the second
gas releases.
option due to several reasons—scientific lit-
NEB (Canada) All detectable unintentional
gas releases; the death of or
erature covering physical analysis issues is quite
serious injury to a person. well developed and the statistical incidents
data aspects are left somewhat underrepresented.

1102
The  usual approach is to concentrate on several
(but possibly incorrectly calculated) main charac-
teristics like mean and variance and to conclude
from these measures the overall state of pipeline
system reliability.
3  METHODOLOGY
3.1  Network reliability assessment considering
variation of incident criteria
We present here the methodology of modelling
incidents count data, when the incident definition
changes over time. This methodology is already
described in (Iešmantas and Alzbutas, 2013) and
we will just describe it quite roughly. Although we
will consider poissonian data, the methodology
can be extended to other distributions as well. Sup-
pose we have a number of incidents X over some
time period ∆ when the length of pipeline system
is L and the exposure is E  =  ∆L. To make things
more transparent we assume that ∆ = 1 and drop
this variable from our further notation. We assume
that the rate of incidents at the age t is the function
of age and incident criteria at that time Ct, i.e.
λ = λ (t; Ct ),
where Ct might be a set of different criteria, which
we will assume to be mutually independent of each
other and the occurrence of incidents can fall just
in one of the categories defined by the set. In addi-
tion, let C denote the set of all criteria used, so that
Ct  ⊆  C, ∀t. However, this is not entirely correct,
because in reality an incident could satisfy more
than one criteria and model is just an approxima-
tion of the phenomena.
We assume that each data point Xt is a sum of
multinomial random variables—the number of
incidents under each criteria out of overall number
of accidents follows multinomial distribution with
parameters p and Xt, where p = (p1,..., pK) and K is
the cardinality of C. More formally, if X t1,…, X tK
are number of incidents under each criteria, then
the distribution of vector of incidents (X t1,…, X tK )
conditional on ∑ X t is as follows:
j
Ct
(X t1, …, X tk ) | ∑ Xtj = Xt ~ Multinomial ( pt , Xt )
Ct
 (2)
where p is the probability vector of incidents. The
unconditional distribution for each vector compo-
nent is then:
(
X tj | Pj , λ (t ) ~ Poisson Pj Et λ (t ) )
pj is the probability of incidents under jth
criterion.
Since the information of how many accidents X tj
have occurred under each criterion is not available
to us, all that could be done is to model the pooled
sum ∑ C X tj = X t together with probability vector
t
p. From the properties of Poisson distribution
we easily conclude with a Criterion-Dependent-
­Poisson (CDP) model
X t ~ Poisson ( Et Λ(t )) (4)
where Λ(t ) = λ (t )∑ C pi and the summation is
t
over those probabilities that correspond to the
collection of criteria Ct. The general framework
schematically can be represented as in flow-chart
Figure 3.
3.2  Accounting for database differences
In this section we will tackle a problem arising due
to the differences of databases. Each database or
data sample represents different natural gas pipeline
networks, controlled by different operators in dif-
ferent environmental and social conditions. Hence,
one cannot expect homogeneity in failure data.
(1) Especially the heterogeneity is pronounced in
the initial failure rates of each database sample.
This raises a question: would it be appropriate to
pool all data into one sample and further proceed
reliability assessment while pretending we are ana-
lysing “virtual” network, which accurately repre-
sents international situation? That would be one
possible (and easy) way to go. But without taking
into account variability in data we would end up
with overly optimistic reliability boundaries, not
to mention that estimates would hardly fit real
situation when data varies a lot from one source
to another.
(3)
Figure  3.  Methodology of pipeline network reliability
model construction under different accident criteria.
1103
 In order to deal with this issue, we employ hier-
archical Bayesian model perspective, which can be
represented as in Figure 4.
The lowest level of the hierarchy represents data
and its stochastic behaviour expressed by some
parametric distribution. Data might be collected at
different pipeline networks or databases. It is then
partially merged in the second level of hierarchy,
where all samples share part of their information
through within-source parameters θ i1 and θ i 2 called
unobservable variables.
Then this information is used to infer in the
third stage, or hyper-prior stage, about between-
source parameters φ. As showed, information goes
up to the highest hierarchy level and its strength
deteriorates as it flows deeper and deeper.
Our final addition to the methodology of pipe-
line network reliability analysis is to use hierar-
chical  Bayesian modelling approach for the CDP
model (Hierarchical CDP, or HCDP). To do
this, we need to decide which parameters will be
treated as hierarchically dependent, and which
should be estimated independently of the others.
The most general case would be to put hierar-
chies on all parameters in the model; however, this
might be impossible to do for probability vectors
p = ( p1, …, pK ), since different operators may
employ some different criteria.
The hierarchical construction opens a possibil-
ity to not just investigate international pipeline
accident databases jointly and assess the variability
of worlds’ pipeline grid reliability, but also to inves-
tigate gas transmission grids not covered by any
of databases: if few data samples are available—­
hierarchical structure will strengthen the infer-
ences; if no statistical information is at hand
(newly deployed transmission network)—more
realistic reliability boundaries still can be obtain
from HCDP rather than just using one database
information.
Figure  4.  Graphical representation of hierarchical
Bayesian model (Iesmantas and Alzbutas, 2012).
1104
4  APPLICATION: JOINING PIPELINE
INCIDENT DATABASES FOR ONE
ANALYSIS
As presented at the beginning of the paper, we
have samples from OPS, EGIG, UKOPA, NEB
and Lithuania. Hence, overall there are 5 samples,
which traditionally would not be analysed jointly,
but our methodology resolves this issue. EGIG,
UKOPA and NEB could be regarded as very simi-
lar data samples, since incident criteria are almost
identical and no change of the incident criteria
have ever occurred. Hence, criterion sets for each
these databases can be regarded as identical. OPS
used 3 criteria and sample from Lithuania is based
on two criteria. Therefore, in order to apply hier-
archical method, we need to construct a set C of
criteria.
Until 1983 accidents were recorded to OPS
if the damage were above 5000 $, or there were
events with injuries or deaths. Then the criterion
were increased to 50000 $ in 1984 and finally addi-
tional criterion were introduced in 2002—leakage
above 43000 m3. Accidents with deaths and inju-
ries were always recorded, so that we can discard
it from our set of criteria, so that we are left with
3 not mutually exclusive criteria. Hence, we form
the set
C = {C 1( > 5000$),C 2 ( > 50000$),
C 1( > 50000$ or 43000 m3 )}.
None of the criteria are mutually exclusive and
following relations hold:
C 2 ⊂ C 1, C 3 ⊂ C 1, C 2 ⊂ C 3 .
Due to this, we have that redefinition of C is
needed. However, it is not so trivial with C3, since
accident in this group might be of damage greater
than 50000 $ but with leakage less than 43000 m3
or vice versa. It may also happen that an accident
falls in both categories. This leads to following
redefinition of the set of accident criteria:
{ (
C ′ = C 1′ > 5000$, < 50000$, < 43000 m3 , )
C 2′
(> 5000$, < 50000$, > 43000 m ),
3
C 3′ (> 50000$, < 43000 m ),
3
C 4′ (> 50000$, > 43000 m )}
3
where all criteria are mutually exclusive and the
following expressions holds:

C 1 = C 1′ ∪ C 2′ ∪ C 3′ ∪ C 4′;
C 2 = C 3′ ∪ C 4′;
C 1 = C 2′ ∪ C 3′ ∪ C 4′.
If we denote p′ = ( p1′, p 2′, p3′, p 4′) a probability
vector for C ′, then it is obvious, that vector for
3′ 4′ 2′ 3′ 4′
C will be p = (1, p + p , p + p + p ) or (since
∑ p = 1) p = (1, 1 − p − p , 1 − p ).
k′ 1′ 2′ 1′
It should be mentioned, that the last expres-
sion of probability vector should be used to avoid
identifiability problems.
Next we will construct criterion sets for Lithuanian
accident data sample. However, to avoid unnecessary
profusion of notation, we will use the same letters
C and p to denote sets and probability vectors—the
reader should be able to still understand it clearly.
Since 2004, Lithuania collected information about
incidence with gas leakage (denote it C 2), so until this
moment, previously used criterion forms a subset of
C 2. If we denote the first criterion C 1 we have a rela-
tion C 1 ⊂ C 2. We transform C = (C 1,C 2) as follows:
C ′ = {C ′1 ( Explosion ),
C ′ 2 (Gas leakage without explosion)}.
1 2
Evidently, criteria C ′ and C ′ are mutually
exclusive and C 2 = C ′1 ∩ C ′ 2 C 1 = C ′1. This leads
to a probability vector p = ( p1′ , 1) for C.
It is difficult to relate probability vectors for different
databases through hierarchical structure—the number
of components differs and the criteria themselves are
not identical. In our case it would be possible, though
not entirely exact, to relate probability to observe inci-
dent under gas leakage criterion C 2 and probability to
observe incident under criterion C 1 ( > 5000$ ) in OPS
dataset. However, this would be quite artificial and
would be true just approximately. Hence, we apply
hierarchical structure only for parameters of trend
λ (t ) = λ (t;θ ) , which itself represents the criterion
under which all accidents are recorded.
Mathematical representation of hierarchically
structured data is as follows:
1105
Here we made an assumption that λ (t; θ) has
two unknown parameters θ k = (θ1k ,θ 2k ) of which
the first is positive, hence has lognormal distri-
bution, and the second is normally distributed.
Normality and log-normality are assumptions
and the sensitivity has not been investigated in
this paper. We admit this shortcoming, but think
that it is a reasonable assumption in our setting.
We are particularly interested in how well our
hierarchical model covers all observed data and
how much including the international experience
on the incidents in pipeline grids strengthens infer-
ences on Lithuanian gas network.
The first issue, performance of our model with
regard to all data samples, is not easy to address.
Since the number of data samples is small, param-
eters θk form so called unobservable data sample
which itself is small. Due to this reason the
uncertainties in second level hierarchy parameter
estimates will be high, resulting to very broad cred-
ibility intervals. Hence, the influence of the hyper-
prior (Level III) distribution has to be investigated.
We will consider three prior distributions of the
following forms:
- π (µ, σ) ∝ 1 - uniform distribution;
- π (µ, σ) ∝ σ -2 - Jeffrey’s prior;
- π (µ, σ) ∝ σ -1 - invariant Haar measure.
For the sake of consistency, we will consider
the failure rate trend λ (t; θ) alone, i.e. when all
incidents are observed. The influence of the prior
distributions on the trend line is negligible—no sig-
nificant differences were observed, hence allowing
to conclude that even under small sample of unob-
servables, the parameter estimates are very robust.
However, the impact is much more pronounced
when we turn to the estimation of credibility inter-
vals, as Figure 5 shows.
The widest intervals are under the uniform
hyper-prior distribution, since it is the least inform-
ative distribution. However, the bounds in this case
are extremely wide (the figure is in log-scale) and
clearly unreasonable: any experienced expert would
Figure 5.  Comparison of the influence of hyper-prior
distribution on Bayesian credibility intervals.
discard such bounds as carrying no useful informa-
tion. Hence, we can say that by using such subjec-
tive judgement, we discard uniform hyper-prior
distribution from our further analysis and turn to
more informative ones. Upper bounds for Haar
measure and Jeffrey’s hyper-prior are still very high
resulting to 107 and 26  incidents for 1000  km of
pipelines accordingly. We again use a subjective
judgement and select for our further analysis the
most informative prior out of three considered—
Jeffreys prior. This distribution represents most
realistic situation of failure rates in pipeline net-
works, because highest observed rate is 1.61  inci-
dence for 1000 km at OPS database, thus 107 would
be clearly too high even for the credibility bounds.
We also observed a good coverage of the incident
frequencies plotted from all data samples. Hence,
the validity of our model is supported as well.
Now we turn our eye on the inference for Lithua-
nian pipeline network. Due to the small size of the
network and the incident criterion used until 2004,
the data is quite scattered and the inferences based
on it alone would be questionable. But until now,
there was nothing to be done: at best, those few data
could be translated into failure frequency estimate
and qualitatively compared to international experi-
ence to validate that the situation in network reli-
ability is not worse\better than in other countries.
When comparing the estimated trend (see
Figure  6, reliability inference zone), hierarchical
model provides smaller credibility bounds than
obtained from non-hierarchical model. This is due to
the information borrowed from other incident sam-
ples through hierarchical structure and demonstrates
the usefulness of the model. More support comes
from the fact that the predictions under hierarchical
model are obtained under higher certainty level than
those, obtained from non-hierarchical (Figure  6,
reliability prediction zone). We have seen such effect
when considering OPS data sample alone when CBP
model was applied: there is nothing surprising there,
though—more information we have, more certain
we are about our current situation and the future.
Figure 6.  Comparison of estimated and predicted trend
and credibility upper bounds for hierarchical and non-
hierarchical models.
1106
5  CONCLUSIONS
Presented methodology allowed to join all pipe-
line accident data sources without the necessity to
discard data under different criteria. Hierarchi-
cal Bayesian method allowed taking into account
differences between pipeline network deployed in
various locations of the world and Criteria-Based
Poisson model enabled to use data collected under
different criteria. In addition we assessed the sen-
sitivity of hierarchical method to various priors
on dispersion parameters, and based on subjective
decision selected one with best reflection of reality.
We showed how reliability forecasts are affected
by hierarchical and non-hierarchical models as well
as the reduction of uncertainty in future reliability
values when all data is taken into consideration.
REFERENCES
EGIG, 2008. Gas Pipeline Incidents, European Gas Pipe-
line Incident Group, Secr. Gasunie N.
Golub, E., Greenfeld, J., Dresnack, R., Griffis, F.H.,
Pignataro, L.J. (2010). Pipeline accident effects for
natural gas transmission pipelines. Final report. New
Jersey Institute of Technology (August, 1996).
Han, Z.Y. & Weng, W.G., 2010. An integrated quanti-
tative risk analysis method for natural gas pipeline
network. Journal of Loss Prevention in the Process
Industries, 23(3), pp. 428–436.
http://primis.phmsa.dot.gov/comm/reports/safety/;
viewed on 2013-04-21.
Iešmantas T., Alzbutas R. Age-dependent hierarchical
Bayesian modelling for reliability assessment under
small data sample // Proceedings of 11th international
probabilistic safety assessment and management con-
ference (PSAM 11) and the annual European safety
and reliability conference (ESREL 12), Helsinki
Finland, June 25–29, 2012. Finland, 2012, p. 1–10.
Iešmantas T. & Alzbutas R. Methodology for gas transmis-
sion network Age-dependent reliability assessment con-
sidering variation of incident criteria. CYSENI 2013,
Kaunas, Lithuania, May 29–31, 2013 (to appear).
Jo, Y.-D. & Ahn, B.J., 2002. Analysis of hazard areas
associated with high-pressure natural-gas pipelines.
Journal of Loss Prevention in the Process Industries,
15(3), pp. 179–188.
McConnell, R. & Haswell, D.J.V., 2011. UKOPA Pipeline
Product Loss Incidents (1962–2010), Ambergate.
Michael Baker Jr., I., 2008. Comparison of US and
Canadian Transmission Pipeline Consensus Standards.
Papadakis, G., 2000. Assessment of requirements on
safety management systems in EU regulations for
the control of major hazard pipelines. Journal of
hazardous materials, 78(1–3), pp. 63–89.
Papadakis, G., 1999. Major hazard pipelines: a comparative
study of onshore transmission accidents. Journal of Loss
Prevention in the Process Industries, 12(1), pp. 91–107.
Papadakis, G., Porter, S. & Wettig, J., 1999. EU initiative
on the control of major accident hazards arising from
pipelines. Journal of Loss Prevention in the Process
Industries, 12(1), pp. 85–90.