Journal of Natural Gas Science and Engineering 25 (2015) 124e133

Contents lists available at ScienceDirect

Journal of Natural Gas Science and Engineering

journal homepage: www.elsevier.com/locate/jngse

A comprehensive risk evaluation method for natural gas pipelines by

combining a risk matrix with a bow-tie model
Linlin Lu a, Wei Liang a, *, Laibin Zhang a, Hong Zhang a, Zhong Lu b, Jinzhi Shan b
a
College of Mechanical and Transportation Engineering, China University of Petroleum, Beijing, 102249, China
b
Petrol China Beijing Gas Pipeline Co. Ltd., Beijing, China

a r t i c l e i n f o a b s t r a c t

Article history: Leakage from natural gas pipelines causes severe economic loss and significantly affects social security
Received 8 January 2015 considering the gas' combustibility and the difficulties in detecting leakage. This study proposes a
Received in revised form comprehensive risk evaluation method by combining a risk matrix with a bow-tie model. First, a bow-tie
20 April 2015
model is built, considering the risk factors that may lead to an accident using a fault tree; the conse-
Accepted 21 April 2015
Available online
quences of unwanted events are then described in an event tree. Second, a fuzzy method is used to
calculate the failure probabilities. Third, the severity of an accident is evaluated through an index system
that includes personal casualties, economic losses and environmental disruptions. Finally, a risk matrix
Keywords:
Bow-tie model
consisting of a probability ranking criterion and a consequence ranking criterion is proposed to reach an
Risk matrix integrated quantitative conclusion of a bow-tie model. A case study of an underwater pipeline carrying
Fuzzy method natural gas has been investigated to validate the utility of the proposed method.
Natural gas pipeline © 2015 Elsevier B.V. All rights reserved.

1. Introduction proposed a quantitative assessment index system that included a

Leakage from natural gas pipelines can cause devastating acci-
dents due to the flammability of the gas, which is transported at
high pressures. In recent years, accidents in natural gas pipelines
have occurred too often and have drawn significant public atten-
tion. Thus, the implementation of safety measures followed by a
comprehensive risk evaluation is critical to maintain a level of risk
below the acceptable criteria. The risk evaluation of pipelines
currently includes a quantitative risk analysis (QRA) and an acci-
dent consequence analysis (ACA).
In a QRA, Muhlbauer (2004) proposed an integrated and
continuously improving risk evaluation framework for pipelines
that has become the guideline for pipeline risk assessment. The
purpose of this framework is to evaluate a pipeline's risk exposure
to the public and to identify ways to effectively manage that risk.
Ma et al. (2013a) used geographical information systems (GIS) to
calculate the quantitative risk of urban natural gas pipeline net-
works. The proposed QRA process incorporated an assessment of
the failure rates of integrated pipeline networks, a quantitative
analysis model of accident consequences, and assessments of in-
dividual and societal risks. Jo and Ahn (2005) also used GIS to assess
the quantitative risk of natural gas pipelines. Han and Weng (2010)
* Corresponding author.
E-mail addresses: lulinlin1211@163.com, lw@cup.edu.cn (W. Liang).
causation index, an inherent index, a consequence index and their
corresponding weights for urban natural gas pipelines. The failure
probability calculation is an important part of a QRA. Yuhua and
Datao (2005) used a fuzzy fault tree to investigate the risk factors
and calculate the failure probabilities of natural gas pipelines.
Shahriar et al. (2012) applied a fuzzy approach to calculate the fuzzy
probabilities (i.e., likelihood) of a basic event in a fault tree for oil
and gas pipelines. There are also other relevant works in the liter-
ature, such as that of Ma et al. (2013b) and Jamshidi et al. (2013),
that investigate the QRAs of pipelines.
In an ACA, an event tree has been shown to be an efficient tool.
As the first step in the multidimensional risk analysis of a hydrogen
pipeline, Lins and de Almeida (2012) built an event tree that
included all possible accident scenarios including punctures and
ruptures of the pipeline. To calculate the safety distances around a
pipeline transporting liquefied gas and pressurized natural gas,
Sklavounos and Rigas (2006) used an event tree analysis as a formal
technique to determine the possible outcomes of an accidental fuel
gas release. Event tree analysis is also widely used to identify
dangerous scenarios with regard to hydrogen pipelines (Lins and de
Almeida, 2012), dynamic analyses for transient systems (Zamalieva
et al., 2013) and accident analyses of different hazardous materials
(Vílchez et al., 2011).
QRA and ACA are related and dependent on each other because
risk identification is the first step of consequence analysis. The

http://dx.doi.org/10.1016/j.jngse.2015.04.029
1875-5100/© 2015 Elsevier B.V. All rights reserved.
 L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133
bow-tie model is an innovative approach and a good combination
of QRA and ACA and is thus widely used in safety analysis (Ferdous
et al., 2013) and risk management (Chevreau et al., 2006). However,
one of the limitations in the existing implementation of the bow-tie
model is a lack of quantitative conclusions; many researchers have
investigated the construction of bow-tie models but not their
quantification.
To achieve a quantitative conclusion from a bow-tie model, a
quantitative risk matrix that includes ranking probability criteria
and consequence severity criteria is proposed in this study to
quantify the probability and consequence of a given accident. The
purpose of this study is to develop a comprehensive approach to
identify the risk factors and evaluate the severity of the conse-
quences of an unexpected event. The procedure of the proposed
approach is presented in Section 2. This procedure includes four
steps: the construction of the bow-tie model, the fuzzy probability
calculation, the consequence analysis of an accident and a risk
matrix analysis. In Section 3, an application of the proposed
approach is presented for the risk analysis and consequence
assessment of an underwater pipeline. Section 4 then presents the
conclusions of the study.
2. Procedures
The procedure of the proposed risk evaluation method is shown
Fig. 1. Schematic diagram of building a bow-tie model.
125
in Fig. 1 and consists of a risk analysis and a consequence assess-
ment in terms of a building fault tree and an event tree, respec-
tively. In the risk analysis, a fuzzy method is applied to convert a
natural linguistic expression into a failure probability. In the
consequence assessment, an index system is introduced to further
assess the consequence in terms of environmental cost, personal
injury and economic loss. In the end, to reach a comprehensive
conclusion, the risk matrix method is applied to combine the re-
sults of the risk analysis and the consequence assessment.
2.1. Construction of a bow-tie model
A bow-tie model is widely applied in risk analyses, including
probability calculations (Khakzad et al., 2013), human error risk
analysis (Deacon et al., 2010, 2013), dynamic risk analysis (Khakzad
et al., 2012), etc. A bow-tie model is comprised of a fault tree, which
represents the risk factors of a failure, and an event tree, which
represents the consequences of a failure. Both the fault tree and the
event tree are effective graphical methods and are widely used in
safety analyses of complex systems; this makes a bow-tie model to
have significant potential in this field. Fig. 2 shows the basic
structure of a bow-tie model. X, E and T are the primary, interme-
diate and top events of the fault tree, respectively, and I and C stand
for the ignition (or safety barrier) and the accident consequence in
an event tree, respectively.
126 L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

In this study, the triangular fuzzy membership is used. The

membership functions and their corresponding figures of the five
different levels are shown in Eqs. (3)e(7) and Fig. 3. The subscripts
VL, L, M, H, and VH in Eqs. (3)e(7) and Fig. 3 represent the five
different levels of the linguistic expression, as described above.
8
>
> 1 0 < x  0:1
>
<
0:2  x
fVL ðxÞ ¼ 0:1 < x  0:2 (3)
> 0:1
>
>
:
0 otherwise

8
Fig. 2. Basic structure of a bow-tie model.
> x  0:1
>
> 0:1 < x  0:25
>
>
< 0:15
2.2. Calculation of a fuzzy probability fL ðxÞ ¼ 0:4  x (4)
>
> 0:25 < x  0:4
>
> 0:15
>
:
To evaluate the failure probability of the top event in a fault tree, 0 otherwise
the probabilities of the primary events must be known in advance.
Because it is difficult to obtain detailed statistical probability data of 8
> x  0:3
>
> 0:3 < x  0:5
primary events, a fuzzy method that consists of 3 steps is proposed >
>
< 0:2
as shown below:
fM ðxÞ ¼ 0:7  x (5)
>
> 0:5 < x  0:7
>
> 0:2
Step 1: Collect a natural linguistic expression of a risk factor >
:
status. 0 otherwise
Step 2: Convert the natural linguistic expression to a fuzzy
8
number. > x  0:6
>
> 0:6 < x  0:75
Step 3: Convert the fuzzy number to a failure probability. >
>
< 0:15
fH ðxÞ ¼ 0:9  x (6)
Further explanations of the above steps are described below. >
> 0:75 < x  0:9
>
> 0:15
In step 1, the likelihood of occurrence of a primary event is >
:
0 otherwise
described in a natural linguistic expression by experienced experts
from different fields (e.g., operation, maintenance, management, 8
installation and design). This likelihood of occurrence can be > x  0:8
>
> 0:8 < x  0:9
categorized into five levels: Very Low (VL), Low(L), Medium(M), < 0:1
fVH ðxÞ ¼ 0:9 < x  1 (7)
High(H) and Very High(VH). Considering the different opinions >
> 1
given by experts, a multi-expert scoring method is frequently rec- >
:
0 otherwise
ommended. The weights of the experts are defined based on their
capabilities, and their capabilities are often evaluated by an analytic The corresponding fuzzy numbers are defined as follows:
hierarchy process (AHP).
In step 2, a numerical approximation approach is proposed to fVL ¼ ½0; 0; 0:1; 0:2; fL ¼ ½0:1; 0:25; 0:4; fM ¼ ½0:3; 0:5; 0:7;
convert the linguistic expression to a corresponding fuzzy number fH ¼ ½0:6; 0:75; 0:9; fVH ¼ ½0:8; 0:9; 1; 1:
(Chen et al., 1992). Fuzzy numbers can be expressed by fuzzy
membership functions. Triangular and trapezoidal fuzzy member- In fuzzy environments, the basic operations of fuzzy numbers
ship functions are generally preferred in fuzzy theory. The trian- such as their addition, subtraction, multiplication and division are
gular fuzzy number is defined as A ¼ (a,b,c), and its membership generally implemented through l-cut. For the given l 2 [0,1], the
function is shown in Eq. (1). Similarly, the trapezoidal fuzzy number l-cut for the fuzzy numbers A and B can be described as:
is defined as A ¼ (a,b,c,d), and its membership function is shown in h i
Eq. (2): Al ¼ fx; x2R; fA  lg ¼ al1 ; bl1
8 h i
>
> 0 x>a Bl ¼ fx; x2R; fB  lg ¼ al2 ; bl2
>
>
>
> xa
>
<b  a a<x  b
f ðxÞ ¼ (1)
>
> cx
>
> b<x<c
>
> c b
>
:
0 x>c

8
>
> 0 x>a
>
>
>
> x  a
>
> a<x  b
>b  a
>
<
f ðxÞ ¼ 1 b<x<c (2)
>
>
>
> d  x
>
> c<x<d
>
> d  c
>
>
:
0 x>d Fig. 3. Membership functions.
 L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 127

Thus, the corresponding l-cuts of the fuzzy numbers are defined minimizing sets, respectively, and are defined as:
as: 
x 0x1
l fmax ðxÞ ¼ (12)
fVL ¼ ½0; 0:2  0:1l; fLl ¼ ½0:15l þ 0:1; 0:4  0:15l; 0 otherwise
l
fM ¼ ½0:2l þ 0:3; 0:7  0:2l; fHl ¼ ½0:15l þ 0:6; 0:9  0:15l; 
1x 0x1
l fmin ðxÞ ¼ (13)
fVH ¼ ½0:1l þ 0:8; 1 0 otherwise

The fuzzy possibility score can be converted to a failure proba-

The basic operations of fuzzy numbers can be expressed by their
bility by the empirical equation proposed by Onisawa (1988, 1990):
l-cut (Jin et al., 2003):
h i 8
< 1 FM s0
Að þ ÞB ¼ Al þ Bl ¼ al1 þ al2 ; bl1 þ bl2 F ¼ 10k (14)
:
h i 0 FM ¼ 0
Að  ÞB ¼ Al  Bl ¼ al1  al2 ; bl1  bl2
 1=3
1  FM
h i k¼  2:301 (15)
FM
Að  ÞB ¼ Al  Bl ¼ al1  al2 ; bl1  bl2
In this section, the natural linguistic expressions given by ex-
perts are expressed as fuzzy numbers. The operations of the fuzzy
al1  0; al2 0 numbers are expressed by the corresponding l-cuts operations.
h i This method transforms natural linguistic expressions into failure
Að÷ÞB ¼ Al ÷Bl ¼ al1 ÷bl2 ; bl1 ÷al2 probabilities.

2.3. Consequence analysis

al1  0; al2 > 0
Different experts often have different opinions of the same
primary event; thus, it is necessary to integrate their opinions into a
single opinion. There are many methods to aggregate fuzzy
numbers, such as the Max-min Delphi method proposed by
Ishikawa et al. (1993), the Arithmetic method proposed by Lin and
Wang (1997) and the Linear Opinion Pool proposed by Clemen and
Winkler (1999). The Linear Opinion Pool is recommended in this
study and is shown in Eq. (8):
X
n tion shutdown and are recorded in the relevant currency. Envi-
fi ¼ wej Aij ; i ¼ 1; 2; …; m; j ¼ 1; 2; …; n
j¼1
where fi is the integrated fuzzy number of event i, wej is the weight
of expert j, Aij is the fuzzy number for event i given by expert j, m is
the total number of events and n is the total number of experts.
In step 3, the method of converting the fuzzy number to a failure
probability consists of two parts: the conversion from the fuzzy
number to a fuzzy possibility score and the conversion from the
fuzzy possibility score to a failure probability. The preferred
method of transforming a fuzzy number to a fuzzy possibility score
is the maximizing set and minimizing set method proposed by
Chen (1985). A fuzzy possibility score is defined as:
FMR þ 1  FML
FM ¼
2 where C is the total loss of an accident, Pi is the probability of
where FMR and FML represent the right and left utility scores of the
fuzzy number, respectively; these values are defined as:
FMR ¼ sup½fM ðxÞ∧fmax ðxÞ
FML ¼ sup½fM ðxÞ∧fmin ðxÞ
The symbol sup in Eq. (10) describes the y-value of the co-
ordinates of the intersection point of fM with from the right side of
fmax. Similarly, in Eq. (11), sup describes the y-value of the co-
ordinates of the intersection point of fM with from the left side of
fmax.
fmax(x) and fmin(x) represent the fuzzy maximizing and
Generally, the consequence assessment system can be catego-
rized into personal casualties, economic losses and environmental
disruptions. Personal casualties are always applied to evaluate the
consequence caused by combustion, explosion or poisoning, and
refers to the potential damage to surrounding persons (not only
workers but also residents). Accidents can damage equipment,
cause a loss of materials, produce delays or suspend production.
Economic losses consist of maintenance costs, reinstallation
charges for damaged equipment and direct losses due to produc-
(8) ronmental disruptions consist of the amount of pollutants or the
expense applied to the removal of pollutants. Environmental dis-
ruptions also draw significant attention from the media and the
public, and the resulting damage to a company's reputation is
typically much more important than the resulting economic losses.
The basic factors that should be considered in a consequence
assessment are shown in Table 1 (Yongji, 2004).
If an accident may result in three probable consequences, the
total loss of the accident is calculated using Table 2 and Eq. (16)
(Yongji, 2004). The total loss of an accident is defined as:
X
3
C¼ ðPi Si þ Pi Ci þ Pi Ei Þ (16)
i¼1
(9)
consequence i, Si is the personal casualty loss of consequence i, Ci is
the economic loss of consequence i and Ei is the environmental
disruption loss of consequence i.
(10)
2.4. Risk matrix
(11)
The risk matrix used in this study can be categorized into two
categories: 2  2and 5  5. The 2  2 matrix is shown in Table 3, and
the 5  5 matrix is shown in Fig. 4. The failure probability can be
categorized into two levels in the 2  2 matrix: notable and
negligible. Similarly, the consequence can be categorized as either
acceptable or unacceptable. The risks are categorized into three
levels: high, medium and low. The failure probability and the
128 L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

Table 1
Factors to be considered in a consequence assessment.

Personal casualty Economic loss Environmental disruption

Assessment system of combustion and explosion

The factors leading to personal The factors leading to economic The factors leading to environmental
casualties may include combustion, losses may include maintenance costs disruption may include the leakage
direct shock wave, indirect of damaged equipment, of toxic gas and smoke.
shock wave, and indirect casualties. reinstallation charges of damaged equipment,
direct losses due to production shutdown,
and reputation losses.
Assessment of poisoning
The factors leading to personal casualties The factors leading to economic losses may The factors leading to environmental
may include leakage of toxic gas, include maintenance costs of damaged disruption may include the
leakage of suffocating gas, and equipment, direct losses due to production leakage of gas and other hydrocarbons.
impaction of pressurized fluid. shutdown, and reputation losses.

Table 2
Total loss calculation for an event tree.

No. P Sub index Contribution to the total loss

Personal casualty Economic loss Environmental disruption Personal casualty Economic loss Environmental disruption

1 P1 S1 C1 E1 P 1  S1 P1  C1 P1  E1
2 P2 S2 C2 E2 P 2  S2 P2  C2 P2  E2
3 P3 S3 C3 E3 P 3  S3 P3  C3 P3  E3

Table 3
2  2 risk matrix.

Level of failure probability Risk level and the corresponding measurement

Notable probability Medium risk High risk

P > 105 (Level 2, 3, 4, 5) Strengthened detection and Measurement that can reduce risk
monitoring are required to reduce risk. should be conducted immediately.
Negligible probability Low risk Medium risk
P < 105 (Level 1) Check if the evaluated factors have Consider the possibility of conversion
changed due to operational condition changes. from a low-probability event to a high-probability event.
Level of consequence Acceptable consequence Unacceptable consequence
(Very low) (Low, Medium, High, Extremely high)

associated consequence with the risk in the 5  5 matrix can be
categorized into 5 levels, as shown in Fig. 4. Level I is “very low
risk”, which indicates that no measurement should be taken; level
II is “low risk”, which indicates that the pipeline can be run regu-
larly with increased monitoring and maintenance; level III is
“medium risk”, which indicates that a detailed analysis and coun-
termeasures should be performed to reduce the risk of the situa-
tion; level IV is “high risk”, which indicates that a maintenance
project should be launched in the near future to avoid an accident;
level V is “very high risk”, which predicts on-going leakage and
indicates that a maintenance project must be implemented as soon
as possible.
The quantitative and qualitative ranking criteria and their cor-
responding regarding failure probabilities are shown in Table 4. In
Table 5, the ranking criteria of the consequences are expressed in
terms of economic loss (Hong et al., 2007).
3. Risk evaluation of an underwater pipeline

3.1. Bow-tie model application

3.1.1. Identification of risk factors

The risk factors of an underwater pipeline are different from
those of a buried pipeline. The object of interest in this section is the
natural gas transmission pipeline (Lines 1 and2) from Tianjin City,
China to Hebei province, China, which belongs to the China National
Petroleum Corporation (CNPC). Line 1 was built in 2003 with a
designed pressure of 10 MPa, a diameter of 711 mm and a length of
43.8 km. Line 2 was built in 2005 with a designed pressure of
10 MPa, a diameter of 711 mm and a length of 43.4 km. These two
pipelines were initially buried underground but are now submerged
in water due to a change in the path of a nearby river. Based on the
statistical data provided by the pipeline's management, the depth of
the water is 1.5 me6.0 m, and the total length of the submerged
section of the pipeline exceeds 25% of its total length in 2011. Fig. 5
Fig. 4. 5  5 risk matrix. shows the field condition of these pipelines before and after being
 L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 129

Table 4
Ranking criterion of failure probability.

Level Failure probability (per year) Explanation

Quantitative criterion Qualitative criterion

5 >102 Regarded as leakage Leakage may occur in a few samples

4 103~102 Extremely high risk of leakage Leakage may occur in significantly of samples
3 104~103 High risk of leakage Leakage beyond service time may occur in a few samples
2 105~104 Low risk of leakage Leakage beyond service time may occur in significantly of samples
1 <105 No leakage Nearly no leakage

Table 5
Ranking criterion of consequence severity. P1 ¼ 0.7 if m0 > 100 kg/s. For allocating the ignition probability, only
No. Amount of loss (thousand $) Level
the net flow rates to the atmosphere must be considered.

1 <1.6 Very low

2 1.6e16 Low 3.2. Failure probability
3 16e160 Medium
4 160e1600 High
To avoid the biased opinions of some experts, a multi-expert
5 >1600 Extremely high
scoring method and the AHP method are recommended and used
in this Section. The assessment index system for the experts' ca-
pabilities is shown in Fig. 8. A brief introduction of every expert
submerged. Because these pipelines were laid underground initially, used in this study is shown in Table 7.
no additional protection measurements, such as crossing the pipe- Using an AHP analysis to define expert weights:
line, were implemented. Water impaction typically leads to hang
risk, and hang may eventually yield rupture. Considering this special we ¼ ð0:2573; 0:1213; 0:2681; 0:3532Þ
situation and its complex underwater environment, a safety analysis
To integrate the different opinions of the experts into a
is required to avoid severe accidents.
comprehensive opinion, the Linear Opinion Pool method proposed
The undesirable event of gas release is selected as the top event
by Clemen and Winkler (1999), as shown in Eq. (8), is applied. The
in the fault tree analysis. Leakage in the pipelines can be caused by
primary event X3-1is discussed here as an example. The linguistic
two events: rupture and puncture. Considering the circumstance of
expressions given from the 4 experts are low, medium, medium
the underwater pipeline, the primary causes for these events
and very low, respectively. The integrated fuzzy number is thus
include interference from a third party, corrosion, incorrect oper-
described as follows:
ation, fatigue, an inherent defect, etc. All of the factors mentioned
above may lead to gas release; thus, they are considered to be in- f ðxÞ ¼ maxðwe1 $fL ðxÞ∧ðwe2 þ we3 Þ$fM ðxÞ∧we4 $fVL ðxÞÞ
termediate events in the fault tree. The root reasons for the top ¼ ½ð0:12l þ 0:14Þ; ð0:45  0:15lÞ
events are regarded as the primary events. The fault tree of the
underwater pipeline consists of 26 primary events, as shown in The corresponding membership function of the above fuzzy
Fig. 6. Further descriptions of the primary events are shown in number f(x) is defined as:
Table 6. 8 x  0:14
>
> 0:14 < x  0:26
>
> 0:12
>
>
3.1.2. Consequence of pipeline leakage >
< 1 0:26 < x  0:30
Natural gas is toxic and combustible, and may lead to a f ðxÞ ¼
poisoning accident or a combustion and explosion (i.e., deflagra- >
> 0:45  x
>
> 0:30 < x  0:45
>
> 0:15
tion) accident if preventive or protective measures are not taken to >
:
avoid or mitigate these accidents. Therefore, the final accidents in 0 otherwise
the event tree of the natural gas leakage are expressed as a
poisoning accident and a combustion and explosion accident, as Fig. 9 shows the fuzzy number and its associated membership
shown in Fig. 7. The probability of immediate ignition of flammable function.
gases depends on the release flow rate m0 (BEVI, 2009). In Fig. 7, Then, the left and right utility scores of the fuzzy number were
P1 ¼ 0.2 if m0 < 10 kg/s; P1 ¼ 0.5 if 10 kg/s < m0 < 100 kg/s; and calculated by using Eq. (10) and Eq. (11):

Fig. 5. Field conditions of the pipeline before being submerged and after being submerged.
130 L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

Fig. 6. Fault tree of the underwater pipeline.

 L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133 131

Table 6
Description of the primary events.

No. Description

X3-1 Risk of underwater pipeline interference due to ship anchor

X3-2 Risk of underwater pipeline interference due to sabotage
X3-3 Risk of underwater pipeline interference due to fishing
X3-4 Risk of underwater pipeline interference due to river dredging
X5-1 Risk of underwater pipeline failure due to incorrect operation
X5-2 Risk of underwater pipeline failure due to incorrect maintenance
X6-1 Risk of underwater pipeline fatigue due to fluctuation of internal pressure
X7-1 Risk of underwater pipeline corrosion due to corrosion medium
X9-1 Risk of underwater pipeline fatigue due to fluid impact
X10-1 Risk of underwater pipeline stress corrosion crack due to stress concentration
X10-2 Risk of underwater pipeline stress corrosion crack due to residual stress
X10-3 Risk of underwater pipeline stress corrosion crack due to large internal stress
X11-1 Risk of underwater pipeline corrosion fatigue due to pressure surge
X11-2 Risk of underwater pipeline corrosion fatigue due to an external load
X12-1 Risk of underwater pipeline fatigue due to failure of protection
X12-2 Risk of underwater pipeline fatigue due to hanging
X14-1 Inherent risk of underwater pipeline due to structure defect
X14-2 Inherent risk of underwater pipeline due to material defect
X15-1 Inherent risk of underwater pipeline due to poor installation
X15-2 Inherent risk of underwater pipeline due to a poor weld
X15-3 Inherent risk of underwater pipeline due to a poor groove
X15-4 Inherent risk of underwater pipeline due to mechanical damage
X17-1 Risk of underwater pipeline corrosion due to failure of inner protection
X18-1 Risk of underwater pipeline corrosion due to failure of cathode protection
X18-2 Risk of underwater pipeline corrosion due to failure of external corrosion
X18-3 Risk of underwater pipeline corrosion due to soil corrosion

FMR ¼ 0:3870; FML ¼ 0:7680

Given these left and right scores, the fuzzy possibility score of
the fuzzy number was calculated based on Eq. (9):

FM ¼ 0:3095
Finally, the fuzzy failure probability was calculated based on Eq.
(14) and Eq. (15):

Fig. 7. Event tree of pipeline leakage.

F ¼ 0:00098
The failure probability of the primary event X3-1 was deter-
mined to be 0.00098. The linguistic expressions of the other pri-
mary events from the experts are shown in Table 8; their
probabilities were also calculated and are also shown in Table 8.
If the probabilities of all of the primary events have been
determined, the failure probability of the top event can be calcu-
lated based on the quantitative analysis technique of the fault tree;

Fig. 8. Index system of AHP for expert capability.

Table 7
Introduction of the experts consulted in this case study.

No. Education background Job title Service time(years)

Expert 1 Junior college Professor 22

Expert 2 Bachelor Associate-professor 8
Expert 3 Doctor Professor 18
Expert 4 Bachelor Associate-professor 30
Fig. 9. Membership function of X3-1.
132 L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133
Table 8
Probabilities of primary events.
this result is 2.44  102. Based on the information in Table 4, the
risk level of these pipelines is Level 5, which implies that leakage is
likely occurring in these pipelines.
3.3. Consequence of leakage
To assess the consequence of the pipeline leakage, an evaluation
index system is recommended in Section 2.3. The historical acci-
dent record is also a good reference for this system. One puncture
accident occurred in 2011 due to a scratch during construction; the
corresponding primary event is X14-1 in the fault tree. This event
resulted in a leakage hole with a diameter of less than 1 mm. Due to
the small size of the leakage hole and the relatively quick detection,
this accident did not lead to a severe poisoning or combustion and
explosion event. However, the total loss of this accident exceeded
$48,000, including $16,000of maintenance costs and more tha-
n$32,000of environmental disputation costs. Experts from the
pipeline management reached an agreement that the total loss
should be set between $16,000 and $160,000, which corresponds
with Level Medium in Table 3.
4. Results
As discussed above, the failure probability of the event investi-
gated is Level 5, and its consequence level is medium. Therefore, it
can be concluded that the risk level is high based on the 2  2 risk
matrix, and level IV based on the 5  5 risk matrix. The result of the
safety evaluation is that the pipeline is a high risk, and thus, a
maintenance project should be implemented and completed as
soon as possible to avoid or mitigate a serious leakage accident
from occurring.
5. Conclusion
Risk evaluation plays a critical role in pipeline management.
Leakage from a natural gas pipeline may lead to a devastating ac-
cident and significant economic losses because natural gas diffuses
and combusts easily. Therefore, a comprehensive risk evaluation
method that helps to define and reduce the risk level of a pipeline is
necessary. Thus, this study establishes a comprehensive risk eval-
uation framework by combining a bow-tie model with a risk matrix
to define the risk level of a pipeline for pipeline management.
The bow-tie model is a quantitative model in this study that is
composed of an integrated quantitative methodology of risk anal-
ysis and a quantification consequence assessment system. The
quantitative methodology of risk analysis provides a quantification
of risk probabilities using a fuzzy method that converts natural
linguistic expressions into failure probabilities. The quantification
of the possible consequences is determined by an index system
with three different categories: personal casualties, economic los-
ses and environmental damage. A quantitative conclusion of the
bow-tie model is reached based on the above procedures; a risk
matrix that includes ranking probability and consequence severity
criteria is also proposed to define the risk level of system.
This study proposes a comprehensive risk evaluation framework
that can be applied in natural gas pipeline. A case study of a natural
gas underwater pipeline in CNPC is investigated in detail. The case
study showed that the combination of the bow-tie model and the
risk matrix creates an effective method for the comprehensive risk
evaluation. This method can help pipeline management compre-
hensively identify risk factors and to assess their consequences.
Through the proposed integrated safety analysis method, risks of
pipeline use can be reduced.
Acknowledgment
This study was supported by the National Science and Tech-
nology Major Project of China (Grant No. 2011ZX05055).
References
BEVI Reference Manual version 3.2. Bilthoven: RVIM.
Chen, S.J.J., Hwang, C.L., Beckmann, M.J., et al., 1992. Fuzzy Multiple Attribute De-
cision Making: Methods and Applications. Springer-Verlag New York, Inc.
Chen, Shanhuo, 1985. Ranking fuzzy numbers with maximizing set and minimizing
 L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133
set. Fuzzy Sets Syst. 17 (2), 113e129.
Chevreau, F.R., Wybo, J.L., Cauchois, D., 2006. Organizing learning processes on risks
by using the bow-tie representation. J. Hazard. Mater. 130 (3), 276e283.
Clemen, R.T., Winkler, R.L., 1999. Combining probability distributions from experts
in risk analysis. Risk Anal. 19 (2), 187e203.
Deacon, T., Amyotte, P.R., Khan, F.I., et al., 2013. A framework for human error
analysis of offshore evacuations. Saf. Sci. 51 (1), 319e327.
Deacon, T., Amyotte, P.R., Khan, F.I., 2010. Human error risk analysis in offshore
emergencies. Saf. Sci. 48 (6), 803e818.
Ferdous, R., Khan, F., Sadiq, R., et al., 2013. Analyzing system safety and risks under
uncertainty using a bow-tie diagram: an innovative approach. Process Saf.
Environ. Prot. 91 (1), 1e18.
Han, Z.Y., Weng, W.G., 2010. An integrated quantitative risk analysis method for
natural gas pipeline network. J. Loss Prev. Process Ind. 23 (3), 428e436.
Hong, Liu, Tang, Yuxia, Cheng, Yuhe, 2007. Study on the classification of dangerous
Hazard evaluation based on risk management method. China Saf. Sci. J. 17 (6),
145e150.
Ishikawa, A., Amagasa, M., Shiga, T., et al., 1993. The Max-Min Delphi method and
fuzzy Delphi method via fuzzy integration. Fuzzy Sets Syst. 55 (3), 241e253.
Jamshidi, A., Yazdani-Chamzini, A., Yakhchali, S.H., et al., 2013. Developing a new
fuzzy inference system for pipeline risk assessment. J. Loss Prev. Process Ind. 26
(1), 197e208.
Jin, Chaoguang, Lin, Yan, Ji, Zhuoshang, 2003. Application of event tree analysis
based on fuzzy sets in risk analysis. J. Dalian Univ. Technol. 43 (1), 97e100.
Jo, Young-Do, Ahn, Bum Jong, 2005. A method of quantitative risk assessment for
transmission pipeline carrying natural gas. J. Hazard. Mater. 123 (1), 1e12.
Khakzad, N., Khan, F., Amyotte, P., 2012. Dynamic risk analysis using bow-tie
approach. Reliab. Eng. Syst. Saf. 104, 36e44.
Khakzad, N., Khan, F., Amyotte, P., 2013. Quantitative risk analysis of offshore dril-
ling operations: a Bayesian approach. Saf. Sci. 57, 108e117.
133
Lin, C.T., Wang, M.J.J., 1997. Hybrid fault tree analysis using fuzzy sets. Reliab. Eng.
Syst. Saf. 58 (3), 205e213.
Lins, P.H.C., de Almeida, A.T., 2012. Multidimensional risk analysis of hydrogen
pipelines. Int. J. Hydrog. Energy 37 (18), 13545e13554.
Ma, L., Cheng, L., Li, M., 2013a. Quantitative risk analysis of urban natural gas
pipeline networks using geographical information systems. J. Loss Prev. Process
Ind. 26 (6), 1183e1192.
Ma, L., Li, Y., Liang, L., et al., 2013b. A novel method of quantitative risk assessment
based on grid difference of pipeline sections. Saf. Sci. 59, 219e226.
Muhlbauer, W.K., 2004. Pipeline Risk Management Manual: Ideas, Techniques and
Resources. Access Online. Elsevier.
Onisawa, T., 1990. An application of fuzzy concepts to modelling of reliability
analysis. Fuzzy Sets Syst. 37 (3), 267e286.
Onisawa, T., 1988. An approach to human reliability in man-machine systems using
error possibility. Fuzzy Sets Syst. 27 (2), 87e103.
Shahriar, A., Sadiq, R., Tesfamariam, S., 2012. Risk analysis for oil & gas pipelines: a
sustainability assessment approach using fuzzy based bow-tie analysis. J. Loss
Prev. Process Ind. 25 (3), 505e523.
Sklavounos, S., Rigas, F., 2006. Estimation of safety distances in the vicinity of fuel
gas pipelines. J. Loss Prev. Process Ind. 19 (1), 24e31.
Vílchez, J.A., Espejo, V., Casal, J., 2011. Generic event trees and probabilities for the
release of different types of hazardous materials. J. Loss Prev. Process Ind. 24 (3),
281e287.
Yongji, W., 2004. Quantitative risk assessment for failure of oil and gas pipelines.
Acta Pet. Sin. 25 (5), 108e112.
Yuhua, Dong, Datao, Yu, 2005. Estimation of failure probability of oil and gas
transmission pipelines by fuzzy fault tree analysis. J. Loss Prev. Process Ind. 18
(2), 83e88.
Zamalieva, D., Yilmaz, A., Aldemir, T., 2013. A probabilistic model for online scenario
labeling in dynamic event tree generation. Reliab. Eng. Syst. Saf. 120, 18e26.