Journal of Natural Gas Science and Engineering 25 (2015) 124e133

Contents lists available at ScienceDirect

Journal of Natural Gas Science and Engineering

journal homepage: www.elsevier.com/locate/jngse

A comprehensive risk evaluation method for natural gas pipelines by

combining a risk matrix with a bow-tie model
Linlin Lu a, Wei Liang a, *, Laibin Zhang a, Hong Zhang a, Zhong Lu b, Jinzhi Shan b
a
b

College of Mechanical and Transportation Engineering, China University of Petroleum, Beijing, 102249, China
Petrol China Beijing Gas Pipeline Co. Ltd., Beijing, China

a r t i c l e i n f o

a b s t r a c t

Article history:
Received 8 January 2015
Received in revised form
20 April 2015
Accepted 21 April 2015
Available online 15 May 2015

Leakage from natural gas pipelines causes severe economic loss and signicantly affects social security
considering the gas' combustibility and the difculties in detecting leakage. This study proposes a
comprehensive risk evaluation method by combining a risk matrix with a bow-tie model. First, a bow-tie
model is built, considering the risk factors that may lead to an accident using a fault tree; the consequences of unwanted events are then described in an event tree. Second, a fuzzy method is used to
calculate the failure probabilities. Third, the severity of an accident is evaluated through an index system
that includes personal casualties, economic losses and environmental disruptions. Finally, a risk matrix
consisting of a probability ranking criterion and a consequence ranking criterion is proposed to reach an
integrated quantitative conclusion of a bow-tie model. A case study of an underwater pipeline carrying
natural gas has been investigated to validate the utility of the proposed method.
2015 Elsevier B.V. All rights reserved.

Keywords:
Bow-tie model
Risk matrix
Fuzzy method
Natural gas pipeline

1. Introduction
Leakage from natural gas pipelines can cause devastating accidents due to the ammability of the gas, which is transported at
high pressures. In recent years, accidents in natural gas pipelines
have occurred too often and have drawn signicant public attention. Thus, the implementation of safety measures followed by a
comprehensive risk evaluation is critical to maintain a level of risk
below the acceptable criteria. The risk evaluation of pipelines
currently includes a quantitative risk analysis (QRA) and an accident consequence analysis (ACA).
In a QRA, Muhlbauer (2004) proposed an integrated and
continuously improving risk evaluation framework for pipelines
that has become the guideline for pipeline risk assessment. The
purpose of this framework is to evaluate a pipeline's risk exposure
to the public and to identify ways to effectively manage that risk.
Ma et al. (2013a) used geographical information systems (GIS) to
calculate the quantitative risk of urban natural gas pipeline networks. The proposed QRA process incorporated an assessment of
the failure rates of integrated pipeline networks, a quantitative
analysis model of accident consequences, and assessments of individual and societal risks. Jo and Ahn (2005) also used GIS to assess
the quantitative risk of natural gas pipelines. Han and Weng (2010)
* Corresponding author.
E-mail addresses: lulinlin1211@163.com, lw@cup.edu.cn (W. Liang).
http://dx.doi.org/10.1016/j.jngse.2015.04.029
1875-5100/ 2015 Elsevier B.V. All rights reserved.

proposed a quantitative assessment index system that included a

causation index, an inherent index, a consequence index and their
corresponding weights for urban natural gas pipelines. The failure
probability calculation is an important part of a QRA. Yuhua and
Datao (2005) used a fuzzy fault tree to investigate the risk factors
and calculate the failure probabilities of natural gas pipelines.
Shahriar et al. (2012) applied a fuzzy approach to calculate the fuzzy
probabilities (i.e., likelihood) of a basic event in a fault tree for oil
and gas pipelines. There are also other relevant works in the literature, such as that of Ma et al. (2013b) and Jamshidi et al. (2013),
that investigate the QRAs of pipelines.
In an ACA, an event tree has been shown to be an efcient tool.
As the rst step in the multidimensional risk analysis of a hydrogen
pipeline, Lins and de Almeida (2012) built an event tree that
included all possible accident scenarios including punctures and
ruptures of the pipeline. To calculate the safety distances around a
pipeline transporting liqueed gas and pressurized natural gas,
Sklavounos and Rigas (2006) used an event tree analysis as a formal
technique to determine the possible outcomes of an accidental fuel
gas release. Event tree analysis is also widely used to identify
dangerous scenarios with regard to hydrogen pipelines (Lins and de
Almeida, 2012), dynamic analyses for transient systems (Zamalieva
et al., 2013) and accident analyses of different hazardous materials
(Vlchez et al., 2011).
QRA and ACA are related and dependent on each other because
risk identication is the rst step of consequence analysis. The

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

bow-tie model is an innovative approach and a good combination

of QRA and ACA and is thus widely used in safety analysis (Ferdous
et al., 2013) and risk management (Chevreau et al., 2006). However,
one of the limitations in the existing implementation of the bow-tie
model is a lack of quantitative conclusions; many researchers have
investigated the construction of bow-tie models but not their
quantication.
To achieve a quantitative conclusion from a bow-tie model, a
quantitative risk matrix that includes ranking probability criteria
and consequence severity criteria is proposed in this study to
quantify the probability and consequence of a given accident. The
purpose of this study is to develop a comprehensive approach to
identify the risk factors and evaluate the severity of the consequences of an unexpected event. The procedure of the proposed
approach is presented in Section 2. This procedure includes four
steps: the construction of the bow-tie model, the fuzzy probability
calculation, the consequence analysis of an accident and a risk
matrix analysis. In Section 3, an application of the proposed
approach is presented for the risk analysis and consequence
assessment of an underwater pipeline. Section 4 then presents the
conclusions of the study.
2. Procedures
The procedure of the proposed risk evaluation method is shown

125

in Fig. 1 and consists of a risk analysis and a consequence assessment in terms of a building fault tree and an event tree, respectively. In the risk analysis, a fuzzy method is applied to convert a
natural linguistic expression into a failure probability. In the
consequence assessment, an index system is introduced to further
assess the consequence in terms of environmental cost, personal
injury and economic loss. In the end, to reach a comprehensive
conclusion, the risk matrix method is applied to combine the results of the risk analysis and the consequence assessment.
2.1. Construction of a bow-tie model
A bow-tie model is widely applied in risk analyses, including
probability calculations (Khakzad et al., 2013), human error risk
analysis (Deacon et al., 2010, 2013), dynamic risk analysis (Khakzad
et al., 2012), etc. A bow-tie model is comprised of a fault tree, which
represents the risk factors of a failure, and an event tree, which
represents the consequences of a failure. Both the fault tree and the
event tree are effective graphical methods and are widely used in
safety analyses of complex systems; this makes a bow-tie model to
have signicant potential in this eld. Fig. 2 shows the basic
structure of a bow-tie model. X, E and T are the primary, intermediate and top events of the fault tree, respectively, and I and C stand
for the ignition (or safety barrier) and the accident consequence in
an event tree, respectively.

Fig. 1. Schematic diagram of building a bow-tie model.

126

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

In this study, the triangular fuzzy membership is used. The

membership functions and their corresponding gures of the ve
different levels are shown in Eqs. (3)e(7) and Fig. 3. The subscripts
VL, L, M, H, and VH in Eqs. (3)e(7) and Fig. 3 represent the ve
different levels of the linguistic expression, as described above.

8
1
>
>
>
<
0:2  x
fVL x
> 0:1
>
>
:
0
Fig. 2. Basic structure of a bow-tie model.

2.2. Calculation of a fuzzy probability

To evaluate the failure probability of the top event in a fault tree,
the probabilities of the primary events must be known in advance.
Because it is difcult to obtain detailed statistical probability data of
primary events, a fuzzy method that consists of 3 steps is proposed
as shown below:
Step 1: Collect a natural linguistic expression of a risk factor
status.
Step 2: Convert the natural linguistic expression to a fuzzy
number.
Step 3: Convert the fuzzy number to a failure probability.
Further explanations of the above steps are described below.
In step 1, the likelihood of occurrence of a primary event is
described in a natural linguistic expression by experienced experts
from different elds (e.g., operation, maintenance, management,
installation and design). This likelihood of occurrence can be
categorized into ve levels: Very Low (VL), Low(L), Medium(M),
High(H) and Very High(VH). Considering the different opinions
given by experts, a multi-expert scoring method is frequently recommended. The weights of the experts are dened based on their
capabilities, and their capabilities are often evaluated by an analytic
hierarchy process (AHP).
In step 2, a numerical approximation approach is proposed to
convert the linguistic expression to a corresponding fuzzy number
(Chen et al., 1992). Fuzzy numbers can be expressed by fuzzy
membership functions. Triangular and trapezoidal fuzzy membership functions are generally preferred in fuzzy theory. The triangular fuzzy number is dened as A (a,b,c), and its membership
function is shown in Eq. (1). Similarly, the trapezoidal fuzzy number
is dened as A (a,b,c,d), and its membership function is shown in
Eq. (2):

f x

8
0
>
>
>
>
xa
>
>
>
<b  a
cx
>
>
>
>
>
c
b
>
>
:
0

8
0
>
>
>
>
x

a
>
>
>
>
>b  a
>
<
1
f x
>
>
>
d

x
>
>
>
>
>
d

c
>
>
:
0

8
x  0:1
>
>
>
>
>
< 0:15
fL x 0:4  x
>
>
>
0:15
>
>
:
0
8
x  0:3
>
>
>
>
>
< 0:2
fM x 0:7  x
>
>
>
0:2
>
>
:
0
8
x  0:6
>
>
>
>
>
< 0:15
fH x 0:9  x
>
>
>
0:15
>
>
:
0

fVH x

8
x  0:8
>
>
>
< 0:1
>
>
>
:

0 < x  0:1
0:1 < x  0:2
otherwise
0:1 < x  0:25
0:25 < x  0:4

0:3 < x  0:5

0:5 < x  0:7

0:6 < x  0:75

0:75 < x  0:9

(6)

otherwise
0:8 < x  0:9

0:9 < x  1

otherwise

(7)

The corresponding fuzzy numbers are dened as follows:

fVL 0; 0; 0:1; 0:2; fL 0:1; 0:25; 0:4; fM 0:3; 0:5; 0:7;

fH 0:6; 0:75; 0:9; fVH 0:8; 0:9; 1; 1:
In fuzzy environments, the basic operations of fuzzy numbers
such as their addition, subtraction, multiplication and division are
generally implemented through l-cut. For the given l 2 [0,1], the
l-cut for the fuzzy numbers A and B can be described as:

i
h
Al fx; x2R; fA  lg al1 ; bl1

(1)
b<x<c
x>c
x>a
a<x  b
(2)

c<x<d
x>d

(5)

otherwise

a<x  b

b<x<c

(4)

otherwise

i
h
Bl fx; x2R; fB  lg al2 ; bl2

x>a

(3)

Fig. 3. Membership functions.

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

Thus, the corresponding l-cuts of the fuzzy numbers are dened

minimizing sets, respectively, and are dened as:

as:
l
fVL


0; 0:2  0:1l;

fLl

fmax x

0:15l 0:1; 0:4  0:15l;

l
0:2l 0:3; 0:7  0:2l; fHl 0:15l 0:6; 0:9  0:15l;
fM
l
0:1l 0:8; 1
fVH

The basic operations of fuzzy numbers can be expressed by their

l-cut (Jin et al., 2003):

i
h
A B Al Bl al1 al2 ; bl1 bl2
i
h
A  B Al  Bl al1  al2 ; bl1  bl2

al1

 0;

al2


fmin x

x
0

0x1
otherwise

1x
0

0x1
otherwise

(12)

(13)

The fuzzy possibility score can be converted to a failure probability by the empirical equation proposed by Onisawa (1988, 1990):

8
< 1
F 10k
:
0

k

i
h
A  B Al  Bl al1  al2 ; bl1  bl2

127

1  FM
FM

FM s0

(14)

FM 0
1=3
 2:301

(15)

In this section, the natural linguistic expressions given by experts are expressed as fuzzy numbers. The operations of the fuzzy
numbers are expressed by the corresponding l-cuts operations.
This method transforms natural linguistic expressions into failure
probabilities.

0

i
h
AB Al Bl al1 bl2 ; bl1 al2
al1  0; al2 > 0

2.3. Consequence analysis

Different experts often have different opinions of the same

primary event; thus, it is necessary to integrate their opinions into a
single opinion. There are many methods to aggregate fuzzy
numbers, such as the Max-min Delphi method proposed by
Ishikawa et al. (1993), the Arithmetic method proposed by Lin and
Wang (1997) and the Linear Opinion Pool proposed by Clemen and
Winkler (1999). The Linear Opinion Pool is recommended in this
study and is shown in Eq. (8):

Generally, the consequence assessment system can be categorized into personal casualties, economic losses and environmental
disruptions. Personal casualties are always applied to evaluate the
consequence caused by combustion, explosion or poisoning, and
refers to the potential damage to surrounding persons (not only
workers but also residents). Accidents can damage equipment,
cause a loss of materials, produce delays or suspend production.
Economic losses consist of maintenance costs, reinstallation
charges for damaged equipment and direct losses due to production shutdown and are recorded in the relevant currency. Environmental disruptions consist of the amount of pollutants or the
expense applied to the removal of pollutants. Environmental disruptions also draw signicant attention from the media and the
public, and the resulting damage to a company's reputation is
typically much more important than the resulting economic losses.
The basic factors that should be considered in a consequence
assessment are shown in Table 1 (Yongji, 2004).
If an accident may result in three probable consequences, the
total loss of the accident is calculated using Table 2 and Eq. (16)
(Yongji, 2004). The total loss of an accident is dened as:

fi

n
X

wej Aij ;

i 1; 2; ; m; j 1; 2; ; n

(8)

j1

where fi is the integrated fuzzy number of event i, wej is the weight

of expert j, Aij is the fuzzy number for event i given by expert j, m is
the total number of events and n is the total number of experts.
In step 3, the method of converting the fuzzy number to a failure
probability consists of two parts: the conversion from the fuzzy
number to a fuzzy possibility score and the conversion from the
fuzzy possibility score to a failure probability. The preferred
method of transforming a fuzzy number to a fuzzy possibility score
is the maximizing set and minimizing set method proposed by
Chen (1985). A fuzzy possibility score is dened as:

FM

FMR 1  FML
2

3
X
Pi Si Pi Ci Pi Ei

(16)

i1

(9)

where FMR and FML represent the right and left utility scores of the
fuzzy number, respectively; these values are dened as:

FMR supfM xfmax x

(10)

FML supfM xfmin x

(11)

where C is the total loss of an accident, Pi is the probability of

consequence i, Si is the personal casualty loss of consequence i, Ci is
the economic loss of consequence i and Ei is the environmental
disruption loss of consequence i.
2.4. Risk matrix

The symbol sup in Eq. (10) describes the y-value of the coordinates of the intersection point of fM with from the right side of
fmax. Similarly, in Eq. (11), sup describes the y-value of the coordinates of the intersection point of fM with from the left side of
fmax.
fmax(x) and fmin(x) represent the fuzzy maximizing and

The risk matrix used in this study can be categorized into two
categories: 2  2and 5  5. The 2  2 matrix is shown in Table 3, and
the 5  5 matrix is shown in Fig. 4. The failure probability can be
categorized into two levels in the 2  2 matrix: notable and
negligible. Similarly, the consequence can be categorized as either
acceptable or unacceptable. The risks are categorized into three
levels: high, medium and low. The failure probability and the

128

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

Table 1
Factors to be considered in a consequence assessment.
Personal casualty
Assessment system of combustion and explosion
The factors leading to personal
casualties may include combustion,
direct shock wave, indirect
shock wave, and indirect casualties.

Assessment of poisoning
The factors leading to personal casualties
may include leakage of toxic gas,
leakage of suffocating gas, and
impaction of pressurized uid.

Economic loss

Environmental disruption

The factors leading to economic

losses may include maintenance costs
of damaged equipment,
reinstallation charges of damaged equipment,
direct losses due to production shutdown,
and reputation losses.

The factors leading to environmental

disruption may include the leakage
of toxic gas and smoke.

The factors leading to economic losses may

include maintenance costs of damaged
equipment, direct losses due to production
shutdown, and reputation losses.

The factors leading to environmental

disruption may include the
leakage of gas and other hydrocarbons.

Table 2
Total loss calculation for an event tree.
No.

1
2
3

P1
P2
P3

Sub index

Contribution to the total loss

Personal casualty

Economic loss

Environmental disruption

Personal casualty

Economic loss

Environmental disruption

S1
S2
S3

C1
C2
C3

E1
E2
E3

P 1  S1
P 2  S2
P 3  S3

P1  C1
P2  C2
P3  C3

P1  E1
P2  E2
P3  E3

Table 3
2  2 risk matrix.
Level of failure probability

Risk level and the corresponding measurement

Notable probability
P > 105 (Level 2, 3, 4, 5)

Medium risk
Strengthened detection and
monitoring are required to reduce risk.
Low risk
Check if the evaluated factors have
changed due to operational condition changes.
Acceptable consequence
(Very low)

Negligible probability
P < 105 (Level 1)
Level of consequence

associated consequence with the risk in the 5  5 matrix can be

categorized into 5 levels, as shown in Fig. 4. Level I is very low
risk, which indicates that no measurement should be taken; level
II is low risk, which indicates that the pipeline can be run regularly with increased monitoring and maintenance; level III is
medium risk, which indicates that a detailed analysis and countermeasures should be performed to reduce the risk of the situation; level IV is high risk, which indicates that a maintenance
project should be launched in the near future to avoid an accident;

High risk
Measurement that can reduce risk
should be conducted immediately.
Medium risk
Consider the possibility of conversion
from a low-probability event to a high-probability event.
Unacceptable consequence
(Low, Medium, High, Extremely high)

level V is very high risk, which predicts on-going leakage and

indicates that a maintenance project must be implemented as soon
as possible.
The quantitative and qualitative ranking criteria and their corresponding regarding failure probabilities are shown in Table 4. In
Table 5, the ranking criteria of the consequences are expressed in
terms of economic loss (Hong et al., 2007).

3. Risk evaluation of an underwater pipeline

3.1. Bow-tie model application

Fig. 4. 5  5 risk matrix.

3.1.1. Identication of risk factors

The risk factors of an underwater pipeline are different from
those of a buried pipeline. The object of interest in this section is the
natural gas transmission pipeline (Lines 1 and2) from Tianjin City,
China to Hebei province, China, which belongs to the China National
Petroleum Corporation (CNPC). Line 1 was built in 2003 with a
designed pressure of 10 MPa, a diameter of 711 mm and a length of
43.8 km. Line 2 was built in 2005 with a designed pressure of
10 MPa, a diameter of 711 mm and a length of 43.4 km. These two
pipelines were initially buried underground but are now submerged
in water due to a change in the path of a nearby river. Based on the
statistical data provided by the pipeline's management, the depth of
the water is 1.5 me6.0 m, and the total length of the submerged
section of the pipeline exceeds 25% of its total length in 2011. Fig. 5
shows the eld condition of these pipelines before and after being

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

129

Table 4
Ranking criterion of failure probability.
Level

5
4
3
2
1

Failure probability (per year)

Explanation

Quantitative criterion

Qualitative criterion

>102
103~102
104~103
105~104
<105

Regarded as leakage
Extremely high risk of leakage
High risk of leakage
Low risk of leakage
No leakage

Table 5
Ranking criterion of consequence severity.
No.

Amount of loss (thousand $)

Level

1
2
3
4
5

<1.6
1.6e16
16e160
160e1600
>1600

Very low
Low
Medium
High
Extremely high

submerged. Because these pipelines were laid underground initially,

no additional protection measurements, such as crossing the pipeline, were implemented. Water impaction typically leads to hang
risk, and hang may eventually yield rupture. Considering this special
situation and its complex underwater environment, a safety analysis
is required to avoid severe accidents.
The undesirable event of gas release is selected as the top event
in the fault tree analysis. Leakage in the pipelines can be caused by
two events: rupture and puncture. Considering the circumstance of
the underwater pipeline, the primary causes for these events
include interference from a third party, corrosion, incorrect operation, fatigue, an inherent defect, etc. All of the factors mentioned
above may lead to gas release; thus, they are considered to be intermediate events in the fault tree. The root reasons for the top
events are regarded as the primary events. The fault tree of the
underwater pipeline consists of 26 primary events, as shown in
Fig. 6. Further descriptions of the primary events are shown in
Table 6.
3.1.2. Consequence of pipeline leakage
Natural gas is toxic and combustible, and may lead to a
poisoning accident or a combustion and explosion (i.e., deagration) accident if preventive or protective measures are not taken to
avoid or mitigate these accidents. Therefore, the nal accidents in
the event tree of the natural gas leakage are expressed as a
poisoning accident and a combustion and explosion accident, as
shown in Fig. 7. The probability of immediate ignition of ammable
gases depends on the release ow rate m0 (BEVI, 2009). In Fig. 7,
P1 0.2 if m0 < 10 kg/s; P1 0.5 if 10 kg/s < m0 < 100 kg/s; and

Leakage may occur in a few samples

Leakage may occur in signicantly of samples
Leakage beyond service time may occur in a few samples
Leakage beyond service time may occur in signicantly of samples
Nearly no leakage

P1 0.7 if m0 > 100 kg/s. For allocating the ignition probability, only
the net ow rates to the atmosphere must be considered.
3.2. Failure probability
To avoid the biased opinions of some experts, a multi-expert
scoring method and the AHP method are recommended and used
in this Section. The assessment index system for the experts' capabilities is shown in Fig. 8. A brief introduction of every expert
used in this study is shown in Table 7.
Using an AHP analysis to dene expert weights:

we 0:2573; 0:1213; 0:2681; 0:3532

To integrate the different opinions of the experts into a
comprehensive opinion, the Linear Opinion Pool method proposed
by Clemen and Winkler (1999), as shown in Eq. (8), is applied. The
primary event X3-1is discussed here as an example. The linguistic
expressions given from the 4 experts are low, medium, medium
and very low, respectively. The integrated fuzzy number is thus
described as follows:

f x maxwe1 $fL xwe2 we3 $fM xwe4 $fVL x

0:12l 0:14; 0:45  0:15l
The corresponding membership function of the above fuzzy
number f(x) is dened as:

f x

8 x  0:14
>
>
>
> 0:12
>
>
>
<
1
>
0:45  x
>
>
>
>
> 0:15
>
:
0

0:14 < x  0:26

0:26 < x  0:30
0:30 < x  0:45
otherwise

Fig. 9 shows the fuzzy number and its associated membership

function.
Then, the left and right utility scores of the fuzzy number were
calculated by using Eq. (10) and Eq. (11):

Fig. 5. Field conditions of the pipeline before being submerged and after being submerged.

130

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

Fig. 6. Fault tree of the underwater pipeline.

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

131

Table 6
Description of the primary events.
No.

Description

X3-1
X3-2
X3-3
X3-4
X5-1
X5-2
X6-1
X7-1
X9-1
X10-1
X10-2
X10-3
X11-1
X11-2
X12-1
X12-2
X14-1
X14-2
X15-1
X15-2
X15-3
X15-4
X17-1
X18-1
X18-2
X18-3

Risk of underwater pipeline

Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Inherent risk of underwater
Inherent risk of underwater
Inherent risk of underwater
Inherent risk of underwater
Inherent risk of underwater
Inherent risk of underwater
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline
Risk of underwater pipeline

interference due to ship anchor

interference due to sabotage
interference due to shing
interference due to river dredging
failure due to incorrect operation
failure due to incorrect maintenance
fatigue due to uctuation of internal pressure
corrosion due to corrosion medium
fatigue due to uid impact
stress corrosion crack due to stress concentration
stress corrosion crack due to residual stress
stress corrosion crack due to large internal stress
corrosion fatigue due to pressure surge
corrosion fatigue due to an external load
fatigue due to failure of protection
fatigue due to hanging
pipeline due to structure defect
pipeline due to material defect
pipeline due to poor installation
pipeline due to a poor weld
pipeline due to a poor groove
pipeline due to mechanical damage
corrosion due to failure of inner protection
corrosion due to failure of cathode protection
corrosion due to failure of external corrosion
corrosion due to soil corrosion

FMR 0:3870; FML 0:7680

Given these left and right scores, the fuzzy possibility score of
the fuzzy number was calculated based on Eq. (9):

FM 0:3095
Finally, the fuzzy failure probability was calculated based on Eq.
(14) and Eq. (15):

F 0:00098

Fig. 7. Event tree of pipeline leakage.

The failure probability of the primary event X3-1 was determined to be 0.00098. The linguistic expressions of the other primary events from the experts are shown in Table 8; their
probabilities were also calculated and are also shown in Table 8.
If the probabilities of all of the primary events have been
determined, the failure probability of the top event can be calculated based on the quantitative analysis technique of the fault tree;

Fig. 8. Index system of AHP for expert capability.

Table 7
Introduction of the experts consulted in this case study.
No.
Expert
Expert
Expert
Expert

1
2
3
4

Education background

Job title

Service time(years)

Junior college
Bachelor
Doctor
Bachelor

Professor
Associate-professor
Professor
Associate-professor

22
8
18
30

Fig. 9. Membership function of X3-1.

132

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

Table 8
Probabilities of primary events.

this result is 2.44  102. Based on the information in Table 4, the

risk level of these pipelines is Level 5, which implies that leakage is
likely occurring in these pipelines.
3.3. Consequence of leakage
To assess the consequence of the pipeline leakage, an evaluation
index system is recommended in Section 2.3. The historical accident record is also a good reference for this system. One puncture
accident occurred in 2011 due to a scratch during construction; the
corresponding primary event is X14-1 in the fault tree. This event
resulted in a leakage hole with a diameter of less than 1 mm. Due to
the small size of the leakage hole and the relatively quick detection,
this accident did not lead to a severe poisoning or combustion and
explosion event. However, the total loss of this accident exceeded
$48,000, including $16,000of maintenance costs and more than$32,000of environmental disputation costs. Experts from the
pipeline management reached an agreement that the total loss
should be set between $16,000 and $160,000, which corresponds
with Level Medium in Table 3.
4. Results
As discussed above, the failure probability of the event investigated is Level 5, and its consequence level is medium. Therefore, it
can be concluded that the risk level is high based on the 2  2 risk
matrix, and level IV based on the 5  5 risk matrix. The result of the
safety evaluation is that the pipeline is a high risk, and thus, a
maintenance project should be implemented and completed as
soon as possible to avoid or mitigate a serious leakage accident
from occurring.

and combusts easily. Therefore, a comprehensive risk evaluation

method that helps to dene and reduce the risk level of a pipeline is
necessary. Thus, this study establishes a comprehensive risk evaluation framework by combining a bow-tie model with a risk matrix
to dene the risk level of a pipeline for pipeline management.
The bow-tie model is a quantitative model in this study that is
composed of an integrated quantitative methodology of risk analysis and a quantication consequence assessment system. The
quantitative methodology of risk analysis provides a quantication
of risk probabilities using a fuzzy method that converts natural
linguistic expressions into failure probabilities. The quantication
of the possible consequences is determined by an index system
with three different categories: personal casualties, economic losses and environmental damage. A quantitative conclusion of the
bow-tie model is reached based on the above procedures; a risk
matrix that includes ranking probability and consequence severity
criteria is also proposed to dene the risk level of system.
This study proposes a comprehensive risk evaluation framework
that can be applied in natural gas pipeline. A case study of a natural
gas underwater pipeline in CNPC is investigated in detail. The case
study showed that the combination of the bow-tie model and the
risk matrix creates an effective method for the comprehensive risk
evaluation. This method can help pipeline management comprehensively identify risk factors and to assess their consequences.
Through the proposed integrated safety analysis method, risks of
pipeline use can be reduced.
Acknowledgment
This study was supported by the National Science and Technology Major Project of China (Grant No. 2011ZX05055).

5. Conclusion

References

Risk evaluation plays a critical role in pipeline management.

Leakage from a natural gas pipeline may lead to a devastating accident and signicant economic losses because natural gas diffuses

BEVI Reference Manual version 3.2. Bilthoven: RVIM.

Chen, S.J.J., Hwang, C.L., Beckmann, M.J., et al., 1992. Fuzzy Multiple Attribute Decision Making: Methods and Applications. Springer-Verlag New York, Inc.
Chen, Shanhuo, 1985. Ranking fuzzy numbers with maximizing set and minimizing

L. Lu et al. / Journal of Natural Gas Science and Engineering 25 (2015) 124e133

set. Fuzzy Sets Syst. 17 (2), 113e129.
Chevreau, F.R., Wybo, J.L., Cauchois, D., 2006. Organizing learning processes on risks
by using the bow-tie representation. J. Hazard. Mater. 130 (3), 276e283.
Clemen, R.T., Winkler, R.L., 1999. Combining probability distributions from experts
in risk analysis. Risk Anal. 19 (2), 187e203.
Deacon, T., Amyotte, P.R., Khan, F.I., et al., 2013. A framework for human error
analysis of offshore evacuations. Saf. Sci. 51 (1), 319e327.
Deacon, T., Amyotte, P.R., Khan, F.I., 2010. Human error risk analysis in offshore
emergencies. Saf. Sci. 48 (6), 803e818.
Ferdous, R., Khan, F., Sadiq, R., et al., 2013. Analyzing system safety and risks under
uncertainty using a bow-tie diagram: an innovative approach. Process Saf.
Environ. Prot. 91 (1), 1e18.
Han, Z.Y., Weng, W.G., 2010. An integrated quantitative risk analysis method for
natural gas pipeline network. J. Loss Prev. Process Ind. 23 (3), 428e436.
Hong, Liu, Tang, Yuxia, Cheng, Yuhe, 2007. Study on the classication of dangerous
Hazard evaluation based on risk management method. China Saf. Sci. J. 17 (6),
145e150.
Ishikawa, A., Amagasa, M., Shiga, T., et al., 1993. The Max-Min Delphi method and
fuzzy Delphi method via fuzzy integration. Fuzzy Sets Syst. 55 (3), 241e253.
Jamshidi, A., Yazdani-Chamzini, A., Yakhchali, S.H., et al., 2013. Developing a new
fuzzy inference system for pipeline risk assessment. J. Loss Prev. Process Ind. 26
(1), 197e208.
Jin, Chaoguang, Lin, Yan, Ji, Zhuoshang, 2003. Application of event tree analysis
based on fuzzy sets in risk analysis. J. Dalian Univ. Technol. 43 (1), 97e100.
Jo, Young-Do, Ahn, Bum Jong, 2005. A method of quantitative risk assessment for
transmission pipeline carrying natural gas. J. Hazard. Mater. 123 (1), 1e12.
Khakzad, N., Khan, F., Amyotte, P., 2012. Dynamic risk analysis using bow-tie
approach. Reliab. Eng. Syst. Saf. 104, 36e44.
Khakzad, N., Khan, F., Amyotte, P., 2013. Quantitative risk analysis of offshore drilling operations: a Bayesian approach. Saf. Sci. 57, 108e117.

133

Lin, C.T., Wang, M.J.J., 1997. Hybrid fault tree analysis using fuzzy sets. Reliab. Eng.
Syst. Saf. 58 (3), 205e213.
Lins, P.H.C., de Almeida, A.T., 2012. Multidimensional risk analysis of hydrogen
pipelines. Int. J. Hydrog. Energy 37 (18), 13545e13554.
Ma, L., Cheng, L., Li, M., 2013a. Quantitative risk analysis of urban natural gas
pipeline networks using geographical information systems. J. Loss Prev. Process
Ind. 26 (6), 1183e1192.
Ma, L., Li, Y., Liang, L., et al., 2013b. A novel method of quantitative risk assessment
based on grid difference of pipeline sections. Saf. Sci. 59, 219e226.
Muhlbauer, W.K., 2004. Pipeline Risk Management Manual: Ideas, Techniques and
Resources. Access Online. Elsevier.
Onisawa, T., 1990. An application of fuzzy concepts to modelling of reliability
analysis. Fuzzy Sets Syst. 37 (3), 267e286.
Onisawa, T., 1988. An approach to human reliability in man-machine systems using
error possibility. Fuzzy Sets Syst. 27 (2), 87e103.
Shahriar, A., Sadiq, R., Tesfamariam, S., 2012. Risk analysis for oil & gas pipelines: a
sustainability assessment approach using fuzzy based bow-tie analysis. J. Loss
Prev. Process Ind. 25 (3), 505e523.
Sklavounos, S., Rigas, F., 2006. Estimation of safety distances in the vicinity of fuel
gas pipelines. J. Loss Prev. Process Ind. 19 (1), 24e31.
Vlchez, J.A., Espejo, V., Casal, J., 2011. Generic event trees and probabilities for the
release of different types of hazardous materials. J. Loss Prev. Process Ind. 24 (3),
281e287.
Yongji, W., 2004. Quantitative risk assessment for failure of oil and gas pipelines.
Acta Pet. Sin. 25 (5), 108e112.
Yuhua, Dong, Datao, Yu, 2005. Estimation of failure probability of oil and gas
transmission pipelines by fuzzy fault tree analysis. J. Loss Prev. Process Ind. 18
(2), 83e88.
Zamalieva, D., Yilmaz, A., Aldemir, T., 2013. A probabilistic model for online scenario
labeling in dynamic event tree generation. Reliab. Eng. Syst. Saf. 120, 18e26.