us

rianiver

6 December 2011Accepted 12 December 2011

Keywords:Oil & gas pipelinesRisk analysisBow-tie analysisDependency

temporally and spatially. Further, as pipes are mostly buried,limited data are available on their condition. Finally, some of thefailure processes are not well understood and forensic investigationis very difcult because there is generally a time lag between thetime of failure and the time at which the consequences areobserved. Several studies dealt with different aspect related to riskassessment of pipelines (Arnaldos, Casal, Montiel, Sanchez-Carricondo, & Vilchez, 1998; Cagno, Caron, Mancini, & Ruggeri,2000; Jo & Ahn, 2002; Sklavounos & Rigas, 2006).

Abbreviations: BE, Basic events; CE, Critical event; CVCE, Conned vapor cloudexplosion; ET, Event tree; ETA, Event tree analysis; FRB, Fuzzy rule base; FST, Fuzzyset theory; FSE, Fuzzy synthetic evaluation; FT, Fault tree; FTA, Fault tree analysis;FMEA, Failure mode and effect analysis; FUV, Fuzzy utility value; HAZOP, Hazardand operability study; O&G, Oil and gas; OE, Output event; PDF, Probability densityfunctions; ZFN, trapezoidal fuzzy number; TFN, Triangular fuzzy number; TBL,Triple bottom line.* Corresponding author. Tel.: 1 250 807 9013.

Contents lists available at

Journal of Loss Prevention

journal homepage: www.

Journal of Loss Prevention in the Process Industries 25 (2012) 505e523E-mail address: rehan.sadiq@ubc.ca (R. Sadiq).1. Introduction

Oil & gas (O&G) are themajor source ofworlds fuel consumption.Most of theO&G is transported fromone location to another throughpipelines. Existing pipelines around the globe have been subjectedto deterioration due to aging, aggressive environmental factors,inadequate design and improper protection and maintenance. Toensure optimal performance, this often requires extensive mainte-nance, repair and renewal practices or even replacement of certaincomponents. Integrity of these pipelines is of primary interest to the

O&G companies, governmental agencies, consumers and otherstakeholder due to potential adverse consequences related to publichealth, safety and heavy nancial liabilities in case of system failure.The pipe failures can never be fully avoided; however, the overallrisk of failure can be reduced to an acceptable level by opting ef-cient risk management strategies.

The quantication of risk of O&G pipeline failure is a difculttask. O&G distribution systems comprise many (sometimes thou-sands) kilometers of pipes of different ages and various materials.Operational and environmental conditions are highly variable bothFuzzy utility valueGas release0950-4230/$ e see front matter 2011 Elsevier Ltd.doi:10.1016/j.jlp.2011.12.007which is the third largest in the world. Integrity of these pipelines is of primary interest to O&G companies,consultants, governmental agencies, consumers and other stakeholder due to adverse consequences andheavy nancial losses in case of system failure. Fault tree analysis (FTA) and event tree analysis (ETA) are twographical techniques used to perform risk analysis, where FTA represents causes (likelihood) and ETArepresents consequencesof a failure event. Bow-tie is anapproach that integrates a fault tree (on the left side)and an event tree (on the right side) to represent causes, threat (hazards) and consequences in a commonplatform. Traditional bow-tie approach is not able to characterize model uncertainty that arises due toassumption of independence among different risk events. In this paper, in order to dealwith vagueness of thedata, the fuzzy logic is employed to derive fuzzy probabilities (likelihood) of basic events in fault tree and toestimate fuzzy probabilities (likelihood) of output event consequences. The study also explores how inter-dependenciesamongvarious factorsmight inuenceanalysis results and introduces fuzzyutility value (FUV) toperformrisk assessment for natural gas pipelines using triple bottom line (TBL) sustainability criteria, namely,social, environmental and economical consequences. The present study aims to help owners of transmissionanddistributionpipeline companies in riskmanagement anddecision-making to considermulti-dimensionalconsequences that may arise from pipeline failures. The research results can help professionals to decidewhether and where to take preventive or corrective actions and help informed decision-making in the riskmanagement process. A simple example is used to demonstrate the proposed approach.

2011 Elsevier Ltd. All rights reserved.Article history:Received 11 November 2011Received in revised formVast amounts of oil & gas (O&G) are consumed around the world everyday that are mainly transported anddistributed throughpipelines. Only in Canada, the total length of O&Gpipelines is approximately 100,000 km,Risk analysis for oil & gas pipelines: A sfuzzy based bow-tie analysis

Anjuman Shahriar, Rehan Sadiq*, Solomon TesfamaSchool of Engineering (Okanagan Campus), The University of British Columbia, 3333 U

a r t i c l e i n f o a b s t r a c tAll rights reserved.tainability assessment approach using

msity Way, Kelowna, BC V1V 1V7, Canada

SciVerse ScienceDirect

in the Process Industries

elsevier .com/locate/ j lp

The term risk is the cornerstone in decision making process.Risk of an undesired event is a function of a set of scenario, likeli-hood of occurrences and the consequences of events (AIChE, 2000;Kaplan & Garrick, 1981). Risk analysis is a systematic and scienticway to predict and prevent the occurrence of undesirable event(s)by gathering and integrating qualitative and quantitative infor-mation of potential causes, consequences, and likelihood of adverseevents. Likelihood of an event refers to a quantitative measurementof occurrence, which is expressed either as frequency (i.e., rate ofevent occurs in per unit time) or probability (i.e., the chance ofevent to occur in dened conditions) of occurrences.

A number of qualitative and quantitative techniques, e.g. failuremode and effect analysis (FMEA), hazard and operability study(HAZOP), fault tree analysis (FTA), event tree analysis (ETA), havebeenused for the risk assessment (Khan&Abbasi, 2001). FTAandETAare two well established techniques that individually assist the riskassessmentbyprovidingqualitativeanalysisofhazards identicationand a detail quantitative assessment of likelihood for the undesiredevents (CMPT, 1999). Bow-tie is a common platformwhich couplesFTA and ETA by considering a common top-event named as criticalevent (Cockshott, 2005; Chevreau,Wybo, & Cauchois, 2006; Dianous& Fivez, 2006; Duijm, 2009; and Markowski, Mannan, &Bigoszewska, 2009). The traditional bow-tie analysis requires theprobabilityof input events asprecise crispdata ordenedprobability

density functions (PDFs) (Markowski et al., 2009). The crisp data orPDFs are often hard to come by and are subjected to a number ofinherent uncertainties due to variant failure modes, design faults,poor understanding of failure mechanisms, as well as the vaguenessof system phenomena (Ayyub, 1991; Ferdous, Khan, Sadiq, Amyotte,& Veitch, 2009, 2011; Sadiq, Saint-Martin, & Kleiner, 2008; Sawyer &Rao, 1994; Yuhua & Datao, 2005). Fuzzy Set Theory (FST) has beenproven to be effective and efcient to handle epistemic uncertainty(due to impreciseness, vagueness, lack of knowledge or incom-pleteness) for experts system applications (Agarwal, Renaud,Preston, & Padmanabhan, 2004; Ayyub & Klir, 2006; Bae, Grandhi,& Caneld, 2004; Cheng, 2000; Sentz et al., 2002; Wilcox et al.,2003). Many attempts have been reported in literature to incorpo-rate FST for risk analysis of different systems using FTA, ETA or bow-tie analysis (Ferdous et al., 2009, 2011; Huang, Chen, &Wang, 2001;Sadiqet al., 2008; Sawyer&Rao,1994; Suresh, Babar,&Raj,1996). Thepresent study aims to propose a generic framework (Fig. 1) to eval-uate risk of natural gas pipeline failure that can both handle data andmodel uncertainties in risk analysis. The rst step proposes a genericframework for the bow-tie analysis to evaluate the likelihood ofundesirable invent fromO&Gpipe failure. Recently, Yuhua andDatao(2005) proposed a fuzzy-based approach to estimate the failureprobability of O&G transmission pipelines using FTA. Expert elicita-tion and FST were used to get the probabilities of the basic events;

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e523506Fig. 1. Proposed generic framework for risk analysis under uncertainty for natural gas pipeline failure.

prevent, control and mitigate undesired events by developinga logical relationship between causes and consequences of anundesired event (Dianous and Fievez, 2006). Bow-tie diagramcomprises of ve basic elements; basic events (BE), FT, main (top)event (i.e. failure), ET and output event. The FT is placed on the leftside of the diagram and it starts with the critical event (i.e., top-

n in the Process Industries 25 (2012) 505e523 507however it is unable to incorporate the uncertainty due to ignoranceor lackof knowledge. YuhuaandDatao (2005)didnot considermodeluncertainty arises due to assumption of independence among basicevents in FTA. In this study the hierarchical structure of factorscontributing to O&G pipeline failure, presented in earlier work byDawotola, Van Gelder, and Vrijling (2009) and Yuhua and Datao(2005) has been adopted after some modication for the proposedfault tree (FT) structure. FT approach considers different failurescenarios to achieve the probability of critical event (e.g. gas release),then this probability lends itself into various output events throughthe event tree (ET). Further, the shortcomings discussed earlier,namely the need for quantication of epistemic uncertainties andindependence assumptions, need to be addressed. Probabilities ofbasic risk events are dened linguistically using fuzzy numbers, andnonlinear interdependencies can be handled using Frank copula (fora known correlation) and Frechets limit (for unknown correlation)(Ferson, Hajagos, Berleant, & Zhang, 2004).

The traditional FT and ET results only in the likelihood of theoutput event, and can not characterize severity of the corre-sponding risk arising from the undesirable output event. The like-lihood of occurrence of an undesirable event may be very low butthe consequence could be very high depending on the type ofincident. Therefore, the study proposes to introduce utility value foreach consequence resulting from the corresponding output event.However, consequences of output event are different for differentpeople because the utility or value assigned to it depends on therelative gain or loss that might be experienced; and the value of thisgain or loss is a personal (or group) judgment. In addition to that inmany cases, the utility values corresponding to consequences areelicited linguistically or vaguely known. Therefore, in this paper wehave introduced fuzzy utility value (FUV) as consequences of eachoutput event. It should be worth mentioning that the utility scalecan be calibrated based on the type of consequences, agenciesneed, and applicable (regulatory/company) risk criteria.

The proposed model takes into account the possible social,environmental and economical consequences that an output eventcauses. Historical data of accidents around the world show thatsingle risk dimension is not appropriate and efcient due tocomplexities involved in social, environmental and regulatoryissues (Brito & Almeida, 2009). The use of monetary values toestimate these consequences is not appropriate to represent theconsequences in a decision making problem (Brito, Almeida, &Mota, 2010). Moreover, different criteria involved in decisionmaking are uncertain and often conicting in nature. It is commonthat criterions are not assessed precisely due to unquantiable,incomplete, and non-obtainable information and partial ignorance.Therefore, fuzzy-based approach has been used to investigatethree-dimensional risk for pipeline failure using triple bottom line(TBL) approach using expert judgment.

The paper is structured as following. Section 2 provides anoverview of proposed framework for O&G pipeliene failure riskanalysis using bow-tie analysis, fuzzy synthetic evaluation (FSE),and fuzzy rule base (FRB). The sub-sections also provide discussionon uncertainty in dependency relationship and interpretation ofrisk followed by knowledge acquisition in Section 3. The results ofthe proposed model are illustrated and discussed in the Section 4.Finally, conclusions are provided in Section 5.

2. Proposed framework for O&G pipeline failure risk analysis

2.1. Bow-tie analysis

Bow-tie analysis is an integrated probabilistic technique thatanalyzes the accident seniors in terms of assessing the probabilities

A. Shahriar et al. / Journal of Loss Preventioand pathways of occurrences (Duijm, 2009). It is employed toevent) and diverges until the basic or intermediate causes aredescribed in terms of BEs using logic gates (e.g., AND and OR gates)and BEs. The right side of the bow-tie diagram corresponds to ETdevelopment,which begins from the critical event as initiatingeventand follows the sequences of events (consequence) to reach to thepossible outcome events. Based on coupled FT and ET, all causes andconsequences related to a critical event are clearly and jointly iden-tied in a bow-tie diagram.Once the bow-tie diagram is constructed,quantitative analyses can be performed following the traditionalassumptions andmathematical operations (Table 1) of FTA and ETA.

Although pipelines are cited in the literature as one of the safestmodes of transporting gaseous substances (Papadakis, 2000), withlower accident frequencies than those associated with road or railhaulage, various hazards with different likelihoods can lead topipeline failure. Considering the natural gas release from thepunctured or ruptured pipe as critical event, a bow-tie diagram forthe O&G pipeline failure has been constructed in Fig. 2. The left sideof the critical event represents the FT and the right side representsthe ET.

2.1.1. Fault tree (FT)O&G pipe failures can occur due to various mechanisms, and

failure rate is signicantly dependent on design factors, construc-tion conditions, maintenance techniques, and the environmentalsituation. Failuremode for a gas pipeline can be of either puncture orrupture and each of thesemodes can happen inmultiple ways, withthe risk that the failure of pipelines propagates through the systemand affects it interactively and eventually risks human life, society,environment and economy. Based on literature (Adebayo & Dada,2008; Dawotola et al., 2009; Simonoff, Restrepo, & Zimmerman,2010; Yuhua & Datao, 2005), different factors have been identied,namely third party activities (accidental, incidental, malicious,sabotage, act of war etc.), corrosion (external or internal), structuraldefects, operational defects (system failure andhuman failure errorsincluding lack of adequate maintenance), natural hazards (earth-quake,ood, ground surface subsidence etc). However, the fault treedeveloped by Dawotola et al. (2009) and Yuhua and Datao (2005)has been adopted in this study after some modication (Fig. 3).The list of each failure event in theproposed FT is provided inTable 2.

2.1.2. Event tree (ET)Different accident scenarios may result from a combination of

events following gas release from a failed pipe due to combustible,explosive anddiffusible nature of natural gas (and of other substancessuch as petroleum) and can lead to a signicant threat to people andproperty in the vicinity of the failure location. A number of ETs ofpipeline leakage carrying natural gas has been found in the literature(Bilo & Kinsman, 1997; Brito & Almeida, 2009; Jo & Ahn, 2002;Sklavounos & Rigas, 2006). However, the ET proposed by Sklavounosand Rigas (2006) has been adopted in this study (right hand side ofFig. 2) which encompasses a set of scenarios (known as events),

Table 1Equations uses in traditional bow-tie analysis.

Approach Operation Equation

ETA Intersection POEi Qn

i1 PiFTA Conjunction POR 1

Qni11 PiIntersection PAND Qn

i1 Pi

T p

n innamely: the time gap between the gas leakage and possible ignition,and degree of space connement produced by the surroundings. TheETconsiders thebinarysituations, i.e., True(T)orFalse (F),Yes (Y)orNo(N)andSuccess (S)orFailure (F) topropagate theeventsuntil it revealsall possible output events in the bow-tie diagram.

2.2. Handling uncertainty in bow-tie analysis

In conventional bow-tie analysis, basic risk events (for FT) andevent (for ET) are assigned crisp probabilities; however, suchprobabilities are often hard to come by due to insufcient statisticaldata and knowledge. Consequently, such crisp probabilities may

Fig. 2. Bow-tie diagram natural gas pipeline failure (E

A. Shahriar et al. / Journal of Loss Preventio508lead to precise but unrealistic results. In this paper we propose touse fuzzy linguistic probabilities (p) instead. These enable uncer-tainties to propagate throughout the structure of the bow-tie. Inthis respect, the failure/occurrence probability dened by a trian-gular fuzzy number (TFN) is used to characterize the possibledeviation of the failure events/events. Therefore the concept of thefuzzy failure probabilities and associated possibilities are usedrather than crisp probability in bow-tie analysis.

Zadeh (1965) introduced fuzzy sets that have recently beenapplied where probability theory alone was found insufcient torepresent all types of uncertainties due to lack of ability to modelhuman conceptualizations of the real world. A fuzzy set isa collection of ordered pair A {x, mx} that describes the relation-ship between an uncertain quantity x and a membership functionmx which ranges between 0 and 1. FST is an extension of thetraditional set theory. In the traditional set theory, x is eitheramember of the set A or not. But in the FST x can be amember of setA with a certain degree of membership mx. Fuzzy sets are qualiedas fuzzy numbers, if they are normal, convex, and bounded (Klir &Yuan, 2001). Fuzzy numbers can be bell, triangular, trapezoidal,Gaussian in shape. However, the selected shape should be justiedby available information. Generally, triangular or trapezoidal fuzzynumbers (TFN or ZFN) are used for representing linguistic variables(Kenarangui, 1991; Rivera & Barn, 1999). In this paper, TFNs areused to dene the fuzzy probability (likelihood) of occurrence (p)and to quantify the subjective and vague uncertainty in expertsknowledge. Fig. 4 describes an 11-granular scale to dene thelikelihood (p) for basic failure events (Lee, 1996). This proposedscale includes 11 linguistic constants, namely, (1) absolutely low, (2)extremely low, (3) quite low, (4) low, (5) mildly low, (6) medium, (7)mildly high, (8) high, (9) quite high, (10) extremely high, and (11)absolutely high. The bottom table in Fig. 4 provides examples offuzzy probabilities assigned to failure risk events and events in FTand ET, respectively. The use of this scale provides decision-makersmore exibility in expressing their linguistic notions ofprobabilities.

Table 2 provides the description and fuzzy likelihood values(dened based on the 11-granular system) assigned to each basicfailure events involved in FT for O&G pipeline failure and Table 3

art has been modied after Sklavounos & Rigas, 2006).

the Process Industries 25 (2012) 505e523lists the corresponding fuzzy likelihood values for all eventsinvolved in ET.

2.2.1. Uncertainty in dependency relationshipsAsmentioned earlier, traditional bow-tie analysis uses a default

assumption of independence among the failure events (for FT)/events (for ET) to determine the joint probability of a parent event.This assumption simplies the analysis, but may lead to unrealisticand erroneous conclusions, and defy the purpose of risk analysis(Ferdous et al., 2009; Ferson et al., 2004; Sadiq et al., 2008;Markowski et al., 2009). The relationship between failure eventsmay be positively or negatively correlated (or independent). In thecase of two independent events X and Y, the joint probability oftheir conjunction is a simply a product of their individual proba-bilities (Ferson et al., 2004), or

PX^Y xy (1)where x PX and y PY, and the symbol ^ denotesa conjunction. The joint probability of their disjunction is obtainedusing following equation:

PXnY 1 1 x1 y x y xy (2)where the symbol n denotes a disjunction.

In this study, the interdependence of two events is denoted byPearson correlation r [1, 1], where r 0 means completeindependence, r 1 means perfect dependence (consonantevents, likely inuenced by the same causes) and r 1 means

Fig. 3. Schematic fault tree for O&G pipe failure.

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e523 509

Table 2Description of all failure events and experts knowledge in fuzzy scale for FT.

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e523510

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e523 511

n inA. Shahriar et al. / Journal of Loss Preventio512opposite dependence (disjoint events). The strongest positivedependence between two events (r 1) is when one eventensures the occurrence of another. When two events are mutu-ally exclusive (r 1), one event ensures the absence of theother. Pearson correlation r can be used to assign a level ofinterdependencies between the two extremes opposite andperfect (Ferson et al., 2004). Fig. 5 shows a possible graphicalthe Process Industries 25 (2012) 505e523relationship between Pearson correlation and a linguisticdependence scale ranging from opposite to perfect (Sadiq et al.,2008).

A particular formulation for correlation is derived from theFrank copula (1979). To formulate the probability of a conjunctionof two events using the Frank model of correlation, the followingequation is used (Sadiq et al., 2008):

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e523 513PX^Y andFrankx;y; r

8>>>:

minx;y if r 1x y if r 0maxx y 1;0 if r 1logs1 sx 1sy 1=s 1 otherwise

(3)

where s tanp1 r=4. This is a continuous function and thelimits are when r 1, 0, or 1 as r tends to be these values respec-tively. Similarly, disjunction of two events using the Frank model is:

PXnY orFrankx;y;r

8>>>:

maxx;y if r111x1y if r 0minxy;1 if r11 logs

1s1x1s1y1s1 otherwise

(4)

There exist many different methods to express correlation(dependence) but the Frank model (copula) is the most common. Itis selected to express dependencies among risk events in theproposed bow-tie analysis. Although exact correlation (r) is hardto come by, meaningful analysis can be performed even if the type

Fig. 4. A scale of fuzzy likelihood of a

Table 3Description of fuzzy likelihood values (qi) in fuzzy scale for the events of ET.

Event Yes

Expert 1 Expert 2 Expert 1

Ignition 10 11 2Delayed ignition 7 9 4Space connement 9 9 3(sign) of correlation is known e.g., positive (r [0, 1]) or nega-tive (r [0, 1]). In the case of completely unknown correlation,the Frechets limit r [1, 1] can be used to represent themaximum uncertainty in dependence relationships.

2.2.2. Interpretation of calculated result (likelihood)Similarity measure (S) and entropy (E) are employed in this

study to interpret the nal results of the analysis. The similaritymeasure is an empirical value that indicates which of the 11 failurelikelihoods/risk, shown in Fig. 4 has the closest resemblance to thecalculated result. The similarity measure is calculated using thereciprocal of the absolute averaged distance between the calcu-lated fuzzy number, and each of the 11 granulars qi (Sadiq et al.,2008).

S MAXsi; where si 1jd aij je bij jf bij jg cij=4

; i 1;2;.;11 (5)

where [d, e, f, g] represents the calculated likelihood/risk as ZFN, and[ai, bi, ci, di] represents the granular qi as ZFN (for TFN, bi ci). Thecalculated result is assigned a linguistic constant based on qi, whichcorresponds toMAX(si), i.e., the granularwith the highest similarity.

failure (after Sadiq et al., 2004).

No Aggregated TFN

Expert 2 Yes No

3 (0.90, 0.95, 1.0) (0.05, 0.15, 0.25)3 (0.60, 0.70, 0.80) (0.15, 0.25, 0.35)2 (0.80, 0.85, 0.90) (0.05, 0.15, 0.25)

-0.5

-0.25

0

0.25

0.5

0.75

1

Opp

osite

V. s

trong

(-)

Stro

ng (-

)

M. s

trong

(-)

Wea

k (-)

V. w

eak

(-)

Inde

pend

ent

V. w

eak

Wea

k

M. s

trong

Stro

ng

V. s

trong

Perfe

ct

Corre

latio

n (r)

cy

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e523514Entropy E represents a spread or variance of the calculatedlikelihood/risk. Entropy E is simply described by a convex set ofgranulars qi (linguistic constants) (Sadiq et al., 2008), which inter-sect with the calculated risk R and can be mathematically writtenas:

E [

RXqis4

qi (6)

2.3. Consequence of output event

Asmentioned earlier, damage resulting from pipelines accidentsgives rise to a number of consequences, e.g. increased threat tohuman life and property, social instability, environmental damageand nancial loss due to supply interruption. The factors thatinuence the magnitude of these consequence measures are thecharacteristics of the accidents such as failure mode (i.e. rupture,small or large leak), the system part involved, pipe mechanical andoperational characteristics, the location where the accidents tookplace (such as high or low consequence area, difculty of access).The consequences are required to be investigated in the hazardzones of output events during and after release. A hazard zone is

-1

-0.75

Fig. 5. Correlation and dependenthe region in which output event effects exceeds critical thresholdvalues and leads to negative effects for people, environment andproperty (Dziubinski et al., 2006).

Fig. 6 shows a simplied hierarchical structure for consequencesof each output events considering TBL sustainability criteria. Thisstructure demonstrates the aggregative consequences of pipeline

Social

EvacuationSociety response Casualty

Consequence of natural gas release

Environmental

Air Habitat for endangered species

Soil aVegeta

Fig. 6. Hierarchical frameworfailure resulting from social, environmental and economicalconsequences of an accident (outcome event) causes by release ofgas. Each criterion is then divided into lower level criteria that arereferred as sub-criteria (Fig. 6).

Consequences related to social criteria involve injuries to humanbeing (casualty), evacuation, social response to the accidents, etc.,among which casualty receive the highest attention and thereby, isgiven the highest weight. Another important sub-criteria consid-ered in the analysis of natural gas transmission incidents is whetheror not an evacuation is ordered and the factors associated withevacuations. It is reported that incidents being in high consequencearea (e.g. onshore) has 7 times the odds of involving evacuationcompared to those not in such a area (Simonoff et al., 2010).

Environmental risk is a combination of probable and actualenvironmental damage including biological effects and impact onecosystems. The air pollution, the expanse of vegetation destroyed,loss of habitat for endangered species, and water pollution are thesub-criteria considered in this study to estimate the environmentalimpacts resulting from gas pipeline failure.

The economical consequences are related to operational lossesthat a natural gas pipeline accident may have. The ow of supplywill certainly be affected by the failure of pipe and depending on

relationship (Sadiq et al., 2008).the extent of accident recovery timemay vary from hours to severaldays involving loss in revenues from supply interruption,compensation or reimbursement to customers for productioninterruption. Other economical losses include expenses requiredfor labor, equipment and raw material to repair/replace affectedpipes, compensation for damage caused to third party and property

nd tion

Water pollution

Economical

Supply Interruption

Repair Material loss

Property and third party damage

k for consequence of OE.

y va

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e523 515damage, loss in revenue due to material release (e.g. loss of gas).The amount of material release and location is a strong predictor forthe extent and cost of different consequences, for instance acci-dents with no material loss includes no need for evacuation andthus no cost associated with evacuation of adjacent properties.

2.3.1. Fuzzy synthetic evaluation (FSE)Due to high level of uncertainty within the criteria and the

Fig. 7. A scale of fuzzy utilitrelationships, fuzzy synthetic evaluation (FSE) technique has beenused to estimate the extent of consequences under each sub-category. In FSE, like other multi criteria decision making problem,the alternatives (outcome events) and attributes/criteria (conse-quences) which affect the decision choice are identied. Majorcriteria are broken down to their basic attribute levels where theinformation is known (e.g., Fig. 6). The sub-criterions are brokendown until further disintegration is not possible. The managementdecision depends on the nal score, which is a composite numberobtainedbygrouping sub-attributes. Forbrevity the FSE technique isnot discussed here, however the interested readers are referred toAppendix A.

Fig. 7 describes the 5-granular scale consisting of very low (VL),low (L), medium (M), high (H) and very high (VH) to assign fuzzy

Table 4Experts knowledge in fuzzy utility value (p) of basic consequence attributes cor-responding to each output event.

Factor OE1 OE2 OE3 OE4 OE5

Casualty 4 3 5 1 1Society Response 3 2 4 2 1Evacuation 4 4 4 1 1Air 4 3 4 2 1Habitat for endangered species 3 2 4 1 2Soil and vegetation 4 4 4 4 4Water pollution 3 3 3 3 3Supply Interruption 4 4 4 4 4Repair cost 3 3 3 3 3Material Loss 4 4 4 4 4Property and third party damage 4 3 5 2 1utility value (FUV) of each consequence factor. The bottom table inFig. 7 describes FUV assigned to consequences. Table 4 lists FUV (p)of basic consequence attributes corresponding to each output eventobtained from expert elicitation. Table 5 presents sets of weightsderived for each attributes based on their relative importance usinganalytic hierarchy process (AHP) considering pro-social attitude ofstakeholder. For a specic site, these weights need to be ne tunedand calibrated to meet the stakeholders need.

lue (FUV) for consequences.2.4. Risk analysis

Risk analysis is prerequisite for risk management of any system.Quantitative risk analysis is generally conducted by measuring therisk as the product of likelihood of the occurrence of any undesir-able event (Li) and the consequence of the corresponding unde-sirable event (Ci):

Ri Li Ci (7)In this study, three types of fuzzy-basedmethods are used in the

risk analyses. The likelihood of each output event is obtained by

Table 5Preference weight used in FSE.

Generation 3 Generation 2 Generation 1

Factor Weight Factor Weight

Casualty 0.70 Social 0.50 Consequenceof natural gasrelease

Society Response 0.20Evacuation 0.10Air pollution 0.40 Environmental 0.30Habitat for

endangered species0.20

Soil and vegetation 0.20Water pollution 0.20Supply Interruption 0.20 Economical 0.20Repair 0.20Material Loss 0.30Property and

third party damage0.30

fuzzy-based bow-tie analysis. Multi-dimensional fuzzy conse-quences are determined using fuzzy synthetic evaluation (FSE),which is primarily a fuzzy-based method that uses a linearizedweighting scheme for aggregation. Finally risk index is evaluatedfrom fuzzy likelihood and fuzzy consequences using a fuzzy rulebase (FRB) technique, a nonlinear method.

2.4.1. Fuzzy-rule-base (FRB)In this study, fuzzy-rule-base (FRB) technique is used to

combine fuzzy likelihood and consequences to determine the fuzzyrisk. In FRBmodeling, the relationships between fuzzy variables canbe represented by if-then rules of the form If antecedent propo-sition then consequent proposition. In the proposed model whereboth the antecedent(s) and consequent are fuzzy propositions, therule can be written as (Mamdani, 1977):

Ri: If L is Xi and C is Yi then Risk is Zi; i 1;2;3 &; k (8)

where, the antecedents (likelihood, L and consequences, C) and theconsequent (Risk) are linguistic variables whereas Xi, Yi, and Zi arelinguistic constants.

In this study, the rule base involves twenty ve rules to deter-mine the fuzzy risk (Table 6). In order to reduce the number ofrules, the fuzzy likelihood obtained from bow-tie analysis is

Table 6Rule base risk matrix for natural gas release.

Consequence Likelihood

Very low Very low Very low Low Medium MediumLow Very low Low Medium Medium HighMedium Low Medium Medium High HighHigh Medium Medium High High Very highVery high Medium Medium High Very high Very high

Table 7Assumed interdependencies among risk events for scenario 8 (SC8).

Node Operation Dependence Node Description Dependence

N-1 Conjunction Independent N-16 Conjunction IndependentN-2 Conjunction Independent N-17 Conjunction IndependentN-3 Intersection () Medium

strongN-18 Conjunction () Weak

N-4 Conjunction () Strong N-19 Conjunction IndependentN-5 Conjunction Independent N-20 Conjunction () Medium

strongN-6 Conjunction Independent N-21 Conjunction () StrongN-7 Conjunction Independent N-22 Conjunction IndependentN-8 Intersection Independent N-23 Conjunction IndependentN-9 Intersection Independent N-24 Conjunction IndependentN-10 Conjunction Independent N-25 Conjunction IndependentN-11 Conjunction Independent N-26 Intersection IndependentN-12 Intersection Independent N-27 Intersection IndependentN-13 Intersection Independent N-28 Intersection IndependentN-14 Conjunction () Medium

strongN-29 Intersection Independent

N-15 Conjunction Independent

Note: Bold events are the identied as dependent risk events.

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e523516Fig. 8. FT analysis results for CE.

transformed into a new fuzzy likelihood scale consisting of 5-linguistic constants as that of the scale used for fuzzy utility value(FUV) for consequences (Fig. 7). Among various compositionoperators, due to simplicity the sum-product operator of fuzzycomposition is used to estimate the fuzzy risk indexmRVL mRL mRM mRH mRVH .

2.4.2. DefuzzicationIn the nal risk assessment, it is convenient for decision making

to convert the fuzzy output into a crisp risk index (RI) throughdefuzzication. Several defuzzication techniques exist, e.g. therst of maximum, the last of maximum, the mean of maximum, thecenter of area and the maximum operator, etc. In this article, theweighted averagemethod is used to compute the nal index (Sadiq,Kleiner, & Rajani, 2004):

RI Xn

i1mi*mi (9)

where mi is quality-ordered weights, mi [0, 10]. The mi valuesassigned for the ve-tuples fuzzy sets are: mVL 0, mL 2.5,mM 5.0, mH 7.5, and mVH 10.0. These scales are generatedby assuming equal importance between each interval andguidelines may be established for the risk index based on expertopinion.

3. Knowledge acquisition

Knowledge acquisition is required to explore and develop rela-tionships between basic risk items and events of occurrence. Forexample, the corrosion medium is associated with internal orexternal corrosion and thus to the likelihood of pipe failure. Simi-larly, lack of knowledge, experience and education affect operationand maintenance of pipe. Knowledge acquisition consists of fourdistinct activities: preliminary analysis; literature review; surveys/interviews and solicitations of opinions of an expert panel. Thepreliminary analysis provides an overview of the problem andbreaks down the risk items along categorical lines through in-depthliterature review, which help identify contributory risk factors(McCauley-Bell & Badiru, 1996). For O&G pipeline failure thisanalysis could be carried out as illustrated in Fig. 1.

The result of this analysis provides a more comprehensiveunderstanding of risk items associated with O&G pipe failure. Witha more comprehensive understanding, questionnaires and inter-view sessions can be designed to query the knowledge of utilitypersonnel and other professionals working in the O&G industry.Finally, an expert panel is assembled to discuss and organize theavailable information as well as to help ll identied knowledgegaps. The nal data of basic risk items may be qualitative, quanti-tative or a hybrid of both. In order to provide an agreement amongconicting experts knowledge a number of aggregation operators

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e523 517Fig. 9. ET analysis results for OE1.

including minimum, maximum, arithmetic mean, median, quasi-arithmetic means, symmetric sum and t-norm is used (Wagholiar,2007). Weighted average method is the most common methodthat allows aggregation according to prior weights on the argu-ments. The weighted average equation for aggregating m expertsknowledge in fuzzy number can be dened as:

P

Table 3 lists the corresponding fuzzy likelihood values for all eventsinvolved in ET. Eight different scenarios based on different inter-dependence assumptions on the input events at different nodes areperformed while estimating the likelihood. It should be noted thatfuzzy likelihood values assigned to the basic failure events (at FT)and the events (at ET) were xed for all trials, but the dependencyassumptions were varied to investigate the impacts of unknowndependencies on the risk analysis. Table 7 represents the assumedinterdependencies among failure events at nodes N-3, N-4, N-14,N-18, N-20 and N-21 for Scenerio 8 (SC8) and the executed oper-ations used in each node. For simplicity, interdependencies amongnon-relevant basic failure events were also assumed independent(r 0). In case of other scenarios, same dependency assumptions areused at each node. In ET analysis, all events were assumed to occurindependently.

The procedure to calculate the likelihood of an intermediateevent, for instance occurrence likelihood of alternate stress (at nodeN-7) in the O&G pipelines from the basic failure events consideringdifferent interdependencies is illustrated in the following section.Alternate stress in the pipeline occurs as a result of pressure surgeor external load (see Fig. 3).

The rst step is to obtain the aggregated TFN provided bydifferentexperts. According todataprovided inTable2, the linguistic

4

4.5

5

5.5

6

-1.5

-1

-0.5

0

0.5

1

1.5

Risk In

dex

Co

rellatio

n (r)

Correlation (r) Risk Index

Fig. 10. Relationship between correlation (r) and the risk index.

21

9

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e5235184.1. Bow-tie analysis

Elicited knowledge from two experts is used to dene the like-lihoods of input events (i.e., basic events and events) for the bow-tieanalysis. Table 2 provides the description and fuzzy likelihoodvalues (dened based on the 11-granular system) assigned to eachbasic failure events involved in FT for O&G pipeline failure and

1

9Construction/material

defectPi mj1wjPi;jPmk1wj

i 1;2;3;..:n (10)

where Pij is the linguistic expressions of uncertain input events ielicited from expert j, n is the number of input events, m is thenumber of the experts. wj is a weighting factor correspond to theexpert j and Pi is the aggregated fuzzy number.

4. Illustrative example and discussions1621

20

21

18

1

20

0 10 20

Corrosion

Outside force

Incorrent operations and others

Pe

Fig. 11. Tornado plot (Percent contribquantier assigned to pressure surge by two experts are 3 and 2which corresponds toTFNs of [0.1, 0.2, 0.3] and [0, 0.1, 0.2]. Assigningequal weights to both experts and using Equation (10), the aggre-gated TFN for stress concentration becomes [0.05, 0.15, 0.25]. Simi-larly aggregated TFN for external load becomes [0.4, 0.5, 0.6].

Since, pressure surge and external load are linked to alternatestress at N-7 by the OR gate, the likelihood (L) of alternate stressconsidering different interdependencies is calculated by theEquation (4) and the results are as follows:

Independent: r 0, LAlternate stress [0.43, 0.58, 0.70]Perfect: r 1, LAlternate stress [0.4, 0.5, 0.6]Opposite: r 1, LAlternate stress [0.05, 0.15, 0.25]Medium Strong (ve): r 0.5, s 2.414,LAlternate stress [0.28, 0.41, 0.57]Medium Strong (ve): r 0.5, s 0.414,LAlternate stress [0.32, 0.44, 0.58]

28

35

36

23

42

25

55

39

25

27

30 40 50 60

rcent contribution (%)

Hopkins, 2002

Yuhua and Datao, 2005

Perfect

Opposite

Independentution of group of factors to OE1).

Table 8Illustration of fuzzy consequence for OE1.

Generation 3 Generation 2 Generation 1

Factor Weight Linguistic quantier Fuzzication Factor (weight) Individual consequences Overall consequence

C 0.70 High (0, 0, 0.5, 1.0, 0.5) Social (0.50) (0, 0.05, 0.30, 0.45, 0.20) (0,0.06,0.31, 0.44, 0.19)SR 0.20 Medium (0, 0.5, 1.0, 0.5, 0)E 0.10 High (0, 0, 0.5, 1.0, 0.5)AP 0.40 High (0, 0, 0.5, 1.0, 0.5) Environmental (0.30) (0, 0.10, 0.35, 0.40, 0.15)HFES 0.20 Medium (0, 0.5, 1.0, 0.5, 0)SV 0.20 High (0, 0, 0.5, 1.0, 0.5)WP 0.20 Medium (0, 0.5, 1.0, 0.5, 0) Economical (0.20) (0, 0.05, 0.30, 0.45, 0.20)SI 0.20 High (0, 0, 0.5, 1.0, 0.5)R 0.20 Medium (0, 0.5, 1.0, 0.5, 0)ML 0.30 High (0, 0, 0.5, 1.0, 0.5)PTPD 0.30 High (0, 0, 0.5, 1.0, 0.5)

C: Casualty, SR: Society Response, E: Evacuation, AP: Air pollution, HFES: Habitat for endangered species, SV: Soil and vegetation, WP:Water pollution, SI: Supply Interruption,R: Repair, ML: Material Loss, PTPD: Property and third party damage.

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e523 519Thus using the appropriate equations depending on the type oflogic gates and interdependencies, and using the likelihood value ofthe basic events from Table 2, the likelihood of critical event (gasrelease) for different dependencies are obtained following theleading path as shown in Fig. 3. For the different scenarios, theuncertainties in the estimates of the likelihood of critical events aremeasured and shown in Fig. 8.

Knowing the likelihood of critical event, likelihood of each outputevent is derived according to the leading path. After gas release, thedetonation/deagration (OE1) occurs if the gas nds an ignitionsource and conned in a space. From Table 3, likelihood for presenceof ignition source and space connement are [0.90, 0.95, 1.0] and[0.80, 0.85, 0.90], respectively. From the bottom table of Fig. 8,likelihood of gas release considering independent dependencyamong basic failure events is [0.50, 0.65, 0.80, 0.84]. Thus thelikelihood of OE1 is obtained by multiplying these three likelihoodsusing equations for ET (provided in Table 1).

LOE1 LGR*LI*LSC 0:50;0:65;0:80;0:84*0:90;0:95;1:0*0:80;0:85;0:90

LOE1 0:35;0:53;0:64;0:77

Where, LGR, LI, and LSC are likelihood of gas release, presence oflikelihood and space connement, respectively. The results of OE1for different scenarios varying the dependencies among the basicfailure events are presented in Fig. 9. Similarly, likelihood of otheroutput events are obtained using likelihood of gas release from thebottom table of Fig. 8 and the likelihood value provided in Table 3

using equation provided in Table 1.

Table 9Summary of three dimension of risk resulting from natural gas release.

Output event Multidimensional consequences O

OE1 Social (0, 0.05, 0.30, 0.45, 0.20) (Environmental (0, 0.06, 0.31, 0.44, 0.19)Economical (0, 0.05, 0.30, 0.45, 0.20)

OE2 Social (0.05, 0.28, 0.42, 0.22, 0.03) (Environmental (0.06, 0.25, 0.38, 0.25, 0.06)Economical (0, 0.13, 0.37, 0.37, 0.13)

OE3 Social (0, 0, 0.08, 0.38, 0.54) (Environmental (0, 0, 0.25, 0.5, 0.25)Economical (0, 0.05, 0.23, 0.40, 0.32)

OE4 Social (0.58, 037, 0.05, 0, 0) (Environmental (0.29, 0.33, 0.19, 0.12, 0.06)Economical (0.07, 0.20, 0.30, 0.30, 0.12)

OE5 Social (0.67, 0.33, 0, 0, 0) (Environmental (0.40, 0.29, 0.12, 0.12, 0.07)Economical (0.20, 0.15, 0.22, 0.30, 0.13)In SC1, the calculated likelihood of critical event is [0.50, 0.65,0.80, 0.84] which corresponds to high likelihood (based on thesimilarity measure as dened in section 2.2.2) of O&G pipelinefailure in the distribution system. In SC8, the calculated likelihoodof critical event is quite high and ranging from 0.45 to 0.99. In thiscase, the increase in likelihood is due to the combination of the basicfailure events uncertainties and the particular set of dependencies.It is obvious that the interdependence of input events has stronginuence over the measurement of uncertainties for the outputevents (e.g., critical event or output events). In SC2 where theinterdependencies among nodes are considered negative, thecalculated likelihood is extremely high and the entropy ranges fromlow to absolutely high (Fig. 11). The entropy for SC3 decreases toquite low to absolutely high. This indicates that there is slightlyhigher uncertainty associated with positive dependencies. Thelikelihood is quite high and ranges from 0.24 to 0.95 which impliesthat likelihood for positive dependencies is lower than that ofnegative dependency. In Fig. 9, the decrease in entropy for likeli-hood of OE1 in SC2 reinforces the notion that there is a slightlyhigher uncertainty associated with positive dependencies. Contraryto SC1, when the input events are assumed as independent, thelikelihood of OE1 bears the smallest uncertainty.

Table 8 provides the illustration of fuzzy consequences for social,environmental and economical impacts resulting from OE1 usingpro-social weight set and considering independent dependenciesamong the nodes of the failure events at FT, and Table 9 providessummary of all risk resulting from natural gas release through thedistribution pipe. For brevity, the calculation of consequences using

fuzzy synthetic evaluation (FSE) and risk index using fuzzy rule

verall consequence Fuzzy likelihood Risk index

0,0.06,0.31, 0.44, 0.19) (0, 0.17, 0.47, 0.36, 0) 4.92

0.04, 0.24, 0.41, 0.26, 0.05) (0.61, 0,39, 0, 0, 0) 2.88

0, 0.02, 0.17, 0.41, 0.40) (0.20, 0.40, 0.29, 0.11, 0) 3.04

0.38, 0.32, 0.16, 0.10, 0.04) (0.67, 0.33, 0, 0, 0) 1.05

0.47, 0.28, 0.10, 0.10, 0.04) (0.75, 0.25, 0, 0, 0) 0.77

isk i

738738738

n inbase (FRB) are not illustrated here. However, interested readers arereferred to Sadiq, Husain, Veitch, and Bose (2004) and Tesfamariamand Saatcioglu (2008). As we can see the risk associated withdetonation/deagration (OE1) is much higher than those of otherOEs. It is worth mentioning that this is case dependent and willvary depending on eld condition and expert opinion. The resultsfrom this study can help professionals to investigate differentdimension of risk and thus help to decide whether and where totake preventive or corrective action to minimize the overall risk ofpipe failure. Fig. 10 represents the relationship of risk index withdifferent types of dependencies. As we can see that the risk indexcontinues to decrease with correlation coefcient (r) from negativetoward positive. The result implies that the assumption of inde-pendent relationship among failure events in FT may result in over-estimation or underestimation of risk index depending on the typeof interdependencies assumed.

4.2. Sensitivity analysis

Uncertainties are inherently present in different inuencingfactors. Bow-tie analysis provides a numerical approximation oflikelihood occurrence of critical event and outcome events withoutidentifying most important input events (Ferdous et al., 2009).Sensitivity analysis (SA) is a systematic approach that can assist inevaluating quantitative information to identify the weakest linksand better design alternatives of a system, and the importantsources of variability and uncertainty in the risk analysis (Contini,Scheer, & Wilikens, 2000; EPA, 2001; Sadiq, 2001). There area number of methods to perform the SA e.g. analytical, statisticaland graphical (Frey & Patil, 2002). The proposed SA method forbow-tie analysis is comprised of following two steps:

4.2.1. Contribution of input eventsIn this study, Spearmans rank correlation coefcients have been

Table 10Risk reduction on OE1 for the most contributed input events.

Contributing basic failure event Dependency Original r

Symbol Name

X58,41 Bad installation Independent 4.9Opposite 5.5Perfect 4.3

X56,31 Construction defect Independent 4.9Opposite 5.5Perfect 4.3

X52,1 Failure of coating Independent 4.9Opposite 5.5Perfect 4.3

A. Shahriar et al. / Journal of Loss Preventio520used to calculate the contribution of each input event (e.g., basicfailure events, events) in causing the OEs. As stated earlier, thisresearch has identied a list of 40 basic failure events as illustratedin Table 2 for which uncertainties has been modeled by assigninga fuzzy probability distribution (Fig. 4) to each basic failure event.Five thousand trials have been used in estimation of likelihood ofthe outcome events to perform SA for the bow-tie. Themeans havebeen assumed based on estimated and/or observed value andstandard deviations for each factor has been assumed as 25% of themean due to lack of data. The SA identied bad installation,construction defects and failure of coating as the most contributinginput event for causing the occurrence of OE1, when interdepen-dencies were assumed independent, opposite and perfect,respectively.

Fig. 11 provides the contribution of different group of parame-ters considering different interdependency relationship. The resultsobtained from the SA of the proposed model were also comparedwith the data provided in Hopkins (2002), and Yuhua and Datao(2005). As we can see, contribution of each group of failureevents changes with the change of dependency relationship. Whenindependent relation was assumed, the average absolute error ofthe model from the data provided by Hopkins (2002) for differentgroup of failure events varies from 20.5 to 30.7%, whereas foropposite and perfect dependencies, the variations are 7.7 to 35.9%and 7.7 to 25.6%, respectively.

4.2.2. Risk reductionIn the proposedmethodology, the likelihood of the critical event

obtained from the FT is propagated to the ET to estimate differentOEs. Five-tuple fuzzy risk of natural gas release from failed distri-bution pipe considering TBL sustainability criteria, namely, social,environmental and economical consequences is then converted into a crisp risk index. After identifying the most contributing basicfailure event on the overall risk, the amount of risk reduction can becalculated (Equation (11) by reducing the likelihood of mostcontributing input events to certain level.

DRKi RJ

K

i RJK*

i

RJi 100% (11)

where DRi refers the risk reduction in criteria i, i refers to social,environmental and economical criteria, and RJ

K*

i refers to the cor-responding risk after reduction of the likelihood of basic inputevent k.

The results are provided in Table 10 and it illustrate that in caseof independent relationship, 14.54%, 11.35% and 4.18% deduction inrisk index of OE1 may be attained for 20% reduction in the likelihoodfor the basic failure event bad instllation, construction defectsand failure of coating, respectively. The reduction in risk index forreduction in these basic failure events considering opposite and

ndex 20% devalued risk index Risk reduction per % devalued

4.27 14.084.81 13.024.04 7.764.49 9.664.43 19.894.17 4.794.8 3.425.02 9.224.01 8.45

the Process Industries 25 (2012) 505e523perfect dependencies are presented in Table 10. Thus the SA canhelp the decision maker to identify the most contributing eventsand allow them to take necessary measures for the risk reductionand risk control in natural gas release from ruptured or punctureddistribution pipe.

5. Conclusions

Risk assessment of O&G pipelines involves the study of failuresand consequences of pipelines in terms of possible damage toproperty, human hazards, and the environment. Ideally, mostpipeline operators ensure sufcient safety provisions during thedesign stage to provide a theoretical minimum failure rate for thelife of the pipeline. The quantication and characterization of thevarious risk factors associated with pipeline failures depends oninputs, which are often vague and uncertain. The unknown

Fuzzifying basic attributes; Dening weights; Aggregating basic attributes stepwise into more generalizedattributes;

Fuzzication is a step in FSE that transforms all commensurateor non-commensurate data into a homogeneous scale by assigningmemberships with respect to predened linguistic variables(Chowdhury, Champagne, & Husain, 2007; Khan & Sadiq, 2005).Fuzzication is required only for the basic input factors. The basicinput events have a range of values that is known as a universe ofdiscourse; say from 0 to 1.0 for utility of each consequence factor.These values can be grouped into a number of linguistic quantierse.g. in this case as very low (VL), low (L), medium (M), high (H) andvery high (VH) as shown in Fig. 6. The process of assigning theselinguistic values can be viewed as a form of data compression,

n in the Process Industries 25 (2012) 505e523 521likelihood and the relationships of the most input events for theaccident make bow-tie analysis more challenging, and in suchcase fuzzy risk assessment is more appropriate.

The study explored two types of uncertainties involved ina bow-tie analysis of O&G pipe failure. The rst was data uncer-tainty associated with the basic risk events (at FT) and event (at ET),and the second was uncertainty with respect to interdependenciesamong risk events. In order to understand the relationships amongrisk for the O&G pipeline failure and the impact of these assump-tions on the nal calculated risk, different types of dependencywere assigned to the corresponding basic failure events and eventson the bow-tiewhile calculating the likelihood of natural gas release(critical event) and identied output events resulted in gas releasefrom the distribution pipe. The input values of the basic event andevents were represented by fuzzy probabilities (likelihood) anduncertainties in interdependencies among risk events weredescribed by Frank copula and Frechets limit. Finally, the result ofthe risk analysis was interpreted using similarity and entropymeasures. This is worth mentioning that this analysis is veryimportant for qualitative analysis. It can be used as an importantpre-screening tool to identify the most signicant risk parametersfor which enough data is not available in the eld. This fuzzy basedapproach used herein is based on the perception and observation ofthe expert and have a signicant of potential to capture theinherent data and knowledge uncertainty. The granulation usedherein for the linguistic quantier has been developed based on theexpert knowledge using the limited information/data available inthe existing literature. The granules can be calibrated once moredata become available leading to more reliable eld specic riskanalysis model.

The traditional risk assessment techniques fail to consider themulti-dimensional consequences that an accident (e.g. failure ofnatural gas pipeline) may impose. The study is a step forward inovercoming this drawback. The proposed model integrates fuzzysynthetic evaluation (FSE) and fuzzy rule base (FRB) techniques toconsider the multiple dimensions of risk resulting from thecomplex risk scenarios and several interested parties involved. It isbelieved that the proposed approach should permit the decisionmakers to assess the overall risk as well as individual risk innatural gas pipeline failure and help the oil industry to quantifythe risks and accordingly priorities the activities and upgrade tominimize risk. Higher risk index for a particular dimension stip-ulates higher states of alert, and eventually demands higherattention and nancial resources to increase physical protectionand monitoring.

The results presented in this study are based on expert elicita-tion. In the future research, the authors of this paper will attempt tocollect eld data from different O&G distribution pipe to demon-strate the applicability of this approach. The structure presented inthis paper is a simplied application of the approach. A compre-hensive structure would require a major effort, including thecollaboration of several experts in the various disciplines ofknowledge. In the future research, the sensitivity analysis should beincorporated to investigate the effect of individual risk items on theover risk of the system. The SA should also be performed toexamine the effects of weights and aggregation operators as modelpredictions may be sensitive to both the types of aggression oper-ators as well as to weights.

Appendix A

The FSE technique comprises the ve steps described below:

Dening alternatives, basic attributes and forming a hierar-

A. Shahriar et al. / Journal of Loss Preventiochical framework;which is known as granulation. In this article, the granularity isassociated with the level of consequences. After fuzzication, eachinput value of the basic attribute is expressed by an array of ve-tuple fuzzy set mVL mL mM mH mVH , mi refers to the membership toeach fuzzy subsets and the subscript describes the correspondingconsequence level.

A value (crisp or a fuzzy number) of each basic attribute ismapped on a corresponding fuzzy scale and the memberships toeach fuzzy subset are determined. The determination of member-ship is straightforward in the case of crisp values, which intersectfuzzy subsets at only one point, but in case of fuzzy inputs of basicattributes, the maximumvalue of intersection for each fuzzy subsetis selected. Fig. A1 illustrates fuzzication for casualty selected asone of the attribute or sub-criteria in social impact of natural gasrelease, For example, the input value for casualty is (0.20, 0.35,0.60). This array refers to a TFN which has maximum likely value of0.35 and minimum and maximum values are 0.20 and 0.60,respectively. When this fuzzy number is mapped on a fuzzy scale,the ve-tuple fuzzy set (0.12, 0.75 0.7, 0.2, 0) is obtained, wherethese ve numbers represent the memberships to fuzzy subsets VL,L, M, H and VH, respectively.

In order to generate the weight of each risk criteria, analytichierarchy process (AHP) proposed by Saaty (1980) was used. AHPestimates the relative importance of each criteria in a group usingpairwise comparisons based on a scale of 1e9 (Saaty, 1980), where1 represents two criteria are equally important, while 9represents that one criteria is absolutely more important than theother (Table A1). The pairwise judgment matrix thus developed,indicates dominance or relative importance of one element overanother (Saaty, 1980). The result of the pairwise comparison on ncriteria is summarized in an n n matrix as follows:

0

0.2

0.4

0.6

0.8

1

0 0.25 0.5 0.75 1

VL L M H VH

Casualty

Fig. A1. Fuzzication e an example for casualty.

s (e.3 Moderately more important One decision element is m

hashasn ineenlue

n in WC WSR WE 64mSRVL mSRL :: :: mSRVHmE mE mE

75 (A4)A

2664a11 a12 :: a1na21 a :: a2n: : : :

an1 an2 :: ann

3775aii 1; aji 1=aij; aijs0 (A1)

Each element amn in the upper triangular matrix expresses theimportance intensity of a criterion (or property) m with respect toanother criterion n.

The nal weights of the criteria in each level of the hierarchy aredetermined by taking the geometric mean of each column of thenal judgment matrix and then normalizing the derived matrix. Ina case of n criteria, a set of weights in each level of hierarchy couldbe written as:

W w1;w2;.:;wn whereXn

1

wn 1 (A2)

Once the fuzzy membership values and the weights are ob-tained, the attributes are aggregated according to the position inthe hierarchical structures (Fig. 7). Aggregation of fuzzy setsrequires operators by which several fuzzy numbers arecombined in a desirable way to produce single fuzzy number.Different aggregation operators are available: intersection suchas, minimum, product, and union such as, maximum, summa-tion. In this study matrix multiplication has been employed toaggregate attributes involved in the hierarchical structure.Assume that the sub-criteria casualty, society response, andevacuation are to be aggregated to obtain overall social conse-quence of natural gas release, where AS is the evaluation matrixconsisting of ve-tuple fuzzy set of these three criteria and WS istheir corresponding weight vector. In such case, the ve-tuplefuzzy set of consequence is obtained by simple matrix multi-plication of WS and AS.

Csocial WS AS mSVL m

SL m

SM m

SH m

SVH

(A3)

Csocial WS AS 2mCVL m

CL :: :: m

CVH

VL L :: :: VH

3

5 Strongly more important One decision element7 Very strongly more important One decision element9 Extremely more important The difference betwee2, 4, 6, 8 Intermediate judgment values Judgment values betwReciprocals If v is the judgment vaTable A1AHP importance scale (Saaty, 1980).

Comparativeimportance

Denition Explanation

1 Equally important Two decision element

A. Shahriar et al. / Journal of Loss Preventio522where C, SR and E represent casualty, social response and evacua-tion, respectively. Similarly, for other attributes at different hier-archical levels, this procedure is repeated, until the nal fuzzy set isobtained.

References

Adebayo, A., & Dada, A. S. (2008). An evaluation of the causes of oil pipeline inci-dents in oil and gas industries in Niger Delta region of Nigeria. Journal ofEngineering Applied Science, 3(3), 279e281.

Agarwal, H., Renaud, E. J., Preston, L. E., & Padmanabhan, D. (2004). Uncertaintyquantication using evidence theory in multidisciplinary design optimization.Reliability EngineeringandSystemSafety, 85(2004), 281e294, PublisherElsevier Ltd.American Institute of Chemical Engineers (AIChE). (2000). Guidelines for chemicalprocess quantitative risk analysis (2nd ed.). New York: AIChE.

Arnaldos, J., Casal, J., Montiel, H., Sanchez-Carricondo, M., & Vilchez, J. A. (1998).Design of a computer tool for the evaluation of the consequences of accidentalnatural gas releases in distribution pipes. Journal of Loss Prevention in the ProcessIndustries, 11, 135e148.

Ayyub, B. M. (1991). Systems framework for fuzzy sets in civil engineering. Inter-national Journal of Fuzzy Sets and Systems, 40(3), 491e508, North-Holland,Amsterdam.

Ayyub, B., & Klir, J. G. (2006). Uncertainty modeling and analysis in engineering andthe sciences. Published by Chapman & Hall/CRC.

Bae, H., Grandhi, V. R., & Caneld, A. R. (2004). An approximation approach foruncertainty quantication using evidence theory. Reliability Engineering andSystem Safety, 86, 215e225.

Bilo, M., & Kinsman, P. R. (1997 NovembereDecember). Thermal radiation criteriaused in pipeline risk assessment. Pipes & Pipelines International, 17e25.

Brito, A. J., & Almeida, A. T. (2009). Multi-attribute risk assessment for risk rankingof natural gas pipelines. Reliability Engineering and System Safety, 94(2009),187e198. doi:10.1016/ j.ress.2008.02.014.

Brito, A. J., Almeida, A. T., & Mota, C. M. M. (2010). A multicriteria model for risksorting of natural gas pipelines based on ELECTRE TRI integrating Utility Theory.European Journal of Operational Research, 200, 212e221.

Cagno, E., Caron, F., Mancini, M., & Ruggeri, F. (2000). Using AHP in determining theprior distributions on gas pipeline failures in a robust Bayesian approach.Reliability Engineering and System Safety, 67, 275e284.

Cheng, Y. (2000). Uncertainties in fault tree analysis. Tamkang Journal of Science andEngineering, 3(1), 23e29.

Chevreau, F. R., Wybo, J. L., & Cauchois, D. (2006). Organizing learning processes onrisks by using the bow-tie representation. Journal of Hazardous Materials, 130(3),276e283.

Chowdhury, S., Champagne, P., & Husain, T. (2007). Fuzzy risk-based decision-making approach for selection of drinking water disinfectants. Journal of WaterSupply: Research and Technology-AQUA, 56(2), 75e93.

CMPT. (1999). A guide to quantitative risk assessment for offshore installation. UK: TheCentre of Marine and Petroleum Technology.

Cockshott, J. E. (2005). Probability bow-ties: a transparent risk management tool.Process Safety and Environmental Protection, 83(B4), 307e316.

Contini, S., Scheer, S., & Wilikens, M. (2000). Sensitivity analysis for system designimprovement. Proceedings of the 2000 International Conference on DependableSystems and Networks, 243-248, New York, USA.

Dawotola, A. W., Van Gelder, P. H. A. J. M., & Vrijling, J. K. (2009). Risk assessment ofpetroleum pipelines using a combined analytical hierarchy process - fault treeanalysis (AHP-FTA). In Proceedings of the 7th International Probabilistic Work-shop, Delft 2009 (pp. 491e501).

Dianous, V., & Fivez, C. (2006). ARAMIS project: a more explicit demonstra-tion of risk control through the use of bowetie diagrams and the evalu-ation of safety barrier performance. Journal of Hazardous Materials, 130(3),220e233.

Dziubnski, M., Fratczak, M., & Markowski, A. S. (2006). Aspects of risk analysisassociated with major failures of fuel pipelines. Journal of Loss Prevent in ProcessIndustries, 19, 399e408.

Duijm, N. J. (2009). Safety-barrier diagrams as a safety management tool. ReliabilityEngineering and System Safety, 94(2), 332e341.

g., indicators) equally inuence the parent decision element.oderately more inuential than the other.stronger inuence than the other.signicantly more inuence over the other.uences of the two decision elements is extremely signicant.equally, moderately, strongly, very strongly, and extremely.when i is compared to j, then 1/v is the judgment value when j is compared to i.

the Process Industries 25 (2012) 505e523EPA. (2001). Part A, Appendix A. Risk Assessment Guidance for Superfund, Sensitivityanalysis: How do we know whats important?, Vol. 3. Washington D.C: U. S.Environmental Protection Agency, EPA 540-R-02-002.

Ferdous, R., Khan, F., Sadiq, R., Amyotte, P., & Veitch, B. (2009). Handling datauncertainties in event tree analysis. Process Safety and Environment Protection,87(5), 283e292.

Ferdous, R., Khan, F., Sadiq, R., Amyotte, P., & Veitch, B. (2011). Fault and event treeanalyses for process systems risk analysis: uncertainty handling formulations.Journal of Risk Analysis, 31(1), 86e107.

Ferson, S., Hajagos, J., Berleant, D., & Zhang, J. (2004). Dependence in Dempster-Shafertheory and probability bounds analysis. US: Sandia National Laboratories.

Frank, M. (1979). On the simultaneous associativity of and F(x, y) and x y- F(x, y).Aequationes Mathematicae, 19, 194e226.

Frey, H. C., & Patil, S. R. (2002). Identication and review of sensitivity analysismethods. An International Journal of Risk Analysis, 22(3), 553e578.

Hopkins, P. (2002). The structural integrity of oil and gas transmission pipelines,comprehensive structural integrity, Vol. 1. Elsevier Publishers, 62 pp.

Huang, D., Chen, T., & Wang, J. M. (2001). A fuzzy set approach for event treeanalysis. Fuzzy Sets and Systems, 118, 153e165.

Jo, Y. D., & Ahn, B. J. (2002). Analysis of hazard areas associated with high-pressurenatural-gas pipelines. Journal of Loss Prevention in the Process Industries, 15,179e188.

Kaplan, S., & Garrick, B. J. (1981). On the quantitative denition of risk. Risk Analysis,1(1), 11e27.

Khan, F., & Sadiq, R. (2005). Risk-based prioritization of air pollution monitoringusing fuzzy synthetic evaluation technique. Environmental Monitoring andAssessment, 105, 261e283.

Khan, F. I., & Abbasi, S. A. (2001). Risk analysis of a typical chemical industry usingORA procedure. Journal of Loss Prevention in the Process Industries, 14, 43e59.

Kenarangui, R. (1991). Event-tree analysis by fuzzy probability. IEEE Transactions onReliability, 40(1), 12e124.

Klir, J. G., & Yuan, B. (2001). Fuzzy sets and fuzzy logic theory and applications.Prentice, Hall of India Private Ltd.

Lee, H.-M. (1996). Applying fuzzy set theory to evaluate the rate of aggregative riskin software development. Fuzzy Sets and Systems, 79, 323e336.

McCauley-Bell, P., & Badiru, A. B. (1996). Fuzzy modeling and analytic hierarchyprocessing to quantify risk levels associated with occupational injuriesePart I:the development of fuzzy linguistic risk levels. IEEE Transactions on FuzzySystems, 4(2), 124e131.

Markowski, A. S., Mannan, M. S., & Bigoszewska, A. (2009). Fuzzy logic for processsafety analysis. Journal of Loss Prevention in the Process Industries, 22(6),695e702.

Mamdani, E. H. (1997). Application of fuzzy logic to approximate reasoning usinglinguistic synthesis. IEEE Transactions on Computers, C-26(12), 1182e1191.

Papadakis, G. A. (2000). Assessment of requirements on safety managementsystems in EU regulations for the control of major hazard pipelines. Journal ofHazardous Materials, 78, 63e89.

Rivera, S. S., & Barn, J. H. (1999). Using fuzzy arithmetic in containment event trees.In International Conference on Probabilistic Safety Assessment-PSA 99, Wash-ington, USA (pp. 22e25).

Saaty, T. L. (1980). The analytic hierarchy process. New York: McGraw-Hill.

Sadiq, R. (2001). Drilling waste discharges in the marine environment: A risk baseddecision methodology. PhD. Thesis, Memorial University of Newfoundland,Canada, 333 pp.

Sadiq, R., Husain, T., Veitch, B., & Bose, N. (2004). Risk-based decision-making fordrilling waste discharges using a fuzzy synthetic evaluation technique. OceanEngineering, 31, 1929e1953.

Sadiq, R., Kleiner, Y., & Rajani, B. (2004). Aggregative risk analysis for water qualityfailure in distribution network. Journal of Water Supply, 4(53), 243e261.

Sadiq, R., Saint-Martin, E., & Kleiner, Y. (2008). Predicting risk of water qualityfailures in distribution networks under uncertainties using fault-tree analysis.Urban Water Journal, 5(4), 287e304.

Sawyer, P. J., & Rao, S. S. (1994). Fault tree analysis of Fuzzy Mechanical system.Microelectronics and Reliability, 34(4), 653e667.

Sentz, K., & Ferson, S. (2002). Combination of evidence in DempstereShafer theory.US: Sandia National Laboratories.

Simonoff, J. S., Restrepo, C. E., & Zimmerman, R. (2010). Risk management of costconsequences in natural gas transmission and distribution infrastructures.Journal of Loss Prevention in the Process Industries, 23, 269e279.

Sklavounos, S., & Rigas, F. (2006). Estimation of safety distances in the vicinity offuel gas pipelines. Journal of Loss Prevention in the Process Industries, 19,24e31.

Suresh, V. P., Babar, A. K., & Raj, V. V. (1996). Uncertainty in fault tree analysis:a fuzzy approach. Fuzzy Sets and Systems, 83, 135e141.

Tesfamariam, S., & Saatcioglu, M. (2008). Risk-based seismic evaluation of rein-forced concrete buildings. Earthquake Spectra, 24(3), 795e821.

Wagholiar, S. A. (2007). Acquisition of fuzzy measures in multicriteria decision makingusing similarity-based reasoning. Gold Coast, Australia: Grifth University.

Wilcox, C. R., & Ayyub, M. B. (2003). Uncertainty modeling of data and uncertaintypropagation for risk studies. IEEE Proceedings on Uncertainty Modeling andAnalysis, 184e191.

Yuhua, D., & Datao, Y. (2005). Estimation of failure probability of oil and gastransmission pipelines by fuzzy fault tree analysis. Journal of Loss Prevention inthe Process Industries, 18(2), 83e88.

Zadeh, L. A. (1965). Fuzzy sets. Information and Control, 8(3), 338e353.

A. Shahriar et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 505e523 523

Risk analysis for oil & gas pipelines: A sustainability assessment approach using fuzzy based bow-tie analysis1. Introduction2. Proposed framework for O&G pipeline failure risk analysis2.1. Bow-tie analysis2.1.1. Fault tree (FT)2.1.2. Event tree (ET)

2.2. Handling uncertainty in bow-tie analysis2.2.1. Uncertainty in dependency relationships2.2.2. Interpretation of calculated result (likelihood)

2.3. Consequence of output event2.3.1. Fuzzy synthetic evaluation (FSE)

2.4. Risk analysis2.4.1. Fuzzy-rule-base (FRB)2.4.2. Defuzzification

3. Knowledge acquisition4. Illustrative example and discussions4.1. Bow-tie analysis4.2. Sensitivity analysis4.2.1. Contribution of input events4.2.2. Risk reduction

5. ConclusionsAppendix AReferences