Risk identification of third-party damage on oil and gas pipelines through the Bayesian network

Accepted Manuscript Risk identification of third-party damage on oil and gas pipelines through the Bayesian network Xiaoyan Guo, Laibin Zhang, Wei Liang, Stein Haugen PII:

S0950-4230(17)31071-9

DOI:

10.1016/j.jlp.2018.03.012

Reference:

JLPP 3674

To appear in:

Journal of Loss Prevention in the Process Industries

Received Date: 7 December 2017 Revised Date:

24 February 2018

Accepted Date: 21 March 2018

Please cite this article as: Guo, X., Zhang, L., Liang, W., Haugen, S., Risk identification of third-party damage on oil and gas pipelines through the Bayesian network, Journal of Loss Prevention in the Process Industries (2018), doi: 10.1016/j.jlp.2018.03.012. This is a PDF file of an unedited manuscript that has been accepted for publication. As a service to our customers we are providing this early version of the manuscript. The manuscript will undergo copyediting, typesetting, and review of the resulting proof before it is published in its final form. Please note that during the production process errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain.

ACCEPTED MANUSCRIPT Risk Identification of Third-party Damage on Oil and Gas Pipelines through the Bayesian Network Xiaoyan Guo a, b, Laibin Zhang a, Wei Liang a*, Stein Haugen b a

College of Mechanical and Transportation Engineering, China University of Petroleum (Beijing), Beijing, China

b

Department of Marine Technology, Norwegian University of Science and Technology, Trondheim, Norway

1

M AN U

SC

RI PT

Abstract: This paper aims to identify the risks influencing oil and gas (O&G) pipeline safety caused by third-party damage (TPD). After comprehensive literature study, we found that the traditional risk identification of TPD suffers from defining binary states of risk only and ignores the risk factors after pipeline failure. To overcome this problem, we investigated incident reports to identify previously unrecognized additional factors. This work also developed a graphic model by using Bayesian theory to cope with the multistate risks arising from third parties and to present the incident evolution process explicitly. Furthermore, this paper included a leakage case study conducted to verify the logicality of this model. The results of case study inspire that the proposed methodology can be used in a dual assurance approach for risk mitigation, namely learning from previous incidents and continuously capturing new risk information for risk prevention. Key words: Oil and Gas Pipeline; Third-party Damage; Risk Identification; Bayesian Network

Introduction

AC C

EP

TE D

Pipelines are a safe form of energy transport, and the industry holds many years of operational experience for this mode (Hopkins, 2008). However, pipeline failures still occur frequently. Besides design defects and operational failures, pipeline exposure to complex environment persists with a constant potential threat from third parties (TPs). Risk analysis generally involves three parties, namely, “first party,” “second party,” and “third party” (TP). For pipelines, the first party refers to the pipeline company and its employees. The second party typically refers to companies working for the pipeline company, whereas the TP comprises individuals or other companies external to the operation of the pipeline. Third-party damage (TPD) can then be defined as “damage arising from individuals or organizations that are not related to the pipeline company, digging in the vicinity of buried pipelines without realizing the pipeline is there or without taking into account the presence of the pipeline.” This kind of damage often occurs in and around cities and towns and can result from large excavation projects, construction work, and farming activities. According to the Ninth Report of the European Gas Pipeline Incident Data Group (EGIG report, 2015), 1,309 pipeline incidents on more than 143,000 km of pipeline occurred from 1970 to 2013. From 2004 to 2013, external interference (EI) corresponding to our definition of TPD, corrosion, construction defects, and ground movement were the main causes of incidents and represented 35%, 24%, 16%, and 13%, respectively, of the total pipeline incidents reported. EI mainly results in pinholes, cracks, and holes. Small-diameter pipelines are more vulnerable to EI *

Corresponding author: College of Mechanical and Transportation Engineering, China University of Petroleum (Beijing), No. 18, Fuxue Road, Changping District, Beijing, China. Email addresses: [email protected]; [email protected] (W. Liang) 1

ACCEPTED MANUSCRIPT

AC C

EP

TE D

M AN U

SC

RI PT

than large diameter pipelines because of the former’s thinner wall thickness and lower depth of cover. As reported by Pipeline and Hazardous Materials Safety Administration (PHMSA), the total onshore pipeline mileage of gas transmission in the United States was about 296,977 km in 2016. Moreover, 1,037 gas transmission pipeline incidents were recorded from 1997 to 2016, with a total cost of $1.63 billion (data can be accessed from http://www.phmsa.dot.gov/pipeline/library/data-stats). Lam and Zhou (2016) analyzed 464 pipe-related incidents on onshore gas transmission pipelines from 2002 to 2013 on the basis of PHMSA data. The leading causes were identified as third-party excavation (TPE), external corrosion, material failure, and internal corrosion, which represent 26.3%, 23.7%, 16.8%, and 8.4%, respectively, of all incidents. The majority of the TPE-caused incidents also resulted in ruptures (about 82%) but few small leaks. To date, onshore O&G pipelines in China have reached 120,000 km and 50% have been used for more than 30 years. Incidents in 1960-1990 were mainly caused by low-level construction and corrosion. Nevertheless, TPD has become the main cause of pipeline incidents since the 1990s. For example, incidents caused by TPD in the gas trunk line at Sichuan, China accounted for 14.2% of all incidents between 1969 and 1990. This proportion rose to 52.9% after 2000 as the nearby population grew and construction increased, which indicated that additional excavation was conducted. The optical fiber system of the West–East Natural Gas Transmission Project has been destroyed 54 times between 2007 and 2009, and 50 of these cases were caused by TPD. In 2002-2009, Sinopec lost 47,000 tons of oil because of 19,804 thefts by hole drilling into pipelines. From 2006 to 2016, incidents caused by TPD have resulted in over 100 deaths, which negatively impacted the whole society (Peng et al., 2016). When incidents occur, long-lasting pipeline shutdowns can halt production upstream and may reduce output downstream because of supply interruption. If the pipeline is transporting oil, environmental pollution may ensue because of leakage. In the early 1990s, Muhlbauer (1992) added TPD to the basic risk assessment model and distributed weightings to TPD indexes, which are minimum depth of cover, activity level, aboveground facilities, line location, public education programs, right-of-way condition, and patrol frequency. Sljivic (1995) analyzed the causes of TPD systematically and concluded that public education is the primary influencing factor. Additionally, many other methods remain to be commonly used in the field of risk identification; these strategies include Safety Checklist Analysis (Long, 2017), Brainstorming and Delphi sessions (de Bakker et al, 2014; Linstone and Turoff, 1975), Scenario Analysis (Kulba et al., 2017), Preliminary Hazard Analysis (PHA) (Chen et al., 2011; Ericson, 2015), Fault Tree Analysis (FTA) (Jiang et al., 2011; Li et al., 2016; Liang et al., 2012; Zhang et al., 2008; Zhao, 2014), Hazard and Operability Analysis (HAZOP) (Nolan, 2015; Crawley and Tyler, 2015), and Failure Mode and Effects Analysis (FMEA) (Feili et al., 2012; Mannan, 2014). Among the above-mentioned methods, HAZOP is the most effective for process flows and FMEA is the mostly applicable to the fault diagnoses of facilities. The remaining methods are easy to perform for simple issues through straightforward analysis procedures, which are time and cost saving for analysts. However, when these strategies are applied to a complex system with multistate risk factors, their limitations are obvious, as stated below. When a high demand of analysis objects exists in using the Safety Check List, analysts must 2

ACCEPTED MANUSCRIPT

AC C

EP

TE D

M AN U

SC

RI PT

implement numerous forms, which increase the workload and uncertainty introduced by the different knowledge levels and experiences of the staff. Brainstorming is more suitable for simple and goal-oriented tasks. Otherwise, the analysts need to split the problem into smaller manageable parts and then discuss in sequence. However, this process involves heavy mental work and is time consuming. The Delphi method may entail a few to many hundreds of analysts within the industry and beyond when addressing a complex issue. No exact requirement exists for the number of attendees, and whether such attendees’ opinions converge to objective reality is difficult to judge. Scenario analysis is a visualized qualitative prediction method that describes future states by identifying key factors influencing the future. However, given its defect of tunnel vision†, this strategy must be adopted along with other methods. PHA is generally used in the initial risk study during the early stage of a project or as a complete risk analysis for a simple system to identify all potential hazards and unintended events that may lead to an accident. Nevertheless, hazards must be foreseen by analysts, and the effects of interactions between hazards are not easily recognized. Considering FTA’s advantage of graphic intuition in determining the causal factors of incidents, FTA has become the most widely used method by researchers for identifying the main reason for TPD-caused incidents and calculate the probability of the top event. However, experienced experts are needed to build a tree, and with the arising complexity of a system, the difficulty of the modeling process also increases. The states of risk factors can only be defined by a binary relation, which involves an obvious subjectivity and some differences from practice. In conclusion, these methods rely overly on the background and experience of analysts and cannot practically address the complex and multistate risk factors of TPD. Compared with the methods mentioned above, the Bayesian network (BN) is a more flexible and powerful tool for knowledge representation and reasoning under conditions of uncertainty (Cai et al., 2017; Lee et al., 2009). As such, the BN is more suitable for analyzing TPD issues. This method is widely used in many areas, e.g., risk analysis, maintenance, and fault diagnosis. Weber et al. (2012) presented a detailed summary of BN applications in their overview paper. The BN is very helpful for risk identification. For instance, Øien (2001) developed a BN model that integrates organizational risk indicators to identify the root causes of incidents. Bhandari et al. (2015) applied the BN to investigate different risk factors of blowout accidents during drilling. Xin et al. (2017) adopted the BN to realize the dynamic hazard identification and scenario mapping of fire and explosion. Furthermore, the BN can realize the prediction of incidents by probabilistic calculation of variables (Heckerman, 1997) and failure rates of safety barriers (Li et al., 2016). Considering real-time updated knowledge, the BN can also be adopted for dynamic risk assessment (Kalantarnia et al., 2009). Therefore, the analysis of TPD by using the BN in this paper can be a basis for future quantitative analysis, i.e., diagnoses and prediction of incidents. Pipeline damage caused by TPD can be entirely prevented if risk factors can be recognized and addressed early. Because human behaviors are extremely difficult to predict and control, risks arising from TPs are complex and extraordinarily random and hence challenge the management of these related uncertain risks. Nevertheless, to ensure the proper risk assessment and risk mitigation of TPD, scholars must initially comprehensively identify the risks arising from TPs by using the BN. This topic is the focus of the present paper.

† Tunnel vision refers to a narrow view of the world from the tunnel. It is used to describe the deviation from the actual process of the prediction by using scenario analysis.

3

ACCEPTED MANUSCRIPT To determine the object of risk identification, we structured the remaining parts of this paper as follows. Section 2 presents a brief introduction of the research method applied and highlights its application scope. Section 3 analyzes incidents in detail and identifies possible risks. Section 4 develops the BN model. Section 5 discusses the features and the possible applications of the proposed methodology. Lastly, Section 6 summarizes the main findings of this study and provides proposals for further research.

Method and application scope

RI PT

2

2.1 Applied method

AC C

EP

TE D

M AN U

SC

1. The data collection from multiple sources, such as EGIG, PHMSA, and UK TRANSCO, is shown in Appendix A. Literature study of TPD on pipelines (mainly described in Section 1) was conducted to determine the relevant causes and contributing factors identified for TPD risk analysis. The statistics and literature study performed highlight some factors that can influence pipeline safety operation with respect to TPD-caused incidents, which fall under the following categories:
Possible interference of facilities and equipment: excavating equipment, agricultural machinery, vehicle, piles, dredger, and anchor (for pipelines crossing rivers)
Factors that influence the accessibility of TP approaching pipelines: legislation and law enforcement, and public safety consciousness; artificial barriers (fence, dam, ditch, and fortifications), natural barriers (tree, river, stream, and rock), depth of cover, warning signs along the pipeline, patrol frequency and efficiency, alarm response, geological conditions (soil, concrete or stone-block paving), and pipeline lay condition
Ground activity level (affected by the location of pipeline): population density, nearby construction work, traffic, underground facilities, and anchorage area 2. A typical TPD prevention mechanism was described for a gas transmission pipeline project in China. Incident investigations were reviewed and analyzed and staff members working around the area were interviewed to search for other unidentified risk factors and evidence of how weaknesses in pipeline management or what kind of rough surroundings contribute to a TPD-caused incident. The description of the prevention mechanism was based on a document review that included the pipeline integrity management manual, pipeline section criteria, operational records, and pipeline laying plans. These materials contain important information about the basic attributes of pipelines, the environment, and the management flow of the pipeline. The incident investigations were also examined to understand risk evolution and hence track the final hazards. Personnel involved in the management department and the site security control center were interviewed when our first author was impeded by confusion from the material proposed and the description of incident evolution in a report. The findings from the interviews were integrated with the incident analysis described in Section 3. 3. A causal relationship model was developed on the basis of the findings synthesized above and the Bayesian theory. The BN is a directed acyclic graph (DAG) that includes parent nodes and child nodes corresponding to random variables and directed arcs that represent the influence links between variables (Charniak, 1991). Parent nodes denote causes, and child nodes represent the effects. The core of the development of a BN model is to identify variables and map logical 4

ACCEPTED MANUSCRIPT

3

M AN U

SC

RI PT

relationships between these variables. Kjærulff and Madsen (2008) provided a step-by-step tutorial of the BN model construction in their book, which is instructive and very helpful to beginners. BN can explicitly reveal the probabilistic dependence between the variables and the related information flow (Villa et al., 2016), which is also called the conditional probability. We can get the conditional probability of any state of a variable by knowing prior information of its cause variable in the DAG. This prior information (also known as evidence) can come from different sources, such as expert judgment, observation or experiences. In the current work, we mainly focus on the development of a BN model. So subjective prior probability based on the previous statistics and the incident description is used in the model verification. The detailed analysis of step three is described in Section 4. Application scope To analyze the threat situation arising from TP closely and acquire the relevant basic knowledge, the authors have reviewed the distribution of TPD-caused incidents in different areas. However, given strong regional features, i.e., the influence arising from TPD is highly dependent on the natural and social environments nearby besides the difficulty in collecting detailed TPD-caused incident reports of other areas; the scope of the analysis in this paper is limited to the base of Chinese experience. The acquired reports can aid the thorough understanding of risk evolution, which is the foundation for tracking final hazards. Although the current work is limited to the certain scope, it can be equally applied to other areas through the same analysis procedure to adjust the risk-influencing factors and consequences involved in the BN model.

Incident analysis

AC C

EP

TE D

An incident analysis of real pipelines was performed to outline the general features of the involved pipelines and the incidents’ likely causes and consequences. The location class is an important consideration when identifying the sources of TPD; this consideration involves the density of the population and buildings along a pipeline. The definition of this term differs across different countries because of the different national conditions and technology levels. In general, four location classes exist for a gas transmission pipeline. Given below are the definitions of location classes in ASME B31.8 (2013), which is popular in European and North American countries. By contrast, China adopts the national standard GB 50251-2015 (2015), and Russia uses the standard SNIP III-42-80 (1980). TPD-caused incidents usually occur in class 3 and 4 areas.
Class 1: The location within 1,609 meters of the pipeline is sparsely populated or contains no more than 10 dwellings.
Class 2: The location within 1,609 meters of the pipeline contains more than 10 but fewer than 46 dwellings.
Class 3: The location within 1,609 meters of the pipeline contains more than 46 dwellings, but the population density is lower than that of class 4.
Class 4: The location within 1,609 meters of the pipeline contains prevalent buildings with four or more stories aboveground. Incident reports are related to the Shaanxi–Beijing gas transmission pipeline project, which is from Shaanxi Province, China to Beijing City, China. This project includes four main lines (Line 4 is still in construction) and thirteen sublines crossing 589 location areas of classes 3 and 4 in total. The basic attributes and the map of Shaan–Jing pipelines are shown in Table 1and Figure 1. 5

ACCEPTED MANUSCRIPT Table 1 Basic attributes of Shaan–Jing pipelines Throughput

Length

Diameter

Operating

(km)

(mm)

pressure (MPa)

Line 1

913.5

∅660

6.4

Line 2

850

∅1016

Line 3

950

∅1016

Year in

grade

operation

36

X60

1997

183

10

120

X70

2005

139

10

150

X70

2010

144

(10 3

m /year)

class 4 areas crossed

M AN U

SC

RI PT

Line

No. of class 3 and

Steel

8

Figure 1 Map of Shaan–Jing transmission pipelines

Communication Fiber

AC C

EP

TE D

As an important part of pipeline real-time detection and monitoring system, optical fibers are laid above the pipeline (Figure 2). The optical fiber vibration sensor can measure external induced vibration. When the vibration frequency is higher than a specified threshold, the system launches an alarm to the control center. Besides, if the fiber is damaged, the system can also immediately instigate an alarm and simultaneously locate the damage site. As a result, the maintenance workers can take actions to prevent further damage. In this analysis, besides common TPD-caused failure types, such as rupture and puncture, failures of supporting optical fiber facilities are also included in the pipeline failure types. Figure 3 shows an example of optical fiber failure caused by canal excavation.

PC Terminal

Signal Processor Sensing Fiber

Ground Soil

Pipeline

Figure 2 Pipeline with optical fiber monitoring system

6

ACCEPTED MANUSCRIPT

RI PT

Figure 3 A sketch of optical fiber broken failure

AC C

EP

TE D

M AN U

SC

In 2006-2016, 37 incidents, including leakages, broken optical fiber, and pipeline hanging occurred on the Shaan–Jing pipelines, and 33 of these incidents were caused by human activities. A brief description of these incidents is shown in Appendix B. The proportion of incidents per cause over the last 10 years is given in Figure 4 (a). Excavation was identified as the main cause of TPD failures, followed by construction work. The proportions were 49% and 24%, respectively. Meanwhile, the proportions of failures caused by farming and natural disasters were almost the same at 13% and 11%, respectively. The Shaanxi Province and Shanxi Province are historical and cultural cities; grave robbery appears to be a new hazard to pipelines in these areas and should be considered in prevention work. In Figure 4 (b), broken optical fibers are apparently the dominant incident type (85% of all failure types). This observation means that preventing this type of incident should be prioritized. The optical fiber system can provide early-warning signals of machinery hits, usually by vibration signals. If maintenance workers respond timely and stop the behavior of TPs immediately, further damage, i.e., Lea., can be prevented. Otherwise, Lea. would occur. This event explains the three Lea. incidents in the statistical data. The last Lea. was caused by lightning, which is a low-probability risk and should be recorded in the potential causes list. Hanging pipelines comprised 5% of all the failure types. This failure resulted from the flood in summer and was usually accompanied by broken optical fiber. As shown in Figure 4 (c), Line 2 and Line Yong-Tang-Qing (YQ) were the main failure sites (failure rates of 43% and 30%, respectively). Nearly half of the areas that Line YQ crossed belong to class 3 and 4 areas because of the 320 intersections between pipelines and highways/railways/rivers. These intersections greatly increase the risk of TPD. The construction standard of the early-laid Line 2 was low, and optical fibers were buried above the pipeline with a shallow depth, which can easily be destroyed. For newly constructed pipelines, optical fibers are located at the one o'clock position of the gas pipeline. Additionally, the TPs around Line 2 tended to excavate without informing the gas transmission department and hence break fibers because of the lack of knowledge of the location and buried depth of the optical fiber. The transmission departments of these two lines should systematically analyze the experiences and lessons learned and improve their management to decrease the incident rate. Figure 4 (d) shows that the number of failures per year varied considerably with no clear trend. The peak was reached in 2011, with nine failures. The number of failures dropped to two in 2012, but again rose in 2016.

7

ACCEPTED MANUSCRIPT Natural disasters 11%

Groove robbery 3%

Hanging 5%

Leakage 11%

Farming 13% Optical Fiber Broken 84%

RI PT

Excavation 49%

Construc t-ion work 24%

(a)

(b)

Line 1 5%

Line YQ 30%

9

10

7

5

6

Line 2 43%

4

5 3

3

2

2

1

1

1

M AN U

Line GQ 8%

SC

8

0

0

Line 3 14%

2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016

(c)

(d)

Figure 4 Statistics of the incidents from 2006 to 2016 in terms of a) failure causes, b) failure types, c)

4

TE D

failure sites, and d) failure numbers per year

Development of the BN risk identification model

AC C

EP

Given the literature review and reports, we determined the three possible TPD-related accidental scenarios, namely, failure of optical fiber (FoOP), failure of pipeline (FoP/L), and fire and explosion (F&E). By analyzing the accident evolution, the discrete nodes (variables) in the BN model were extracted. Then, the overall BN model was developed by mapping causal relations between nodes (Figure 5), which includes 9 root nodes, 3 leaf nodes, and 28 intermediate nodes. Table 2 presents a clear perspective of the definitions of nodes and their states. 4.1 Definition of nodes in the BN model 1. FoOP and FoP/L Some behaviors of TP only cause damage to optical fibers; this damage can lead to communication outage and send an alarm to the control center. If the company responds to the alarm quickly, further damage can be prevented, and the broken fibers can be repaired. The pipeline then returns to normal operation soon after. Some other behaviors may result in damage to the outside coating and pipeline rupture. Therefore, two nodes named FoOP and FoP/L were defined (orange ovals in Figure 5). For the variable FoP/L, the states include damage on the outside coating, rupture of pipeline, and intact pipeline. For the variable FoOP, an alarm will be sent upon TP interference regardless of whether the optical fiber is operating or broken. By contrast, some pipelines, such as Shaan–Jing Line 1, are not equipped with optical fiber. Thus, the states include optical fiber giving an alarm, 8

ACCEPTED MANUSCRIPT

AC C

EP

TE D

M AN U

SC

RI PT

optical fiber not giving an alarm, and no optical fiber. Machinery hits, strength of pipeline, and geological disasters resulting from digging are the three main influencing factors of these two kinds of failures. (1) Machinery Hits Direct hits from machinery during excavation, construction, farming and sabotage activities may damage optical fiber and pipelines. The occurrence of this damage depends on the following factors: location of pipeline/OP unknown (LoPL/OP ukn), buried depth unknown (BD ukn), surveillance, telephone alarm system, warning in time, safety protection facilities, and insufficiently trained diggers (ITD). Machinery may hit the pipeline/optical fiber if the TPs are not highly aware of the location and buried depth of the pipeline. This lack of knowledge about the location may be caused by the lack of communication between the pipeline company and the TPs (LoC bet. P/L C & TPs), inadequate maps about the pipeline (IM fm. P/L C), and the lack of warning signs. LoC bet. P/L C & TPs is also the cause of buried depth unknown.Warning Signs, including mile stake, turning point stake, crossing stake, intersecting stake, warning board, and warning tape, should be installed along the pipeline. These signs must be complete and clear to prevent TPD effectively. Besides, warning signs are at risk of damage from external interference, e.g., cars, wildlife, and growth of plants. a) Surveillance and telephone alarm system, along with warning in time, can maximally reduce the risk of machinery hits by providing real-time information on the pipeline, offering risk warning information, and stopping further damage immediately. A communication network (CN) similar to optical fiber and cameras supports the operation of a surveillance system. On one hand, once pipelines break, managers cannot obtain real-time information. On the other hand, the inability to access real-time information indicates that TPD is in progress, and the system locates the damage location immediately to halt further destruction. Telephone alarm system help managers confirm pipeline accidents rapidly. Extensive propaganda to inform people through the one-call system and feedback in time are effective in handling accidents and reducing loss. Patrollers are responsible for maintaining the pipeline and the pipeline’s ancillary facilities and supervising construction activities around the pipeline. These workers are required to address potential accidents and report timely. The inspection frequency, expertise of the patrollers, and the perfection of the patrol system crucially impact the efficiency of the guard and patrol of a pipeline. The effectiveness of surveillance system and patrollers can help to facilitate the warning in time. b) Safety protection facilities refer to the external facilities or structures that protect the pipelines from damage. These facilities include the cement baffle of buried pipelines, the fence of the valve room of ground pipelines, and the hydraulic protection facilities for pipelines crossing water areas. These structures can protect pipelines against external damage effectively. The facilities are at risk of damage from external interference and are maintained by patrollers. c) TP diggers should be trained to be skillful in operating machineries and should master the location of pipelines and their safety protection facilities. When the digging work begins, the TP diggers are required to submit to the control of pipeline managers and maintain communication with the latter. Otherwise, insufficiently trained diggers greatly augment the risk of damage. (2) Strength of Pipeline 9

ACCEPTED MANUSCRIPT

AC C

EP

TE D

M AN U

SC

RI PT

Service time, pipeline quality, and wall thickness are three factors that influence the strength of pipeline. Pipelines are constantly subjected to various adverse factors throughout its long service life. These adverse factors include fatigue, environmental corrosion, and material aging, which render pipelines weak and easily destroyed. If the material quality or soldering quality of a pipeline is poor, the pipeline cannot resist surface stress and likely cracks. In particular, when progressive urbanization leads to a great increase in the number of vehicles above a pipeline, the pipelines suffer from additional external pressure. Failure more likely ensues in pipelines with thin than thick wall thickness. The strength against external forces of pipelines with thin wall thickness is relatively low and susceptible to surface activity; thus, such pipelines become damaged by a TP. The wall thickness usually depends on the pipeline transport abilities. Long-distance pipelines with large diameter has thick wall to undertake the pressure caused by large capacity and vice versa. Pipeline company management includes the management of pipelines and ancillary facility (warning signs, telephone alarm system, safety protection facilities, pipeline quality, service time and CN), personnel management (patrollers) and the communication with the TPs. The pipeline company should provide adequate maps to diggers and keep in touch with the TPs (IM fm. P/L and LoC bet. P/L & TPs). (3) Geological Disasters Geological disasters arising from TPs, such as landslides, collapse, land subsidence, and debris flow, can destroy pipeline infrastructure and ancillary facilities and thus cause explosion, suspending, deformation, or even rupture of pipelines. These damages may be due to improper planning of digging, bad weather, and poor surrounding geological conditions (SGC). The TP should create a detailed digging plan based on its own communication with the pipeline company with consideration of the pipeline condition before starting an excavation. Unstable geological conditions, such as crushing surfaces and loose soil structures, are vulnerable to external forces and easily cause geological disasters. Heavy rain and storms are triggers of debris flow. Thus, digging should avoid this bad weathers or adopt extra protective measures to reduce risk. The behavior of a pipeline company and the TPs are controlled by laws and regulations drafted by the government. Powerful laws and regulations should specify the rights, obligations, and responsibilities of each party and provide detailed pipeline protective measures. Meanwhile, the laws and regulations should be strictly enforced by local governments to maximize their own role in constraint and guidance. Otherwise, thy are insufficient. 2. F&E The initial event of F&E is leakage. The trigger event of F&E is ignition. The final consequences of F&E are economic loss, casualties, and pollution. (1) Leakage Machinery hits may release a sufficient force to break pipelines directly and cause leakage. Depending on the leak duration, the states can be divided into two types, i.e., instantaneous leakage and continuous leakage, which are related to the phase, pressure, and temperature of the leak material. A continuous leak refers to a steady leak sustained over long periods of time and is usually caused by cracks in a pipeline. By contrast, an instantaneous leak refers to a sudden leak of a large 10

ACCEPTED MANUSCRIPT

AC C

EP

TE D

M AN U

SC

RI PT

amount of material within a very short period, and this occurrence may result from a rupture of a pipeline. In the case of further dispersal or even ignition, a fire or an explosion may occur and cause extreme consequences. A natural gas leak is primarily an acute hazard because of the instant formation of gas cloud in this case. When ignited, this leak transforms into a jet fire or a fireball and endangers the spill site rapidly. For oil pipelines, leak oil can form a liquid pool in low-lying areas. Such pool highly likely results in a pool fire upon ignition. For the pipeline transfer of pressurized liquefied gas, e.g., LNG, in the presence of Lea., a sudden change of pressure causes a strong phase transformation of the liquid gas. The evaporated vapor from boiled liquid causes flash fire or even explosion. (2) Ignition The number of ignition sources depends on the people in vicinity and the normalization of repair tools. The location area class of a pipeline and the repair workers in the vicinity influence the probability of ignition and the people present. If the pipeline is located in a place with high-density population and buildings or with many workers on site, many sources can produce a spark, such as live electric wires, vehicle exhausts, naked flame from smoking, and use of mobile phones. The Fire/explosion-proof tools are required in repair work not to create sparks, because even a small spark can cause a fire or an explosion. Detection in time plays a very important role in repair and emergency management. A leakage can continue for a long time in the absence of available detection technology or if the people present do not report the leakage in time. As a result, the economic loss and the probability of ignition rise. Through detection, the situation can be evaluated with respect to leakage location, gas concentration, and area of influence. Appropriate repair actions can then be taken and warnings of danger can be given to the people present, who will then be evacuated. (3) Economic Loss, Casualties, and Pollution Three kinds of failure types exist as follows: broken optical fiber, damage to the outside coating, and pipeline rupture. The first two failure types usually cause only economic loss because of the repair required, whereas the last type can lead to O&G leakage. If ignited, the leakage would result in fire or even explosion, which severely threatens the environment and personnel security. The states of economic loss, casualties, and pollution should be defined with reference to the classification of accident severity, namely, serious, major, large, and general. For example, a serious accident refers to an accident causing more than 30 deaths; more than 100 injuries; over 15 million dollars of direct economic loss; Pollution that gravely affects the production and living quality of a community, for instance, polluting drinking water; and over 50 thousand people to require evacuation. However, the main point of this model is to calculate the probability of the occurrence and not to determine the magnitude of the consequence. We chose the binary variables, True and False, to maximally simplify the quantification and avoid an excessive number of states. Then, three nodes were defined, including six possible states, namely, Economic Loss (True/False), Casualties (True/False), and Pollution (True/False), to represent the final consequences of pipeline failures. The severity of casualties depends on the people present during the F&E scene, which is influenced by the pipeline location class, repair workers in vicinity, and warning of danger. A proper emergency preparedness and response (EP&R) system can provide warning of danger and evacuate the people present. Emergency preparedness includes planned emergency procedures and measures based on 11

ACCEPTED MANUSCRIPT historical accidents. A proper preparedness must be improved constantly by regular emergency exercises and ensure that the emergency team is familiar with the emergency procedure. Once an accident occurs, an instant and proficient emergency response is needed to the reduce risk. 4.2 Case study

AC C

EP

TE D

M AN U

SC

RI PT

To supplement the structure of the proposed model, this work conducted a case study based on incident reports. A leakage incident occurred on Line 1 on June 3, 2006 in Shaanxi Province, China because of excavation. Villagers nearby used a loader to dig soil from 7 m of pipeline for their own road renovation and finally ripped the pipeline. Their activities caused two scratches and one crack (length, 7 cm; width, 4 mm) in the pipeline, which resulted in a leakage of 220,000 m3 of natural gas. Investigations of this incident are summarized as follows:
The first O&G pipeline ordinance was enacted in 1989 in China, but its legal force was weaker than that of formal law. In 2010, the first O&G pipeline protection law was implemented. Regulations existed when the incident occurred but were insufficient.
Line 1 laid here was near the Changhaize village (only 70 m from the nearest dwelling) and crosses a road (class 3 area). The diameter and wall thickness of this pipeline were 660 mm and 7.14 mm, respectively. The pipeline itself was in good condition but was not equipped with optical fibers.
More than four lines, including Line 1, Line 2, and other pipelines, were located in this area. Many of the villagers participated in the construction work of pipelines and were aware that the pipelines were located in the area. However, the villagers did not report their digging work to the gas transmission department before beginning.
Warning signs were insufficient and buried in a shallow depth (only 0.28 m) and hence easily destroyed.
Three patrollers without regular training were responsible for this segment. On one hand, while finding the digging work, the patrollers did not stop nor provide villagers with pipeline maps. On the other hand, the patrollers did not report the situation to the gas transmission department until after 35 min.
The training process of the gas transmission department was extremely poor that almost all patrollers operated without sufficient knowledge on the pipeline.
The emergency response from the department was proper with no casualties. The cut-off valve stations upstream and downstream were closed instantly. Compressors upstream were set up to reroute gas to Line 2 and ensure normal supply to downstream users. Compressors downstream were assembled to reduce the pressure in the damaged pipeline from 4.1 MPa to 2.5 MPa, and then, the pressure was lowered further to 0.3 MPa by emptying the line from gas. Finally, the pipeline was repaired using proper tools and technologies. The evidence from the above investigation was extracted and inputted into the BN model. The result is shown in Figure 6, through the flow path developed in the model, digging from TPs without informing the gas transmission department, combined with late warning resulting in leakage. However, given the proper emergency measures, the leakage was stopped timely and did not result in more serious consequences, such as F&E. The details in the incident report provided empirical support for the accuracy and rationality of the logical relation in the model. The outcome of the BN model was then compared and agreed with the ultimate scenario described in the report. 12

ACCEPTED MANUSCRIPT Table 2 Definition of variables in the BN model Nodes

States Damage on the outside coating

Failure of pipelines (FoP/L)

Rupture of pipeline Pipeline intact Optical fiber giving an alarm Optical fiber not giving an alarm No optical fiber

RI PT

Failure of optical fiber (FoOP)

Jet fire/Fireballs/Flash fire/Pool

Fire and explosion (F&E)

fire/Explosion/None True/False

Pollution

True/False

Casualties

True/False

External interference

True/False

Laws and regulations

Powerful/Insufficient

Weather

Good/Bad

Surrounding geological conditions (SGC)

Good/Bad

M AN U

SC

Economic loss

Pipeline location classes

Class 1/Class 2/Class 3/Class 4

Repair workers in vicinity

Many/A few/None

Failure detection in time

True/False

Emergency preparedness and response (EP&R)

Proper/Bad

Wall thickness

Thick/Thin

Machinery hits

Excavation/Construction/Farming/Sabotage

Geological disasters

Strong/Weak

TE D

Strength of pipelines

True/False

Location of pipeline unknown (LoPL/OP ukn)

True/False

Buried depth unknown (BDukn)

True/False

Surveillance

Working/Not working/none

Warning in time

EP

Telephone alarm system

Working/Not working/none True/False True/False

Service time

Long/Normal

AC C

Safety protection facilities Pipeline quality

Good/Poor

Planning of digging

Good/Poor

Insufficient training diggers (ITD)

True/False

Warning signs

Sufficient/Insufficient

Inadequate maps from pipeline company (IM fm.

True/False

P/L C) Lack

of

communication

between

pipeline

company and TPs (LoC bet. P/L C & TPs )

True/False

Communication network (CN)

Working/not working/none

Patroller

Working/not working/none

Pipeline company management

Good/Poor

Behavior of TPs

Good/Bad 13

ACCEPTED MANUSCRIPT Continuous/Instantaneous/None

Repair

Proper/Improper

Ignition

True/False

Warnings of danger

True/False

People present

Many/A few/None

AC C

EP

TE D

M AN U

SC

RI PT

Leakage

14

AC C

EP

TE D

M AN U

SC

RI PT

ACCEPTED MANUSCRIPT

Figure 5 Overall BN model of TPD-caused failures of pipelines

15

AC C

EP

TE D

M AN U

SC

RI PT

ACCEPTED MANUSCRIPT

Figure 6 BN results of the case study

16

ACCEPTED MANUSCRIPT 5

Discussion

AC C

EP

TE D

M AN U

SC

RI PT

The BN model of TPD caused failures (presented in Figure 5 in section 4) was developed with the purpose of being a practical and usable model to present a graphical demonstration of inter-relationships and to provide the basis for the future dynamic risk analysis. If we compare our BN model with the previous research on TPD then the main implications are the following three features. First, we made further improvement by considering two additional scenarios, FoOP and F&E. As discussed in Section 3, broken optical fibers are the dominant incident type (85% of all failure types). There are 8 F&E accidents initialized by TPD according to the statistics in Appendix A. Taking the accident occurred in Belgium on July 30, 2004 as an example, a construction machine broke the gas pipeline directly and resulted in an explosion, which caused 23 deaths and 132 wounded or burned. Apparently, the low-probability major accidents lead to grave consequences. Therefore, it’s essential to add these two scenarios into the model. Second, the BN model can practically address the complex and multistate risk factors of TPD. The states of TPD risk factors defined in the previous work are binary, e.g., {True, False} for all variables. In the BN model, the states of risk factors can be defined closer to practice. But we have deliberately concentrated on defining an optimum number of states to avoid ending up with too much quantification (such as the definition of economic loss, casualties, and pollution in Section 4.1). Third, the proposed model can be applied to identify risk using previously reported incidents further as well as estimate potential incident frequencies and consequences. By using conditional probabilities (CPs), the BN can realize quantified inference and reasoning, even the information is limited and incomplete (Villa et al., 2016). The whole model is easy to update when giving new information. The demonstration of this feature is the following work of our research but it has been demonstrated in many BN-based risk evaluation papers as mentioned in the Introduction. When compared with the relatively data-rich fields, such as the operational risk analysis in chemical process industry and for offshore installations, the application of BN theory in pipeline risk evaluation starts late. But with the aid of statistics in EGIG and PHMSA, the outcome is still fruitful (Kabir et al., 2016; Wang et al., 2017; Wu et al., 2015; Zarei et al., 2016). However, almost all the databases and the researchers considered TPD as one of the causes of incidents instead of clarifying the types of TPD. It’s comparatively rare to adopt BN theory in the investigation of risks initialized by TPs. To support our research, we spend considerable effort taking TPD related incident data statistics and analysis. The outcome shown in the Appendixes can be a good reference for the TPD research. The limitations of the proposed model should be viewed in light of the purpose of our work. In this phase, we are inclined to discuss the TP related risks qualitatively and exploring risk-reducing measures by comprehensive identification of risk factors to improve the safety of pipelines. Thus, a model has been established by using extensive resources in the investigation of the possible causes. One consequence of this is that the calculation of CPs in the next phase is increasing greatly. Therefore, if the purpose of the next phase is to quantitatively calculate the occurrence probability of incidents, it’s necessary to weigh the importance of risk factors and optimize the model. Furthermore, in order to enable the dynamic performance, only variables generating real-time data like surveillance can be selected to conduct the risk analysis. The case study in Section 4.2 indicates that when the active defense (warning signs and 17

ACCEPTED MANUSCRIPT

Conclusion and further research

SC

6

RI PT

patrollers) fails, the passive defense (EP&R) can still prevent the most serious accident if it can start normally. This inspires us to propose dual assurance for risk mitigation of TPD. First, weaknesses or gaps in the management system can be identified by learning from incidents as that performed in the present study. Incidents are not merely the events that result in leakage but also the precursor events, such as the broken optical fiber, of a leakage. This manner is called the reactive approach. Second, learning from the past is insufficient for comprehensively preventing incidents. The surroundings of pipelines can be altered constantly, and these changes may bring new risks. This occurrence prompts the proactive approach of incident prediction. This approach can be realized by capturing the risk variation on the basis of continuous surveillance of the pipeline. The proactive approach can help to improve pipeline safety continuously by providing new risk information to the traditional risk analysis system (Khan et al., 2016). Therefore, this strategy enables dynamic risk analysis.

6.1 Summary

AC C

EP

TE D

M AN U

In this paper, we focused on the risk identification of TPD on pipelines as the first main step of risk assessment. TPD arising from residents or companies is the greatest threat to the safe operation of pipelines as shown by incident data from the United States, Europe, and China, particularly, in and around cities and towns. Risks arising from TPs are complex, and every causal variable may hold several states. Considering the flexibility and ability to use information from multiple sources, the BN was adopted to analyze the causal relationship between different variables. Literature review combined with analysis of pipeline incident reports was conducted to provide additional information about causes and consequences. Then, the development of a BN model for failure caused by TPD was described in detail. A case of leakage was investigated by inputting the identified root causes in the accident report to verify the adaptability of the generic model. The outcome agreed with the description in the accident report. Dual assurance derived from the developed methodology can guarantee the safe operation of pipelines. The advantage of the BN model is reflected in this dual assurance strategy: risk identification using historical incident data and continuous estimation of potential incident frequencies and consequences by giving new risk information. Although efforts have been exerted to reduce leakage, pipeline damage incidents remain because of the risk arising from frequent TP activities. This study identified the main causes of TPD, and further risk reduction measures directed for these causes should be implemented properly. 6.2 Future work

The work in this paper corresponds to the most basic part of an entire risk analysis of TPD. Given the qualitative risk identification of TPD on pipelines, future work would utilize the inference and reasoning mechanism of the BN to predict the risk evolution tendency and diagnose the most likely causes. Most of TPD variables, such as resident awareness and pipeline surroundings, are excessively abstract to be quantified; thus, a semi-quantitative assessment using the index scoring method is suitable for these causes. For machinery hits that can generate real-time vibration signals, quantitative analysis and dynamic analysis can be performed. Besides, 18

ACCEPTED MANUSCRIPT the statistics of incidents caused by different hits can serve as information for the distribution of prior probabilities. The conditional probability will be determined with the help of expert judgment. The next step is dedicated to confirm the prior probabilities and build conditional probability tables.

Acknowledgement

RI PT

This research was partly carried out in the Department of Marine Technology at Norwegian University of Science and Technology (NTNU) and supported by the Science Foundation of China University of Petroleum, Beijing (No.2462015YQ0406). The authors are grateful for the valuable suggestions of reviewers.

SC

References

ASME. ASME B31.8: gas transmission and distribution piping systems. New York. The American Society of Mechanical Engineers, Three Park Avenue. 2013.

Bhandari, J., Abbassi, R., Garaniya, V., Khan, F., 2015. Risk analysis of deepwater drilling operations using

M AN U

Bayesian network. Journal of Loss Prevention in the Process Industries.38, 11-23.

Cai, B., Huang, L., Xie, M.,2017. Bayesian networks in fault diagnosis. IEEE Transactions on Industrial Informatics.99, 1-1.

Charniak, E., 1991. Bayesian networks without tears. AI Magazine. 12(4), 51-63.

Chen, X.K., Zhu, H.L, Chen, J.Q., 2011. Hazard identification and control in the pre-blasting process. Journal of Coal Science & Engineering. 17(03), 331-335.

Crawley, F., Tyler, B., 2015. HAZOP: Guide to Best Practice (Third Edition): Guidelines to Best Practice for the

TE D

Process and Chemical Industries. Elsevier B.V..

de Bakker, K., Boonstra, A., Wortmann, H., 2014. The communicative effect of risk identification on project success. International Journal of Project Organisation and Management. 6, Nos. 1/2, 138-156. EGIG, 2015. 9th Report of the European Gas Pipeline Incident Data Group (period 1970-2013). p.22-26. Ericson, C.A., 2015. Hazard Analysis Techniques for System Safety. John Wiley & Sons. p. 125-144.

EP

Feili, H.R., Akar, N. Lotfizadeh, H., Bairampour, M., Nasiri, S., 2012. Risk analysis of geothermal power plants using Failure Modes and Effects Analysis (FMEA) technique. Energy Conversion and Management.72,69-76. GB 50251-2015, 2015. Part 4.2: Location classification and determination of design factors. Beijing. Ministry of

AC C

Housing and Urban-Rural Development. Jihua Precess. Heckerman, D., 1997. Bayesian networks for data mining. Data Mining and Knowledge Discovery, 1(01), 79-119. Hopkins, P., 2008. Learning From Pipeline Failures. Penspen Integrity Virtual Library. ISO 9001, 2015. Quality Management Systems-Requirements. Geneva: The International Organization for Standardization. p.19.

Jiang H.Y., Yao, A.L., Yao, H.Q., Zhang, Z.X., 2011. Sensitivity analysis on risk factors of the third party damage in gas pipeline. Natural Gas and Oil. 29(01),1-4. Kabir, G., Sadiq, R., Tesfamariam, S., 2016. A fuzzy bayesian belief network for safety assessment of oil and gas pipelines. Structure & Infrastructure Engineering. 12(8), 874-889. Kalantarnia, M., Khan, F., Hawboldt, K., 2009. Dynamic risk assessment using failure assessment and Bayesian theory. Journal of Loss Prevention in the Process Industries. 22 (05), 600-606. Khan, F., Hashemi, S.J., Paltrinieri, N., Amyotte, P., Cozzani, V., Reniers, G., 2016. Dynamic risk management: a contemporary approach to process safety management. Current Opinion in Chemical Engineering. 14, 19

ACCEPTED MANUSCRIPT 9-17.Kjærulff, U.B., Madsen, A.L., 2008. Bayesian networks and influence diagrams: A guide to construction and analysis. Springer Science+Business Media, LLC. Kulba, V., Bakhtadze, N., Zaikin, O.,Shelkov, A., Chernov, I., 2017. Scenario analysis of management processes in the prevention and the elimination of consequences of man-made disasters. Procedia Computer Science, 112, 2066-2075. Lam, C., Zhou, W.X., 2016. Statistical analyses of incidents on onshore gas transmission pipelines based on PHMSA database. International Journal of Pressure Vessels and Piping. 145, 29-40.

Journal of the American Statistical Association. 87(420), 1098-1108.

RI PT

Lauritzen, S. L., 1992. Propagation of probabilities, means and variances in mixed graphical association models.

Lee, E., Park, Y., Shin, J.G., 2009. Large engineering project risk management using Bayesian belief network. Experts System with Applications. 36, 5880-5887.

Li, J., Zhang, H., Han, Y.S., Wang, B.D., 2016. Study on failure of third-party damage for urban gas pipeline based

SC

on fuzzy comprehensive evaluation. PLOS ONE｜DOI:10.1371/journal.pone.0166472.

Li, X.H., Chen, G.M., Zhu, H.W., 2016. Quantitative risk analysis on leakage failure of submarine oil and gas pipelines using Bayesian network. Process Safety and Environmental Protection. 103:163-173. Liang, W., Hu, J.Q., Zhang, L.B.,Guo, C.J., Lin, W.P., 2012. Assessing and classifying risk of pipeline third-party

M AN U

interference based on fault tree and SOM. Engineering Applications of Artificial Intelligence. 25, 594-608. Linstone, H.A., Turoff, M., 1975. The Delphi method-techniques and applications. Addison-Wesley Publishing. Long, J., 2017. Research on risk investigation of major fire in buildings based on safety checklist method. Jiangxi Chemical Engineering. 2, 134-140.

Mannan, M.S., 2014. Frank P. Lees’ Loss Prevention in the Process Industries (Fourth Edition): Hazard Identification, Assessment and Control. Butterworth-Heinemann. p. 81-97.

Muhlbaucer, W. K., 1992. Pipeline risk management manual. Gulf Professional Publishing. p. 43-60.

TE D

Nolan, D.P., 2015. Safety and Security Review for the Process Industries (Fourth Edition): Application of HAZOP, PHA, What-If and SVA reviews. Gulf Professional Publishing. p.8-13. Øien, K., 2001. A framework for the establishment of organizational risk indicators. Reliability Engineering and System Safety, 74, 147-168.

Pearl, J., 1988. Probabilistic reasoning in intelligent systems: networks of plausible inference. Series in

EP

Representation and Reasoning. Morgan Kaufmann Publishers. San Mateo, CA. Peng, X.Y., Yao, D.C., Liang, G.C., Yu, J.S., He, S., 2016. Overall reliability analysis on oil/gas pipeline under typical third-party actions based on fragility theory. Journal of Natural Gas Science and Engineering. 34,

AC C

993-1003.

Reason, J., 2000. Human error: models and management. British Medical Journal. 320 (7237), 768-770. Sljivic S., 1995. Pipeline safety management and the prevention of third-party interference. Pipes& Pipelines International, November-December. 40(06), 14-16.

SNIP III-42-80, 1980. Rules for performance and acceptance of work. Main pipelines. Moscow. The USSR State Committee for Construction.

Villa, V., Paltrinieri, N., Khan, F., Cozzani, V., 2016. Towards dynamic risk analysis: A review of the risk assessment approach and its limitations in the chemical process industry. Safety Science. 89, 77-93. Wang, W., Shen, K., Wang, B., Dong, C., Khan, F., Wang, Q., 2017. Failure probability analysis of the urban buried gas pipelines using bayesian networks. Process Safety & Environmental Protection.111. Weber, P., Oliva, G.M., Simon, C., Iung, B., 2012. Overview on Bayesian networks applications for dependability, risk analysis and maintenance areas. Engineering Applications of Artificial Intelligence. 25, 671-682. Wu, S., Zhang, L., Zheng, W., Liu, Y., Lunteige, M.A.,2016. A DBN-based risk assessment model for prediction 20

ACCEPTED MANUSCRIPT and diagnosis of offshore drilling incidents. Journal of Natural Gas Science & Engineering.34,139-158. Wu, W. S., Yang, C. F., Chang, J. C., Château, P. A., Chang, Y. C., 2015. Risk assessment by integrating interpretive structural modeling and bayesian network, case of offshore pipeline project. Reliability Engineering & System Safety. 142, 515-524. Xin, P., Khan, F., Ahmed, S., 2017. Dynamic hazard identification and scenario mapping using Bayesian network. Process Safety and Environmental Protection. 105, 143-155.

using bayesian network. Journal of Hazardous Materials. 321, 830-840.

RI PT

Zarei, E., Azadeh, A., Khakzad, N., Mohammadfam, I., 2016. Dynamic safety assessment of natural gas stations

Zhao, D.Y., 2014. Research on the third-party damage risk factors of west-east gas pipeline. Northeast Petroleum University. p. 25-32.

Zhang, Z., Li, Z.X., Shi, J., 2008. Analysis on third party damage fault tree of long distance oil and gas pipelines.

AC C

EP

TE D

M AN U

SC

Oil and Gas Storage and Transportation. 27(06), 37-40.

21

ACCEPTED MANUSCRIPT

RI PT

Appendix A Table 1 Statistical data of incidents at home and abroad

Data source

Period

Notes

Europe | EGIG [1]

2004-2013

Outside interference 35%:

SC

Activity having caused the incident (e.g. digging, piling, ground works) Equipment involved in the incident (e.g. anchor, bulldozer, excavator, plough)

M AN U

Installed protective measures (e.g. casing, sleeves)

Note: Construction work form TP caused an explosion in Ghislenghien, Belgium on Jul. 30, 2004. And: Corrosion 24% Construction defects 16% Ground movement 13% 2002-2013

TPE (third party excavation) 26.3%

TE D

The USA | PHMSA

[2]

And:

External corrosion 23.7% Material failure 16.8%

Internal corrosion 8.4% TPE 40%

1984-1987

430 TPE caused incidents result in 26 deaths, 148 injuries and $18 million of economic loss

1987-2006

Values in brackets are the proportion for natural gas pipelines

EP

1971-1986

AC C

The USA | DOT

TPE 27.2% (23%) Note: TPD caused 3 separate explosions taking place in New Jersey (1994.03.23), in Bellingham, Washington (1999.06.10) and in Walnut Creek, California (2004.11.10). And: Natural disasters 8.2% (10.3%)

22

ACCEPTED MANUSCRIPT

Other outside forces 2.6% (3.3%) Material failure 14.8% (17.9%) Human error 5.2% (1.4%) Others 23.8% (21.6%) The USA | DOE The USA

[4]

1970-1984

53.5% of the 5872 incidents are caused by TPD

1985-2000

1318 natural gas pipeline incidents Outside corrosion 15.3% Inside corrosion 12.8% Misoperation 7.0% Others 6.8%

M AN U

TPD 27.6%

SC

[3]

RI PT

Corrosion 18.2% (22.1%)

590 TPD caused incidents including 558 damage events and 32 failures:

Grid)

Submarine cable-laying construction 15+0

TE D

UK | TRANSCO (National

Construction 46+0 Demolition 6+0

Drainage 158+9

EP

Farming 7+1

NG operation 96+8 Others 49+4

AC C

Serving work 40+4

Highway construction 30+5 Drainage canal digging 38+1 Malicious destruction 3+0 Unknown 69+0

Canada | NEB

[5]

1991-2008

TPE 6% (TPD usually occurs in high-population density areas whereas the pipeline monitored by

23

ACCEPTED MANUSCRIPT

NEB is in remote areas)

RI PT

And: Crack 38% Loss of metal 25% Material/construction 6%

SC

Geotechnical failure 6% Others 19% 2006-2016

2005-2014[7]

TPD caused incidents have resulted in over 100 deaths

59 natural gas pipeline incidents and 41 oil pipeline incidents consisting of : TPE 61% Thefts 10% Natural disaster 7%

M AN U

China

[6]

Design and misoperation 6% Others 6% 2004-2012[8]

TE D

Corrosion 10%

17 of 28 leakages are caused by TPD TP machinery hits 10 And:

EP

Thefts 7

Geological disasters 3

AC C

Corrosion 2

Material failure 3 Misoperation 1 Others 2

China| East China

1970-1990

TPD 8.3% And: Equipment failure 30.3%

24

ACCEPTED MANUSCRIPT

Corrosion 21.3%

RI PT

Mis-operation 20.5% Material 8.5% Others 11.1% China| South China

[7]

2006-2013

25 in 40 incidents are caused by TPD in Dapeng Gas Pipeline, Guangdong province. And:

SC

Corrosion 8 Natural disasters 8 Design and misoperation 1

South China Product Oil Pipeline (section from Zhanjiang to Guangzhou)

M AN U

2008-2014

91 interference events all arising from TP and two of them caused the damage of pipeline. 2009-2013

Huizhou-Dongguan Product Oil Pipeline

TPE 18 (broke the OP fiber directly) + 3 ( damage of external coating) Illegal tie-up of pipeline 15

Note: TPD caused a chain explosion in Fanyu, Guangdong on May 9, 2010. Chongqing area

[9]

Sichuan gas pipelines + Chongqing gas field

TE D

1980-2004

China| Sichuan and

TPD 7+30=37 13.17% And:

Corrosion 17+ 55=72 25.63%

EP

Weld defects 46 +54 = 105 37.37% Material defects 10+ 0 = 10 3.56%

AC C

Misoperation 2+ 0 =2 0.71% Others 18+37= 55 19.56%

China| Sichuan main gas transmission pipeline

[9]

China| Golmud-Lhasa Line

[10]

1969-1990 2000-2008 1977-2005

TPD 14.2%

TPD 52.9% (5000 illegally occupying points) 7 TPD caused incidents in 10 pipeline failures Machinery hits 5

25

ACCEPTED MANUSCRIPT

Stealing 2

RI PT

Corrosion 1 Weld failures 2 China| Gas Transmission

2000-2008

9 TPD caused incidents in 17 failures

2000-2002

241 O&G thefts:

Department of Southwest Oil China| CNPC

SC

and Gas Branch, CNPC[9]

2002 92 thefts 2002 abortive thefts 35 1993-2002

China| Sinopec

3847 O&G thefts: 1993 1 theft 1996 29 thefts 1998 52 thefts

M AN U

2001 87 thefts

TE D

1999 249 thefts 2000 510 thefts 2001 847 thefts

2002 1387 thefts

Transmission Project

[9]

2007-2009

EP

China| West-East Gas

lost 47,000 tons of oil because of 19,804 thefts 50 TPD caused incidents (OP broken) in 54 failures 2007-24 times;2008 -17 times; 2009-13 times

AC C

2002-2009

[11]

Railway/highway construction 32 Cross construction 2 Farmers’ activities: digging canals/ desilting/ river levee construction/soil digging 12 Stealing 2 Crushed by a running car 1

26

ACCEPTED MANUSCRIPT

Moorburn by farmers 1 Broken by second parties 2; by first party 1 2007-2008

69 TPD caused incidents

Yu-Wan subline

Construction 23 (33.33%)

SC

Road construction 13 (18.84%)

RI PT

Note: TPD caused an explosion in Wuhan on May 15, 2010.

Desilting of river, fishpond and ditch 1 (1.45%) Cross construction 5 (7.25%) Mining 1 (1.45%) Land leveling 1 (1.45%)

M AN U

Tree planting 25 (36.23%)

2006-2008

260 TPD caused incidents

Northern Jiangsu

Construction 52 (20%)

subline

Road construction 82 (31.54%)

TE D

Desilting of river, fishpond and ditch 73 (28.07%) Cross construction 23 (8.85%) Tree planting 1 (0.38%)

Land leveling 10 (3.85%)

EP

Soil digging 4 (1.538%) Bridge erection 5 (1.92%)

AC C

High-tension cable construction 8 (3.08%) Others 2 (0.77%)

2005-2008 the regions of Su-Zhe-Hu

69 TPD caused incidents Construction 109 (16.17%) Road construction 266 (39.47%) Desilting of river, fishpond and ditch 18 (2.67%)

27

ACCEPTED MANUSCRIPT

Cross construction 262 (38.86%) Land leveling 1 (0.15%) Soil digging 2 (3%) Bridge erection 1 (0.15%)

SC

High-tension cable construction 5 (0.74%) Others 3 (0.45%) Transmission Project

2006-2016

[12]

32 TPD caused incidents which have resulted in 31 OP broken with 3 leakages Excavation 18 Construction work 9 Farming 5

M AN U

China| Shaan-Jing Gas

RI PT

Tree planting 7 (1.04%)

[1] EGIG, 2015. 9th Report of the European Gas Pipeline Incident Data Group (period 1970-2013). p.22-26.

[2] Lam, C., Zhou, W.X., 2016. Statistical analyses of incidents on onshore gas transmission pipelines based on PHMSA database. International Journal of Pressure Vessels and Piping. 145,

TE D

29-40.

[3] Wang, Y.M., 2000. Accident analysis on abroad natural gas pipeline. Oil and Gas Storage and Transportation. 19(7).p.5-10. [4] Kolovich C. E., Haines, H., 2004. Analysis of US Liquid and Gas Incident Data. International Pipeline Conference. Calgary, Alberta, Canada. P. 2679-2687. [5] National Energy Board,2010. Focus on safety: A comparative analysis of pipeline safety performance 2000－2008[R]. Calgary: National Energy Board.

Science and Engineering. 34, 993-1003.

EP

[6] Peng, X.Y., Yao, D.C., Liang, G.C., Yu, J.S., He, S., 2016. Overall reliability analysis on oil/gas pipeline under typical third-party actions based on fragility theory. Journal of Natural Gas

AC C

[7] Liang Y.K., Yang F.M., Yin Z.Q., Chen B.J.,2017. Accident statistics and risk analysis of oil and gas pipelines. Oil & Gas Storage and Transportation. 36(4), 472-476. [8] Di,Y., Shuai, J.,Wang, X.L., Shi, L.,2013. Study on Methods for Classifying Oil &Gas Pipeline Incidents. China Safety Science Journal. 23(7),109-115. [9] Project report of study on the third-party damage of West-East gas transmission project, 2008. [10] Lv,H.Q.,Li,J.F.,2005. Cause and prevention of pipeline third party interference. Natural Gas Industry. 25(12), 118-120. [11] Outlook, 2010. Energy arteries is threatened by growing crisis and who is going to protect these seventy thousand kilometers of pipelines. Safe and Health. 17(9), 38-39. [12] Incident reports from Shaan-Jing gas transmission project, 2006-2016.

28

ACCEPTED MANUSCRIPT Appendix B Table 2 Statistics of Incidents caused by TPD for Shaan-Jing pipelines during 2006-2016 When

Where

Direct Cause

Consequences

Incident Type

2006.06.03

Line 1

Excavation

Vent gas amount:

Leakage

3

Villagers dug up soil above the

220,000m

Yulin compressor

pipeline to build their own road

station)

when they have known the location of pipeline.

Line 2

Farming

Optical fiber

Optical Fiber

(S3P741+30m)

Farmers used rotary cultivator for

communication

Broken

farming and damaged the fiber.

outage: 3h30min

The buried depth of fibers is only 0.85m and is quite shallow. Construction Work

(S1P0313+800m)

A municipal road and bridge

Optical fiber

Optical Fiber

communication

Broken

M AN U

2008.10.09

Line 2

SC

2007.03.24

RI PT

(530m away from

construction unite used a bulldozer

outage: 17h

to work above the pipeline and broke the optical fiber. 2009.04.07

Line 2

Excavation

Optical fiber

Optical Fiber

(near Yongqing

Construction company dug deeper

communication

Broken

relay station)

canal than the depth allowed before

outage: 3h

without authorization and broke the

Excavation

Optical fiber

Optical Fiber

(40m away from

Construction company used large

communication

Broken

Yongqing relay

excavator for digging canals

outage: 2h50min

station)

without informing gas transmission

EP

2009.04.07

TE D

fiber.

Line 2

department

Line 2

Excavation

Optical fiber

Optical Fiber

(S2-1516+300m)

Villagers violated construction

communication

Broken

agreement and used pickaxes to dig

outage: 6h37min

AC C

2009.06.03

2009.10.11

2009.11.30

Line Gang-Qing

canals for a vegetable greenhouse without

guidance from gas

transmission department. Vent gas amount:

Construction Work

Leakage

3

(P3P-0011+400m

Use of possible equipment such as

700,000 m

)

jackhammer caused depression of

Economic loss:

pipeline.

CNY 1,981,800

Line 2

Excavation

Optical fiber

Optical Fiber

(S3-0619+10#

Villagers used excavator to dig

communication

Broken

pole)

water canals without informing gas

outage: 5h45min

transmission department.

29

ACCEPTED MANUSCRIPT Table 2 (continued) When

Where

Direct Cause

Consequences

Incident Type

2010.05.04

Line

Lightning

Direct economic

Leakage

Yong-Tang-Qin

15 # valve chest was struck by

loss: CNY

(15# block valve

lightning with intensity 191kA in

5,893,490

station)

the morning; misoperation during repair caused cracks on valve and

Construction Work

Pipeline

Province

Construction Company conducted

shutdown

(F2-1085＋20m)

work without permitsion from the

duration: 10h,

pipeline company and damaged the

Vent gas amount:

pipeline.

470,000 m3

Line 2

Excavation

(S1-0259/-100m)

SC

2010.10.22

Line 1 in Shanxi

Leakage

Optical fiber

Optical Fiber

Optical fiber is exposed outside the

communication

Broken

security cordon; construction

outage: 2h53min

M AN U

2010.05.30

RI PT

led to gas emission.

company used large machinery for excavation and damaged the fiber. 2010.11.11

Line

Excavation

Optical fiber

Optical Fiber

Yong-Tang-Qin

Unskilled and irresponsible

communication

Broken

( YQ-0335)

construction worker drove an

outage: 6h

excavator to dig canals despite having been informed of the

TE D

locations of pipelines and fibers, causing damage to the fiber.

2010.11.12

Line

Excavation

Optical fiber

Optical Fiber

Yong-Tang-Qin

Hebei construction group used an

communication

Broken

(YQ0410+400m)

excavator to dig canals without

outage: 31h

EP

informing the pipeline maintenance department and broke the fiber.

Line

Construction Work

Optical fiber

Optical Fiber

Yong-Tang-Qin

Unskilled and irresponsible

communication

Broken

(YQ-P0466+50m

construction worker cleaned mud

outage:

)

despite having been informed of

7h

AC C

2010.11.27

2010.12.07

the locations of pipelines and fibers causing damage to the fiber

Line

Excavation

Optical fiber

Optical Fiber

Yong-Tang-Qin

A steel milldug near the pipeline

communication

Broken

(YQ-0825+5+30

for laying sewage pipes using an

outage:

m)

excavator and broke the optical

8h42min

fiber.

30

ACCEPTED MANUSCRIPT Table 2 (continued) When

Where

Direct Cause

Consequences

Incident Type

2011.02.22

Line

Construction Work

Optical fiber

Optical Fiber

Yong-Tang-Qin

Unskilled and irresponsible

communication

Broken

(YQ-0218m)

construction worker cleaned float

outage :10h

ice despite having been informed

fibers, causing damage to the fiber. 2011.03.29

RI PT

of the locations of pipelines and

Line

Construction Work

Optical fiber

Optical Fiber

Yong-Tang-Qin

Unskilled and irresponsible

communication

Broken

(YQ-0917+40m)

construction worker cleaned mud

outage 10h

despite having been informed of

SC

the locations of pipelines and fibers, causing damage to the fiber Line 2

Farming

S2dP-1288+100

Buried depth of fiber here was only

m

0.28 m. Farmers used iron ploughs

Optical fiber

Optical Fiber

communication

Broken

M AN U

2011.04.04

outage 5h

for staggered furrows and dug 0.35 m. The fiber was broken. 2011.04.29

Line 2

Excavation

Optical fiber

Optical Fiber

S2CG-0738-5m

Unskilled and irresponsible

communication

Broken

construction worker drove an

outage :3h32min

excavator digging drainage canals

TE D

despite having been informed of the locations of pipelines and fibers, causing damage to the fiber.

Line

Excavation

Optical fiber

Optical Fiber

Yong-Tang-Qin

Jing-Qin highway project office

communication

Broken

(YQ-0804-150m)

wanted to design the scheme for

outage:9h22min

EP

2011.06.30

crossing pipelines and to know the pipeline locations. However, they

AC C

used an excavator to confirm the

2011.09.24

2011.10.30

location instead of contacting the pipeline company.

Line 2

Grave Robbery

Optical fiber

Optical Fiber

S2b-0455+100m

Grave robbers used Luoyang

communication

Broken

shovel for theft and damaged the

outage:

fiber

11h15min

Line

Farming

Optical fiber

Optical Fiber

Yong-Tang-Qin

Villagers dug vegetable cellars

communication

Broken

(YQ-0525+30m)

above the pipeline and broke the

outage:6h7min

fiber.

31

ACCEPTED MANUSCRIPT Table 2 (continued) Where

Direct Cause

Consequences

Incident Type

2011.11.22

Line

Farming

Optical fiber

Optical Fiber

Yong-Tang-Qin

Villagers used an excavator to

communication

Broken

(YQ-0194+300m

dig a drainage canal for the

outage:8h

)

farmland.

Line

Excavation

Optical fiber

Optical Fiber

Yong-Tang-Qin

Construction team dug a pit

communication

Broken

(YQ-0187+30m)

to embed construction waste.

outage:5h10min

Line 3

Flood

Embankment breaking:

Hanging,

(AA173)

Flood caused by heavy rain

24m

Optical fiber

broke the pipeline

Hanging height: 3.5m,

embankment and led to

(highest: 4m)

pipeline hanging and the fiber

Optical fiber

being broken.

communication

2012.07.27

broken

SC

2011.11.27

RI PT

When

2013.08.13

Line 3

Flood

(AB063)

Flood caused by heavy rain

Hanging length: 13m;

washed away the soil

Hanging height: 1.3m;

surrounding pipelines.

Duration:1d7h41min

Line 3

Flood

Optical fiber

Optical Fiber

(1km away from

Flood from persistent heavy

communication

Broken

11# block valve

rain caused a large area of

outage: 7h

station in the

collapse around pipeline.

upstream)

Explosion length: 15m;

TE D

2012.07.27

M AN U

outage: 5d9h

Hanging

Downfaulted soil broke the fiber.

2013.08.26

Line 3

Optical fiber

Optical Fiber

Water and soil conservancy

communication

Broken

construction company

outage:7h48 min

EP

(AB-0065)

Excavation

regulated the river near pipeline by using an

AC C

excavator. They continued

2013.10.22

digging even after seeing the fiber connection boxes thus broke the fiber.

Line 2

Excavation

Optical fiber

Optical Fiber

(S2CP-0862-150

Construction company dug

communication

Broken

m)

the main canal (Bao-Cang

outage: 2h11min

segment) of the south-to-north water transfer project (they signed the special scheme for pipeline protection during construction) 32

ACCEPTED MANUSCRIPT Table 2 (continued) When

Where

Direct Cause

Consequences

Incident Type

2014.01.01

Line 2

Excavation

Optical fiber

Optical Fiber

(S2C-0193)

Construction company of Jing-Kun

communication

Broken

highway build a roadbed and dug a

outage: 6h

blow-off basin (they agreed not to work again, but still used

2014.01.09

RI PT

excavators did) Line 2

Excavation

Optical fiber

Optical Fiber

(S2C-0134)

Construction company dug holes

communication

Broken

for telegraph poles and broke the

outage: 4h22 min

fiber Line 2

Excavation

(S2b-0176-50m)

Villagers used an excavator to dig

Optical fiber

drains without informing the

communication

Optical Fiber Broken

outage: 7h4 min

M AN U

pipeline maintenance station;

SC

2014.08.24

warning signs here were blocked by crops. 2016.01.12

Line Gang-Qing

Construction Work

Optical fiber

Optical Fiber

3 in Jinghai area

Village officer ordered to drive

communication

Broken

(BA031)

I-shaped steel piles into the earth

outage: 16h2min

without abiding by the signed

pipeline protection agreement. Construction Work

TE D

2016.11.03

Line 2

Optical fiber

Optical Fiber Broken

(S2b-1337+100m

Municipal construction for laying

communication

)

water pipes by using a blender

outage:5h35min

damaged the fiber; warning signs were insufficient.

Line 2

Farming

Optical fiber

Optical Fiber

Farmers used a rotary cultivator for

communication

Broken

farming and damaged the fiber.

outage:5h1min

Construction Work

Optical fiber

Optical Fiber

Construction company broke the

communication

Broken

fiber during their work.

outage:4h16 min

Line Gang-Qing

Excavation

Optical fiber

Optical Fiber

3

Landlord used an exactor on the

communication

Broken

(P4P -0086 +

ground above the pipeline to

outage:16h53min

200m)

unchoke water arbitrarily without

EP

2016.05.01

(S2C-0740+9m)

Line 3

AC C

2016.05.28

(S3b-0550-50m)

2016.05.30

informing the gas transmission department and broke the fiber

33

ACCEPTED MANUSCRIPT Highlights

RI PT

SC M AN U



TE D



EP



Focus on the risk identification of Third Party Damage (TPD) which is the greatest threat to pipeline safety. Literature review combined with analysis of incident reports is conducted to identify additional TPD risk factors that have not been recognized before. A Bayesian Network (BN) model is developed to cope with multi-state risks and clarify the causal relationship between TP-related events and effects. Dual assurance approach derived from the proposed methodology is helpful in learning from previous incidents and continuously capturing new risk information for risk prevention

AC C

