Risk Assessment System for Oil and Gas Pipelines Laid in One Ditch Based on Quantitative Risk Analysis

In view of the vegetation reduction caused by the continuous construction of oil and gas pipelines, the pipelines have been designed to be laid in one ditch to reduce land occupation. However, owing to the small spacing between the pipelines, the fault correlation between pipelines has been proven to increase the potential hazard of adjacent pipelines and routing environments. The neglect of failure correlation in existing risk assessment methods leads to inaccurate results, which will lead to errors in maintenance decisions. Therefore, this paper proposed a risk assessment system for pipelines using this laying method. In the risk assessment, pipelines laid in one ditch (PLOD) were regarded as a series system relative to the routing environment. Therefore, the functional relationship between the total risk of the pipeline system and the risk of each pipeline was obtained by combining the engineering system reliability theory with the mathematical induction method. In addition, fuzzy set theory combined with fault tree analysis was used to calculate the failure probability of each pipeline in the system. Event tree analysis was used to sort out all the possible consequences of pipeline failure, and then the consequences were unified into monetary units to evaluate the severity of failure consequences. Finally, the two parts were merged into a bow-tie diagram to realize the risk management and control of the pipeline. Meanwhile, risk acceptance criteria were formulated to analyze risks and to guide pipeline maintenance. This system provides a complete risk assessment system for the pipeline system laid in one ditch, including the methods of risk identification, risk assessment, and risk analysis, which are of great significance to ensure the safety of the pipeline and the surrounding environment using this laying method.


Introduction
In light of global economic development, the demand for petroleum resources and energy in various countries is increasing [1,2].To solve the problem of imbalance between supply and demand, oil and gas pipelines have been built in large quantities owing to their economic and high efficiency in oil and gas transportation.However, since plants cannot be grown around the pipelines, the construction of numerous pipelines seriously affects the ecological environment.Therefore, operators lay two or more new pipelines in one ditch or lay the new pipelines along other existing pipelines in one ditch to reduce the occupation of land and to follow the principle of sustainable development [3].
Owing to the large span of the pipelines, it is inevitable that pipelines will be routed through areas with complex geological environments.There are many uncertainties and risks involved in the use of pipeline transportation, such as natural factors and human factors.According to reports, every year, there are numerous accidents caused by soil corrosion, landslides, floods, collapses, mudslides, and earthquakes [4][5][6][7][8][9].In addition, pipeline safety is simultaneously threatened by human factors, such as third-party damage, terrorist attacks, incorrect operation, and design flaws [10,11].Since the oil and gas pipelines are flammable, explosive, and toxic, any pipeline leakage can cause catastrophic consequences, such as fire, explosions, and environmental pollution [12][13][14].Hence, risk assessment is used to identify the risk factors relating to uncertainty in pipeline operation, to evaluate the possibility and consequences of accidents, as well as to comprehensively calculate the risk value.The results can be used to guide pipeline maintenance [15].In 1992, Muhlbauer proposed an integrated and continuously improving quantitative pipeline risk assessment framework, which has become the guiding principle for pipeline risk assessment [16].The methodology for calculating failure probability has gradually developed from qualitative to quantitative methods [17], which includes two types of methods.One is the estimation of failure probability based on failure databases, such as the database of Pipeline and Dangerous Goods Safety Administration (PHMSA) in the USA and the database of European Gas Pipeline Incident Data Group (EGIG) in Europe [18].However, in situations where the data is insufficient to support quantitative risk assessment, then the low data-dependent failure probability determination methods can be adopted.Consequently, methods have been developed in this field, such as fuzzy mathematics, expert scoring, and fault tree analysis [19][20][21][22].However, in terms of the evaluation of failure consequences, event tree analysis has proven to be the most effective tool [23,24].
From a risk perspective, the PLOD are subject not only to the failure factors of a single pipeline, but also to the effects of adjacent pipeline failures, which has been proven by numerical simulations and experiments by scholars.Studies show that jet fire and explosion shock waves caused by pipeline failure will affect adjacent pipelines, that is to say, there is a failure correlation between pipelines [25][26][27][28].Therefore, the potential danger of the pipelines and the routing environment can be upgraded.However, the existing risk assessment methods do not account for the impact of failure correlation, which leads to results that do not reflect the true value of risk, resulting in inadequate maintenance [29].To avoid the uncertainty caused by the underestimation of risk, this paper presented a quantitative risk assessment method that is suitable for PLOD.
The following work was carried out in this paper.The relationship among routing environment risk and pipelines was deduced.A risk assessment method suitable for pipelines with failure correlation was proposed.Moreover, to evaluate the results of risk assessment to guide risk reduction, the curve method and as low as reasonable practical (ALARP) principle were used to formulate risk acceptance criteria.Thus, the three parts form a risk assessment system.

Risk Assessment Method for Pipeline Systems Laid in One Ditch
Pipeline risk assessment is used to comprehensively evaluate the internal and external factors affecting pipeline failure and the severity of the failure consequences, enabling the risk level of each segment to be determined as the basis of maintenance works.When pipelines are laid in one ditch, each pipeline can be affected by the failure of the adjacent pipelines owing to the small spacing between them, thus it is more susceptible to failure than a single pipeline laying method.Therefore, the potential danger to the routing environment affected by pipeline failure is also increased.Thus, to guide operators using this laying method to manage and control pipeline risk, the risk assessment method is discussed in this section.

Risk Assessment of Pipeline System
Given the small spacing between the pipelines, the pipelines can be regarded as an engineering system (PLOD system) related to the routing environment, where the double-pipeline system is used as an example (Figure 1).Pipeline A or B failure in this system will have a certain impact on the routing environment.From the point of view of reliability engineering, this system can be regarded as a series system related to the routing environment, and the failure of any unit (pipeline) will affect the routing environment.Therefore, the calculation method of the series system can be used to calculate the risk of this system.as a series system related to the routing environment, and the failure of any unit (pipeline) will affect the routing environment.Therefore, the calculation method of the series system can be used to calculate the risk of this system.Meanwhile, given that the pipeline spacing is small, the failure correlation between pipeline A and B has been proven.From a risk perspective, when the failure probability of pipeline A in the system is evaluated, in addition to the failure factors of the single pipeline, the influence of the adjacent pipeline B's failure on pipeline A should also be considered.
That is, the failure probability PfA is ( , ,..., , ) where Ii is the failure factor, i = 1, 2, 3,…, n; IBA is the influence of the adjacent pipeline B on A.
When the failure consequences of pipeline A are evaluated, in addition to the failure consequences of the single pipeline, the influence of A's failure on the adjacent pipeline B should be considered.That is, the failure consequences CA are where Cj is the possible consequence of failure, j = 1, 2, 3,…, n; CAB is the influence of pipeline A's failure on the adjacent pipeline B.
On this basis, a risk assessment system that is suitable for the PLOD system will be deduced.

Double-Pipeline System
The PLOD system consists of A and B. According to the theory of the series system, there are three situations of system failure: ① A fails but B does not, the failure probability of the system is A B (1 ) f f

P P -
; ③ A and B fail at the same time, the failure probability of the system is A B f f P P .Correspondingly, each of the three failure situations will bring three consequences: ① Failure consequences of the A; ② Failure consequences of the B; ③ Sum of the failure consequences of A and B. Therefore, the total risk of the system can be calculated as follows: where RAB is the total risk of double-pipeline system; PfA is the failure probability of A; PfB is the failure probability of B; CA is failure consequences of A; CB is failure consequences of B. Meanwhile, given that the pipeline spacing is small, the failure correlation between pipeline A and B has been proven.From a risk perspective, when the failure probability of pipeline A in the system is evaluated, in addition to the failure factors of the single pipeline, the influence of the adjacent pipeline B's failure on pipeline A should also be considered.

R P C P C P P C P P C P P C C
That is, the failure probability P fA is where I i is the failure factor, i = 1, 2, 3, . . ., n; I BA is the influence of the adjacent pipeline B on A.
When the failure consequences of pipeline A are evaluated, in addition to the failure consequences of the single pipeline, the influence of A's failure on the adjacent pipeline B should be considered.That is, the failure consequences C A are where C j is the possible consequence of failure, j = 1, 2, 3, . . ., n; C AB is the influence of pipeline A's failure on the adjacent pipeline B. On this basis, a risk assessment system that is suitable for the PLOD system will be deduced.

Double-Pipeline System
The PLOD system consists of A and B. According to the theory of the series system, there are three situations of system failure: 1 A fails but B does not, the failure probability of the system is P f A (1 − P f B ); 2 B fails but A does not, the failure probability of the system is P f B (1 − P f A ); 3 A and B fail at the same time, the failure probability of the system is P f A P f B .Correspondingly, each of the three failure situations will bring three consequences: 1 Failure consequences of the A; 2 Failure consequences of the B; 3 Sum of the failure consequences of A and B. Therefore, the total risk of the system can be calculated as follows: where R AB is the total risk of double-pipeline system; P fA is the failure probability of A; P fB is the failure probability of B; C A is failure consequences of A; C B is failure consequences of B. Expand Equation (3): Collate Therefore, the risk of the double-pipeline system is equal to the sum of the risks of the two pipelines.

Triple-Pipeline System
In many pipeline projects, new pipelines have been laid beside the existing double-pipeline system, forming a triple-pipeline system, which undoubtedly increases the possibility of damages to the surrounding environment.
The PLOD system consists of A, B, and C, where there are seven situations of system failure: Correspondingly, each of the seven failure modes will bring seven consequences: 1 failure consequences of A; 2 failure consequences of B; 3 failure consequences of C; 4 sum of the failure consequences of A and B; 5 sum of the failure consequences of A and C; 6 sum of the failure consequences of B and C; 7 sum of the failure consequences of A, B, and C.
Therefore, the total risk of the system can be calculated as follows: where R ABC is the total risk of the triple-pipeline system; P fC is the failure probability of C; C C is failure consequences of C. Expand Equation (6): Therefore, the risk of the triple-pipeline system is equal to the sum of the risks of the three pipelines.

Multi-Pipeline System
In the previous sections, the double-pipeline system and triple-pipeline system are discussed, where the total risk of these systems are equal to the sum of the risks of each pipeline.Owing to the continuous construction of pipelines, that is, four pipelines, five pipelines, or other multi-pipelines may be laid in one ditch in the future.Therefore, it is of great significance to study the risk assessment method for a multi-pipeline system laid in one ditch.
Based on Equation (3) and Equation (4): The total risk of a double-pipeline system R 2 is The total risk of a triple-pipeline system R 3 is Let i = m, the equation still holds: Item m+1 is added to the left and right sides of the equation: According to mathematical induction, for any n ∈ N * , there is where R n is the total system risk of n pipelines; P fi is the failure probability of the ith pipeline; C i is failure consequences of the ith pipeline.Therefore, the risk of the PLOD system is equal to the sum of the risks of each pipeline, and the routing environment risk equals the sum of the pipeline risks in the system.
Currently, single-pipeline risk assessment methods underestimate the risk of pipelines in the PLOD system [30,31].Based on Equation ( 9), the risk of the routing environment will be also underestimated.Therefore, a quantitative risk assessment method for pipelines considering the failures correlation among the pipelines will be studied in the next section.

Quantitative Risk Assessment for Pipelines Considering Failure Correlation Among Pipelines
Since the number of pipelines in the ditch is increased, the entire engineering system is more complicated, and the probability of damage to the surrounding environment is increased.Therefore, a method with characteristics of visual, communication, and display convenience is needed to guide maintenance personnel to reduce the occurrence and spread of accidents.The development of the pipeline risk assessment method has gradually developed to include the main contents of the risk assessment process in a model.The bow-tie model uses intuitive graphics to express the possible causes and consequences of an accident.Measures to prevent the occurrence of accidents and to mitigate consequences can be clearly marked on the graphics by setting barriers, so that dynamic management can be achieved, which meets the development goals of risk assessment methods in oil and gas engineering [32].Therefore, the bow-tie model has become a hotspot in the application and research of risk assessment methods [33].The center of the bow-tie diagram is an undesired event.The left side is the cause of the event and the preventive control measures, and the right side is the potential consequences of the event and the measures to mitigate the consequences.The bow-tie diagram is used to systematically identify hazards, assess and control risks, and to facilitate team communication discussions to reduce risk to an acceptable level by taking appropriate control mitigation measures at the appropriate locations [34].
In the bow-tie model, fault tree analysis (FTA) is a logic deductive analysis tool that can be used to analyze the causes and outcomes of all basic events leading to pipeline failure and their combinations [35].When FTA is used to analyze pipeline failure factors, in addition to third-party damage, corrosion, pipeline quality defects, incorrect operation, and unreasonable design, the failure effects of the adjacent pipelines should also be considered, which can be determined as a basic event affecting the pipeline under evaluation.The consequences of pipeline failure in the PLOD system are complex and uncertain.Event tree analysis (ETA) can be used to sort out all the possible consequences of pipeline failures, ascertain the main causes of the accidents, and provide a reliable basis for determining safety countermeasures, so as to achieve the goal of predicting and preventing accidents.Moreover, to assess the overall failure consequences, this paper proposed a new approach which can unite the various consequences of pipeline failure, and finally express the consequences in the form of currency.
In summary, the bow-tie model of pipeline failure accidents is shown in Figure 2.
Energies 2018, 11, x FOR PEER REVIEW 6 of 23 In summary, the bow-tie model of pipeline failure accidents is shown in Figure 2.

Calculation of the Failure Probability
There are two types of pipeline failures, fractures and perforations [36], and these two forms of failure can lead to leakage.Therefore, the top event of the bow-tie model is media leakage.To assess the occurrence probability of the top event, the occurrence probabilities of all basic events must be known.The determination of occurrence probabilities of basic events can refer to the historical failure data.However, owing to insufficient failure information regarding pipelines, it is difficult for all pipeline operators to utilize a quantitative risk assessment [37], as such the judgment and estimation of experts becomes the primary data source.However, given that the occurrence of basic events in the pipeline fault tree is ambiguous and random, even experts cannot accurately estimate the probability of each event.Therefore, fuzzy mathematics is introduced to quantify expert judgment opinions to obtain the occurrence probability of basic events [38].
In the process of expert judgment, an exact number may not be directly provided, but some language indicating the occurrence possibility of the event is used.Combined with pipeline engineering, the natural language values can be divided into seven levels: very small (VS), small (S), relatively small (RS), medium (M), relatively large (RL), large (L), and very large (VL) [24].In practice, to achieve the estimated data trend objective, it is necessary to select experts from different fields in pipeline engineering.However, different experts have different strengths and knowledge gaps owing to differences in their personal experiences and knowledge level.Therefore, the ability of experts to provide estimates is also different.It is not appropriate to combine mathematical averages or geometric mean values as expert estimates.In order to obtain more reliable results, it is necessary to assess the personal ability of the experts before providing the judgement.Therefore, an analytic hierarchy process (AHP) is used to evaluate the ability of experts to improve the objectivity of the expert judgment [39].
In AHP, factors affecting expert competence are used to determine the weight of the expert's competence (Figure 3).The overall target is personal ability (PA), which is the first layer of the model.Factors affecting expert competence include personal knowledge (PK), information source (IS), unbiased (UB), and personal experience (PE), which make up the second layer of the model [40].
The third layer is the expert involved in the assessment.
PA PE IS UB PK …

Calculation of the Failure Probability
There are two types of pipeline failures, fractures and perforations [36], and these two forms of failure can lead to leakage.Therefore, the top event of the bow-tie model is media leakage.To assess the occurrence probability of the top event, the occurrence probabilities of all basic events must be known.The determination of occurrence probabilities of basic events can refer to the historical failure data.However, owing to insufficient failure information regarding pipelines, it is difficult for all pipeline operators to utilize a quantitative risk assessment [37], as such the judgment and estimation of experts becomes the primary data source.However, given that the occurrence of basic events in the pipeline fault tree is ambiguous and random, even experts cannot accurately estimate the probability of each event.Therefore, fuzzy mathematics is introduced to quantify expert judgment opinions to obtain the occurrence probability of basic events [38].
In the process of expert judgment, an exact number may not be directly provided, but some language indicating the occurrence possibility of the event is used.Combined with pipeline engineering, the natural language values can be divided into seven levels: very small (VS), small (S), relatively small (RS), medium (M), relatively large (RL), large (L), and very large (VL) [24].In practice, to achieve the estimated data trend objective, it is necessary to select experts from different fields in pipeline engineering.However, different experts have different strengths and knowledge gaps owing to differences in their personal experiences and knowledge level.Therefore, the ability of experts to provide estimates is also different.It is not appropriate to combine mathematical averages or geometric mean values as expert estimates.In order to obtain more reliable results, it is necessary to assess the personal ability of the experts before providing the judgement.Therefore, an analytic hierarchy process (AHP) is used to evaluate the ability of experts to improve the objectivity of the expert judgment [39].
In AHP, factors affecting expert competence are used to determine the weight of the expert's competence (Figure 3).The overall target is personal ability (PA), which is the first layer of the model.Factors affecting expert competence include personal knowledge (PK), information source (IS), unbiased (UB), and personal experience (PE), which make up the second layer of the model [40].The third layer is the expert involved in the assessment.
of the expert judgment [39].

221
In AHP, factors affecting expert competence are used to determine the weight of the expert's 222 competence (Figure 3).The overall target is personal ability (PA), which is the first layer of the 223 model.Factors affecting expert competence include personal knowledge (PK), information source

224
(IS), unbiased (UB), and personal experience (PE), which make up the second layer of the model [40].

225
The third layer is the expert involved in the assessment.The possibility of a basic event (X i ) can be calculated as follows: • The evaluation team composed of experts makes subjective judgments on X i Experts from different fields, such as pipeline design, construction, installation, maintenance, and management are invited to form an evaluation group.The pipeline manager reports the basic status of the pipelines to the experts and invites the experts to inspect the pipelines.Then the experts are organized to discuss the occurrence possibility of the basic event X i .
• Linguistic value is transformed into fuzzy numbers Fuzzy set theory is used to process these linguistic values with uncertainty.There are many expressions of the membership function, such as triangular fuzzy number membership function, trapezoidal fuzzy number membership function, and Gauss fuzzy number membership function.Triangle and trapezoidal fuzzy numbers are widely used in linear fuzzy computations owing to their high efficiency and simplicity.They are used to provide more accurate descriptions and more accurate solutions, which are widely used in real-time systems [41].Therefore, triangle fuzzy numbers (Equation (10)) and trapezoidal fuzzy numbers (Equation (11)) are used to replace these linguistic values (Figure 4).
where a, b, c and d are the upper and lower limits of the fuzzy numbers representing the natural language, respectively.
Energies 2018, 11, x FOR PEER REVIEW 7 of 23 The possibility of a basic event (Xi) can be calculated as follows:  The evaluation team composed of experts makes subjective judgments on Xi Experts from different fields, such as pipeline design, construction, installation, maintenance, and management are invited to form an evaluation group.The pipeline manager reports the basic status of the pipelines to the experts and invites the experts to inspect the pipelines.Then the experts are organized to discuss the occurrence possibility of the basic event Xi.
 Linguistic value is transformed into fuzzy numbers Fuzzy set theory is used to process these linguistic values with uncertainty.There are many expressions of the membership function, such as triangular fuzzy number membership function, trapezoidal fuzzy number membership function, and Gauss fuzzy number membership function.
Triangle and trapezoidal fuzzy numbers are widely used in linear fuzzy computations owing to their high efficiency and simplicity.They are used to provide more accurate descriptions and more accurate solutions, which are widely used in real-time systems [41].Therefore, triangle fuzzy numbers (Equation ( 10)) and trapezoidal fuzzy numbers (Equation ( 11)) are used to replace these linguistic values (Figure 4).
where a, b, c and d are the upper and lower limits of the fuzzy numbers representing the natural language, respectively.Therefore, Equations 12a-g represent the membership functions of different levels: Therefore, Equations (12a)-(12g) represent the membership functions of different levels: The α-cut set theory is used to comprehensively address the expert assessments.The α-cut for the fuzzy numbers W can be described as: Let the α-cut set of each formula in Equations ( 12) be W α = [z 1 , z 2 ], where z 1 and z 2 represent the upper and lower limits of each α-cut set, respectively.Thus, the upper and lower limits and the α values of the cut set in the Equations ( 12) are as follows: According to the trapezoidal fuzzy number theory, the relationship function (S, RS, M, RL, L) of the fuzzy numbers W corresponding to each fuzzy language can be derived by According to the triangle fuzzy number theory, the relationship function of the fuzzy numbers W corresponding to VS and VL can be derived by The basic operations of fuzzy numbers can be expressed by their α-cut as in Reference [42]: Different experts often have different opinions on a basic event; therefore, it is necessary to integrate their opinions into a single opinion.There are many ways to aggregate fuzzy numbers, the linear opinion pool is recommended in this paper as described in Reference [43]: where A X i N is the linguistic value of basic event X i given by expert N; ω N is the weight of expert N.

• Convert fuzzy numbers to fuzzy possibility values
Based on the left and right fuzzy ordering method proposed by Chen and Hwang [44], the fuzzy number is transformed into fuzzy possibility scores (FPS T ).This method defines the maximum fuzzy set and the minimum fuzzy set as: Then the left fuzzy probability scores (FPS L ) and right fuzzy probability scores (FPS R ) are Then, the FPS T is defined as • Convert FPS T to fuzzy failure possibility as in Reference [45] The fuzzy possibility value (F) can be converted to a failure probability as follows: where k = 2.301 × 1−FPS T FPS T 1/3 .

Monetary Quantification of Pipeline Failure Consequences
ETA is used to sort out all the possible consequences of pipeline failure according to the development of an accident and then to identify the hazard source.Finally, barriers will be set up to mitigate the consequences.To comprehensively assess the severity of the failure consequences, quantitative analysis should be conducted.
Typically, the consequences of pipeline failure are considered from three aspects: casualties (n), environmental damage (v), and property loss (c).Casualties (persons) refer to the burning, explosions, or poisoning accidents caused by pipeline failure that may cause damage to the surrounding population.Environmental damage (m 3 ) is used to determine the severity of the consequences by assessing the volume of pollutants.Environmental damage often attracts great attention from the media and the public, which to a corporation's reputation is much more serious than the direct economic loss.Economic loss ($) includes maintenance costs, reinstallation costs for damaged equipment, and shutdown losses.Moreover, the impact of pipeline failure on adjacent pipelines should be assessed, which includes pipe loss, media loss, and downtime loss.
However, given that the dimensions of the three failure consequences are inconsistent, it is difficult to comprehensively evaluate the loss caused by pipeline failure.In fact, after a pipeline failure accident, for the pipeline operators, it is accompanied by economic losses, such as compensation and maintenance.According to this idea, this study unified the dimension of loss by currency quantification, which requires investigating market prices, drawing lessons from various methods of property statistics, life safety, and environmental value assessment, combined with the specific conditions of pipelines.These are recorded as life loss c 1 ($), environmental loss c 2 ($), property loss c 3 ($), and adjacent pipelines loss c 4 ($), respectively.The factors that should be considered in the currency quantification of the failure of pipeline systems laid in one ditch are shown in Table 1 [46][47][48].In a specific assessment, it should depend on the situation.The consequences of different failure modes are different.Therefore, the consequences C 1 and C 2 of the fractures and perforations of the pipelines can be expressed as: Then the risk of a pipeline in the PLOD system can be calculated by the following: where R ($) is the risk of a pipeline in the PLOD system; P 1 is the probability of fracture; P 2 is the probability of perforation.

Risk Acceptability Criteria
The bow-tie model has a good effect in preventing the occurrence and spread of adverse events.However, there is a limitation that quantitative conclusions cannot be obtained to guide risk decision-making.A guideline for guiding risk decisions is needed.Hence, risk acceptability was introduced to further assess risk and to guide the implementation of risk reduction measures.
The sociological concept of risk acceptability was introduced into engineering decision analysis to address "how safe is safe enough" in the 1960s [49].Risk acceptance criteria have been studied by scholars since the 1970s as a bridge between risk assessment and risk decision-making.In the book Acceptable Risk, risk is acceptable only when the benefits obtained can compensate for the loss of risk, thus risk acceptance criteria were proposed to protect the interests of all parties [50].Pipeline risk acceptance criteria can be divided into two categories: one is the risk acceptance criteria for pipeline operators formulated from the perspective of economic interests.In order to seek benefits, operators need to seek a balance between safety and efficiency [51].The ALARP principle and cost-benefit analysis are used to formulate the risk acceptance criteria [52].The second is the risk acceptance criteria for society formulated from the perspective of protecting the lives and environment of surrounding residents [53].Historical data on the deaths and environmental pollution caused by pipeline failure are used as the reference values, and social risk acceptance criteria are formulated in consultation with relevant departments and trade unions.
In this paper, to facilitate communication with field managers, the curve method was used to illustrate risk acceptability criteria.Given that the consequences of pipeline failures are uniformly quantified as money, the function image of pipeline failure probability (P) and property loss (L) combined with the ALARP principle was used to formulate economic loss risk acceptable criteria.The two boundaries of ALARP (negligible value at risk (NVAR) and intolerable value (IRV)) divide risk into three regions: unacceptable region, negligible region, and the ALARP region (Figure 5).The maintenance decision-making ideas of each region are different [52].The risk boundary P-L curve is expressed as follows, as in Reference [54]: where ( ) f P x is the probability of accidents; x is the loss caused by the accident; L ( ) The risk boundary P-L curve is expressed as follows, as in Reference [54]: where P f (x) is the probability of accidents; x is the loss caused by the accident; F L (x) is the probability distribution function of the annual economic loss from an accident; B is a constant to determine the position of the P-L curve, referring to the risk acceptability criteria for dangerous goods transportation (HSE), the B of the IRV line is 10 −4 , and the B of NVAR is 10 −6 [55,56]; n is the slope of the P-L curve, the value of n is based on the acceptable risk level and the degree of risk control.The level of accident property loss is classified as shown in Table 2 [57].Therefore, the pipeline property loss risk acceptable criterion is shown in Figure 6.
After the risk assessment, the probability of pipeline failure and the possible losses are represented by points on the P-L diagram.When the point falls into a negligible region, the risk is considered negligible and there is no need to reduce the risk.When the point falls into an unacceptable region, the risk is considered unacceptable and measures must be taken at all costs to reduce the risk below the IRV line.When the point falls in the ALARP region, a cost-benefit analysis should be conducted to determine whether to take measures.In summary, this section proposed the following risk assessment system for the PLOD (Figure 7): (1) Identifying risk factors to determine the basic events, and carding the possible failure consequences of each pipeline; (2) Calculating the probability and consequences of each pipeline failure to obtain the total risk of the PLOD system; (3) Judging the risk acceptability to determine whether to maintain the system.In summary, this section proposed the following risk assessment system for the PLOD (Figure 7): (1) Identifying risk factors to determine the basic events, and carding the possible failure consequences of each pipeline; (2) Calculating the probability and consequences of each pipeline failure to obtain the total risk of the PLOD system; (3) Judging the risk acceptability to determine whether to maintain the system.
In summary, this section proposed the following risk assessment system for the PLOD (Figure 7): (1) Identifying risk factors to determine the basic events, and carding the possible failure consequences of each pipeline; (2) Calculating the probability and consequences of each pipeline failure to obtain the total risk of the PLOD system; (3) Judging the risk acceptability to determine whether to maintain the system.

Case Study
A natural gas pipeline (A) operated by China Petroleum and Natural Gas Corporation and a product pipeline (B) operated by the Yunnan Product Pipeline Engineering Company are laid in one ditch up to 10.16 km from Nanhua County, Chuxiong City to Fumin County, Kunming City, China.One of the segments was selected for risk assessment.In this segment, the pipeline spacing is 1.2 m and the length is 1 km.Pipeline A is made from X80 steel with a diameter of 1016 mm and designed with an internal pressure of 10 MPa.Pipeline B is made from X52 steel with a diameter of 406.4 mm and designed with an internal pressure of 13.2 MPa.Ravines, collapses, landslides, debris flows, and earthquakes often erupt in the routing areas of the pipelines.In addition, there are several homes and groves in the affected area (Figure 8).Once the pipelines fail, the surrounding environment will be badly affected.Pipeline A was taken as an example, and the bow-tie model was used for quantitative risk assessment.define the weights N ω (N = 1, 2,3, 4) of E1, E2, E3, and E4, which were 0.224, 0.27, 0.188, and 0.318,

397
To calculate the weighted average ambiguity of the event by the four experts, as shown in 398 Equation ( 14), the integrated fuzzy number can be expressed as follows: Calculated by Equation (15), max ( ) 0.3641 The occurrence probability of other basic events can be obtained by calculations using this method, where the occurrence probability of the top event is 1.258 × 10 −4 according to the calculation method of the top event.The occurrence probability of other basic events can be obtained by calculations using this method, where the occurrence probability of the top event is 1.258 × 10 −4 according to the calculation method of the top event.

Event Tree Analysis
Natural gas is toxic and flammable.Once an accident occurs, it may spread or cause jet fire and steam cloud explosion accidents, thereby endangering the surrounding population, buildings, and trees.Meanwhile, the adjacent pipeline B will also be affected by the leakage accident of A. In the event of an accident, if it is not repaired in time, it may even cause B's failure.There are two aspects as described in Reference [59]: (1) When A fails, a shock wave will be formed, and the ground pressure transmitted through the surrounding soil may lead to the failure of the adjacent pipeline B owing to radial buckling.
(2) When A ruptures, the jet air may blow off the surrounding backfill soil to form craters.When the jet gas is ignited to form a jet fire, the adjacent pipeline B will be directly subject to thermal radiation without cover protection (Figure 11).Therefore, the event tree of A's failure in one ditch laying system was established (Figure 12).

Monetary Quantification of the Consequences
According to the method in Section 2.2.2, by investigating the surrounding environment of the pipeline section, that is, the environmental media, equipment, and buildings in the influence area, we estimated that the possible loss due to pipeline failure is around $140,000, and combined with the Therefore, the event tree of A's failure in one ditch laying system was established (Figure 12).Therefore, the event tree of A's failure in one ditch laying system was established (Figure 12).

Monetary Quantification of the Consequences
According to the method in Section 2.2.2, by investigating the surrounding environment of the pipeline section, that is, the environmental media, equipment, and buildings in the influence area, we estimated that the possible loss due to pipeline failure is around $140,000, and combined with the

Monetary Quantification of the Consequences
According to the method in Section 2.2.2, by investigating the surrounding environment of the pipeline section, that is, the environmental media, equipment, and buildings in the influence area, we estimated that the possible loss due to pipeline failure is around $140,000, and combined with the local environmental pollution damage compensation, the failure consequence is around $145,000.

Pipeline Failure Prevention Measures and Emergency Measures
After determining the probability and consequences of the natural gas pipeline failure, according to the risk acceptance criteria formulated in Section 2.3, the risk was considered to be in the unacceptable region.Therefore, immediate measures should be taken to reduce the risk below the IRV line.In addition, the failure probability and failure consequences of the product pipeline B can be calculated using this method, and the risk of the PLOD system can be calculated using Equation (8).
Events with a high probability of occurrence should be controlled.For the failure of adjacent pipelines, a safety early warning system should be installed to monitor the pipeline operation in real time.In addition, the strength of the pipelines should be increased to withstand the load caused by the explosion of adjacent pipelines.Radiation heat dissipation coatings should be applied on the surface of the pipe to reduce the effects of heat radiation caused by the jet.Controlling measures for third-party damage should be based on patrolling and real-time monitoring.Given the frequent occurrence of geological disasters around the area, the monitoring of disaster points should be carried out.In addition, obvious signs should be erected in the areas where the depth of the pipeline cannot be guaranteed.Corrosion inspection and pigging should be carried out regularly to ensure that the pipeline will not fail.Pipeline operators and designers should be regularly trained to reduce the possibility of them making mistakes.
The consequences of a natural gas leak depend on whether it is ignited immediately; therefore, it is necessary to control the source of the fire around the source of the accident to mitigate against further development of the accident [60,61].After the accident, the leak should be plugged and evacuated urgently, which requires the training of the rescue team during peacetime.
In summary, the entire preventive control process for the top event is shown in Figure 13.The consequences of a natural gas leak depend on whether it is ignited immediately; therefore, it is necessary to control the source of the fire around the source of the accident to mitigate against further development of the accident [60,61].After the accident, the leak should be plugged and evacuated urgently, which requires the training of the rescue team during peacetime.
In summary, the entire preventive control process for the top event is shown in Figure 13.

Conclusion
In this paper, risk analysis of the PLOD system was carried out and a risk assessment system was proposed.Some conclusions were subsequently drawn.The pipelines that use this laying mode can be regarded as a series engineering system relative to the routing environment.In the pipeline

Conclusions
In this paper, risk analysis of the PLOD system was carried out and a risk assessment system was proposed.Some conclusions were subsequently drawn.The pipelines that use this laying mode can be regarded as a series engineering system relative to the routing environment.In the pipeline system, the failure probability of the pipeline is affected by the adjacent pipelines.Meanwhile, the pipeline failure will affect the adjacent pipelines.Combining the engineering system reliability analysis and mathematical induction, the risk of the pipeline system is equal to the sum of the risks of the pipelines with failure correlation.Subsequently, the fuzzy bow-tie model combined with the risk acceptance criteria was used to obtain a quantitative risk assessment result, which can directly guide operators in making risk decisions.In pipeline maintenance, to prevent the influence of adjacent pipelines, the strength of the pipelines should be increased and fireproof coatings should be applied on the surfaces of the pipelines.In addition, the frequency of monitoring and patrolling should be increased to avoid accidents.

Figure 1 .
Figure 1.The diagram of the pipelines laid in one ditch (PLOD) system.

Figure 1 .
Figure 1.The diagram of the pipelines laid in one ditch (PLOD) system.

Figure 2 .
Figure 2. Bow-tie model of pipeline failure accidents.

Figure 2 .
Figure 2. Bow-tie model of pipeline failure accidents.

Energies 2018 , 23 Figure 5 .
Figure 5. Level of risk and the as low as reasonably practicable (ALARP) region.

Figure 5 .
Figure 5. Level of risk and the as low as reasonably practicable (ALARP) region.

Figure 6 .
Figure 6.Pipeline property loss risk acceptable criteria.

Figure 7 .
Figure 7. Assessment process of the PLOD system.

A
natural gas pipeline (A) operated by China Petroleum and Natural Gas Corporation and a product pipeline (B) operated by the Yunnan Product Pipeline Engineering Company are laid in one ditch up to 10.16 km from Nanhua County, Chuxiong City to Fumin County, Kunming City, China.One of the segments was selected for risk assessment.In this segment, the pipeline spacing is 1.2 m and the length is 1 km.Pipeline A is made from X80 steel with a diameter of 1016 mm and designed with an internal pressure of 10 MPa.Pipeline B is made from X52 steel with a diameter of 406.4 mm and designed with an internal pressure of 13.2 MPa.Ravines, collapses, landslides, debris flows, and

Figure 7 .
Figure 7. Assessment process of the PLOD system.

Energies 2018 ,Figure 8 .
Figure 8. Trend map of the evaluated pipeline segment.

Figure 8 .
Figure 8. Trend map of the evaluated pipeline segment.

Figure 9 .
Figure 9. Fault tree of the natural gas pipeline in the same ditch laying system.
the left and right fuzzy probability values (Figure10), respectively.Thereafter, the left and right fuzzy probability values of the fuzzy numbers are calculated by Equation(16) and Equation(17), respectively,

Figure 10 .
Figure 10.Left and right fuzzy possibility values of fuzzy numbers.

23 Figure 11 .
Figure 11.Failure of the adjacent pipeline caused by thermal radiation.

Figure 12 .
Figure 12.Natural gas pipeline failure event tree.

Figure 11 .
Figure 11.Failure of the adjacent pipeline caused by thermal radiation.

Energies 2018 , 23 Figure 11 .
Figure 11.Failure of the adjacent pipeline caused by thermal radiation.

Figure 12 .
Figure 12.Natural gas pipeline failure event tree.

Figure 12 .
Figure 12.Natural gas pipeline failure event tree.

Energies 2018 ,
11, x FOR PEER REVIEW 19 of 23third-party damage should be based on patrolling and real-time monitoring.Given the frequent occurrence of geological disasters around the area, the monitoring of disaster points should be carried out.In addition, obvious signs should be erected in the areas where the depth of the pipeline cannot be guaranteed.Corrosion inspection and pigging should be carried out regularly to ensure that the pipeline will not fail.Pipeline operators and designers should be regularly trained to reduce the possibility of them making mistakes.

Figure 13 .
Figure 13.Bow-tie diagram of natural gas pipeline leakage for the PLOD system.

Figure 13 .
Figure 13.Bow-tie diagram of natural gas pipeline leakage for the PLOD system.

Table 1 .
Factors considered in monetary quantification.

Table 2 .
Ranking criteria of consequences.