An Interval-Valued Intuitionistic Fuzzy Bow-Tie Model (IVIF-BT) for the Effectiveness Evaluation of Safety Barriers in Natural Gas Storage Tank

: Safety barriers (SBs) are important means of reducing failure risks of process systems. As barriers vary in type and function, their effectiveness needs to be evaluated in order to ﬁnd a more reasonable conﬁguration strategy. However, in practice, there is often a lack of accurate and complete data relating to SBs, which poses a signiﬁcant challenge in quantitatively assessing their effectiveness. To address this issue, in this study, we propose a semi-quantitative approach for evaluating the effectiveness of both preventive and protective barriers in process systems by integrating expert elicitation, interval-valued intuitionistic fuzzy numbers (IVIFNs), and a bow-tie model. In this approach, the bow-tie model is ﬁrst applied to describe the system failure scenarios and the action phases of the barriers, and then IVIFNs with expert judgment are introduced to obtain the failure probabilities of basic events and the effects of SBs. Subsequently, the effectiveness of each barrier is measured by comparing the relative change in failure risk due to the addition of the barrier. To verify the feasibility of this approach, a natural gas storage tank with some barriers was analyzed. The results show that the regular inspection of the deformation or damage of the storage tank has the highest effectiveness, followed by the installation and regular maintenance of safety electrical equipment. Furthermore, compared to a single barrier, multiple barriers can signiﬁcantly reduce the system risk.


Introduction
Configuring safety measures for the process systems is a crucial means to preventing and reducing the failure risk.These safety measures are generally called safety barriers (SBs).There are a variety of SBs in process systems, like corrosion detection devices, relief valves, flammable gas detective and alarm systems, and fire extinguishing apparatus.Different SBs have different functions and effects, which raises the important question of how well these SBs protect the system from failure threats, and which SBs are more effective.If these questions can be answered well, then a more reasonable configuration strategy for SBs may be devised according to their effectiveness.Therefore, how to evaluate the effectiveness of SBs has become a significant issue for system safety management.
There are several analysis approaches for SBs in process systems at present, such as the Swiss cheese model [1], safety barrier diagram (SBD) [2], barrier and operational risk analysis (BORA) [3], layer of protection analysis (LOPA) [4], fault tree analysis (FTA), event tree analysis (ETA) [5], Petri nets [6], Bayesian networks [7], and the bow-tie (BT) model [8].Among these approaches, the BT model has attracted great attention due to its integration of FT and ET, which can intuitively and clearly describe system failure scenarios and the roles of SBs.According to its use, the BT model can be used for qualitative and quantitative analyses.The former is primarily used to identify which basic events or combinations will lead to the final accident, as well as to help engineers understand the nature and functions of SBs.However, the qualitative analysis cannot quantify the influence degree of SBs on system failure.Fortunately, the latter can reach such a goal as long as all the data associated with the occurrence probabilities of basic events with or without SBs can be obtained.
The quantitative BT analysis cannot be separated from high-quality and sufficient data.But in practice, things often go contrary to our wishes.On the one hand, because of the insufficient knowledge of the system, the parameters used in the BT model (like failure probability data) may be inaccurate and incomplete; on the other hand, the complexity of the system and its behavior often result in the simplification of the assumptions in the analysis process [9].All these uncertainties can negatively affect the availability and credibility of BT analysis.Therefore, in order to mitigate this issue, several approaches have been proposed to handle uncertainty data, such as fuzzy set theory (FST), evidence theory, and rough set theory [10,11].Among these, FST has been broadly applied in the BT model for risk assessment because of its complete theoretical basis and good usability.Wang et al. [12] proposed a probability assessment method that combined FST, BT analysis, and Bayesian updating technology to assess accidents in natural gas distribution station systems.Yazdi [13] applied the Z-number to the FT to investigate the server failure consequences of hydrocarbon storage tanks.Arici et al. [14] applied a risk analysis framework of a fuzzy BT model for maritime transportation.Das [15] combined the BT model and type-2 fuzzy set for risk quantification.Elidolu [16] carried out a static electricity risk failure analysis of oil tankers using the BT model with fuzzy logic and CREAM.
To a certain extent, a fuzzy BT model can handle uncertainty effectively during analysis, but the traditional FST still has its limitations.The membership degree of the elements in a certain set is a value in the range of [0, 1] for FST.Therefore, the membership value simply indicates the degree to which the element belongs to the set, and it cannot take into account the non-membership degree originated from experts' lack of knowledge or hesitancy.To overcome this issue, Atanassov [17] proposed the intuitionistic fuzzy set (IFS) theory.The IFS could better describe uncertain information through the concepts of membership, non-membership, and hesitation degrees.It is therefore more appropriate to address situations in which the membership value of the element in the set may be hesitant or uncertain.Given the advantages of the IFS, it has been combined with several risk assessment techniques [18].Guo [19] applied the IFS to FMEA for risk analysis.In the IFS theory, the language variables represented by intuitionistic fuzzy numbers were used to evaluate and transform risk factors.Yazdi [20] presented a hybrid approach of intuitional fuzzy and TOPSIS for risk matrix analysis.Subsequently, Yazdi et al. [21] used IF-AHP to address uncertain data in risk-based maintenance investment optimization.Viegas et al. [22] provided an IFS-based MCDM sorting model for improving HAZOP analysis.Kaushik and Kumar [23] proposed a novel system for safety and risk assessment.This method combines the concept of BN with FTA under an intuitionistic fuzzy environment.
Whether the FS or IFS, explicit membership and/or non-membership functions are required.As commonly known, in IF-BT models, occurrence possibilities of basic events are represented by the IFS obtained through expert elicitation.However, it is often troublesome to require experts to express the membership and non-membership degrees with crisp values, since the membership and non-membership functions may not be precisely known in many cases.For this reason, the IFS is extended to interval-valued intuitionistic fuzzy sets (IVIFSs).In IVIFSs, the membership and non-membership degrees are represented by interval values in the range of [0, 1] rather than crisp values in the range of [0, 1], which bring interval freedom to the representation and treatment of uncertainty, Therefore, the IVIFS method has become increasingly popular.Wang et al. [24] incorporated an IVIFS into a hybrid MCDM model of risk analysis to handle vagueness and uncertainty.Liu et al. [25] employed an IVIFS to express the assessment values of risk factors in FMEA.Huang [26] combined an IVIFS and rough number theory to propose an IVIF rough number concept and its corresponding FMEA model.Huang and Xiao [27] also proposed an IVIF cloud theory based on FMEA for risk evaluation.
The aforementioned studies have shown that the IVIFS approach is a valuable solution to handle uncertainty in risk and safety assessment.However, to the best of our knowledge, no methods exist for evaluating SB effectiveness involving the IVIFS concept.Therefore, this paper proposes an IVIF-BT method for safety assessment and SB evaluation by introducing an IVIFS into the BT model.In this method, the failure possibilities of basic events with/without SBs in the BT model are represented as interval-valued intuitionistic fuzzy numbers (IVIFNs) to characterize the hesitation of events.Also, an IVIF-AHP is employed to analyze the importance weights of different severity types of failure consequences.Furthermore, the SB effectiveness is clearly defined and measured by comparing system failure risk with SBs to that without SBs.
In this approach, the BT model effectively links key events with the associated causes and consequences while fully and comprehensively considering the role of SBs within the model.Compared to other methods, this approach not only allows for safety assessments but also considers the failure risks and consequences of the system in the presence of various SBs, further analyzing the effectiveness of each SB.Additionally, in this method, obtaining key data through expert elicitation enhances the applicability of the model, and the use of IVIFNs helps handle the uncertainty and fuzziness of expert opinions, thereby increasing the reliability of the model.Consequently, this method can effectively address the challenges of multiple uncertainties and incomplete information in process industries, ensuring the accuracy and credibility of safety assessments.It provides decision-makers with intuitive and comprehensive safety assessment results, aiding them in devising more effective safety management measures.
The remainder of this paper is structured as follows: Section 2 introduces basic concepts of safety barriers, the BT model, and IVIFNs.Section 3 presents the method for evaluating the effectiveness of SBs in process systems, and the detailed implementation process is given.In Section 4, to verify the feasibility of this method, an illustrative example of natural gas storage tank is provided.Finally, the analysis conclusions are drawn in Section 5.

Preliminaries
This section introduces the key concepts and definitions associated with safety barriers, the bow-tie model, and IVIFNs.The arithmetic operations and properties of IVIFNs are also discussed in this section.

Safety Barriers
Safety barriers (SBs) have not had a universally accepted definition so far because they cover a broad range of subjects in areas like economics, management, traffic, aeronautics and astronautics, nuclear power, and the petrochemical industry.As far as process systems are concerned, Sklet [28] recommended an appropriate definition of SBs.The definition implies three fundamental elements of SBs as follows:

•
Barrier systems: physical and/or non-physical means; • Barrier functions: for prevention, control, or mitigation; • Barrier objects: undesired events or accidents.
Furthermore, they can be categorized into several types according to different dimensions.Table 1 summarizes some typical classifications of SBs in process systems.
There are different requirements for SB functions and implementation methods in safety management, leading to different classification methods and principles.In addition, considering the specific application scenarios, industry standards, regulatory requirements, and specific requirements of safety management, different classification systems emphasize different aspects.Therefore, although the classification principle is the same, classification results will be different.• Prevention

•
Reduce the probability of an event by suppressing some of the underlying causes or reducing their intensity.

•
Monitor the operation process of the system or the changing process of events.• firewalls [36] • Technical

•
Barriers that prevent accidents and mitigate their consequences through engineering or technological measures.
• pressure detection systems • Operational

•
Through processes, operating procedures, and other necessary activities to realize the function.

•
Barriers that used to prevent accidents or limit the risk at a limited time or situation only.
• manual shut-down, intervention of fire brigades The classification adopted in this study is based on barrier functions.Hence, SBs are classified into preventive and protective barriers (see Figure 1).The former, involving barriers between causes and the critical event, can reduce the occurrence probabilities of hazard events, while the latter, encompassing the barriers between the critical event and outcomes, can mitigate the consequence severity of the hazard events.
Generally speaking, a catastrophic accident starts with one or some initiating events, which proceed in a certain sequence of events and evolve gradually until the accident finally occurs or aborts.SBs play a crucial role in this process.If SBs are effective and reliable, they can largely mitigate and avoid hazardous events, thus giving the system a strong protective effect, and conversely, they cannot slow down the progress of the accident.Therefore, SB performance is an issue that requires more in-depth analysis.
For safety barriers, common performance indicators include effectiveness, availability, durability, independence, etc.Among them, effectiveness is the core indicator to measure whether SBs can achieve their expected function.It can measure the degree to which the SBs mitigate system damage from the accident [37].In some cases, effectiveness is primarily considered in the measurement of preventative barriers, expressed as a reduction in the probability of system safety events.In other cases, it is indicated by the mitigation degree of the consequences of system failure, which is common in protective barriers.

Bow-Tie Model with Safety Barriers
The bow-tie (BT) model was developed by Nielsen in the 1970s.It was named as such because the shape of the model is similar to a bow tie.The BT model can display the relationship between the risk parameters of causes, hazards, and consequences in the form of a logical block diagram.As research progressed, the BT approach became a popular risk management approach in high-risk industries such as petrochemicals, aerospace, and mining.Figure 1 illustrates a schematic diagram of a bow-tie model with SBs [38].
A complete BT model can describe the whole accident scenario from accident causes to accident consequences.When SBs are considered in the BT model, the ones located on the FT are viewed as preventive SBs, and those on the ET are protective SBs.In other words, the BT model can be used to evaluate the performance of both preventive and protective SBs.From a qualitative point of view, the BT model can help researchers and engineers understand what initial event or event set will lead to the final accident, and what role SBs play.From a quantitative point of view, if the probabilities of all the basic events occurring, along with the influence of SBs on the probabilities of the events, are For safety barriers, common performance indicators include effectiveness, availability, durability, independence, etc.Among them, effectiveness is the core indicator to measure whether SBs can achieve their expected function.It can measure the degree to which the SBs mitigate system damage from the accident [37].In some cases, effectiveness is primarily considered in the measurement of preventative barriers, expressed as a reduction in the probability of system safety events.In other cases, it is indicated by the mitigation degree of the consequences of system failure, which is common in protective barriers.

Bow-Tie Model with Safety Barriers
The bow-tie (BT) model was developed by Nielsen in the 1970s.It was named as such because the shape of the model is similar to a bow tie.The BT model can display the relationship between the risk parameters of causes, hazards, and consequences in the form of a logical block diagram.As research progressed, the BT approach became a popular risk management approach in high-risk industries such as petrochemicals, aerospace, and mining.Figure 1 illustrates a schematic diagram of a bow-tie model with SBs [38].
A complete BT model can describe the whole accident scenario from accident causes to accident consequences.When SBs are considered in the BT model, the ones located on the FT are viewed as preventive SBs, and those on the ET are protective SBs.In other words, the BT model can be used to evaluate the performance of both preventive and protective SBs.From a qualitative point of view, the BT model can help researchers and engineers understand what initial event or event set will lead to the final accident, and what role SBs play.From a quantitative point of view, if the probabilities of all the basic events occurring, along with the influence of SBs on the probabilities of the events, are determined, then it becomes possible to quantify the probability of the critical event and the ensuing consequences of failure, including the performance of each SB.

Interval-Valued Intuitionistic Fuzzy Set 2.3.1. Fuzzy Set and IFS
Zadeh [39] first proposed the theory of classical fuzzy set in 1965.In the fuzzy set theory, membership represents the degree to which an element belongs to a set or the belief that it belongs to a concept.The membership degree of an element in the domain X is usually in the range of [0, 1].

Definition 1. Fuzzy set:
Let X be a non-empty set.A fuzzy set in X is an object A given in Equation (1) as follows: where µ A (x) is the membership function, and 0 ≤ µ A (x) ≤ 1, ∀x ∈ X.
Definition 2. Intuitionistic fuzzy set: Let X be a non-empty set.An intuitionistic fuzzy set (IFS) in X is an object A given in Equation ( 2) as follows: where µ A (x), v A (x), and π A (x) are the membership, non-membership, and hesitation functions, respectively.Figure 2 illustrates a typical IFS of the real number R.
belief that it belongs to a concept.The membership degree of an element in the domain X is usually in the range of [0, 1].

Definition 1. Fuzzy set:
Let X be a non-empty set.A fuzzy set in X is an object A given in Equation ( 1) as follows: where ( ) μ is the membership function, and

Definition 2. Intuitionistic fuzzy set:
Let X be a non-empty set.An intuitionistic fuzzy set (IFS) in X is an object A  given in Equation ( 2) as follows: where .

( ) ( ) ( )
where ( ) ( ) are the membership, non-membership, and hesitation functions, respectively.Figure 2 illustrates a typical IFS of the real number R.

IVIFS and IVIFNs
The interval-valued intuitionistic fuzzy set (IVIFS) was first proposed by Atanassov and Gargov [17].In the IVIFS, the concept of interval is introduced to extend the IFS, so that the membership and non-membership functions in the IVIFS no longer function but are interval values.The concept of interval values can better address uncertain information in practice.

IVIFS and IVIFNs
The interval-valued intuitionistic fuzzy set (IVIFS) was first proposed by Atanassov and Gargov [17].In the IVIFS, the concept of interval is introduced to extend the IFS, so that the membership and non-membership functions in the IVIFS no longer function but are interval values.The concept of interval values can better address uncertain information in practice.

Definition 3. IVIFS and IVIFNs:
Let X be a non-empty set.An IVIFS α in X is given in Equation ( 4). where Here, µ α (x) and v α (x) are the intervals with the following conditions: The intervals µ α (x), ν α (x), and π α (x) denote the degrees of membership, non- membership, and hesitation of the element x in the set X, respectively.Here, the interval pair ( µ α (x), ν α (x)) is called the interval-valued intuitionistic fuzzy number (IVIFN).For convenience, it can be denoted as , then the IVIFN degenerates to an intuitionistic fuzzy number (IFN).
In order to easily and quickly aggregate IVIFNs, the IVIFWA operator was used in this study.

Proposed Effectiveness Evaluation Method of Safety Barrier
In this section, the proposed method for the effectiveness evaluation of SBs based on the integration of IVIFNs and bow-tie methodology is described in detail.The method aims to evaluate the effectiveness of SBs in improving system safety.The point-to-point guide to this method is shown in Figure 3, which mainly consists of four critical procedures, and a brief overview of each critical procedure is as follows: (1) Preparatory work: This initial step involves identifying the system under evaluation, forming an expert group, and constructing the corresponding BT model with SBs.(2) System failure probability analysis: In this procedure, the possibility of system failure events and the effectiveness of preventive SBs are assessed using IVIFNs.(3) System failure consequence analysis: The severity of failure consequences and the effectiveness of protective SBs are evaluated using the IVIF-AHP and IVIFNs, respectively.(4) Safety barrier analysis: Finally, the failure risk of the system with and without SBs is computed, and the effectiveness of various safety barrier configurations is analyzed to provide recommendations for future safety planning.In summary, this method takes the BT model with SBs as the basis of safety evaluation and optimizes the calculation process and analysis results of the model using IVIFNs.This IVIF-BT method can further improve the reliability of the evaluation results.

Identify the System to Be Evaluated
The first step in this method is to identify the system being evaluated and gather relevant information about this system.

Form an Expert Group and Assign Weights to Experts
To address the lack and inaccuracy of objective data, an expert decision-making group composed of K experts and/or engineers is needed to provide the required system information.The selection of experts should follow the principle of diversity and professionalism as far as possible.In general, the opinions given by experts vary depending on their educational profile, professional types, and work experience, making the opinions more comprehensive.Therefore, experts are evaluated by considering their work experience, education level, professional relevance, and professional title, so as to obtain the expert weight coefficients to indicate the relative importance of each expert's opinion.The criteria are shown in Table 2.The weighting factors of the experts are calculated using Equation (18).
where Q1 i -Q4 i are the weighting scores of the ith expert according to Table 2.

Construct the Bow-Tie Model with Safety Barriers
The BT model with SBs can be constructed according to the failure scenarios of the system and the actual configuration of SBs.The first step is to determine the critical event.Bellamy et al. [45] stated that any event can be a critical event, as long as it meets the needs and actual situation.Usually, the critical event is a hazardous event or dangerous event that may lead to a serious accident when the final accident has not occurred, such as mechanical failure, equipment damage, energy escape, or human errors.It can be determined according to the system design, system operation, accident experience, etc.When the critical event is defined, the fault tree in the BT model can be constructed from the critical event to basic events.Then, the potential types of failure consequences after the critical event can be analyzed, and the event tree in the BT model can be constructed from the critical event to failure consequences according to accident scenarios.Finally, the SBs are added to the correct event paths in the model.The construction process can be carried out using HAZOP, Fishbone Diagram, FMEA, or other methods.
Appl.Sci.2024, 14, 1586 11 of 33 evaluation and optimizes the calculation process and analysis results of the model using IVIFNs.This IVIF-BT method can further improve the reliability of the evaluation results.The first step in this method is to identify the system being evaluated and gather relevant information about this system.The possibility of each basic event in FT is given by expert group members according to their own knowledge and experience, as well as the actual operation situation of the system.However, it is difficult for experts to determine IVIFNs directly by using a direct assignment method, so linguistic terms (see Table 3) are adopted.Experts select the linguistic terms from Table 3 to indicate the possibilities of events [46].The selected linguistic terms are then converted into the corresponding IVIFNs to perform an aggregation operation using Equation (19).

Form an Expert Group and Assign Weights to Experts
Xi , P E 2 Xi , . . ., P E K Xi (19) where P Xi is the possibility of the ith basic event, and Xi is the possibility of the ith basic event given by the jth expert.Using Equation (20), the possibility is converted to a probability [47].
where FP Xi is the crisp value of P Xi after defuzzification through Equation ( 17), and P Xi is the probability of the ith basic event.

Linguistic Terms Abbreviation IVIFNs
Absolutely

Determine the Effect of Preventive Safety Barriers on Associated Events via IVIFNs
When preventive SBs exist, the occurrence possibilities of the events related to the SBs in FT are also given by experts, and the experts' opinions are aggregated by the IVIFWA operator.

Compute the Probability of the Critical Event with and/or without Preventive Safety Barriers
After obtaining the probability of each basic event and the probabilities of related events in the presence of SBs, the probability of the critical event P T is computed using Equations ( 21) and (22).
3.3.System Failure Consequence Analysis 3.3.1.Determine Severity Types of Failure Outcomes and Their Weights Using IVIF-AHP Traditional event trees are mainly used to analyze the probabilities of different failure outcomes (e.g., fire and explosion) in a system; however, they do not take into account the severity of the failure consequences caused by outcomes.This leads to the inability to effectively quantify the effect of various protective SBs on failure consequences through the event tree alone, thus limiting the estimation of the effectiveness of SBs.Therefore, in this study, a link between the outcomes in the ET and the severity of the consequences is established, as shown in Figure 4, through which the failure outcomes can be further converted into a severity index so that the effect of SBs on the failure consequences of the system can be measured.In Figure 4, COn refers to the failure outcomes in the ET, Cm refers to the consequence severity types, n indicates that there are n types of failure consequences, and m means that consequences can be divided into m severity types.
Appl.Sci.2024, 14, 1586 14 of 33 event tree alone, thus limiting the estimation of the effectiveness of SBs.Therefore, in this study, a link between the outcomes in the ET and the severity of the consequences is established, as shown in Figure 4, through which the failure outcomes can be further converted into a severity index so that the effect of SBs on the failure consequences of the system can be measured.In Figure 4, COn refers to the failure outcomes in the ET, Cm refers to the consequence severity types, n indicates that there are n types of failure consequences, and m means that consequences can be divided into m severity types.There are two main ways to evaluate the severity index of failure consequences.One is to estimate the monetary loss caused by each outcome, then multiply the money lost for each by the corresponding occurrence probability, and finally sum them up.However, the monetary measure for human casualties and environmental impacts is too complex and difficult to estimate.For this reason, the second way is adopted here, which is to categorize the severity of failure consequences into several types like production loss, safety effect, environmental effect, and equipment cost, and then assess the effect of each consequence on each severity type through expert judgment, and finally aggregate the effects.
Considering the fact that different severity types have different levels of impact on the consequences, the weight of each severity type  needs to be assigned before determining the severity index of each failure outcome.The IVIF-AHP is used for this.The specific procedure for calculating the weights is described below.There are two main ways to evaluate the severity index of failure consequences.One is to estimate the monetary loss caused by each outcome, then multiply the money lost for each by the corresponding occurrence probability, and finally sum them up.However, the monetary measure for human casualties and environmental impacts is too complex and difficult to estimate.For this reason, the second way is adopted here, which is to categorize the severity of failure consequences into several types like production loss, safety effect, environmental effect, and equipment cost, and then assess the effect of each consequence on each severity type through expert judgment, and finally aggregate the effects.
Considering the fact that different severity types have different levels of impact on the consequences, the weight of each severity type w i needs to be assigned before determining the severity index of each failure outcome.The IVIF-AHP is used for this.The specific procedure for calculating the weights is described below.
Firstly, the importance of pairwise comparison of each severity type is given by experts and converted into IVIFNs according to Table 4 [48].Secondly, the importance of each severity type judged by each expert IVIFWA Ci(E k ) is calculated using Equation ( 23), and then the importance of each severity type IVIFWA Ci is obtained by aggregating experts' opinions using Equation (24).
where λ k is the weight of the kth expert, and Thirdly, the rationality of the experts' opinions is verified according to the consistency ratio (CR) calculated with Equation (25).If CR does not exceed 0.1, the experts' opinions are reasonable.Otherwise, they need to be re-evaluated [49].
where RI is the random index, which is indicated in Table 5 [50].Finally, when passing the consistency test, the crisp weights of the severity types are obtained using Equations ( 26) and ( 27) [51]. where (27)

Determine the Severity Index of Each Failure Outcome
The consequence severity of each failure outcome differs, so after obtaining the relative weights of the severity types, the severity index (SI) of each potential failure outcome needs to be calculated.According to the linguistic terms in Table 3, each expert will be asked to evaluate the influence of the failure outcome COj on the severity type Ci, and thus the corresponding IVIFN a Ci COj(E K ) can be obtained.According to Equations ( 28) and ( 29), experts' opinions are aggregated to obtain the severity of each failure outcome a C COj .
After normalization, the severity index of each failure outcome SI COj is calculated using Equation (30).
Lastly, through defuzzification, the crisp severity index SI COj can be obtained.

Determine the Possibilities of the Conditioning Events in ET via IVIFNs
The possibility of each conditioning event in the ET is obtained through the aggregation of experts' opinions in Equation (31).
where P E K EV j is the possibility of the jth conditioning event converted by the linguistic term (see Table 3) given by the kth expert.

Determine the Effect of Protective Safety Barriers on Associated Events via IVIFNs
When protective SBs exist, the occurrence possibilities of the conditioning events in ET are also given by experts, and the experts' opinions are aggregated by the IVIFWA operator.

Compute the Failure Consequence Severity without Protective Safety Barriers
The probability of each failure outcome P COj can be calculated with the basic formula of ET (see Equation ( 32)).
where P EVi is the probability of the ith conditioning event.Then, the failure consequence severity CS without protective SBs can be obtained with Equation (33).
CS w/oSB = ∑ n j=1 P COj,w/oSB × SI COj (33) where P COj,w/oSB is the probability of the jth failure outcome without protective SBs.

Compute the Failure Consequence Severity Considering Protective Safety Barriers
The failure consequence severity of the system with a certain protective SB can be calculated using Equation (34).
where P COj,w/SBi is the probability of the jth failure outcome with the ith SB.

Safety Barrier Analysis
The risk index (RI) of the system without/with SBs can be calculated using Equations ( 21)- (33) when the probabilities of a critical event and the failure consequence severity (CS) are obtained.Here, the effectiveness index Eff SB is defined to describe the relative effectiveness of an SB.The higher the Eff SB is, the higher the effectiveness of the SB is, and the greater the risk reduction in the system is.

Compute the Failure Risk of the System without Safety Barriers
The failure risk index of the system without SBs can be calculated using Equation (35).
where P T,w/oSB is the occurrence probability of the critical event without SBs, and CS w/oSB is the failure consequence severity of the system without SBs.

Compute the Failure Risk of the System Considering Different Safety Barriers
The failure risk index of the system with a certain SB can be calculated using Equation (36).
RI w/SBi = P T,w/SBi × CS w/SBi (36) where RI w/SBi is the risk index with the ith SB; P T,w/SBi is the occurrence probability of the critical event with the ith SB; and CS w/SBi is the failure consequence severity of the system with the ith SB.

Compute the Effectiveness of Each Safety Barrier and Rank Safety Barriers
The Eff SB of a certain SB is calculated using Equation (37) and sorted according to their values.

Compute the Effectiveness of Various Combinations of Safety Barriers
Combining SBs in different combinations, their Eff SB values can be calculated using Equation (37) to analyze and compare their effectiveness.

Determine the Optimal Configuration of Safety Barriers for Future Plan
By comparing the Eff SB values of different SB combinations, reasonable guidance and suggestions for the optimization of SBs in the future are put forward.

Case Information
In this section, the safety barrier of a natural gas spherical storage tank in a natural gas reserve plant in western China is taken as an example.The specific analysis steps of the method are demonstrated, and its feasibility and applicability are verified.Details on the storage tank can be found in [52].

Construction of the Bow-Tie Model for Describing the Failure of Storage Tank
Natural gas is a highly flammable gas, so in the case of an ignition source, any large amount of natural gas leakage may lead to fire and explosion; in other words, the leakage of the natural gas in the storage tank is the direct cause and key link to serious safety accidents.Therefore, natural gas leakage was set as the critical event in the BT model.Through a field survey, it was found that fire, explosion, personnel suffocation, and safe dispersion were the main failure outcomes caused by natural gas leakage.Furthermore, thermal radiation and shock waves generated by fire and explosion can cause serious damage to equipment and personnel, and the high concentration of natural gas can lead to oxygen deprivation leading to personnel suffocation, while gas dispersion cannot cause harm to personnel but can cause gas loss.Based on this, the BT model of the natural gas storage tank with SBs was established, as shown in Figure 5 and Table 6.This model had seven preventive SBs and four protective SBs, as shown in Table 7. Y1-Y7 were designated as the preventive SBs, mainly involving personnel training, daily inspection, and equipment maintenance, while F1-F4 were considered the protective SBs, mainly involving a series of protective measures after natural gas leakage.
Appl.Sci.2024, 14, 1586 18 of 33 Through a field survey, it was found that fire, explosion, personnel suffocation, and safe dispersion were the main failure outcomes caused by natural gas leakage.Furthermore, thermal radiation and shock waves generated by fire and explosion can cause serious damage to equipment and personnel, and the high concentration of natural gas can lead to oxygen deprivation leading to personnel suffocation, while gas dispersion cannot cause harm to personnel but can cause gas loss.Based on this, the BT model of the natural gas storage tank with SBs was established, as shown in Figure 5 and Table 6.This model had seven preventive SBs and four protective SBs, as shown in Table 7. Y1-Y7 were designated as the preventive SBs, mainly involving personnel training, daily inspection, and equipment maintenance, while F1-F4 were considered the protective SBs, mainly involving a series of protective measures after natural gas leakage.

Expert Group Formation
In this case study, a decision-making group of three experts from enterprises and universities was established.The weights of the three experts were determined according to the scoring method shown in Table 2.The information and corresponding weights of the experts are shown in Table 8  The experts' opinions on the possibilities of basic events in the FT were obtained (see Table 9) and then converted into the corresponding IVIFNs (see Table 10) according to Table 3. Subsequently, these IVIFNs were aggregated and defuzzified into crisp values using Equations ( 15) and (17).Using Equations ( 21) and ( 22), the calculation formulas of the occurrence probability of the critical event with/without the SBs can be written as Equations ( 38)-( 50), and the calculation results are shown in Figure 7.
expert's opinions were reasonable.Finally, the weight of the consequence severity type w CS was obtained using Equations ( 26) and (27).

Results and Discussion
As shown in Figures 9 and 10, both the preventive and protective SBs can reduce the

Results and Discussion
As shown in Figures 9 and 10, both the preventive and protective SBs can reduce the failure risk of the storage tank to a certain extent.In particular, Y4 (the regular detection of deformation or damage in the storage tank), Y7 (the installation and regular maintenance of safety electrical equipment), Y6 (the regular maintenance of safety alarm system equipment), F1 (fire source detection and alarm devices), and F4 (fire alarm and extinguishing systems) have high Eff SB .This is because Y4, Y7, and Y6 are parts of the regular inspection and maintenance of key equipment, which play an important role in identifying gas leakage sources and can stop the incidents in their initial stages.F1 and F4 are responsible for monitoring sources of ignition and extinguishing fires, respectively, playing an obvious role in curbing fire, explosion, and other events with very high consequence severity.
Y1 (personnel operation and safety training), Y2 (using a checklist to establish complete and strict specifications and requirements for daily inspection work), Y3 (the regular detection of tank subsidence height and ground soil condition), and Y5 (the regular detection of the complete length of the surface coating) have low Eff SB .The reason is that Y1 and Y2 involve personnel operation, which has a high degree of uncertainty, and these two SBs can only limit third-party damage.Furthermore, Y3 mainly controls tank subsidence, having little influence on leakage.Y5 mainly limits external corrosion, which is not promi-nent for tanks in the dry western region of China.The protective SBs of F2 (storage tank pressure detection) and F3 (gas concentration detection instrument) also have relatively low Eff SB .This is because the F2 and F3 can only detect leakage but not locate it, and they have limited effect on mitigating the hazard of consequences on their own.As a result, they must cooperate with other protective measures to reduce the consequence severity effectively.

Results and Discussion
As shown in Figures 9 and 10, both the preventive and protective SBs can reduce the failure risk of the storage tank to a certain extent.In particular, Y4 (the regular detection of deformation or damage in the storage tank), Y7 (the installation and regular maintenance of safety electrical equipment), Y6 (the regular maintenance of safety alarm system equipment), F1 (fire source detection and alarm devices), and F4 (fire alarm and extinguishing systems) have high EffSB.This is because Y4, Y7, and Y6 are parts of the regular inspection and maintenance of key equipment, which play an important role in identifying gas leakage sources and can stop the incidents in their initial stages.F1 and F4 are responsible for monitoring sources of ignition and extinguishing fires, respectively, By comparing the corresponding RI and Eff SB Y1-Y7 (the combination of the preventive SBs) and F1-F4 (the combination of the protective SBs) in Figures 9 and 10, it can be inferred that Y1-Y7 are more effective than F1-F4.Therefore, when configuring SBs, it is not advisable to rely solely on protective SBs to reduce tank risks.Instead, a thorough analysis of the causes of the critical event should be carried out to ensure that preventive SBs are set up correctly to control most risks before critical events occur.
Although some barriers have a significant effect when acting alone, most barriers have a low effect.When multiple barriers work together, the risk reduction for storage tanks is very significant.In particular, the risk reduction for storage tanks is most pronounced when all SBs are present, with an Eff SB of 37.7%.The reason for this is that a single SB may only limit the probability of a single failure path, but there are often multiple failure paths for a complex system.Therefore, only when multiple SBs are in play can the risk of the system be effectively reduced and the safe operation of the storage tank be guaranteed.
Furthermore, all the SBs considered in this system were freely combined, and the effectiveness index of each combination was analyzed.The results are shown in Figure 11.Here, n is the number of SBs considered.The orange markers and labels indicate the combination of SBs with the highest effectiveness index for each combination number scenario as well as the specific effectiveness index value.It can be inferred that the Eff SB gradually increases as the number of SBs increases.Moreover, by comparing different combinations in (j), it can also be deduced that with the increase in the number of combinations, the growth rate of the effectiveness index of the best SB combination decreases.It is worth noting that when the combination includes preventive SBs Y4, Y6, and Y7, as well as protective SBs F1 and F4, Eff SB increases significantly.If and only if these SBs are included, the Eff SB reaches 34.3%, accounting for 91% of the highest Eff SB .This indicates that these five SBs play an important role in the safe operation of the storage tank.These findings provide a reference for decision-makers.For the sake of safety, when all SBs cannot be realized in actual production, at least these five SBs should be included in the system, as they are essential.Through the above analysis, it is revealed that the storage tank failure risk can be greatly controlled and mitigated in the two stages of system maintenance detection and operation.Therefore, regular inspection and maintenance plans can be formulated to ensure the normal operation and effectiveness of the storage tank system.On the one hand, in the routine maintenance of the storage tank, the monitoring of potential risks and accidents should be strengthened, which needs to focus on checking and maintaining the deformation of the storage tank, safety electrical equipment, and the integrity of the alarm system equipment.On the other hand, it is necessary to formulate a perfect fire emergency mechanism, conduct regular simulation exercises, and strengthen the emergency response ability of fire alarms and fire suppression systems.Combining the analysis results with the design, maintenance, and operational strategies of the system can effectively improve the safety of tank systems, reduce potential accident risks, and protect people and the environment.

Conclusions
Assessing the effectiveness of safety barriers (SBs) holds significance in guiding their configuration and subsequently reducing the failure risks within process systems.In this study, we proposed an integrated method to evaluate the effectiveness of SBs in process systems.This method incorporated IVIFNs into the BT model.Due to the limited data availability concerning safety barriers in practical processes, this method addresses the challenge of obtaining fundamental probability data by employing expert elicitation.Furthermore, it manages uncertainties in opinions by utilizing IVIFNs.The effectiveness of safety barriers is measured by comparing the relative change in failure risk due to the addition of the barrier.
The method was applied to analyze the SBs of a natural gas storage tank.The results show that multiple SBs are more effective than a single SB, and preventive SBs have a greater effect on system risks than protective SBs.Therefore, preventive SBs should be prioritized in order to avoid a critical event.However, as it is not possible to fully control all sources of hazards, it is desirable to also have protective SBs to control and mitigate the effects of failure consequences.The combinational analysis of SBs can also provide a comprehensive understanding of the effectiveness of each SB so that the most appropriate combination of SBs can be found to meet the requirements of safe production and cost control.
The accuracy of this method still depends on the model structure and the probabilities of bottom events, which means that the selection of experts and the supplementation of data are very important.Therefore, it is necessary to consider experts' professional background and practical experience comprehensively, giving as comprehensive information as possible to eliminate the influence of expert bias when determining the expert group.A panel of three experts was used in this study, who met the criteria for professionalism and diversity, but consulting more experts can make the model results more objective and reliable.In fact, expert elicitation is used to solve the challenge of lacking accurate and reliable objective data, and IVIFNs in further analysis are used in this method to reduce the bias and uncertainty of experts' opinions.Moreover, if objective data exist for some events of the BT model, direct assignment can make the evaluation more reliable.Therefore, in future studies, we plan to propose more effective methods to mitigate the influence of expert biases and to obtain objective actual data as comprehensively as possible to replace experts' opinions.
Due to the feasibility of the IVIFN-BT method, it can be extended to other process industry scenarios where SBs are required, and actual data are difficult to obtain.It can also provide support for safety management and risk assessment in other process industry environments.
In addition, in the current work, the SB effectiveness analysis based on the BT model is static.However, in practice, safety barriers evolve over time.Therefore, future research should further consider the changes in safety barrier functions during the evolution of an event, so as to conduct a more comprehensive assessment in the process industry.

Figure 1 .
Figure 1.General bow-tie model with safety barriers.

Figure 1 .
Figure 1.General bow-tie model with safety barriers.

Figure 2 .
Figure 2. IFS explanation of real number R.

Figure 2 .
Figure 2. IFS explanation of real number R.

Figure 3 .
Figure 3. Flowchart of the methodology proposed in this study for effectiveness evaluation of safety barriers of process systems.

Figure 3 .
Figure 3. Flowchart of the methodology proposed in this study for effectiveness evaluation of safety barriers of process systems.

Figure 4 .
Figure 4.The corresponding relationship between failure outcomes and severity types.

Figure 4 .
Figure 4.The corresponding relationship between failure outcomes and severity types.

Figure 5 .
Figure 5. Bow-tie model of the natural gas storage tank considering safety barriers.

Figure 5 .
Figure 5. Bow-tie model of the natural gas storage tank considering safety barriers. .

Figure 6 .
Figure 6.Comparison of the probabilities of the basic events in the BT model converted from IVIFNs with those from the literature [52].

Figure 6 .
Figure 6.Comparison of the probabilities of the basic events in the BT model converted from IVIFNs with those from the literature [52].4.4.2.Computation of the Probability of the Critical Event with/without Preventive Safety Barriers

Figure 9 .
Figure 9. Risk indexes of the natural gas storage tank under different safety barrier scenarios.

Figure 10 .
Figure 10.Effectiveness indexes of different safety barriers.

Figure 9 .
Figure 9. Risk indexes of the natural gas storage tank under different safety barrier scenarios.

Figure 9 .
Figure 9. Risk indexes of the natural gas storage tank under different safety barrier scenarios.

Figure 10 .
Figure 10.Effectiveness indexes of different safety barriers.

Figure 10 .
Figure 10.Effectiveness indexes of different safety barriers.

Figure 11 .
Figure 11.The effectiveness index of an arbitrary combination of the eleven safety barriers of the natural gas storage tank.The combination mode is denoted as C n 11 , where n represents the number of SBs included.(j) Box-plot of the effectiveness index for nine combination modes.

Table 1 .
Classification of safety barriers in process systems.

Table 2 .
Weighting scores of experts.

Table 5 .
Random indices of different sizes of matrices.

Table 6 .
The description of the events in the fault tree of the natural gas storage tank.

Table 6 .
The description of the events in the fault tree of the natural gas storage tank.

Table 7 .
The description of safety barriers of the natural gas storage tank.

Table 8 .
Experts' information and their weights.

Table 14 .
IVIFNs of comparison judgment matrix for criteria from Expert No.1.