An Interval-Valued Intuitionistic Fuzzy Bow-Tie Model (IVIF-BT) for the Effectiveness Evaluation of Safety Barriers in Natural Gas Storage Tank

Abstract

Safety barriers (SBs) are important means of reducing failure risks of process systems. As barriers vary in type and function, their effectiveness needs to be evaluated in order to find a more reasonable configuration strategy. However, in practice, there is often a lack of accurate and complete data relating to SBs, which poses a significant challenge in quantitatively assessing their effectiveness. To address this issue, in this study, we propose a semi-quantitative approach for evaluating the effectiveness of both preventive and protective barriers in process systems by integrating expert elicitation, interval-valued intuitionistic fuzzy numbers (IVIFNs), and a bow-tie model. In this approach, the bow-tie model is first applied to describe the system failure scenarios and the action phases of the barriers, and then IVIFNs with expert judgment are introduced to obtain the failure probabilities of basic events and the effects of SBs. Subsequently, the effectiveness of each barrier is measured by comparing the relative change in failure risk due to the addition of the barrier. To verify the feasibility of this approach, a natural gas storage tank with some barriers was analyzed. The results show that the regular inspection of the deformation or damage of the storage tank has the highest effectiveness, followed by the installation and regular maintenance of safety electrical equipment. Furthermore, compared to a single barrier, multiple barriers can significantly reduce the system risk.

1. Introduction

Configuring safety measures for the process systems is a crucial means to preventing and reducing the failure risk. These safety measures are generally called safety barriers (SBs). There are a variety of SBs in process systems, like corrosion detection devices, relief valves, flammable gas detective and alarm systems, and fire extinguishing apparatus. Different SBs have different functions and effects, which raises the important question of how well these SBs protect the system from failure threats, and which SBs are more effective. If these questions can be answered well, then a more reasonable configuration strategy for SBs may be devised according to their effectiveness. Therefore, how to evaluate the effectiveness of SBs has become a significant issue for system safety management.

There are several analysis approaches for SBs in process systems at present, such as the Swiss cheese model [1], safety barrier diagram (SBD) [2], barrier and operational risk analysis (BORA) [3], layer of protection analysis (LOPA) [4], fault tree analysis (FTA), event tree analysis (ETA) [5], Petri nets [6], Bayesian networks [7], and the bow-tie (BT) model [8]. Among these approaches, the BT model has attracted great attention due to its integration of FT and ET, which can intuitively and clearly describe system failure scenarios and the roles of SBs. According to its use, the BT model can be used for qualitative and quantitative analyses. The former is primarily used to identify which basic events or combinations will lead to the final accident, as well as to help engineers understand the nature and functions of SBs. However, the qualitative analysis cannot quantify the influence degree of SBs on system failure. Fortunately, the latter can reach such a goal as long as all the data associated with the occurrence probabilities of basic events with or without SBs can be obtained.

The quantitative BT analysis cannot be separated from high-quality and sufficient data. But in practice, things often go contrary to our wishes. On the one hand, because of the insufficient knowledge of the system, the parameters used in the BT model (like failure probability data) may be inaccurate and incomplete; on the other hand, the complexity of the system and its behavior often result in the simplification of the assumptions in the analysis process [9]. All these uncertainties can negatively affect the availability and credibility of BT analysis. Therefore, in order to mitigate this issue, several approaches have been proposed to handle uncertainty data, such as fuzzy set theory (FST), evidence theory, and rough set theory [10,11]. Among these, FST has been broadly applied in the BT model for risk assessment because of its complete theoretical basis and good usability. Wang et al. [12] proposed a probability assessment method that combined FST, BT analysis, and Bayesian updating technology to assess accidents in natural gas distribution station systems. Yazdi [13] applied the Z-number to the FT to investigate the server failure consequences of hydrocarbon storage tanks. Arici et al. [14] applied a risk analysis framework of a fuzzy BT model for maritime transportation. Das [15] combined the BT model and type-2 fuzzy set for risk quantification. Elidolu [16] carried out a static electricity risk failure analysis of oil tankers using the BT model with fuzzy logic and CREAM.

To a certain extent, a fuzzy BT model can handle uncertainty effectively during analysis, but the traditional FST still has its limitations. The membership degree of the elements in a certain set is a value in the range of [0, 1] for FST. Therefore, the membership value simply indicates the degree to which the element belongs to the set, and it cannot take into account the non-membership degree originated from experts’ lack of knowledge or hesitancy. To overcome this issue, Atanassov [17] proposed the intuitionistic fuzzy set (IFS) theory. The IFS could better describe uncertain information through the concepts of membership, non-membership, and hesitation degrees. It is therefore more appropriate to address situations in which the membership value of the element in the set may be hesitant or uncertain. Given the advantages of the IFS, it has been combined with several risk assessment techniques [18]. Guo [19] applied the IFS to FMEA for risk analysis. In the IFS theory, the language variables represented by intuitionistic fuzzy numbers were used to evaluate and transform risk factors. Yazdi [20] presented a hybrid approach of intuitional fuzzy and TOPSIS for risk matrix analysis. Subsequently, Yazdi et al. [21] used IF-AHP to address uncertain data in risk-based maintenance investment optimization. Viegas et al. [22] provided an IFS-based MCDM sorting model for improving HAZOP analysis. Kaushik and Kumar [23] proposed a novel system for safety and risk assessment. This method combines the concept of BN with FTA under an intuitionistic fuzzy environment.

Whether the FS or IFS, explicit membership and/or non-membership functions are required. As commonly known, in IF-BT models, occurrence possibilities of basic events are represented by the IFS obtained through expert elicitation. However, it is often troublesome to require experts to express the membership and non-membership degrees with crisp values, since the membership and non-membership functions may not be precisely known in many cases. For this reason, the IFS is extended to interval-valued intuitionistic fuzzy sets (IVIFSs). In IVIFSs, the membership and non-membership degrees are represented by interval values in the range of [0, 1] rather than crisp values in the range of [0, 1], which bring interval freedom to the representation and treatment of uncertainty, Therefore, the IVIFS method has become increasingly popular. Wang et al. [24] incorporated an IVIFS into a hybrid MCDM model of risk analysis to handle vagueness and uncertainty. Liu et al. [25] employed an IVIFS to express the assessment values of risk factors in FMEA. Huang [26] combined an IVIFS and rough number theory to propose an IVIF rough number concept and its corresponding FMEA model. Huang and Xiao [27] also proposed an IVIF cloud theory based on FMEA for risk evaluation.

The aforementioned studies have shown that the IVIFS approach is a valuable solution to handle uncertainty in risk and safety assessment. However, to the best of our knowledge, no methods exist for evaluating SB effectiveness involving the IVIFS concept. Therefore, this paper proposes an IVIF-BT method for safety assessment and SB evaluation by introducing an IVIFS into the BT model. In this method, the failure possibilities of basic events with/without SBs in the BT model are represented as interval-valued intuitionistic fuzzy numbers (IVIFNs) to characterize the hesitation of events. Also, an IVIF-AHP is employed to analyze the importance weights of different severity types of failure consequences. Furthermore, the SB effectiveness is clearly defined and measured by comparing system failure risk with SBs to that without SBs.

In this approach, the BT model effectively links key events with the associated causes and consequences while fully and comprehensively considering the role of SBs within the model. Compared to other methods, this approach not only allows for safety assessments but also considers the failure risks and consequences of the system in the presence of various SBs, further analyzing the effectiveness of each SB. Additionally, in this method, obtaining key data through expert elicitation enhances the applicability of the model, and the use of IVIFNs helps handle the uncertainty and fuzziness of expert opinions, thereby increasing the reliability of the model. Consequently, this method can effectively address the challenges of multiple uncertainties and incomplete information in process industries, ensuring the accuracy and credibility of safety assessments. It provides decision-makers with intuitive and comprehensive safety assessment results, aiding them in devising more effective safety management measures.

The remainder of this paper is structured as follows: Section 2 introduces basic concepts of safety barriers, the BT model, and IVIFNs. Section 3 presents the method for evaluating the effectiveness of SBs in process systems, and the detailed implementation process is given. In Section 4, to verify the feasibility of this method, an illustrative example of natural gas storage tank is provided. Finally, the analysis conclusions are drawn in Section 5.

2. Preliminaries

This section introduces the key concepts and definitions associated with safety barriers, the bow-tie model, and IVIFNs. The arithmetic operations and properties of IVIFNs are also discussed in this section.

2.1. Safety Barriers

Safety barriers (SBs) have not had a universally accepted definition so far because they cover a broad range of subjects in areas like economics, management, traffic, aeronautics and astronautics, nuclear power, and the petrochemical industry. As far as process systems are concerned, Sklet [28] recommended an appropriate definition of SBs. The definition implies three fundamental elements of SBs as follows:

• Barrier systems: physical and/or non-physical means;
• Barrier functions: for prevention, control, or mitigation;
• Barrier objects: undesired events or accidents.

Furthermore, they can be categorized into several types according to different dimensions.

Table 1. Classification of safety barriers in process systems.

Classification Principle	Classification	Description	Examples	References
Barrier functions in accident management and emergency response	Prevention	Reduce the probability of an event by suppressing some of the underlying causes or reducing their intensity.	non-flammable products	[29]
	Detection	Monitor the operation process of the system or the changing process of events.	pressure detection system
	Control	Limit the scope and/or rate of development of hazard events.	pool dispersion, overfilling of a liquid storage
	Mitigation	Limit the undesirable effects of particular events.	pressure relief systems
	Emergency response	Emergency plans formulated by internal personnel or external teams in response to major accidents.	emergency communication systems
Barrier functions and purposes in safety management	Preventive barriers	Reduce the probability of undesired events.	periodic inspection	[28]
	Protective barriers	Mitigate negative consequences of undesired events.	fire extinguishing systems
Barrier functions and implementation method in safety management	Passive barriers	Barriers operate continuously without any external actions.	fire extinguishing system, sprinkler delivery, smoke alarm systems, emergency depressurization, emergency shut-down	[4]
	Active barriers	External action is required to activate the barriers.	firewall, cofferdam, heat-resistant coating
Barrier functions and implementation method in safety management	Passive protection systems	Barriers operate continuously without any external actions.	Heat-insulating coating, fireproofing layers, containment dikes	[30]
	Active protection systems	External action is required to activate the barriers.	fire/smoke and/or heat detectors, water deluge systems
	Procedural and emergency	Procedures and contingency plans established to respond to major accidents.	fire brigade intervention, emergency teams, deploying on-site measures
Barrier types and characteristics	Passive barriers	Barriers operate continuously without any external actions.	corrosion prevention systems, walls	[31]
	Activated barriers	External action is required to activate the barriers.	water deluge systems, smoke alarms
	Human actions	Rely on the knowledge of the operator to activate barriers.	rules, guidelines, safety principles
	Symbolic barriers	Barriers that rely on symbolic indications or warnings to communicate information or provide guidance.	warning boards
Barrier properties and implementation method	Passive barriers	Barriers operate continuously without any external actions.	Surface-controlled subsurface safety valve (SCSSV)	[32]
	Active barriers	External action is required to activate the barriers.	casing, tubing, well packer
	Conditional barriers	Barriers that are either not always in place or not always capable of functioning as barriers.	stabbing valve
	Operational barriers	Barriers that function while the operation is carried out.	drilling mud
Barrier elements	Physical barriers	Barriers consist of physical or mechanical elements.	pressure relief devices, water deluge systems, firewalls	[33]
	Non-physical barriers	Barriers consist of non-physical elements.	safety training, inspection
Barrier elements (further divided in the category of non-physical barriers)	Physical and material barriers	Barriers that physically prevent an action from being carried out or an event from taking place.	firewall, heat resistant coating, pressure relief devices	[34]
	Functional barriers	Rely on systematic or functional means to prevent or mitigate the occurrence or spread of hazards.	physical lock, interlock
	Symbolic barriers	Barriers that rely on symbolic indications or warnings to communicate information or provide guidance.	warning boards
	Incorporeal barriers	Through non-physical means to raise the risk awareness among individuals to prevent or reduce hazards.	rules for actions, safety guidelines
Barrier movement characteristics	Static barriers	Barriers are available for a long time.	well packer	[32]
	Dynamic barriers	Barriers vary over time.	stabbing valves
Barrier implementation subjects or source	Personnel barriers	Barriers that reduce the accidents in terms of personnel behavior, knowledge, or attitude.	training, safety guidelines	[35]
	Organization barriers	Barriers that improve management, organizational structure, and norms to reduce accidents.	regulatory agencies, management institutions
	Technology barriers	Barriers that prevent accidents and mitigate their consequences through engineering or technological measures.	emergency shutoff valves, sprinkler systems, automatic interlocking devices
Barrier properties and implementation method	Physical	There are physical or mechanical elements in barriers.	firewalls	[36]
	Technical	Barriers that prevent accidents and mitigate their consequences through engineering or technological measures.	pressure detection systems
	Operational	Through processes, operating procedures, and other necessary activities to realize the function.	manual shut-down
	Organizational	Barriers include management systems, organizational training, security policies, and other aspects.	safety training
Barrier lifespan (durability and lifespan of the barriers)	Permanent barriers	Barriers are usually part of the design base and have a long-term existence in the management system.	firewalls	[34]
	Temporary barriers	Barriers that used to prevent accidents or limit the risk at a limited time or situation only.	manual shut-down, intervention of fire brigades

summarizes some typical classifications of SBs in process systems.

There are different requirements for SB functions and implementation methods in safety management, leading to different classification methods and principles. In addition, considering the specific application scenarios, industry standards, regulatory requirements, and specific requirements of safety management, different classification systems emphasize different aspects. Therefore, although the classification principle is the same, classification results will be different.

The classification adopted in this study is based on barrier functions. Hence, SBs are classified into preventive and protective barriers (see Figure 1). The former, involving barriers between causes and the critical event, can reduce the occurrence probabilities of hazard events, while the latter, encompassing the barriers between the critical event and outcomes, can mitigate the consequence severity of the hazard events.

Generally speaking, a catastrophic accident starts with one or some initiating events, which proceed in a certain sequence of events and evolve gradually until the accident finally occurs or aborts. SBs play a crucial role in this process. If SBs are effective and reliable, they can largely mitigate and avoid hazardous events, thus giving the system a strong protective effect, and conversely, they cannot slow down the progress of the accident. Therefore, SB performance is an issue that requires more in-depth analysis.

For safety barriers, common performance indicators include effectiveness, availability, durability, independence, etc. Among them, effectiveness is the core indicator to measure whether SBs can achieve their expected function. It can measure the degree to which the SBs mitigate system damage from the accident [37]. In some cases, effectiveness is primarily considered in the measurement of preventative barriers, expressed as a reduction in the probability of system safety events. In other cases, it is indicated by the mitigation degree of the consequences of system failure, which is common in protective barriers.

2.2. Bow-Tie Model with Safety Barriers

The bow-tie (BT) model was developed by Nielsen in the 1970s. It was named as such because the shape of the model is similar to a bow tie. The BT model can display the relationship between the risk parameters of causes, hazards, and consequences in the form of a logical block diagram. As research progressed, the BT approach became a popular risk management approach in high-risk industries such as petrochemicals, aerospace, and mining. Figure 1 illustrates a schematic diagram of a bow-tie model with SBs [38].

A complete BT model can describe the whole accident scenario from accident causes to accident consequences. When SBs are considered in the BT model, the ones located on the FT are viewed as preventive SBs, and those on the ET are protective SBs. In other words, the BT model can be used to evaluate the performance of both preventive and protective SBs. From a qualitative point of view, the BT model can help researchers and engineers understand what initial event or event set will lead to the final accident, and what role SBs play. From a quantitative point of view, if the probabilities of all the basic events occurring, along with the influence of SBs on the probabilities of the events, are determined, then it becomes possible to quantify the probability of the critical event and the ensuing consequences of failure, including the performance of each SB.

2.3. Interval-Valued Intuitionistic Fuzzy Set

2.3.1. Fuzzy Set and IFS

Zadeh [39] first proposed the theory of classical fuzzy set in 1965. In the fuzzy set theory, membership represents the degree to which an element belongs to a set or the belief that it belongs to a concept. The membership degree of an element in the domain X is usually in the range of [0, 1].

Definition 1.

Fuzzy set:

Let X be a non-empty set. A fuzzy set in X is an object A given in Equation (1) as follows:

$$A=\left\{〈x,{\mu }_A\left(x\right)〉\left|x\in X\right.\right\}$$

(1)

where ${\mu }_A\left(x\right)$ is the membership function, and $0\le {\mu }_A\left(x\right)\le 1,\forall x\in X$.

Definition 2.

Intuitionistic fuzzy set:

Let X be a non-empty set. An intuitionistic fuzzy set (IFS) in X is an object $\tilde{A}$ given in Equation (2) as follows:

$$\tilde{A}=\left\{〈x,{\mu }_{\tilde{A}}\left(x\right),v_{\tilde{A}}\left(x\right)〉\left|x\in X\right.\right\}$$

(2)

where ${\mu }_{\tilde{A}}\left(x\right):X\to \left[0,1\right]$ and ${\nu }_{\tilde{A}}\left(x\right):X\to \left[0,1\right]$, while,$0\le {\mu }_{\tilde{A}}\left(x\right)+v_{\tilde{A}}\left(x\right)\le 1,\forall x\in X$.

$${\pi }_{\tilde{A}}\left(x\right)=1-{\mu }_{\tilde{A}}\left(x\right)-v_{\tilde{A}}\left(x\right)$$

(3)

where ${\mu }_{\tilde{A}}\left(x\right),v_{\tilde{A}}\left(x\right)$, and ${\pi }_{\tilde{A}}\left(x\right)$ are the membership, non-membership, and hesitation functions, respectively. Figure 2 illustrates a typical IFS of the real number R.

2.3.2. IVIFS and IVIFNs

The interval-valued intuitionistic fuzzy set (IVIFS) was first proposed by Atanassov and Gargov [17]. In the IVIFS, the concept of interval is introduced to extend the IFS, so that the membership and non-membership functions in the IVIFS no longer function but are interval values. The concept of interval values can better address uncertain information in practice.

Definition 3.

IVIFS and IVIFNs:

Let X be a non-empty set. An IVIFS $\tilde{\alpha }$ in X is given in Equation (4).

$$\tilde{\alpha }=\left\{〈x,{\tilde{\mu }}_{\tilde{\alpha }}\left(x\right),{\tilde{v}}_{\tilde{\alpha }}\left(x\right)〉\left|x\in X\right.\right\}$$

(4)

where ${\tilde{\mu }}_{\tilde{\alpha }}\left(x\right)=\left[{\mu }_{\tilde{\alpha }}^{-},{\mu }_{\tilde{\alpha }}^{+}\right]\subset \left[0,1\right]$ and ${\tilde{\nu }}_{\tilde{\alpha }}\left(x\right)=\left[{\nu }_{\tilde{\alpha }}^{-},{\nu }_{\tilde{\alpha }}^{+}\right]\subset \left[0,1\right],\forall x\in X$. Here, ${\tilde{\mu }}_{\tilde{\alpha }}\left(x\right)$ and ${\tilde{v}}_{\tilde{\alpha }}\left(x\right)$ are the intervals with the following conditions:

$${\mu }_{\tilde{\alpha }}^{-}=\inf \left({\tilde{\mu }}_{\tilde{\alpha }}\left(x\right)\right),{\mu }_{\tilde{\alpha }}^{+}=\sup \left({\tilde{\mu }}_{\tilde{\alpha }}\left(x\right)\right)$$

(5)

and

$${\nu }_{\tilde{\alpha }}^{-}=\inf \left({\tilde{\nu }}_{\tilde{\alpha }}\left(x\right)\right),{\nu }_{\tilde{\alpha }}^{+}=\sup \left({\tilde{\nu }}_{\tilde{\alpha }}\left(x\right)\right)$$

(6)

$$0\le \sup \left({\tilde{\mu }}_{\tilde{\alpha }}\left(x\right)\right)+\sup \left({\tilde{\nu }}_{\tilde{\alpha }}\left(x\right)\right)\le 1$$

(7)

Additionally,

$${\tilde{\pi }}_{\tilde{\alpha }}\left(x\right)=\left[{\pi }_{\tilde{\alpha }}^{-},{\pi }_{\tilde{\alpha }}^{+}\right],x\in X$$

(8)

where ${\pi }_{\tilde{\alpha }}^{-}=1-{\mu }_{\tilde{\alpha }}^{+}-{\nu }_{\tilde{\alpha }}^{+},{\pi }_{\tilde{\alpha }}^{+}=1-{\mu }_{\tilde{\alpha }}^{-}-{\nu }_{\tilde{\alpha }}^{-}$.

The intervals ${\tilde{\mu }}_{\tilde{\alpha }}\left(x\right)$, ${\tilde{\nu }}_{\tilde{\alpha }}\left(x\right)$, and ${\tilde{\pi }}_{\tilde{\alpha }}\left(x\right)$ denote the degrees of membership, non-membership, and hesitation of the element x in the set X, respectively. Here, the interval pair $\left({\tilde{\mu }}_{\tilde{\alpha }}\left(x\right),{\tilde{\nu }}_{\tilde{\alpha }}\left(x\right)\right)$ is called the interval-valued intuitionistic fuzzy number (IVIFN). For convenience, it can be denoted as $\tilde{\alpha }=\left(\left[{\mu }_{\tilde{\alpha }}^{-},{\mu }_{\tilde{\alpha }}^{+}\right],\left[{\nu }_{\tilde{\alpha }}^{-},{\nu }_{\tilde{\alpha }}^{+}\right]\right)$. If ${\mu }_{\tilde{\alpha }}^{-}={\mu }_{\tilde{\alpha }}^{+}$ and ${\nu }_{\tilde{\alpha }}^{-}={\nu }_{\tilde{\alpha }}^{+}$, then the IVIFN degenerates to an intuitionistic fuzzy number (IFN).

Definition 4.

Basic arithmetic operations of IVIFNs:

Let ${\tilde{\alpha }}_1=\left(\left[{\mu }_{{\tilde{\alpha }}_1}^{-},{\mu }_{{\tilde{\alpha }}_1}^{+}\right],\left[{\nu }_{{\tilde{\alpha }}_1}^{-},{\nu }_{{\tilde{\alpha }}_1}^{+}\right]\right)$ and ${\tilde{\alpha }}_2=\left(\left[{\mu }_{{\tilde{\alpha }}_2}^{-},{\mu }_{{\tilde{\alpha }}_2}^{+}\right],\left[{\nu }_{{\tilde{\alpha }}_2}^{-},{\nu }_{{\tilde{\alpha }}_2}^{+}\right]\right)$ be two IVIFNs; λ is a positive real number. Then, some arithmetic operations can be defined using Equations (9)–(14) [40].

$${\tilde{\alpha }}_1+{\tilde{\alpha }}_2=\left(\left[{\mu }_{{\tilde{\alpha }}_1}^{-}+{\mu }_{{\tilde{\alpha }}_2}^{-}-{\mu }_{{\tilde{\alpha }}_1}^{-}{\mu }_{{\tilde{\alpha }}_2}^{-},{\mu }_{{\tilde{\alpha }}_1}^{+}+{\mu }_{{\tilde{\alpha }}_2}^{+}-{\mu }_{{\tilde{\alpha }}_1}^{+}{\mu }_{{\tilde{\alpha }}_2}^{+}\right],\left[{\nu }_{{\tilde{\alpha }}_1}^{-}{\nu }_{{\tilde{\alpha }}_2}^{-},{\nu }_{{\tilde{\alpha }}_1}^{+}{\nu }_{{\tilde{\alpha }}_2}^{+}\right]\right)$$

(9)

$${\tilde{\alpha }}_1-{\tilde{\alpha }}_2=\left(\left[{\mu }_{{\tilde{\alpha }}_1}^{-}{\nu }_{{\tilde{\alpha }}_2}^{-},{\mu }_{{\tilde{\alpha }}_1}^{+}{\nu }_{{\tilde{\alpha }}_2}^{+}\right],\left[{\nu }_{{\tilde{\alpha }}_1}^{-}+{\mu }_{{\tilde{\alpha }}_2}^{-}-{\nu }_{{\tilde{\alpha }}_1}^{-}{\mu }_{{\tilde{\alpha }}_2}^{-},{\nu }_{{\tilde{\alpha }}_1}^{+}+{\mu }_{{\tilde{\alpha }}_2}^{+}-{\nu }_{{\tilde{\alpha }}_1}^{+}{\mu }_{{\tilde{\alpha }}_2}^{+}\right]\right)$$

(10)

$${\tilde{\alpha }}_1\times {\tilde{\alpha }}_2=\left(\left[{\mu }_{{\tilde{\alpha }}_1}^{-}{\mu }_{{\tilde{\alpha }}_2}^{-},{\mu }_{{\tilde{\alpha }}_1}^{+}{\mu }_{{\tilde{\alpha }}_2}^{+}\right],\left[{\nu }_{{\tilde{\alpha }}_1}^{-}+{\nu }_{{\tilde{\alpha }}_2}^{-}-{\nu }_{{\tilde{\alpha }}_1}^{-}{\nu }_{{\tilde{\alpha }}_2}^{-},{\nu }_{{\tilde{\alpha }}_1}^{+}+{\nu }_{{\tilde{\alpha }}_2}^{+}-{\nu }_{{\tilde{\alpha }}_1}^{+}{\nu }_{{\tilde{\alpha }}_2}^{+}\right]\right)$$

(11)

$${\tilde{\alpha }}_1÷{\tilde{\alpha }}_2=\left(\left[{\mu }_{{\tilde{\alpha }}_1}^{-}+{\nu }_{{\tilde{\alpha }}_2}^{-}-{\mu }_{{\tilde{\alpha }}_1}^{-}{\nu }_{{\tilde{\alpha }}_2}^{-},{\mu }_{{\tilde{\alpha }}_1}^{+}+{\nu }_{{\tilde{\alpha }}_2}^{+}-{\mu }_{{\tilde{\alpha }}_1}^{+}{\nu }_{{\tilde{\alpha }}_2}^{+}\right],\left[{\mu }_{{\tilde{\alpha }}_1}^{-}{\nu }_{{\tilde{\alpha }}_2}^{-},{\mu }_{{\tilde{\alpha }}_1}^{+}{\nu }_{{\tilde{\alpha }}_2}^{+}\right]\right)$$

(12)

$$\lambda \tilde{\alpha }=\left(\left[1-{\left(1-{\mu }_{\tilde{\alpha }}^{-}\right)}^{\lambda },1-{\left(1-{\mu }_{\tilde{\alpha }}^{+}\right)}^{\lambda }\right],\left[{\left({\nu }_{\tilde{\alpha }}^{-}\right)}^{\lambda },{\left({\nu }_{\tilde{\alpha }}^{+}\right)}^{\lambda }\right]\right)$$

(13)

$${\tilde{\alpha }}^{\lambda }=\left(\left[{\left({\mu }_{\tilde{\alpha }}^{-}\right)}^{\lambda },{\left({\mu }_{\tilde{\alpha }}^{+}\right)}^{\lambda }\right],\left[1-{\left(1-{\nu }_{\tilde{\alpha }}^{-}\right)}^{\lambda },1-{\left(1-{\nu }_{\tilde{\alpha }}^{+}\right)}^{\lambda }\right]\right)$$

(14)

Let ${\tilde{\alpha }}_1=\left(\left[{\mu }_{{\tilde{\alpha }}_1}^{-},{\mu }_{{\tilde{\alpha }}_1}^{+}\right],\left[{\nu }_{{\tilde{\alpha }}_1}^{-},{\nu }_{{\tilde{\alpha }}_1}^{+}\right]\right)$, ${\tilde{\alpha }}_2=\left(\left[{\mu }_{{\tilde{\alpha }}_2}^{-},{\mu }_{{\tilde{\alpha }}_2}^{+}\right],\left[{\nu }_{{\tilde{\alpha }}_2}^{-},{\nu }_{{\tilde{\alpha }}_2}^{+}\right]\right)$, and ${\tilde{\alpha }}_3=\left(\left[{\mu }_{{\tilde{\alpha }}_3}^{-},{\mu }_{{\tilde{\alpha }}_3}^{+}\right],\left[{\nu }_{{\tilde{\alpha }}_3}^{-},{\nu }_{{\tilde{\alpha }}_3}^{+}\right]\right)$ be three IVIFNs. Then, we have

(1) 

Closure Property: ${\tilde{\alpha }}_1+{\tilde{\alpha }}_2$, ${\tilde{\alpha }}_1-{\tilde{\alpha }}_2$, ${\tilde{\alpha }}_1\times {\tilde{\alpha }}_2$, ${\tilde{\alpha }}_1÷{\tilde{\alpha }}_2$, $\lambda \tilde{\alpha }$ and ${\tilde{\alpha }}^{\lambda }$ are also interval-value intuitionistic fuzzy numbers;

(2) 

Commutative law: ${\tilde{\alpha }}_1+{\tilde{\alpha }}_2={\tilde{\alpha }}_2+{\tilde{\alpha }}_1$, ${\tilde{\alpha }}_1\times {\tilde{\alpha }}_2={\tilde{\alpha }}_2\times {\tilde{\alpha }}_1$;

(3) 

Associative law: $\left({\tilde{\alpha }}_1+{\tilde{\alpha }}_2\right)+{\tilde{\alpha }}_3={\tilde{\alpha }}_1+\left({\tilde{\alpha }}_2+{\tilde{\alpha }}_3\right)$, $\left({\tilde{\alpha }}_1\times {\tilde{\alpha }}_2\right)\times {\tilde{\alpha }}_3={\tilde{\alpha }}_1\times \left({\tilde{\alpha }}_2\times {\tilde{\alpha }}_3\right)$;

(4) 

Distributive law: ${\tilde{\alpha }}_1-\left({\tilde{\alpha }}_2+{\tilde{\alpha }}_3\right)={\tilde{\alpha }}_1-{\tilde{\alpha }}_2-{\tilde{\alpha }}_3$, ${\tilde{\alpha }}_1÷\left({\tilde{\alpha }}_2\times {\tilde{\alpha }}_3\right)={\tilde{\alpha }}_1÷{\tilde{\alpha }}_2÷{\tilde{\alpha }}_3$.

Definition 5.

Aggregation operation of IVIFNs:

Let ${\tilde{\alpha }}_i=\left(\left[{\mu }_{{\tilde{\alpha }}_i}^{-},{\mu }_{{\tilde{\alpha }}_i}^{+}\right],\left[{\nu }_{{\tilde{\alpha }}_i}^{-},{\nu }_{{\tilde{\alpha }}_i}^{+}\right]\right),\left(i=1,2,\dots ,n\right)$  be a collection of IVIFNs,$I^n\to I$, I be the set of IVIFN, and $w={\left(w_1,w_2,\dots ,w_n\right)}^T$ be the weight vector, where $w_i\in \left[0,1\right]$ and ${\displaystyle {\sum }_{i=1}^n{w}_i=1}$. The aggregation operations commonly used in IVIFNs are the interval-valued intuitionistic fuzzy weighted arithmetic averaging (IVIFWA) operator and the weighted geometric averaging (IVIFWG) operator, which are defined using Equations (15) and (16), respectively [41,42,43].

$$\mathrm{IVIFWA}\left({\tilde{\alpha }}_1,{\tilde{\alpha }}_2,\dots ,{\tilde{\alpha }}_n\right)=\left(\left[1-\prod _{i=1}^n{\left(1-{\mu }_{{\tilde{\alpha }}_i}^{-}\right)}^{w_i},1-\prod _{i=1}^n{\left(1-{\mu }_{{\tilde{\alpha }}_i}^{+}\right)}^{w_i}\right],\left[\prod _{i=1}^n{\left({\nu }_{{\tilde{\alpha }}_i}^{-}\right)}^{w_i},\prod _{i=1}^n{\left({\nu }_{{\tilde{\alpha }}_i}^{+}\right)}^{w_i}\right]\right)$$

(15)

$$\mathrm{IVIFWG}\left({\tilde{\alpha }}_1,{\tilde{\alpha }}_2,\dots ,{\tilde{\alpha }}_n\right)=\left(\left[\prod _{i=1}^n{\left({\mu }_{{\tilde{\alpha }}_i}^{-}\right)}^{w_i},\prod _{i=1}^n{\left({\mu }_{{\tilde{\alpha }}_i}^{+}\right)}^{w_i}\right],\left[1-\prod _{i=1}^n{\left(1-{\nu }_{{\tilde{\alpha }}_i}^{-}\right)}^{w_i},1-\prod _{i=1}^n{\left(1-{\nu }_{{\tilde{\alpha }}_i}^{+}\right)}^{w_i}\right]\right)$$

(16)

In order to easily and quickly aggregate IVIFNs, the IVIFWA operator was used in this study.

Definition 6.

Defuzzification of IVIFN:

Let $\tilde{\alpha }=\left(\left[{\mu }_{\tilde{\alpha }}^{-},{\mu }_{\tilde{\alpha }}^{+}\right],\left[{\nu }_{\tilde{\alpha }}^{-},{\nu }_{\tilde{\alpha }}^{+}\right]\right)$ be an IVIFN. Equation (17) can be used to defuzzify $\tilde{\alpha }$ [42,44] as follows:

$$I\left(\tilde{\alpha }\right)=\frac{{\mu }_{\tilde{\alpha }}^{-}+{\mu }_{\tilde{\alpha }}^{+}+\left(1-{\nu }_{\tilde{\alpha }}^{-}\right)+\left(1-{\nu }_{\tilde{\alpha }}^{+}\right)+{\mu }_{\tilde{\alpha }}^{-}\times {\mu }_{\tilde{\alpha }}^{+}-\sqrt{\left(1-{\nu }_{\tilde{\alpha }}^{-}\right)\times \left(1-{\nu }_{\tilde{\alpha }}^{+}\right)}}{4}$$

(17)

3. Proposed Effectiveness Evaluation Method of Safety Barrier

In this section, the proposed method for the effectiveness evaluation of SBs based on the integration of IVIFNs and bow-tie methodology is described in detail. The method aims to evaluate the effectiveness of SBs in improving system safety. The point-to-point guide to this method is shown in Figure 3, which mainly consists of four critical procedures, and a brief overview of each critical procedure is as follows: (1) Preparatory work: This initial step involves identifying the system under evaluation, forming an expert group, and constructing the corresponding BT model with SBs. (2) System failure probability analysis: In this procedure, the possibility of system failure events and the effectiveness of preventive SBs are assessed using IVIFNs. (3) System failure consequence analysis: The severity of failure consequences and the effectiveness of protective SBs are evaluated using the IVIF-AHP and IVIFNs, respectively. (4) Safety barrier analysis: Finally, the failure risk of the system with and without SBs is computed, and the effectiveness of various safety barrier configurations is analyzed to provide recommendations for future safety planning. In summary, this method takes the BT model with SBs as the basis of safety evaluation and optimizes the calculation process and analysis results of the model using IVIFNs. This IVIF-BT method can further improve the reliability of the evaluation results.

3.1. Preparatory Work

3.1.1. Identify the System to Be Evaluated

The first step in this method is to identify the system being evaluated and gather relevant information about this system.

3.1.2. Form an Expert Group and Assign Weights to Experts

To address the lack and inaccuracy of objective data, an expert decision-making group composed of K experts and/or engineers is needed to provide the required system information. The selection of experts should follow the principle of diversity and professionalism as far as possible. In general, the opinions given by experts vary depending on their educational profile, professional types, and work experience, making the opinions more comprehensive. Therefore, experts are evaluated by considering their work experience, education level, professional relevance, and professional title, so as to obtain the expert weight coefficients to indicate the relative importance of each expert’s opinion. The criteria are shown in

Table 2. Weighting scores of experts.

Criterion	Classification	Score
Work experience (Q1)	>30 years	4
	21–30 years	3
	11–20 years	2
	<10 years	1
Education level (Q2)	Doctor’s	4
	Master’s	3
	Bachelor’s	2
	Technical school	1
Professional relevance (Q3)	Completely related	4
	Basically related	3
	Basically irrelevant	2
	Completely irrelevant	1
Professional title (Q4)	Senior	4
	Deputy senior	3
	Intermediate	2
	Primary	1

. The weighting factors of the experts are calculated using Equation (18).

$${\lambda }_i=\frac{Q{1}_i+Q{2}_i+Q{3}_i+Q{4}_i}{{\displaystyle {\sum }_{j=1}^k\left(Q{1}_j+Q{2}_j+Q{3}_j+Q{4}_j\right)}}$$

(18)

where Q1_i–Q4_i are the weighting scores of the ith expert according to Table 2.

3.1.3. Construct the Bow-Tie Model with Safety Barriers

The BT model with SBs can be constructed according to the failure scenarios of the system and the actual configuration of SBs. The first step is to determine the critical event. Bellamy et al. [45] stated that any event can be a critical event, as long as it meets the needs and actual situation. Usually, the critical event is a hazardous event or dangerous event that may lead to a serious accident when the final accident has not occurred, such as mechanical failure, equipment damage, energy escape, or human errors. It can be determined according to the system design, system operation, accident experience, etc. When the critical event is defined, the fault tree in the BT model can be constructed from the critical event to basic events. Then, the potential types of failure consequences after the critical event can be analyzed, and the event tree in the BT model can be constructed from the critical event to failure consequences according to accident scenarios. Finally, the SBs are added to the correct event paths in the model. The construction process can be carried out using HAZOP, Fishbone Diagram, FMEA, or other methods.

3.2. System Failure Probability Analysis

3.2.1. Determine the Possibility of Each Basic Event in FT via IVIFNs

The possibility of each basic event in FT is given by expert group members according to their own knowledge and experience, as well as the actual operation situation of the system. However, it is difficult for experts to determine IVIFNs directly by using a direct assignment method, so linguistic terms (see

Table 3. Linguistic scale and their corresponding IVIFNs [46].

Linguistic Terms	Abbreviation	IVIFNs
Absolutely Low	AL	([0, 0.2], [0.5, 0.8])
Very Low	VL	([0.1, 0.3], [0.4, 0.7])
Low	L	([0.2, 0.4], [0.3, 0.6])
Medium Low	ML	([0.3, 0.5], [0.2, 0.5])
Medium	M	([0.4, 0.6], [0.2, 0.4])
Medium High	MH	([0.5, 0.7], [0.1, 0.3])
High	H	([0.6, 0.8], [0, 0.2])
Very High	VH	([0.7, 0.9], [0, 0.1])
Absolutely High	AH	([0.8, 1.0], [0, 0])

) are adopted. Experts select the linguistic terms from Table 3 to indicate the possibilities of events [46]. The selected linguistic terms are then converted into the corresponding IVIFNs to perform an aggregation operation using Equation (19).

$${\tilde{P}}_{Xi}=IVIFWA\left({\tilde{P}}_{Xi}^{E_1},{\tilde{P}}_{Xi}^{E_2},\dots ,{\tilde{P}}_{Xi}^{E_K}\right)$$

(19)

where ${\tilde{P}}_{Xi}$ is the possibility of the ith basic event, and ${\tilde{P}}_{Xi}^{E_j}$ is the possibility of the ith basic event given by the jth expert. Using Equation (20), the possibility is converted to a probability [47].

$$P_{Xi}=\left\{\begin{array}{cc}\frac{1}{{10}^k},& forF{P}_{Xi}\ne 0\\ 0,& forF{P}_{Xi}=0\end{array}\right.,k={\left(\frac{1-F{P}_{Xi}}{F{P}_{Xi}}\right)}^{\frac{1}{3}}\times 2.301$$

(20)

where $F{P}_{Xi}$ is the crisp value of ${\tilde{P}}_{Xi}$ after defuzzification through Equation (17), and $P_{Xi}$ is the probability of the ith basic event.

3.2.2. Determine the Effect of Preventive Safety Barriers on Associated Events via IVIFNs

When preventive SBs exist, the occurrence possibilities of the events related to the SBs in FT are also given by experts, and the experts’ opinions are aggregated by the IVIFWA operator.

3.2.3. Compute the Probability of the Critical Event with and/or without Preventive Safety Barriers

After obtaining the probability of each basic event and the probabilities of related events in the presence of SBs, the probability of the critical event P_T is computed using Equations (21) and (22).

$$P_{AND}={\displaystyle {\prod }_{i=1}^n{P}_{Xi}}$$

(21)

$$P_{OR}=1-{\displaystyle {\prod }_{i=1}^n\left(1-P_{Xi}\right)}$$

(22)

3.3. System Failure Consequence Analysis

3.3.1. Determine Severity Types of Failure Outcomes and Their Weights Using IVIF-AHP

Traditional event trees are mainly used to analyze the probabilities of different failure outcomes (e.g., fire and explosion) in a system; however, they do not take into account the severity of the failure consequences caused by outcomes. This leads to the inability to effectively quantify the effect of various protective SBs on failure consequences through the event tree alone, thus limiting the estimation of the effectiveness of SBs. Therefore, in this study, a link between the outcomes in the ET and the severity of the consequences is established, as shown in Figure 4, through which the failure outcomes can be further converted into a severity index so that the effect of SBs on the failure consequences of the system can be measured. In Figure 4, COn refers to the failure outcomes in the ET, Cm refers to the consequence severity types, n indicates that there are n types of failure consequences, and m means that consequences can be divided into m severity types.

There are two main ways to evaluate the severity index of failure consequences. One is to estimate the monetary loss caused by each outcome, then multiply the money lost for each by the corresponding occurrence probability, and finally sum them up. However, the monetary measure for human casualties and environmental impacts is too complex and difficult to estimate. For this reason, the second way is adopted here, which is to categorize the severity of failure consequences into several types like production loss, safety effect, environmental effect, and equipment cost, and then assess the effect of each consequence on each severity type through expert judgment, and finally aggregate the effects.

Considering the fact that different severity types have different levels of impact on the consequences, the weight of each severity type $w_i$ needs to be assigned before determining the severity index of each failure outcome. The IVIF-AHP is used for this. The specific procedure for calculating the weights is described below.

Firstly, the importance of pairwise comparison of each severity type is given by experts and converted into IVIFNs according to

Table 4. IVIF-AHP preference scale.

Preference in Pairwise Comparison	Notation	AHP Preference Number	IVIFNs
Equally Important	EI	1	([0.38, 0.42], [0.22, 0.58])
Equally Very Important	EVI	2	([0.29, 0.41], [0.12, 0.58])
Moderately Important	MI	3	([0.10, 0.43], [0.03, 0.57])
Moderately More Important	MMI	4	([0.03, 0.47], [0.03, 0.53])
Strongly Important	SI	5	([0.13, 0.53], [0.07, 0.47])
Strongly More Important	SMI	6	([0.32, 0.62], [0.08, 0.38])
Very Strongly More Important	VSMI	7	([0.52, 0.72], [0.08, 0.28])
Extremely Strong Important	ESI	8	([0.75, 0.85], [0.05, 0.15])
Extremely More Important	EMI	9	([1.00, 1.00], [0.00, 0.00])

Note: Reciprocal IVIF values can be obtained by exchanging $\left[{\mu }^{-},{\mu }^{+}\right]$ and $\left[{\nu }^{-},{\nu }^{+}\right]$.

[48]. Secondly, the importance of each severity type judged by each expert ${\mathrm{IVIFWA}}_{Ci\left(E_k\right)}$ is calculated using Equation (23), and then the importance of each severity type ${\mathrm{IVIFWA}}_{Ci}$ is obtained by aggregating experts’ opinions using Equation (24).

$${\mathrm{IVIFWA}}_{Ci\left(E_k\right)}=\left(\begin{array}{c}\left[1-{\prod }_{j=1}^n{\left(1-{\mu }_{{\tilde{A}}_{ij}^{\left(k\right)}}^{-}\right)}^{{\lambda }^{\left(k\right)}},1-{\prod }_{j=1}^n{\left(1-{\mu }_{{\tilde{A}}_{ij}^{\left(k\right)}}^{+}\right)}^{{\lambda }^{\left(k\right)}}\right],\\ {\prod }_{j=1}^n{\left({\nu }_{{\tilde{A}}_{ij}^{\left(k\right)}}^{-}\right)}^{{\lambda }^{\left(k\right)}},{\prod }_{j=1}^n{\left({\nu }_{{\tilde{A}}_{ij}^{\left(k\right)}}^{+}\right)}^{{\lambda }^{\left(k\right)}}\end{array}\right)$$

(23)

$${\mathrm{IVIFWA}}_{Ci}=\left(\begin{array}{c}\left[1-{\prod }_{k=1}^K{\left(1-{\mu }_{\tilde{A}}^{-}\right)}^{{\lambda }_k},1-{\prod }_{k=1}^K{\left(1-{\mu }_{\tilde{A}}^{+}\right)}^{{\lambda }_k}\right],\\ {\prod }_{k=1}^K{\left({\nu }_{\tilde{A}}^{-}\right)}^{{\lambda }_k},{\prod }_{k=1}^K{\left({\nu }_{\tilde{A}}^{+}\right)}^{{\lambda }_k}\end{array}\right)$$

(24)

where ${\lambda }_k$ is the weight of the kth expert, and ${\displaystyle {\sum }_{k=1}^K{\lambda }_k}=1$.

Thirdly, the rationality of the experts’ opinions is verified according to the consistency ratio (CR) calculated with Equation (25). If CR does not exceed 0.1, the experts’ opinions are reasonable. Otherwise, they need to be re-evaluated [49].

$$CR=\frac{RI-\frac{{\displaystyle \sum {\pi }_{ij}^{+}\left(x\right)}}{n}}{n-1}$$

(25)

where RI is the random index, which is indicated in

Table 5. Random indices of different sizes of matrices.

n	1	2	3	4	5	6	7	8	9
RI	0.0	0.0	0.58	0.90	1.12	1.24	1.32	1.41	1.45

[50].

Finally, when passing the consistency test, the crisp weights of the severity types are obtained using Equations (26) and (27) [51].

$$w_{CSi}=\frac{1-{\tilde{w}}_i}{n-{\displaystyle {\sum }_{i=1}^n{\tilde{w}}_i}}$$

(26)

where

$${\tilde{w}}_i=1-\frac{{\displaystyle {\sum }_{k=1}^K\frac{{\lambda }_k\left({\mu }_{{\tilde{A}}_i}^{-}+{\mu }_{{\tilde{A}}_i}^{+}\right)}{2}}}{\sqrt{{\displaystyle {\sum }_{k=1}^K\frac{{\lambda }_k\left({\left({\mu }_{{\tilde{A}}_i}^{-}\right)}^2+{\left({\mu }_{{\tilde{A}}_i}^{+}\right)}^2+{\left({\nu }_{{\tilde{A}}_i}^{-}\right)}^2+{\left({\nu }_{{\tilde{A}}_i}^{+}\right)}^2\right)}{2}}}}$$

(27)

3.3.2. Determine the Severity Index of Each Failure Outcome

The consequence severity of each failure outcome differs, so after obtaining the relative weights of the severity types, the severity index (SI) of each potential failure outcome needs to be calculated. According to the linguistic terms in Table 3, each expert will be asked to evaluate the influence of the failure outcome COj on the severity type Ci, and thus the corresponding IVIFN ${\tilde{a}}_{COj\left(E_K\right)}^{Ci}$ can be obtained.

According to Equations (28) and (29), experts’ opinions are aggregated to obtain the severity of each failure outcome ${\tilde{a}}_{COj}^C$.

$${\tilde{a}}_{COj}^{Ci}=\mathrm{IVIFWA}\left({\tilde{a}}_{COj\left(E_1\right)}^{Ci},{\tilde{a}}_{COj\left(E_2\right)}^{Ci},\dots ,{\tilde{a}}_{COj\left(E_K\right)}^{Ci}\right)$$

(28)

$${\tilde{a}}_{COj}^C=\mathrm{IVIFWA}\left({\tilde{a}}_{COj}^{C1},{\tilde{a}}_{COj}^{C2},\dots ,{\tilde{a}}_{COj}^{Cm}\right)$$

(29)

After normalization, the severity index of each failure outcome ${\widetilde{SI}}_{COj}$ is calculated using Equation (30).

$${\widetilde{SI}}_{COj}={\tilde{a}}_{COj}^C÷{\displaystyle {\sum }_{j=1}^m{\tilde{a}}_{COj}^C}$$

(30)

Lastly, through defuzzification, the crisp severity index $S{I}_{COj}$ can be obtained.

3.3.3. Determine the Possibilities of the Conditioning Events in ET via IVIFNs

The possibility of each conditioning event in the ET is obtained through the aggregation of experts’ opinions in Equation (31).

$${\tilde{P}}_{EVj}=\mathrm{IVIFWA}\left({\tilde{P}}_{EVj}^{E_1},{\tilde{P}}_{EVj}^{E_2},\dots ,{\tilde{P}}_{EVj}^{E_K}\right)$$

(31)

where ${\tilde{P}}_{EVj}^{E_K}$ is the possibility of the jth conditioning event converted by the linguistic term (see Table 3) given by the kth expert.

3.3.4. Determine the Effect of Protective Safety Barriers on Associated Events via IVIFNs

When protective SBs exist, the occurrence possibilities of the conditioning events in ET are also given by experts, and the experts’ opinions are aggregated by the IVIFWA operator.

3.3.5. Compute the Failure Consequence Severity without Protective Safety Barriers

The probability of each failure outcome $P_{COj}$ can be calculated with the basic formula of ET (see Equation (32)).

$$P_{COj}={\displaystyle {\prod }_{i=1}^n{P}_{EVi}}$$

(32)

where $P_{EVi}$ is the probability of the ith conditioning event. Then, the failure consequence severity CS without protective SBs can be obtained with Equation (33).

$$C{S}_{w/oSB}={\displaystyle {\sum }_{j=1}^n\left(P_{COj,w/oSB}\times S{I}_{COj}\right)}$$

(33)

where $P_{COj,w/oSB}$ is the probability of the jth failure outcome without protective SBs.

3.3.6. Compute the Failure Consequence Severity Considering Protective Safety Barriers

The failure consequence severity of the system with a certain protective SB can be calculated using Equation (34).

$$C{S}_{w/SBi}={\displaystyle {\sum }_{j=1}^n\left(P_{COj,w/SBi}\times S{I}_{COj}\right)}$$

(34)

where $P_{COj,w/SBi}$ is the probability of the jth failure outcome with the ith SB.

3.4. Safety Barrier Analysis

The risk index (RI) of the system without/with SBs can be calculated using Equations (21)–(33) when the probabilities of a critical event and the failure consequence severity (CS) are obtained. Here, the effectiveness index Eff_SB is defined to describe the relative effectiveness of an SB. The higher the Eff_SB is, the higher the effectiveness of the SB is, and the greater the risk reduction in the system is.

3.4.1. Compute the Failure Risk of the System without Safety Barriers

The failure risk index of the system without SBs can be calculated using Equation (35).

$$R{I}_{w/oSB}=P_{T,w/oSB}\times C{S}_{w/oSB}$$

(35)

where $P_{T,w/oSB}$ is the occurrence probability of the critical event without SBs, and $C{S}_{w/oSB}$ is the failure consequence severity of the system without SBs.

3.4.2. Compute the Failure Risk of the System Considering Different Safety Barriers

The failure risk index of the system with a certain SB can be calculated using Equation (36).

$$R{I}_{w/SBi}=P_{T,w/SBi}\times C{S}_{w/SBi}$$

(36)

where $R{I}_{w/SBi}$ is the risk index with the ith SB; $P_{T,w/SBi}$ is the occurrence probability of the critical event with the ith SB; and $C{S}_{w/SBi}$ is the failure consequence severity of the system with the ith SB.

3.4.3. Compute the Effectiveness of Each Safety Barrier and Rank Safety Barriers

The Eff_SB of a certain SB is calculated using Equation (37) and sorted according to their values.

$$Ef{f}_{SBi}=\frac{R{I}_{w/oSB}-R{I}_{w/SBi}}{R{I}_{w/oSB}}$$

(37)

3.4.4. Compute the Effectiveness of Various Combinations of Safety Barriers

Combining SBs in different combinations, their Eff_SB values can be calculated using Equation (37) to analyze and compare their effectiveness.

3.4.5. Determine the Optimal Configuration of Safety Barriers for Future Plan

By comparing the Eff_SB values of different SB combinations, reasonable guidance and suggestions for the optimization of SBs in the future are put forward.

4. Case Study

4.1. Case Information

In this section, the safety barrier of a natural gas spherical storage tank in a natural gas reserve plant in western China is taken as an example. The specific analysis steps of the method are demonstrated, and its feasibility and applicability are verified. Details on the storage tank can be found in [52].

4.2. Construction of the Bow-Tie Model for Describing the Failure of Storage Tank

Natural gas is a highly flammable gas, so in the case of an ignition source, any large amount of natural gas leakage may lead to fire and explosion; in other words, the leakage of the natural gas in the storage tank is the direct cause and key link to serious safety accidents. Therefore, natural gas leakage was set as the critical event in the BT model. Through a field survey, it was found that fire, explosion, personnel suffocation, and safe dispersion were the main failure outcomes caused by natural gas leakage. Furthermore, thermal radiation and shock waves generated by fire and explosion can cause serious damage to equipment and personnel, and the high concentration of natural gas can lead to oxygen deprivation leading to personnel suffocation, while gas dispersion cannot cause harm to personnel but can cause gas loss. Based on this, the BT model of the natural gas storage tank with SBs was established, as shown in Figure 5 and

Table 6. The description of the events in the fault tree of the natural gas storage tank.

Symbol	Content	Symbol	Content
X1	Geological factors	M3	Equipment reasons
X2	Environmental factors	M4	Natural factors
X3	Failure to standardize operation according to requirements	M5	Non-natural factors
X4	Daily inspections do not meet the requirements	M6	Main equipment
X5	Mechanical breakdown	M7	Others
X6	Installation failure	M8	Design reasons
X7	Design specification failure	M9	Processing problem
X8	Unreasonable layout	M10	Material reasons
X9	Foundation subsidence or displacement	M11	Instrument problem
X10	Weld defect	M12	Corrosion
X11	Failure to finish processing as required	M13	External corrosion
X12	Deformation/breakage	EV1	Generate an open flame
X13	Internal corrosion occurred	EV2	Forming steam clouds
X14	Damage of coating	EV3	Limited space
X15	External environment meets corrosion standards	EV4	Delayed ignition
X16	Failure of other fittings	CO1	Jet fire
X17	No alarm/indicator light	CO2	Vapor cloud explosion
X18	Other failures in the instrument system	CO3	Poisoning
X19	Instrument system open circuit	CO4	Flash fire
M1	Natural gas leakage	CO5	Natural gas dispersion
M2	Third-party sabotage	CO6	Deflagration

. This model had seven preventive SBs and four protective SBs, as shown in

Table 7. The description of safety barriers of the natural gas storage tank.

Symbol	Description	Safety Barrier Type
Y1	Personnel operation and safety training	Preventive safety barriers
Y2	Using a checklist to establish complete and strict specifications and requirements for daily inspection work
Y3	Regular detection of tank subsidence height and ground soil condition
Y4	Regular detection of deformation or damage in the storage tank
Y5	Regular detection of the complete length of the surface coating
Y6	Regular maintenance of safety alarm system equipment
Y7	Installation and regular maintenance of safety electrical equipment
F1	Fire source detection and alarm device	Protective safety barriers
F2	Storage tank pressure detection
F3	Gas concentration detection instrument
F4	Fire alarm and extinguishing system

. Y1–Y7 were designated as the preventive SBs, mainly involving personnel training, daily inspection, and equipment maintenance, while F1–F4 were considered the protective SBs, mainly involving a series of protective measures after natural gas leakage.

4.3. Expert Group Formation

In this case study, a decision-making group of three experts from enterprises and universities was established. The weights of the three experts were determined according to the scoring method shown in Table 2. The information and corresponding weights of the experts are shown in

Table 8. Experts’ information and their weights.

Number	Work Experience (Year)	Education Level	Professional Relevance	Professional Title	Weight (λi)
1	21	Master’s	Basically related	Senior	0.382
2	4	PhD	Basically related	Deputy senior	0.324
3	11	Master’s	Basically irrelevant	Deputy senior	0.294

.

4.4. System Failure Probability Analysis

4.4.1. Determination of the Possibilities of Basic Events

The experts’ opinions on the possibilities of basic events in the FT were obtained (see

Table 9. Experts’ linguistic judgments for the possibilities of basic events.

Basic Events	Expert No.1	Expert No.2	Expert No.3	Basic Events	Expert No.1	Expert No.2	Expert No.3
X1	AL	VL	AL	X14	MH	M	MH
X2	VL	VL	VL	X15	H	MH	MH
X3	M	M	M	X16	MH	MH	M
X4	M	MH	M	X17	VH	H	M
X5	AH	AH	VH	X18	MH	VH	VH
X6	M	ML	ML	X19	VH	VH	H
X7	M	ML	M	X3-Y1	ML	ML	L
X8	L	L	ML	X4-Y2	L	ML	ML
X9	MH	M	M	X9-Y3	ML	L	ML
X10	H	M	VH	X12-Y4	L	VL	L
X11	H	VH	H	X14-Y5	L	L	ML
X12	VH	AH	H	X17-Y6	ML	L	L
X13	MH	VH	VH	X19-Y7	L	ML	VL

) and then converted into the corresponding IVIFNs (see

Table 10. The IVIFNs and the aggregation values for the possibilities of basic events.

Basic Events	Expert No.1	Expert No.2	Expert No.3	Aggregation Value
X1	([0, 0.2], [0.5, 0.8])	([0.1, 0.3], [0.4, 0.7])	([0, 0.2], [0.5, 0.8])	([0.0335, 0.2339], [0.4651, 0.7661])
X2	([0.1, 0.3], [0.4, 0.7])	([0.1, 0.3], [0.4, 0.7])	([0.1, 0.3], [0.4, 0.7])	([0.1, 0.3], [0.4, 0.7])
X3	([0.4, 0.6], [0.2, 0.4])	([0.4, 0.6], [0.2, 0.4])	([0.4, 0.6], [0.2, 0.4])	([0.4, 0.6], [0.2, 0.4])
X4	([0.4, 0.6], [0.2, 0.4])	([0.5, 0.7], [0.1, 0.3])	([0.4, 0.6], [0.2, 0.4])	([0.4344, 0.6356], [0.1598, 0.3644])
X5	([0.8, 1], [0, 0])	([0.8, 1], [0, 0])	([0.7, 0.9], [0, 0.1])	([0.7747, 1], [0, 0])
X6	([0.4, 0.6], [0.2, 0.4])	([0.4, 0.6], [0.2, 0.4])	([0.3, 0.5], [0.2, 0.5])	([0.3400, 0.5409], [0.2, 0.4591])
X7	([0.4, 0.6], [0.2, 0.4])	([0.3, 0.5], [0.2, 0.5])	([0.4, 0.6], [0.2, 0.4])	([0.3693, 0.5700], [0.2, 0.4230])
X8	([0.2, 0.4], [0.3, 0.6])	([0.2, 0.4], [0.3, 0.6])	([0.3, 0.5], [0.2, 0.5])	([0.2308, 0.4313], [0.2663, 0.5687])
X9	([0.5, 0.7], [0.1, 0.3])	([0.4, 0.6], [0.2, 0.4])	([0.4, 0.6], [0.2, 0.4])	([0.4404, 0.6416], [0.1535, 0.3584])
X10	([0.6, 0.8], [0, 0.2])	([0.4, 0.6], [0.2, 0.4])	([0.7, 0.9], [0, 0.1])	([0.5808, 0.7958], [0, 0.2042])
X11	([0.6, 0.8], [0, 0.2])	([0.7, 0.9], [0, 0.1])	([0.6, 0.8], [0, 0.2])	([0.6356, 0.8402], [0, 0.1598])
X12	([0.7, 0.9], [0, 0.1])	([0.8, 1], [0, 0])	([0.6, 0.8], [0, 0.2])	([0.7137, 1], [0, 0])
X13	([0.5, 0.7], [0.1, 0.3])	([0.7, 0.9], [0, 0.1])	([0.7, 0.9], [0, 0.1])	([0.6354, 0.8479], [0, 0.1521])
X14	([0.5, 0.7], [0.1, 0.3])	([0.6, 0.8], [0, 0.2])	([0.5, 0.7], [0.1, 0.3])	([0.4695, 0.6707], [0.1252, 0.3293])
X15	([0.6, 0.8], [0, 0.2])	([0.5, 0.7], [0.1, 0.3])	([0.5, 0.7], [0.1, 0.3])	([0.5409, 0.7430], [0, 0.2570])
X16	([0.5, 0.7], [0.1, 0.3])	([0.5, 0.7], [0.1, 0.3])	([0.4, 0.6], [0.2, 0.4])	([0.4725, 0.6735], [0.1226, 0.3265])
X17	([0.7, 0.9], [0, 0.1])	([0.6, 0.8], [0, 0.2])	([0.4, 0.6], [0.2, 0.4])	([0.5963, 0.8118], [0, 0.1882])
X18	([0.5, 0.7], [0.1, 0.3])	([0.7, 0.9], [0, 0.1])	([0.7, 0.9], [0, 0.1])	([0.6354, 0.8479], [0, 0.1521])
X19	([0.7, 0.9], [0, 0.1])	([0.7, 0.9], [0, 0.1])	([0.6, 0.8], [0, 0.2])	([0.6735, 0.8774], [0, 0.1226])
X3-Y1	([0.3, 0.5], [0.2, 0.5])	([0.3, 0.5], [0.2, 0.5])	([0.2, 0.4], [0.3, 0.6])	([0.2720, 0.4725], [0.2253, 0.5275])
X4-Y2	([0.2, 0.4], [0.3, 0.6])	([0.3, 0.5], [0.2, 0.5])	([0.3, 0.5], [0.2, 0.5])	([0.2634, 0.4639], [0.2335, 0.5361])
X9-Y3	([0.3, 0.5], [0.2, 0.5])	([0.2, 0.4], [0.3, 0.6])	([0.3, 0.5], [0.2, 0.5])	([0.2691, 0.4696], [0.2281, 0.5304])
X12-Y4	([0.2, 0.4], [0.3, 0.6])	([0.1, 0.3], [0.4, 0.7])	([0.2, 0.4], [0.3, 0.6])	([0.1689, 0.3693], [0.3293, 0.6307])
X14-Y5	([0.2, 0.4], [0.3, 0.6])	([0.2, 0.4], [0.3, 0.6])	([0.3, 0.5], [0.2, 0.5])	([0.2308, 0.4313], [0.2663, 0.5687])
X17-Y6	([0.3, 0.5], [0.2, 0.5])	([0.2, 0.4], [0.3, 0.6])	([0.2, 0.4], [0.3, 0.6])	([0.2398, 0.4404], [0.2570, 0.5596])
X19-Y7	([0.2, 0.4], [0.3, 0.6])	([0.3, 0.5], [0.2, 0.5])	([0.1, 0.3], [0.4, 0.7])	([0.2069, 0.4082], [0.2863, 0.5918])

) according to Table 3. Subsequently, these IVIFNs were aggregated and defuzzified into crisp values using Equations (15) and (17).

In order to verify the accuracy of the proposed model in calculating the probability of an event, the probability data obtained by IVIFNs were compared with the data from the literature [52], and the results are shown in Figure 6. It can be seen from the figure that the variability between the two sourcing data is small, which indicates that the proposed method for obtaining the probabilities of the basic events is feasible.

4.4.2. Computation of the Probability of the Critical Event with/without Preventive Safety Barriers

Using Equations (21) and (22), the calculation formulas of the occurrence probability of the critical event with/without the SBs can be written as Equations (38)–(50), and the calculation results are shown in Figure 7.

$$P_{M1}=1-\left(1-P_{M2}\right)\times \left(1-P_{M3}\right)$$

(38)

$$P_{M2}=1-\left(1-P_{M4}\right)\times \left(1-P_{M5}\right)$$

(39)

$$P_{M3}=1-\left(1-P_{M6}\right)\times \left(1-P_{M7}\right)$$

(40)

$$P_{M4}=1-\left(1-P_{X1}\right)\times \left(1-P_{X2}\right)$$

(41)

$$P_{M5}=1-\left(1-P_{X3}\right)\times \left(1-P_{X4}\right)$$

(42)

$$P_{M6}=1-\left(1-P_{X5}\right)\times \left(1-P_{X6}\right)\times \left(1-P_{M8}\right)\times \left(1-P_{M9}\right)\times \left(1-P_{M10}\right)$$

(43)

$$P_{M7}=1-\left(1-P_{X16}\right)\times \left(1-P_{X17}\right)\times \left(1-P_{M11}\right)$$

(44)

$$P_{M8}=1-\left(1-P_{X7}\right)\times \left(1-P_{X8}\right)\times \left(1-P_{X9}\right)$$

(45)

$$P_{M9}=1-\left(1-P_{X10}\right)\times \left(1-P_{X11}\right)$$

(46)

$$P_{M10}=1-\left(1-P_{X12}\right)\times \left(1-P_{M12}\right)$$

(47)

$$P_{M11}=1-\left(1-P_{X18}\right)\times \left(1-P_{X19}\right)$$

(48)

$$P_{M12}=1-\left(1-P_{X13}\right)\times \left(1-P_{M13}\right)$$

(49)

$$P_{M13}=P_{X14}\times P_{X15}$$

(50)

4.5. System Failure Consequence Analysis

4.5.1. Determination of the Type of Failure Consequence and Their Weights

Based on the literature, experts’ opinions, and field survey, the consequences of the natural gas storage tank failure were divided into four categories: production interruption loss (C1), safety/health effect (C2), environment/ecological effect (C3), and equipment maintenance cost (C4) [53]. The weights of these four consequence types were first determined using the IVIF-AHP mentioned in Section 3.3.1. Specifically, the experts provide the relative importance of the consequence types in pairs in the form of linguistic terms (see

Table 11. Criterion AHP data from Expert No.1.

Cm	C1	C2	C3	C4
C1	EI	1/MMI	MI	SMI
C2	MMI	EI	SI	VSMI
C3	1/MI	1/SI	EI	SMI
C4	1/SMI	1/VSMI	1/SMI	EI

,

Table 12. Criterion AHP data from Expert No.2.

Cm	C1	C2	C3	C4
C1	EI	1/SMI	MI	SI
C2	SMI	EI	VSMI	ESI
C3	1/MI	1/VSMI	EI	EVI
C4	1/SI	1/ESI	1/EVI	EI

and

Table 13. Criterion AHP data from Expert No.3.

Cm	C1	C2	C3	C4
C1	EI	1/SI	EVI	SMI
C2	SI	EI	SMI	VSMI
C3	1/EVI	1/SMI	EI	MMI
C4	1/SMI	1/VSMI	1/MMI	EI

), and then these opinions are converted into the corresponding IVIFNs (see

Table 14. IVIFNs of comparison judgment matrix for criteria from Expert No.1.

Cm	C1	C2	C3	C4
C1	([0.38, 0.42], [0.22, 0.58])	([0.03, 0.57], [0.03, 0.47])	([0.10, 0.43], [0.03, 0.57])	([0.32, 0.62], [0.08, 0.38])
C2	([0.03, 0.47], [0.03, 0.57])	([0.38, 0.42], [0.22, 0.58])	([0.13, 0.53], [0.07, 0.47])	([0.52, 0.72], [0.08, 0.28])
C3	([0.03, 0.57], [0.10, 0.43])	([0.07, 0.47], [0.13, 0.53])	([0.38, 0.42], [0.22, 0.58])	([0.32, 0.62], [0.08, 0.38])
C4	([0.08, 0.38], [0.32, 0.62])	([0.08, 0.28], [0.52, 0.72])	([0.08, 0.38], [0.32, 0.62])	([0.38, 0.42], [0.22, 0.58])

,

Table 15. IVIFNs of comparison judgment matrix for criteria from Expert No.2.

Cm	C1	C2	C3	C4
C1	([0.38, 0.42], [0.22, 0.58])	([0.08, 0.38], [0.32, 0.62])	([0.10, 0.43], [0.03, 0.57])	([0.13, 0.53], [0.07, 0.47])
C2	([0.32, 0.62], [0.08, 0.38])	([0.38, 0.42], [0.22, 0.58])	([0.52, 0.72], [0.08, 0.28])	([0.75, 0.85], [0.05, 0.15])
C3	([0.03, 0.57], [0.10, 0.43])	([0.08, 0.28], [0.52, 0.72])	([0.38, 0.42], [0.22, 0.58])	([0.29, 0.41], [0.12, 0.58])
C4	([0.07, 0.47], [0.13, 0.53])	([0.05, 0.15], [0.75, 0.85])	([0.12, 0.58], [0.29, 0.41])	([0.38, 0.42], [0.22, 0.58])

and

Table 16. IVIFNs of comparison judgment matrix for criteria from Expert No.3.

Cm	C1	C2	C3	C4
C1	([0.38, 0.42], [0.22, 0.58])	([0.07, 0.47], [0.13, 0.53])	([0.29, 0.41], [0.12, 0.58])	([0.32, 0.62], [0.08, 0.38])
C2	([0.13, 0.53], [0.07, 0.47])	([0.38, 0.42], [0.22, 0.58])	([0.32, 0.62], [0.08, 0.38])	([0.52, 0.72], [0.08, 0.28])
C3	([0.12, 0.58], [0.29, 0.41])	([0.08, 0.38], [0.32, 0.62])	([0.38, 0.42], [0.22, 0.58])	([0.03, 0.47], [0.03, 0.53])
C4	([0.08, 0.38], [0.32, 0.62])	([0.08, 0.28], [0.52, 0.72])	([0.03, 0.57], [0.03, 0.47])	([0.38, 0.42], [0.22, 0.58])

). Through aggregation, the IVIFN for each consequence severity type was obtained. The results underwent a consistency test ($CR=0.098<0.1$) to ensure that the expert’s opinions were reasonable. Finally, the weight of the consequence severity type $w_{CS}$ was obtained using Equations (26) and (27).

$$w_{CS}=\left(w_{CS1},w_{CS2},w_{CS3},w_{CS4}\right)=\left(0.2520,0.2935,0.2465,0.2080\right)$$

(51)

4.5.2. Determination of the Severity Index of Each Failure Outcome

According to the BT model, the potential failure outcomes of the natural gas storage tank were injection fire (CO1), vapor cloud explosion (CO2), poisoning (CO3), flash fire (CO4), natural gas dispersion (CO5), and deflagration (CO6).

Table 17. Experts’ linguistic judgments on the effect of each failure outcome on different consequence severity types.

Failure Outcomes	Expert No.1				Expert No.2				Expert No.3
	C1	C2	C3	C4	C1	C2	C3	C4	C1	C2	C3	C4
CO1	H	VH	H	H	H	VH	H	H	H	H	H	VH
CO2	VH	VH	VH	VH	VH	H	H	VH	VH	H	VH	H
CO3	L	M	L	VL	L	L	L	VL	VL	M	L	VL
CO4	H	H	H	H	H	VH	M	VH	M	H	H	H
CO5	VL	VL	VL	L	L	VL	VL	VL	VL	VL	VL	VL
CO6	VH	VH	VH	VH	VH	VH	VH	VH	VH	VH	VH	VH

shows the effect of each failure outcome on the different consequence severity types collected from the experts. The linguistic terms were converted into IVIFNs according to Table 3. Then, the severity index of each failure outcome expressed as IVIFN was calculated using Equations (28)–(30), and the results are shown in

Table 18. The severity indexes of different failure outcomes.

Failure Outcomes	Severity Index (SI)	Failure Outcomes	Severity Index (SI)
CO1	([0.6194, 0.8226], [0, 0.1774])	CO4	([0.5937, 0.8012], [0, 0.1988])
CO2	([0.6876, 0.88897], [0, 0.1103])	CO5	([0.1169, 0.3172], [0.3819, 0.6828])
CO3	([0.2189, 0.4218], [0.3002, 0.5782])	CO6	([0.7, 0.9], [0, 0.1])

. After defuzzification and normalization, the severity indexes $SI$ of the failure outcomes were obtained.

$$SI=\left(S{I}_{CO1},S{I}_{CO2},S{I}_{CO3},S{I}_{CO4},S{I}_{CO5},S{I}_{CO6}\right)=\left(0.7168,0.7839,0.3278,0.6941,0.2409,0.7953\right)$$

(52)

4.5.3. Determination of the Possibilities of Conditioning Events with/without Safety Barriers

As shown in

Table 19. Experts’ linguistic opinions on the possibility of conditioning events in ET.

Conditioning Events	Expert No.1	Expert No.2	Expert No.3	Conditioning Events	Expert No.1	Expert No.2	Expert No.3
EV1	H	H	MH	EV1-F1	ML	L	L
EV2	H	VH	VH	EV2-F2	MH	M	M
EV3	H	H	VH	EV3-F3	M	M	M
EV4	H	H	H	EV4-F4	ML	M	L

, the experts’ opinions on the possibilities of conditioning events in the ET were obtained. Then, they were converted into the corresponding IVIFNs (see

Table 20. The IVIFNs and aggregation values for the possibility of conditioning events.

Conditioning Events	Expert No.1	Expert No.2	Expert No.3	Aggregation Value
EV1	([0.6, 0.8], [0, 0.2])	([0.6, 0.8], [0, 0.2])	([0.5, 0.7], [0.1, 0.3])	([0.5729, 07747], [0, 0.2253])
EV2	([0.6, 0.8], [0, 0.2])	([0.7, 0.9], [0, 0.1])	([0.7, 0.9], [0, 0.1])	([0.6652, 0.8697], [0, 0.1303])
EV3	([0.6, 0.8], [0, 0.2])	([0.6, 0.8], [0, 0.2])	([0.7, 0.9], [0, 0.1])	([0.6324, 0.8369], [0, 0.1631])
EV4	([0.6, 0.8], [0, 0.2])	([0.6, 0.8], [0, 0.2])	([0.6, 0.8], [0, 0.2])	([0.6, 0.8], [0, 0.2])
EV1-F1	([0.3, 0.5], [0.2, 0.5])	([0.2, 0.4], [0.3, 0.6])	([0.2, 0.4], [0.3, 0.6])	([0.2398, 0.4404], [0.2570, 0.5596])
EV2-F2	([0.5, 0.7], [0.1, 0.3])	([0.4, 0.6], [0.2, 0.4])	([0.4, 0.6], [0.2, 0.4])	([0.4404, 0.6416], [0.1535, 0.3584])
EV3-F3	([0.4, 0.6], [0.2, 0.4])	([0.4, 0.6], [0.2, 0.4])	([0.4, 0.6], [0.2, 0.4])	([0.4, 0.6], [0.2, 0.4])
EV4-F4	([0.3, 0.5], [0.2, 0.5])	([0.4, 0.6], [0.2, 0.4])	([0.2, 0.4], [0.3, 0.6])	([0.3074, 0.5093], [0.2253, 0.4907])

) according to Table 3. Subsequently, these IVIFNs were aggregated and defuzzified into crisp values using Equations (15) and (17).

4.5.4. Computation of the Failure Consequence Severity with/without Safety Barriers

Using Equation (32), the detailed Formulas (53)–(58) for calculating the probability of each failure outcome were obtained. Using these formulas and Equation (33), the failure consequence severity with/without the SBs of the storage tank was calculated, and the calculation results are shown in Figure 8. As can be seen in Figure 7, the probability of critical events only decreases when preventive SBs are set. As shown in Figure 8, the failure consequence severity is reduced only when protective SBs are used. Thus, it is obvious that preventive SBs only have an effect on the probability of critical event occurrence, while protective SBs only affect the failure consequence severity.

$$P_{CO1}=P_{EV1}$$

(53)

$$P_{CO2}=\left(1-P_{EV1}\right)\times P_{EV2}\times P_{EV3}\times P_{EV4}$$

(54)

$$P_{CO3}=\left(1-P_{EV1}\right)\times P_{EV2}\times P_{EV3}\times \left(1-P_{EV4}\right)$$

(55)

$$P_{CO4}=\left(1-P_{EV1}\right)\times P_{EV2}\times \left(1-P_{EV3}\right)\times P_{EV4}+\left(1-P_{EV1}\right)\times \left(1-P_{EV2}\right)\times \left(1-P_{EV3}\right)\times P_{EV4}$$

(56)

$$\begin{array}{c}{P}_{CO5}=\left(1-P_{EV1}\right)\times P_{EV2}\times \left(1-P_{EV3}\right)\times \left(1-P_{EV4}\right)+\left(1-P_{EV1}\right)\times \left(1-P_{EV2}\right)\times P_{EV3}\times \left(1-P_{EV4}\right)\\ +\left(1-P_{EV1}\right)\times \left(1-P_{EV2}\right)\times \left(1-P_{EV3}\right)\times \left(1-P_{EV4}\right)\end{array}$$

(57)

$$P_{CO6}=\left(1-P_{EV1}\right)\times \left(1-P_{EV2}\right)\times P_{EV3}\times P_{EV4}$$

(58)

4.6. Computation of the Failure Risk and Effectiveness with/without Safety Barriers

When the failure probability of the critical event and the failure consequence severity with/without SBs were obtained, the RIs with/without SBs and the Eff_SBs of the SBs could be obtained using Equations (35)–(37). The results are shown in Figure 9 and Figure 10. It can be seen in Figure 9 that when SBs are set up, the risk index of the storage tank is significantly reduced. Figure 10 illustrates that different SBs have different effectiveness indexes. When all SBs work at the same time, the failure risk of the storage tank is the lowest and the effectiveness of SBs is the highest.

4.7. Results and Discussion

As shown in Figure 9 and Figure 10, both the preventive and protective SBs can reduce the failure risk of the storage tank to a certain extent. In particular, Y4 (the regular detection of deformation or damage in the storage tank), Y7 (the installation and regular maintenance of safety electrical equipment), Y6 (the regular maintenance of safety alarm system equipment), F1 (fire source detection and alarm devices), and F4 (fire alarm and extinguishing systems) have high Eff_SB. This is because Y4, Y7, and Y6 are parts of the regular inspection and maintenance of key equipment, which play an important role in identifying gas leakage sources and can stop the incidents in their initial stages. F1 and F4 are responsible for monitoring sources of ignition and extinguishing fires, respectively, playing an obvious role in curbing fire, explosion, and other events with very high consequence severity.

Y1 (personnel operation and safety training), Y2 (using a checklist to establish complete and strict specifications and requirements for daily inspection work), Y3 (the regular detection of tank subsidence height and ground soil condition), and Y5 (the regular detection of the complete length of the surface coating) have low Eff_SB. The reason is that Y1 and Y2 involve personnel operation, which has a high degree of uncertainty, and these two SBs can only limit third-party damage. Furthermore, Y3 mainly controls tank subsidence, having little influence on leakage. Y5 mainly limits external corrosion, which is not prominent for tanks in the dry western region of China. The protective SBs of F2 (storage tank pressure detection) and F3 (gas concentration detection instrument) also have relatively low Eff_SB. This is because the F2 and F3 can only detect leakage but not locate it, and they have limited effect on mitigating the hazard of consequences on their own. As a result, they must cooperate with other protective measures to reduce the consequence severity effectively.

By comparing the corresponding RI and Eff_SB of Y1–Y7 (the combination of the preventive SBs) and F1–F4 (the combination of the protective SBs) in Figure 9 and Figure 10, it can be inferred that Y1–Y7 are more effective than F1–F4. Therefore, when configuring SBs, it is not advisable to rely solely on protective SBs to reduce tank risks. Instead, a thorough analysis of the causes of the critical event should be carried out to ensure that preventive SBs are set up correctly to control most risks before critical events occur.

Although some barriers have a significant effect when acting alone, most barriers have a low effect. When multiple barriers work together, the risk reduction for storage tanks is very significant. In particular, the risk reduction for storage tanks is most pronounced when all SBs are present, with an Eff_SB of 37.7%. The reason for this is that a single SB may only limit the probability of a single failure path, but there are often multiple failure paths for a complex system. Therefore, only when multiple SBs are in play can the risk of the system be effectively reduced and the safe operation of the storage tank be guaranteed.

Furthermore, all the SBs considered in this system were freely combined, and the effectiveness index of each combination was analyzed. The results are shown in Figure 11. Here, n is the number of SBs considered. The orange markers and labels indicate the combination of SBs with the highest effectiveness index for each combination number scenario as well as the specific effectiveness index value. It can be inferred that the Eff_SB gradually increases as the number of SBs increases. Moreover, by comparing different combinations in (j), it can also be deduced that with the increase in the number of combinations, the growth rate of the effectiveness index of the best SB combination decreases. It is worth noting that when the combination includes preventive SBs Y4, Y6, and Y7, as well as protective SBs F1 and F4, Eff_SB increases significantly. If and only if these SBs are included, the Eff_SB reaches 34.3%, accounting for 91% of the highest Eff_SB. This indicates that these five SBs play an important role in the safe operation of the storage tank. These findings provide a reference for decision-makers. For the sake of safety, when all SBs cannot be realized in actual production, at least these five SBs should be included in the system, as they are essential.

Through the above analysis, it is revealed that the storage tank failure risk can be greatly controlled and mitigated in the two stages of system maintenance detection and operation. Therefore, regular inspection and maintenance plans can be formulated to ensure the normal operation and effectiveness of the storage tank system. On the one hand, in the routine maintenance of the storage tank, the monitoring of potential risks and accidents should be strengthened, which needs to focus on checking and maintaining the deformation of the storage tank, safety electrical equipment, and the integrity of the alarm system equipment. On the other hand, it is necessary to formulate a perfect fire emergency mechanism, conduct regular simulation exercises, and strengthen the emergency response ability of fire alarms and fire suppression systems. Combining the analysis results with the design, maintenance, and operational strategies of the system can effectively improve the safety of tank systems, reduce potential accident risks, and protect people and the environment.

5. Conclusions

Assessing the effectiveness of safety barriers (SBs) holds significance in guiding their configuration and subsequently reducing the failure risks within process systems. In this study, we proposed an integrated method to evaluate the effectiveness of SBs in process systems. This method incorporated IVIFNs into the BT model. Due to the limited data availability concerning safety barriers in practical processes, this method addresses the challenge of obtaining fundamental probability data by employing expert elicitation. Furthermore, it manages uncertainties in opinions by utilizing IVIFNs. The effectiveness of safety barriers is measured by comparing the relative change in failure risk due to the addition of the barrier.

The method was applied to analyze the SBs of a natural gas storage tank. The results show that multiple SBs are more effective than a single SB, and preventive SBs have a greater effect on system risks than protective SBs. Therefore, preventive SBs should be prioritized in order to avoid a critical event. However, as it is not possible to fully control all sources of hazards, it is desirable to also have protective SBs to control and mitigate the effects of failure consequences. The combinational analysis of SBs can also provide a comprehensive understanding of the effectiveness of each SB so that the most appropriate combination of SBs can be found to meet the requirements of safe production and cost control.

The accuracy of this method still depends on the model structure and the probabilities of bottom events, which means that the selection of experts and the supplementation of data are very important. Therefore, it is necessary to consider experts’ professional background and practical experience comprehensively, giving as comprehensive information as possible to eliminate the influence of expert bias when determining the expert group. A panel of three experts was used in this study, who met the criteria for professionalism and diversity, but consulting more experts can make the model results more objective and reliable. In fact, expert elicitation is used to solve the challenge of lacking accurate and reliable objective data, and IVIFNs in further analysis are used in this method to reduce the bias and uncertainty of experts’ opinions. Moreover, if objective data exist for some events of the BT model, direct assignment can make the evaluation more reliable. Therefore, in future studies, we plan to propose more effective methods to mitigate the influence of expert biases and to obtain objective actual data as comprehensively as possible to replace experts’ opinions.

Due to the feasibility of the IVIFN-BT method, it can be extended to other process industry scenarios where SBs are required, and actual data are difficult to obtain. It can also provide support for safety management and risk assessment in other process industry environments.

In addition, in the current work, the SB effectiveness analysis based on the BT model is static. However, in practice, safety barriers evolve over time. Therefore, future research should further consider the changes in safety barrier functions during the evolution of an event, so as to conduct a more comprehensive assessment in the process industry.