ARTICLE IN PRESS

Reliability Engineering and System Safety 94 (2009) 187–198

www.elsevier.com/locate/ress

Multi-attribute risk assessment for risk ranking of natural gas pipelines

A.J. Brito, A.T. de Almeida
Federal University of Pernambuco UFPE, Cx. Postal 7462, CEP 50.630-970, Recife, Brazil
Received 14 August 2007; received in revised form 18 February 2008; accepted 19 February 2008
Available online 26 February 2008

Abstract

The paper presents a decision model for risk assessment and for risk ranking of sections of natural gas pipelines based on multi-
attribute utility theory. Pipeline hazard scenarios are surveyed and the reasons for a risk assessment model based on a multi-attribute
approach are presented. Three dimensions of impact and the need to translate decision-makers’ preferences into risk management
decisions are highlighted. The model approaches these factors by using a multi-attribute utility function, in order to produce multi-
dimensional risk measurements. By using decision analysis concepts, this model quantitatively incorporates the decision-maker’s
preferences and behavior regarding risk within clear and consistent risk measurements. In order to support the prioritizing of critical
sections of pipeline in natural gas companies, this multi-attribute model also allows sections of pipeline to be ranked into a risk hierarchy.
A numerical application based on a real case study was undertaken so that the effectiveness of the decision model could be verified.
r 2008 Elsevier Ltd. All rights reserved.

Keywords: Natural gas pipelines; Pipeline hazard scenarios; Risk assessment; Multi-attribute utility theory; Decision analysis

1. Introduction have been conducted on pipeline accidents [5,13]. However,

Pipelines are seen as one of the most practical and
economically effective modes for transporting dangerous
and flammable substances, such as natural gas, for which
road or rail transportation is often impractical [1]. In most
countries, the more that pipeline systems are expanded and
natural gas consumption increases, the more their econo-
mies become dependent on the stable, continuous and safe
operation of these facilities [2].
According to international historical data [3–5], acci-
dents involving natural gas pipelines do happen, even
though the frequency of such occurrences is generally low
when compared to road or rail accidents. Moreover,
pipeline accidents often result in consequences which have
impacts of different dimensions. This implies that measures
need to be adopted in order to adequately quantify and
thereby to mitigate the risks.
Several approaches have been applied in order to
identify and estimate risks to pipelines [6–10]; safety
distances from pipeline facilities [3,11,12] and other studies
Corresponding author. Fax: +55 81 21268728x30.
E-mail address: gpsidufpe@gmail.com (A.J. Brito).
a limitation can be observed regarding several widely used
methods for risk analysis and risk assessment. This
concerns consideration being given to the multiple dimen-
sions that the impacts of accidents arising from natural gas
releases from pipelines can assume. As accidents recorded
around the world have shown, an approach of risk
dimensions, if it only considers the human or financial
aspects, is incomplete and inadequate due to the complex-
ity of the issues involved. Nowadays, what is clear is the
need to reconcile the concerns of society, the State and the
gas companies in relation to the operation and safety of
pipelines.
Another point rarely explored in traditional methods of
risk assessment for operating pipelines is to incorporate the
preferences and value judgments of decision-makers who
are responsible for the management of pipelines. It is
important to take into consideration their behavior
regarding risk in decision processes which involve plan-
ning, prevention, supervision and maintenance activities to
reduce risks.
As Cagno et al. [9] have pointed out, the effectiveness of
many techniques still used for safety management in
pipelines is low. This often causes inefficiency as to

0951-8320/$ - see front matter r 2008 Elsevier Ltd. All rights reserved.
doi:10.1016/j.ress.2008.02.014
 ARTICLE IN PRESS
188 A.J. Brito, A.T. de Almeida / Reliability Engineering and System Safety 94 (2009) 187–198
prioritizing those pipeline segments that must receive
investments and supplementary maintenance. Papadakis
[14] emphasizes that, in order to overcome traditional
deterministic techniques, probabilistic approaches such as
risk ranking, which combines probabilities of an event with
its resulting consequences, have proved to be more
adequate for priority level problems, such as in setting
replacement policies.
Therefore, in order to help decision-makers tackle this
problem, this paper presents a multi-attribute decision
model for risk assessment in pipelines and for ranking
sections of gas pipelines into a risk hierarchy. This model
takes into account the possible human, environmental and
financial impacts that an accident in a given pipeline
section can bring about. Multi-attribute utility theory
(MAUT) [15] is used in order to aggregate several
dimensions of consequences and to incorporate the
decision-maker’s preferences and behavior in cases of
uncertainty within a clear and mathematically based risk
measurement.
2. Causes of pipeline failure and hazard scenarios
Pipelines are usually laid underground, and supposedly
free from the influence of external factors on the surface.
However, they can be damaged by various activities, which
can result, though not necessarily immediately, in serious
accidents. These activities are described as the principal
causes that can start an accidental event in pipelines, and
they are classified into five main categories: external
interference; erosion; mechanical failures and construction
defects; earth movements and natural disasters; and
unknown causes [1,3,4,16].
The presence of pipelines transporting natural gas brings
intrinsic risk of damage. As Yuhua and Datao [10] assert,
Initial Pipeline Immediate
Event Failure Mode
Ignition
Rupture
Gas
release
Puncture
Fig. 1. Event tree for accidental release of natural gas from pipelines.
accidents due to natural gas releases from ruptures or
punctures in pipelines can cause fatalities, large economic
losses and environmental damage. According to Montiel et
al. [13], the severity of the consequences of a potential
natural gas leakage is accentuated by the existence of
hundreds of kilometer-long pipelines which are buried
under areas with intense human activity, cross urban
centers and farming properties, and sometimes run parallel
to highways. However, the risks related to the possible
hazards of having pipelines laid in a certain area are usually
accepted by society when it is not higher than a standard
accepted failure probability, such as 106 or 105 [3,17].
The laying of the pipeline is then accepted and its presence
is tolerated because of the benefits and comforts that these
facilities provide.
As Papadakis [14] affirms, the choice of using pipelines
as a mode of natural gas transportation, as well as for other
dangerous substances, is due to the fact that pipelines are
recognized as one of the safest and most economical means
of conveying these substances. The transportation of gas
by pipeline presents lower frequencies of accident than
those associated with road or rail haulage. However,
failures in pipelines do happen and sometimes they lead to
catastrophic consequences.
Due to the combustible, explosive and diffusible nature
of natural gas (and of other substances such as petroleum),
damage to pipelines that cause the release of natural gas
due to puncturing of the pipe creates a dangerous situation
that may provoke explosions and fire. Fig. 1 shows an
event tree and a set of accident scenarios resulting from a
release of gas [3,11].
Fig. 1 displays the main factors responsible for the
evolution of an accident arising from a natural gas
leakage, namely: the pipeline failure mode, the time gap
between the leakage and a possible ignition of the resulting
Delayed Space
Confinement Resulting Scenario
Ignition
Detonation/Deflagration θR1
Fireball/ Jet Fire θR2
CVCE θR3
Flash Fire θR4
Gas Dispersion θR5
Detonation/Deflagration θP1
Jet Fire θP2
θP3
CVCE
Flash Fire θP4
Gas Dispersion θP5
 ARTICLE IN PRESS
A.J. Brito, A.T. de Almeida / Reliability Engineering and System Safety 94 (2009) 187–198
gas cloud, and the degree of confinement produced by the
surroundings.
As Sklavounos and Rigas [3] describe, for rupture or
puncture failure modes, when the gas released is adequately
mixed with air finds an ignition source and is trapped by
the confines of the surroundings, combustion starts quickly
with a medium increase of pressure. This phenomenon,
called deflagration, is possible if the gas–air mix is inside the
limits of gas flammability. However, under considerable
confinement, if the proportion of oxygen inside the gas
cloud is enough to break all its carbon chains and to
convert all of its carbon to CO2 with no excess (which is
known as the stoichiometric zero oxygen balance), the
propagation speed of flames increases swiftly producing
overpressure and strong shock waves. This is called
detonation [3].
As shown in Fig. 1, when a large mass of quickly
released gas is not trapped in any space and encounters an
ignition source immediately, the gas cloud, now mixed with
air ignites, but still in a limited way. The external layer of
the cloud is set on fire, while the nucleus remains rich in gas
concentrations, outside its upper flammability limit (UFL).
On account of the buoyancy forces of the hot gas, the cloud
of burning gas starts to acquire a more spherical shape and
to ascend, and assumes the form of a fire ball. When the
fire ball moves upwards, the gas–oxygen mixture under
flammability limits is increased, sustaining the flames [3].
However, Jo and Ahn [11] describe a fireball as a short-
lived scenario. A fireball is usually quickly dispersed by the
wind, and a sustained jet of flaming gas, called jet fire, is
formed.
When gaseous mixtures are accumulated in confined
spaces, such as buildings, cellars and warehouses, a
confined vapor cloud explosion (CVCE) may occur
whenever the gas finds an ignition source, a spark, for
example. This scenario is very dangerous for constructions
within a distance where the gas still presents a flammable
concentration, due to the possibility of there being a CVCE
in underground spaces or inside buildings. This happened
in Bridgeport, Alabama, in 1999, and caused 3 deaths,
injuries to 6 people and US$1,400,000.00 in material
damages [4].
There may be very poor or very rich gas mixtures that
still remain within the flammability limits and that ignite
later in unconfined spaces. In such cases, the resulting fires
usually spread slowly and with negligible increases in
pressure. Such a phenomenon is known as a flash fire, but
in the context of a natural gas pipeline, some authors such
as Jo and Ahn [11] consider the possibility of this occurring
very low due to the buoyant nature of the vapor released,
since this hinders the formation of a persistent vapor cloud
on the ground.
Finally, if there is no immediate or delayed ignition, the
presence or absence of space confinement will cause an
accumulation or a dispersion of the vapor cloud, respec-
tively. The gas trapped may not ignite immediately, but if it
reaches a concentration between its flammability limits, a
189
CVCE scenario may happen. On the other hand, the
dispersion of gas usually poses no significant hazard, but it
may injure people close to the leakage point due to the heat
generated by gas escaping at high temperatures.
3. Reasons for a risk assessment model based on a multi-
attribute approach
Damage resulting from pipeline accidents gives rise to a
wide-ranging set of consequences. They are usually not
limited to fatalities or human injuries, but also involve
environmental damage caused by fires and large financial
losses due to supply interruptions.
However, the process of pipeline risk assessment is based
fundamentally on the study of probabilities for different
levels of human fatalities [6], which are indeed the most
critical aspects. On the other hand, without a complemen-
tary model that considers all risk dimensions, the
traditional approach to risk assessment which only
considers human fatalities can in effect hinder the
identification of pipeline segments which may put at
considerable risk ecological–environmental or economic
factors. Although these factors are not as important as the
risk of fatalities and human injuries, they also demand
substantial attention.
Under the strong influence of competition, of an increase
in the rigidity with which environmental legislation is
applied, and of the general public becoming increasingly
aware of safety aspects related to this type of accident, gas
companies need to consider, concomitantly, their own
financial objectives, and the requirements for human safety
and environmental preservation demanded by society and
by the State.
Besides the risks to humans and the environment, Liu
et al. [18] also focused their attention on the economic
impacts that often result from a natural gas escape and
from pipeline accidents. The financial risks related to a
possible interruption to the gas supply cannot be ignored,
even if they are not associated with significant impacts on
the first two risk dimensions presented. The losses caused
by interruption to the gas supply and to revenues, as a
result of accidents, usually vary from consumer to
consumer, and may range from small reductions in profit
to significant production losses, contract delays and
damage to pieces of equipment. Therefore, an important
point to be observed is an approach to risk assessment that
includes dimensioning the human, environmental and
financial impacts of pipeline accidents.
Furthermore, budget, time and labor restrictions must be
taken into account in the risk management process carried
out by gas transmission and distribution companies. An
apparent difficulty within this problem is to prioritize
sections of pipeline, using a multi-dimensional risk
measure, by considering, simultaneously, the consequences
on the environment, finances, and on human beings.
Sections of pipeline will not always present high risk levels
in all the dimensions of consequence simultaneously, so
 ARTICLE IN PRESS
190 A.J. Brito, A.T. de Almeida / Reliability Engineering and System Safety 94 (2009) 187–198

that segments with higher risks in one dimension and lower
risks in others will have to be compared, which causes the
ranking of risk to become even more complex.
Thus, in order to tackle the problem described above
adequately, a different approach is necessary in order to
consider the multiple dimensions of risks related to
pipelines, which can be regarded as multiple attributes or
multiple objectives to be achieved. The approach applied in
this study is based on MAUT, as presented by Keeney and
Raiffa [15]. Such an approach underpins the arrangement
of sections of pipeline into a risk hierarchy, thus helping to
establish an order of priority so that limited resources may
be applied first to activities for accident prevention,
supervision and maintenance in the most critical group of
pipeline segments.
Additionally, given that risk assessment is also a
subjective process, it is necessary to observe decision-
makers’ perceptions and behavior regarding risk. In this
paper, these factors are also handled based on MAUT,
which is integrated within the decision analysis approach
[15].
Under the decision analysis approach [19,20], risk is here
assessed as the expected loss, which is estimated here for
each section of pipeline, ai as follows:
Z 4.1. Identification of the decision-maker
X
rðai Þ ¼  pðyÞ Pðpjy; ai ÞuðpÞ dp (1)
p This is the step at which the decision-maker is identified.
y
where P(p|y,ai) is the probability distribution over the
consequences or outcomes p, U(p) is the MAUT-based
utility function for these outcomes, and p(y) are the
probabilities of the states of nature. States of nature are
classical decision analysis terminology and mean the
scenarios of the system (in this problem this includes both
the scenario of operational normality and accident
scenarios).
4. A multi-attribute decision model for risk assessment and
for ranking pipelines
The decision model proposed here allows the ranking of
sections of a pipeline into a hierarchy of multi-dimensional
risks. So, if specific measures for risk reduction on all
sections of pipeline are not viable because of time, cost, or
other technical restrictions, then a ranking process may be
undertaken to reduce risks on a prioritized set of sections
that present the highest potential damage when the human,
environmental and financial dimensions are considered
simultaneously.
In Fig. 2, a diagram with the procedure for implementa-
tion of this decision model is presented, and the steps of the
proposed risk assessment model are discussed as follows.
Generally, this is the manager of the operation, main-
tenance or safety of the pipeline. The decision-maker
influences the risk management process by establishing

Identification of the decision-maker

Segmentation of pipeline Identification of hazard scenarios (Survey

into sections ai of the states of nature Θ = {θ})

Object exposure analysis to

Estimation of the
impacts due to occurrence of
payoffs set (H, E, F)
scenario θ in ai

Estimation of accident Calculation of

scenario probabilities πi(θ) consequence probabilities Elicitation of U(h,e,f)
for each section ai P(h,e,f |θ, ai)

Estimation of risks ri(ai)

Risk ranking of
sections of pipeline

Fig. 2. Structure of the model for risk assessment and ranking sections of pipeline.
 ARTICLE IN PRESS
A.J. Brito, A.T. de Almeida / Reliability Engineering and System Safety 94 (2009) 187–198
value judgments that represent his perceptions and
preferences. These preferences will be revealed in the
elicitation process and will guide the construction of utility
functions.
4.2. Segmentation of pipeline into sections
The second stage corresponds to individualizing the
sections of a pipeline under study. In order to assess risk in
pipelines, it is useful to divide them into smaller sections as
some conditions change significantly along their route,
such as the pipeline failure rate [6]. By understanding the
threats present in each segment of pipeline, strategies can
be drawn up to mitigate risks more effectively [7]. There-
fore, a discrete set A ¼ {a1, a2, a3, y, an} of sections of
pipeline is established. These elements are distinguished by
their characteristics, and they sum up to the total length of
the pipeline under analysis.
4.3. Identification of hazard scenarios
The next step is directed towards surveying the hazard
scenarios, which, in this model, are all the states of nature,
here represented by the set Y ¼ {y}. The states of nature
correspond to a description of all the possible scenarios
that may happen from an accidental leakage of natural gas.
These have already been schematically presented in Fig. 1.
4.4. Estimation of accident scenario probabilities for each
section ai
Estimating the probabilities of accident scenarios is
performed in order to obtain a prior probability distribu-
tion, p(y). Factors such as land use, distance to ignition
sources, and the existence of confinement barriers in the
region surrounding each section of pipeline will often
amount to applying a different probability pi(y) for each
section of pipeline. The scenario probabilities for each ai
can be obtained through:
 experts’ prior knowledge, obtained using structured
Bayesian elicitation procedures [15,20];
 historical data of accidents and leakages [1,8];
 or by combining these two resources [9].
4.5. Object exposure analysis
At this stage, an analysis of the exposure of objects to
impacts resulting from the occurrence of each accident
scenario on section of pipeline ai is undertaken. By means
of mathematical modeling and specialized computer tools
(such as those presented in [3,8,11,22], a set of simulations
is performed to relate the hazard source to the possible
objects, subject to such hazards, in the surroundings. This
process enables danger zones to be determined for each
section of pipeline, and to estimate possible environmental
impacts, damage to properties, and effects on the health
191
and safety of people exposed to fires and heat, depending
on the complexity of the simulation models adopted.
4.6. Estimation of the payoffs set (H, E, F)
After establishing the danger zones for each section of
pipeline, the set of human, environmental and financial
consequences of a gas release accident is defined. Vulner-
ability analyses are normally performed to obtain the
possible outcomes due to heat and energy being carried by
heated gas, flames or explosions. A worst value for each
dimension of consequence, considering the most pessimistic
combination of factors, may be obtained.
The first group of consequences, H, receives the greatest
examination in the literature [22], mainly as the number of
fatalities due to thermal radiation [6]. It is not satisfactory,
for such a dimension of consequences, to use monetary
estimates in order to evaluate or represent physical
damages. Such an attitude involves an ethical discussion
on this subject, because the consequences of injury or death
are not losses that can be financially offset [23]. In this
model, the human consequences associated with each
section of pipeline are estimated as the number of persons
exposed, at least, to second degree burns, not necessarily to
the number of deaths. This is a more conservative criterion
for analysis, but it is appropriate since it deals with impacts
on human beings, and considers that any type of physical
harm to the population should be avoided.
The second dimension of consequences, E, corresponds
to the environmental impacts due to fires arising from the
ignition of gas released from pipelines. As natural gas is
less dense than atmospheric air, it usually quickly disperses
in unconfined spaces. The environmental consequences are
usually limited to fires and scorching in vegetation areas,
after some mass of released gas finds an ignition source.
However, similarly to the human consequences, the
burning of vegetation effects the integrity of animal species
and the disequilibrium of biodiversity in a given area
cannot be expressed in monetary indices. Besides, the
increase in the rigidity with which environmental
legislation and monitoring activities are applied has
turned the management of such sorts of consequences
into a more critical activity. Serious pipeline accidents
may influence public opinion, and may render the
installation of new pipeline branches impossible. Environ-
mental impacts can be assessed through several indicative
variables, but the measure, assumed here, for the environ-
mental consequences, is the expanse (in square meters) of
vegetation destroyed, which is reasonably related to the
range of environmental impacts caused by this sort of
accident.
The third and last group of consequences, F, corre-
sponds to the financial expenses incurred due to opera-
tional damages that a natural gas pipeline accident may
cause. These consequences can be subject to direct
monetary estimates, and they correspond to: expected
loss in revenues from supply interruptions; refunds to
 ARTICLE IN PRESS
192 A.J. Brito, A.T. de Almeida / Reliability Engineering and System Safety 94 (2009) 187–198
customers because of interrupted production; expected
expenses on labor, equipment and raw material to
substitute pipes, and other operational damage. This
dimension of consequences involves impacts, which are
directly reflected in gas companies’ financial accounts, and
they can jeopardize the company’s financial standing
depending on how serious the outcomes of accidents are.
4.7. Elicitation of u(h,e,f)
The next stage corresponds to the elicitation of the
utility function on the set of three-dimension consequences,
U(h,e,f). In this model, the multi-attribute utility function
U(h,e,f) is assumed to be additive. This is a typical
multi-attribute utility function and is often found in
practice [24], including in the context of maintenance
problems [25,26]. The use of additive utility functions
implies a decision-maker’s independence of preferences
among H, E and F (for more details, see [15]). Thus, the
multi-attribute utility function U(h,e,f) is obtained based
on the one-dimensional (1D) utility functions U(H), U(E)
and U(F), as follows:
Uðh; e; f Þ ¼ k1 UðhÞ þ k2 UðeÞ þ k3 Uðf Þ
where k1+k2+k3 ¼ 1. These are scaling constants esti-
mated by means of elicitation procedures based on
comparisons of payoff lotteries [15].
4.8. Calculation of consequence probabilities p(h,e,f|y,ai)
The results of the object exposure analysis are used to
obtain a consequence function [19]. This is a probability
distribution P(h,e,f|y,ai) of outcomes for each pair of
scenario and section of pipeline.
Given that the radius of danger zones usually covers tens
of meters, mainly for small diameter and low-pressure
pipes (such as distribution pipelines), then it will usually
cover an area with a specific land use (for instance, only an
area with industrial concentration, a residential area, or a
vegetation region). Therefore, the consequences H, E and F
will be assumed to occur in a random and independent
way, and with no significant correlation. They will be
influenced by the geographical particularities of the
surroundings of each section of pipeline. By adopting
these simplifying but reasonable assumptions, the prob-
abilities P(h|y,ai), P(e|y,ai) and P(f|y,ai) can be separately
estimated.
These probability functions may present several shapes,
depending on the mathematical models and on the
computer tools used at the stage of object exposure
analysis [11,21]. In order to not to impose limitations on
the application of this model to specific cases, these
probabilities are generically represented here by the
probability density functions f(h|y,ai), f(e|y,ai) and
f(f|y,ai).
4.9. Estimation of risks r(ai)
To estimate the risk related to each pipeline section, the
multi-attribute utility function U(h,e,f) is used and
combined to the probability density function f(h,e,f|y,ai)
related to the cumulative distribution P(h,e,f|y,ai). In Eq.
(3), the loss L(y, ai) for each accident scenario and section
of pipeline is calculated:
Z Z Z
Lðy; ai Þ ¼  f ðh; e; f jy; ai ÞUðh; e; f Þdf de dh (3)
H E F
Given that the additive utility function and the
independence of probabilities P(h|y,ai), P(e|y,ai) and
P(f|y,ai) have been assumed, this problem is then more
subject to mathematical treatment. As per Appendix A, the
risk value r(ai) represented in Eq. (1) becomes:
X  Z
rðai Þ ¼ pi ðyÞ  f ðhjy; ai Þk1 em1 h dh
H
y
Z Z 
m1 e m1 f
þ f ðejy; ai Þk2 e de þ f ðf jy; ai Þk3 e df
E F
þ ð1Þpi ðyN Þ (4)
where pi(yN) is the probability of the operational normality
(2) scenario, yN. The value 1 multiplied by pi(yN) is the loss
related to the scenario yN (none damage).
4.10. Risk ranking of sections of pipeline
As the result of the previous stage, a risk value is
obtained for each section of pipeline after taking into
consideration all accident scenarios and the human,
environmental and financial consequences of a natural
gas release. Sections of pipeline can be placed in descending
order of risk such that a multi-attribute risk ranking to
help risk management is obtained. By taking into
consideration workforce constraints and financial or
technical restrictions, this ranking provides support to
prioritize the most critical sections of pipeline in order to
reduce the risks related to such facilities.
5. Decision model application
In order to illustrate the use of the proposed decision
model for risk assessment and for risk ranking of natural
gas pipelines, a numerical application is presented, based
on a case study in a natural gas distribution company. To
meet the confidentiality conditions set by the gas company,
the figures and other aspects of this application are not
real; nevertheless they have been conveniently changed in
order to represent a realistic and consistent context.
The company wishes to assess the risks related to its
pipelines and to arrange the sections of pipeline into a
hierarchical ranking of risk. Besides its usual safety and
maintenance activities over the entire pipeline grid, the
company holds a small budget which is available for a
supplementary prevention program. It aims to prioritize
 ARTICLE IN PRESS
A.J. Brito, A.T. de Almeida / Reliability Engineering and System Safety 94 (2009) 187–198 193

the most critical sections of pipeline by taking into
consideration the human, environmental and financial
consequences of accidents which may happen in any
section of pipeline. Some other techniques such as HAZOP
and FMEA [27] have been in use by this company.
However, the managers decided to apply a formal decision
procedure, and set out to find more consistent and
confident decision support on this problem.
Initially, a group of the company staff is selected from
the maintenance and safety division to help a team of
decision analyst consultants to carry out the application of
this model into the company context. Preliminary meetings
are usually scheduled by consultants with the group in
order to present the main concepts of MAUT [15], decision
analysis [19,20], and to explain the steps of this model. In
this kind of meeting, some difficulties may be observed in
dealing with the probabilistic thinking of the decision
analysis approach. Often this may cause this preliminary
stage to last a couple of days more than was initially
scheduled.
In order to start this application (see Fig. 2), given that
this risk approach is built for a managerial decision-
making context, the consultants stressed the importance of
identifying the decision-maker adequately. This subject
plays an essential role in this decision model because of the
probabilistic choices and judgments which must be made.
Next, in order to facilitate the description of the model
application and illustrate the use of the model, some
aspects related to the problem and to the context are
pointed out. The maintenance and safety manager was
appointed as the decision-maker. He is the company staff
member responsible for decisions on the prevention
program and for reporting its final results.
Along with the technical group performing this applica-
tion, the manager segmented the company’s pipeline grid
into sections of homogeneous characteristics, distinct from
the adjacent sections. Being of an 8-in nominal diameter,
the pipeline grid was divided into 12 different sections after
considering some technical factors including: soil charac-
teristics, land use, demographic concentration surround-
ing each section, the pressure and age of the pipeline
sections.
This company did not hold sufficient historical data on
failures concerning its pipeline grid. All they had were a
few records of dispersion and jet fire. However, in order to
identify the states of nature, the group decided to adopt the
10 scenarios presented in the accidental event tree of Fig. 1.
For the estimation of scenario probabilities pi(y) for each
section of pipeline, the technical team decided to adopt as a
reference the values presented in EGIG reports [16] and in
other publications [3,8]. EGIG data was used by this
company because the EGIG report considers distinctions
among pipeline failure modes. Furthermore, it also
provides a conservative estimate of the scenario probabil-
ities when compared to other databases such as those from
the United States Department of Transportation.
The basic probability for occurrence of a gas leakage,
assumed by the company, was 0.00041/km yr [16]. These
values were examined by the study group and multiplied by
some adjusting factors in order to consider the particular
conditions of each pipeline section, such as land use and
soil, third party activities, distance from residential areas
etc. The prior probabilities of accident scenarios for each
section of pipeline are shown in Table 1.
With the support of computational tools, the company
performed several simulations for the object exposure
analysis under each accident scenario y and for each
section of pipeline. The first dimension of consequences
was considered as being the number of persons injured, al
least, by second degree burns. The second dimension was
taken as the vegetation area (in m2) destroyed due to the
combustion of natural gas after a leakage. Finally, the third
dimension of consequence was measured by the total
financial loss due to interrupted revenues, refunds to
clients, product losses and repairs to facilities etc.
Next, the technical support team performed the estima-
tion of consequence probabilities. This deals with a set of
probability density functions f(h|y,ai), f(e|y,ai) and f(f|y,ai)

Table 1
Prior probabilities for accidental scenarios, for each section of pipeline

Section p(yfailure) p(yN) Rupture (  104) Puncture (  104)

p(yR1) p(yR2) p(yR3) p(yR4) P(yR5) p(yF1) p(yF2) p(yF3) p(yF4) p(yF5)

S1 0.0007073 0.9992927 0.0424 0.8060 0.1960 0.0020 1.7800 0.0106 1.0500 0.6300 0.0064 2.55
S2 0.0010769 0.9989231 0.0484 0.9200 0.3840 0.0039 3.4900 0.0444 0.8440 0.7470 0.0076 4.28
S3 0.0015332 0.9984668 0.0225 0.7290 0.4570 0.0046 4.1500 0.0359 1.1600 1.3000 0.0132 7.46
S4 0.0012304 0.9987696 0.0185 0.3510 0.1460 0.0015 1.3300 0.0732 1.3900 1.3400 0.0135 7.64
S5 0.0005904 0.9994096 0.0047 0.4680 0.1870 0.0019 1.7000 0.0050 0.4910 0.4520 0.0046 2.59
S6 0.0016005 0.9983995 0.0000 0.0080 0.0150 0.0002 0.1370 0.0079 0.7840 2.2300 0.0226 12.80
S7 0.002064 0.997936 0.0021 0.2050 0.1840 0.0019 1.6700 0.0093 0.9210 2.6200 0.0265 15.00
S8 0.0015129 0.9984871 0.0000 0.0759 0.0676 0.0007 0.6140 0.0072 0.7130 2.0300 0.0205 11.60
S9 0.0006314 0.9993686 0.0044 0.0840 0.0269 0.0003 0.5160 0.0341 0.6480 0.0495 0.0005 4.95
S10 0.0011075 0.9988925 0.0498 0.9460 0.3950 0.0040 3.5900 0.0457 0.8680 0.7690 0.0078 4.40
S11 0.0024609 0.9975391 0.0738 1.4000 0.5840 0.0059 5.3100 0.1030 1.9600 2.2500 0.0227 12.90
S12 0.0015743 0.9984257 0.0107 0.3450 0.1990 0.0020 1.8100 0.0483 1.5600 1.7500 0.0177 10.00
 ARTICLE IN PRESS
194 A.J. Brito, A.T. de Almeida / Reliability Engineering and System Safety 94 (2009) 187–198

that, in their opinion, resulted in the best modeling for the
uncertainties associated with the human, environmental
and financial outcomes. These estimations were made for
each accident scenario and section of pipeline, which
would result in 120 probability density functions being
obtained. The technical group and the consultants were
divided into three sub-groups in order to perform these
estimations for one of the three impact dimensions. By
studying the simulation results, after some discussions on
the best way to model the uncertainties associated with the
outcomes, the sub-groups decided to adjust the conse-
quence probabilities to Lognormal, Gamma and Exponen-
tial probability density functions (pdf). The pdf’s
parameters were changed from section to section based
on the results of the simulations performed and based on
the engineers’ knowledge on the particular conditions of
each section.
Concurrently with the estimation of consequence prob-
abilities, the multi-attribute utility function U(h,e,f) was
elicited from the decision-maker. This process involves
obtaining subjective data from the decision-maker, follow-
ing some structured elicitation protocols, as presented in
Keeney and Raiffa [15] and Raiffa [20]. The safety manager
answered questions put by the consultants, who asked him
to make choices between deterministic consequences (hu-
man, environmental or financial payoffs due to a pipeline
accident) and lotteries with specific probabilities between
best case and worst case values.
By answering these questions, the maintenance and
safety manager allowed some utility values to be obtained
for each one of the three dimensions of consequences.
These values were plotted and exponential regression
curves were drawn in order to obtain the 1D utility
functions U(h), U(e) and U(f) of Eq. (4). The exponential
curve regression was proposed by the consultants for the
1D utility functions. It provided a good translation of the
decision-maker’s preferences, for which higher values in a
consequence dimension were much more undesirable than
lower ones [15,25,26]. For exponential utility functions,
Eq. (2) assumes a formula as follows:
Uðh; e; f Þ ¼ k1 em1 h þ k2 em2 e þ k3 em3 f (5)
where m1, m2 and m3 are shape parameters for the
exponential utility functions. With determination coeffi-
cients (r2) higher than 0.90, the exponential regressions
were considered satisfactory by the safety manager and the
consultants. The following shape parameters were ob-
tained: m1 ¼ 0.12, m2 ¼ 0.0017 and m3 ¼ 3.5  107.
Similarly to the elicitation of the 1D utility functions, the
consultants used elicitation procedures [15,20] in order to
obtain the scaling constants k1, k2 and k3. By means of a
structured set of questions, the decision-maker faced some
probabilistic choices of lotteries involving three-dimen-
sional (3D) payoffs. These payoffs were triples of human,
environmental and financial consequences, with composi-
tions of best and worse 1D values (for further explanations
on this procedure, see [15]). This process may have to be
restarted twice due to inconsistencies in the answers of the
maintenance and safety manager. The procedure evaluates
these possible inconsistencies based on the axiomatic
structure of the utility theory [15,26]. Finally, the multi-
attribute utility scaling constants were obtained: k1=0.65,
k2=0.10 and k3=0.25.
Based on Eq. (3), the combination of the probability
density functions f(h|y,ai), f(e|y,ai) and f(f|y,ai) with the
multi-attribute utility function, as explained in the Appen-
dix A, was performed. Thus, a set of losses L(y,ai) was
obtained, and they are shown in Table 2.
As seen in Table 2, although the flash fire scenario was
accepted by the technical group as proposed in this deci-
sion model, the probability of its occurring was considered
very low by the company’s technical group. Besides, the
outcomes for this scenario were assumed to be reasonably
negligible for all dimensions of consequence [11].
Finally, by multiplying probabilities and losses from
Tables 1 and 2 respectively, and summing these results for

Table 2
Loss values for accidental scenarios, for each section of pipeline

Section Rupture Puncture

L(yR1, ai) L(yR2, ai) L(yR3, ai) L(yR4,ai) L(yR5, ai) L(yF1, ai) L(yF2,ai) L(yF3, ai) L(yF4, ai) L(yF5, ai)

S1 0.68005 0.5545 0.78335 1 0.97075 0.7326 0.6724 0.8711 1 0.9798

S2 0.30435 0.2529 0.58465 1 0.92055 0.3862 0.3268 0.73505 1 0.94495
S3 0.42745 0.36745 0.5851 1 0.9499 0.48385 0.4469 0.699 1 0.97125
S4 0.50118 0.45175 0.65235 1 0.8922 0.5644 0.47258 0.7325 1 0.9205
S5 0.29798 0.23245 0.37355 1 0.8593 0.3898 0.31055 0.55955 1 0.9084
S6 0.2077 0.15732 0.28291 1 0.8991 0.3081 0.2392 0.36455 1 0.95105
S7 0.47835 0.32535 0.37885 1 0.8557 0.5632 0.42625 0.46305 1 0.94755
S8 0.45485 0.40215 0.64705 1 0.93855 0.50655 0.51775 0.77965 1 0.9468
S9 0.09821 0.07705 0.2311 1 0.84005 0.15785 0.1281 0.36625 1 0.8958
S10 0.28883 0.20348 0.34545 1 0.86655 0.40525 0.28455 0.58745 1 0.8924
S11 0.2573 0.1844 0.39805 1 0.90715 0.3657 0.2788 0.50865 1 0.9493
S12 0.3549 0.31573 0.48845 1 0.8697 0.43665 0.41633 0.62395 1 0.88975
 ARTICLE IN PRESS
A.J. Brito, A.T. de Almeida / Reliability Engineering and System Safety 94 (2009) 187–198 195

Table 3 Table 4
Resulting risk ranking of the pipeline sections after the multi-attribute risk Comparisons on risk values and ratios of increments of risk among
assessment prioritized pipeline sections

Position Section R(ai) Position Section r(ai)r(ai+1) Ratios

1 S11 0.528 1 S11 0.200 34.357

2 S12 0.328 2 S12 0.006 0.228
3 S7 0.322 3 S7 0.026 0.885
4 S10 0.297 4 S10 0.029 0.589
5 S6 0.268 5 S6 0.049 9.941
6 S2 0.219 6 S2 0.005 4.563
7 S3 0.214 7 S3 0.001 0.018
8 S4 0.213 8 S4 0.061 27.570
9 S8 0.152 9 S8 0.002 0.129
10 S5 0.150 10 S5 0.017 0.452
11 S9 0.133 11 S9 0.038 –
12 S1 0.095 12 S1 – –

each section of pipeline according to Eq. (4), the company
obtained a value of risk r(ai) for each segment. Results are
presented in Table 3.
It was emphasized that, since the value of the multi-
attribute utility function U(h,e,f) is within an interval scale
from 0 (least preferred) to 1 (most preferred) [15], then the
loss function and the risk function will consequently be on
a scale from 1 (lowest risk) to 0 (highest risk). However, a
linear scale transformation L0 (y, a) ¼ 1000L(y, a)+1000
was applied in order to facilitate visualization and
comparison of these values. This procedure may be applied
to utility (or loss) functions in the context of utility theory,
since it corresponds to an interval scale [15,19,20].
These values were not immediately comprehensible
either to the safety manager or his company subordinates
in the supporting group, for they were used to estimating
risks by means of ordinal indexes or within a probability
scale. The first information provided is the ranking of the
pipeline sections. However, the model provides a cardinal
measure regarding how distant the risk of one pipeline
section is from another.
As explained by the consultants to the company study
group, the use of utility theory for assessing risks in this
model allows the latter to have an axiomatic framework
which also provides other interesting information regard-
ing the ranking of pipeline sections obtained. The interval
scale of the utility functions (and therefore, the risk
functions) allows comparisons of increments of risk in
relation to the pipeline sections in lower positions in the
ranking [15,19,20]. For example, if the risk related to a
section in a position i is subtracted from the risk value
related to the section in position i1, this difference may be
compared by dividing it by the difference of risks between
sections i and i+1. These increment values are presented in
Table 4.
According to the results in Table 3, section S11 was the
first one to be prioritized. Moreover, as shown by Table 4,
the increment on the risk values from section S11 to section
S12 is more than 34 times higher than the increment of risk
from section S12 to section S7. This ratio value highlights
the considerable magnitude by which S11 exceeds S12 in
relation to the other ranked sections, and it is a
quantitative measure of the relative priority of this section
S11 within this ranking.
From these results, it was recommended to the technical
study group that section S11 should be the first to receive
an allocation of resources from the supplementary preven-
tion program, because it presented a higher generalized
expected loss after taking into consideration the conse-
quence values and occurrence probabilities of the human,
environmental and financial impacts.
Depending on the amount of available resources, the set
of sections of pipeline benefited is increased until all
resources are employed in order to minimize the risks
related to the company’s pipeline grid. As to starting the
supplementary prevention program immediately, the com-
pany estimated that the available budget was enough for
investments, through the first year, only on the first five
prioritized sections.
6. Discussion of application results
As shown in the results of Table 3, this decision model
has been effective for assessing risks and for ranking
sections of pipeline under a multi-attribute approach.
Within an approach of risk from a wider point of view,
this model has provided, for this maintenance and safety
decision problem, a joint evaluation of human, environ-
mental and financial impacts of a natural gas pipeline
accident.
Besides its multi-attribute feature, as seen in this case
study, risks were regarded within a decision-making
context, which not only deals with technical evaluations
of consequences and probabilities, but also with choices,
decisions, and value judgments about uncertainty con-
sequences. Such a formal approach was provided by this
utility theory-based model for pipeline risk assessment, and
for the related priority ranking problem.
In complex technological environments where managers
and engineers have knowledge of uncertainties and their
 ARTICLE IN PRESS
196 A.J. Brito, A.T. de Almeida / Reliability Engineering and System Safety 94 (2009) 187–198
probabilities, they need more conclusive, more formal and
quantitative decision models in order to support more
reliable decisions. In this paper, this was obtained by using
the MAUT [15], which also allowed the decision-maker to
aggregate multiple risk dimensions. Although utility theory
is seen as complex and hard to use by many practitioners, it
possess an axiomatic base that ensures a consistent
measurement of risks, within an interval scale.
As to tackling the problem of pipeline risk assessment,
the use of MAUT allowed the human, environmental and
financial consequences (represented here by h,e,f) to be
taken as the problem attributes. The decision-maker’s
preference and behavior regarding risk were modeled in
order to obtain a multi-attribute utility function U(h,e,f),
which aggregates the utility function for each attribute.
The decision-maker played an important role in this
process, not only in judging consequences by means of
utilities, but also in trying to represent stakeholders’
interests as seen by the company, society and the
Government. The use of this decision model in the
company studied has shown that the application of
elicitation protocols requires the decision-maker to be
available, patient and to have a good knowledge of
consequences. In order to obtain consistent utility func-
tions, this manager or executive must answer some lottery
questions. The background of the decision analyst con-
sultants is also important in order to make clear questions,
to point out inconsistencies and to guide this process
efficiently. Despite these difficulties, it is an important step
involving choices that associate impacts with probabilities,
and which allows the construction of utility functions that
aggregate aversion regarding risk [16].
In this model, the use of probability distributions over
the payoffs h, e and f allowed the uncertainties of the risk
assessment problem to be tackled [19,20]. The problem
uncertainties of the problems were also modeled by means
of states of nature y, the accidental scenarios of a natural
gas pipeline accident. However, as shown in the case study
section where the model was applied, the absence of
available data is another difficult point for applying such a
formal model for risk assessment. In order to tackle this
problem, international reports may be combined with
simulations and with technical expertize in order to
estimate scenario probabilities and probability distribution
functions over the consequences. This alternative way of
obtaining data was undertaken in this case, which allowed
the gas company studied to move towards a more adequate
approach for pipeline risk assessment, although it was not
possible to evaluate precisely the consistency between the
values obtained and the real unknown variables.
7. Conclusions
A multi-attribute approach for risk assessment in natural
gas pipelines has been discussed in this paper. The greatest
contribution of this study to pipeline risk assessment,
focusing on natural gas facilities, is the application of
MAUT in order to undertake a risk assessment and a risk
ranking of sections of pipeline. Models based on tradi-
tional methods for risk assessment [6,7] do not incorporate
the decision-maker’s behavior regarding risk, such as prone
or aversion to risk. These models are also incomplete due
to the need to take into consideration the aggregation of
multiple objectives, such as: human, environmental and
financial consequences that an accident in natural gas
pipelines may cause. Nowadays, risk management must
reconcile the concerns of society, the state and gas
companies in relation to the operation and safety of
pipelines, which is in fact one of the most difficult tasks in
risk management.
Therefore, so as to tackle these problems presented by
traditional methods, this decision model for risk assess-
ment was based on MAUT, which provides a risk
assessment process under a multi-dimensional perspective.
Utility theory also translates the decision-maker’s behavior
regarding risk, by making a quantitative measurement of
this behavior (the elicitation of utility values), grounded on
the decision analysis’ framework [19,20].
The application of the proposed model may seem to be
difficult for professionals used to applying traditional risk
assessment approaches, when we consider the different
scale of risk and the mathematical structure proposed for
risk assessment by applying decision analysis concepts
[19,20]. This requires an appropriate background from the
risk assessment team in order to estimate probabilities for
some model components when sufficient historical data for
statistical analyses are not available, which may make its
application difficult for small and beginning companies.
However, this model has sought to translate more
consistently the uncertainties of the problem, the complex-
ity of accident scenarios, and the several interests involved
in reducing human, environmental and financial impacts by
simultaneously taking into consideration these three
dimensions of consequence for risk estimation.
The subsequent risk ranking of sections of pipeline
allows gas companies to prioritize, in a wider and more
complete perspective, those sections that present higher
levels of risk for society, for the environment, and for
companies’ financial goals. As a further study on this
theme, the development of models for assessing risks and
for pipeline ranking in a context of group decision making
is suggested, whereby consideration is not given to a single
person, but to a group of decision-makers who must
include representatives from both the state and the
community.
Acknowledgements
This paper is part of a research funded by the Brazilian
Research Council (CNPq). The authors would like to
acknowledge the valuable suggestion that have been made
by the editor and anonymous reviewers on previous version
of this paper, which have contributed to make a better final
version.
 ARTICLE IN PRESS
A.J. Brito, A.T. de Almeida / Reliability Engineering and System Safety 94 (2009) 187–198 197

Appendix A Thus, by solving the right-hand side integrals in each

part of this sum, it can be seen that:
For additive utility functions [16,25], by applying Z Z
Eqs. (2) into Eq. (3), it follows that:
Lðy; ai Þ ¼ f ðhjy; ai Þk1 em1 h dh þ f ðejy; ai Þk2 em1 e de
Z Z Z Z
H

E

Lðy; ai Þ ¼  f ðh; e; f jy; ai Þ½k1 UðhÞ þ k2 UðeÞ þ f ðf jy; ai Þk3 em1 f df .

H E F F
þ k3 Uðf Þdf de dh.
According to decision analysis [20,21], the risk related to
Assuming an exponential equation to represent the 1D an alternative ai is assessed as the expected loss for ai by
utility functions, this expression can be expanded to taking into consideration the probability values, for ai, of
all the possible accidental states of nature. Recalling Eq.
Z Z Z
(1), it finally follows that:
Lðy; ai Þ ¼  f ðh; e; f jy; ai Þ
H E F
X  Z
m1 h
½k1 e þ k2 em2 e þ k3 em3 f df de dh. rðai Þ ¼ pi ðyÞ  f ðhjy; ai Þk1 em1 h dh
y H
Z
Then, by taking into consideration the independence of
þ f ðejy; ai Þk2 em1 e de
P(h|y,ai), P(e|y,ai) and P(f|y,ai) as discussed in Section 4.5,
it follows that: ZE 
m1 f
þ f ðf jy; ai Þk3 e df þ ð1Þpi ðyN Þ; ð4Þ
Z Z Z F
Lðy; ai Þ ¼  f ðhjy; ai Þf ðejy; ai Þf ðf jy; ai Þ
H E F where pi(yN) is equal to 1p(yfailure). The probability of
m1 h
½k1 e þ k2 em2 e þ k3 em3 f df de dh. failure, p(yfailure), is the sum of the probabilities of the 10
accidental scenarios considered in this model.
If we expand this expression, it can be seen that
Z Z Z References
Lðy; ai Þ ¼  f ðhjy; ai Þf ðejy; ai Þ
H E F [1] Papadakis GA, Porter S, Wettig J. EU initiative on the control of
f ðf jy; ai Þk1 em1 h df de dh major accident hazards arising from pipelines. J Loss Prevent Process
Z Z Z Ind 1999;12:85–90.
 f ðhjy; ai Þf ðejy; ai Þ [2] Dey PK. An integrated assessment model for cross-country pipelines.
H E F Environ Impact Assess Rev 2002;22:703–21.
[3] Sklavounos S, Rigas F. Estimation of safety distances in the vicinity
f ðf jy; ai Þk2 em2 e df de dh
Z Z Z of fuel gas pipelines. J Loss Prevent Process Ind 2006;19:24–31.
[4] NTSB (National Transportation Safety Board). Accident no. DCA-
 f ðhjy; ai Þf ðejy; ai Þ 99-MP-004, National Transportation Safety Board, 2000; /http://
H E F
www.ntsb.gov/publictn/2000/PAB0001.pdfS.
f ðf jy; ai Þk3 em3 f df de dh. [5] Bartenev AM, Gelfand BE, Makhviladze GM, Roberts JP. Statistical
analysis of accidents on the Middle Asia-Centre gas pipelines.
Variable h is a constant for all the integration ranges of E J Hazard Mater 1996;46:57–69.
[6] Jo YD, Ahn BJ. A method of quantitative risk assessment for
and F. Similarly, E and F are constants for the integration
transmission pipeline carrying natural gas. J Hazard Mater 2005;
ranges of H, F and H, E, respectively. By removing A123:1–12.
constants from the integrals, it follows that: [7] Henselwood F, Phillips G. A matrix-based risk assessment approach
for addressing linear hazards such as pipelines. J Loss Prevent Process
Z
Ind 2006;19:433–41.
Lðy; ai Þ ¼  f ðhjy; ai Þk1 em1 h dh [8] Dziubnski M, Fratczak M, Markowski AS. Aspects of risk analysis
H
Z Z associated with major failures of fuel pipelines. J Loss Prevent
Process Ind 2006;19:399–408.
 f ðejy; ai Þf ðf jy; ai Þ df de
[9] Cagno E, Caron F, Mancini M, Ruggeri F. Using AHP in
ZE F determining the prior distributions on gas pipeline failures in a
 f ðejy; ai Þk2 em1 e de robust Bayesian approach. Reliab Eng Syst Safety 2000;67:275–84.
[10] Yuhua D, Datao Y. Estimation of failure probability of oil and gas
Z EZ
transmission pipelines by fuzzy fault tree analysis. J Loss Prevent
 f ðhjy; ai Þf ðf jy; ai Þ df dh Process Ind 2005;18:83–8.
ZH F [11] Jo YD, Ahn BJ. Analysis of hazard areas associated with high-
pressure natural-gas pipelines. J Loss Prevent Process Ind 2002;15:
 f ðf jy; ai Þk3 em1 f df
179–88.
Z FZ [12] Zhao Y, Xihong L, Jianbo L. Analysis on the diffusion hazards of
 f ðhjy; ai Þf ðejy; ai Þ de dh. dynamic leakage of gas pipeline. Reliab Eng Syst Safety 2007;92:
H E 47–53.
 ARTICLE IN PRESS
198 A.J. Brito, A.T. de Almeida / Reliability Engineering and System Safety 94 (2009) 187–198
[13] Montiel H, Vı́lchez JA, Arnaldos J, Casal J. Historical analysis of
accidents in the transportation of natural gas. J Hazard Mater
1996;51:77–92.
[14] Papadakis GA. Assessment of requirements on safety management
systems in EU regulations for the control of major hazard pipelines.
J Hazard Mater 2000;78:63–89.
[15] Keeney RL, Raiffa H. Decision with multiple objectives: preferences
and value tradeoffs. New York: Wiley; 1976.
[16] EGIG (European Gas Pipeline Incident Data Group). Sixth EGIG-
report 1970–2004. Gas Pipeline Incidents, Report EGIG 05.R.0002,
EGIG, Groningen, December 2005, /http://www.egig.nl/downloads/
6th.Report.EGIG.pdfS.
[17] Kirchhoff D, Montãno M, Ranieri V, Oliveira I, Doberstein B, Souza
M. Limitations and drawbacks of using preliminary environmental
reports (PERs) as an input to environmental licensing in São Paulo
State: a case study on natural gas pipeline routing. Environ Impact
Assess Rev 2007;27(4):301–18.
[18] Liu M, Zang S, Zhou D. Fast leak detection and location of gas
pipelines based on adaptative participle filter. Int J Appl Math
Comput Sci 2005;15(4):541–50.
[19] Berger JO. Statistical decision theory and Bayesian analysis. New
York: Springer; 1985.
[20] Raiffa H. Decision analysis. Reading, MA: Addison-Wesley; 1970.
[21] Arnaldos J, Casal J, Montiel H, Sanchez-Carricondo M, Vilchez JA.
Design of a computer tool for the evaluation of the consequences of
accidental natural gas releases in distribution pipes. J Loss Prevent
Process Ind 1998;11:135–48.
[22] Erkut E, Verter V. Modeling of transport risk for hazardous
materials. Oper Res 1998;46(5):625–42.
[23] Faber MH, Stewart MG. Risk assessment for civil engineering facilities:
critical overview and discussion. Reliab Eng Syst Safety 2003;80:173–84.
[24] Vincke P. Multicriteria decision-aid. Bruxelles: Wiley; 1992.
[25] de Almeida AT, Bohoris GA. Decision theory in the maintenance
strategy of a standby system with gamma distribution repair time.
IEEE Trans Reliab 1996;45(2):216–9.
[26] de Almeida AT. Multicriteria modelling of repair contract based on
utility and ELECTRE I method with dependability and service
quality criteria. Ann Oper Res 2005;138:113–26.
[27] Modarres M, Kaminskiy M, Krivtsov V. Reliability engineering and
risk analysis. New York: Marcel Dekker Inc.; 1999.