Pipeline Failure Cause Theory: A New Accident Characteristics, Quantification, and Cause Theory

Abstract

Based on the accident research and management practices of oil and gas pipelines, the characteristics and the quantitative description of the accident/failure are set up. Several characteristics are summarized which clearly describe the essential prosperities of the accident. Fragility, anti-fragility, and integrity are used as an index to describe the state of accident, which provides a new way of evaluating and describing accident, different from the traditional accident assessment. The understanding and the evaluation of the nature of accident become clearer. Accident cause theory is the basic theory of cognition and prevention of failure. In this chapter, based on the analysis of characteristics and limitations of some accident cause theories, and comprehension of characteristics of failure and systematic statistics, a new systematic accident cause theory is proposed, named by analogy with “tree-type.” This theory provides a systematical supplement of accident cause theories.

1. Introduction

As the most safe, environmentally friendly and energy-saving oil and gas transmission method, pipelines have been widely constructed around the world. Compared with other methods of transportation, its safety is the highest, but more serious accidents can also occur, causing the public and the government to pay close attention in recent years [1]. Therefore, a correct understanding of pipeline accidents, prediction, and prevention of pipeline accidents is the basis for ensuring the safe operation of pipelines [2]. However, research in this area is mostly concentrated in the fields of construction, processing, and manufacturing of traditional industries. The study of accident causes, prediction, and prevention for the pipeline industry is relatively rare, which severely restricts the perception of pipeline accidents and limits the pertinence of the prepared response measures. The lack of theoretical basis for integrity management with the main purpose of preventing accidents has weakened the effect of pipeline integrity management [3].

First, this chapter discusses the characteristics of accidents and quantitative description methods. It can help to understand accidents logically and avoid deviations or mistakes in the cognitive process of accidents. Then, based on the cognition of the characteristics of accident, the author introduced the concept of fragile assessment to quantify the state of the system. It provided a new accident assessment description model for the industry and made it possible to recognize the cause of the accident and more formulated [4].

Accident cause theory is the theoretical basis for recognizing accidents and preventing similar accidents from occurring again. The current accident causality theories have certain limitations; they cannot find full life cycle problems and achieve targeted prevention. With the development of technology, the basis for analyzing the causes of accidents has changed, for example, it is easier to obtain a lot of data. This chapter is based on the ability to obtain a large amount of data, the cognition of accident characteristics, the analysis conclusions and statistics of a large number of accident causes, etc., proposes a theory of systematically analyzing the causes of accidents. This theory analogizes the life of the tree to describe this set of the accident cause theory. It is a new set of system analysis methods to the analysis of accident causes [5].

In order to predict and prevent accidents, it needs to know the cause of the accident. The era of big data makes this possible. In the past few years, big data technology has developed rapidly and has been widely used. Based on in-line inspection data or/and global positioning system (GPS) data, it is easy to setup the data model and make all data in one big database. The big data makes “samples = all”; it has the conditions of system failure analysis supported by multiple angles, full life cycle, and multiple information sources [6, 7]. In future, the prediction of pipeline failure model analyzes the failure factors of fragilities on big data, and uses Bayesian survival method by accident cause theory to predict life, and proposes that corresponding prediction models will be the hot pot of the research.

2. Characteristics and quantification of oil and gas pipeline failure

2.1 Characteristics of failure

The accident is an inevitable product of human industrial development and an important way in which the industry naturally chooses to eliminate it. It is also an important driving force for the industrial progress. In this chapter, leakage or certain economic losses of pipeline system as accidents or failure is defined. Many times accidents are described as failures and no distinction is made here. According to the pipeline accident statistics report [8, 9, 10, 11], the causes of pipeline accidents are manifold, and most of them are caused by multiple factors. The industry has done a lot of analysis on the causes of pipeline accidents. However, in order to raise awareness of pipeline accidents, it is necessary to understand the accident intrinsically.

The accident has the following characteristics:

1. Inevitability: the accident will inevitably happen. It can only prevent accidents to the greatest extent, but it cannot prevent accidents from happening.

2. Irreversibility: any accident is irreversible, so it is more advantageous to increase the prediction and judgment of the accident than to ignore it.

3. Unknown: never know what will happen, unexpected accidents may occur at any time.

4. High probability: before the accident did not happen there will be lots similar but unhappen events. The types of accidents that have generally occurred will occur several times. The opposite is the small probability. For some type of small number incidents, it should be considered whether it is a low probability accident.

5. Not predictable: before the accident did not happen, it was considered that a very serious forecast may not be recognized. When an accident occurs, it cannot predict its consequences immediately. Dangerous factors may be safety, and unnoticed factors are often prone to accidents.

6. Recognize deviations: accidents, whether large or small, should be treated equally, but usually only serious accidents will be given attention. Experiments have found that people’s ease of feeling about different risks is closely related to their emotional responses to these risks. Judgments and decisions can be influenced by emotions that happen without any awareness. The process of dealing with small accidents is feeling easy, after dealing with major accidents. The reverse order is feeling irritating, panicking, and easy to treat with mistakes. In fact, only focusing on major accidents is losing the chance of discovering problems from small accidents and avoiding major accidents. It is easy to occurrence of “probability neglect.” There is a potential habit of coping with small risks, either completely ignored or over-emphasized and without buffers. “Availability bias” also affects the understanding of the accident. Such as public opinion, personal experiences, etc. will increase the impression of events, so that the brain is more likely to think of these things, so that these things are more likely to happen, but the reality may not be the case, this is only everyone’s own understanding.

7. Tolerance is not uniform: the accident is unchanged, but the tolerance of the accident changes with time or place. When there is a need for war or survival, the tolerance for accidents rises; and when peace time and economic conditions are good, the tolerance for accidents decreases.

8. The simplicity and complexity of the cause: the cause for most of the accidents is very simple, but the process and factors that cause the accidents are very complicated.

9. Uncertainty of the cause. Many accident causes cannot be known. Perhaps, individual decisions are correct, but they do not determine that there will be no accidents.

10. The dichotomy of the accident: incidents include stages of occurrence and losses caused. For example, a pipeline leakage accident is divided into leakage and causes of loss. At the stage of occurrence, it includes leakage, diffusion, and explosion. The consequence phase is the serious loss caused by the formation of people, buildings, environments, etc. The first phase focuses on the direct cause of the leak, while the second phase analyzes the direct causes of serious consequences.

11. The ambiguity of accidents and affairs: an accident is an objectively occurring phenomenon that does not change; but as the situation changes, awareness and description of the accident will change accordingly. The level of awareness of accidents, response measures, and public opinion guidance determine the direction of affairs change.

12. The impetus of industrial progress: the accident will inevitably promote the improvement of management. Major accidents will become the turning point of cognition and management, and promote the improvement of technology and management level.

The above features are not all the features of the accident. With the deepening of the cognition of the accident, new features will continue to be recognized, and the existing features need to be further improved and supplemented. The characteristics of accidents are the essential attributes of accidents. However, this point is often overlooked, which leads to the deviation from the nature of accidents in analyzing and recognizing accidents, and results in erroneous analysis.

2.2 Accident probability and qualitative analysis

Whether or not all accidents should be investigated is the first problem in accident management decision-making. If this problem cannot be solved theoretically, it will result in unnecessary investigations and erroneous investigations, leading to erroneous management improvement measures.

If the occurrence of an accident is a low probability event or a random event, the causal explanation for it must be wrong. A small sample of the risk of error may be as high as 50%. In this case, if it is still handled according to the traditional high probability accident, it can easily cause greater losses [12]. The confirmation of the probability of an accident is the basis for deciding whether or not to conduct accident analysis and investigation. Therefore, the probability confirmation of the accident must be discussed before the accident investigation.

For random problems, the determination of the overall problem through a small number of accidents or random inspections is the key, which can be analyzed using the Larger Number Theorem. Bernoulli’s theorem of large number is: let $\mathrm{\mu }$ be the number of occurrences of event C in n independent experiments, and the probability of occurrence of event C in each test is P. Then, for any positive number ε, there is:

$$\underset{n\to \infty }{\mathit{lim}}\left(\left|\frac{{\mu }_n}{n}-P\right|<\epsilon \right)=1$$E1

This theorem is a special case of Chebyshev’s Law of Large Numbers, which means that when n is large enough, the frequency of occurrence of event C will be almost close to the probability of its occurrence, that is, the stability of the frequency. However, frequency is not equal to probability. As the theoretical basis for estimating the truth from statistics, the Large Number Theorem states that if the statistical sample is large enough, then the frequency of things can be infinitely close to its theoretical probability, that is, its “nature.” It should be noted that “having a certain regularity” does not mean that a limited number of repeated trials will be taken, and the results obtained must have regularity. Even if a very large N is given, as long as n < N, it cannot be guaranteed. The frequency of occurrence of C is equal to the probability of its occurrence.

Generally, people misunderstand randomness as homogeneity: if something that has happened in the past has been uneven, it is mistakenly thought that things in the future will move toward “nearly uniform” direction. If an individual’s misoperation like tossing coins is random, then the misoperation is not necessarily an individual subjective behavior. It may be due to the lack of certain standard constraints. It should be prudent to determine whether it is a personal problem, small probability problem, standard management problem, or ubiquitously large probability problem. For example, in the analysis of pipeline welding defects, the determination of whether a welder’s welding problem or the welding quality of all pipeline construction management systems is a problem that needs to be clarified first.

If you decide to analyze the case, analyze it according to the law of small numbers. The law of small number is an important research result obtained by the Nobel Prize-winning behavior psychologists Amos Tversky and Daniel Kahneman in his study of “gambler’s fallacy.” It means that because of the limited human cognition of things, its behavior often shows heuristic biases and there is a problem of “spud,” that is, the follow-up judgment result has a strong relationship with the starting point, and will be based on the observed several results to speculate on the later results, while ignoring the independence between each experiment.

The confirmation of the nature of the accident with small probabilities is the basis for deciding on the nature of the accident. If the survey is conducted without first determining whether it is a small probability event, there will be a significant impact of preemptive bias, leading to adverse consequences. Therefore, it should be judged first whether it is a small probability event. For a non-small probability event, a detailed accident investigation should be conducted and the improvement should be made based on the investigation results. In the investigation and analysis process, the investigation of the cause of the accident’s occurrence and consequences, as well as the investigation of the cause of the accident, must also be based on the judgment of the nature of the accident with large probability or small probability.

The law of small numbers holds that if the sample is not large enough, then it may manifest itself in various extreme situations, and these conditions may not be related to the nature of the sample. You cannot rely solely on the judging person’s own experience, and even add other people’s experience to make judgments about things. The personal experience is limited. It is not possible to apply individual cases and large-scale statistics should be conducted. At the same time, before summing up the rules based on the sample results, try to avoid the conclusion of “anchoring” first, that is, you cannot first set a conclusion that is acceptable in mind and then look for a sample that supports the conclusion.

2.3 A quantitative description of the likelihood of an accident

Although there are many studies on the causes of accidents, there are few studies on how to quantify the possibility or status trend of accidents or failure. That is, there is little research on the quantitative assessment of the status of a system or object from the perspective of the probability of an accident when there is no accident or after an accident. Because risk is not measurable, the author tries to use the triad classifies, fragile, anti-fragile, and robust, proposed in the book anti-fragility, to quantify pipeline accidents or failures trend [13].

The concept of vulnerability is proposed by Keohane and Nye in “Power and Interdependence” [14]. It is mainly used to analyze the concept of international politics and assess the cost of changing the system of interdependence, that is, assess the severity of the consequences of violating or changing the rules. “Anti-fragile” believes that the triad classified of things is fragile, robust, and anti-fragile. Fragility is related to how a system suffers from the variability of its environment beyond a certain preset threshold, while anti-fragility refers to when it benefits from this variability—in a similar way to “vega” of an option or a nonlinear payoff, that is, its sensitivity to volatility or some similar measure of scale of a distribution [15]. That is, system becomes stronger or weaker after things such as fluctuations, pressure, etc., and other environmental or internal factors change. Specifically, fragile is a weak element in an object or system that may be exploited by the threat to cause damage. Once the fragility is successfully exploited, it may cause damage to the object or system. Fragile may exist in physical environment, organization, process, personnel, management, hardware, software and information, etc. Fragile refers to the trend of changes in things, such as volatility, randomness, pressure, etc. If an incident does not respond to volatility, randomness, and stress better, it means that the thing or system is vulnerable. A change trend that has no effect on the thing or system means that it is resilient or complete in response to fluctuations; if things exhibit greater flexibility in responding to fluctuations, an increase in benefits, or a decrease in damage, it means that the item is anti-fragile in response to fluctuations.

The fragile, anti-fragile, and toughness used to quantify the state of the accident system are only static physical states. The difference from traditional risk assessment is that the fragile is measurable, but the risk cannot be measured, and the measure of fragile is also different from risk prediction [13].

For oil and gas pipelines, in order to describe the trend of possible pipeline accidents, the entire system such as the physical state of the pipeline system and the management system can be described with the fragile, anti-fragile, and integrity. The choice of integrity instead of robust is based on the current state of the art of pipeline integrity management and assessment. Pipeline system fragile refers to the system that suffers from the fragility that may occur when pipeline internal and external factors change.

Fragility describes the possibility that a defect develops into an accident or an intact state develops into an accident. The anti-fragility of pipelines refers to changes in internal and external environmental factors, and even in the event of accidents, the pipeline’s emergency measures, integrity management, etc. have been strengthened. Anti-fragility describes the development of pipeline systems in the direction of accident prevention. Integrity refers to the physical state of the pipeline and its ability to withstand changes in various factors. Fragility and anti-fragility are the status of the pipeline system, and its comprehensive indicators reflect the possibility of accidents in the pipeline system. Integrity means that the physical state of the pipeline is intact and its ability to withstand changes in various factors is strong. Vulnerability and anti-vulnerability are the status of the pipeline system, and its comprehensive indicators reflect the possibility of accidents in the pipeline system.

Entropy increase includes both the external factors that cause fragility and the internal factors in the system itself, which can reduce the integrity of the system. The entropy increase of the pipeline system makes the status of the pipeline system worse, and accidents are more likely to occur. The increase in entropy is controlled through management upgrades and maintenance inputs. If the entropy increase of the pipeline system fails to receive sufficient attention, it may increase the negative anti-fragile index, that is, the increase in entropy is a normal phenomenon, and the phenomenon of “warm boiled frog” occurs.

In the presence of known fragilities or hazards in the system, when external factors change, the factors that cause the accident are called trigger factors. For factors that are flawed, but do not cause an accident under conditions of external factors, are not triggers. The accident can happen because there are multiple triggers, or it can be the last trigger. The triggering factors may be related to time or maybe timeless, which is the direct cause of the accident. The trigger factor may be that a known fragility factor develops into an accident, or is an unoccupied or unrecognized fragility factor.

Therefore, the state of an accident that may occur in the pipeline can be described by the following formula:

$$A=F-AF$$E2

In the formula, A is the probability of accident; F is the probability of accident described by fragility; and A F is anti-fragility.

Since it is the fragility of the triggering factor that determines whether an accident occurs or not, the fragility probability ${\mathrm{F}}_{\mathrm{p}}$ described by the fragility is equal to the trigger fragility ${\mathrm{F}}_{\mathrm{t}}$, which is the direct cause of the accident. This results in:

$$F_p=F_t=ma{x}_i\{F_y,F_w\}$$E3

where $F_y$ is the identified fragility factor and $F_w$ is an unidentified fragility factor.

Because the fragility indicators of unknown factors cannot be identified and evaluated, the probability of an accident described by the fragility is generally equal to the maximum value of all known triggering vulnerabilities. F is a positive value. The larger the value is, the more fragile the physical state is and the more prone to accidents.

$$F=ma{x}_i\left\{F_y\right\}$$E4

In the above model description, there will be two cases:

1. One of the known factors develops to an accident.

For example, assuming that a pipe has 10 conditions that can lead to the occurrence of cracks in the girth weld, the current girth weld has 9 known factors, and the existence of these 9 factors does not cause an accident. When one of these 9 factors changes, it causes an accident. This factor may be an internal or external factor. It may be that the weld crack defect grows to the extent that it cannot carry the normal operating pressure of the pipeline, or it may be that the geological displacement causes an increase in the external bending stress.

2. Unknown factors triggers to accident.

For example, among all the factors of the cause of the accident, the known factors of vulnerability did not change further, but the occurrence of unknown or missing triggers led to the accident. Supposing that a pipeline with 10 factors can cause cracks in the girth weld of a pipeline, the current girth weld has 9 factors condition, and if the tenth factor condition is met, such as the internal pressure rises due to misoperation as a trigger, an accident occurs.

Therefore, the probability of an accident is determined by the fragility factor that has the highest probability. When conducting risk management, you should focus on the most probable fragility factors, rather than assessing and managing every risk of the entire system.

When the triggering factor is timeless, traditional risk assessment may think that its risk is high, but its qualitative change from high-risk to accident may never happen, or it may happen at any time. Therefore, the probability that the triggering factor break determines the risk of the entire system, rather than judging and counting the risk based on experience, and more importantly, the fragility status determines the risk.

When the probability of fragility factors cannot be identified technically, it can be assumed that there are many existing fragility factors in the system. Once the conditions change, the probability of accident of both types is high. The “accounting rate” of factors corresponds to the probability of an accident.

Therefore, according to the accidental “tree-type” theory [5], it is assumed that the largest factor causing a certain type of pipeline accident is m, and the state is found to have k fragile factors. According to the occupation rate, the probability of occurrence of the accident is k/m.

Therefore, for a multi-factor i that may result in fragility, the fragility can be quantified using the following formula:

$$F={\displaystyle {\prod }_i\left\{\frac{k}{m}\right\}}$$E5

In the formula, i is the number of risk factors that cause fragility, for pipeline that will be including the total number of corrosion, cracks, third-party damage, etc.

Assume that there may be 10 factors that may cause cracking of girth welds in a pipeline, including the lake of fusion, crack, repair welding, dead ends’ welding, etc. Through the risk identification, it was found that the weld has seven fragile factors such as crack, but the assessment results indicate that the pipeline can continue to be serviced under the existing pressure and other conditions. The triggering factor may be the growth of crack, or it may be the eighth or ninth newly added fragility, such as the external load caused by geological displacement, overpressure by misoperation. Under fragility conditions that cannot be clearly determined, it is believed that the higher the F value, the easier the break. When internal and external environments change, accidents are more likely to occur. Comprehensive calculation of F-values and consequences can give the risk of the pipeline system.

According to the definition of anti-fragility:

$$A_f=M_g-L_f$$E6

In the formula, $M_g$ is the management improvement effect and $L_f$ is the negative effect.

When the effect of management improvement is greater than the negative effect, ${\mathrm{A}}_{\mathrm{f}}$ is positive; otherwise, it is negative.

For oil and gas pipelines, its integrity is defined as:

$$I=1-F$$E7

where I is the integrity of the pipeline, that is, the physical state of the pipeline that meets the design and operational requirements.

Fragility describes the state of the pipeline system, which is only the physical state at a specific point in time. When the factor conditions change, the fragility will be changed. When conditions change independently of time, the fragility is also independent of time. Therefore, the fragility cannot be used to predict the probability of an accident. The likelihood of accidents is the degree of difficulty or likelihood of triggering. So the concept of fragility is different from that of the traditional pipeline accident.

In general, the ratio calculated from accident statistics is used as the probability of an accident, which is a calculation or statistic. Muhlbauer, in his newly published book in 2015, Pipeline Risk Assessment—The Definitive Approach and Its Role in Risk Management, believes that the most useful definition of probability is the level of trust [16], including engineering judgments, expert opinions, and potential risks that have been evaluated understanding of physical phenomena.

The traditional risk assessment is to use the experience and statistics of past accidents to predict the possibility of accidents occurring in the future, rather than describe the physical state of the system. This type of risk assessment method often fails to answer the question: “High-risk pipelines have not been involved in high-risk accidents for a long time,” which has seriously affected the degree of recognition and acceptance of risks by some public, engineers, and senior management personnel.

If we assess and describe the state of the system based on the fragility, we can more scientifically describe the system’s possible accidents, and more clearly reflect the process and possibility of the development of high-accident factors as accidents. If on this basis, combined with the consequences of accidents to comprehensively measure, it can reflect the state risk of the pipeline system, and the conditions and factors that lead to the establishment of an accident or risk will be clearer.

Fragility is not reliability. Reliability is generally an indicator for non-repairable systems. It is the ability to continuously provide normal use functions through parallel systems in the absence of faults or under fault conditions.

According to Mohitpour et al.’s Pipeline Operation and Maintenance: A Practical Approach, the reliability of the pipe system is considered to be the degree of reliability of the media to be safely transported through pipes within a given time [17]. Some pipeline operators calculate the reliability of a pipeline by using the total amount of time that a pipeline can deliver a certain amount of medium without failure during a certain period of time. It can be seen that the reliability assessment is an assessment of the integrated system such as process and system status, and the fragility is only a key factor of reliability.

3. “Tree-type” model of accident cause theory

In areas such as the oil and gas industry and the construction industry, accidents such as leaks and explosions of oil and gas pipelines, and the collapse of buildings and bridges often occur with serious consequences. In the face of accidents, people are always thinking about the causes of accidents. This has led to the theory of accident causes and has become the theoretical basis for understanding accidents [18].

The accident-causing theory promoted the recognition of the objective world and reduced the harm of accidents to humans, which is a direct reflection of human technological progress. The occurrence of an accident, especially the occurrence of a casualty accident, is random and accidental. It is caused by many factors, and there are intricate and complex relationships among various factors. The theory of accident cause is to find out the inevitability of the accident from the random and accidental accident, understand the law of the accident, and eliminate the accident in the bud.

At present, the more-recognized causality theory focuses on the analysis of the unstable conditions under the conditions of accidents, ignoring its historical background and causing a great deal of information loss. For this reason, based on the analysis of numerous accidents, a new theory of accident causation was proposed, and the core content and new criteria for analyzing the causes of accidents were systematically presented. Then, an accident failure analysis method was proposed based on this theory include analysis process and logic analysis model in order to be able to improve the drawbacks of the traditional theory, improve the cognition of the cause of the accident.

Due to the limitation of professional technology, the “tree-type” accident cause theory proposed below is mainly aimed at oil and gas pipelines and building structure accidents, but it also has reference value for the analysis of accident causes in other area.

3.1 Traditional accident cause theory

Accident cause theory is the product of the development of productive forces to a certain stage, especially the change of production methods and the change of people’s status in the production process, causing changes in people’s safety concepts, resulting in different accident cause theory. With the continuous improvement of the level of production technology and the deepening awareness of accidents, the accident cause theory has also been continuously improved and developed, and has gradually become an important theoretical basis for understanding the accident process and preventing accidents [19]. To sum up, it mainly experienced three historical periods of single factor cause theory, two-factor cause theory and system cause theory.

The accidental cause theory is gradually developed in the process of modern industrial development. In its development process, Adams’ accident causal chain theory, trajectory intersection theory, human factor system theory and synthesis are the comprehensive theory. The difference in the core content of these theories reflects the continuous improvement of the depth of awareness of accidents. The theoretical analysis of comprehensive causes is the most scientific, and it comprehensively covers other theoretical contents.

The analysis of several current classical theory of cause of accidents has certain limitations and deficiencies. The core of the theory is mainly about insecure physical state of things and the unsafe behavior of people. Failed to grasp the true features and root causes of the accident. The effects of incentives on accidents were not taken into consideration, and the comprehensive role of multiple factors was not considered as the key to the accident. What is more important is that the comprehensive relationship between accidents and all aspects of the entire life cycle and the environment is not taken into account, and the possibility of technical ambiguity is not taken into consideration. Therefore, the problem cannot be fundamentally explained.

The traditional accident cause theory believes that an accident is caused by the cross between the unsafe state of the object and the unsafe behavior of the person. Obviously, it describes only an idealized simple concept. This theory cannot explain the situation in which the two are crossed without accidents. At the same time, it cannot explain the situation where the two do not exist or do not cross, but the accident still occurs. For this reason, the cause of the accident cannot be really identified only by the crossing of the trajectory.

The use of traditional theories to analyze accidents can easily cause certain causes of omissions in many aspects. In particular, the underlying causes of analysis are prone to large deviations. For example, in the building structure and pipeline industry, the occurrence of accidents is affected by many factors. It is necessary to consider all aspects of the life cycle such as planning, design, construction, and operation. Often, the unsafe physical state of things and people’s unsafe behavior are not fundamental to the accident. The traditional cause theories, therefore, are not recommended as the core of the accident causal analysis.

3.2 “Tree-type” model of accident cause theory

Before discussing the causal theory of the “tree-type” pipeline accident proposed in this paper, several basic definitions are discussed.

3.2.1 Definition

Root cause: it refers to the root cause of things or the most essential reason that causes things to change. It is the most important reason that plays a key role and determines the role of many things that cause things to change.

Indirect cause: it is a factor that cannot play a leading role. It only plays a role in the transfer.

The direct cause (usually also the inducement): it refers to the most direct promotion of the occurrence of things and the direct contact with the occurrence of accidents. It is the near-term surface expression that causes changes in the development of things. It does not go through intermediary or intermediary links. Generally, it is to analyze the closest factor in time relationship or logical relationship.

3.2.2 Fundamental arguments for the cause of the “tree-type” accident

The principle of inevitability: the occurrence of an accident is inevitable; there is no accident that occurs as contingency; only the probability is different. With the increase in awareness of the causes of accidents, it can be seen that when certain conditions are met, accidents are inevitable and can be predicted and prevented.

Direct consequence: the direct consequence of an accident is structural failure, leakage or Destroyed of device etc. The failure includes failure of ontology function, failure of auxiliary facilities, etc., while the loss refers to the state of physical corrosion loss, structural protection loss, and other deviations from the original design requirements.

Indirect consequences: the indirect consequences of an accident are casualties, environmental pollution, or property damage.

Direct cause: if accidents occur due to inadequate or unfavorable changes in the natural environment, management (human), and nature (process, corrosion, and fatigue), this change can be considered as a direct and direct cause of the accident. Any factor may break the balance. There is no concept of quantity.

Indirect reasons: the insecure status of objects and human unsafe behaviors, and the factors that create the necessary conditions for accidents are indirect causes. The insecurity of things and the unsafe behavior of people should all be attributed to the management elements. It is just a direct manifestation of various kinds of missing in time coordinates, rather than the direct cause of the accident. It is an indirect cause. The intersection or non-intersection of the two may cause accidents, and the intersection between the two may not cause accidents. Whether or not the accident is affected by the amount of crossover, incentives, etc. Although accidents occur when the insecurity of things and people’s unsafe behaviors intersect, it does not mean that they are the root cause of the accident. The lack of deficiencies in each link of the entire life cycle or the inadequacy of reliability over time may add up to a certain extent, which may lead to accidents. If the absence of the latter link leads to the lack of the previous link, it may have a continuation effect. If the latter link corrects the lack of the previous link in a timely manner, the accident may be controlled in this link. There is no lack of a link itself cannot make up for the lack of upstream links, can only reduce the contribution rate to the accident. Designs or requirements based on a large number of preconditions and designs without loss of control are missing.

Quantification of indirect causes: the lack of various links (insecure state of matter, lack of management) varies according to external factors (administrative insecurity, natural environment, process change, etc.) under different conditions, and needs to be based on external conditions. Determine whether the absence will lead to an accident. Whether it is a single link or multiple links is the key to causing an accident. It is necessary to analyze the degree of lack of each single link, and the degree of influence of comprehensive factors and external incentives needs to be considered. The unsafe state of things and the unsafe behavior of human beings cannot be cut off, and it is impossible to eliminate them completely. It is also possible that the factors are considered to be in a state of safety and the accidents are caused by superposition.

Root causes: it refers to the nature and root causes of various factors. It is the system, mechanism, law, humanities, education, economy, standards, norms, management methods, assessment mechanism, and technical cognitive level that lead to the lack of the main body, lack of management, etc. The phenomenon is generated, which accumulates and develops into an accident. This is the root cause.

Quantification of root causes: different social factors, life cycle factors, and direct influence factors are the key to the possibility of an accident.

The unique characteristics of accidents: the types of accidents are different, and the number, distribution, severity, and external incentives of the links are different. It is necessary to perform logical analysis according to the actual situation.

3.2.3 Logical model of the cause of “tree-type” accidents

The “tree-type” accident causation theory is based on the conditions of big data [6], combined with case analysis and verification, and proposes a new theory of accident causation. Its purpose is to grasp some potential laws of accidents are followed. The accidents that have occurred are tracked. The root causes and evolution of the accidents are studied and analyzed to understand the tendency and inherent laws of the accidents so as to find the potential or possibility of accidents in the future. Therefore, adopting corresponding measures to prevent or eliminate accidents and avoid “reproducing” accidents is a philosophy of accident-free [2].

According to the above arguments, the causes of accidents can be simulated using the logic of “tree-type” like the life of tree: accidents are just like a dead tree, broken branches, and other processes. When standards, norms, education, mechanisms, and other fundamental issues are similar to bad soil environmental impacts, the health of the tree determines its basic nature. Design, construction, and other aspects will affect the strength and ability of the entire tree. The various production processes of operations are similar to the leaves of trees, and play a role and contribution to the whole in the sunlight of management. If problems arise in management, the entire process will be affected, causing the trees to wither or be blown off in the breeze. Process changes and changes in the elements of the natural environment are the external environments in which trees live. Just as seasonal changes and wind and rain are the external influences on the health of trees, they are the external environments that a healthy body should bear. The changes are the internal defects that lead to the development of accidents. It is the direct cause. Based on the above, the “tree-type” simulation was conducted for the pipeline industry as Figure 1.

Figure 1.

Tree-type simulation of pipeline accident cause theory.

3.2.4 Application analysis process of “tree birth” theory

The value mining of accidents is only the tip of the iceberg. A large amount of regular and valuable information has not been fully analyzed and identified, resulting in the loss of precious wealth. Under the conditions of big data, the awareness of accidents has changed and can be fully realized. Digging out the “long-tailed” factors that may cause accidents can also fully avoid the “survivors’ rule” [20].

The “tree-type” pipeline accident causation theory aims to reveal the relationship and laws between accidents and life cycle influencing factors, so as to feed back to each stage of the life cycle and prevent the repetition of similar events. According to the principle proposed by the basic arguments of the “tree-type” accident cause theory, the causal analysis was carried out in order as Table 1.

No.	Steps	Course analysis
1	The principle of inevitability	Define the inevitability principle of accident analysis and confirm that it is a small probability event or a single event.
2	Direct consequence	Investigation to clarify the direct performance of the accident.
3	Indirect consequences	Investigate indirect performance and losses, such as casualties, property damage, etc.
4	Direct cause	Analyze the direct cause and find out the factors that break the balance. There may be multiple factors.
5	Indirect cause	Identify unsafe status of objects and unsafe behavior of people, analyze cross history and quantity, find data of full life cycle, analyze possible lacks of each link, and find indirect causes.
6	Quantification of indirect causes	Quantify the contribution of indirect causes to accidents.
7	Root causes	The various factors of the whole life cycle link to find out the root cause.
8	Quantification of root causes	Quantify different social factors, life cycle factors, and direct influence factors.
9	The unique characteristics of accidents	Analyze the uniqueness of various types of accidents according to the differences among various factors of different accidents.

Table 1.

Tree-type theory analysis process.

The accident causation theory is the theoretical basis of the accident investigation When the accident investigation is conducted, data collection and analysis are performed according to the various factors and logic involved in the theory. So the pipeline big data era lets the full life cycle of “tree-type” theory to be operated. Under big data conditions, how to recognize pipeline accidents and risks gives a different point of view than traditional. The change of risk assessment under big data conditions is inevitable. The prediction of pipe girth accident model based on big data and “tree-type” theory is only an application example, and its conclusion has shown that this analysis method gives more reasonable conclusions [2]. It is easier to identify the cause of the accident and give suggestions for management improvement.

This theory is also the theoretical basis for risk identification and assessment. Under the conditions of big data, by analyzing the key factors leading to accidents, and calculating the ratios of potential factors and causes, the possibility of accidents can be calculated and the key factor of the mitigation can be given. Based on this idea, a new and systematic risk assessment model can be constructed.

3.3 Casing study

3.3.1 San Bruno pipeline rupture

On September, 2010, a gas pipeline operated by Pacific Gas and Electric Company (PG&E) ruptured under the suburb of San Bruno, California, USA. The rupture produced a crater about 72 feet long by 26 feet wide. The released natural gas ignited, resulting in a fire that destroyed 38 homes and damaged 70. Eight people were killed, many were injured, and many more were evacuated from the area [21]. Applying the tree-type theory to analyze the accident can more systematically identify the cause of the accident as Table 2.

No.	Steps	Course analysis	Tree-type
1	The principle of inevitability	Define the inevitability principle of accident analysis and confirm that it is a small probability event or a single event.; The dichotomy of an accident should be considered when analyzing the causes and consequences.
2	Direct consequence	The rupture of the pipeline.	Dead or broken of the tree.
3	Indirect consequences	Casualties and property losses.	Broken tree brings other losses.
4	Direct cause	A pressure increase stemming from poorly planned electrical work at the Milpitas Terminal.	Decayed tree trunk breaks under strong wind.
5	Indirect cause	Inadequate quality assurance and quality control in 1956 during its Line 132 relocation project, which allowed the installation of a substandard and poorly welded pipe section with a visible seam weld flaw that, over time grew to a critical size, causing the pipeline to rupture.	The soil on which the tree grows and the growth environment is poor, results in the lack of robustness of the tree.
6	Quantification of indirect causes	If you quantify the contribution of each link to the accident, construction may be the most important factor.	Just as the tree has decayed in its trunk during its growth, the decayed trunk has the largest contribution to the breakage of the tree.
7	Root causes	It was inextricably linked with the social environment and technology limited at that time. Despite the fact that education, culture, and technology have been greatly improved over the past, there is no good technology of integrity management performance measurement lead weld defect grow to rupture.	The roots of the tree grow poorly in soil (social environment, culture, ideas, etc.) and lack of sunlight (laws, standards, regulations, etc.), causing them to grow into unhealthy and irregular trees such as rot. When the external environment changes, it is broken. The cause of the rot of its trunk is the root cause of the broken tree.
8	Quantification of root causes	In the pipeline’s life cycle, neglected construction quality, poor of integrity management plan and inspection during operations, and weak safety awareness are the reasons that inevitably lead to accidents and consequences are extremely serious. Quantify the contribution of each link to accidents, and the lack of safety awareness and supervision is the most important factor.	Quantitative analysis of the contribution of various aspects of the decay of the trunk, including soil problems, lack of sunlight and other factors.
9	The unique characteristics of accidents	There is only one San Bruno pipeline rupture accident in the world, but similar problems exist in other pipelines. The accident has its own unique cause, but it is also universal. Its occurrence is inevitable.

Table 2.

Tree-type theory analysis process of San Bruno pipeline rupture.

3.3.2 Pipeline pigging stopping accident

A pigging stop occurred during a pigging operation for internal inspection of a pipeline: the first pig was parked at the elbow. After the analysis was performed using traditional analysis methods, specific improvement measures were implemented, but after restarting the operation, a second card stop accident occurred and the pigs stopped at the “t” section. According to the traditional accident analysis method, the root cause of the first pig stopping accident was analyzed. The pig cup was cracked by a 1.5 D (D-pipe diameter) elbow, causing the pig to lose its power and stop. The existing management problem is that there is no careful analysis of pipeline data, and the information obtained does not match the facts. According to the results of this analysis, the operator shortened the pig to enable the pig to pass through the low-rate elbow. However, due to the shortened length, the pig was passing through the tee because the length of the three-way flower hole was greater than the length of the pig. The tube device drives the distance between the cups before and after, losing power, and stopping. According to the traditional accident analysis method, it is believed that the current stoppage is due to the pigging device being too short. The reason for management is still that the pipe data is not carefully analyzed. The information obtained is inconsistent with the facts, and the management reason cannot be eliminated because of the history of the pipeline construction. As a result, the technology and management are not standardized during construction, and no comprehensive and accurate pipeline information can be obtained. If we continue to follow the traditional methods of accident analysis and treat similar problems, not only can we not really avoid the occurrence of accidents, but we also think that there are problems in management that have a greater impact on managers. Therefore, we should not simply think that there are problems with management.

According to the “tree-type” causal analysis method, the occurrence of a branch similar to the breakage of a branch, the common cause of multiple breakage of different causes is the irregular growth of branches, self-elimination in the natural environment, which is basically the root soil, trunk, etc. There are hidden dangers caused by the growth of irregular branches.

The direct consequence is that the pigs are stuck in the pipeline, causing minor production impacts. Increasing the pig pushing operation is an indirect consequence, similar to the breaking of the branches; the incentive is for the pigging effect, and the investment size is larger during the pigging process. The pig-cleaner exceeds the requirements that the pipeline can pass, just as the decaying branch naturally breaks due to an increase in its own weight when it grows up; the pipeline is in a state of such objects from construction to operation for a long time, but it cannot be simply defined as unsafe status.

The indirect reason for the first stop is that pigs are designed according to the passing capacity of 4 D, but the actual pipe elbows reach a minimum of 1.5 D. In the absence of a determination of the root cause, only the passing capacity of the pigs is improved. The length of the pig was shortened to enable it to pass through a 1.5 D elbow, but it stopped at the tee section again during the pigging process. The cause of this short pig stoppage was too low a ballast flow. The indirect reason was short of pig and the tee flower hole is too long, causing the pig to lose its power.

There are certain management problems in the two stops. Without the tee size data, there is no systematic assessment for it to be passable. However, the root cause of the management problem is that the pipeline data it is based on is inconsistent with the facts. It is a pipeline construction background such as the social environment, technical level, and standards that cause the irregular pipeline were the root causes of the stop.

The above case also show that the presence of elbows and tee features in the pipeline cannot simply be considered as an unsafe state of things, nor can pigging operations is regarded as unsafe acts of people, but still a stuck pig accident occurred. Through the use of the “tree-type” theory, a systematic analysis of the factors that caused the pig stop and find out the root causes can recognize that the two pig stop accidents are caused by historical reasons, and there are deviations in the pipeline data on which management is based. Only by implementing pigging operations in accordance with the most stringent pipeline data, gradually reassessing pipeline data, and making decisions based on real data, can effectively avoid the pig stoppage.

At the same time, in the principle of “tree-type” accidents, the understanding of “insecurity of things and unsafe behavior of people” is deepened, that is, both are variables that lead to accidents. When they appear crosswise, they may happen and also may not happen. Only by analyzing the historical background and conditions of the pipeline’s manufacturing, construction, etc., factors can the root cause of the accident to be identified. If the traditional accident analysis method is used, the root cause cannot be systematically and comprehensively analyzed, which may lead to the repetition of similar accidents.

The application of “tree-type” accident cause theory will raise the level of risk analysis and response at a higher level to mitigate risk and prevent accident. It is the key to the integrity management of oil and gas pipelines and building structures and technological progress, as well as the theoretical basis for achieving “prevention” [22]. At the same time, this theory systematically gives the core content of the analysis of the accidents causes. It can be widely applied to the cognition of industrial accidents such as building structures and oil and gas pressure pipelines. It can also build risk assessment methods based on this theory and is a risk assessment technology in the future as a new research way [23].

4. Summary and conclusions

The occurrence of non-leakage accidents is the goal of pipeline operation. Research on accidents cause theory is the theoretical basis for accident prevention. A clear understanding of the nature of accidents is the basis for the analysis and management of accidents and it will help to improve the technical level of managing oil and gas pipelines. The author’s research raises the following awareness to help prevent pipeline accidents:

1. The essential feature of an accident is the clear recognition of the basis of the accident. In the analysis of accidents, inevitability, deviation, and dichotomy are all characteristics that are easily overlooked or forgotten. Accidents and events are often confused. This article lists only part of the characteristics of the accident. There will be other features that will be recognized, observed, and accepted gradually in the future.

2. After an accident, whether it is a low probability or high probability accident, or the nature of a random accident, is the basis for determining whether the accident needs to be investigated and analyzed. Cognition of accident samples is the basis for improving accident awareness. The characterization of the accident as a small probability event or a universal problem is the basis for making accident investigations and accountability. Accurate characterization can avoid incorrect conclusions due to incorrect investigation and analysis, and affect management improvement.

3. The quantitative description of an accident is different from the current traditional method of recording accident descriptions, and it is the theoretical basis for improving accident analysis and cognition. The concepts such as fragility are used to quantify the accident probability, and the differences from traditional risk assessment techniques are analyzed. This not only improves the level of awareness of accidents, but also has a certain guiding role in improving the direction of risk assessment techniques.

4. The author proposes to describe the possibility of system accidents with fragility, anti-fragility and integrity. This is the first time that the logical relationship and mathematical description of the accident analysis have been given, and it is believed that the fragility description is superior to the traditional risk assessment and can better reflect the system status and identify the key factors leading to the accident.

5. Traditional accident cause theory makes people pay more attention to the insecure state of the object and the unsafe behavior of the person, and treats the directly presented problem as a root cause. The “tree-type” accident cause theory gives a systematic analysis of the logic, ideas and methods of accident analysis. It is a comprehensive analysis of various factors, which helps to find the causes of accidents, and distinguishes between the direct causes and indirect causes are an effective supplement to the theory of accident causes.

Using the “tree-type” accident causality theory analysis method, it is easier to understand the logical relationship and process of the analysis of the causality of accidents. Based on the principles and processes proposed by the “tree-type” accident causation theory, the use of simulated logical relationships can be clearly understood the causes of accidents and avoid take indirect causes as root causes. The factors that lead to the accident, the logical relationship, and the contribution to the tree breakage that are analyzed using this method can fully identify the risk of the accident and how to control the risk, so as to effectively prevent it.

This chapter discusses that the cause of accident is an older and traditional research topic. The causes of accident and description methods of features, etc., are not the hot topics in recent years. However, the cause of the accident is the theoretical basis for pipeline integrity management. As the author discusses in the book “Research and Practice on Pipeline Integrity Management in the Eastern Pipeline Network” [3], the core of pipeline integrity management is accident prevention, so what is the accident, what causes accidents, and why accidents and other issues are the core of research and promotion of pipeline integrity technology. Only by clearly knowing the causes of accidents can we identify potential risks and assess their vulnerability. Therefore, the study of the theory of accidental causes is the theoretical basis for improving the integrity of pipelines. It is recommended that in-depth study be conducted. The consequences of pipeline accidents are great harm to environments and safety. With the large-scale application of high-pressure and high-grade steels pipe, scientific accident cause theories are needed to support and identify the causes of various accidents under new material and new process conditions. Protect and assessments the fragile of pipeline to address urgent pipeline operation needs.

In the future, it is necessary to continue to study the characteristics of accidents and improve the theory of accident causes. It will be a longer-term task to study how to use system fragility assessment instead of risk assessment based on big data. At present, the recognition of accident features, the causation theory, and the vulnerability assessment system based on big data are still incomplete, and its need to be improved. However, with the accumulation of big data, new methods such as quantitative accidents based on the use of fragility are available. These new technologies will be recognized and developed.