Safety assessment of petrochemical enterprise using the cloud model, PHA–LOPA and the bow-tie model

Safe production is the foundation of the normal operations of petrochemical enterprises, and it helps maintain social stability. The main purpose of this study is to prevent petrochemical enterprise accidents by proposing a composite safety assessment approach based on the cloud model, preliminary hazard analysis–layer of protection analysis (PHA–LOPA) and the bow-tie model. First, the petrochemical enterprise and its relevant indicators were evaluated based on the cloud model. Second, the quantitative effect of the uncertainty transformation on the evaluation result of the cloud model was further analysed. This mainly includes the error analysis of the numerical characteristics under the conditions of few samples and small values. Third, the critical indicators such as shock and noise can be weakened and prevented by corresponding safety measures based on PHA–LOPA and the bow-tie model. After adopting two independent protection layers, the risk levels of shock and noise decrease from 3 to 2. Then, shock and noise were analysed in depth with the bow-tie model, and the causes and consequences were identified. Moreover, corresponding safety measures were taken to prevent accidents. The case study validated the validity and feasibility of the composite safety assessment approach proposed here.


Cloud model concept
As mentioned above, the cloud model is a transformation between a qualitative concept described by language and its relevant quantitative value. Furthermore, the transformation is uncertain, and contains fuzziness and randomness [15].
Let U be a quantitative domain described by a precise numerical value, and C be a qualitative concept in U. For the random element x ∈ U of the qualitative concept C, μ(x) ∈ [0, 1] is a random number with a stabilized trend for the membership x ∈ C. Then, the distribution of x in domain U is called the cloud, and x is called a cloud drop.
A specific cloud model is usually described by three numerical characteristics (Ex, En, He). A cloud model for a comfortable temperature is shown in figure 2, and the meanings of the three numerical characteristics are illustrated below.
The expectation Ex is the central value of the qualitative concept and the most representative of the cloud drops. The expected comfortable temperature is 21°C (figure 2).
The entropy En is the uncertain degree of the qualitative concept. It represents the cloud drops that are accepted by the qualitative concept in the domain. A larger En indicates greater fuzziness and randomness of the qualitative concept.
The hyper entropy He is the fuzziness and randomness of En. It represents the thickness of the cloud drops. A larger He indicates greater dispersion and randomness of the cloud drops.

Cloud forward algorithm
The most important algorithm of the cloud model is forward and backward cloud algorithms. The cloud forward algorithm is used to generate as many cloud drops as needed based on the three numerical characteristics (Ex, En, He). It mapped the qualitative concept to quantitative value, producing as many cloud drops as needed when the numerical characteristics (Ex, En, He) were provided. It can be easily qualitatively analysed by mapping the cloud model and standard cloud models into one cloud image. The cloud forward algorithm is neither an unambiguous membership curve nor a determinate probability density function. However, many cloud drops are created by two normal distribution functions that can realize the transformation between qualitative and quantitative. The cloud forward algorithm is described below.
Input. The expectation Ex, the entropy En and the hyper entropy He of the qualitative concept, and the number of cloud drops n. Output. The position in the domain and membership of each cloud drop.
(1) Generate a normal random number En with expectation En and standard deviation He.
(2) Generate a normal random number x with expectation Ex and standard deviation En .

Cloud model backward algorithm
The cloud backward algorithm is used to calculate the expectation Ex, the entropy En and the hyper entropy He from the given cloud drops. The cloud backward algorithm is described below.

Comprehensive cloud model
There are complicated correlations among the safety assessment indicators, which makes it more suitable to use the comprehensive cloud model. Let the cloud model's assessment indicators be C i (Ex i , En i , He i ) and the final comprehensive cloud model be C (Ex, En, He), in which C i is the fundamental cloud model of C. The comprehensive cloud model C can be computed as follows: En i v i (2.2) and where v i is the weight of the assessment indicators and n is the number of assessment indicators.

Standard cloud model
The standard cloud model is a kind of cloud model which is the standard for determining the level of cloud models, and it is usually determined by the golden section method [41,42]. The main idea of the golden section method is that the closer the variable is to the domain centre, the smaller the entropy and hyper entropy of the cloud model, and vice versa. The smaller entropy of adjacent cloud models is 0.618 times the larger one; so is the hyper entropy. The standard cloud model is usually divided into an odd number of levels. It is divided into five levels in this paper, including Safe C 1 (Ex 1 , En 1 , He 1 ), Relatively safe C 2 (Ex 2 , En 2 , He 2 ), Generally safe C 3 (Ex 3 , En 3 , He 3 ), Relatively dangerous C 4 (Ex 4 , En 4 , He 4 ) and Dangerous C 5 (Ex 5 , En 5 , He 5 ). For the assessment indicators with two unilateral constraints [x min , x max ], the numerical characteristics of the standard cloud model can be calculated as follows based on the golden section method:

Similarity between the cloud model and the standard cloud model
Similarity is used to confirm the level of the cloud model evaluated, and the computational formula is as follows: where Ex is the expectation of the cloud model to be evaluated, and Ex j and En j are the entropy and hyper entropy of the jth standard cloud model, respectively. By computing the similarity λ j between the cloud model and the standard cloud model based on formula (2.14), the level of the standard cloud model corresponding to the maximum similarity λ j is the final evaluation result based on the maximum membership principle.

PHA-LOPA
Preliminary hazard analysis (PHA) is a qualitative assessment method of internal hazards and criticality. Layer of protection analysis (LOPA) is a semi-quantitative assessment method of accident scenarios that analyses the initiating event, consequences and the independent protection layer. PHA-LOPA identifies the initiating events that can lead to the accidents in advance, determine the causes, risk levels and consequences, and prevent accidents or reduce the risk level of initiating events using independent protection layers [35][36][37][38]. The risk levels of hazards are presented in table 1 according to PHA.

Bow-tie model
The bow-tie model (figure 3) consists of fault tree analysis on the left and event tree analysis on the right [34]. The top event is centred in the bow tie, which may happen. On the left are the basic events that may result from the top event. On the right are the consequences caused by the top event, including casualties and property loss. To prevent the top event, safety barriers must be adopted. Preventive safety measures are set on the left, and mitigative safety measures are set on the right.

Results
The production process of petrochemical enterprises is complicated and changeable, and the operation process is serialized. The producers' goods and products are flammable, combustible, poisonous, harmful and perishable. Additionally, petrochemical enterprises are prone to fire hazards and explosion accidents, which will result in serious casualties, property loss and environmental pollution. Therefore, the safety assessment of petrochemical enterprises must be conducted. It must identify the risk factors that affect safe production and propose specific improvement measures.

Computational process of standard cloud model
The cloud model was applied to assess the safety of a petrochemical enterprise. The safety assessment indicators are shown in table 2 [13].
First, each assessment indicator must be given a mark, and the standard for evaluation is presented in table 3.

Evaluation results of indicators
The score results of experts and weights of indicators are presented in table 2 [13]. The basic cloud model of indicators can be achieved based on the scores of experts and the backward cloud generator that are also presented in table 2.
As shown in table 2, the entropy and hyper entropy in several basic cloud models of indicators were all 0. It is because some indicators, such as X 1 and X 7 , were scored the same by the experts, which leads to the scores of the indicators being identical to the expectation.
Taking the indicator X 1 as an example, the basic cloud model of indicator X 1 was (3.8, 0.401, 0.198). The similarity can be achieved based on formula (2.14). The results were λ 1 = 0.015 and λ 2 = 0.398, and the others were 0. Therefore, the evaluation result of indicator X 1 was relatively safe based on the maximum membership principle.
The evaluation results of other indicators can be achieved in a similar way. The indicators that were evaluated Safe include X 2 , X 10 , X 15 , X 16 , X 21 and X 25 ; Relatively safe include X 1 , X 9 , X 14 and X 18 ; Generally safe include X 3 , X 5 , X 7 , X 13 , X 17 , X 22 and X 24 ; Relatively dangerous include X 6 , X 8 , X 11 and X 20 ; and Dangerous include X 4 , X 12 , X 19 and X 23 .

Evaluation results of petrochemical enterprise
The comprehensive cloud model of the petrochemical enterprise can be obtained according to the weights of indicators and formulae (2.1)-(2.3). The result was C (3.161, 0.291, 0.216). A comparison between the comprehensive and standard cloud models is shown in figure 4.
The qualitative analysis of the evaluation result can be obtained based on these images. As shown in figure 4, the comprehensive cloud model fell into the Generally safe and Relatively safe standard cloud models, which indicates that the qualitative evaluation result of petrochemical enterprises fell in between Generally safe and Relatively safe. The quantitative analysis of the evaluation result can be achieved based on similarity. The similarity can be achieved based on formula (2.14). The results were         λ 3 = 0.595, and others were 0. Therefore, the quantitative evaluation result of petrochemical enterprises was Generally safe based on the maximum membership principle. Several important conclusions were reached from the process of petrochemical enterprise assessment with the present cloud model. First, an intuitive understanding and qualitative assessment were obtained by comparing the cloud model of petrochemical enterprise and its corresponding standard cloud models. Second, the greater the coverage area of the cloud model of the petrochemical enterprise, the greater is the fuzziness in determining the risk level, indicating that the score data of indicator were scattered and had violent changes in risk levels. Third, the larger the cloud thickness of the petrochemical enterprise, the greater is the randomness in determining the risk level.

Quantitative effect of uncertainty transformation on the evaluation result of the cloud model
The cloud model is a transformation between a qualitative concept described by language and its relevant quantitative value. Furthermore, the transformation is uncertain and contains fuzziness and randomness. The uncertainty transformation process will inevitably cause errors. The effect of uncertainty transformation (especially for samples no larger than 30 and values no more than 5) on the evaluation result of the cloud model will be analysed in this part.

Effect of five samples on the numerical characteristics of the cloud model
Let the expectation Ex = 1, entropy En = 0.2 and hyper entropy He = 0.02. First, generate five samples as input values with the help of the forward cloud generator. Then, calculate the numerical characteristics of the cloud model using the backward cloud generator. As the samples were randomly generated using the forward cloud generator, each simulation experiment was repeated 100 times, and finally, the relative error of the numerical characteristics was calculated. All the simulation experiments in this paper were processed with the help of the Matlab software. The relative errors of the numerical characteristics calculated by five samples are shown in figure 5.
As shown in figure 5a, the relative errors of expectations were approximately evenly distributed on both sides of the y = 0 axis, and the distribution of the sample points was denser the closer it was to the y = 0 axis. Most of the relative errors of the expectation fell in the interval [−20%, 20%]. The main reason is that cloud drops are created by two normal distribution functions that have a series connection, and the generating process for the cloud drops is random. Therefore, numerical characteristics of the cloud  model calculated by the backward cloud generator will inevitably cause errors, and the relative error of the expectation contains randomness that considers the y = 0 axis as the average value. The relative errors of entropy were also approximately evenly distributed on both sides of the y = 0 axis, but the range of the relative error was larger, and several relative errors of the entropy reached and exceeded 100% (figure 5b). This is due to the entropy being calculated by the numerical value and the expectation of the generated cloud drops. Both of them have randomness and uncertainty, which lead to further increase of the relative error of entropy.
The relative error of hyper entropy was further increased, and several relative errors of hyper entropy almost reached 1000% (figure 5c). This is due to hyper entropy being calculated by the entropy and the variance of generated cloud drops. Both of them have larger randomness and uncertainty than the entropy calculated by the numerical value and expectation of the generated cloud drops, which results in a larger relative error for hyper entropy.  average absolute value of the relative error of entropy, AAVREHE is the average absolute value of the relative error of hyper entropy and AEHE is the average entropy divided by the hyper entropy. As presented in table 5, the average absolute value of the relative error of numerical characteristics gradually decreased as the number of samples increased. However, the average absolute value of the relative errors of entropy and hyper entropy was also very large, and the average for the absolute value of the relative error of hyper entropy still exceeded 100%. The entropy divided by the hyper entropy was 10 in the original cloud model, but it was approximately 5 when the numerical characteristics were calculated by the generated samples, and there was no significant change when the number of samples increased. In the future, studies should focus on how to reduce the error caused by the uncertainty transformation of the cloud model.

Quantitative analysis between the number of samples and the relative error of expectation
As seen from formula (2.14), the most influential factor with regard to the evaluation result is the expectation among the numerical characteristics of the cloud model. The quantitative analysis between the number of samples and the relative error of expectations is carried out in this section.
To obtain enough fitting data, let the expectation Ex = 1, entropy En = 0.2 and hyper entropy He = 0.02, and generate 35, 40, 45 and 50 samples as input values with the help of the forward cloud generator. Then, calculate the expectation of the cloud model using the backward cloud generator. Each simulation experiment was repeated 100 times, and finally, the relative error of expectations was calculated. The averages for the absolute value of the relative errors of expectations were 2.58%, 2.23%, 2.08% and 2.04%, respectively. The relationship between the average absolute values of the relative error of expectations and the number of samples is shown in figure 6.
As shown in figure 6, the average absolute value of the relative error of expectations gradually decreased as the number of samples increased, but it would not decrease to 0 or turn negative because the decreasing function regarded the y = 0 axis as the asymptotic line. Therefore, the regression formula using the exponential function is shown as follows: The coefficient of determination in the above equation is large at R 2 = 0.933, which shows that a reasonable fitting function was chosen.

Error analysis for the proportional numerical characteristics
The error statistics for different samples of the same numerical characteristics were analysed above.
Here, we focus on the error analysis for the proportional numerical characteristics. First, select five cloud models in which the numerical characteristics are proportional. Then, generate five samples as input values with the help of the forward cloud generator, and calculate the numerical characteristics using the backward cloud generator. Each simulation experiment was repeated 100 times, and finally, the relative error of the numerical characteristics was calculated. The error statistics for the proportional numerical characteristics are shown in table 6. As shown in table 6, when the numerical characteristics were proportional, the relative errors of the numerical characteristics showed no significant change.

Effect of uncertainty transformation of the cloud model on the evaluation result
As was analysed above, large errors are caused by the uncertainty transformation of the cloud model. Take five samples as an example. The relative errors of expectations, entropy and hyper entropy could reach ±20%, 100% and even 1000%, respectively, which were all caused by the uncertainty transformation of the cloud model. It can be seen that the greatest impact on the evaluation results is the expectation of the cloud model based on formula (2.14), while the entropy and hyper entropy do not directly impact the evaluation result. In addition, the relative errors of entropy and hyper entropy were large, and it is not easy to grasp their impacts on the evaluation results. To specifically investigate the uncertainty transformation of the cloud model on the evaluation result, the hypothesis is that the entropy and hyper entropy are unchanged and just take the error of expectations caused by the uncertainty transformation into account. The comprehensive cloud model of this petrochemical enterprise was C (3.161, 0.291, 0.216), and changed the expectation on the basis of the relative error by +20% and −20%, respectively. Therefore, the worst situation of cloud model may be C min (2.634, 0.291, 0.216), and the best situation may be C max (3.951, 0.291, 0.216). The effect of the uncertainty transformation of the cloud model on the evaluation result is shown in figure 7.
As shown in figure 7, the worst safety situation of this petrochemical enterprise was between Relatively dangerous and Generally safe, and it is preferred to Generally safe. When the comprehensive cloud model was C min (2.634, 0.291, 0.216), the similarity could be achieved based on formula (2.14). The  results were λ 3 = 0.068 and λ 4 = 0.009, and the others were 0. Therefore, the worst evaluation result was Generally safe based on the maximum membership principle. The middle safety situation was between Generally safe and Relatively safe, and it is preferred to Generally safe. The middle safety situation was Generally safe by calculating the similarity based on the maximum membership principle.
The best safety situation was between Generally safe and Relatively safe, and it is preferred to Relatively safe. When the comprehensive cloud model was C max (3.951, 0.291, 0.216), the similarity could be achieved based on formula (2.14). The results were λ 1 = 0.040 and λ 2 = 0.747, and the others were 0. Therefore, the best evaluation result was Relatively safe based on the maximum membership principle.
It can be seen from the above analysis that if considering the effect of the uncertainty transformation of the cloud model, the evaluation result may be different and skip from one level to another level.
Future studies should focus on how to reduce the effects of the uncertainty transformation of the cloud model on the evaluation result or propose a forward new algorithm for uncertainty transformation.

PHA-LOPA of dangerous indicator
Based on the above analysis of the cloud model, the evaluation result of the petrochemical enterprise was likely to be Generally safe, and the best evaluation result was Relatively safe. Therefore, accidents were probable in the petrochemical enterprise. Moreover, the shock and noise indicator was Dangerous. Therefore, accidents in the petrochemical enterprise may be caused by the shock and noise indicator, and this indicator belongs to risk level 3 based on table 1. For this reason, the shock and noise indicator was chosen as the event scenario and analysed with PHA-LOPA, as presented in  Figure 8. Bow-tie analysis of shock and noise; the causes and consequences were identified and corresponding safety measures were adopted to prevent accidents.

Bow-tie analysis of shock and noise
After PHA-LOPA on the shock and noise indicator and adopting two independent protection layers, although the risk level descended from 3 to 2, it was still necessary to continue to add to the accident prevention. We adopted the shock and noise indicator as the event scenario, made a detailed analysis with the bow-tie model, identified the causes of the event scenario and the corresponding consequences, and adopted safety measures to prevent the event scenario, as shown in figure 8.
Four causes that can lead to shock and noise are on the left of the bow tie, which belongs to the fault tree analysis. Five consequences that are caused by shock and noise are on the right of the bow tie, which belongs to the event tree analysis. To prevent the occurrence of shock and noise, nine preventive safety measures were set on the left. To mitigate accidents' consequences caused by shock and noise, 13 mitigative safety measures were set on the right. Therefore, the risk level of accidents' consequences caused by shock and noise can be further reduced by means of bow-tie analysis.

Brief summary of discussion
The present results confirmed that the composite safety assessment model proposed in this paper can be successfully applied to the evaluation of petrochemical enterprises, in which the safety of the petrochemical enterprises and its relevant indicators can be first obtained based on the cloud model. safety situations were achieved. Third, to ensure the safe production of the petrochemical enterprise, the identified critical indicators can be weakened and prevented by corresponding safety measures based on PHA-LOPA and the bow-tie model, respectively.
Motivated by the previous studies of the cloud model [15][16][17], PHA-LOPA [31][32][33] and the bow-tie model [35][36][37][38], these three methods were used for the safety assessment of petrochemical enterprises for the first time. Different from the frequently used quantitative safety assessment methods such as the fuzzy evaluation method [6][7][8], grey system theory [9][10][11], set pair analysis [12][13][14] and neural networks [18][19][20], the cloud model uses an uncertainty transformation that contains fuzziness and randomness, which is suitable for petrochemical enterprises. Therefore, the cloud model is introduced in this field. In previous studies of the cloud model [15][16][17], there is little quantitative research about the effects of uncertainty transformations on the evaluation results, especially for few samples and small values, and this quantitative effect was further studied in this paper. Owing to the uncertainty transformation, relative errors of expectations fell in the interval [−20%, 20%], but entropy and hyper entropy reached 100% and 1000%, respectively. The relative error of numerical characteristics gradually decreased as the number of samples increased, but the entropy divided by the hyper entropy remained basically unchanged. When the numerical characteristics were proportional, the relative error of numerical characteristics showed no significant change. By taking the effects of the uncertainty transformation of the cloud model into consideration, the evaluation result may be different and skip from one level to another level. We imitated previous studies of PHA-LOPA [31][32][33] and the bow-tie model [35][36][37][38] that were applied in risk analysis. After adopting two independent protection layers, the risk level of shock and noise decreased from 3 to 2. Then, shock and noise was taken as a critical indicator for the bowtie analysis, thus identifying the causes and consequences and taking corresponding safety measures to prevent accidents. The composite safety assessment model can be applied to the risk analysis of other related industries.
To simplify the discussion, there is not enough research on how to reduce the effects of uncertainty transformations. Future studies should focus on how to reduce the effects of uncertainty transformations in the cloud model on the evaluation results or propose a new algorithm for uncertainty transformation.

Conclusion
A composite safety assessment model of petrochemical enterprises based on the cloud model, PHA-LOPA and the bow-tie model was proposed, and the main conclusions are as follows.
First, the petrochemical enterprise and its relevant indicators were evaluated based on the cloud model. The indicators that were evaluated as Safe include X 2 , X 10 , X 15 , X 16 , X 21 and X 25 ; Relatively safe include X 1 , X 9 , X 14 and X 18 ; Generally safe include X 3 , X 5 , X 7 , X 13 , X 17 , X 22 and X 24 ; Relatively dangerous included X 6 , X 8 , X 11 and X 20 ; and Dangerous include X 4 , X 12 , X 19 and X 23 . Overall, the petrochemical enterprise was evaluated as Generally safe.
Second, the quantitative effect of uncertainty transformation on the evaluation result of the cloud model was analysed. The relative errors of expectations fell in the interval [−20%, 20%], but entropy and hyper entropy reached 100% and 1000%, respectively. The relative error of numerical characteristics gradually decreased as the number of samples increased, but the value of entropy divided by hyper entropy remained almost the same. The functional relationship between the average absolute values of the relative errors of expectations and the number of samples was achieved. Then, the numerical characteristics were proportional, and the relative error of numerical characteristics showed no significant change. By taking the effects of the uncertainty transformation of the cloud model into consideration, the evaluation result may be different and skip from one level to another level.
Third, the risks of shock and noise can be weakened and prevented by corresponding safety measures based on PHA-LOPA and the bow-tie model. After adopting two independent protection layers, the risk level decreased from 3 to 2. Then, shock and noise were analysed in depth with the bow-tie model, which identified causes and consequences and led to the adoption of corresponding safety measures to prevent accidents.
Data accessibility. The code supporting this paper has been uploaded as the electronic supplementary material. Authors' contributions. K.X. guided the writing process. Q.X., L.L. and X.Y. conducted the data analysis, and Q.X. wrote the paper. All the authors gave their final approval for publication.
Competing interests. We declare we have no competing interests. Funding. This study was supported by the National Key Research and Development Program of China (2017YFC0805100).