Establishing an onshore pipeline incident database to support operational risk management in Brazil - Part 2: Bowtie proposition and statistics of failure