LY2021046-TEMBA Final Document

学校代号 10532 学号 LY2021046
分类号 16 密级普通
Dissertation of Master Degree
Risk Assessment of Petroleum Pipeline: Mtwara- Dar es

Salaam Natural Gas Transmission Pipeline, Tanzania
Candidate Name: Hassan Temba

Department/School: College of Mechanical and Vehicle Engineering
Supervisor Name: Dr. Maojun Li
Subject Major: Industrial Engineering
Research Field: Risk Assessment
Date of Submission: May, 2023
Risk Assessment of Petroleum Pipeline: Mtwara- Dar Es Salaam
Natural Gas Transmission Pipeline, Tanzania
By
Hassan Temba
B.Sc. in Industrial Engineering and Management (University of Dar es salaam) 2011
A thesis submitted in partial satisfaction of the requirements
for the degree of Master of Engineering
in
Industrial Engineering
in
the Graduate school
of
Hunan University
Supervisor
Dr. Maojun Li
May 2023
Hunan University
Originality of statement of the dissertation
I solemnly declare that the thesis I submitted is independent research results obtained
under the guidance of my supervisor. In addition to the contents specially quoted in the text,
this thesis does not contain any other works that have been published or written by individuals
or collectives. The individuals and collectives that have made important contributions to this
study have been clearly identified in the text. I am fully aware that the legal consequences of
this statement are borne by me.
Author's signature： Date：
Authorization for the use of copyrights in academic dissertations
Author’s signature: Date:
Supervisor’s signature: Date:

Thesis of Master degree
Abstract
In terms of primary energy use, oil and natural gas account for 57.5% of the total. Pipelines
connect oil and natural gas producing regions to refineries, chemical plants, residential and
commercial customers, and business needs. Pipelines are a vital component of the
transportation infrastructure for oil and natural gas. Oil and natural gas, on the other hand, are
combustible and explosive substances that are typically transported through pipeline networks
under high-temperature, high-pressure circumstances. As a result, major incidents like fire,
explosion, and toxic release are likely to happen at oil and gas pipelines, causing fatalities,
financial losses, and environmental issues. This decreases the sustainability of pipeline
transportation.
In order to evaluate the dangers and risks at their facilities around the world, the oil and
gas sectors frequently utilize risk assessment. There can be severe repercussions in the event
of an accident. The author proposes the use of an updated bow-tie model to examine the hazards
of Tanzania natural gas pipeline network operated by GASCO in order to better understand the
causes and effects of accidents involving gas pipeline networks and to develop mitigation and
prevention strategies. The improved bow-tie model examines accident causes from four
perspectives: human, material, environmental, and management. It also examines accident
consequences from four perspectives: casualty, property loss, environmental degradation, and
society. Next, it puts the causes and effects into numerical form.
In the model, risk identification, risk analysis, risk assessment, risk control, and risk
management will all be clearly displayed. Then, it can recommend preventative and mitigating
actions in accordance with the accident rate of the gas pipeline network. The outcomes
demonstrate that utilizing the bow-tie model, the entire accident process may be visually
analyzed. Also, it can explain why a bad thing happened and foretell its effects. The analysis
of gas pipeline network leakage failure depends heavily on it.
Keywords: Gas pipelines; Bow-tie model; Risk analysis; Mitigation measures
I
摘要
在能源使用方面，石油和天然气占总消费量的 57.5％。石油和天然气的产区和炼
油厂、化工厂、住宅和商业客户以及业务需求的运送主要靠管道运输。管道是石油和
天然气运输基础设施的重要组成部分。然而，石油和天然气是易燃易爆的物质，通常
在高温高压条件下通过管道网络进行输送。因此，油气管道可能发生火灾、爆炸和有
毒物质泄漏等重大事故，造成人员伤亡、财务损失和环境问题，从而降低管道运输的
可持续性
为了评估全球各地的设施存在的危险和风险，石油和天然气行业经常使用风险评
估。一旦发生事故，可能会造成严重后果。作者建议使用更新的蝴蝶结模型，以研究
由 GASCO 运营的坦桑尼亚天然气管道网络的危险性，以更好地了解涉及天然气管道
网络的事故的原因和影响，并制定减轻和预防策略。改进后的蝴蝶结模型从人员、物
质、环境和管理四个角度考虑事故原因，并从人员伤亡、财产损失、环境恶化和社会
影响四个角度考虑事故后果。接下来，它将原因和结果转化为数字形式。在该模型中，
风险识别、风险分析、风险评估、风险控制和风险管理都将清晰显示。然后，根据天
然气管道网络的事故率，它可以推荐预防和缓解措施。结果表明，利用蝴蝶结模型，
整个事故过程可以进行视觉分析。此外，它还可以解释为什么会发生不好的事情并预
测其影响，对于燃气管网泄漏故障的分析具有重要意义。
关键词：天然气管道; 领结模型; 风险分析; 缓解措施
II
Risk Assessment of Petroleum Pipeline: Mtwara-Dar es Salaam Natural Gas Transmission Pipeline, Tanzania
CONTENTS
Abstract ................................................................................................................................ I
摘要 ............................................................................................................................... II
CONTENTS...................................................................................................................... III
List of Figures .................................................................................................................... V
List of Tables .................................................................................................................... VI
Table of Major Symbols and Units ................................................................................. VII
Definitions and Acronyms ............................................................................................. VIII
Chapter One: Research Background and Risk Statement ................................................. 12
1.1 Background .......................................................................................................... 12
1.2 Tanzania Natural Gas Pipeline Overview............................................................ 15
1.3 Problem Statement ............................................................................................... 19
1.4 Research Objectives............................................................................................. 20
1.4.1 Main Objective .......................................................................................... 20
1.4.2 Specific Objectives .................................................................................... 20
1.5 Purpose of the study............................................................................................. 20
1.6 Research Content ................................................................................................. 20
1.7 Layout of the Paper .............................................................................................. 21
Chapter Two: Literature Review ...................................................................................... 22
2.1 Pipeline System ................................................................................................... 22
2.2 Risk Concept ........................................................................................................ 24
2.3 Pipeline Risk Management .................................................................................. 26
2.3.1 Risk Identification ..................................................................................... 27
2.3.2 Risk Analysis ............................................................................................. 29
2.3.3 Pipeline Risk Analysis Models .................................................................. 31
Chapter Three: Research Methodology ............................................................................ 51
3.1 Introduction.......................................................................................................... 51
3.2 The Data Sources ................................................................................................. 51
3.3 Risk Assessment Methodology Structure ............................................................ 52
Chapter Four: Result and Discussion................................................................................ 53
4.1 Introduction.......................................................................................................... 53
4.2 Development of Bow-tie model for Tanzania Natural Gas Pipeline Network
Failure .............................................................................................................................. 53
4.3 Quantitative Analysis of Bow-Tie Model on Tanzania Natural Gas Pipeline
Failure. ............................................................................................................................. 61
4.3.1 Pipeline gas leak analysis for small scale leak scenario. ........................... 62
4.3.2 Pipeline gas leak analysis for large scale leak scenario. ............................ 64
4.3.3 Gas Leakage Analysis of Gas Pipeline Rupture Scenario ......................... 66
4.4 Gas Leakage Risk Evaluation. ............................................................................. 68
III
4.5. Gas Leakage Risk Control .................................................................................. 68

4.5.1 Risk control for small scale pipeline gas leak scenario ............................. 69
4.5.2 Risk control for gas pipeline large scale leak scenario .............................. 71
4.5.3 Risk control for gas pipeline rupture scenario ........................................... 73
Chapter Five: Conclusion and Recommendations ............................................................ 76
5.1 Conclusion ........................................................................................................... 76
5.2 Recommendations................................................................................................ 77
References ......................................................................................................................... 78
Acknowledgement ............................................................................................................ 83
IV
List of Figures
Figure 1. 1 NG from wellhead to consumption [15]. ................................................................. 13
Figure 1. 2 Gas pipeline transportation system from production to consumption [12]. ............ 14
Figure 1. 3 Physical features of Tanzania [75]. ......................................................................... 15
Figure 1. 4 Mnazi Bay Processing plant [62]. ........................................................................... 17
Figure 1. 5 Songo Songo Natural Gas Processing Plant operated by TPDC [62] ..................... 17
Figure 1. 6 Dar es Salaam Kinyerezi Pipeline Natural Gas Receiving Station [62] .................. 18
Figure 1. 7 Tanzania Natural Gas Pipeline layout ................................................................... 18
Figure 1. 8 Tanzania Natural Gas Pipeline construction, 2014 [62] .......................................... 18
Figure 1. 9 Fire outbreak after a leak from a natural gas pipeline at Buguruni, Tanzania on
January 9, 2018 ........................................................................................................................ 19
Figure 1. 10 Fire outbreak after a leak from a natural gas pipeline at Buguruni ..................... 19
Figure 2. 1 Schematic view of pipeline system (Board, Transportation Research, 2004) [11] . 22
Figure 2. 2 Trans- Alaska Pipeline [29] ..................................................................................... 23
Figure 2. 3 Typical risk distribution of equipment [6] .............................................................. 25
Figure 2. 4 Pipeline risk management [38] ................................................................................ 26
Figure 2. 5 A Bow-tie Model diagram ..................................................................................... 33
Figure 2. 6 Improved bow-tie model diagram ......................................................................... 34
Figure 2. 7 Tree diagram for leakage incident of gas pipeline [65] ........................................... 35
Figure 2. 8 Simplified Example Fault Tree Model for Excavator to Hit Pipelin..................... 43
Figure 2. 9 Gas pipeline leakage consequence event tree ........................................................ 45
Figure 2. 10 Relative Risk Model Consequence Score............................................................ 47
Figure 2. 11 Example Threat Matrix for a Gas Facility Risk Assessment .............................. 49
Figure 3. 1 Risk Assessment methodology of Tanzania natural gas pipeline ......................... 52
Figure 4. 1 Tree diagram for Tanzania natural gas pipeline leakage incident ......................... 56
Figure 4. 2 Primary pipeline failure frequencies per cause from 1970-2019 .......................... 59
Figure 4. 3 Improved Bow-tie Model for risk analysis of natural gas pipeline failure........... 60
Figure 4. 4 Event tree diagram for small scale leak scenario .................................................. 62
Figure 4. 5 Event tree diagram for the large-scale gas leak situation ...................................... 64
Figure 4. 6 Event tree diagram for the gas pipeline rupture scenario ...................................... 66
Figure 4. 7 Event tree diagram for small scale gas leak scenario with gas detection and
firefighting systems .................................................................................................................. 69
Figure 4. 8 Event tree diagram for the large scale gas leak scenario with gas detection and
firefighting systems .................................................................................................................. 71
Figure 4. 9 Event tree diagram for the gas pipeline rupture incident after the application of
control measures ...................................................................................................................... 73
V
List of Tables
Table 2. 1 Facts on some well-known pipelines [11]................................................................. 23
Table 2. 2 Critical Pipeline risk factors from the reviewed literatures .................................... 28
Table 2. 3 Main categories of risk analysis methods ............................................................... 30
Table 2. 4 Urban gas pipeline network leakage accident tree symbol representative event. ... 36
Table 2. 5 Example of Qualitative Model ................................................................................ 38
Table 2. 6 Qualitative Risk Scale ............................................................................................. 38
Table 2. 7 A risk index algorithm ............................................................................................ 40
Table 2. 8 Urban gas pipeline network leakage incident tree event [65] ................................... 46
Table 2. 9 Example Threats and Failure Causes for a Gas Facility Risk Assessment ............. 50
Table 4. 1 Tanzania gas pipeline network leakage accident tree symbol representative event. ...... 54
Table 4. 2 Primary failure frequencies per cause [78] ............................................................... 58
Table 4. 3 Outcome risk probability values for small scale leak scenario ............................... 63
Table 4. 4 Outcome risk probability values of the large-scale gas leakage situation .............. 65
Table 4. 5 Outcome risk probabilities of the gas pipeline rupture scenario ............................ 67
Table 4. 6 Risk level probabilities category............................................................................. 68
Table 4. 7 Outcome risk probabilities of the small scale gas leak scenario after application of
mitigation measures ................................................................................................................. 70
Table 4. 8 Outcome risk probabilities of the large scale gas leak scenario after application of
Table 4. 9 Outcome risk probabilities for gas pipeline rupture scenario after application of
Table 4. 10 Probability values for all unsafe outcomes of each scenario ................................ 75
Table 4. 11 Highest risk levels for all three scenarios after risk control ................................. 75
VI
Table of Major Symbols and Units

Symbol Name of Measure Unit Symbol
P Probability -
d Pipeline diameter Inch/cm
p Pipeline operating pressure Bar/MPA
f Pipeline failure frequency No. of Failures/year
VII
Definitions and Acronyms

Definitions
Term Definition Source
Terms Related to Defining Risk
Consequence Impact that a pipeline failure could have on the public, B31.8S-2004, ISO
employees, property, the environment, or organizational 31000:2009
objectives
Frequency Number of events or outcomes per defined unit of time. SO 31000:2009
Frequency can be applied to past events or to potential
future events, where it can be used as a measure of
likelihood/probability.
Hazard Source of potential harm or potential consequences. Muhlbauer, 2004 ISO
Guide 73-2009
Likelihood The chance of something happening, whether defined, SO 31000:2009
measured, or determined objectively or subjectively,
qualitatively or quantitatively, and described using
general terms or mathematically (such as a probability or
frequency over a given time period).
Probability (1) Likelihood, or (2) Measure of the chance of (1) numerous sources
occurrence expressed as a number between 0 and 1, use the terms
where 0 is impossibility and 1 is absolute certainty. likelihood and
probability
interchangeably (2)
ISO 31000:2009
Risk Measure of potential loss in terms of both the likelihood B31.8S-2004 CSA
or frequency of occurrence of an event and the Z662
magnitude of the consequences from the event. [Note: In
practice, “likelihood,” “probability,” and “frequency”
are often used interchangeably. In each risk modeling
approach, the associated units (e.g., events/year) for
each variable must be carefully assigned/verified in
order to assure proper usage.]
Terms Related to Defining Risk Assessment and Risk Assessment Models
Risk analysis Process of using available information to comprehend ISO 31000:2009
the nature of risk and estimate the level of risk.
Risk assessment Systematic process in which hazards from pipeline ASME B31.8S-2004
operation are identified and the probability and
VIII
consequences of potential adverse events are analyzed

and estimated
Risk assessment A set of algorithms or rules that use available Muhlbauer, 2004
model (Risk Model) information and data relationships to perform risk
assessment. A model is a simplified representation of a
pipeline system and represents the relation of important
risk factors.
Risk management Overall program consisting of identifying potential B31.8S-2004
threats to a pipeline; assessing the risk associated with
those threats in terms of incident likelihood and
consequences; mitigating risk by reducing the
likelihood, the consequences, or both; and measuring
the risk reduction results achieved.
Other Terms
Threat Scoring rules or algorithms that define how a risk B31.8S-2004
Potential cause of failure; failure mechanism. Muhlbauer, 2015
Facility Portions of a pipeline system other than line pipe: 49 CFR Part 192.3 49
includes compressor units, metering stations, regulator CFR Part 195.2
stations, delivery stations, holders, fabricated
assemblies, and underground storage facilities (gas);
and pumping units, fabricated assemblies associated
with pumping units, metering and delivery stations and
fabricated assemblies therein, breakout tanks, and
underground storage facilities (liquid).
Failure (1) A part in service has become completely B31.8S-2004
inoperable; is still operable but is incapable of Muhlbauer, 2004
satisfactorily performing its intended function; or has Muhlbauer, 2015
deteriorated seriously, to the point that is has become
unreliable or unsafe for continued use.
(2) A structure is subjected to stresses beyond its
capabilities, resulting in its structural integrity being
compromised.
(3) Unintentional release of pipeline contents, loss of
integrity, leak, or rupture.
Gas pipeline All parts of those physical facilities through which gas 49 CFR Part 192.3
moves in transportation, including pipe, valves, and
other appurtenance attached to pipe, compressor units,
metering stations, regulator stations, delivery stations,
IX
holders, and fabricated assemblies.

Hazardous liquid All parts of a pipeline facility through which a 49 CFR Part 195.2
pipeline hazardous liquid or carbon dioxide moves in
transportation, including, but not limited to, line pipe,
valves and other appurtenances connected to line pipe,
pumping units, fabricated assemblies associated with
pumping units, metering and delivery stations and
fabricated assemblies therein, and breakout tanks.
Line pipe Cylindrical linear “mileage” portions of a pipeline 49 CFR Part 195.2
system that transport commodities from one point to
another; i.e., the part of a pipeline system outside of
any facilities.
Risk index Unit-less measure of risk derived from input ISO/IEC-31010-2009 –
information using ordinal scales. Risk management –
Risk assessment
techniques
Term Definition
TPDC Tanzania Petroleum Development Corporation
GASCO Gas Company (Tanzania) Limited
CD Construction damage
CFR Code of Federal Regulations
CIS Close interval survey
CON Construction
CP Cathodic protection
DCVG Direct current voltage gradient
DEM Digital elevation model
SCADA Supervisory control and data acquisition
DP Defective pipe
DPS Defective pipe seam
EC External corrosion
EM Earth movement
ESD Emergency shut-down
EQ Equipment
GF gasket failure
HCA High consequence area
HRF HRF
X
HVL HVL
HRF HRF
TP Third party
TPD Third party damage

IC Internal corrosion
IM Integrity management
IO Incorrect operations
ISO International Organization for Standardization
IEC International Electro-technical Commission
MAOP MAOP maximum allowable operating pressure
MCRE Malfunction of control or relief equipment
MFR Manufacturing
MOP Maximum operating pressure
P&ID Piping and instrument drawing
PDP Previously damaged pipe
PHMSA Pipeline and Hazardous Materials Safety
Administration
PODS Pipeline Open Data Standard
MDS Material data sheet
NG Natural gas
XI
Chapter One: Research Background and Risk Statement

This chapter focuses on the study background, Tanzania pipeline overview, problem statement,
research objectives, purpose of the study, research content and layout of the study.
Background
Oil and natural gas are the most used energies in the world, contributing to 57.5% global
primary energy consumption [1]. Pipelines are critical infrastructure for the transportation of oil
and natural gas, connecting producing areas to refineries, chemical plants, home consumers
and business needs [2]. In the United States, there are more than 190,000 miles of liquid
petroleum pipelines and over 2.4 million miles of natural gas pipelines (including the
distribution lines that serve homes, offices and businesses). This constitutes the largest pipeline
network in the world [3].
However, oil and natural gas are flammable and explosive substances, usually delivered
in high-temperature high-pressure conditions via pipeline networks. As a result, major [4,5,6]
such as fire, explosion, and toxic release are likely to occur at oil and gas pipelines, resulting
in casualties, economic losses, and environmental problems, thus reducing the sustainability of
pipeline transportation. On November 22, 2013, a series of explosions and fires occurred in
Qingdao, China, resulting in 62 fatalities, 136 injuries, 8000 people evacuated, and damages to
nearby buildings and vehicles. The explosions occurred in a drain when the vaporized crude
oil from a pipeline leak was ignited by a leak repair operation [7]. Besides, oil and gas pipelines
may be damaged by natural hazards such as earthquakes, floods, and lightning, resulting in
potential adverse secondary consequences to the population, the environment, or the industrial
activity itself. These events are commonly referred to as Natech events, responsible for
approximately 5% of major industrial accidents [8,9].
The risk assessment of a petroleum pipeline includes evaluating the potential risks and
hazards associated with its construction, operation, and maintenance. This includes analyzing
the potential for accidents and spills, the impact on the environment and surrounding
communities, and the likelihood of natural disasters or other external events affecting the
pipeline.
In terms of construction, potential risks include failure of equipment and machinery,
unsafe working conditions, and potential damage to the pipeline during the installation process.
During operation, risks may include leaks or ruptures due to corrosion or other factors, as well
as the potential for fires or explosions. In terms of maintenance, risks may include inadequate
inspection and maintenance procedures, leading to potential failure or malfunction of the
pipeline [10].
Although gas piping systems are mostly installed underground, they are often damaged
by various activities. The leakage of natural gas can lead to different scenarios and outcomes.
12
The most common consequences of natural gas pipeline accidents are fire, explosion, fatality,
environmental damage and financial loss.
Depending on where they are in a transportation system all natural gas pipelines are either:
(Figure 1 and 2).
(1) Transmission pipelines — the large lines (typically 6-48 inches in diameter) that move gas
long distances around the country, often at high pressures (typically 200 – 1500 psi);
(2) Distribution pipelines — are a system of mains and service lines that deliver natural gas to
our individual homes and businesses. They operate at a relatively low pressure (e.g. 30 psi);
(3) Gathering pipelines — transporting gas away from the point of production (well pad) to
another facility for further refinement or to transmission pipelines;
(4) Production Lines — the pipes and equipment, normally near the wellhead, used to produce
and prepare the gas for transport [11].
Natural gas pipelines failures are potentially hazardous events especially in urban areas
and near roads. Therefore, people around the pipeline routes are subject to significant risk from
pipeline failure. The hazard distance associated with the pipeline ranges from under 20 m for
a smaller pipeline at lower pressure, up to over 300 m for a larger one at higher pressure [12].
Figure 1. 1 NG from wellhead to consumption [14].
13
Figure 1. 2 Gas pipeline transportation system from production to consumption [11].
Pipelines are the safest and most cost effective means to transport natural gas, petroleum
and refined products in the large volumes and long distances that are required nowadays.
Although rare losses of restraint in pipelines do occur and can be the outset of an accident of
severe consequences. Mostly, major environmental damage, destruction of properties and
several casualties take place. Risk assessment is identified as a very valuable tool to improve
safety in pipeline operation. The use of risk assessment enables pipeline operators to rationally
manage inspection and preventive maintenance and is paramount in allocating prevention
resources [13].
Cross-country petroleum pipeline mode for transportation of bulk petroleum product has
already been identified and approved as the most energy efficient, safe and environment
friendly and economic mode of transporting hydrocarbon (gas, crude oil and finished product)
over long distances within the geographical boundary of a country and beyond. A stage has
now been reached when a significant part of a nation’s energy requirement is transported
through pipelines. The economy of a country is heavily dependent on smooth and uninterrupted
operation of these lines [12].
Long-distance pipelines mainly suffer from mechanical, operational and natural hazards [15],
design flaws, misuse, corrosion damage and Third-Party Disruption (TPD) [12]. Muhlbauer [16]
defines TPD as any individual or group action that obstructs the functionality of the
infrastructures’ systems in any direct or indirect manner. Peng et al. [17] add any action that
accidentally damages Pipelines, such as human error, natural phenomena, soil movement (e.g.
foundation collapse, landslides, floods, and mudflows), and surface loads as a result of
improper building, blast construction and overweight ground loads that compress pipelines. In
this paper. Third-party damage (TPD) refers to any accidental damage done to the pipeline
because of activities done by individual or group of people not associated with the pipeline
(non-operator). Currently, TPD is more likely to happen in developing countries compared to
developed countries due to number of reasons, like lack of awareness of the individuals, poor
14
safety measures and political instability. But the TPD degrees of impact varies from minor to
catastrophe and disastrous consequence, in safety, asset loss, and environmental aspect. TPD
is the leading cause of oil and gas pipeline failure [18].
Tanzania Natural Gas Pipeline Overview

Tanzania is the largest country in East Africa and includes the islands of Zanzibar, Pemba
and Mafia. About twice the size of California, Tanzania is bordered by Indian Ocean and eight
counties: Kenya, Uganda, Rwanda, Burundi, Democratic Republic of Congo, Zambia, Malawi
and Mozambique. Mount Kilimanjaro, once an active volcano, is the highest point in Africa
and is bordered by three largest lakes on the continent: Lake Victoria (the world’s second
largest freshwater lake) in the north, Lake Tanganyika in the west and Lake Nyasa in the
southwest.
Figure 1. 3 Physical features of Tanzania [74].

Tanzania is estimated to have 45 billion m³of natural gas reserves that are in use currently,
enough to cover the country’s domestic use and make Tanzania the next natural gas hub in
Africa. Also, there are discoveries made in the deep offshore basin between 2010 to 2015 from
bloc 1, 2 and 4b 4 amounting to 47.13 trillion cubic feet of natural gas. Tanzania Petroleum
15
Development Corporation (TPDC) is the National Oil Company of Tanzania, wholly owned
by the Government of Tanzania. The Petroleum Act, 2015 has given the TPDC mandate to
undertake Tanzania’s commercial aspects of petroleum operations in the upstream, midstream
and downstream and participating interests of the Government in the petroleum and natural gas
agreements. TPDC has exclusive rights over the natural gas midstream and downstream value
chain. Further, it can authorize any other person to undertake regulated activities, particularly
those to which TPDC has exclusive rights.
For effective carrying out specific petroleum operations as stated in the Petroleum Act
2015, TPDC formed two subsidiary companies; Gas Supply Company Limited (GASCO),
responsible for operations and maintenance of the National Natural Gas Infrastructure (NNGI)
and TANOIL Investments Limited, which undertake oil trading business [62].
Natural gas deposits in Tanzania are found at Songo Songo in Lindi region, Mnazi bay in
Mtwara Region and Mkuranga in Coast Region. The reserves at Songo Songo and Mnazi bay
are estimated at 30 and 15 billion m³respectively. A 232 km gas pipeline from Songo Songo
Island to Dar es salaam has been constructed and is supplying natural gas for power generation
and other industrial thermal processes.
There are nine thermal power plants in Tanzania converting natural gas to electricity:
Ubungo I and II, Tegeta, Songas, Mtwara, Somanga, Kinyerezi I and II, and Dangote. Total
production per year stands at approximately 650 MW (About 60% of total power generated by
the country comes from natural gas). The Songas Project is currently producing around 200
MW of electricity using natural gas.
Some of the Dar es Salaam based industries using Natural Gas for thermal applications
include Cement factories, Textiles, Breweries, Glass and Aluminum industry among others
(Tanzania-Country Commercial Guides, 2021).
Tanzania Mnazi Bay and Songo Songo Natural Gas Processing Plants and Transportation
Pipeline Project Pipeline Section consist of the trunk line from Songo Songo and Mtwara to
Dar es Salaam and a branch line from Dar es Salaam to Tegeta. The gas from two resources
(one is Songo Songo, the other is Mtwara (Mnazi Bay)) joins up at Somanga and then be
transmitted to Dar es Salaam and Tegeta. The offshore pipeline from Songo Songo to Somanga
will be 24”, API 5L PSL2 X65, and the length is about 29km. The onshore pipeline from
Mtwara via Somanga to Dar es Salaam will be 36”, API 5L PSL2 X70, and the length is about
286km and 191km respectively. The branch line from Dar es Salaam to Tegeta, which is 16”,
API 5L PSL2 X70, and the length is about 27.5km. The design pressure of the pipeline is
9.7MPa and the design transmission capability is 784mmscfd in recent stage and 1002 mmscfd
in future stage. Two initial stations (Songo, Mtwara), one junction station (Somanga), one
terminal station (Dar es Salaam), one branch terminal station (Tegeta) and 16 block valve
stations will be provided along the gas pipeline route. The pipeline route passes through
Mtwara, Lindi, Pwani and Dar es Salaam region. The route runs in the seismic area of. Ⅵ
Degree (The peak ground acceleration is 0.8m/s2), The total length of the route is
approximately 533.5km.
16
Figure 1. 4 Mnazi Bay Processing plant [61].
Figure 1. 5 Songo Songo Natural Gas Processing Plant operated by TPDC [61]
17
Figure 1. 6 Dar es Salaam Kinyerezi Pipeline Natural Gas Receiving Station [61]
Figure 1. 7 Tanzania Natural Gas Pipeline layout
Figure 1. 8 Tanzania Natural Gas Pipeline construction, 2014 [61]
18
Problem Statement
The increasing demand for energy supply in Tanzania has led to the expansion of gas
pipelines projects, but these gas pipelines also pose risks to the environment and communities
affected by them. This study seeks to perform comprehensive risk assessment by identifying
and evaluate potential hazards and develop appropriate controls and contingency plans to
mitigate those risks. The following are the examples of risk impacts occurred in Tanzania gas
pipelines;
Figure 1. 9 Fire outbreak after a leak from a natural gas pipeline at Buguruni, Tanzania on
January 9, 2018
Figure 1. 10 Pipeline washout and FOC cut after heavy rainfall at Kimara Baruti Dar es
Salaam, Tanzania on March 26, 2018.
19
Research Objectives
Main Objective
The main objective of this thesis is to conduct a comprehensive risk assessment of the
Mtwara to Dar es Salaam natural gas transmission pipeline in Tanzania. The study aims to
evaluate and analyze the potential risks associated with the pipeline's operation and propose
effective risk mitigation strategies to ensure safe and reliable transportation of petroleum
products.
Specific Objectives
This objective entails developing a robust risk management framework specifically
tailored to the Mtwara to Dar es Salaam natural gas transmission pipeline. The framework will
incorporate the identified risks, their likelihood, and potential consequences. It will also
propose risk mitigation strategies and controls that are aligned with the unique characteristics
and operational context.
i. To enable predict/identify the greatest risk factors on Tanzania natural gas pipeline.
This refers to evaluate risks of the pipeline, including mechanical failures, corrosion,
and integrity issues, with a focus on identifying vulnerable sections or components
that may pose threats to the pipeline's overall reliability and threats to the safety of the
pipeline.
ii. To analyze the effect of risk factors identified on Tanzania natural gas pipeline;
iii. To develop a comprehensive risk management framework for the Mtwara to Dar es
Salaam natural gas transmission pipeline, incorporating the identified risks, their
likelihood, and potential consequences, and proposing risk mitigation strategies
tailored to the specific characteristics of the pipeline.
Purpose of the study

The purpose of conducting a risk assessment on a natural gas pipeline is to ensure the
safety and integrity of the pipeline, prevent accidents and incidents, and protect the
environment and communities affected by the pipeline in Tanzania. It also helps to improve
the industry's (TPDC) reputation and avoid negative public perception and legal challenges.
Research Content
To address the existing challenges of developing the risk analysis framework for Tanzania
natural gas transmission pipeline, two questions have been prepared to help perform a study on
critical risk elements of pipeline failures in Tanzania. These questions are:
i. What elements contribute to the failure of natural gas pipelines in Tanzania?
ii. What is the best safety method to reduce risks of natural gas pipelines and to achieve
safety and pipeline integrity?
20
Layout of the Paper

It is organized in four chapters as follows;
Chapter one focuses on the study background, Tanzania pipeline overview, problem
statement, research objectives, purpose of the study, research content and layout of the study.
Chapter two focuses on literature review of the academia on the pipeline systems, risk,
pipeline risk and pipeline risk management, review on pipeline risk factors, risk analysis and
risk models used to analyze identified pipeline risk factors.
Chapter four is the research methodology which focuses on the data sources used for the
analysis of the case study company and shows the design methodology structure.
Chapters four focuses on the result and discussions of study. In the study Bow-tie Risk
Model were used for the risks assessment of Tanzania natural gas pipeline and evaluation.
Control Measures are established to minimize the failure mode consequences to the people and
environment.
Chapter five presents the summary and conclusions of this thesis, and recommendations
for future study.
21
Chapter Two: Literature Review

This chapter focuses on literature review of the academia on the pipeline systems, risk, pipeline
risk and pipeline risk management, review on pipeline risk factors, risk analysis and risk
models used to analyze identified pipeline risk factors.
2.1 Pipeline System

Transmission pipeline, a pipeline, other than a gathering line, that transports natural gas
or other products in form of gas or liquids from producing areas to refineries and processing
facilities and then to consumer areas and local distribution systems [10].
Figure 2. 1 Schematic view of pipeline system (Board, Transportation Research, 2004) [10]
Pipelines play a vital role in the transmission of oil and gas from the source to the destination
for further refining, processing and storage. Most of developed countries have an extensive
pipeline network that help meet energy and product demands at different locations. Pipeline
construction and use is increasing at rapid pace in developing nations. Pipelines traverse large
distances and can be above ground or below ground. Pipelines also cross bodies of water such
as lakes and rivers [11]. A picture of the Trans-Alaska pipeline is shown in Figure 2.2. Facts on
some well-known pipelines are presented in Table 2.1 below.
22
Figure 2. 2 Trans- Alaska Pipeline [28]
Table 2. 1 Facts on some well-known pipelines [10]

Pipeline Trans-Alaska Baku-Tbilisi-Ceyhan (TBC) West-East Gas
Location Prudhoe Bay to Valdez Caspian Sea to Mediterranean Xingjiang Uygur to
sea Shanghai
Commodity Crude Oil Crude Oil Natural Gas
Length 800 miles 1100 miles 2500 miles
Constr. Dates 1974 - 1977 2003 - 2005 2002-2004
Cost $7.7 billion $3.6 billion $5.2 billion
Features Extreme Terrain and Traverses mountain ranges, Traverses three mountains,
Climate, Permafrost roads, railways, water bodies 37 rivers, used remote
Environment sensing technology.
Status 2 million BPD at peak 150,000 BPD in June 2005, Will 1.3 billion cubic meters of
(1988). 890,000 BPD in reduce by 350, the tankers natural gas in 2004, its first
2005 through Bosporus Strait year of operation
The design, construction, maintenance and operation of pipeline involve the use of several
engineering, scientific and economic principles. The location of the pipeline depends on the
location of the source of the commodity and its destination. The routing of the pipeline involves
consideration of factors such as the terrain, topography, climate and the environment.
Construction techniques are adopted to suit the terrain, the soil and the environment.
Compressor stations support the operation of gas transmission lines and pumping stations
support pipelines transporting liquids.
The major factors influencing the design and construction of pipelines are listed here.
• Nature of fluid being transported (gas or liquid) and fluid properties.
• Volume flow rate.
• Length of the pipeline.
• Terrain and medium (soil/water) traversed by the pipeline.
• Climatic conditions – extreme heat/cold.
• Environmental constraints and impact on the environment.
• Codes, standards and regulations governing the design, construction and operation of
the pipeline.
• Seismic/volcanic conditions.
23
• Flood plains and potential for flooding.

• Economics.
• Materials.
• Construction, operation and maintenance of the pipeline.
The objective of pipeline design and engineering is to route, design and construct a
pipeline that can operate safely with minimal impact on the environment and one that is cost
effective both in terms of capital and operating costs. To achieve this objective, sophisticated
engineering and economic studies are necessary to optimize variables such as pipeline routing,
size (diameter), materials and compression/pumping requirements [12].
2.2 Risk Concept

Risk can be measured in a variety of ways, including through the likelihood of an event
occurring and the potential impact of that event, and different research define it different ways
but with the same meaning as follows;
Risk as “the considered expected loss or damage associated with the occurrence of a
possible undesired event. Risk can be defined as a measure of possible loss or injury and is
expressed as the combination of the incident probability and its consequences [5][9].
Risk can be described as the multiplication of the probability of failure (PoF) and the
consequence of failure (CoF), as can be seen in equation below [6].
Risk = (Event likelihood) * (Event consequences)
𝑅𝑖𝑠𝑘 = 𝑃𝑜𝐹 × 𝐶𝑜𝐹
Such risks often are expressed in measurable quantities like frequency of fatalities, injuries
or economic loss. A complete understanding of the risk requires that three questions to be
answered;
(1) What can go wrong?
(2) How likely is it?
(3) What are the consequences?
In most processing facilities, a large percent of the total risk for a pipeline will be
concentrated in a relatively small percentage of the equipment items. These potential high-risk
components may require greater attention through a revised inspection plan. The cost of the
increased inspection effort may be offset by reducing excessive inspection efforts in the areas
identified as having lower risk [4].
24
Relatively average
inspection to maintain
•High risk or remove the risk •Low risk region
region/potential risk •Chances and
area •Medium risk region
consequences are
•High probality and •Probality and very low
conesequences cosequences are
average
Focus on risk items to
No need for inspection
drive them down/High
cost
inspection cost
Figure 2. 3 Typical risk distribution of equipment [4]
Risk may be defined as perceived exposure or perceived uncertainty [29]

In finance, risk refers to the degree of uncertainty and/or potential financial loss inherent
in an investment decision. In general, as investment risks rise, investors seek higher returns to
compensate themselves for taking such risks [30]
Risk implies future uncertainty about deviation from expected earnings or expected
outcome. Risk measures the uncertainty that an investor is willing to take to realize a gain from
an investment [31].
Description: Risks are of different types and originate from different situations. We have
liquidity risk, sovereign risk, insurance risk, business risk, default risk, etc. Various risks
originate due to the uncertainty arising out of various factors that influence an investment or a
situation.
The common meaning of risk according to literature review is that risk is the potential for
harm or loss associated with a particular activity or situation. It is an inherent part of life and
can be present in a wide range of activities and endeavors, including personal, financial, and
professional endeavors.
Literature have explained pipeline risk in slightly different view but with common
meaning as follows;
(1) Pipeline risk refers to the potential for damage or accidents to occur during the operation
of a pipeline, which is a transportation system for moving liquids, gases, or other materials
from one location to another. Pipeline accidents can have serious consequences, including
environmental damage, loss of life, and financial losses for the companies operating the
pipelines and for communities affected by the accidents. There are a number of factors
that can contribute to pipeline risk, including the age and condition of the pipeline, the
materials being transported, the geography through which the pipeline passes, and the
procedures and technologies in place to manage and monitor the pipeline [9].
25
(2) Pipeline risk refers to the potential for harm to people or the environment as a result of the
construction, operation, or maintenance of a pipeline. This type of risk can arise from a
variety of causes, including accidents or spills, corrosion or other types of physical damage
to the pipeline, and natural disasters such as earthquakes or floods. It is important for
companies that operate pipelines to carefully assess and manage these risks in order to
ensure the safety of the public and the environment. This can include measures such as
regular inspections, maintenance programs, and emergency response plans. [33]
Even though risks to Oil and Gas pipelines cannot be entirely stopped, dealing with each
risk as severe is subsequent to losses in expenditure and time [34]. Reasonable and accurate risk
evaluation measures can contribute to a reduction in the overall risk of pipeline failure [35].
2.3 Pipeline Risk Management

Risk management studies must be conducted and interpreted into formats that can be
reviewed, understood and analyzed in order to maintain safe and secure construction and
operational environments [36].
Figure 2. 4 Pipeline risk management [37]
Pipeline risk management is the process of identifying, assessing, and prioritizing risks
associated with the construction, operation, and maintenance of a pipeline, and implementing
measures to reduce the likelihood and impact of those risks. It is an important aspect of ensuring
the safety of the public and the environment, as well as the integrity and reliability of the
pipeline.
Some key elements of pipeline risk management include [38]:
(1) Identifying potential risks: This involves using tools such as hazard analysis and risk
matrixes to identify the potential risks associated with the pipeline, including hazards
26
related to the construction, operation, and maintenance of the pipeline, as well as

external factors such as natural disasters and third-party interference.
(2) Assessing and prioritizing risks (Risk analysis): Once potential risks have been
identified, they must be assessed in order to determine their likelihood and potential
impact. This allows organizations to prioritize risks and focus their risk management
efforts on the most significant threats.
(3) Implementing risk reduction measures: Once risks have been identified and assessed,
organizations can implement a variety of measures to reduce the likelihood and impact
of those risks. These may include regular inspections and maintenance, emergency
response plans, spill prevention and response procedures, and other measures designed
to ensure the safety of the public and the environment.
(4) Monitoring and reviewing the effectiveness of the risk management plan: It is
important to regularly review and monitor the effectiveness of the risk management
plan in order to ensure that it is effective at identifying and mitigating risks. This may
involve the use of performance indicators and metrics to measure the effectiveness of
the plan.
2.3.1 Risk Identification

In Tanzania, and other developing countries under similar situations, Pipeline risk
management is hampered by a shortage of data. To overcome this problem, a comprehensive
document analysis has been carried out here to identify the common causes of pipeline failure.
This step is fundamental in risk management because is based on the premise that risk factors
are identifiable as defending a system from unknown risk is almost impossible [39]. Pipeline
risk factors at the planning, design, construction, operation, and maintenance stages have been
identified, classified by type. Thirty risk factors have been identified and classified into five
types as follows:
(1) Pipeline Location (PL): This includes risk factors like "Hot-Zones"; easy access to
pipelines; conflict over land ownership; geological risks such as groundwater and
landslides, and vehicle and animal accidents.
(2) Operational constraints (OC): This includes corrosion and a lack of protection against it;
the weakened ability to identify and monitor threats; a shortage of IT services and modern
equipment; design, construction and material defects; operational errors, and hacker attacks
on the operating or control systems
(3) Health & Safety and Environment (HSE). This incorporates improper safety regulations;
improper inspection and maintenance; sabotage opportunities due to pipelines that are
exposed as laid above ground; limited warning signs; inadequate risk management, and
natural disasters and weather conditions.
According to Muhlbauer [18], TPD risk breakdown the factor as follows.
27
Table 2. 2 Critical Pipeline risk factors from the reviewed literatures

S/N Risk Factors Source Risk
Type
01 Geographical location like ‘Hot-Zones’ [43] PL
02 Conflict over land ownership [54,55] PL
03 Accessibility of pipelines [43] PL
04 Geological risks like soil movement and landslides [40,46,56] PL
05 Vehicle accidents [41] PL
06 Animal accidents [46,52] PL
07 Lack of compliance with the safety regulations [40,47] PL
08 Weak ability to identify and monitor the risk factors [47] OC
09 Shortage of high-quality and modern IT services [46,47] OC
10 Corrosion and lack of anti-corrosive action [40,43,45,47,50, 51,56] OC
11 Design, construction, material and manufacturing defects [40,45,50,51,56,57] OC
12 Operational errors e.g. human error and equipment failure [40,42,45,46,47,50,51] OC
13 Hacker attacks on the operating or control systems [43] OC
14 Non-availability of warning signs [40] HSE
15 Lack of proper maintenance and regular inspection [40,42,44,45,47,51] HSE
16 The opportunity to sabotage exposed pipelines [52] HSE
17 Inadequate risk management methods [42,47] HSE
18 Natural disasters and weather conditions [44,46-48] HSE
19 Socio-political factors such as education level and poverty [40,44,46-48] SS
20 Low levels of the general publics’ legal and moral awareness [41,49] SS
21 Thieves [47,48] SS
22 Terrorism and sabotage [44,46-51] SS
23 Threats to staff (kidnap and/or murder) [52] SS
24 Leakage of sensitive information [43,53] SS
25 The law not applying to saboteurs (lawlessness) [41,46] RR
26 Stakeholders are not paying proper attention [47] RR
27 Few researchers are dealing with this problem [47] RR
28 Lack of historical records about accidents and risk registration [42,47] RR
29 Lack of proper training schemes [42,47] RR
30 Corruption [47] RR
Exposure is defined as an event that, in the absence of any mitigation or safeguard, can result
in the incident if insufficient resistance exists. Exposure of third-party damage consists of:
(1) Excavation exposure often occurs at new construction from heavy equipment activities.
Excavation exposure is only applicable to buried pipelines.
(2) Vehicles Exposure for vehicles hit the pipeline is a function of the type of vehicle, traffic
frequency, speed, and distance to facilities. Vehicles hit only applicable to above-ground
pipelines.
(3) Falling object Exposure for the falling object could from tools drop, cranes, falling trees.
Falling object exposure only applied to above-ground pipelines.
28
Mitigation is defined as the type and effectiveness of every preventive and mitigative
measure designed to block or reduce exposure. Mitigation of third-party damage consists of:
1) Cover of depth: Cover depth is the amount of protection over the buried pipeline that
protects it from third-party activities and impacts. In general, a more in-depth and
stronger cover provides better protection.
2) Impact barrier: The impact barrier protects above ground pipelines from exposure to
mechanical damage, falling object, and vehicle collision.
3) Line locating: Line locating involves pipeline marking, line locating devices and
procedures, marking practices.
4) Speed control Speed control is mainly used to reduce vehicles hit.
5) Sign, Markers, ROW condition The more recognizable the pipeline sign, markers, and
a ROW can reduce the likelihood of inadvertent damage.
6) Patrol Pipeline patrol is the best practice of reducing third-party intrusions. It is also
intended to detect an abnormal condition such as evidence of a leak from pipelines.
The patrol also should detect potential third-party threats to the pipeline. Such as when
there is excavating equipment operating nearby. The frequency and competency of the
patrol are affecting the patrol effectiveness to prevent the incident.
7) Public education programs to educate the public about the hazard of critical activities
such as excavation near pipelines. This is important because third-party damage is
unintentional or due to ignorance.
(4) Security and Societal (SS): This type of risk includes terrorism and sabotage; thieves;
public, legal and moral awareness; socio-political dimensions such as education level
and poverty; threats to staff, and leakage of sensitive information about risks.
(5) Rules and Regulations covering corruption (RR): laws which do not apply to saboteurs
and thieves; a lack of attention paid to circumstances by stakeholders; a lack of proper
training; a lack of historical and risk registration, and a paucity of research addressing
these problems.
2.3.2 Risk Analysis

Risk analysis is the process of assessing the likelihood and potential impact of potential
hazards, threats, or risks to an organization or individual. The goal of risk analysis is to identify
and prioritize potential risks in order to develop strategies to mitigate or manage them. The
process typically involves identifying potential hazards, evaluating the likelihood and potential
impact of those hazards, and developing plans to minimize or eliminate the risks they pose.
The process is widely used in a variety of fields, including finance, healthcare, engineering,
and information technology [62].
Table 2. 3 Main categories of risk analysis methods

Main Category Type of analysis Description
Simplified risk analysis Qualitative It is an informal procedure that
29
establishes the risk picture

using brainstorming sessions
and group discussions. The
risk might presented on coarse
scale, for example low,
moderate or high, making no
use of formalized risk analysis
methods.
Standard risk analysis Qualitative or quantitative It is more formalized
procedure in which recognized
risk analysis methods are used,
such as Hazard and
Operability study (HAZOP)
and coarse risk analysis, to
name a few. Risk matrices are
often used to present the
results.
Model based risk analysis Primarily quantitatively This method makes use of
techniques as event tree
analysis and Fault tree analysis
to calculate risk.
Pipeline risk analysis is a process used to identify and evaluate potential hazards and risks
associated with the operation of pipelines. This can include physical risks such as leaks or
ruptures, as well as operational risks like equipment failure or human error [71]. The goal of
pipeline risk analysis is to identify potential issues before they occur, and to develop strategies
to mitigate or manage those risks. This can include measures such as regular inspections and
maintenance, emergency response plans, and security measures to protect against sabotage.
The analysis process typically includes an assessment of the likelihood and potential impact of
different risks, and may be performed by pipeline operators or specialized consulting firms [63].
Risk or threat assessment is intended to identify the root causes of pipeline failure that
could occur, or that may have occurred, during the operation of the pipeline.
(1) Risk assessment: Once hazards have been identified, they are evaluated to determine
their likelihood of occurrence and potential impact. This step may involve using
statistical or modeling techniques to estimate the probability of different risks and their
potential consequences.
(2) Risk management: Based on the results of the risk assessment, strategies are developed
to mitigate or manage the identified risks. This can include measures such as regular
inspections and maintenance, emergency response plans, and security measures to
protect against sabotage.
(3) Implementation: The risk management strategies are implemented and the pipeline
system is monitored to ensure that the mitigation measures are working effectively.
30
(4) Review and update: The pipeline risk analysis process is ongoing, with regular reviews
and updates to ensure that it remains current and relevant. New risks and hazards may
be identified over time, and existing risks may change in terms of likelihood or impact.
It's important to note that the specific procedure will be depending on the specific
regulations and codes that apply to the pipeline in question, the procedure can be tailored to
specific pipeline, company regulations and the location where the pipeline is operated.
Additionally, different industry sectors such as oil and gas, water, or chemical have different
standards, therefore the procedures might differ among them.
2.3.3 Pipeline Risk Analysis Models

There are several pipeline risk management models that can be used to identify and
evaluate potential risks associated with pipeline operations. Some common models include:
(1) Bow-tie Model
This model is a visual representation of the potential hazards, controls, and consequences
of an incident. It can be used to identify the critical controls that are necessary to prevent an
incident and the key actions that should be taken in the event of an incident [64].
The Bowtie Model can be applied to pipeline risk assessment by following these general
steps:
a) Identify the incident scenario: The first step is to define the incident scenario that you
want to assess, such as a pipeline leak or rupture.
b) Identify the top events: The top events are the potential hazards or undesirable outcomes
that can lead to the incident scenario. For example, in the case of a pipeline leak, the
top event could be a pipeline rupture caused by corrosion.
c) Identify the barrier events: The barrier events are the controls or safeguards that are in
place to prevent the top events from happening. For example, in the case of a pipeline
leak, the barrier events could be regular inspections, corrosion monitoring, and
maintenance.
d) Identify the causes: The causes are the factors or events that can lead to the failure of
the barrier events and the occurrence of the top events. For example, in the case of a
pipeline leak, the causes could be lack of maintenance, corrosion, or external damage.
e) Identify the consequences: The consequences are the potential impacts of the top events.
For example, in the case of a pipeline leak, the consequences could be environmental
damage, loss of life, and economic losses.
f) Identify the recovery actions: The recovery actions are the measures that should be
taken in the event of an incident. For example, in the case of a pipeline leak, the
recovery actions could be activating emergency response procedures, shutting down the
pipeline, and containing the leak.
g) Create the bowtie diagram: The final step is to create a bowtie diagram that visually
represents the relationship between the top events, barrier events, causes, consequences, and
recovery actions.
31
It is important to note that the Bowtie Model can be a useful tool for pipeline risk
assessment, but it is not a substitute for a comprehensive risk management process. It is
important to also consider other factors such as regulations, industry standards, and best
practices when assessing pipeline risks.
A. Development of bow-tie model
The bow-tie model established in the 1970s by David Gill and named it Bow –tie Diagram
[65]
. It was meant to be used in the university course notes as a systematic model and was
continuously reviewed. At the end of the 20th century, the bow-tie model was successfully
applied to analyze accidents by explosion [66]. At the beginning of the 21st century, NASA used
the bow-tie model in risk management, promoting its development in the field. The Bow-tie
model is widely used in risk analysis and management of oil, natural gas and other industries
because of its practical and highly visualized features.
B. Bow-tie model principle
A useful and simple way for analyzing and evaluating risk is the bow-tie model [67]. For
the first time, it combines FTA and ETA, accident prevention measures and control mitigation
methods. Using the quality attributes of FTA and ETA, it examines the causes and effects of
accidents [68]. It identifies risk factors at all stages. As a result, it can influence risk analysis
outcomes and accident development [69]. In order to determine the direct and indirect causes of
the top event, FTA selects an accident as the starting point. The explanations are all
qualitatively analyzed after that. For the examination of accident causes, it serves as the
foundation. Considering the successes and failures of events in terms of temporal development,
ETA starts with the primary event that can result in an accident. The effects of various accident
models that could happen in complex systems can be examined through ETA. A bow-tie
diagram would place the accident in the middle, with the FTA and ETA on either side of it.
Using a layer-by-layer approach, the FTA determines the causes of accidents, identifies risk
factors, and develops prevention control measures. Considering the primary accident as the
main event, ETA deduces the outcomes of an accident based on several circumstances.
Therefore, mitigation strategies are created. The process of an accident as well as the
connections between its component pieces are shown by the bow-tie model [70]. A bow-tie
model is shown in figure 2.5.
32
Figure 2. 5 A Bow-tie Model diagram
C. Improved bow-tie model

The traditional bow-tie model is commonly chosen while using it. However, it does not
distinguish between accident causes and effects, making it difficult to identify and subsequently
fix problems. As a result, the updated bow-tie design was recommended. In order to analyze
accident causes, the expanded bow-tie model looks at four variables: human, material,
environmental, and managerial. It then builds prevention control methods in accordance with
fully recognizing higher risk variables, with a focus on prevention and control. It also looks at
four aspects of accident effects: fatalities, property losses, environmental impacts, and social
impacts. The proposed mitigation measures in the model would then make it possible to carry
out effective emergency rescue operations to reduce the damage index. The traditional bow-tie
paradigm merely evaluates events and their outcomes using only qualitative analysis. When
conducting a risk analysis of the urban gas pipeline network, the author conducted a statistical
investigation on the causes and effects and established their numbers. It is possible to quantify
the causes of gas pipeline network accidents and their more severe repercussions. When
statistics on accident outcomes are being produced, the type of an accident is determined by
the aspect that has sustained the most damages. The four considerations are the aforementioned
casualty, property loss, the environment, and society. For instance, the failure of a gas pipeline
network is the most lethal scenario.
The incident falls under the category of accidents involving fatalities when statistics are
being prepared. The improved bow-tie model is shown in figure 2.6.
33
Figure 2. 6 Improved bow-tie model diagram
(2) Fault Tree Analysis (FTA)

This model is used to identify the potential causes and contributing factors of an incident.
It can be used to identify the critical components and systems in a pipeline and prioritize risk
mitigation efforts.
Fault Tree Analysis (FTA) can be applied to pipeline risk management by following these
general steps:
(a) Identify the top event: The top event is the incident scenario that you want to assess,
such as a pipeline leak or rupture.
(b) Identify the basic events: The basic events are the immediate causes of the top event.
For example, in the case of a pipeline leak, the basic events could be a pipeline rupture
caused by corrosion or a valve failure.
(c) Identify the intermediate events: The intermediate events are the causes of the basic
events. For example, in the case of a pipeline leak, the intermediate events could be
lack of maintenance, corrosion, or external damage.
(d) Identify the initiating events: The initiating events are the factors or events that can lead
to the intermediate events. For example, in the case of a pipeline leak, the initiating
events could be design flaws, poor quality materials, or inadequate training of personnel.
(e) Create the fault tree diagram: The final step is to create a fault tree diagram that visually
represents the relationship between the top event, basic events, intermediate events, and
initiating events.
(f) Perform the quantification: The quantification is the process of assigning probabilities
to the events and gates in the fault tree. It can be done using subjective or objective
methods, such as failure data analysis, expert judgement or simulations.
34
(g) Identify the critical components: The critical components are the events or gates that
have the highest probability of contributing to the top event. Identifying these critical
components allows to prioritize the risk mitigation efforts.
The failure probability of petroleum pipeline is modelled as sum of failure probability due
to external interference, corrosion, construction defect, operational errors and other minor
failures.
P (Total failure of pipeline) = P (failure of pipeline due to corrosion) + P (failure of
pipeline due to external interference) + P (failure of pipeline due to construction defect) + P
(failure of pipeline due to operational error) + P (failure of pipeline due to other minor failures)
+… P (failure of nth factor).
There are now numerous outdated gas pipeline networks operating in many Chinese cities
and villages. The construction of numerous new pipeline networks also continues. This has
caused numerous failures in the gas pipeline network. They have caused severe losses in terms
of people's lives, lost property, the environment, and society. The breakdown of the urban gas
pipeline network must thus be examined by the author [64].
The following FTA has built in order to analyses the urban gas pipeline network failure.
Figure 2. 7 Tree diagram for leakage incident of gas pipeline [64]
35
Fault tree study of urban gas pipeline network breakdown identifies risk variables. Table
2.4 displays the events that various symbols symbolize.
Table 2. 4 Urban gas pipeline network leakage accident tree symbol representative event.
S/N Basic event S/N2 Basic event2 S/N Basic event3
T Pipeline leakage X1 natural disasters X34 acidic medium
A1 Pipeline perforation X2 unintentional damage X35 water in pipe network
poor quality of internal
A2 Pipeline rupture X3 deliberate destruction X36 corrosion coating
Related accessories
A3 leaked X4 internal overpressure X37 corrosion inhibitor failure
film/pressure tube vibration aging and damage of inner
B1 Pipeline corrosion X5 damage X38 coating
corrosive gases in the
B2 Pipeline defect X6 film aging X39 atmosphere
in the atmosphere high
B3 Third party damage X7 gasket damage X40 humidity and temperature
pipeline network is not coating repair/replacement not
B4 Mechanical failure X8 clear X41 timely
Voltage regulator
B5 leakage X9 illegal construction X42 coating aging
B6 Valve leakage X10 construction error X43 uneven grain size
B7 Stem defect X11 not found in time X44 improper selection
B8 Screw defect X12 not timely treated X45 uneven deformation
B9 Valve defect X13 uneven bottom X46 serious welding defects
failure to take necessary
C1 Buried corrosion X14 protective measures X47 welding defect
not according to actual
C2 Internal corrosion X15 traffic intensity design X48 welding material defect
Atmospheric stem deformation by
C3 corrosion X16 external force X49 mandatory installation
Pipeline quality large fault between pipe
C4 defect X17 stem severely corroded X50 segments
Improper security system design is not
C5 construction X18 stem wear X51 reasonable
system design safety factor is
C6 Construction failure X19 filler filling is not standard X52 small
C7 Illegal tying X20 nut loosening X53 soil settlement
bolt pre-tightening force is
C8 Traffic damage X21 not uniform X54 installation stress
Soil corrosion insufficient bolt pre-
D1 environment X22 tightening force
External corrosion
D2 failure X23 incorrect gasket mounting
36
Internal corrosion
D3 environment X24 gasket aging
Internal corrosion
D4 failure X25 insufficient gasket
Corrosive
D5 atmosphere X26 improper valve body
Failure of protective severe corrosion of valve
D6 measures X27 body
valve manufacturing
D7 Material defect X28 defects
chemical corrosion
D8 Poor rolling process X29 environment
electrochemical corrosion
D9 Pipeline welding X30 environment
microbial corrosion
D10 Pipeline installation X31 environment
Low pressure bearing
D11 capacity X32 cathodic protection failure
Pipe network under
D12 high stress X33 coating failure
The fundamental event might be identified by layer-by-layer analysis of the fault tree of
the urban gas pipeline network breakdown. It must first identify crucial checkpoints and crucial
accident prevention phases. The likelihood of the accident can then be qualitatively analyzed.
Finally, depending on the findings of the analysis, relevant prevention and control strategies
might be created.
The AHP (Analytic hierarchy process) developed by Saaty [20] provides a flexible and
easily understood way of analyzing complicated problems. It is a multiple criteria decision-
making technique that allows subjective as well as objective factors to be considered in
decision-making process. The AHP allows the active participation of decision-makers in
reaching agreement, and gives managers a rational basis on which aspect to make decisions
depending on the situation. AHP is based on the following three principles: decomposition;
comparative judgment; and synthesis of priorities, so that the right resources will be delegated
to right incident.
Risk analysis is usually a team effort, and the AHP is one available method for forming a
systematic framework for group interaction and group decision making.
AHP was used for risk analysis because of the following:
1) risk factors are both objective and subjective;
2) factors are conflicting, achieving of one factor may sacrifice others;
3) some objectivity should be reflected in assessing subjective factors;
4) AHP can consider each factor in a manner that is flexible and easily understood, and
allows consideration of both subjective and objective factors;
5) AHP requires the active participation of decision-makers in reaching agreement, and
gives decision-makers a rational basis upon which to make their decision
37
The probability of failure occurrence is performed by qualitative and quantitative means

to build generic conception that consider the majority of the facilities within the petroleum
industry.
Qualitative Assessment is the probabilistic failure analysis is conducted using the fault
tree analysis (FTA). The use of FTA along with components failure data and human reliability
data enables the determination of the frequency of occurrence of an accident. The top event is
identified based on the detailed study of the process, control arrangement, and behavior of
components of the unit/plant. A logical dependency between the causes leading to the top event
(failure) is developed in this stage [5].
Quantitative analysis is conducted to estimate the probability of the occurrence of the risk.
In order to validate the proposed risk estimation model, a degree of acceptance of risk has to
be set up against the estimated risk. The developed proposed mathematical model (Likelihood
of Risk (LOR)) is based on the assumption that the risk depends exponentially on time P, where
P is the physical age of the equipment and d is the design age of a part/machine (the expected
life of equipment).
(3) Likelihood Models
A. Qualitative models
Inputs and outputs are developed as qualitative categories rather than numerical scores. In
processes that use such models, the likelihood, consequence, and output risk levels are obtained
by consideration of pipeline risk factors and assignment to a qualitative risk level. These
models should have a defined logic for assigning risk levels. Risk levels may be assigned via
an SME discussion. If so, a structured process is needed to integrate and balance the panel’s
knowledge on risk factors. A simplified example of the representation of qualitative results is
given in Figure 2.6. In the matrix shown, the different shaded regions represent areas of
equivalent risk based on different combinations of likelihood and consequence.
Table 2. 5 Example of Qualitative Model
Likelihood
Consequences
High Medium Low
High
Medium
Low
Table 2. 6 Qualitative Risk Scale
High Medium Low
38
B. Relative Assessment of the likehood Model

Relative Assessment model inputs represent the major risk factors for failure of a pipeline
segment, including characteristics of pipeline segments and the surrounding area. These inputs
are assigned numeric scores that represent the relative effects on failure likelihood of a pipeline
characteristic. Each input may also be assigned a numerical weight, which reflects a subjective
assessment of the importance to the potential for a pipeline failure represented by the input.
The weighted scores are then combined to calculate an index or score representing the risk
presented by each segment. Weights are commonly applied to threat scores to account for the
pipeline segment’s or operator’s failure cause history. Typically, a likelihood index score and
consequence index score are calculated separately. They are then combined to obtain a total
risk index score. The most common method of combining a likelihood and consequence index
to calculate a risk score is by multiplying them.
The index model algorithms often combine likelihood factors according to categories
representing major threats to pipeline integrity. For example, index model likelihood categories
might include:
a. External Corrosion
b. Internal Corrosion
c. Stress Corrosion Cracking
d. Manufacturing Related Defects
i. Defective pipe seam
ii. Defective pipe
e. Welding/Fabrication Related
i. Defective pipe girth weld
ii. Defective fabrication weld
iii. Wrinkle bend or buckle
iv. Stripped threads/broken pipe/coupling
v. Failure
f. Equipment
i. Gasket O-ring failure
ii. Control/Relief equipment malfunction
iii. Seal/pump packing failure
iv. Miscellaneous
g. Third Party/Mechanical Damage
i. Damage inflicted by first, second, or third parties (instantaneous/immediate
failure)
ii. Previously damaged pipe (delayed failure mode)
iii. Vandalism
h. Incorrect Operations
i. Incorrect operational procedure
i. Weather Related and Outside Force
39
ii. Cold weather o Lightning

iii. Heavy rains or floods
iv. Earth quakes
The models typically include several inputs in each threat category. As mentioned above,
each input is assigned a numerical score based on the characteristics or “attributes” of the
pipeline segment or the area surrounding the section and is weighted according to its
importance. The attribute information is stored in a pipeline risk database. Individual likelihood
and consequence indexes can be calculated for each threat, using only the scores and weights
of inputs included for the threat category. For example, a risk index algorithm used by one
pipeline operator includes the input “Construction Activity” under the category of “Third-Party
Damage.” This input has four possible levels, or “attributes,” corresponding to different levels
of construction activity along a pipeline segment. A numerical score is associated with each
attribute so that the variable can be assessed on a consistent basis from pipeline segment to
pipeline segment. The attributes and their associated scores for “Construction Activity” are as
follows:
Table 2. 7 A risk index algorithm

Construction Activity
Attribute Score
High 10
Medium 7
Low 5
Very Low 1
Specific rules should be established for assigning attributes to ensure consistent

application of the process across different SME groups. SMEs need specific guidance on what
constitutes “high,” “medium,” “low,” and “very low,” so that the process can be consistently
applied across the operator’s pipeline assets. Continuing the example, the weight for
“Construction Activity” within the third-party damage threat category would be assigned a
value (e.g., perhaps “13%”). In this algorithm, the attribute score for the “Construction Activity”
variable is multiplied by this weight and summed with the weighted attribute scores for all
other inputs in the third-party damage category to calculate a likelihood index score for the
relative probability of pipeline damage due to third-party damage. This threat-specific index
score is weighted and summed with the weighted index scores developed for the other cause
categories to obtain the total likelihood index. The likelihood index is multiplied by the
consequence index to obtain the total risk score for the pipeline segment.
Some operators use one of the “standard” risk-index models that have been developed by
various industry consultants, while other operators have developed their own in-house index
models. One commonly used industry model is the model, presented in the Muhlbauer Pipeline
Risk Management Manual [9]. Significant differences exist among index models in the specific
40
input variables that are included in the quantification of the likelihood index, how scores are
assigned to these variables, how the scores are weighted, and how the weighted scores are
combined to provide an overall index. In the most common approach, the likelihood index is
calculated simply as a weighted sum of the variable scores. Each variable weight is multiplied
by the corresponding variable score for a segment and the products of the variable weights and
scores are summed to calculate the likelihood index. If any interacting threats were applicable,
an additional score would be added to the likelihood index to reflect the additional likelihood
of pipeline failure.
In the Muhlbauer [9] approach, an index model algorithm calculates the likelihood index
as a weighted sum of variable scores. The Muhlbauer Pipeline Risk Management Manual
provides a set of nominal variable scores and weights that are intended to be starting points for
the incorporation of segment-specific data. Additional variables can be defined by the operator.
In-house models developed by operators have been similar in nature to these two models. In
some models, the algorithm that translates the individual variable scores into the likelihood
index is more complex than a simple weighted sum. A fundamental characteristic of index
models is that the quantitative output is not an actual estimate of the likelihood of failure,
consequence of failure, or risk. Instead, it is a numerical index that represents these measures.
In most cases, a higher index value is meant to indicate higher likelihood, consequence, or risk
and a lower index value is meant to indicate lower values. Thus, the indexes provide a relative
measure of risk that has been useful for comparison between different segments or sections of
the pipeline (e.g., for setting integrity assessment priorities). Relative model risk results can be
challenging to use for applications requiring absolute estimates of likelihood or risk
C. Quantitative System and Probabilistic Models
In this category of risk model, the characteristics of segments of the pipeline and the
surrounding area are used to derive an actual estimate of the risk for each segment. Likelihood
is estimated as the frequency of failure along each segment over a year’s time (or over some
other relevant period). Expected levels of consequences in different categories (e.g., human
health and safety, the environment, or the potential for economic losses) are estimated. The
various consequence measures may be combined using some common units, such as equivalent
dollar cost. If so, this requires consequences such as human deaths and injuries and adverse
environmental impacts to be represented by dollars in the risk equation. The total risk for the
segment is estimated as the product of the likelihood of failure and the expected consequences
given failure.
If the model calculates the likelihood of different pipeline failure modes (i.e., small leak,
large leak, rupture), then the likelihood and consequences corresponding to each failure mode
would be estimated as well. The total risk would be estimated as the sum of the product of the
likelihood of failure in each failure mode and the expected consequences, given failure in that
mode. Quantitative System models calculate the likelihood and consequences of a failure along
each pipeline segment using the same general types of information on pipeline segment
characteristics and the surrounding area that relative assessment (index) models use. Like index
41
models, they can use a combination of data and SME judgment to evaluate inputs in categories
corresponding to important threats and consequences. The algorithm for a Quantitative System
model typically includes numerous calculations based on the physical and logical relationships
that translate pipeline segment characteristics into estimates of failure likelihood and
consequences. In one model of this type, a nominal or base likelihood estimate is provided
based on historical failure rates for the cause categories. This nominal failure rate is modified
according to segment-specific characteristics to estimate a segment-specific failure rate (i.e.,
the expected number of failures for each of the different failure modes per year). The algorithm
for modification of the base failure rate may be based on statistical analysis of incident data or
on analytical models (e.g., fault tree models or structural reliability models). In addition, the
estimate for likelihood of failure may be modified by assumptions about the inspection and
maintenance history and practice along the segment. For example, segments that have had
recent integrity assessment and repair of discovered defects would typically have different
failure likelihood estimates than other segments whose characteristics would otherwise be
similar. The additional threat potential from interacting threats can be explicitly accounted for
in quantitative system and probabilistic models. As an example of how an analytical tool is
utilized to estimate the likelihood of pipeline failure for one threat category, Figure 2.9, which
is a simplified fault tree that models the likelihood of an excavator hit on a pipeline. This model
would be part of the model used to estimate the likelihood of failure from excavation damage.
42
Figure 2. 8 Simplified Example Fault Tree Model for Excavator to Hit Pipelin
43
The frequencies or probabilities of the basic events of this fault tree (construction activity,
inadequate cover, etc.) are model inputs that would be evaluated based on data. These quantities
would be combined according to the model logic to estimate the probability of a pipeline hit
by an excavator. This estimate would be combined with an estimate of pipe failure probability,
given a hit, to obtain the estimated failure likelihood due to excavation damage. The failure
probability, given a hit, is estimated using the probability of a hit imposing specific loads on
the pipe and the probability of pipe failure to maintain integrity given those loads (based on
pipe characteristics). For time-dependent threats (e.g., corrosion), a similar “load vs. resistance”
approach may be taken that includes evaluation of operating pressure, pipe properties,
identified defect characteristics, and the likelihood of failure given pipe, defect, and operating
characteristics. For these threats, however, defects grow over time, so the likelihood of failure
is time dependent. Consequences in some risk estimation models are estimated using analytical
models to derive quantities such as economic loss and fatalities.
(4) Event Tree Analysis (ETA)
This model is used to identify the potential consequences of an incident and the actions
that should be taken to mitigate them. It can be used to evaluate the effectiveness of different
risk mitigation strategies [72].
A frequently used method for determining the effects that may follow the occurrence of a
potentially dangerous event is event tree analysis (ETA) [73]. With the help of this method, one
can identify prospective accident sequences connected to a specific initiating event or group of
initiating events. The event tree model explains the logical relationship between the probable
successes and failures of a given safety system or safety functions as they react to the initial
event and the subsequent series of events. Sequences in the investigated system demonstrate
the effectiveness and ineffectiveness of the safety system and available options. Sequences in
a safety function's failure or success include initiating events. The event tree is a diagram that
displays the first event and any subsequent successes or failures.
44
Figure 2. 9 Gas pipeline leakage consequence event tree
45
In different environment and under different conditions, the accident consequences will
be different as well. By analyzing the event tree of urban gas pipeline network failure, accident
consequences under different environmental conditions are found. Gas pipeline leakage
consequence event tree is shown in Figure 2.9. Events in the event tree of gas pipeline network
failure are represented by symbols shown in Table 2.8.
Table 2. 8 Urban gas pipeline network leakage incident tree event [64]
Event Consequence event Event Consequence event
sequence sequence
C1 jet fire, fire C9 Explosion hazard, suffocation
C2 confined space explosion, steam C10 steam clouds explode, fire
cloud explosion, poisoning
C3 poisoning, suffocation, explosion C11 poisoning, explosion hazard
hazard
C4 confined space explosion, steam C12 steam clouds explode, fire
cloud, explosion
C5 suffocation, explosion hazard C13 gas loss, explosion hazard
C6 confined space explosion, fire, C14 poisoning, gas loss
poisoning
C7 Poisoning, explosion hazard, C15 gas loss, diffusion
suffocation
C8 confined space explosion, fire
A pipeline network failure can result in serious effects like fire, vapor cloud explosion,
suffocation, and poisoning in a variety of environmental situations, according to an analysis of
the event tree. These effects could cause enormous costs to people and the environment,
especially in heavily populated urban areas, upsetting society.
(5) Other Models
(1) Risk Matrix: This model is a simple visual representation of the likelihood and
consequences of potential incidents. It can be used to identify and prioritize high-risk
areas and evaluate the effectiveness of different risk mitigation strategies [29].
(2) The Swiss Cheese Model: This model proposed by James Reason, it explains the role of
multiple defenses in preventing incidents. The model illustrates that multiple layers of
defense (the cheese slices) exist in a system, but they are not always aligned, resulting in
holes (or vulnerabilities) that may allow an incident to occur.
(3) Consequences Models
Example: Relative Risk Model Consequence Model. A risk index model, developed by
Dynamic Risk [26] and used by an operator for pipelines with diverse hazardous liquid
commodities, calculates hazard areas for multiple hazards posed by a potential pipeline failure:
Flammability, Toxicity (based on H2S content) and Overpressure.
46
For flammability and toxicity, the size of the hazard area is based on equations from API
RP 581 for different commodities, considering estimated release rates, likelihood of ignition,
liquid or gas release, and instantaneous or continuous release.
For overpressure, the hazard area calculations use estimated release rates and “TNT
equivalent Equation for Hard radius [27]” Estimated release rates are based on an average of
assumed hole sizes assumed for failure from different threats and equations for sonic and
subsonic flow. The largest hazard area of the three hazards considered for each location is
chosen to estimate consequences. Human safety consequences are derived from the product of
the estimated hazard area and the assumed population density within the hazard area (units are
the estimated number of persons impacted). Different population densities are assumed based
on which HCA types (High-Population, Other Populated, No HCAs, etc.) are within the hazard
area. Environmental consequences are estimated as the cost to clean up spills, which is
considered applicable to commodities released as liquids (including some HVLs). Different
costs per gallon to clean up spill are assumed for liquids and HVLs and for different HCA types.
Total costs are estimated by applying this cost per gallon to the estimated spill volume, which
is based on leak detection and shut down time, volume in line between valves, and drain down
factor. The units are estimated total clean-up costs in dollars. The human safety impact
measured in estimated number of persons impacted and environmental impact measured in
estimated total clean-up costs are weighted to obtain a total consequence score (Figure 2.10
below). Note that safety and environmental consequence scores are assigned the same weight
in the overall consequence score and economic consequences are assigned zero weight.
Figure 2. 10 Relative Risk Model Consequence Score
(4) Facility Risk Models

Example Tools for Gas Facility Risk Assessment Three examples are shown of risk
assessment tools used by an operator for facility risk assessment. These examples indicate
threats and risk factors that should be included in facility risk models. Figure 2.11 shows an
example “threat matrix” indicating threats and risk factors for a qualitative gas system facility
risk assessment. Note that this process includes threats to facility reliability and emergency
response as well integrity threats. The figure shows candidate preventive measures for each
threat. Figure 2.12 shows an example table of threats and failure causes to be considered in a
47
gas facility risk assessment process [25]. Figure 2.13 shows a portion of a “risk register” used as
a qualitative risk assessment model. The model includes:
(1) Seven frequency levels (the highest 2 are shown), from “Common” (>10 times per
year), down to “Remote” (once every 100+ years)
(2) Seven impact (consequence) levels (highest 2 shown), from “Catastrophic” down to
“Negligible
(3) Impact levels are defined for six categories (two are shown), including:
1) Safety
2) Environmental
3) Compliance
4) Reliability
5) Reputational
6) Financial
These are some of the possible models that can be used to assess pipeline risks, but it is
important to note that the specific model(s) used will depend on the pipeline system and the
level of risk involved. It is also important to note that the above-mentioned models are not
mutually exclusive, they can be combined and used together to give a more comprehensive
understanding of the risks involved.
48
Figure 2. 11 Example Threat Matrix for a Gas Facility Risk Assessment
49
Table 2. 9 Example Threats and Failure Causes for a Gas Facility Risk Assessment
Time-Dependent Threats Stable Threats Time independent Threats

‘The threat level grow over time if ‘The threat is inherent but does not grow over time ‘The threat exists outside of the continuum of
unchecked’ unless acted upon pressure or external load’ time’
Weather
Third
External Internal Stress manufacturing Welding/fabrication incorrect related
equipment part/mechanical
corrosion corrosion corrosion related defect related operations &Outside
damage
forces
Age,
Obsolescence Inadequate
Incorrect procedures
sizing/design Human error
Poor quality Vandalism
-Transitions maintenance Quality of Flooding
liquids manufacture Poor construction Excavation
Primary Inadequate Not a risk related station
Sulfur Inadequate practices Damage Seismic
coating for asset Sulfur documentation
CAUSES specification Inadequate Vehicular
Atmospheric family Liquids Inadequate events
Erosion Strength test QC/Inspection damage
conditions entering the training
documentations Cyber Threat
system Debris from
Vault flooding pigging &
(LP) hydro testing
50
Chapter Three: Research Methodology

In this chapter the study shows the data sources and the structure of the research
methodology.
3.1 Introduction
After reviewing the literature from various reference books and journals related to pipeline,
the next step is to collect the data needed to support research. The data obtained will be
analyzed using analytical tools selected. For this study the data used for analysis are obtained
directly from Gas Company (Tanzania) Limited (GASCO) which is a subsidiary company of
Tanzania Petroleum Development Corporation (TPDC) and from online journals and books.
3.2 The Data Sources
Risk factors are characteristically unclear, random and uncertain often accommodating a
more subjective idea, processing capability and cognition [40]. Operator records of segment-
specific characteristics are the primary source of data used for risk model inputs. Operators
collect data from routine operating, maintenance, and inspection activities. For example,
operating logs record pressures, indicative of stresses on the pipeline, and transients to which
the pipeline may be subjected. Exposed pipe reports record data about the condition of the
pipeline that is gathered whenever the pipeline is exposed by excavation for other reasons.
Records of patrols and surveillance show nearby construction activities that could pose threats
to the pipeline, and evidence of changes in the environment that may be indicative of changes
in soil conditions. Data sets from in-line inspection integrity assessments also provide
information concerning pipeline integrity. Operators should ensure that their data acquisition
forms are collecting the data needed for their risk model inputs. Construction, operations,
maintenance, and inspection personnel responsible for completing data acquisition forms
should be trained on requirements for completing forms with the needed data quality and
completeness. An online questionnaire survey was used in this research because it is one of the
most widely used methods of data collection since it is easy to carry out, less time consuming
and inexpensive [58].
There are, however, some disadvantages/limitations associated with online services that
could result in a low response rate such as a lack of accessibility to the internet, issues regarding
computer literacy, web security and anonymity and knowledge about the website [59]. That said,
authors like Bertot [60] and Czaja and Blair [59] have concluded that this kind of survey is the
easiest form of data collection as real cooperation is provided via open-ended questions.
51
3.3 Risk Assessment Methodology Structure
The chance of the detected risks occurring and their potential hazard repercussions,
specifically being evaluated through hypothetical accident scenarios, are the main tenets of the
risk assessment method. A bow-tie model that combines the risk severity and likelihood factor
has been created to assess and evaluate the principal hazards of flash fire and fireball arising
from natural gas pipeline collapse with regard to the proposed project. The distribution network
for natural gas has been related with risk, and the repercussions have been computed semi-
quantitatively as the product of likelihood/probability and severity/consequence.
Figure 3. 1 Risk Assessment methodology of Tanzania natural gas pipeline
52
Chapter Four: Result and Discussion.

4.1 Introduction
The Bowtie analysis is a qualitative risk assessment methodology that provides a way to
effectively communicate complex risk scenarios in an easy-to-understand graphic format and
shows the relationships between the causes of unwanted events and the escalation potential for
loss and damage. While quantitative analysis has been applied, bow-ties are typically
qualitative and simplified to support their use in communication. The bow-tie method combines
traditional event trees and fault trees models into a single diagram [75].
Bowtie can display the commands, which prevent the Top event from happening primarily,
specific to each threat and also the recovery measures that are ready to limit possible effects
once the Top event has been accomplished, specific for each credible result.
In this study Bow-tie analysis Model were preferably used because demonstrated the
following advantages:
(1) Provides a solid technique of comprehensive identification of all risk events and
promote an understanding of their reciprocal relations;
(2) ‘Living Case for Safety’: Bow-ties can be used through databases and risk registers
to enable periodic updating, which links current critical procedures to help maintain
a Case for Safety as a live tool.
(3) Uses a format in the form of an easy-to-understand scheme to communicate the cause-
and-effect relationships underlying more complex risk scenarios for a wide range of
stakeholders;
(4) Focus on Measures: It identifies and highlights the measures, which allows
inadequately control threats or consequences to be identified so that action may be
taken.
(5) Allows verification and connection to relevant sections of the management system
that support controls (including critical security elements and critical safety activities);
(6) Increases the awareness of the workforce on the risks associated with their facility
and how they are managed; and
(7) Uses the knowledge and expertise of the workforce, which best understands the actual
state of operation of existing controls and threats.
4.2 Development of Bow-tie model for Tanzania Natural Gas Pipeline

Network Failure
Bowtie diagram has two parts: One part represents the fault tree with principal causes of
the top event and correlation between the initiator events and related events (AND and OR
gates). The AND gate means that an event which is in progress involves the deployment of all
other events related to it. The OR gate means an event which is in progress involves the
deployment of any events related to it.
53
Another part represents the event tree with all consequences for top event. These
consequences can be: primary consequences, dangerous consequences and major consequences.
In fault tree description each incident is defined with a specific initial letter which
represents a different level in the block diagram. The first level is occupied by the main causes
and the other levels are occupied by intermediate causes. The levels which are situated before
the top event are called failure mode and level of causes [76].
Tanzania gas pipeline network failure has to be thoroughly analyzed using an updated
bow-tie model, which will help to better comprehend it.
(1) Identification of the top event
The gas pipeline in Tanzania has been in service for more than eight years at this
point. Numerous distribution lines to connected cities are constantly being built. Due
to a variety of causes, this has caused a considerable number of pipeline failures, as a
result, the gas pipeline leakage is identified as the top event (or an unexpected event).
(2) Identify the initiating events
The fault tree is created using guidelines for gas pipeline design, construction, operation,
and maintenance, as well as a thorough examination of natural gas pipeline failures.
The development of the fault tree diagram will provide the link between the top event
and the initiating event or the causes to the top event.
Consider Table 4.1 below consisting all possible threats from Tanzania natural gas
pipeline failure operated by GASCO.
Table 4. 1 Tanzania gas pipeline network leakage accident tree symbol representative event.
S/N Basic event description
T0 Natural gas pipeline leakage/failure
H1 External factors for pipeline failure
H2 Internal factors for pipeline failure

S1 Misoperation/Incorrect pipeline operation
S2 Corrosion
S3 Natural Calamity
S4 External interference
S5 Material defects
S6 Welding/fabrication defects
S7 Manufacturing defects
S8 External pipeline corrosion
S9 Internal pipeline corrosion
S10 Protection failure
54
X1-1 Inadequate procedures
X1-2 Inadequate training/Personnel qualification

X1-3 Negligence/Human error
X3-1 Failure due floods/heavy rainfall
X3-2 Seismic events
X4-1 Cyber threat
X4-2 Excavation
X4-3 Vandalism
X4-4 Vehicle accidents
X5-1 Defective pipe seam
X5-2 Incorrect or low-quality material selection
X6-1 Poor construction practices
X6-2 Inadequate Qc/inspection
X7-1 Design failure
X7-2 Inadequate specifications
X8-1 Soil corrosivity
X8-2 Failure of CP
X8-3 Coating failure
X8-4 Improper inspection schedule
X9 Corrosive medium/aid (H2O, H2S, CO2)
X10-1 Inhibitor failure
X10-2 Coating failure
X10-3 Interfacial bonding defects
55
By using Wondershare EdrawMax Software version 12.0.7 copyright 2023, fault tree analysis model diagram was developed as shown below.
Figure 4. 1 Tree diagram for Tanzania natural gas pipeline leakage incident
56
(1) Develop prevention and control measures

The causes of the gas pipeline failure are determined by studying the fault tree. The initial
events are broken down into four categories by the modified bow-tie model: human, material,
environmental, and management. This essay recommends looking at the event's causes from
four angles:
(a) Operating errors caused by people;
Through discussions with technicians, engineers, operators, and managers from TPDC
and GASCO and reviewing journal papers, a risk analysis of the failure of the Tanzanian gas
pipeline network based on the fault tree diagram has revealed that personnel mistakes that result
in pipeline failure are typically caused by a lack of safety knowledge, awareness, skills, and
competence. They may show up as incorrect, even unlawful, constructions and operations. The
majority of them involve improper operation. Under specific circumstances, these risk factors
created by humans may result in significant catastrophes like fire, explosion, gas leaks, and
pipeline failures that have serious ramifications.
• Prevention Measures (P1):
It is necessary to design suitable preventative and mitigation strategies in order to avoid
human error. By exposing workers to additional safety lessons, regular safety training and
education can encourage them to take safety issues more seriously. Regular employee
evaluations can aid in ensuring that duties are carried out by qualified individuals with
credentials.
(b) Pipeline network problems;
Design problems, technical deficiencies, welding and construction flaws, pipe, equipment,
device, too accessory flaws, and corrosion failure are the most common accident causes relating
to flaws in pipeline networks. Pipes built of subpar materials and construction methods,
pipeline network aging, design and construction problems due pipeline built under water ways
affected by soil erosion, subpar network architecture, and cracks in bad welding work are few
examples of how they show up. The most serious of these is the design defect in the pipeline
network.
To make sure that the pipe network is of high quality, strict quality control is advised. The
total quality of welding operations can be increased by following stringent procedures and
employing high-quality materials. Serious welding flaws can then be prevented. Accidents can
be avoided with a well-planned pipeline network.
(c) Environmental disasters;
Other pipeline networks' interference, the human-made environment (such as equipment
theft, cultivation), the external environment (such as a lack of safety precautions), and the
natural environment (such as floods and earthquakes) are some of the environmental factors
that contribute to the failure of the Tanzanian gas pipeline network. The most dangerous of
these are natural calamities. For instance, each year's floods in waterways cause more than ten
(10) FOC cuts, which resulted in blind operation, or the failure to remotely monitor and regulate
57
pipelines. Also cause the destruction of access roads to the pipeline facility, which makes
difficult for pipeline routine inspections.
Theft of devices and equipment can be avoided by improving network oversight and
security. The pipeline network should be well protected. To minimize accident loss and manage
damages to the pipeline network, emergency planning and contingency measures should be in
place.
(d) Interference from external factors.
The terms “External Interference”, “Third Party Interference” and “Third Party Damage”
are often used for all incidents involving own operator's personnel (regularly referred to as
“first party” excavation damage), or the operator’s contractor (regularly referred to as “second
party” excavation damage), or people or contractors not associated with the operator (often
referred to as “third party” excavation damage). These external interferences or third party
damage includes excavation, cyber threats, vandalisms and vehicle accidents. Incidents caused
by external interference are characterized by potentially severe consequences and are the
greatest risk to public safety.
Consider the following Table 4.2 below of Primary failure frequencies per cause, that
shows the contribution of external interferences to pipeline failure.
Table 4. 2 Primary failure frequencies per cause [77]

Primary failure frequency
1970-2019 2000-2019 2010-2019 2015-2019
per per per per
1,000 km·yr 1,000 km·yr 1,000 km·yr 1,000 km·yr
External interference 0.134 0.054 0.035 0.036
Corrosion 0.050 0.033 0.034 0.032
Construction defect / 0.048 0.020 0.020 0.015
Material failure
Hot tap made by error 0.013 0.005 0.002 0.001
Ground movement 0.025 0.020 0.020 0.017
Other and unknown 0.022 0.015 0.017 0.024
58
Figure 4. 2 Primary pipeline failure frequencies per cause from 1970-2019

Transmission pipelines shall be designed according to recognized standards. Typical
prevention measures include: Routing pipelines away from populated areas, Marking of
pipelines with marker posts, Underground warning tape, Using pipes with greater wall
thickness in built up areas, Providing additional mechanical protection (e.g. concrete slabs) in
vulnerable areas, Marking out of the pipeline and supervision of work, Liaison with land
owners and other key stakeholder groups, Third party enquiry processes (including one call
systems in some countries), Pipeline surveillance.
(2) Identification of the outcomes/consequences of the top event
A pipeline network failure can cause grave consequences such as fire, explosion,
suffocation, and poisoning. According to the improved bow-tie model, the pipeline gas leak
consequences are to be analyzed and identified from four aspects: (a)casualties referred to
minor injury, serious injury and death of people, (b) property/economical losses referred loss
due repair costs, loss due equipment downtime and loss of production, (c) environmental loss
referred to air pollution, soil pollution and water pollution and (d) social consequences which
referred to political influences, living resident influences and company image impacts.
(3) Development of Improved Bow-tie Model
In light of steps performed above and the statistics of more than 50 incidents of natural
gas pipeline network failure in Tanzania the period of seven years, the improved bow-tie
diagram of gas pipeline network failure was built by using Wondershare EdrawMax Software
version 12.0.7 copyright 2023, as shown in Figure 4.3.
59
Figure 4. 3 Improved Bow-tie Model for risk analysis of natural gas pipeline failure
60
4.3 Quantitative Analysis of Bow-Tie Model on Tanzania Natural Gas

Pipeline Failure.
Some level of quantification of a bow tie diagram can be achieved by presence of the
following factors:
(1) The pathways are independent,
(2) The probabilities of events on each pathway can be estimated,
(3) The probabilities that particular controls will fail can be estimated.
However, many situations are more complex, pathways and barriers are not independent,
and the effectiveness of the controls may be uncertain. It is unwise to attempt quantification in
these circumstances. More appropriate quantification tools may be fault tree analysis or event
tree analysis which are part of bow-tie model.
Each outcome risk has an associated probability value for an accident to occur. Equation
(4.1) was used to compute each outcome risk's probability values. The probability value of
outcome risk (Po) is calculated by Equation (3.1) as follows:
Po=PIE×PPE1×PPE2×………………………...........PPEn (4.1)
Where by PIE = initial probability event, and PPE1, PPE2……. PPEn are the probabilities
of pivotal/key events.
Leak sizes are categorized as follows;
(1) Small scale leak (Pinhole/crack): the effective diameter of the hole is smaller than or
equal to 2 cm (Ø hole ≤ 2cm);
(2) Large scale leak (Hole): the effective diameter of the hole is larger than 2 cm and
smaller than or equal to the diameter of the pipe (2cm < Ø hole ≤ Ø pipeline);
(3) Rupture: the effective diameter of the hole is larger than the pipeline diameter. [77].
The leakage analysis for existing pipeline in Tanzania was analyzed using ETA method.
The analysis will be focused on small scale leakage, large scale leakage and rupture scenarios
because of the incidents recorded from the case study company.
The risks from a pipeline containing a flammable fluid depend critically on whether a
release is ignited, and whether ignition occurs immediately or is delayed. It is usually assumed
that immediate ignition occurs within 30 s, and delayed ignition occurs after 30 s. Concerning
the proposal, the chance of pipeline failure (rupture and leaks) is determined from the following
equations following IGEM/TD/2 standard [81].
{𝑃 𝑖𝑔𝑛 = 0.0555 + 0.0137𝑝𝑑2; 𝑓𝑜𝑟 0 ≤ 𝑝𝑑 2 ≤ 57 } Ignition probability for pipeline rupture
𝑃𝑖𝑔𝑛 = 0.81; 𝑓𝑜𝑟 𝑝𝑑2 > 57
{𝑃 𝑖𝑔𝑛 }
= 0.0555 + 0.0137(0.5𝑝𝑑2); 𝑓𝑜𝑟 0 ≤ 0.5𝑝𝑑 2 ≤ 57 Ignition probability for pipeline leaks
𝑃𝑖𝑔𝑛 = 0.81; 𝑓𝑜𝑟 0.5𝑝𝑑2 > 57
where Pign = Probability of ignition, p= Pipeline operating pressure (bar), d = Pipeline diameter (m).
61
4.3.1 Pipeline gas leak analysis for small scale leak scenario.
The small-scale gas pipeline leak that occurs in this scenario is the major event, and the
key events are fire ignition, fire escalation, and evacuation. For a pipeline with varying
diameters of 36, 24, 16, and 8 inches, the probability value for a small leak is 0.85, and for an
ignition and delayed ignition for a subterranean pipeline along an even population density, the
values are 0.97 and 0.89, respectively [78]. The odds of a failure event causing a fire to spread
and forcing people to flee multi-dwelling structures are 0.43 and 0.1, respectively [79]. Every
important event has a chance of succeeding or failing, and each one carries a certain risk for
the outcome. The outcomes along each path in an event tree diagram comprise the outcome
risk. Figure 4.4 below depicts the event tree diagram for a small-scale leak scenario drawn by
Wondershare EdrawMax Software.
Figure 4. 4 Event tree diagram for small scale leak scenario
The probability value for each outcome risk (OC1-OC9 in Figure 4.4) was calculated
using equation (4.1) above. All the outcomes which results to the failure of evacuation are
unsafe which all could lead to fire, casualties, and gas poisoning at different levels are OC2,
OC4, OC6 and OC8. The probability values for all safe and unsafe outcomes of small scale gas
pipeline leak scenario which is greater to 10-4 are categorized as intolerable risks [79].
62
The probability values of safe and unsafe outcomes of the event tree diagram Figure 4.4 above are shown in Table 4.3.
Table 4. 3 Outcome risk probability values for small scale leak scenario
Risk PIE × PPE1 × PPE2 … … … . PPEn Po Outcome(Cn)

Fireball, light poisoning 0.85 × 0.03 × 0.57 × 0.90 1.3 × 10−2 OC1
Fireball, severe casualties, light poisoning 0.85 × 0.03 × 0.57 × 0.10 1.5 × 10−3 OC2
Fireball, light poisoning 0.85 × 0.03 × 0.43 × 0.90 9.9 × 10−3 OC3
Fireball, severe casualties, light poisoning 0.85 × 0.03 × 0.43 × 0.10 1.0 × 10−3 OC4
Flash fire, light poisoning 0.85 × 0.97 × 0.11 × 0.57 × 0.90 4.7 × 10−2 OC5
Flash fire, severe casualties, light poisoning 0.85 × 0.97 × 0.11 × 0.57 × 0.10 5.2 × 10−3 OC6
Flash fire, light poisoning 0.85 × 0.97 × 0.11 × 0.43 × 0.90 3.5 × 10−2 OC7
Flash fire, light casualties, light poisoning 0.85 × 0.97 × 0.11 × 0.43 × 0.10 3.9 × 10−3 OC8
Severe poisoning 0.85 × 0.97 × 0.89 7.3 × 10−1 OC9
Unsafe outcome
63
4.3.2 Pipeline gas leak analysis for large scale leak scenario.
The situation starts off with a significant gas leak. The igniting, delayed ignition, fire
escalation, and evacuation are the key moments in this scenario. Large-scale gas releases have
a chance value of 0.10, and failure events for ignition and delayed ignition in metropolitan
areas have probabilities of 0.90 and 0.80, respectively [78]. In a multi-dwelling building, the
probabilities of failure events related to fire escalation and evacuation are 0.43 and 0.10,
respectively [79]. The event tree diagram for the large-scale gas release scenario is shown in
Figure 4.5.
Figure 4. 5 Event tree diagram for the large-scale gas leak situation
The probability value of each outcome risk (Outcomes OCL1–OCL9 in Figure 4.5) was
calculated using Equation (4.1). All the outcomes which results to the failure of evacuation are
unsafe which all could lead to fire, casualties, and gas poisoning at different levels are OCL2,
OCL4, OCL6 and OCL8. The probability values for all safe and unsafe outcomes of large scale
gas pipeline leak situation which is greater to 10-4 are categorized as intolerable risks [79]. From
Table 4.4, showing the probability value for each outcome risk in the large-scale gas leak
situation.
64
Table 4. 4 Outcome risk probability values of the large-scale gas leakage situation
Fireball, light poisoning 0.10 × 0.10 × 0.57 × 0.90 5.1 × 10−3 OCL1
Fireball, severe casualties, light poisoning 0.10 × 0.10 × 0.57 × 0.10 5.7 × 10−4 OCL2
Fireball, light poisoning 0.10 × 0.10 × 0.43 × 0.90 3.9 × 10−3 OCL3
Fireball, severe casualties, light poisoning 0.10 × 0.10 × 0.43 × 0.10 4.3 × 10−4 OCL4
Flash fire, light poisoning 0.10 × 0.90 × 0.20 × 0.57 × 0.90 9.2 × 10−3 OCL5
Flash fire, severe casualties, light poisoning 0.10 × 0.90 × 0.20 × 0.57 × 0.10 1.0 × 10−3 OCL6
Flash fire, light poisoning 0.10 × 0.90 × 0.20 × 0.43 × 0.90 7.0 × 10−3 OCL7
Flash fire, light casualties, light poisoning 0.10 × 0.90 × 0.20 × 0.43 × 0.10 7.7 × 10−4 OCL8
Severe poisoning 0.10 × 0.90 × 0.80 7.2 × 10−2 OCL9
Unsafe outcome.
65
4.3.3 Gas Leakage Analysis of Gas Pipeline Rupture Scenario

Gas pipeline rupture serves as the scenario's opening act. The igniting, delayed ignition,
fire escalation, and evacuation are the key moments in this scenario. For natural gas pipelines,
the likelihood of a pipeline rupture is 0.05, and in metropolitan areas, the probabilities of an
ignition failure event and a delayed ignition are 0.75 and 0.64, respectively [78]. For fire
escalation and evacuation in a multi-dwelling building, the likelihood values of failure events
are 0.43 and 0.10, respectively [79]. Figure 4.6 depicts the event tree diagram for a gas pipeline
rupture.
Figure 4. 6 Event tree diagram for the gas pipeline rupture scenario
Equation (3.1) was used to calculate the probability value for each outcome risk
(Outcomes OCR1–OCR9 in Figure 4.6). All the outcomes which results to the failure of
evacuation are unsafe which all could lead to fire, casualties, and gas poisoning at different
levels are OCR2, OCR4, OCR6 and OCR8. The outcome risk probability values of the gas
pipeline rupture scenario are shown in Table 4.5. All outcome risks are categorized as
intolerable risks because the probability value of each is more than 10−4 [80].
66
Table 4. 5 Outcome risk probabilities of the gas pipeline rupture scenario
Fireball, light poisoning 0.05 × 0.25 × 0.57 × 0.90 6.4 × 10−3 OCR1
Fireball, severe casualties, light poisoning 0.05 × 0.25 × 0.57 × 0.10 7.1 × 10−4 OCR2
Fireball, light poisoning 0.05 × 0.25 × 0.43 × 0.90 4.8 × 10−3 OCR3
Fireball, severe casualties, light poisoning 0.05 × 0.25 × 0.43 × 0.10 5.4 × 10−4 OCR4
Flash fire, light poisoning 0.05 × 0.75 × 0.36 × 0.57 × 0.90 6.9 × 10−3 OCR5
Flash fire, severe casualties, light poisoning 0.05 × 0.75 × 0.36 × 0.57 × 0.10 7.7 × 10−4 OCR6
Flash fire, light poisoning 0.05 × 0.75 × 0.36 × 0.43 × 0.90 5.2 × 10−3 OCR7
Flash fire, light casualties, light poisoning 0.05 × 0.75 × 0.36 × 0.43 × 0.10 5.8 × 10−4 OCR8
Severe poisoning 0.05 × 0.75 × 0.64 2.4 × 10−2 OCR9
Unsafe outcome.
67
4.4 Gas Leakage Risk Evaluation.

From 4.3 above, each risk probability estimate for each scenario was compared with
specified risk criteria using risk evaluation. Whether the risk level falls into the categories of
negligible/insignificant, tolerable/bearable, or intolerable/significant is determined by the
appraisal. The probability value for the intolerable risk category is greater than 10-4, the
insignificant risk category has a probability value of less than 10-6, and the tolerable or bearable
risk category has a probability value between 10-4 and 10-6 [80]. The likelihoods of a small gas
leak, a large gas leakage, and a gas pipeline rupture are all more than 10-4. In order to lower the
risks in the scenarios of a small leak, a large-scale gas discharge, and a gas pipeline rupture to
either the tolerable or negligible levels, risk control is required.
Table 4. 6 Risk level probabilities category

Risk Probability Risk Category Sign
≥ 10-4 Intolerable
10-4 ˃ risk ˃ 10-6 Tolerable
≤ 10-6 Negligible/Insignificant
Control needed Monitoring required No need to engage any cost.
4.5. Gas Leakage Risk Control

Risk control should be undertaken to reduce the risks already analyzed in the small-scale
gas leak, large-scale gas leakage, and gas pipeline rupture situation to either the tolerable or
negligible risk category. Currently Tanzania natural gas pipeline has limited number of gas
detectors only to the receiving stations, BVS, and processing plants. A vast of pipeline and
distribution lines has no gas detection systems, makes it vulnerable in case of leakage incident.
Risk controls to reduce the risk level in the small-scale leakage, large-scale gas release, or gas
pipeline rupture scenarios should be pre-formed to detect gas leakage immediately by installing
a sophisticated gas detector and increase the number of automated valves around the pipe. Thus,
if a gas leak is detected, the valve of the gas pipe can be closed immediately to stop the flow
of gas. For ignition, it is necessary to install firefighting systems at reasonable intervals to assist
in the scenario of fire, so that fire can be extinguished immediately if ignition is detected. The
probability value of a failure event for the gas detector is 0.05 and that for a firefighting system
is 0.20 [80].
68
4.5.1 Risk control for small scale pipeline gas leak scenario
After the analysis and installation of suitable gas detection and extension of SCADA
system to support gas leak detectors and provision of firefighting systems, small gas pipeline
leak scenario will be regulated as shown in Figure 4.7 below.
Figure 4. 7 Event tree diagram for small scale gas leak scenario with gas detection and
firefighting systems
Through the installation of gas detection systems to the area where gas pipeline is passing
through with provision of gas automatic gas detection systems connected directly to the control
room via SCADA System. And installation of firefighting systems to gas stations and buildings
that are connected with natural gas infrastructure the consequences probability will be reduced
to tolerable range and three safe conditions were identified as shown below in Table 4.7.
69
Table 4. 7 Outcome risk probabilities of the small scale gas leak scenario after application of mitigation measures
Fireball, light poisoning 0.85 × 0.05 × 0.03 × 0.20 × 0.57 × 0.90 1.3 × 10-4 OC1
Fireball, severe casualties, light poisoning 0.85 × 0.05 × 0.03 × 0.20 × 0.57 × 0.10 1.4 × 10−5 OC2
Fireball, light poisoning 0.85 × 0.05 × 0.03 × 0.20 × 0.43 × 0.90 9.9 × 10−5 OC3
Flash fire, light poisoning 0.85 × 0.05 × 0.97 × 0.11 × 0.20 × 0.57 × 0.90 4.7 × 10−4 OC5
Flash fire, severe casualties, light poisoning 0.85 × 0.05 × 0.97 × 0.11 × 0.20 × .57 × 0.10 5.2 × 10−5 OC6
Flash fire, light casualties, light poisoning 0.85 × 0.05 × 0.97 × 0.11 × 0.20 × 0.43 × 0.10 3.9 × 10−5 OC8
Severe poisoning 0.85 × 0.05 × 0.97 × 0.89 3.7 × 10−2 OC9
Unsafe outcome.
All unsafe outcomes due to pipeline natural gas leak their probabilities are being controlled into tolerable range i.e. ˂ 10-4. And for those
outcomes with mild effects their probabilities are being reduced reasonably.
70
4.5.2 Risk control for gas pipeline large scale leak scenario
Gas detectors and firefighting were also used to lessen the risk brought on by a large
natural gas leak scenario. The analysis in this scenario is illustrated in Figure 4.8, which is
presented below. Three safe states can be defined following the installation of the control
measures (gas detection and firefighting systems). All unfavorable outcomes with intolerable
probability levels have been lowered to ranges that are less than 10-4, which are considered
bearable.
Figure 4. 8 Event tree diagram for the large-scale gas leak scenario with gas detection and
firefighting systems
By installing gas detection systems in the vicinity of gas pipelines and providing automatic
gas detection systems that are directly connected to the control room via SCADA. The
likelihood of consequences will be decreased to a manageable range with the installation of
firefighting systems in gas stations and buildings connected to natural gas infrastructure, and
three safe conditions were found, as indicated in Table 4.8 below.
71
Table 4. 8 Outcome risk probabilities of the large scale gas leak scenario after application of mitigation measures
Fireball, light poisoning 0.1 × 0.05 × 0.1 × 0.20 × 0.57 × 0.90 5.1 × 10-5 OC1
Fireball, light poisoning 0.1 × 0.05 × 0.1 × 0.20 × 0.43 × 0.90 3.9 × 10−5 OC3
Flash fire, severe casualties, light poisoning 0.1 × 0.05 × 0.90 × 0.20 × 0.20 × 0.57 × 0.10 1.0 × 10−5 OC6
Flash fire, light casualties, light poisoning 0.1 × 0.05 × 0.90 × 0.20 × 0.20 × 0.43 × 0.10 7.7 × 10−6 OC8
Severe poisoning 0.1 × 0.05 × 0.90 × 0.80 3.6 × 10−3 OC9
Unsafe outcome.
72
4.5.3 Risk control for gas pipeline rupture scenario

Gas detection and firefighting systems are also employed in gas pipeline rupture scenarios
to reduce the risk of consequences to acceptable or negligible levels. The Bow-tie model's event
tree diagram was also used to demonstrate how gas detectors and fire systems could be
employed as barriers or mitigation measures in the case of a gas pipeline rupture, as seen in
Figure 4.9 below.
Figure 4. 9 Event tree diagram for the gas pipeline rupture incident after the application of
control measures
After the application of gas detection and firefighting systems adequately, under gas
pipeline rupture scenario, three safe conditions were identified. The outcomes probabilities for
all safe outcomes and unsafe outcomes were reasonably reduced as shown on Table 3.9 below.
73
Table 4. 9 Outcome risk probabilities for gas pipeline rupture scenario after application of mitigation measures
Fireball, light poisoning 0.05 × 0.05 × 0.25 × 0.20 × 0.57 × 0.90 6.4 × 10−5 OCR1
Fireball, severe casualties, light poisoning 0.05 × 0.05 × 0.25 × 0.20 × 0.57 × 0.10 7.1 × 10−6 OCR2
Fireball, light poisoning 0.05 × 0.05 × 0.25 × 0.20 × 0.43 × 0.90 4.8 × 10−5 OCR3
Fireball, severe casualties, light poisoning 0.05 × 0.05 × 0.25 × 0.20 × 0.43 × 0.10 5.4 × 10−6 OCR4
Flash fire, light poisoning 0.05 × 0.05 × 0.75 × 0.36 × 0.20 × 0.57 × 0.90 6.9 × 10−5 OCR5
Flash fire, severe casualties, light poisoning 0.05 × 0.05 × 0.75 × 0.36 × 0.20 × 0.57 × 0.10 7.7 × 10−6 OCR6
Flash fire, light poisoning 0.05 × 0.05 × 0.75 × 0.36 × 0.20 × 0.43 × 0.90 5.2 × 10−5 OCR7
Flash fire, light casualties, light poisoning 0.05 × 0.05 × 0.75 × 0.36 × 0.20 × 0.43 × 0.10 5.8 × 10−6 OCR8
Severe poisoning 0.05 × 0.05 × 0.75 × 0.64 1.2 × 10−3 OCR9
Unsafe outcome
74
The greatest risk levels for the dangerous/unsafe outcomes (outcomes that resulted in
casualties) for each of the three scenarios are listed in Table 4.11 below, following the
implementation of the control measure.
Table 4. 10 Probability values for all unsafe outcomes of each scenario

Outcome Probability
OC2 1.4 × 10−5
OC4 1.1 × 10−5
OC6 5.2 × 10−5
OC8 3.9 × 10−5
OCL2 5.7 × 10−6
OCL4 4.3 × 10−6
OCL6 1.0 × 10−5
OCL8 7.7 × 10−6
OCR2 7.1 × 10−6
OCR4 5.4 × 10−6
OCR6 7.7 × 10−6
OCR8 5.8 × 10−6
Table 4. 11 Highest risk levels for all three scenarios after risk control
Outcome Probability Risk Levels
OC6 5.2 × 10−5 Tolerable
OCL6 1.0 × 10−5 Tolerable
OCR6 7.7 × 10−6 Tolerable
75
Chapter Five: Conclusion and Recommendations

5.1 Conclusion
Failure of the natural gas pipeline network is a serious safety hazard. There can be
significant harm and consequences in the event of an accident. This study does a risk analysis
of natural gas pipeline network breakdown using the improved bow-tie model and comes to
the following conclusions:
The bow-tie model combines the best elements of both FTA and ETA in an ideal way. It
explains the causes and effects of an accident in detail, then proposes appropriate preventative
and mitigation strategies.
By examining accident causes and consequences from four different perspectives, the
revised bow-tie model conducts a risk analysis of natural gas pipeline network failure. People,
materials, environments, and management make up the four factors that cause accidents,
whereas casualties, property damage, environments, and society make up the four factors that
result from accidents.
The improved bow-tie model is ideal for risk analysis of Natural gas pipeline network
failure. It can analyze its cause risks and consequence risks. And it can develop prevention and
mitigation measures accordingly to eliminate these causes and consequences. The whole
process can be shown dynamically.
Through the use of improved bow-tie model for Natural gas pipeline network risk analysis,
we can know that human causes are the most important factors in the causes of gas pipe network
leakage, followed by environmental factors such as corrosion, we should focus on these two
aspects of prevention and control to reduce the incidence of accidents better. Gas pipe network
leakage, resulting in casualties, property loss is more serious, we should mainly focus from
these two aspects to develop mitigation measures to reduce the impact of accidents.
The improved bow-tie model is easy to understand, clear, and practical, so that people can
understand the causes and consequences of an accident simply by reading the figures it
provides. It is of great significance to the analysis of gas pipeline network failure.
Generally, using ETA as part of the improved bow-tie model revealed that consequences
due natural gas pipeline failure may be reduced by actions, such as:
(1) Reducing potential release volumes by:
a) Installing new emergency flow restriction devices, remote control valves, or
automatic shutoff valves.
b) Improving leak detection systems or operator response to rupture indications.
c) Installing more SCADA measurement points to allow for more precise monitoring
and quicker determinations of pressure, flow, or temperature data reflective of
pipeline operating conditions at specific locations.
(2) Reducing the potential for spill dispersion through such measures as secondary
containment, positioning emergency equipment, or improving emergency response.
(3) Relocating receptors or relocating the pipeline to lower the potential for receptor impacts.
76
5.2 Recommendations
(1) It was deemed vital to recommend providing communication between the inspection
and patrol team and the control room. By taking this move, inspection and patrol staff
are able to promptly contact the control room if they discover any anomalies.
(2) Similar to that, a means of quick communication between the patrol control and the
local police was deemed important. In the case of opposition from anyone interfering
from outside, this mechanism ensures prompt local police response.
(3) Signaling that could be plainly seen at night was suggested as another recommended
step since signposts announcing the existence of pipelines could typically only be seen
during daylight hours.
(4) It was thought of as a suggested activity to update preventative maintenance plans in
order to guarantee the integrity of the pipeline and its ancillary components.
(5) The pipeline under study lacks a barrier to prevent internal corrosion. It was advised
to install an instrumented Pipeline Inspection Gauge (PIG) cleaning system in the
pipeline even if the fluid did not exhibit corrosive properties because impurities
cannot be completely removed. The PIG has the capacity to clean pipelines and
measure thickness.
(6) To make sure that the community is aware of the risks involved with the pipeline and
to prevent outside meddling, a public education campaign using Bow-Tie diagrams as
assistance was advised. Even those who are unfamiliar with the technical aspects of
pipelines may easily comprehend the hazards thanks to the Bow-Tie diagram interface.
Avoiding one of the most likely causes of pipeline leaks and ruptures is made possible
by this advised course of action.
(7) A contributing element in the prevalence of human failures may also be outdated
workforce training. As a result, it was advised to improve the training management
program since qualified operators reduce the risk of human error during pipeline
operation or repair.
(8) The study recommend that the great focus should be given to the causes of the
incidents, since managing the risk factors means no incident is likely to occur.
77
References
[1] Vairo T, Pontiggia M, Fabiano B. Critical aspects of natural gas pipelines risk
assessments[J]. Process Safety and Environmental Protection, 2021; 149:258-68.
[2] Baybutt P. Issues for security risk assessment in the process industries[J]. Loss Prevention
in the Process Industries. 2017; 49:509-18.
[3] Dey PK, Gupta SS. Analytical hierarchy process boosts risk analysis objectivity[J]. Pipe
line & gas industry, 2000; 83(9):69-72.
[4] Dawotola AW, Trafalis TB, Mustaffa Z, Van Gelder PH, Vrijling JK. Risk-based
maintenance of a cross-country petroleum pipeline system[J]. Pipeline systems
engineering and practice, 2013; 4(3):141-8.
[5] Mohamed AM, Saad SM. Development of risk assessment model for equipment within
the petroleum industry[J]. IFAC-PapersOnLine. 2016; 49(28):37-42.
[6] Priyanta D, Zaman M B. The development of a risk-based maintenance flowchart to select
the correct methodology to develop maintenance strategies of oil and gas
equipment[C]IOP Conference Series: Materials Science and Engineering. IOP Publishing,
2021; 1052(1): 012042.
[7] Dey PK. Decision support system for inspection and maintenance: a case study of oil
pipelines[J]. IEEE transactions on engineering management, 2004; 19;51(1):47-56
[8] Han ZY, Weng WG. Comparison study on qualitative and quantitative risk assessment
methods for urban natural gas pipeline network[J]. Hazardous materials, 2011; 15;189(1-
2):509-18.
[9] Muhlbauer W K. Pipeline risk management manual: ideas, techniques, and resources[M].
Elsevier, 2004.
[10] National Research Council (US). Committee for Pipelines, Public Safety, Scoping Study
on the Feasibility of Developing Risk-Informed Land Use Guidance near Existing, et al.
Transmission Pipelines and Land Use: A Risk-informed Approach[M]. Transportation
Research Board, 2004.
[11] N.S. Nandagopal B.Sc (Chem Eng), M.Sc, P.E. Pipeline Systems - Designing, Construction,
Maintenance and Asset Management [M/OL]. ISBN: 978-1-921007-00-2, 2012.
[12] Shafiee M, Chukova S. Maintenance models in warranty: A literature review[J].
Operational Research, 2013; 16;229(3):561-72
[13] Scekic V, Lilic V, Reko K. Management of Preventative Maintenance as a Factor of
Successful Technological Process[J]. No. 5 Int'l J. Econ. & L. 2012; 2:153.
[14] Priyanta D, Zaman M B. The development of a risk-based maintenance flowchart to select
the correct methodology to develop maintenance strategies of oil and gas equipment[C]
IOP Conference Series: Materials Science and Engineering. IOP Publishing, 2021;
1052(1): 012042.
78
[15] Cheng JC, Chen W, Chen K, Wang Q. Data-driven predictive maintenance planning
framework for MEP components based on BIM and IoT using machine learning
algorithms[J]. Automation in Construction, 2020; 112:103087.
[16] El-Abbasy MS, Senouci A, Zayed T, Mosleh F. A condition assessment model for oil and
gas pipelines using integrated simulation and analytic network process[J]. Structure and
Infrastructure Engineering, 2015; 11(3):263-81.
[17] Peng XY, Yao DC, Liang GC, Yu JS, He S. Overall reliability analysis on oil/gas pipeline
under typical third-party actions based on fragility theory[J]. Natural Gas Science and
Engineering, 2016; 34:993-1003.
[18] Jackson C, Mosleh A. Oil and gas pipeline third party damage (TPD)-a new way to model
external hazard failure, 2018[C]. Los Angeles, University of California, 2018.
[19] Muhlbauer WK. Pipeline risk assessment: The definitive approach and its role in risk
management, 2015[C]. Clarion Technical Publishers; 2015.
[20] Saaty TL. Decision making with the analytic hierarchy process[J]. International journal of
services sciences, 2008; 1(1):83-98.
[21] Purdy G. ISO 31000: 2009—setting a new standard for risk management[J]. Risk Analysis,
2010;30(6):881-6.
[22] International Organization for Standardization[S]. ISO 31000: Risk Management:
Principles and Guidelines. ISO; 2009.
[23] Xie M, Tian Z. A review on pipeline integrity management utilizing in-line inspection
data[J]. Engineering Failure Analysis. 2018; 1; 92:222-39.
[24] white, T. and Rovella, T., Pipeline Risk Modeling: Overview of Methods and Tools for
Improved Implementation[P/OL]. 2018.
[25] MacFarlane, Trevor (Dynamic Risk), Index Models and Applications an Industry
Perspective[P/OL], 2017.
[26] Xie M, Tian Z. A review on pipeline integrity management utilizing in-line inspection
data[J]. Engineering Failure Analysis, 2018; 92:222-39
[27] Babcock M. Evidence-‐Based Risk Communication and Pipeline Public Awareness[J]. 2017.
[28] Srivastava A, Gupta JP. New methodologies for security risk assessment of oil and gas
industry[J]. Process Safety and Environmental Protection. 2010; 88(6):407-12.
[29] Guo Y, Meng X, Wang D, Meng T, Liu S, He R. Comprehensive risk evaluation of long-
distance oil and gas transportation pipelines using a fuzzy Petri net model[J]. Natural Gas
Science and Engineering, 2016; 33:18-29.
[30] Kraidi L, Shah R, Matipa W, Borthwick F. An investigation of mitigating the safety and
security risks allied with oil and gas pipeline projects[J]. Pipeline Science and Engineering,
2021; 1(3):349-59
[31] Kraidi L, Shah RK, Matipa WM, Borthwick F. An analysis of the critical risk factors in
oil and gas pipeline projects using a comprehensive risk management framework. In
ARCOM Conference Proceedings 2018[C]. ARCOM 2018, (pp. 360-369).
79
[32] Labaka L, Hernantes J, Sarriegi JM. A holistic framework for building critical infrastructure
resilience[J]. Technological Forecasting and Social Change, 2016; 103:21-33.
[33] Guo Y, Meng X, Wang D, Meng T, Liu S, He R. Comprehensive risk evaluation of long-
distance oil and gas transportation pipelines using a fuzzy Petri net model[J]. Natural Gas
Science and Engineering, 2016; 33:18-29.
[34] X. Peng, D. Yao, G. Liang, J. Yu and S. He, Overall reliability analysis on oil/gas pipeline
under typical third-party actions based on fragility theory[J]. Natural Gas Science and
Engineering, Vol. 34 (Aug 31), pp. 993--1003, 2016.
[35] Balfe N, Leva MC, McAleer B, Rocke M. Safety risk registers: Challenges and guidance,
2014[C]. Technological University Dublin, Ireland 2014.
[36] Srivastava A, Gupta JP. New methodologies for security risk assessment of oil and gas
industry[J]. Process Safety and Environmental Protection, 2010; 88(6):407-12.
[37] Anifowose B, Lawler DM, Van der Horst D, Chapman L. Attacks on oil transport pipelines
in Nigeria: A quantitative exploration and possible explanation of observed patterns[J].
Applied Geography, 2012; 32(2):636-51.
[38] Whipple T, Pitblado R. Applied risk‐based process safety: A consolidated risk register and
focus on risk communication[J]. Process Safety Progress, 2010; 29(1):39-46.
[39] Mubin S, Mubin G. Risk analysis for construction and operation of gas pipeline projects
in Pakistan[J]. Engineering and Applied Sciences, 2008.
[40] Nnadi U, El-Hassan Z, Smyth D, Mooney J. Lack of proper safety management systems
in Nigeria oil and gas pipelines[J]. Delta, 2007.
[41] Onuoha FC. Oil pipeline sabotage in Nigeria: Dimensions, actors and implications for
national security[J]. African Security Review, 2008; 17(3):99-115.
[42] Li H, Sun R, Lee WJ, Dong K, Guo R. Assessing risk in chinese shale gas investments
abroad: Modelling and policy recommendations[J]. Sustainability, 2016; 26;8(8):708.
[43] Dawotola AW, Van Gelder PH, Vrijling JK. Multi Criteria Decision Analysis framework
for risk management of oil and gas pipelines[J]. RELIABILITY, Risk and Safety. London:
Taylor & Francis Group, 2010:307-14.
[44] Lu L, Liang W, Zhang L, Zhang H, Lu Z, Shan J. A comprehensive risk evaluation method
for natural gas pipelines by combining a risk matrix with a bow-tie model[J]. Natural Gas
Science and Engineering. 2015; 25:124-33.
[45] Rowland A. GIS-based prediction of pipeline third-party interference using hybrid
multivariate statistical analysis[D]. UK, Newcastle University, 2011.
[46] Wu WS, Yang CF, Chang JC, Château PA, Chang YC. Risk assessment by integrating
interpretive structural modeling and Bayesian network, case of offshore pipeline project[J].
Reliability Engineering & System Safety, 2015; 142:515-24.
[47] Macdonald KA, Cosham A. Best practice for the assessment of defects in pipelines–
gouges and dents[J]. Engineering Failure Analysis, 2005; 12(5):720-45.
80
[48] Mather J, Blackmore C, Petrie A, Treves C. An assessment of measures in use for gas
pipelines to mitigate against damage caused by third party activity[J]. HSE CONTRACT
RESEARCH REPORT, 2001.
[49] Akel S, Riegert F. Third-party interference: pipeline survey based on risk assessment[J].
Pipeline Engineering, 2011; 1;10(4).
[50] Sulaiman N, Tan H. Third party damages of offshore pipeline[J]. Energy Challenges and
Mechanics, 2014;1(1):3.
[51] Dolnicar S, Laesser C, Matus K. Online versus paper: Format effects in tourism surveys[J].
Travel Research, 2009;47(3):295-316
[52] Blair J, Czaja R F, Blair E A. Designing surveys: A guide to decisions and procedures[M].
sage publications, 2013.
[53] Bertot JC. Web-based surveys: Not your basic survey anymore[J]. The Library Quarterly,
2009;79(1):119-24.
[54] Aven T. Risk analysis[M]. John Wiley & Sons, 2015.
[55] Carpenter P, Henrie M, Okamoto Y, Liddell P. Analysis of PHMSA Spill Data for Pipeline
Spill Risk Analysis[C] PSIG Annual Meeting. OnePetro, 2019.
[56] Hao M J, You Q J, Yue Z. Risk analysis of urban gas pipeline network based on improved
bow-tie model[C] IOP conference series: earth and environmental science. IOP Publishing,
2017; 93(1): 012059.
[57] Jia M, Yu X, Song Q. Application of bow-tie technology in the risk management of urban
gas pipeline[J]. Ind. Saf. Environ. Prot., 2014;40:14-8
[58] Department of energy dose reduction technique (HNF-63 16 -FP., 5). U S 2000.
[59] Lu Z. The runway landing aircraft out of the risk analysis model based on Bow-tie[J]. Ind
Safety and Environ Protection, 2015; 41: 4-8.
[60] Zhang Y, Lv S, Wang W. Risk analysis of high pressure gas pipeline leakage based on
bow-tie model and IAHP[C] IOP Conference Series: Earth and Environmental Science.
IOP Publishing, 2020; 461(1): 012079.
[61] Kambiz M, Jun R, Charles R, Jin W. Application of a generic bow-tie based risk analysis
framework on risk management of sea ports and offshore terminals[J]. Hazardous
Materials, 2011;192(2): 465-475
[62] Liu J, ZHANG L. An Analysis of Hard Landing Events in Civil Aviation Based on an
Improved Bow-Tie Model[J]. Journal of Transport Information and Safety, 2016; 34(4):
57-62.
[63] Dawotola A W, Van Gelder P, Vrijling J K. Risk assessment of petroleum pipelines using
a com-bined analytical hierarchy process-fault tree analysis (AHP-FTA) [C] Proceedings
of the 7th international probabilistic workshop, Delft. 2009.
[64] Andrews JD, Dunnett SJ. Event-tree analysis using binary decision diagrams[J]. IEEE
Transactions on Reliability, 2000;49(2):230-8.
[65] Verma S, Kumar S. A Study of Dependability Modeling Methodologies for Safety-Critical
Systems[M]. In 2022 IEEE Delhi Section Conference (DELCON), 2022 (pp. 1-6). IEEE.
81
[66] Slatnick S, Angevine D, Cranefield J, Maddox C, Overstake M, Palmer L, Younan A.

Bow-ties use for high-consequence marine risks of offshore structures[J]. Process Safety
and Environmental Protection, 2022;165:396-407.
[67] Voicu I, Panaitescu F V, Panaitescu M. Risk management with Bowtie diagrams[C] IOP
Conference Series: Materials Science and Engineering. IOP Publishing, 2018; 400(8):
082021.
[68] EGIG gas pipeline incident 11th report, 2020[R].
[69] Park KS, Lee JH, Jo YD. An approach to risk management of city gas pipeline[J]. Process
Safety and Environmental Protection, 2004; 82(6):446-52.
[70] Hermansyah H, Nur Hidayat ME, Kumaraningrum AR, Yohda M, Shariff AB. Assessment,
Mitigation, and Control of Potential Gas Leakage in Existing Buildings Not Designed for
Gas Installation in Indonesia[J]. Energies, 2018;11(11):2970
[71] Schmidt M. Tolerable risk[J]. Chemical Engineering, 2007; 114(9): 69.
[72] Abdoul Nasser AH, Ndalila PD, Mawugbe EA, Emmanuel Kouame M, Arthur Paterne M,
Li Y. Mitigation of Risks Associated with Gas Pipeline Failure by Using Quantitative Risk
Management Approach: A Descriptive Study on Gas Industry[J]. Journal of Marine
Science and Engineering. 2021; 9(10):1098.
82
Acknowledgement
First of all, I want to say thanks to God for giving me the ability, knowledge, and insight
necessary to complete this endeavor.
Associate Professor Mao Jun Li from the Faculty of Mechanical and Vehicle Engineering
was my thesis supervisor, and I am glad and appreciative of his help. Throughout every phase
of my thesis preparation, he offered me unwavering, selfless support, advice, and guidance.
Second, I would like to express my thanks to the administration, faculty, and staff of
Hunan University, especially Mechanical and Vehicle Engineering, who have helped me the
last two (2) years by providing support, cooperation, and encouragement.
I also like to thank Kaila for his support during the study period, as well as the
encouragement and help I received from my Industrial Engineering colleagues.
In addition, I want to thank my family members—parents, siblings, wife, and friends—
who supported me during this time. It is impossible to overstate how patient and understanding
they are.
Last but not least, I want to express my profound gratitude to the governments of Tanzania
through TPDC and China for offering the MOFCOM scholarship master's program, which
made my studies in China fruitful.
83

LY2021046-TEMBA Final Document

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

LY2021046-TEMBA Final Document

Uploaded by

Copyright:

Available Formats

学校代号 10532 学 号 LY2021046

Dissertation of Master Degree

Risk Assessment of Petroleum Pipeline: Mtwara- Dar es

Candidate Name: Hassan Temba

B.Sc. in Industrial Engineering and Management (University of Dar es salaam) 2011

A thesis submitted in partial satisfaction of the requirements

for the degree of Master of Engineering

the Graduate school

Originality of statement of the dissertation

Author's signature： Date：

Authorization for the use of copyrights in academic dissertations

Author’s signature: Date:

Supervisor’s signature: Date:

Keywords: Gas pipelines; Bow-tie model; Risk analysis; Mitigation measures

关键词：天然气管道; 领结模型; 风险分析; 缓解措施

4.5. Gas Leakage Risk Control .................................................................................. 68

Table of Major Symbols and Units

d Pipeline diameter Inch/cm

p Pipeline operating pressure Bar/MPA

f Pipeline failure frequency No. of Failures/year

Definitions and Acronyms

consequences of potential adverse events are analyzed

holders, and fabricated assemblies.

TPD Third party damage

Chapter One: Research Background and Risk Statement

Figure 1. 1 NG from wellhead to consumption [14].

Figure 1. 2 Gas pipeline transportation system from production to consumption [11].

Tanzania Natural Gas Pipeline Overview

Figure 1. 3 Physical features of Tanzania [74].

Figure 1. 4 Mnazi Bay Processing plant [61].

Figure 1. 7 Tanzania Natural Gas Pipeline layout

Figure 1. 8 Tanzania Natural Gas Pipeline construction, 2014 [61]

Purpose of the study

Layout of the Paper

Chapter Two: Literature Review

2.1 Pipeline System

Figure 2. 2 Trans- Alaska Pipeline [28]

Table 2. 1 Facts on some well-known pipelines [10]

• Flood plains and potential for flooding.

2.2 Risk Concept

Figure 2. 3 Typical risk distribution of equipment [4]

Risk may be defined as perceived exposure or perceived uncertainty [29]

2.3 Pipeline Risk Management

Figure 2. 4 Pipeline risk management [37]

related to the construction, operation, and maintenance of the pipeline, as well as

2.3.1 Risk Identification

Table 2. 2 Critical Pipeline risk factors from the reviewed literatures

2.3.2 Risk Analysis

Table 2. 3 Main categories of risk analysis methods

establishes the risk picture

2.3.3 Pipeline Risk Analysis Models

Figure 2. 5 A Bow-tie Model diagram

C. Improved bow-tie model

Figure 2. 6 Improved bow-tie model diagram

(2) Fault Tree Analysis (FTA)

Figure 2. 7 Tree diagram for leakage incident of gas pipeline [64]

The probability of failure occurrence is performed by qualitative and quantitative means

Table 2. 5 Example of Qualitative Model

Table 2. 6 Qualitative Risk Scale

High Medium Low

B. Relative Assessment of the likehood Model

ii. Cold weather o Lightning

Table 2. 7 A risk index algorithm

学校代号 10532 学号 LY2021046