Proceedings of the 2012 9th International Pipeline Conference IPC2012 September 24-28, 2012, Calgary, Alberta, Canada

IPC2012-90164

RISK ASSESSMENT METHOD OF UNDERGROUND SALT CAVERN GAS STORAGE AND CASE STUDY
Jinheng Luo Tubular Goods Research Institute of CNPC Xian, Shaanxi, China Lifeng Li Tubular Goods Research Institute of CNPC Xian, Shaanxi, China

Xinwei Zhao Tubular Goods Research Institute of CNPC Xian, Shaanxi, China

Ke Wang Tubular Goods Research Institute of CNPC Xian, Shaanxi, China

Ke Cai Tubular Goods Research Institute of CNPC Xian, Shaanxi, China

ABSTRACT With the increasing development of underground gas storage in China, greater focus is being placed on the economic and safe operation of these facilities. Storage facility operators are examining the factors that affect the life safety and economic risk in an effort to prevent the occurrence of accidents. To evaluate the risk, an underground salt cavern gas storage facility can be divided into three separate units: underground facilities, surface plant facilities and gathering lines. An integrated analysis approach was used to examine eight different hazards that could contribute to the facility risk: corrosion, erosion, hydrate formation, equipment failure, operation related, mechanical damage, geologic effects and natural forces. A fault tree approach was used to assess the risk for the underground facilities. A risk indexing method was used to assess the surface plant facilities and gathering lines. To demonstrate this approach, this paper presents a risk assessment of one underground salt cavern gas storage operation in China.

Pingdingshan and Yunying, an aquifer storage facility at Maqiu, and storage in depleted oil-gas reservoirs at Ordos Basin and Xiangguosi [1]. Although USCNGS can be used effectively for seasonal peak-shaving and emergency gas supply, USCNGS is susceptible to undesirable impacts from hazards including; corrosion, erosion, hydrate formation, equipment failure, operation related, mechanical damage, geological effects and natural forces. These hazards can reduce the safety and reliability of USCNGS, and even cause disastrous incidents such as gas releases, instability of the salt cavern and surface subsidence. Therefore, the factors that affect the safety and reliability of underground gas storage facilities must be well understood to ensure the safe and economic operation of these facilities. Gas storage facility operators must evaluate a variety of measures to identify effective means for decreasing the occurrence of undesirable impacts from the various hazards. To accomplish this, a risk-based assessment method for USCNGS was applied to solve this problem. 2 CLASSIFICATION OF ASSESSMENT UNIT The USCNGS facility can be divided into three subsystems: underground facilities, surface plant facilities and gathering lines. The underground facilities consist of a closed system with three components: underground cavern, wellbore and wellhead. Surface plant facilities include various buildings for metering, drying and compressing the gas as it enters and leaves the facility. The gathering lines connect the surface plant facilities and the underground facilities. Each of the three sub-

1 INTRODUCTION Underground salt cavern natural gas storage (USCNGS), is an effective method to store natural gas to ensure a reliable gas supply for transmission pipeline networks and can play an important role in meeting delivery demand during peak periods. In China at present, gas is stored in both depleted oil-gas reservoirs and salt caverns. New gas storage facilities such as LAMADIAN Storage DAZHANGTUO Storage associated with the Shan-Jing pipeline project and JINTAN cavern storage. Construction plans are underway for a second westeast gas pipeline project, with salt cavern storage facilities at

Copyright 2012 by ASME

systems can be further sub-divided into subunits for the risk assessment as shown in Figure 1. 3 IDENTIFICATION OF RISK FACTORS 3.1 Risk analysis Underground gas storage facilities have two main functions: store gas such that it is not released to the surroundings, and supply gas reliably on demand to the pipeline system. If an event causes the facility to not meet either of these functions, it can be defined as a failure of the USCNGS. Therefore, two failure modes were identified: release of gas and reduced deliverability. In the risk analysis presented here, both failure modes were considered for underground facilities, while only releases were considered for surface plant facilities and gathering lines. The gas released from an underground facility (e.g. cavern, wellbore and wellhead) may enter the atmosphere or a geological formation above the cavern. Atmospheric releases may result in a fire or explosion, bringing casualties and significant economic losses. Reduced deliverability from an underground facility mainly affects the economics of the facility and operation efficiency, including extra repair costs. Similarly, releases from surface plant facilities and gathering lines will enter the atmosphere which could result in jet fires, increasing the life safety risk to exposed personal and economic risk due to the lost gas. Note that the environment effects of natural gas releases to the atmosphere or to unintended geological formations were not considered in this analysis. 3.2 Analysis of incident causes for USCNGS A statistical analysis of incidents occurring in the operation of underground storage facilities showed that of 23 reported incidents, seven were caused by cavern failure, 10 were due to wellbore failure, three sue to wellhead failure, 2 due to incorrect operation, with one incident where the cause was not identified [2]. Similarly Figure 2, shows that the failure causes noted for underground gas storage facilities can be sorted as follows (from most to least frequent): casing failure, poor cement quality, packer failure, salt creep, communication with adjacent cavern due to operating practices, roof collapse, pipe elbow failure connecting with wellhead, flange failure, pipeline failure, overfilling and unavailable reasons [1]. Incident reports for surface plant facilities and gathering lines in USCNGS facilities are not generally available, so incident causes for similar facilities (e.g. compressor, heat exchanger, air-cooler, tank and separator) were used for reference. The statistical results indicate that incident causes in these similar facilities include: design and manufacturing defects, improper installation of equipment, wall loss and cracking due to corrosion and erosion, incorrect operation, fatigue, blockage and natural disasters [3]. The distribution of incident causes associated with the urban gas supply system reported from 2003 to 2008 in China were considered to provide some insight into the likely causes of failure for gathering lines in USCNGS facilities. The statistical results show that third party damage is the most common cause of failure, with other causes noted to include corrosion, incorrect operation and design [4]. 3.3 Risk factor identification and classification

To identify the factors that contribute to risk at USCNGS facilities, the failure modes noted in Section 3.2 were compared to each of the seven sub-units shown in Figure 1. The following eight factors were identified: corrosion, erosion, hydrate formation, equipment failure, operation related, mechanical damage, geological effects and natural force. Each of these factors was further reviewed to determine how each could affect the performance of each sub-system. This resulted in a total of 45 specific effects as shown in Table 1. 4 RISK ASSESSMENT METHOD The three sub-systems of a USCNGS each have different functions, configurations and failure modes as mentioned in Section 2. Therefore each sub-system requires a somewhat different method to performing a risk assessment. The basic components of these methods, however, are the same: failure probability analysis, consequence analysis and risk analysis. The following sections describe the risk assessment method used for each sub-system. 4.1 Risk assessment method for underground facilities based on fault tree 4.1.1 Calculation of failure probability Underground facilities are generally more complex than gas pipelines resulting in more potential failure modes (Figure 3). These multiple failure modes can be described effectively using the fault tree method to determine the overall failure probability of underground facilities. The fault tree method can define multiple release pathways as well as identify the combination of events required to cause reduced deliverability. The steps required to assess the risk assessment for underground facilities are as follows: 1) Establish fault trees The failure of underground facilities was considered as the top event, with gas leakage and reduced deliverability as secondary events as shown in Figure 4. A, B, C, D in Figure 4 represent four intermediate events including leak to atmosphere, leak to underground, operation impairment and operation interruption which are used to develop further subfault trees [5]. 2) Estimate basic event probabilities Estimating basic event probability is the key step to calculate the failure probability for underground facilities. According to the fault trees established for the underground facilities, 18 basic events were identified. To estimate the probability of occurrence of a basic event, a combination of historical data and engineering models were used. The probability of occurrence for equipment failures, roof collapse, overlying layer instability and leak though cement were estimated through a review of historical data for storage caverns and oil field wells. Where historical data were not available, engineering models were developed to calculate basic event probabilities. These models included wellhead particle erosion, hydrate plug formation in pipe, earthquake probability and hazards, casing leakage and cavern closure. 3) Calculate probability of failure The basic event probabilities are substituted into the fault tree logic to define a probability of occurrence for each pathway through the fault tree. The probability of occurrence of the tope event and any intermediate event in the fault tree can

Copyright 2012 by ASME

then be calculated as the sum of all pathways that contribute to that event. 4.1.2 Consequence estimation The consequences of failures occurring in the underground facilities are calculated using a variety of models which consider life safety, economic and environmental impacts caused by leakage or reduced deliverability events. Failure consequences are specifically estimated for different event types, event locations and failure severity (i.e., small, large, rupture leak events and partial or complete impairment of operation). 1) Natural gas leakage For a leakage event, all effects on life safety, economics and the environment should be considered in the consequence models. Life safety consequences should consider casualties due to a jet fire. Economy consequences are assumed to include: cost of lost product, facility repair costs (including damage due to a jet fire) and revenue lost due to service impairment or interruption. The environmental impact of natural gas releases was assumed to be negligible and was not considered in the consequence analysis. For underground facilities, the consequences for three leak sizes were considered: small, large and rupture. The leakage rate is a key parameter required to calculate leakage consequence. For leak to underground, a choked flow model can be used to estimate the leakage rate of small and large leaks, as described by Beggs [6] and represented by Equation 1.

qSC =

2 k 1 Cn p1d ch 2 k ( )(y k -y k ) k 1 T1Z1 g

Where qSC is gas leakage rate, m3/d; Cn is a constant; p1 is well pressure, kPa; d ch is diameter of the hole, mm;

is g

the specific gravity of natural gas; T is well temperature, K; Z is z-factor of gas; k is CP / CV of natural gas; k is the

specific heat ratio, dimensionless; and y is a function of k, dimensionless. For a rupture event to underground, if the change in cavern pressure with time during the leak event is not considered, Equation 2 can be used to estimate the gas flow rate:

pw pe 2 Kh 2 log e (r (t ) / rw ) Where q (t ) is the gas flow rate, m3/s; K is horizontal q (t ) =

temporary interruption and long-term interruption. The consequence estimation for reduced deliverability events focuses on the economic impact including gas delivery revenue lost due to operation interruption and incremental costs for repair or replacement of damaged equipment. 4.1.3 Risk estimation The objective of a risk assessment for underground gas storage is to estimate the risk by combining the results of the failure probability and consequence analyses with a focus on life safety and economic risk. Individual life safety risk due to leak events is defined as the annual mortality rate due to leakage events for any person living or working near. Economic risk can be estimated by multiplying the probability of failure events and failure consequences. Economic risk for four events including leak to atmosphere, leak to underground, operation interruption or operation impairment were considered. The ALARP principle can be used to evaluate whether individual safety risk is acceptable. The unacceptable risk value and widely acceptable risk value in China are 10-4 times/year and 10-6 times/year, respectively [7]. The acceptability of economic risk can be judged by a cost-benefit analysis. 4.2 Risk assessment method for surface plant facilities At present, the risk assessment methods used for oil and gas pipelines are mature and are widely applied, but specific risk assessment methods for facilities are less mature. The risk assessment methods used for facilities that comply with national laws and regulations are typically qualitative and provide results that assist in designing a risk reduction program. This paper assesses the risk based on the quantitative risk analysis approach described in API581 [8] which ranks the risk to identify the main factors contributing to the risk or the main equipment or component with the highest risk. With this information, measures can be taken to reduce the risk. 4.2.1 Failure probability estimation The failure probability analysis begins with a database of generic failure frequencies for onshore refining and chemical processing equipment. These generic frequencies are then modified by two terms, the equipment modification factor (FE) and the management systems evaluation factor (FM), to yield an adjusted failure frequency as shown in Equation 3. The details of these calculations are provided in API581 [9]. 3 Frequency adjusted = Frequency generic FE FM 4.2.2 Consequence estimation The consequence estimation for surface plant facilities includes seven steps: 1) determine the characteristics of the stored natural gas; 2) choose a series of hole sizes to cover the possible range of expected leaks; 3) estimate the potential quantity of gas leakage; 4) estimate the potential leakage rate; 5) specify the leakage mode to determine what simulation method is required to estimate consequences; 6) assess the impact of leakage response and mitigation systems on the leak event; 7) estimate the affected area and cost of the leak event including fire, explosion, operation interruption, etc.. 4.2.3 Risk estimation The risk associated with each equipment sub-system is calculated as the sum of the risk for each failure scenario. Economic and life safety risks are summed separately and

permeability of the formation into which the gas is leaking, m/s; h is height of the permeable formation, m; is the gas viscosity, Pa.s; pw is wellbore pressure, Pa; pe is pressure at the gas/water interface, Pa; r (t ) is gas front position relative to the wellbore, m; and rw is the well radius , m. For a less conservative estimate of the flow rate, the change in cavern pressure with time needs to be considered, however, this would require implementation of a much more complex pseudo-transient flow model. 2) Reduced deliverability For reduced deliverability events, four levels of severity were considered: minor impairment, major impairment,

Copyright 2012 by ASME

presented as risk values in terms of Yuan/year and fatalities/year, respectively. The risk matrix method can be used to evaluate whether the two risks are acceptable or not. 4.3 Risk assessment of gathering lines The risk assessment method for pipelines described by Muhlbauer [10] has been widely used all over the world. This method was adapted for analyzing gathering lines since some parts of the indexing system are not consistent with specific gathering line conditions in China. As a result, 12 assessment indices were modified including the alarm system and public education indices in the third party factor. In addition, the index for internal corrosion detection of the corrosion factor and poisoning screening index of the incorrect operation factor were deleted. In the standard approach for pipelines, the same event probability is used for the third party damage factor, corrosion factor, incorrect operation factor and design factor, but in fact these are different, so a weighting coefficient, based on accident statistics, was introduced to calculate the risk index for gathering lines as shown in Equation 4.

V=

w x
l

i i

Where V is the relative value of risk, w is the weighting coefficient determined from analysis of accident statistics, x is the score of the risk factor index and l is the leakage index. 5 EXAMPLE APPLICATIONS 5.1 Basic outline of application objects To demonstrate the application of the risk assessment model, a typical USCNGS facility in China was described as: Salt cavern volume 1.05105 m3 Stored product is natural gas Storage operating pressure is between 7MPa and 14MPa Temperature in the middle of the salt cavern is 326.1 K The injection-withdrawal string diameter is 177.8m Average wellhead temperature is 298.15K Gathering lines are 273mm20mm, 16Mn seamless steel. The surface plant facilities have been on production since 2007, including a SCADA system to gather data and monitor the facility operation. 5.2 Analysis of risk assessment results The risk assessment was carried out for the cavern well, plant and a single-well gathering line according to the risk assessment method described for an underground salt cavern gas storage facility. For the cavern well, the most serious condition of a wellhead rupture event, the individual risk for the residents or employees (maintenance works or inspectors) that are within 50 meters of the wellhead are 2.47210-5 and 2.0610-6, respectively. Resident risk is higher than employees because the proportion of time spent within 50 meters of the wellhead by residents was assumed to be greater than employees. According to the acceptance criterion established in Section 4.1, the individual risk is in the risk tolerable area, but, according to ALARP principle, action should still be taken to minimize the risk. As shown in Table 2, leak to underground has higher economic consequences than a leak to atmosphere because the

duration of the underground leak was assumed to be longer since it is more difficult to detect and control than a leak at surface. However, the economic risk caused by natural gas leakage and reduced deliverability shows that the risk of leak to atmosphere is much larger than a leak to underground. This is because the probability of a leak to atmosphere is larger than a leak to underground, which outweighs the effect of the higher consequence for the underground leak. The results show that the probability of operation impairment is also high. Therefore, the probability of occurrence for the leak to atmosphere and operation impairment should be strictly controlled. For example, to reduce the number of operation impairment events, measures should be taken to prevent the occurrence of hydrate blocks, equipment failure, roof collapse, and overlying layer and cavern collapse. The large economic risk associated with long-term interruption was caused by the financial loss due to cavern abandonment. The results of the risk assessment for the surface plant facilities indicate that the risk associated with failure of the compressor and processing systems is much larger than for the pipeline system, with the risk associated with the compressor being the largest in the compressor system; and the air-cooler risk being the largest in the processing system. Figure 5 shows the results of analyzing 34 pipe segments of pipe in the surface facility pipe system. The equipment and injury risk associated with P2112~P2118 pipe segments from the discharge of the compressor to the discharge from the buffer tank are large, with P2113 being the largest in the system. This is mainly due to the relatively high operating pressure and temperature in this section of pipe. By applying these risk assessment methods for underground salt cavern gas storage, the facility administrators will know the risks associated with each component of their facilities so that effective actions can be taken to control the risk and reduce the occurrence of accidents. 6 SUMMARIES Due to the complex systems required for an USCNGS facility, there are many risk factors that can impact the facility operation. Operation managers must ensure the safe and reliable operation of these facilities to make them economically beneficial. Conducting a risk assessment for an USCNGS provides a rational, transparent means to manage the risk, to ensure public and worker safety, protect property and facilities, maintain social stability and reduce the occurrence of incidents. ACKNOWLEDGMENTS The authors would like to express their appreciation to the China National Petroleum Corporation (CNPC) for supporting the research (Project No. 2008B-2903-1) and the cooperation with C-FER Technologies. REFERENCES [1] LI Lifeng, ZHAO Xinwei, LUO Jinheng, et al. The Analysis of Failure and Preventive Measures on Underground Salt Cavern Gas Storage. Oil & gas storage and transportation [J].2010, 29(6):407-410.

Copyright 2012 by ASME

[2] D J Evans. An appraisal of underground gas storage technologies and incidents for the development of risk assessment methodology. RR605 Research Report. [3] Liu Xiangchen, Zhang Bingshu. Petroleum and chemical equipment, accident analysis and prevention (3rd edition), Chemical Industry Press,2011. [4] Du Yan et al.Accident Analysis of Gas pipeline[J].Pipeline Technique and Equipment, 2009,2(3):1718. [5] Patrick Wickenhauser, Brian Wagg, et al. Quantitative risk assessment-natural gas storage facilities[C]. IPC 200610411 [6] Beggs, HD. Gas Production Operations. Tulsa, USA: OGCI Publicaitons,1984. [7] Cao Zheng, Liu Mao. Individiual risk analysis and researches of city gas pipelines. china public security academy edition.2009(12)421-25. [8] American Petroleum Institute. Risk based resource document API 581[S].2000. [9] Wang Ke, Luo Jinheng, Zhao Xinwei et al. Risk Assessment of Underground Natural Gas Storage Station, the 8th International Pipeline Conference (IPC2010). 2010, September 27 - October 1. Calgary, Alberta, Canada. [10] W. Kent Muhlbauer. Pipeline Risk Management Manual, 2nd ed. Houston, TX: Gulf Publishing Co., 1996.

Copyright 2012 by ASME

Figure1 Risk assessment sub-systems for an USCNGS

Figure 2 Summary of incident types for USCNGS

Figure 3 Schematic of potential leak paths from a cavern storage well

Copyright 2012 by ASME

6.00E-04 5.00E-04

Equipment Injury

R i s k m 2 / y e a r

4.00E-04 3.00E-04 2.00E-04 1.00E-04 0.00E+00

Figure 5 Risk assessment result for pipe unit of surface plant facilities Table 1 Risk factors of USCNGS Numbers 1 Corrosion Risk Factors External Corrosion Internal Corrosion Bacteria Corrosion Stress Corrosion Manufacturing Defects Specific types External Corrosion Internal Corrosion Bacteria Corrosion Stress Corrosion Defective pipe Defective pipe seam Defective wellhead assembly defective wellhead valve Defective pipe girth weld , Defective fabrication weld, thread joints failure wrinkle, bend or buckle O-gasket failure, control/release valve failure, cementation failure, casing failure, packer failure, seal/pump packing failure injection-withdrawal string failure, apparatus and instruments failure Internal sand ,salt erosion Hydrate Formation Fault, abandoned well, aquifer, permeability defective cap rock Overfilling, high pressure operation, low pressure operation, maintained failure salt cavern closure, roof collapse communication with adjacent cavern due to operation The damage caused by the third party vandalism Pressure changes, metal fatigue Extreme temperature, hurricane, rainstorm, lightning, formation movement, earthquake Unavailable reason flood,

P2101

P2102

P2103

P2104

P2105

P2106

P2107

P2108

P2109

P2110

P2111

Pipelines

P2112

P2113

P2114

P2115

P2116

P2117

P2118

P2201

P2202

P2203

P2204

P2205

P2206

P2207

P2208

P2209

P2210

P2211

P2212

P2213

P2214

P2215

P2216

Equipment Failure

Welding Construction Defects

Equipment failure

3 4 5

Erosion Hydrate Formation Geological Structure

Erosion Hydrate Formation Geological structure defect

Operation related

Operation related

Mechanical Damage

The third damage

party/mechanical

Mechanical fatigue, vibration 8 Natural force Climate /external force

Copyright 2012 by ASME

Table 2 Example results for risk assessment of underground facility Event rate event/year 2.8610-1 1.1810-1 4.1210-3 1.9810-4 3.0510-4 6.0410-6 1.610-1 7.4310-2 2.3610-1 1.8310-3 Economic consequence Thousand Yuan /event 97.5 186.1 6754 4633.2 4474.4 7290.6 43.3 43.3 43.3 171740 Economic risk Thousand Yuan /year 27.85 22.05 27.83 0.92 1.37 0.04 6.9 3.2 10.2 314.3

Failure event

Leak size small large rupture small large rupture minor major temporary long-term

Leak to atmosphere Leak to underground Operation impairment Operation interruption

Copyright 2012 by ASME