A

Proceedings of the 2022 14th International Pipeline Conference

tte
IPC2022

nd
September 26-30, 2022, Calgary, Alberta, Canada

ee
R
ea
d-
O
IPC2022-86833

nl
y
C
op
y
A QUANTITATIVE RISK ASSESSMENT FRAMEWORK FOR NATURAL GAS
STORAGE WELLS
Thomas Dessein1, Brent Ayton1, Alex Fraser1, Shawn Smith1, Mari Shironishi2, Travis Sera2
1
Integral Engineering, Edmonton, AB, Canada
2
SoCalGas, Los Angeles, CA, USA

ABSTRACT NOMENCLATURE
A quantitative framework for risk assessment of natural gas 𝑐 consequences of a failure
storage wells, including the wellhead and connected piping, has
𝐶 conditional expression, which is either true or false
been developed to assess SoCalGas’s underground gas storage
sites in California. The approach has been developed to meet and 𝑐𝑉𝐶 historical incident rate calibration factor for vehicle
exceed the risk assessment requirements of API RP 1171 collisions
(incorporated by reference in U.S. regulation 49 CFR 192.12) 𝐷𝑣𝑖→𝑠𝑖 damage due to the impact between vehicle vi and
and the recent changes to the California Code of Regulations. the wellhead or associated piping section si
Further, several of the recommendations made in the recent
PHMSA study, “Risk Assessment and Treatment of Wells” 𝐹𝑉𝐶 annual frequency of failures (failures/well-year) due
(2021), have been addressed and incorporated. to vehicle collisions
𝑓𝑣𝑖𝑠,𝑠𝑖 factor to account for barriers that reduce the
The framework uses a dynamic fault tree to aggregate the probability of a collision between a vehicle and the
barrier failure rates from over 80 potential failure mechanisms wellhead or associated piping section si
to quantify the combined probability of an accidental release to 𝐼[ ] ‘indicator function’ which equals 1 if the
the atmosphere and the resulting hazards. The modular conditional expression within the [ ] is true and 0 if
architecture allows operators to use threat-specific models with it is false.
differing levels of sophistication. Additionally, the framework
accounts for the interplay between barriers to failure in a well, 𝐿𝑒𝑥𝑝,𝑠𝑖 length of the wellhead or associated piping section
the benefits of continuous monitoring, and the effect that si exposed to the potential for a vehicle collision
wellhead spacing, cement quality, and well-inflow performance 𝑁 number of Monte Carlo simulation trials
have on the expected consequences. p probability of a failure
Priority to develop quantitative models is given to the 𝑃𝐶 probability of failure for well component C
threats that potentially have high probability or high (ex. flange, hanger, tubing, casing)
consequences and to threats with effective mitigation options, 𝑃𝑟 probability of an accidental release event
such as corrosion and external interference threats. For threats
with very low consequences or likelihood of occurrence, simple r risk of a failure
models with conservative assumptions are typically sufficient 𝜎𝑣𝑚 von Mises stress
because the contribution to overall risk is low. This process
𝜎𝑎𝑥𝑖𝑎𝑙 stress component in the axial direction
minimizes the overall analysis complexity and allows mitigations
to be tailored to the higher-risk threats. 𝜎ℎ𝑜𝑜𝑝 stress component in the hoop direction

This paper describes example assessments to illustrate how

the framework can quantify the benefits of integrity management
activities, such as an erosion monitoring program, continuous
pressure monitoring of the annuli, and adding protections to
minimize risk from vehicle collisions.
Keywords: Underground Gas Storage, Risk Assessment

1
Contact author: tdessein@integraleng.ca

1 Copyright © 2022 by ASME

1. INTRODUCTION
The oil & gas industry utilizes risk and reliability estimates
to optimize the structural integrity management of pipeline,
facility, storage, and distribution assets. These approaches can be
used to ensure the health and safety of workers and the public,
minimize the impacts on the environment, and mitigate financial
risk. A quantitative framework for risk assessment of natural gas
storage wells, including the wellbore, wellhead, and connected
piping, has been developed to assess SoCalGas’s underground
gas storage sites in California. The approach has been developed
to meet and exceed the risk assessment requirements of
API RP 1171 (incorporated by reference in US regulation
49 CFR 192.12) and the recent changes to the California Code
of Regulations [1, 2, 3]. Further, several recommendations made
in the recent PHMSA study, Risk Assessment and Treatment of
Wells [4], have been addressed and incorporated.
The framework uses a dynamic fault tree to aggregate the
barrier failure rates from potential failure mechanisms to
quantify the combined probability of an accidental release to the
atmosphere and the resulting hazards. The modular architecture
allows operators to use threat-specific models with differing
levels of sophistication. Additionally, the framework accounts
SoCalGas and Integral reviewed the literature to establish
the historical precedent of threats specific to underground gas
storage reservoirs, wells, connected piping, and, more broadly,
to similar facilities such as those used for CO2 sequestration,
offshore platforms, and processing plants. A detailed list of
sources is provided in Section 9. The following categories of
sources were reviewed:
• Published technical papers and reports focused on risk
assessments and historical failures,
• Failure databases that cover specific equipment used in
well completions at storage facilities, and
• US and international standards and regulations.
The initial list of threats established through the literature
review was then supplemented through workshops with subject
matter experts (SMEs) that have long-term practical experience
with storage well operation. This effort identified more than
80 potential threats applicable to natural gas storage in depleted
hydrocarbon reservoirs. The list of threats was organized into the
eleven threat categories shown in Table 1.

Completions
Reservoir &
for the interplay between barriers to failure in a well, the benefits

Connected

Wellhead

Caprock
Piping
of continuous monitoring, and the effect that wellhead spacing,

Well
Threat Categories
cement quality, and well-inflow performance have on the
expected consequences.
Corrosion • • •
The threats to gas storage wells and the risk framework are
described in Section 2, with Section 2.3 describing the Erosion • • •
constraints and requirements considered when developing the Manufacturing Defects • • •
risk framework to model these threats. The process to model the
Installation Defects • • •
overall well failure rates is described in Section 3, the approach
used to model failure rates of individual barriers in a well is Mechanical Damage • • •
described in Section 4, and the consequence assessment models Equipment Failure • • •
are described in Section 5. The framework can quantify the
External Interference • • • •
benefits of integrity management activities, such as an erosion
monitoring program, continuous pressure monitoring of the Well Intervention • •
annuli, and adding protections to minimize risk from vehicle Incorrect Operations & Maintenance • • • •
collisions. A more in-depth discussion of the use of this
framework for corrosion management is provided in the Weather & Outside Forces • • • •
accompanying paper, IPC2022-86794 [7], and for external Geological Uncertainty •
interference threats is in IPC2022-86734 [8].
TABLE 1: THREAT CATEGORIES AND AFFECTED
2. BACKGROUND SYSTEM COMPONENTS
2.1 Threat Identification
Both applicable regulations in California – API RP 1171 and
the recent changes to the California Code of Regulations –
require operators to develop a program to manage risk that
includes identifying potential threats to the storage operation
[1, 2, 3]. API RP 1171 includes a high-level description of
common potential threats. While the CalGEM regulations do not
explicitly enumerate potential threats, many are mentioned
throughout the regulation. An operator may supplement these to
identify potential threats more comprehensively.

2 Copyright © 2022 by ASME

2.2 Risk Framework
The basic definition of risk is provided in Equation 1, where p is
the probability of failure per year leading to an unplanned release
and c is a measure of the consequences. The assessed risk has the
same units as the consequence measure.
𝑟 =𝑝 ×𝑐 (1)
A fully quantitative risk framework uses a comprehensive set of
models to estimate the two elements of risk. The probability of
failure requires models for each threat applied separately to each
well barrier, considering the specific operating conditions and
component attributes (ex., pressure, wall thickness, yield
strength, age). Several consequence measures could be assessed,
including life safety, environmental impact, and financial
impact [4]. Life safety consequences are most often addressed in
storage risk assessments and are the focus of this paper.
However, the total volume of gas released is the most direct
measure of environmental impact and is readily assessed with
the framework described here [4]. Life safety risk for an ignited
natural gas release is assessed by calculating the release rate, the
hazard area from the resulting jet fire model, and the thermal
radiation dosage to people or equipment within the area. This
dosage is accumulated in time to estimate the number of potential
fatalities and whether any equipment in the area would be
damaged or progress to failure with another ignited release (a
knock-on failure). This calculation accounts for the probability
of ignition and the uncertainty in the population present. In this
paper, we have focused our discussion on the release rate, jet fire,
and knock-on calculations, where we have made the greatest
improvements over the approach described in the recent PHMSA
study, Risk Assessment and Treatment of Wells [4].
Using this approach, the rates of failure and the associated
consequences can be quantified so that the operator can
demonstrate if the risk of an operation is tolerable. This also
enables the operator to optimize decisions to use resources
effectively to reduce the risk. This approach addresses the
shortcomings of relative ranking approaches with limited ability
to reflect complex threat interactions and other methods that
have a singular focus on specific threats (ex., assessments of
corrosion in isolation).
Each threat is initially assessed using simple models with
conservative assumptions or by reviewing the historical incident
records. For threats with very low consequences or likelihood of
occurrence, this approach is typically sufficient because the
contribution to overall risk is low. Quantitative models are then
developed for threats that potentially have high probability or
high consequences and for threats with effective mitigation
options, such as corrosion and external interference threats. This
process minimizes the overall analysis complexity and enables
mitigations to be tailored to the higher-risk threats.
3 Copyright © 2022 by ASME
2.3 Risk Framework Requirements
The solution developed to assess risk for storage wells was
designed to have the following characteristics:
• Comprehensively assesses the probability of occurrence as
a function of time for all combinations of barrier failures
and failure modes (hole sizes). See Section 4.
• Calculates the gas release rate for each combination of
barrier failures and failure modes, accounting for all flow
resistance elements along the release path, including the
reservoir inflow performance, and characterizes the
probability of ignition. See Section 5.1.
• Displays the results individually for all scenarios and
aggregates the results by threat, threat category, barrier,
and release rate. See Section 3.
• Considers that certain threats cause multiple-barrier
failures simultaneously and that these should not be treated
as independent events. Examples include vehicle collisions
and landslides. See Section 3.
• Reflects the influence of monitoring systems on the
sequencing of barrier failures that can go undetected,
leading to a release to the atmosphere. See Section 3.
• Accounts for the probability that unscheduled activities
required to address leaks may lead to additional well
intervention related failures. See Section 3.
• Calculates separate failure probabilities for each measured
metal loss anomaly on the casing. See Section 4.2.
• Automatically segments the tubing, casing, and cement to
efficiently capture the differences in release rate with depth
due to the changes in cement quality along the well and the
difference in the flow path length. See Section 5.1.
This solution addresses and incorporates several
recommendations made in the recent PHMSA study, Risk
Assessment and Treatment of Wells [4]. Examples include
accurate estimation of release rates and thermal radiation hazard
zones, methods to optimize well entry frequency based on well
condition, and the use of structural reliability models to estimate
the probability of failure of measured metal loss anomalies on
the casing.
3. METHODOLOGY
Unlike pipelines, facility equipment, and other single-
barrier pressure containment components, wells can be
constructed with several physical barriers preventing leaks to the
atmosphere. To accurately estimate the probability of a release,
a model must combine the individual barrier failure probabilities
to reflect the construction of the well. In a single-barrier well,
with flow in the production casing, a failure of the casing above
the top of the cement that surrounds the casing could lead to a
release to the atmosphere. Double-barrier wells are wells with a
secondary annulus that can be monitored for changes in pressure
resulting from one of the primary barriers being breached. For
these double-barrier wells, multiple barriers need to fail
simultaneously for a release to the atmosphere to occur. An
example of a double-barrier well with tubing-only flow is
illustrated in Figure 1, showing leak paths through the tubing and
packer primary barriers.
AND gate (PAND), which only reaches failure if the input
components fail in a prescribed order [5]. Release paths 1 and 2
in Figure 1 above require a PAND gate to correctly model the
interactions between barriers, as shown in Figure 2. Note that a
fault tree is read from the bottom to the top, with basic initiating
events shown as circles in the bottom layer and resulting
intermediate events and the final top event shown as squares that
are found at the output of a logic gate.

Atmospheric
flange Release

hanger

OR
Release path 1 Release path 2 Release path 3 …

PAND

PAND
1 2 1 2

Wellhead
Tubing Casing Packer Flange
Leak
leak corroded leak leak

tubing

AND
casing
Hanger Flange
packer leak leak

FIGURE 2: DYNAMIC FAULT TREE

FIGURE 1: STORAGE WELL SHOWING A SUBSET OF
POSSIBLE LEAK PATHS
If the barrier failure probabilities are assumed to be small,
the probability of a release for the example shown in Figure 1
can be approximated2 by Equation 2.
𝑃𝑟 ≈ 𝑃𝑡𝑢𝑏𝑖𝑛𝑔 ∙ 𝑃ℎ𝑎𝑛𝑔𝑒𝑟 ∙ 𝑃𝑓𝑙𝑎𝑛𝑔𝑒 + 𝑃𝑝𝑎𝑐𝑘𝑒𝑟 ∙ 𝑃𝑐𝑎𝑠𝑖𝑛𝑔 + 𝑃𝑓𝑙𝑎𝑛𝑔𝑒
If the tubing-casing annulus is monitored for changes in
pressure, the mode of failure of the casing affects the sequencing
of events that can lead to a release. For a burst failure of the
casing to occur, the inner barrier (tubing or packer) needs to fail
after the casing has corroded to a point where it would not handle
the full pressure. Otherwise, the rise in pressure in the annulus
between the tubing and casing can be detected, and the operator
can perform a well workover to remedy the leak before a release
to the atmosphere can occur. The same concept applies to wells
with multiple casing strings.
A dynamic fault tree can be represented equivalently by a
directed graph [6], as shown in Figure 3. This form of the fault
tree is better suited to automation and provides a clear visual
representation of the release flow paths in the context of a well.
The sequencing constraints (PAND gates), which only reach
failure if the input components fail in a prescribed order, are
reflected in the directed graph by the open circles surrounding
(2) the node. Integral has developed a solution that can
automatically generate a directed graph from the information on
a well completion diagram or from structured data stored in a
WellView software database.
tubing hanger flange
packer casing
Release
flange

The combination and sequence of barrier failures required

for a release can be modelled using a dynamic fault tree.
Dynamic fault trees extend the set of logical Boolean gates used
in static fault tree models, AND & OR, to include logic gates that
consider the sequence of events. One example is the priority FIGURE 3: DIRECTED GRAPH

2
The probability of either of two independent events, A or B, occurring can be
calculated as P(A or B) = P(A) + P(B) – P(A and B). For small probabilities this
can be approximated by P(A or B) ≈ P(A) + P(B). For example, if the probability
of each event is 0.01, the approximation yields P(A or B) = 0.02 while the exact
answer is 0.0199. This simplification is useful for the purpose of discussion, but
in practice we apply the first equation which subtracts the union of the
probabilities and extend this for cases with more than two independent events.

4 Copyright © 2022 by ASME

 The total probability of failure for each barrier is the
aggregate of the probabilities of failure for each threat. For
example, the possible causes of failure of the piping connected
to the wellhead could include corrosion, erosion, vehicle
collisions, or landslides, among others (see Section 2.1). These
aggregate probabilities are used as the inputs to the directed
graph nodes shown in Figure 3.
The gas flow rate and resulting hazards are estimated using
the approach described in Section 5 for each combination of
barriers (nodes) leading to a release to the atmosphere and is
repeated for each combination of hole sizes (failure modes) in
each barrier. For example, a release case that includes a breach
through two barriers, with each barrier having three possible
failure modes, would have nine subcases, one for every possible
combination of hole sizes. Each subcase has its own probability
of occurrence, release rate, probability of ignition, and resulting
jet fire hazard area calculated.
4. THREAT MODELS
4.1 Approach
The annual failure rate from the applicable threats to each
barrier in the well is modelled using combinations of the
following quantitative methods.
• Structural reliability models use physics-based
probabilistic models to describe the failure mechanism and
use statistical distributions to directly capture the
uncertainty in measurements of degradation, the expected
loading, material properties, the rate of degradation, and
the accuracy of the model (model error). Examples include
the corrosion and erosion growth and burst models.
• Historical failure rates are derived from historical failures
recorded in industry-wide datasets. With the low rates of
storage failures, these rates require pooling data from many
operators and typically only represent an average rate of
failure. This approach can be applied to well intervention
related failures.
• Fault tree analysis captures the relationships between
lower-level events that can combine to lead to a higher-
level failed state using Boolean logic (AND & OR gates).
Examples include vehicle collisions and excavation
damage.
• Bayesian methods can combine expert knowledge,
engineering models and historical data into an interpretable
model that can be updated as new data becomes available.
Examples include corrosion growth rates and well
component failure rates.
The methods best suited to each threat depend on the type
of data available and the failure mechanism. Many threats can be
modelled with higher fidelity using a hybrid of these approaches.
The following subset of threats was selected for the initial phase
of model development and analysis, based on a review of threats
with perceived higher risk and the prevalence of the threats
reported in public failure databases.
5 Copyright © 2022 by ASME
• internal and external corrosion;
• erosion;
• external interference damage from vehicle collisions,
excavation damage, lifting operations, and aircraft crashes;
• manufacturing and installation defects, equipment failure,
and incorrect operations and maintenance from component
failures, with detailed models for tubular connections and
packers;
• mechanical damage from casing wear;
• accidental loss of control of the well during well
interventions;
• lack of zonal isolation from the cement annulus
(installation defects); and
• weather and outside force failures from geological hazards,
including landslides and seismic events.
The approaches taken for corrosion and vehicle collisions
are described briefly below. Full descriptions are provided in the
accompanying papers, IPC2022-86794 [7] for corrosion, and
IPC2022-86734 [8] for external interference threats.
4.2 Corrosion
As a well ages, metal loss on the casing can grow, increasing
the probability of a failure from corrosion. Inspection and repair
programs manage this probability by reducing uncertainty in the
casing condition and repairing significant metal loss anomalies.
Multiple modes of failure are typically considered when
assessing corrosion. A corrosion defect can fail by a small leak
when a small portion of the metal loss goes through the casing
wall but the surrounding casing is strong enough to contain the
internal pressure, or by burst when the growth of the corrosion
defect degrades the pressure capacity of the casing to a point
where it can no longer contain the internal pressure. These limit
states are shown in Figure 4 (adapted from [9]).
Leak
Wall
Thickness
No Leak
Anomaly Depth
Small Leak
Burst
Burst
No Burst
Anomaly Length
FIGURE 4: CORROSION LIMIT STATES
 The burst failure limit state for well casings is complicated
by the variation in axial loading applied to the casing joints at
different depths in the well. A study completed through the
United States Department of Energy (DOE) compared full-scale
burst tests of well casing joints with metal loss defects to burst
pressure predictions calculated with industry burst models [10].
This work concluded that axial loading plays a significant role
and the best model for this application is the Level II analysis
found in Part 5 Assessment of Local Metal Loss of API 579
Fitness-For-Service3 [11]. Axial loading should be considered in
the failure criterion for the following reasons:
1. The axial loads can become sufficiently compressive
that they would reduce the burst pressure capacity.
2. It is possible to have circumferential metal loss in
casings that can reach an extent that the failure is
circumferentially oriented due to axial tensile loadings.
The API model burst limit state is calculated using the von
Mises stress where the hoop and axial stresses are assumed to be
the principal stresses in the casing, shown in Equation 3. The
calculation of the axial stress on the casing considers the axially
induced stress from pressure changes, thermal strain, bending,
the hanging weight of the casing, buoyancy force, and the
frictional loading induced during well construction (negligible
for relatively straight wells). The full details of the calculation of
the hoop and axial stresses are provided in API 579 [11].
Reported Depth Simulation Depth
Wall Thickness
2nd Inspection
Defect Depth
Defect Depth
Burst Depth
Time
FIGURE 5: CORROSION SIMULATION PROCESS
3
This question was also studied in a recent project jointly funded by PRCI and
PHMSA [12]. The study found that for localized corrosion, where the uncorroded
sections surrounding the metal loss can provide constraint of the plastic
deformations, the von Mises ultimate tensile stress criterion can be exceeded.
2
𝜎𝑣𝑚 = √𝜎ℎ𝑜𝑜𝑝 2
− 𝜎ℎ𝑜𝑜𝑝 𝜎𝑎𝑥𝑖𝑎𝑙 + 𝜎𝑎𝑥𝑖𝑎𝑙 (3)
We have applied this model using structural reliability
methods to estimate the probability of failure of measured
corrosion defects on well casing strings. Figure 5 illustrates how
this model is used to evaluate the impact of a future inspection
on the failure rate using simulation.
a) A simulated depth is sampled from a distribution with a
mean centered on the current reported depth. The depth
is then grown until the next inspection using a rate
sampled from a statistical distribution.
b) A future measured depth is sampled using the tool
measurement accuracy and the simulated depth as the
mean. The future measured depth is then adjusted
upward to reflect the conservative deterministic process
used to make repair decisions. The defect would be
repaired if the von Mises stress is greater than the flow
stress (burst failure) or the depth is greater than the wall
thickness (leak failure). If the defect is not repaired, it
continues to the third pane (c).
c) A new growth rate is calculated using the adjusted depth
and the defect is grown to the time of the third
inspection. The depth and von Mises stress are checked
again for repair consideration. If the simulation passes
these repair scenarios, the simulation proceeds and
evaluates whether the depth would exceed the burst
depth within the simulation period.
Future Measured Depth Depth Adjusted in Repair Check
Wall Thickness
Burst Depth
Defect Depth
3rd Inspection
Time Time
However, the physical tests in the project did not consider the effect of axial
loading and only assessed metal loss with burst failure pressures greater than
5,700 psi, well beyond the limits of normal storage operating pressures.
6 Copyright © 2022 by ASME
 This process is implemented as a Monte Carlo simulation,
which involves repeating the simulation process across many
trials and checking each iteration to establish the portion of
simulations that lead to future leaks or bursts that are not
prevented by the repair checks described above. As described by
Melchers [13], for N trials, the generic method to calculate the
probability of one of these outcomes is estimated using:
𝑁
1
𝑝 ≈ ∑ 𝐼[𝐶] (4)
𝑁
𝑗=1
Where Equation (4) is an unbiased estimator of the
probability, and I [ ] is an ‘indicator function’ which equals 1 if
the conditional expression, C, contained within [ ] is true and 0
if it is false.
An example assessment is shown in Figures 6 and 7. This
assessment was generated using 1 million Monte Carlo
simulations. The measured corrosion and estimated failure rates
five years after the 2022 inspection are shown in Figure 6. The
cumulative failure rate over time across all corrosion anomalies
is shown in Figure 7.
FIGURE 6: EXAMPLE CORROSION ASSESSMENT AS A
FUNCTION OF DEPTH 5 YEARS AFTER THE MOST
RECENT INSPECTION
7 Copyright © 2022 by ASME
FIGURE 7: EXAMPLE CORROSION WITH FAILURE
PROBABILITIES COMBINED ACROSS ALL ANOMALIES
OVER TIME
4.3 Vehicle Collisions
An industry survey of underground storage operators found
a historical failure rate of 1.78 x 10 -5 failures/well-year due to
vehicle collisions across 7,481 wells over approximately 30 data
years for releases with an estimated equivalent diameter of 1 inch
or larger [14]. Therefore, vehicle collisions with aboveground
equipment are a dominant contributor to the overall external
interference rate of 2.21 x10-5 failures/well-year based on data
from Schultz et al. [15, 16] and Folga et al. [17]. The model in
Equation (5) was developed to capture the differences in vehicle
traffic, wellhead and connected aboveground piping size and
strength, and the presence of collision prevention measures such
as bollards.
𝑣𝑛 𝑠𝑛
𝐹𝑉𝐶 = 𝑐𝑉𝐶 ∙ ∑ ∑ 𝑓𝑣𝑖𝑠,𝑠𝑖 ∙ 𝐿𝑒𝑥𝑝,𝑠𝑖 ∙ 𝐷𝑣𝑖→𝑠𝑖 (5)
𝑣𝑖 𝑠𝑖
Damage is assessed using a sharp indenter impact model
developed by DNV for pipeline anchor strikes [18], considering
the vehicle speed and mass, the dimensions and material
properties of the wellhead or piping, and any traffic barriers
present (ex. bollards).
The estimated failure rate due to vehicle collisions for a
given well construction and aboveground context is directly
proportional to the vehicle traffic rates. The frequency of
scheduled and unscheduled activities involving the use of
vehicles for each well, as well as estimates of the number of
vehicles involved, mass, and speed of those vehicles for each
activity, were used with site traffic networks to determine the
frequency of traffic passing by each well, grouped by speed and
mass. An example of a representative traffic network, colored by
traffic rates is shown in Figure 8. This heatmap illustrates the approaches full-bore, the flow is limited by the pressure drop
difference in risk due to vehicle collisions between wells located needed to overcome the flow resistance in the reservoir and
on isolated well pads at the boundary of the facility and those frictional losses up the tubing.
located along common thoroughfares at the site.

FIGURE 9: PRESSURE PROFILE WITH DEPTH FOR

FIGURE 8: EXAMPLE ESTIMATED VEHICLE TRAFFIC
RATES
5. CONSEQUENCE ASSESSMENT
5.1 Release Rates
Each potential release path has a unique geometry resulting
in a wide range of possible release rates. In extreme release
scenarios, such as a wellhead rupture, the friction losses as gas
flows through the reservoir and into the wellbore (the well inflow
performance) can be the main element in the flow path restricting
the flow. If the well inflow performance and frictional losses
through all parts of the flow path are not considered, the
estimated release rates can be overly conservative. Since the
release rate affects the probability of ignition and the size of the
jet fire hazard area, this can lead to overly conservative estimates
for the overall risk.
A cloud-based computational fluid dynamics (CFD) release
rate model has been incorporated into the directed graph solver
to calculate release rates. The flow model accounts for the inflow
performance limits of the reservoir and can estimate gas flow
rates through complex geometries, accounting for the frictional
losses along the potentially tortuous flow path created by
multiple well barrier breaches and by the cement annulus behind
the casing. This process is automated and can process and run
calculations for several different release cases at once to handle
the large number of scenarios considered in a fully quantitative
risk assessment.
SEVERAL WELLHEAD FAILURES
5.2 Jet Fires
The thermal radiation from a jet fire is the dominant hazard
resulting from accidental natural gas releases from onshore
pipelines or facilities. The most widely used model for natural
gas pipelines in North America is the so-called Potential Impact
Radius (PIR) model, a single-point model [19]. The PIR model
has been found to produce reasonable results, with slight
conservatism, when compared to the far-field effects of a jet fire
such as burn extent and injury [19]. However, in the near-field
where damage to equipment can occur, single-point models can
be overly conservative [20]. Therefore, we have adopted a
Weighted Multiple Point Source (WMPS) model, the most
accurate of the semi-empirical models [20]. Figure 10 shows a
comparison of the estimated areas within which human injuries
and equipment damage are expected, using the simplified PIR
model (a), and the WMPS model for a vertical release (b) and for
a horizontal release (c).

The pressure versus depth curves in a well following a

breach in the wellhead for 4 cases, with progressively larger hole
sizes from left to right, are shown in Figure 9. Cases 1 and 2
represent breaches smaller than 1 inch. In these cases, the bulk
of the pressure drop to reach atmospheric conditions occurs at
the wellhead. Cases 3 and 4 demonstrate that as the breach

8 Copyright © 2022 by ASME

 Equipment damage

Burn injury onset

(a) PIR Model (b) WMPS Model – Vertical Flame (c) WMPS Model – Horizontal Flame
FIGURE 10: COMPARISON OF HEAT AFFECTED ZONES

The WMPS model can reflect the effects of non-vertical
fires, lift-off, and shielding from buildings and the site
topography, as described in Smith et al. [21]. Flame lift-off refers
to the distance between the release location and the visible flame
envelope, as shown in Figure 11. The released gas can have
outlet speeds exceeding several hundred feet per second,
resulting in a lift-off distance of more than 50 ft from the gas
travelling upward for only a small fraction of a second (~0.02s)
before enough oxygen is incorporated for combustion to occur.
Lift-off
FIGURE 11: WEIGHTED MULTIPLE POINT SOURCE
(WMPS) MODEL WITH LIFT-OFF
5.3 Knock-on Failures
If wells are closely spaced together, an ignited release from
one well can lead to the failure of an adjacent well, commonly
referred to as the domino effect or a knock-on failure. Reports
from the California Council on Science and Technology and
Lawrence Berkeley National Laboratory note the potential for an
ignited well rupture to lead to multiple wellhead failures as well
as the use of risk assessments to identify optimal interventions to
prevent such low-probability high-consequence events [22, 23].
These reports were incorporated into the California Department
of Conservations’ recent rulemaking on gas storage. In addition,
a relatively small, ignited release has the potential to cause heat
damage to the wellhead, reducing its pressure capacity and
ultimately leading to a full rupture of the wellhead.
The model to assess the knock-on failure potential at a gas
storage well site consists of:
• The weighted multiple point jet fire model described in
Section 5.2 above.
• A transient heat transfer model, which models the
temperature and pressure changes within wells and other
pressurized equipment near a jet fire in response to the
incident radiation predictions from the jet fire model.
• An equipment failure model, which accounts for the
decreasing material strength capacity as temperature
increases. This model uses the pressure and temperature
predictions from the heat transfer model to determine when
or if a failure of the wellhead components, lateral piping,
or flanges will occur.
• A knock-on timeline model, which combines the three
models above to simulate the progression of knock-on
failures over time following an initial ignited release.
An example simulation is shown in Figure 12 with an
ignited small release on the wellhead that is modelled to progress
to a full rupture of the wellhead. A small leak also occurred
during the simulation on the adjacent well, but the surface safety
valve (SSV) was triggered and prevented the propagation of
knock-on failures to the rest of the well. The initial release is
shown in time step 0, the knock-on to the adjacent well occurs in
step 9 (see blue arrow), a full wellhead rupture occurs in step 12,
and the adjacent well shut-in section is fully emptied in step 16
after the SSV has triggered in step 13.

9 Copyright © 2022 by ASME

 6. EXAMPLE ASSESSMENT
An assessment was conducted on an example well using
representative conditions for the threat models listed in
Section 2.1. Figure 13 shows wellbore diagrams for the four
considered well configurations, which include the list below.
Each of these configurations requires different wellhead
components, which are shown in Figure 14.
a) Casing-only flow
b) Tubing and packer installed, representing two different
options based on the sliding sleeve position:
i. dual flow (tubing and casing flow) if the sliding sleeve
at the bottom of the tubing is open to allow flow into
the tubing-casing annulus. Flow shown in orange.
ii. dual barrier (tubing-only flow) if the sliding sleeve is
closed. Flow shown in red.
c) Installing a new casing string inside the existing casing
(an inner string), cemented to surface with case (a)
d) Installing an inner string with case (b)
FIGURE 12: EXAMPLE KNOCK-ON FAILURE SCENARIO
Figure 15 shows the predicted annual failure rate in 2026.
The annual rates for the casing-only flow and dual flow
configurations are comparable to average rates reported in
literature, in the range of 2.1 x 10-4 to 2.9 x 10-4 failures/well-year
[14, 15, 16].

FIGURE 13: EXAMPLE ASSESSMENT WELLBORE CONFIGURATIONS

10 Copyright © 2022 by ASME

 FIGURE 14: EXAMPLE ASSESSMENT WELLHEAD CONFIGURATIONS

Switching to a dual-barrier configuration or installing an

inner string reduces the annual failure rate by approximately an
order of magnitude, to 2 x 10-5 failures/well-year. The results
can also be examined as a cumulative failure rate over time, as
shown in Figure 16 for the casing-only flow and dual-barrier
configurations.

FIGURE 16: CUMULATIVE FAILURE RATE OVER THE

NEXT 10 YEARS FOR CASING-ONLY FLOW AND DUAL-
BARRIER CONFIGURATIONS

Starting from a casing-only flow configuration (baseline),

Figure 17 shows the effect that the following mitigations would
have on the failure rate over the next five years, presented as the
cumulative failure rate in 2026. The mitigations are applied
additively in the following order:
FIGURE 15: 2026 ANNUAL FAILURE RATE FOR THE
EXAMPLE WELL CONFIGURATIONS

11 Copyright © 2022 by ASME

 1. Install a tubing string and packer assembly, switching
to tubing-only flow. This transitions the well from a
single- to dual-barrier configuration at the expense of a
reduction in well deliverability.
2. Install sacrificial erosion probes connected to an
automatic shutdown valve that triggers if the probe
erodes.
3. Install bollards with reflective markings to improve
visibility and reduce vehicle impact energy.
FIGURE 17: COMPARISON OF MITIGATION OPTION
EFFECTS ON THE 2026 CUMULATIVE FAILURE RATE
Each mitigation action in Figure 17 reduces the failure rate,
but each action has very different costs to implement and
maintain. A cost-benefit analysis can be used to evaluate which
actions have the most risk reduction per dollar spent. Other
considerations may factor into the decision on which mitigation
actions should be taken. For example, an operational change to
move to tubing-only flow also limits the deliverability of the
well, so adopting this mitigation may not be feasible to maintain
the required level of service.
The results presented above do not include the risk of
accidental release during well workovers and inspections. The
initial install of a tubing and packer into a well to create a
dual-barrier configuration and all subsequent inspections require
a workover, which has a significant failure rate of 2.0 x 10-4,
while single-barrier wells can be inspected via wireline which
has a much lower failure rate of 4.5 x 10-6 (PHMSA 2021). These
well intervention failure rates are comparable to the annual rates
of failure during operation, so the inspection frequency can
substantially change the overall operating risk of a well and
should be optimized based on the current state of the innermost
casing to minimize the overall risk.
12
7. SUMMARY
A fully quantitative framework for risk assessment of
natural gas storage wells, including the wellhead and connected
piping, has been developed to assess SoCalGas’s underground
gas storage sites in California. The approach was developed to
meet and exceed the risk assessment requirements of
API RP 1171 (incorporated by reference in U.S. regulation
49 CFR 192.12) and the recent changes to the California Code
of Regulations [1, 2, 3]. Further, several recommendations made
in the recent PHMSA study, Risk Assessment and Treatment of
Wells [4], have been addressed and incorporated.
In the first phase of work, threat models were developed that
cover all eleven threat categories in Table 1. The framework uses
a dynamic fault tree to aggregate the barrier failure rates to
quantify the combined rate of accidental releases to the
atmosphere and the resulting hazards. A flow model capable of
estimating gas flow rates through complex geometries was
implemented that can handle the large number of scenarios
needed for a comprehensive quantitative risk assessment. The
calculated flow rates are used to predict the probability of
ignition and to quantify the thermal radiation from the resulting
jet fire. The jet fire model can handle scenarios with non-vertical
fires, lift-off, and shielding from buildings and the site
topography. The framework combines all these elements along
with an assessment of the life safety consequences to estimate
the risk and can quantify the benefit of various mitigation
strategies, enabling an operator to develop an optimal integrity
management strategy so that resources are used in the most
effective way to reduce the risk.
8. REFERENCES
[1] United States Code of Federal Regulations (CFR). 2022.
Underground Natural Gas Storage Facilities. Title 49,
Section 192.12.
[2] American Petroleum Institute (API). 2015. Functional
Integrity of Natural Gas Storage in Depleted Hydrocarbon
Reservoirs and Aquifer Reservoirs. API-RP-1171.
Washington, DC: API Publishing Services.
[3] California Geologic Energy Management Division
(CalGEM, formerly DOGGR). 2018. Requirements for
California Underground Gas Storage Projects. California
Code of Regulations, Title 14 Chapter 4 Subchapter 1,
Articles 3 & 4.
[4] PHMSA. 2020. Risk Assessment and Treatment of Wells.
Project Number: 740, Contract Number: 693JK31810017
[5] Rao, et al. 2010. Dynamic Fault Tree Analysis: Simulation
Approach in Simulation Methods for Reliability and
Availability of Complex Systems. Springer, London, pp.
41–64.
[6] Mannan, S., 2005. Lees’ Loss Prevention in the Process
Industries, 3rd ed. Elsevier.
[7] Dessein, T., Ayton, B., Fraser, A., Shironishi, M., Sera, T.,
and Shapiro, D. 2022. Probabilistic Corrosion Assessment
Copyright © 2022 by ASME
 for Natural Gas Storage Wells. 14th International Pipeline
Conference, IPC2022-86794.
[8] Smith, S., Fraser, A., Shironishi, M., Neville, D., and
Shapiro, D. 2022. Modelling Accidental Impact Threats to
Natural Gas Storage Wells. 14th International Pipeline
Conference, IPC2022-86734.
[9] Canadian Standards Association (CSA). 2015. Oil and
Gas Pipeline Systems - Annex H Pipeline Failure
Records. CSA Z662-15. CSA Group.
[10] Francini, Robert B., Wahl, Jacob D., & Zelenak, Paul A.
2008. Effects of Tensile Loading on the Remaining
Strength of Corroded Casing. United States Government.
[11] American Petroleum Institute (API). 2000. Fitness-for-
Service. API-579. Washington, DC: API Publishing
Services.
[12] PRCI. 2021. Evaluation of Casing Integrity for
Underground Storage Wells US-3J. PRCI Contract No.
PR-244-18702. PHMSA Project Number: 474, Contract
693LK31810014.
[13] Melchers, R., and Beck, A. 2018. Structural Reliability
Analysis and Prediction. Hoboken, NJ: John Wiley & Sons
Ltd.
[14] DeWolf, G., Seacry, K., Orr, D., and Loughran, C. 2004.
Risk Assessment Methodology for Accidental Natural Gas
and Highly Volatile Releases from Underground Storage,
Near-Well Equipment. Gas Research Institute, GRI-
05/0172.
[15] Schultz, R.A., Hubbard, D.W., Evans, D.J., and Savage,
S.L. 2019. Characterization of Historical Methane
Occurrence Frequencies from U.S. Underground Natural
Gas Storage Facilities with Implications for Risk
Management, Operations, and Regulatory Policy. Society
for Risk Analysis, 0272-4332/19/0100-0001.
[16] Schultz, R.A., Hubbard, D.W., Evans, D.J., and Savage,
S.L. 2021. Corrigendum to Characterization of Historical
Methane Occurrence Frequencies from U.S. Underground
Natural Gas Storage Facilities with Implications for Risk
Management, Operations, and Regulatory Policy. Society
for Risk Analysis, 0272-4332/21/0100-0001.
[17] Folga, S. et al. 2016. U.S. Natural Gas Storage Risk-Based
Ranking Methodology and Results. Argonne National
Laboratory, ANL-16/19.
[18] DNV. 2019. Risk assessment of pipeline protection.
DNVGL-RP-F107.
[19] Stephens, M.J., Leewis, K., and Moore, D.K. 2002. A
model for sizing high consequence areas associated with
natural gas pipelines. 4th International Pipeline
Conference, IPC2002-27073.
[20] Hankinson, G., and Lowesmith, B.J. 2012. A consideration
of methods of determining the radiative characteristics of
jet fires. Combustion and Flame, Volume 159: 1165-1177.
[21] Smith, S., Fraser, A., and Shironishi, M. 2020.
Recommendations for Jet Fire Model Selection when
Performing Consequence Assessments of Onshore Natural
Gas Pipelines and Facilities. 13th International Pipeline
Conference. IPC2020-9483.
13
[22] California Council on Science and Technology (CCST).
2018. Long-Term Viability of Underground Natural Gas
Storage in California. Sacramento: California Council on
Science and Technology.
[23] Oldenburg, C. M. (2017). Comments of Curtis Oldenburg
and Robert J. Budnitz on draft UGS regulations [Personal
communication].
9. BIBLIOGRAPHY
American Petroleum Institute (API). 2008. Risk-Based
Inspection Technology. API-581. Washington, DC: API
Publishing Services.
American Petroleum Institute (API). 2015. Functional Integrity
of Natural Gas Storage in Depleted Hydrocarbon Reservoirs and
Aquifer Reservoirs. API-RP-1171. Washington, DC: API
Publishing Services.
American Petroleum Institute (API). 2016. Fitness-for-Service.
API-579. Washington, DC: API Publishing Services.
American Petroleum Institute (API), American Gas Association
(AGA), The Interstate Natural Gas Association of America
(INGAA). 2016. Underground Natural Gas Storage Integrity &
Safe Operations. Retrieved from: http://www.energyinfrastructu
re.org/energy-101/natural-gas-storage.
The American Society of Mechanical Engineers (ASME). 2005.
Managing System Integrity of Gas Pipelines. ASME B31.8S-
2004. New York: ASME.
California Council on Science and Technology (CCST). 2018.
Long-Term Viability of Underground Natural Gas Storage in
California. Sacramento: California Council on Science and
Technology.
California Geologic Energy Management Division (CalGEM,
formerly DOGGR). 2018. Requirements for California
Underground Gas Storage Projects. California Code of
Regulations, Title 14 Chapter 4 Subchapter 1, Articles 3 & 4.
Canadian Standards Association (CSA). 2015. Oil and Gas
Pipeline Systems - Annex H Pipeline Failure Records. CSA
Z662-15. CSA Group.
Det Norske Veritas (DNV). 2012. Failure Frequency Guidance.
DNV.
Det Norske Veritas (DNV). 2015. Managing Sand Production
and Erosion. Recommended practice DNVGL-RP-O501.
Duncan, I. J. 2014. Developing a Comprehensive Risk
Assessment Framework for Geological Storage of CO2. DE-
FE0001563.
Evans, D. 2009. A Review of Underground Fuel Storage Events
and Putting Risk into Perspective with Other Areas of the Energy
Supply Chain. British Geological Survey, Keyworth.
Evans, D., & Schultz, R. A. 2017. Analysis of Occurrences at
Underground Fuel Storage Facilities and Assessment of the Main
Copyright © 2022 by ASME
Mechanisms Leading to Loss of Storage Integrity. Austin:
American Rock Mechanics Association.
Folga, S., Portante, E. S., McLamore, M., Kavicky, J.,
Conzelmann, G., & Levin, T. 2016. U.S. Natural Gas Storage
Risk-Based Ranking Methodology and Results. Alexandria: U.S.
Department of Energy (DOE).
Gas Technology Institute (GTI). 2016. Approaches for
Preventing Catastrophic Events. GTI Project Number 21878.
Health and Safety Executive (HSE). 2002a. Hazard Assessment
of Well Operations from Vessels. 2002/013. Norwich.
Health and Safety Executive (HSE). 2002b. Spool Tree
Component Reliability, Failure Mode Identification,
Determination of the Leak Frequencies and Leakage Rates.
2002/014. Norwich.
Pipeline and Hazardous Materials Safety Administration
(PHMSA). 2011. Instructions for Form PHMSA F 7000-1 (Rev.
10-2011) Accident Report – Hazardous Liquid Pipeline Systems.
Retrieved from: https://www.phmsa.dot.gov/sites/phmsa.dot.go
v/files/docs/forms/12436/hlaccidentinstructionsphmsa-f-7000-
1on-or-after-january-1-2010_0.pdf
Pipeline and Hazardous Materials Safety Administration
(PHMSA). 2016. Pipeline Safety: Deactivation of Threats.
Docket No. PHMSA-2016-0131; Billing Code: 4910-60-W.
Retrieved from: https://federalregister.gov/d/2017-05262
Pipeline and Hazardous Materials Safety Administration
(PHMSA). 2018. Pipeline Risk Modeling: Overview of Methods
and Tools for Improved Implementation.
Pipeline and Hazardous Materials Safety Administration
(PHMSA). 2019. Distribution, Transmission & Gathering, LNG,
and Liquid Accident and Incident Data. Retrieved from
https://www.phmsa.dot.gov/data-and-
statistics/pipeline/distribution-transmission-gathering-lng-and-
liquid-accident-and-incident-data.
Schultz, R., Hubbard, D., Evans, D., Savage, S. 2019.
Characterization of Historical Methane Occurrence Frequencies
from U.S. Underground Natural Gas Storage Facilities with
Implications for Risk Management, Operations, and Regulatory
Policy. Risk Analysis. Society for Risk Analysis.

14 Copyright © 2022 by ASME