CET-vol 105 DOI: 10.3303/CET23105080 Paper Received: 25 February 2023; Revised: 3 May 2023; Accepted: 15 September 2023 Please cite this article as: Marrazzo R., Mazzini C., 2023, Risk Management and Safety Aspects in Italian Underground Gas Storage Activities, Chemical Engineering Transactions, 105, 475-480 DOI:10.3303/CET23105080 CHEMICAL ENGINEERING TRANSACTIONS VOL. 105, 2023 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: David Bogle, Flavio Manenti, Piero Salatino Copyright © 2023, AIDIC Servizi S.r.l. ISBN 979-12-81206-04-5; ISSN 2283-9216 Risk Management and Safety Aspects in Italian Underground Gas Storage Activities Romualdo Marrazzoa,*, Cosetta Mazzinib aVAL-RTEC, ISPRA. Via V. Brancati n. 48 - 00144 Roma, Italia bPTR Impianti RIR, ARPAE. P.zza Largo Caduti del Lavoro, 6 - 40122 Bologna, Italia romualdo.marrazzo@isprambiente.it The underground storage of natural gas is an industrial process which consists of injecting gas into a depleted underground rock system, to ensure its accumulation and subsequently deliver it in a second phase. The scope of the paper is providing technical support in safety analysis evaluation of underground natural gas storage establishments, to pursue a uniformity of evaluation throughout the national territory, in accordance with the Seveso III directive. The main issues concern: Italian law and legal requirements; information about the establishment and the company organizational structure; information on classification of substance under Seveso directive; industrial safety of the plants, with the relative individuation of the critical technical systems; methodological approach for assessing the risk analysis of plants, including the NaTech risk. Some references are finally given to identify the most “critical” parameters of the different techniques for risk analysis which, if not adequately evaluated, can lead to an incorrect result of the analysis itself, also considering the correct safety measures to prevent or limit the consequences of an accident scenario and in reference to the proper implementation of the Safety Management System. 1. Introduction In the context of the technologies aimed at supporting the national energy transition, the underground natural gas storage facilities play an important role to deal with variable market demands or to deal with situations of lack/reduction of energy supply sources. The paper explains the results of technical assessments carried out by national competent authorities working group, in accordance with the D.Lgs. 105/2015 (GU, 2015), the Italian implementation of the 2012/18/UE directive (s.c. “Seveso III”), regarding risk management and safety aspects in underground natural gas storage activities. The scope is to provide technical support in safety reports evaluation of these facilities, to pursue a uniformity of evaluation throughout the national territory, taking into account plant and site-specific territorial aspects. The paper explains the main contents of the “Guidelines for the safety report evaluation of underground natural gas storage” (MATTM, 2018), which purpose was having uniform evaluation throughout the national territory of the risk analyses produced. 1.1 Overview of legal requirements Depending on the amount of dangerous substances present, establishments under the D.Lgs. 105/2015 are categorised in lower and upper tier, with different obligations to prevent major accidents and to limit their consequences for human health and the environment. The requirements include, among others: notification of all concerned establishments; deploying a Major Accident Prevention Policy (MAPP) and a Safety Management System (SMS); producing a Safety Report (SR) for upper-tier establishments; producing an Internal Emergency Plan (IEP) for upper tier establishments; providing information in case of accidents. In Italy, based on the information in the inventory of establishment notifications, there are about 1.000 Seveso sites. Among these, twelve underground natural gas storage sites operate in four different regions in the central north of the country. 475 1.2 Underground storage in Italy The operating storage sites are depleted gas production sites: natural structures in which gas was trapped and which, once the primary exploitation phase was completed, were converted into storage. These establishments are: surface plants (compressor and treatment units); reservoirs (deposits - natural storage systems); wells (connecting the reservoir with surface plants); interconnecting flow-lines. The activity consists of the storage of natural gas in underground geological structures (injection) and subsequent distribution, according to market demand and to guarantee the “strategic” energy supply in the country. The substances classified as dangerous pursuant to D.Lgs. 105/2015 present in these establishments are natural gas, diesel oil and methanol. The Italian establishments are upper-tier establishments for the quantities of natural gas held, considering the holdup of the reservoir and the holdup of the surface plants. For underground storage of natural gas, the following additional legal references may apply: the D.Lgs. 624/1996, concerning the safety and health of workers in extractive industries; the DM 17 April 2008, which applies to gas transport pipelines; the DM 17 January 2018, which provide the Italian regulatory indications for constructions, seismic verification and other structural checks (i.e. strong wind and flooding). 1.3 Risk assessment and safety report In the safety report, the site operator produces a risk assessment with the description of a risk analysis and measures for the prevention of major accident hazards. The Italian competent authority for the evaluation of the safety report carries out the technical evaluation for the safety report with a multidisciplinary approach. The technical evaluation identifies accident scenarios, damage distances and frequencies of occurrence, as well as the safety measures adopted, for the purposes of External Emergency Planning (EEP) and Land Use Planning (LUP). 2. Guidelines for the safety report evaluation of underground natural gas storage The guidelines do not introduce new developments, but it is the result of the experience gained over the years at a national level in the evaluation of the Safety Reports of this type of establishment. The specificity of these plants is that the safety of the underground storage is ensured by the production history of the field itself, as the geological covering structures have guaranteed the permanence on site of the gas for millions of years, and it is also managed by creating specific site geo-mechanical models and adopting monitoring techniques. The main contents of the guidelines are: • Information relating to establishment • Establishment classification and verification subject to Seveso directive • Safety of establishment • NaTech risk assessment • Identification of events and accident scenarios • Evaluation of events and scenarios frequency • Calculation of consequences • Safety systems 3. Safety of Natural Gas storage establishments 3.1 Risk of loss of integrity of reservoirs and wells There are two parameters for the safety assessment of gas reservoirs, considering a depth of 1000-2000 m: the geo-mechanical model for the gas reservoir provides quantitative assessments of the limit pressure with which safe storage can be performed; monitoring of pressure, micro-seismicity and deformation of the soil indicate the maintenance of the state of the gas reservoir in conditions of safety during injection and distribution activity.The well consists of “casing”, steel pipes and a cement filling. Anomalies with gas leakage that can cause risks are: ineffective seal from the casing cementation of the well; risk of eruption (blow out) of the well even during maintenance operations. 3.2 Safety of connecting flow-lines Flow-lines are connection pipelines, outside the fences of the plants, between the well/cluster areas and the surface plants (compressor units). In Italy the “methane pipeline” standard establishes the minimum safety distances from residential areas: 100 m for pipelines with maximum operating pressures exceeding 24 bar. Concerning flow-lines, in the safety report, it is therefore important to describe: routes and construction features; interception - blocking – safety systems. 476 Another aspect to be taken into due consideration, to correctly evaluate the safety of flow-lines, is the formation of hydrates that could obstruct the pipeline. Hydrates are compounds of molecules of free water and/or condensation in the pipeline and natural gasses that crystallize in particular conditions of pressure and temperature. To contrast the formation of hydrates, inhibitors such as methanol or glycol are used to move the stability curve. The evaluation of hydrate formation that can lead to variations in pressure or temperature must be done in all plant conditions (normal operation, shutdown, maintenance activities). It is then necessary to implement procedure for the formation of hydrates and emergency instructions if the phenomenon occurs. 4. Risk analysis for surface plants 4.1 Identification of events and accident scenarios For the identification of events and consequent accident scenarios, it is possible to refer to the typical techniques as historical experience, what-if analysis, FMEA-FMECA, HazOp. The analysis develops as: internal historical analysis, identifying causes of accidents, near-misses, anomalies that have occurred inside the plant; external historical analysis of events, which have occurred in similar establishments, through consultation of updated databases (MHIDAS, FACTS, eMARS, etc.); analysis of the historical experience of "delivery points" or "nodes" of the national natural gas distribution network. Care must be taken on reference databases and plant and/or management measures to prevent events or limit their probability and consequences. 4.2 Evaluation of the frequency of events and scenarios The identification of failure rates differs according to complex systems (Fault tree analysis) or “Random” failure of a single component (equipment, systems, pipes). Failure rates are taken from reliability databases (Oreda, EIGIG, HSE, TNO Purple Book, EIGH, etc.): it is important to show that data are representative of the specific plant and that the chosen failure rates can be considered conservative. In underground gas storage plants, the random failure of the pipes is the basis (Top-Event) of the most significant events (more extensive damage areas). In the particular case of above-ground pipes (Uijt de Haag P. et al., 2005), the guidelines make a comparison between databases (HSE Failure Rate/TNO Purple Book 2005), giving general frequency values for pipe failure in a range of 10-5 – 10-7 occ/y*m (Keeley D., 2008). For buried pipes, an important reference is the European Gas Pipeline Incident Data Group (EGIG) Report (Dröge M. et al., 2018). The guidelines suggest, however, that failure frequencies indicated in the EGIG Report can be taken as a reference for natural gas pipes (buried or not buried, even within establishment) (van Vliet A. et al., 2011). A final consideration must be made on the incidence of the different failure causes on frequency. For example, the CONCAWE Report identifies the percentage of failure causes for buried pipes carrying hot or cold petroleum products (2011-2016 period) as below: corrosion (90% - hot products; 20% cold products), operational errors (10% - cold), and mechanical causes (20% - cold) (Cech M. et al., 2018). 4.3 Calculation of the frequency: the integrated approach to risk assessment The reduction of occurrence frequencies through an integrated analysis that combines risk analysis with the Safety Management System (SMS) allows the quantification of the positive effects of the system in order to prevent major accidents. If an inspection plan of equipment and pipes based on risk analysis has been prepared, its effectiveness in preparing an integrated analysis can be taken into account in order to reduce the frequency of accidents. The use of methodologies for the drafting of a risk-based inspection plan such as the API 581: 2016 standard is suggested (API, 2016). If this standard is used improperly and partially (e.g. taking into account in a generic way only SMS procedures) the results which are obtained will be wrong, because there will be a reduction by at least one order of magnitude of the general frequencies of equipment and pipe failure. These methodologies allow the reduction of the top frequencies for complex systems - Fault Tree Analysis (Bellamy et al., 2000), and specifically for random pipe failures (Milazzo et al., 2010). Taking for example the parameter "external corrosion", the quantification of this reduction is obtained by applying the methods indicated (Goodfellow et al., 2018). For the calculation of scenario frequency using the event tree (Uijt de Haag P. et al., 2005), it is finally important to remember that the trigger probability values (immediate or delayed triggering) must be pertinent to the plant reality or cautiously estimated in favour of safety (Spencer et al., 1997). 4.4 Calculation of consequences It is necessary to model the physical phenomena of methane release in high-pressure conditions. These are the release phases, as shown in Figure 1: Phase 1: expansion from the initial pressure to the hole pressure; Phase 2: expansion up to atmospheric pressure; Phase 3: initial dilution. 477 Figure 1: Modelling of a high-pressure methane release The methane released is in supercritical conditions, that is a fluid is at a temperature and pressure higher than the critical ones (no distinction between gaseous and liquid phase). The properties are intermediate between those of a gas and a liquid, and its density can be greater than that of gases in ordinary conditions. The density of methane proportionally affects the release rate and therefore the gas release rate must be calculated considering the gas density in supercritical conditions. The possible accident scenarios in case of methane release in the conditions stated above are: • Flash Fire. Fire of a flammable gas cloud that disperses into the atmosphere as a light neutral gas; the factors that affect modelling are density, weather conditions, release duration, cloud dilution, roughness. In case of interception systems, the duration of the release and the quantity released will be less: the frequency of the flash fire scenario could be reduced, as the smaller cloud is less likely to run to a trigger source. Therefore, the intervention times assumed must be consistent with the emergency procedures and be verified through field inspections. • Jet Fire. The release of a pressurized gas with immediate ignition and fire of a cloud; the factors that affect modelling are gas density, jet direction, release flow rate. Jet fire damage areas are normally included within the damage areas for the corresponding flash fire scenarios: they must be considered especially for the purposes of evaluating a possible domino effect. • Vapour Cloud Explosion (VCE). It occurs when a confinement of the mass of flammable vapours is mixed with air at the moment of ignition. It is necessary to assess whether the air/natural gas mixture can fall within the flammability range, calculating the amount of flammable mixture between LFL (Lower Flammability Limit) and UFL (Upper Flammability Limit). Conditions that facilitate the occurrence of a VCE are releases in areas with a high degree of confinement or in closed environments. The verification of the computational models chosen for the estimation of the consequences must be adequate to the physical phenomenon reality: some models does not consider the “super critical conditions” of methane. There are softwares that do not automatically take into account the initial expansion and dilution of the methane jet. It is therefore necessary to apply a dilution factor to the release range (approximately 1/10): the value of the recalculated flow must be used as input data to any Gaussian dispersion model, since for this model the gas concentration is directly proportional to the release flow. 4.5 Safety systems The main prevention and protection measures aimed at reducing the frequency and/or extent of the consequences of accident events are: Locking systems to make plants safe (ESD - Emergency Shut Down: closing of all the plant sectioning valves and opening of the blow down valves with the consequent depressurization of the system; PSD - Process Shut Down: production shutdown by closing the sectioning valves (SDV) and securing the unit; LSD - Local Shut Down: blocking and securing of the unit, or interception and stopping of the single equipment); Fire prevention measures and systems. 5. NaTech risk assessment A complete NaTech risk assessment consists of the following steps: • Preliminary analysis, carried out through territorial contextualization, historical analysis of natural events and assessment of the hazards of each NaTech event considered for the site. • Identification of equipment exposed to risk. • Identification of prevention and mitigation measures, possible estimate of occurrence frequencies and areas of damage, relative integration of the scenarios in the Safety Report. 478 In the Safety Reports examined, the site Managers completed the first of the phases indicated; in some specific situations, the second phase and part of the third phase have also been completed, as requested by the Competent Authorities, identifying the prevention and mitigation measures. Based on the safety reports examined, the technical assessment of the scenarios still has to be faced. Every specific NaTech risk, as analysed in the mentioned Saferty Reports, must be described: • The seismic risk • The Hydrogeological risk • Lightning and Tornado risk The extension of these establishments over large areas means that parts of the system (i.e., the connecting pipes) can cross areas subject to extreme weather events, with possible occurrence of NaTech events. 6. Safety report evaluation conclusions For the purpose of the guidelines, an example of external emergency planning (GU, 2005) is shown in the Figure 2. Figure 2: Example of external emergency planning through geo-referencing of the consequence evaluation This numerical example can be useful to understand the conditions of use of commercial computational models for the study of the consequences in case of super critical conditions methane releases. In particular, a flash fire, caused by failure of a natural gas pipe (152 mm hole) at an operating pressure of 140 bar (top-event), was developed through geo-referencing of the consequence evaluation. The calculation was carried out under the following weather conditions in the area: atmospheric stability class of Pasquill D5 (neutral) with wind speed of 5 m/s. The damage distances resulting are 284.91 m (corresponding to “LFL” threshold) and 435.88 m (corresponding to “1/2 LFL” threshold). 7. Conclusions Underground natural gas storage establishments use depleted fields as a natural reservoir to store gas, and therefore constitute strategic energy reserves. The purpose of the document is to provide a technical support reference to the evaluation of the Safety Reports of the underground natural gas storage establishments, in order to pursue greater uniformity of assessment throughout the national territory. Although each installation may present strictly site-specific plant and territorial aspects, there are nonetheless elements that unite all installations. The “Guidelines for the safety report evaluation of underground natural gas storage” provide specific indications and insights, with the aim of supporting and directing the activities related to the assessment of the risks of a major accident. Legislative Decree 105/15 defines criteria, data, references, information for the preparation of the Safety Report and assigns the manager the task of identifying the dangers of major accidents and measures; consequently, it is up to the manager to choose the methodology to be used for the systematic identification of accidents, the evaluation of probability / frequencies and the calculation of the consequences, since this methodology must be justified and technically justified in the Safety Report. Instead, the competent Authority is responsible for "ensuring that the description of each scenario, complete with supporting evidence, is formulated in such a way as to highlight the consistency between the identified scenario and the measures taken".The approach used for drafting the guidelines initially envisaged the search for the references of technical regulations applicable to underground gas storage, including an overview of the approaches adopted in some European countries for the assessment of the risk of a major accident; 479 subsequently, the problems relating to the reservoir and wells were examined, to finish with an in-depth study of the peculiar characteristics of the surface plants, considering the related safety aspects with reference to major accidents. The guidelines achieved the following aims: • The identification of the standards applicable to natural gas storage establishments and the respective areas of application and methods of coordination. • The identification of specific individual safety aspects relating to reservoirs, surface plants and flow-lines. • Criteria for choosing state of the art accident databases and sources of reliability data. • Conditions of feasibility of the API 581 standard (RBI) in the risk assessment of safety reports. • Conditions of use of commercial computational models for the study of the consequences for methane releases in super critical conditions. • Uniformity of risk assessment throughout the national territory. Some indications emerged to improve the national regulatory framework: • Define a validated methodology of integrated risk assessment in order to quantify the effect of the safety management system. • Establish the procedures which are necessary both to reduce the probability of occurrence and to reduce the extent of the consequences of major accidents. • Identify credibility thresholds for accident events, as in other countries in Europe. • Recognize ways to carry out NaTech risk assessment, relating to natural events or disasters that can induce one or more technological accidents such as fires, explosions and releases, in order to adopt the necessary measures for the prevention, mitigation and management of the emergency. • Put in place measures to contain methane emissions (greenhouse gas) in conditions other than normal operation. Acknowledgments Special thanks to the Italian Ministry of Environment (DIV.II Rischio Rilevante e AIA, MASE. Via Cristoforo Colombo 44 – 00147 Roma). References API, 2016, American Petroleum Institute, “API RP 581 - Risk Based Inspection Methodology”, Third edition. Bellamy L., Papazoglou l., Hale A., Aneziris O., Ale B., Morris M., Joy I., 2000, “I-RISK: A quantified integrated technical and Management risk control and monitoring methodology”, EC, EUR-19320. Cech M., Davis P., Gambardella F., Haskamp A., 2018, CONCAWE, Report No. 6/18, “Performance of European cross-country oil pipelines – Statistical summary of reported spillages in 2016 and since 1971”. Dröge M., Kenter R., 2018, EGIG, Doc. number VA 17.R.0395, European Gas Pipeline Incident Data Group, “10th Report of the European Gas Pipeline Incident Data Group (period 1970 – 2016)”. Goodfellow et al., 2018, “UKOPA Pipeline Product Loss Incidents and Faults Report (1962 – 2016)”, Report Number: UKOPA/17/002, Issue: 1.1. GU, 2005, DECRETO DEL PRESIDENTE DEL CONSIGLIO DEI MINISTRI 25 febbraio 2005 Linee Guida per la predisposizione del piano d'emergenza esterna di cui all'articolo 20, comma 4, del decreto legislativo 17 agosto 1999, n. 334, GU Serie Generale n.62 del 16-03-2005 - Suppl. Ordinario n. 40. GU, 2015, DECRETO LEGISLATIVO 26 giugno 2015, n. 105. SO n. 161 del 14 luglio 2015 “Attuazione della direttiva 2012/18/UE relativa al controllo del pericolo di incidenti rilevanti connessi con sostanze pericolose”, Gazz. Uff. 14 luglio 2015, n. 161, S.O.. Keeley D., 2008, HSE, Research Report RR671 “Failure rates for underground gas storage”. MATTM, 2018, “Gli stoccaggi sotterranei di gas naturale - Linee Guida per la valutazione dei Rapporti di Sicurezza”, Coordinamento per l’uniforme applicazione sul territorio nazionale di cui all’art. 11 del decreto legislativo 26 Giugno 2015 n. 105. Milazzo et al., 2010, “The Influence of Risk Prevention Measures on the Frequency of Failure of Piping”, International Journal of Performability Enineering, Vol.6. Spencer et al., 1997, “Ignition Probability of Flammable Gases (Phase1)”, HSE Contractor Report RSU8000/081, HSE Books. Uijt de Haag P., Ale B., 2005, TNO, Committee for the Prevention of Disasters, CPR, doc CPR 18 E, “Guidelines for quantitative risk assessment – Purple Book”. van Vliet A., Gooijer L., Laheij G., 2011, RIVM, Report 620550004/2011, “On-site natural gas piping - scenarios and failure frequencies”. 480 11marrazzo.pdf Risk Management and Safety Aspects in Italian Underground Gas Storage Activities