A Comparison of FEP-analysis and Barrier Analysis for CO2 Leakage Risk Assessment on an Abandoned Czech Oilfield

Available online at www.sciencedirect.com

ScienceDirect Energy Procedia 114 (2017) 4237 – 4255

13th International Conference on Greenhouse Gas Control Technologies, GHGT-13, 14-18 November 2016, Lausanne, Switzerland

A comparison of FEP-analysis and barrier analysis for CO2 leakage risk assessment on an abandoned Czech oilfield Øystein Arilda,*, Eric P. Forda, Hans Petter Lohnea, Mohammad Mansouri Majoumerda, Vaclava Havlovab a

International Research Institute of Stavanger (IRIS), P.O. Box 8046, N-4068 Stavanger, Norway b UJV Řež, Hlavní 130, 250 68 Husinec – Řež, Czech Republic

Abstract

The storage of CO2 in depleted oilfields is one of the possible measures for reducing CO2 emissions to the atmosphere. In parallel with the technical feasibility study, a risk assessment focusing on storage risk and reliability need to be undertaken prior to CO2 storage. This is to demonstrate that the quality of the storage site, often formulated as the risk of CO2 containment failure, is acceptable. Legislations in various European countries state such risk assessments shall be provided as part of making a decision with respect to accepting a storage site solution. However, the details and the choices on the risk assessment approach itself are often arbitrary. In the REPP-CO2 project, a research cooperation initiative between Czech Republic and Norway, the main goal is to evaluate the feasibility of a storage site in the Vienna Basin, in the southeastern part of the Czech Republic. As part of the REPP-CO2 project, two different approaches have been selected for performing the risk assessment part, namely the features, events and processes (FEP) approach and the barrier analysis approach, to quantify storage risk. This paper elaborates both approaches and presents strengths and weaknesses for each of them, with respect to work process scalability, available analytical modeling tools, their role in a classical risk assessment context, uncertainty treatment, system suitability and their effectiveness with respect to communication of results. To highlight different aspects of comparison, examples from the Czech storage site candidate are also described in the paper. © 2017 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY-NC-ND license © 2017 The Authors. Published by Elsevier Ltd. (http://creativecommons.org/licenses/by-nc-nd/4.0/). Peer-review under responsibility of the organizing committee of GHGT-13.

* Corresponding author. Tel.: +47 51 87 50 15; fax: +47 51 87 52 00. E-mail address: [email protected]

1876-6102 © 2017 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/). Peer-review under responsibility of the organizing committee of GHGT-13. doi:10.1016/j.egypro.2017.03.1564

4238

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

Keywords: Risk assessment; FEP analysis; Barrier analysis; Geological CO2 storage

1. Introduction According to the fifth assessment report of Intergovernmental Panel on Climate Change (IPCC), “Warming of the climate system is unequivocal”. Moreover, “it is extremely likely” that human influence by emitting greenhouse gas (GHG) is the main contributor to the observed warming since the mid-20th century” [1, 2]. One of the main options to stabilize the atmospheric GHG concentrations is to deploy carbon capture and storage (CCS). This process involves three main steps including capture of GHG (typically carbon dioxide) in emitting sources; transport of the captured CO2 to an appropriate site; and finally long-term isolation and storage of the captured CO2 [1]. Despite considerable global efforts to develop efficient and affordable CCS technologies, risk for CO 2 leakage from the designated storage sites can be high and has been mentioned as one of the main barriers towards the widespread deployment of CCS [3]. Carbon dioxide leakage can have both global and local effects and can potentially have consequences on human health or ecosystems due to increasing CO2 concentrations in the atmosphere or shallow subsurface, dissolved CO2 on groundwater, displacement of brines, and damages to hydrocarbon resources [4]. Therefore, all the associated risks with subsurface injection and storage of CO2 need to be assessed. Concerning “environmentally safe” geological storage of CO2, there are different regulations around the world [4]. At a European level, the Directive 2009/31/EC on the geological storage of carbon dioxide establishes a legal framework and regulates the CCS process. In this directive, the purpose of geological storage of CO2 is stated as “permanent containment of CO2 in such a way as to prevent and, where this is not possible, eliminate as far as possible negative effects and any risk to the environment and human health”. As determined by Annex I of the Directive 2009/31/EC, risk assessment needs to be performed involving hazard characterization, exposure assessment, effects assessment and risk characterization [5]. In addition to risk assessment, various activities including storage site selection, site characterization, storage system design, monitoring and remediation (if necessary) need to be performed that are considered as risk management activities. According to IPCC’s special report on CCS [3], risk management is a structured process to: a) identify and quantify different risks associated with storing CO 2 in geological storages; b) evaluate risks based on inputs and considerations from different stakeholders; c) modify the process of CO2 storage to remove excess risks; and d) identify and implement proper monitoring and remediation strategies to manage the remaining risks. A wide variety of standards and textbooks presents various frameworks on how to undertake risk management in general and in the context of CO2 storage [6-9]. Most of these frameworks agree on the necessary elements in the risk management process. However, most regulatory bodies do not state specifically how to undertake risk management. Operators or storage owners need, therefore, to demonstrate and convince the regulators that the CO 2 storage site is safe in terms of environment and human health. Consequently, a plethora of methods, both quantitative and qualitative, exists for assessing containment risk depending on the specific application and the team who performs the analysis. There is also a variety of approaches towards identifying, analyzing and evaluating risk. Such approaches include features, events and processes (FEP)- based approach [10, 11], reliability-based approach using barrier analysis [12, 13], as well as other approaches including CO2 predicted engineered natural systems (CO2-PENS), data-driven approaches that rely only on data for risk assessment etc. [14, 15]. Being the first stage of a pilot project, the REPP-CO2 project [16] started in January 2015 with support from Norway Grants. The scope of the REPP-CO2 project is limited to evaluation of a potential storage complex, the Brodske LBr-1 field, a part of the Vienna Basin in the southeastern part of the Czech Republic, from different perspectives, including risk assessment. The primary goal of the risk assessment activity is to assess the risk of CO2

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

4239

leakages from the storage system situated in the selected reservoir, in particular with respect to sealing of approximately 50 deep wells [16]. The risk assessment part of the project has included the use of two different approaches. Expertise of the Czech partner with risk assessment of nuclear waste storage using an FEP-based approach is used to assess the risk of CO2 leakage from the storage complex. The Norwegian partner has experience from risk assessment in the petroleum industry using a barrier analysis and is responsible for implementing this approach as part of the risk assessment activity. Drawing on experiences from the REPP-CO2 project, this article aims to compare the FEP and barrier approaches for CO2 leakage risk assessments, with the awareness that both of these approaches are viable and have been used on a variety of applications. This article first presents both FEP and barrier analysis approaches, separately. Then, it is shown how both approaches can be fit into a classical risk management framework, e.g. the one advocated in ISO 31000:2009 [7], thus demonstrating that both approaches will satisfy most European legislations. In addition to some general similarities, differences between both approaches are also elaborated in the paper. Advantages and disadvantages of each approach will be highlighted with respect to work process scalability, available analytical modeling tools, their role in a risk assessment context, uncertainty treatment, system suitability and their effectiveness with respect to communication of results. The paper finally provides a case study to illustrate both approaches, based on examples from the candidate storage site in the Czech Republic. Nomenclature CCS CO2 FEP FMECA GHG HSE IAEA IEAGHG IPCC ISO NORSOK PSA QRA

carbon capture and storage carbon dioxide features, events and processes failure mode, effects, and criticality analysis greenhouse gas health, safety and environment International Atomic Energy Agency International Energy Agency Greenhouse Gas Intergovernmental Panel on Climate Change International Organization for Standardization the Norwegian shelf’s competitive position Petroleum Safety Authority of Norway Quantitative Risk Assessment

2. Risk management process The risks associated with operating any technology must be assessed and managed. A geological disposal facility is considered safe if it meets the relevant safety standards that are internationally recommended, as well as those that are specified by the national regulator [17]. The purpose of risk management is to ensure that necessary measures are taken to protect people, the environment and assets from harmful consequences of the activities being undertaken, as well as balancing different concerns e.g. related to health, environment and safety (HES) and costs. Various guidelines exist for the execution of risk management, most of which are similar. The risk management principles, framework and process is described in the widely adopted international standard ISO 31000:2009 [7].

4240

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

Fig. 1. Risk management principles, framework and process according to ISO 31000:2009 [7] .

The risk management process is the systematic application of policies, procedures and practices on specific activities. As can be seen from Fig. 1, this process starts with the establishment of the context, which includes defining objectives, internal and external parameters to take into account, and the scope and risk criteria to be used in the remaining process. The context establishment is followed by the risk assessment, which in ISO31000:2009 includes risk identification, risk analysis and risk evaluation. In the risk identification part, all sources of risks, areas of impact and events and their causes and potential consequences should be identified. This is followed by risk analysis, which is the development of an understanding of identified elements and their effect on the objectives. The third part of the assessment is the risk evaluation, where the outcome of the risk analysis is put into the context of decision making to provide a basis for making decisions regarding which risks need treatment and the priority of treatment implementation. This typically involves comparing the level of risk found in the risk analysis with the risk criteria in order to determine the acceptable or tolerable level of risk. After the risk assessment, potential risk treatments are considered together with plans for their implementation. Throughout all the mentioned activities, communication and consultation with stakeholders should take place both to communicate results and to understand and agree upon the context and views of the stakeholders. After the initial execution of the activities, the situation should be monitored and the results should be reviewed according to a plan to ensure that the outcomes are performed as desired and kept up-to-date. ISO 31000:2009 is generic and adaptations are made to be more specific within certain areas. Two relevant variations mentioned here, are the Quantitative Risk Analysis (QRA) process described for Norwegian petroleum in NORSOK Z-013 [6], shown in Fig. 2 (a) and a combination of different frameworks for geological storage from IEAGHG [9], shown in Fig. 2 (b). Both are variations of the process laid out in the ISO standard, with the NORSOK standard fitting into a barrier mindset, while the IEAGHG has the FEP approach as one of its cornerstones. The FEP and barrier approaches will be described in later sections.

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

4241

Fig. 2. (a) Risk management process according to NORSOK Z-013 [6] and (b) IEAGHG [9].

The NORSOK Z-013 standard can be seen as a specification, where the context is split into two parts: an initial planning activity focusing on management objectives, including the definition of acceptance criteria and of the system, which limits the scope and puts engineering into the assessment. This is followed by an identification activity, which splits into the qualitative and/or quantitative analysis of frequency and consequences of the identified hazards (initiating events with potential for negative consequences). This analysis is then summarized as a risk picture. The risk picture is then evaluated against the acceptance criteria established in the initial planning activity to identify if risks must be reduced. The effect of risk reducing measures must be assessed by including them in the system definition and updating the risk picture. Even if all risk acceptance criteria are met, additional measures should be considered to reduce risk further. The IEAGHG risk management process (Fig. 2 (b)) [9] is drawn differently compared to the one presented by NORSOK Z-013, and is an attempt to harmonize terminology for risk assessments for geological storage. However, this process also starts with the context and problem formulation. This feeds into the risk assessment, which in this process include risk source assessment, exposure assessment, effects assessments and risk characteristics. The risk source assessment includes site selection and characterization, risk identification and vulnerability assessment, which can be considered identifying the properties of the system, what can happen to the system and features facilitating or inhibiting this. Thus, here the specification of the system is included as an identification activity unlike the definition activity used in NORSOK Z-013. The exposure assessment includes detailing the site characterization, simulation of the system and security, sensitivity and hazard characterization that aims to assess the dimensions of failures of the system. The activity is very much focused on modeling and simulating the system and does not clearly separate frequencies and consequences as the NORSOK Z-013 standard. The effects assessment focuses on the consequences

4242

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

for the identified vulnerabilities, while the risk characterization sums up all the risks and is equivalent to a risk picture. The risk management part consists of risk evaluation, which in the other processes are included under risk assessment, risk treatment and monitoring and verification. This does not differ from the previously mentioned process in the NORSOK Z-013 standard. The risk management feeds back into the context and problem formulation to take into account the implemented treatment options. 3. FEP (Features, Events and Processes) approach The FEP approach has its origins from the radioactive waste management industry, as a tool to construct a system definition in order to identify key scenarios for safety and risk assessments, although in recent years, the FEP approach has also become widely used in the risk assessment process related to geological storage of CO2. In the early 1980s, the IAEA reproduced a list of about 60 phenomena potentially relevant to release scenarios for waste repositories [18, 19], and this has been cited as the starting point for scenario development activities in a number of repository safety studies [20]. Other similar initiatives in the same period include [21-24]. The FEP terminology was however first introduced by the Swedish Nuclear Fuel and Waste Management Company (SKB) and Swedish Nuclear Power Inspectorate (SKI) as part of a Joint Scenario Development Exercise [25]. The building blocks of the system definition are its Features, Events and Processes. These terms are explained and exemplified in Table 1. Table 1. FEP terminology, based on [26]. Term

Short explanation

Examples

Features

Physical characteristics, properties or components of the system of interest

Cement plug Fault Caprock

Events

Discrete occurrences in time (the duration being short compared to the time frame of consideration) which may impact the system

Cement plug leakage Blowout Earthquake

Processes

Gradual or continuous changes, due to interactions between features, which influence the evolution of the system

Forming of microannuli in cement plug Displacement of formation fluids CO2 phase behavior

The distinction between events and processes is not always obvious; however, events are generally short in the timeframe in questions, whereas processes occur over a longer period of time. The basic steps of an FEP analysis are shown in Fig. 3. The first step of an FEP analysis consists of identifying the features, events and processes, and very often relies on the use of checklists as an important aid. Such checklists are often found in the form of online databases containing generic or specific FEPs. The Quintessa Generic CO2 FEP Database [29] is an example of the former, where the FEPs are not case- or site-specific. Specific FEP collections exists from CO2 storage sites such as Weyburn, Canada [30], Williston Basin, USA [31], Decatur, USA [32], Kimberlina, USA [33], In Salah, Algeria [34], Northern Germany [35, 36] and Kalundborg, Denmark [35, 37]. The reliance of checklists and brainstorming in this identification phase depends upon the approach undertaken; using a bottom-up approach, the checklists are used as a starting point, while in a top-down approach the identification is more that of a brainstorming session where FEP databases are used as audit tools to ensure that no important omissions occur. Identified events and processes (EP) are then narrowed down based on semi-quantitative probability and impact assessments, where EPs with very low risk are deemed irrelevant for further analysis and disregarded. The remaining EPs are grouped into either a reference scenario (i.e. base case) or variant scenario (i.e. alternative scenarios). Features are correlated with the EPs, where those features linked to EPs included in subsequent scenario analyses [38].

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

4243

Fig. 3. Basic steps of an FEP analysis [26] based on [27, 28].

In order to structure the relationships and influence between EPs, interaction matrices and influence diagrams are often used, both as visual support tools and to manage complexity. The basic principle of an interaction matrix is to list the parameters defining the properties and conditions in the physical components of the system studied, along the leading diagonal elements of a square matrix. Events and processes that are influenced by, and affect, the properties and conditions defined in the leading diagonal elements of the matrix occur in the off-diagonal elements of the matrix. The matrices, and the decisions made in developing the matrices, are carefully documented in an interaction matrix database. For each matrix element the database contains a short description of the process/or condition, its relevance (with a justification) and a record on date of entry/revision and which experts were involved. Finally, before the further scenario analysis is started, the EPs are grouped based on attributes such as e.g. time scale, spatial scale, process type or common parameters. In the context of geological CO2 storage, the FEP approach often constitutes the qualitative part of the analysis, providing input and guiding the direction of models developed in order to perform the quantitative consequence analysis of each scenario. From a risk assessment process standpoint, the FEP analysis would to a large extent be placed within the risk identification phase (and, one could argue, also the preceding context establishment). Although the FEP approach as such also strongly influences the subsequent risk analysis phase; the strong scenario focus does to a certain extent dictate the way in which risk elements are analyzed. 4. Barrier approach Any activity that takes place with the purpose of providing some kind of societal benefit, such as CO2 storage, may incur accidental events that may harm humans, the environment, assets or reputation. A safety barrier can be considered a defense system put in place to reduce the risk of such accidental events. As barrier thinking is being used in different industries, different terms like safety systems, safeguards and protective systems are used as synonyms for barriers. Despite the widespread applications of barriers, no commonly accepted definition of a barrier exists [39].

4244

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

Several possible definitions have been proposed [39-41], one of them being [39]: “Safety barriers are physical and/or non-physical means planned to prevent, control or mitigate undesired events or accidents.” Safety barriers can be classified and organized in a variety of ways, for example passive, active, physical, technical, human, operational, safety-instrumented system etc. [39, 41, 42]. In the authors’ opinion, for practical purposes, a minimum distinction should be between “hard” or physical barriers such as mechanical, hydraulic and electronic solutions, and “soft” or non-physical barriers such as organizational solutions, human performance and communication. “Hard” barriers are often prioritized, but accidents investigations over a wide range of industries and activities show the importance of including “soft” barriers [43]. For the purpose of barrier analysis related to CO 2 storage, focus will naturally be on the “hard” barriers as these are often placed in the underground and very often physically isolated, thus making their performance independent from “soft” barriers, unless mitigating events such as intervention are included. Safety barriers naturally belong in a risk management context, as they ultimately can control and/or influence the risk level. In the following, the terms “barrier management” and “barrier analysis” as used in Fig. 4 will be elaborated. The Petroleum Safety Authority of Norway (PSA) has had barrier thinking as a priority area for several years, and has recently published “Principles for barrier management in the petroleum industry” [44]. Stated briefly, they introduce what can be regarded a barrier management philosophy and a corresponding terminology that can be used for a wide variety of applications, both within the petroleum industry and elsewhere. This general approach can be used for designing and establishing barriers, controlling barriers during an operation or activity for an existing system and as a tool for accident investigation purposes. The main terms with a short explanation in this barrier terminology is shown in Table 2. Table 2 also provides an example by using a cement plug in a plugged and abandoned well as a case in order to show the applicability of the terms in a CO2 storage context. The PSA philosophy is well integrated with many of the NORSOK standards in the sense that the standards fits the language introduced. For a CO2 storage case, wells are often the major risks with respect to CO 2 leakage from the storage reservoir [46]. Designing wells to minimize leakage from a reservoir, be it oil or gas from an abandoned oil and gas field or a CO2 storage reservoir, the approach to well barrier thinking is in essence the same. In Norway, the NORSOK D-010 standard [45] takes a barrier management approach to the establishment of well barriers for wells that are to be permanently plugged and abandoned. Although many onshore wells around storage sites around the world may not have been plugged using this standard, the methodology that NORSOK D-010 uses for mapping the barriers in place and setting up barrier elements can be used on any well, as shown in section 5.3. Having defined barrier management as the overarching approach, the next step for a real case is barrier analysis, which is a more detailed specification of how barriers look like, depending on for which part of the barrier life-cycle one are studying. From the literature [42], there is a plethora of tools and methods at varying degrees of detail available for this, some examples being Hazard-barrier matrixes, Safety-barrier diagram variants and BORA. In the following, the bow-tie method will be briefly introduced, as this was used for the study of the Brodske field.

Fig. 4. Illustration of in which context barrier approach is used, and terminology illustration of the work flow used in this case.

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

4245

Table 2. Barrier terminology, as defined in [44], with an example taken from [45]. Term

Short explanation

Example

Barrier

Technical, operational and organizational elements that are intended individually or collectively to reduce possibility for a specific error, hazard or accident to occur, or which limit its harm or disadvantages.

Cement plug and the formation connected to it

Barrier element

Technical, operational or organizational measures or solutions that play a part in realizing a barrier function.

Cement plug

Barrier function

The task or role of a barrier. Examples include preventing leaks or ignition, reducing fire loads, ensuring acceptable evacuation and preventing hearing damage.

The purpose of the plug is to prevent flow of formation fluids inside a wellbore between formation zones and/or to surface/seabed.

Barrier strategy

Result of a process that, on the basis of the risk picture, describes and clarifies the barrier functions and elements to be implemented in order to reduce risk

Use at least two barriers that are independent of each other.

Performance requirements

Verifiable requirements related to barrier element properties to ensure that the barrier is effective.

Non-shrinking, ability to withstand mechanical loads, resistant to chemicals, impermeable.

They can include such aspects as capacity, functionality, effectiveness, integrity, reliability, availability, ability to withstand loads, robustness, expertise and mobilization time. Barrier management

Coordinated activities to establish and maintain barriers so that they maintain their function at all times

Not possible after permanent plugging and abandoning the well, except for trying to detect leakage at surface/seabed

Performance influencing factors

Verifiable requirements related to barrier element properties to ensure that the barrier is effective.

Pressure, temperature, reservoir fluid composition and geological movements

They can include such aspects as capacity, functionality, effectiveness, integrity, reliability, availability, ability to withstand loads, robustness, expertise and mobilization time.

A bow-tie is a safety-barrier diagram that visualizes the risk under consideration and the barriers that are in place to reduce the risk, as shown in Fig. 5. The diagram is shaped like a bow-tie and has the risk event under consideration in the middle, marked by a circle. The left side of the diagram represents underlying and direct causes to the risk event occurring together with the (preventive) barriers in place to stop the causes from developing. The right side of the diagram represents potential effects from the leak occurring together with (remedial) barriers in place to reduce the effects from the event. The bow-tie can act as a starting point for mapping the barriers in place, but for more detailed analysis, it is often required that engineering evaluations, phenomenological studies and uncertainty modelling be taken into account [47].

Fig. 5. Example of a conceptual bow-tie diagram for a leakage scenario.

4246

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

5. Case study 5.1. Brodske well Br-73 To exemplify some of the key differences and similarities between the FEP and barrier approaches, this section uses a case study focusing on the features, events and processes, and barriers of the legacy well Br-73 in the Lbr-1 field in the Czech Republic. The field, located in the southeastern region, produced the majority of its oil and gas resources between the mid-50s and the late 70s. Today there is no production and the field is a pilot candidate for CO 2 injection. Well Br-73 is a former oil and gas production well, with production occurring between 1958 and 1977. In October 2000, the well was abandoned according to Fig. 6, in accordance with Czech legislations for abandonment procedures. In the following sub-sections, the system definition will be limited to well Br-73 to avoid too many scenarios for the sake of illustration. Furthermore, the focus here is on leakage-related scenarios, i.e. loss of containment of formation fluid and/or CO2. However, the system must also consider its immediate surroundings, which either act as barriers or which are related to the system in terms of consequences. In addition, to allow for a more direct comparison with the barrier analysis, the focus is on the features, events and processes leading up to a leakage situation, while not considering what happens post-leakage. That essentially means, the factors such as how CO2, or other substances, escape/migrate, and to where, nor whom are the receptors are not elaborated here. For the barrier analysis, this paper is only concerns the technical barriers; operational and organizational barriers are not investigated. 5.2. FEP approach The FEP approach consists of six basic steps; i) FEP identification, ii) FEP classification, iii) FEP ranking, iv) FEP screening, v) FEP interaction and grouping and vi) scenario formation [29, 48]. Furthermore, the approach can be undertaken “top-down” or “bottom-up”. In the former case, an FEP database in used as an audit tool and modelling-

Fig. 6. Well abandonment schematic for well Br-73, courtesy of Pereszlényi and Franců

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

4247

aid, to check that all relevant FEPs have been included, whilst in the latter, case it is the other way around, where the starting point is the database, and relevant FEPs are then screened and filtered. In the REPP-CO2 project, we applied the bottom-up methodology, using the Quintessa Generic CO2 FEP Database [29] as a starting point for generating scenarios. The process was conducted by gathering various experts within different disciplines, and going through the list of generic FEPs, to exclude those not deemed relevant in any way to the site in question. In the first stage, the list of FEPs was still quite extensive, as shown in Table 3. The fact that the FEPs are generic implies they are suggestive as to what could be included, but are not FEPs in themselves. The FEP classes used in Quintessa are: 0) Assessment basis, 1) External factors, 2) CO2 storage, 3) CO2 properties, 4) Geosphere, 5) Boreholes, 6) Near-surface environment and 7) Impacts [29]. The argumentation for the excluded FEP categories (0 – Assessment Basis, 1 – External Factors, 4 – Geosphere, 6 – Near-Surface Environment and 7 – Impacts) and sub-categories/items are based on the system definition (one particular well, not the geological storage system as a whole), so here issues mostly directly related to properties and failures of the wellbore and its sub-components are of interest. Table 3. Initial set of FEPs for well Br-73, prior to screening. Class

Sub-class

Sub-Sub-class

FEPs identified (high level abstraction)

1 - External factors

Future human actions

Motivation and knowledge issues

Inadvertent damage to wellbore caused by humans

Social and institutional developments

Changes in legislation requiring operations on abandoned wells

Quality control

Verification procedures related to borehole integrity

Accidents and unplanned events

Incomplete sealing of borehole, leading to free pathway for CO2 and hydrocarbons

2 - CO2 storage

Pre-closure

Sabotage/intrusion to storage site, causing damage to wellbore

Destruction of wellhead, caused by vehicle in motion 3 - CO2 properties, interactions and transport

CO2 interactions

Mechanical processes and conditions

Borehole lining collapse

5 - Boreholes

Drilling and completion

Well lining and completion

Cement bond logs Casing program Cement properties

Well records

Well coordinates Wellbore schematics Blowout reports

Borehole seals and abandonment

Closure and sealing for boreholes

Plug locations Plug thickness Plug porosity Plug permeability Plug material Date of abandonment Abandonment procedures

Seal failure

Cement cracks Forming of microannuli in cement Casing corrosion De-bonding of cement plugs

Blowouts

Blowout to surface Underground blowout

4248

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

To proceed towards generating leakage scenarios, coarse probability and consequence assessments are applied, using expert judgments and available information, to remove those scenarios which are deemed very unlikely or which have insignificant consequences. As an example, based on the elicitation screening process, it is found that the probability of the wellbore leaking as a result of acts of sabotage or other intended malicious efforts was very low; hence, it was not analyzed in-depth any further. In this way, the list of FEPs was reduced somewhat. Using an FEP interaction matrix, to investigate connections and degree of relevance between different FEPs, finally resulted in a set of potential leakage scenarios on which to focus on. Essentially, these stemmed from the “Seal failure” and “Blowouts” category with distinctive leakage scenarios for different migration paths through the casing, annulus cement and cement plugs. The scenarios that were established for further analysis are listed in Table 4. Table 4. Scenarios generated from the FEP analysis (The system in question here is well Br-73). Leakage path category

Leakage path sub-type

Leakage scenario

Wells

Abandoned wells

Leakage between cement fill and outside of casing Leakage between cement plug and inside of casing Leakage through cement well plug Leakage through casing Leakage in cement fill fractures Leakage between cement fill and formation rock

Injection wells

Leakage in casing wall due to corrosion Leakage through the safety valve and xmas tree due to failure in safety valve, xmas tree or related equipment Blowout through the well due to failure in downhole safety equipment

5.3. Barrier approach The well barrier analysis approach can be said to contain three main steps; 1) define and become familiar with the system, 2) identify failure modes and failure causes, 3) construct a reliability model of the well barrier system, 4) perform a qualitative analysis of the fault tree, 5) perform a quantitative analysis of the fault tree and 6) report results [49]. In the case of abandoned well Br-73, the main barrier function is sealing off injected CO 2 and hydrocarbons, to prevent loss of containment through or along the wellbore. In order to address identification of barrier systems and barrier elements, the NORSOK D-010 standard is used for guiding principles, see Fig. 7. This means that the barriers to be identified are those being primary barriers, i.e. those intended to isolate flow from an inflow source to surface, and secondary barriers, i.e. barriers intended to prevent flow in the event of a breach of the primary barrier, and finally, any other additional barriers adding extra redundancy to the system. Table 5 then gives an overview of the barriers, following the structure of NORSOK D-010 superimposed on the wellbore schematic for Br-73. In the example, the classification is simplified into three barrier groups, in addition to the surface well barrier. Note that barriers can have common barrier elements. Based on the barrier elements that have been established, some of the key functions of each element can be identified. For example, a cement plug shall prevent any inflow from formations where it seals perforated intervals of the casing, and also it shall prevent flow vertically. Therefore, using the intended functions of each well barrier element may serve as a starting point for trying to establish ways in which they may fail. Here, the use of e.g. an FMECA is common, which principally is conducted by posing the following questions: a) in what ways can system components fail, b) what are the underlying failure causes, c) how are failures detected, d) what are the failure effects and e) how critical are the failure effects.

4249

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

Fig. 7. Generic example of well barrier elements for a permanently abandoned, perforated well, where tubing is removed [45].

Using the cement plug as an example, we can here identify cement failure such as degradation due to CO 2/H2S, thermal cracking, de-bonding (micro-annulus between cement and casing), pre-existing channels or insufficient displacement. Similarly, the casing could fail because of material degradation by corrosion from annulus or reservoir fluids, or material yields due to e.g. insufficient thermal or pressure capacities. The use of checklists for generic or specific failure modes can be an efficient aid in the FMECA process. The process of answering the key questions posed in an FMECA leads to the construction of fault trees, in order to structure the connections between specific failures and possible leakage scenarios. Table 5. Well barrier elements for Br-73. Barrier classification

Well barrier element type

Element name

Depth range

Primary well barrier

Formation

Lower Badenian

Ca. 1190-1105 m

Casing

Production casing

288 – 1155 m

Cement plug

Lower isolation plug

1098 – 1200 m

Cement plug

Upper isolation plug

1028 – 1095 m

Cement plug

Mid cement plug #1

440 – 483 m

Formation

Pannonian

Ca. 0-440 m

Casing cement

Cement, surface casing

2 – 290 m

Casing

Surface casing

2 – 290 m

Cement plug

Mid cement plug #2

256 – 297 m

Formation

Pannonian

Ca. 0-440 m

Casing cement

Cement, surface casing

2 – 290 m

Casing

Surface casing

2 – 290 m

Cement plug

Upper cement plug

96 – 124 m

Cement plug

Surface plug

2 – 46 m

Casing cement

Cement, surface casing

2 – 290 m

Cement cap

Cement cap

0–2m

Secondary well barrier

Tertiary well barrier

Surface well barrier

4250

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

An example of such a fault tree is shown in Appendix A.1, where the fault tree has been simplified to a high level for illustrative purposes. The level of detail of such fault trees must depend both on the objective of the analysis as well as how the analysis will be used when considering reliabilities of each branch of the tree. If it is difficult to arrive at quantitative assessments of reliabilities for certain branches, there is perhaps no need to exhaust the level of detail further, but rather attain a more qualitative approach. 6. Comparison of approaches When comparing the FEP and barrier approaches, it should again be noted that these are sub-activities taking place within a risk management process. They are also not normative methodologies as such, but can be viewed as particular mindsets which share common objectives but utilize different means. From the experience of the REPP-CO2 project, where both sets of approaches were applied, both similarities and differences between the two were found, which are hereafter discussed in more detail. The FEP approach does not explicitly define its position in a traditional risk management framework, however it is safe to say that it is mainly used in the establishment of context and risk identification steps, wherein the system definition is formulated and subsequently divided into smaller sub-systems and components. Once this has been done, i.e. the most relevant FEPs are identified, and scenarios have been established, the process of risk analysis and quantification of risks is not particularly defined. How various scenarios are simulated and which methods are used, is rather up to the analysts; the FEP approach does not have common practices for using any specific methods for this phase. The FEP analysis seems to invoke an implicit understanding that the purpose of the scenario (risk) analysis should lead to a risk matrix, in which each scenario has an assigned probability of occurrence and judgments of consequences on one or more dimensions. The uncertainties addressed in an FEP context are often in relation to the consequences of the variant scenarios, and perhaps have a lesser focus on the probabilities of failure. A reason could be because the irrelevant scenarios are screened on the basis of coarse probability/consequence judgments, and once the relevant scenarios are in place, the main interest revolves around identifying what are the resulting consequences. The notion of failure frequencies is less important, as the scenario is classified as “relevant”. The barrier approach is also strongly centered in the context establishment/risk identification part of the risk management process, as one of the initial steps is the identification of barriers and barrier elements, essentially compartmentalizing the system into parts. While the barrier approach explicitly states that barriers can be both technical, operational or organizational, often times analyses using this approach gravitates towards the former type, perhaps to a certain extent because such analyses are common in engineered systems, such as a well, where even the barrier terminology is widely used. However, the experience of the authors is that the barrier approach to a stronger degree outlines how the subsequent risk analysis step shall be conducted, and also (especially when the analysis concerns primarily technical barriers) the focus is of a more quantitative nature than what is the case for an FEP approach. Against this backdrop, it is perhaps not surprising that the barrier approach is more preoccupied with failure frequencies, as these often constitute mandatory inputs, at least when using fault trees with the objective of obtaining system reliability. Concerning commonly used methods for identification and risk analysis, there are differences between the two approaches, In the FEP approach, the use of checklists is an implicit prerequisite. However, the reliance of the checklist is dependent upon whether a top-down or bottom-up approach is adapted. The top-down approach basically becomes a brainstorming/checklist duality, where the brainstorming creativity lies the foundation, and the checklist is used to ensure no important features, events or processes are forgotten. Whereas in a bottom-down approach, the methodology is more that of a conventional checklist-based analysis and reliance on the completeness of the checklist becomes obvious. In contrast, a barrier analysis does not need to have a checklist in place at all. In many cases, such as the example using the NORSOK D-010 standard, there is one, but that will largely depend on the domain of application, and to what extent the system can easily be sub-divided into components. The oil and gas industry widely uses the barrier concept (as in many cases, operators are required by law to do so), hence, it has checklists in place for identifying and analyzing system barriers. On the other hand, one would expect that for systems that are more difficult

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

4251

to represent in terms of technical components, and where the barrier notion is as much or more related to operational or organizational aspects, the barrier analysis relies less on checklists and more on brainstorming. The FEP analysis, at least when using the bottom-up approach, often relies on both process influence diagrams and interaction matrices, and especially so if the number of identified FEPs becomes large. On the other hand, establishing both an influence diagram and an interaction matrix, in the case where the number of FEPs is greater than e.g. 15, quickly becomes a daunting and exasperating task, and the tools quickly may become obstacles as much as aids. This is why the top-down approach is much preferred, as the starting point is primarily brainstorming potentially relevant FEPs, and using checklists to audit. Barrier analyses often use hazard-barrier matrices, in which various hazard sources are mapped against identified barrier types (barrier efficiency is sometimes added as a third dimension), Failure Mode, Effects and Criticality Analysis (FMECA), event and fault trees, and variations of bow-tie diagrams. Principally, the interaction matrix used in the FEP analysis and the hazard-barrier matrix used in the barrier analysis are simply slightly different means to the same end, namely to map to two different building blocks of the analysis together in order to produce scenarios in the case of FEP, and fault tree branches for the barrier analysis. Conversely, process influence diagrams, focusing on any relations between included items, are vastly different from the more sequential event and fault trees. That said, neither types of methods are strictly required in the respective approaches; this mostly becomes a difference once the formality of the analysis increases. One of the key challenges to an efficient and useful analysis, regardless of approach, relies on the ability of the analyst to narrow the scope down to one that is manageable, yet avoids excluding important scenarios in the process. The possibility of important omissions is less in a bottom-up FEP approach, but at the cost of a more time-demanding analysis, both in terms of going through all potential FEPs and to screen and select those scenarios to proceed with. The more “flexible” approaches of top-down FEP and barrier analysis run the risk of omitting scenarios especially where checklists either are non-existent or where they exist but are high-level or generic. Criteria for selecting relevant scenarios are generally only present in cases where legislation requires the analysis to begin with (case in point being the NORSOK D-010 standard). In cases where there are too many scenarios to analyze in full, exclusion is done on the basis of preliminary judgments of probability and/or impacts of scenarios, which in some cases might lead to the removal of key assumptions or limitations which were a premise for the judgment. In addition, the barrier analysis will reduce the analysis to focus on the barriers of the systems, and could possibly neglect aspects that were not defined as part of a barrier system. A common attribute for both the FEP and barrier analysis is the normative set of representing the system in a particular way. In the FEP approach, the system is comprised of building blocks in the form of features, events and processes, whose interactions result in the creation of scenarios to be further analyzed. The equivalent for barriers consists of technical, operational and organizational barriers, whose failure modes give rise to scenarios. Though these are both types of system building blocks, the nomenclature of the two gives rise to different focus areas in the identification and analysis steps; the FEP is more concerned with describing attributes of the system and their interactions, while the barrier approach leads towards investigating the ways in which the specific parts of a system might fail. Arguably, in terms of areas of application, the barrier approach is very well suited where the system can, with little effort, be modelled in terms of components and sub-systems, which typically have different operational states and failure modes. Whereas an FEP approach would likely be far more suited than a barrier approach where there are challenges in abstracting the system into a model, and where ambiguity in the system or system component borders is high. The weakness of a technical-oriented barrier approach lies in that it more or less requires the system be represented using logical trees, and that each branch in these trees can somehow be assessed. A barrier-approach in the case of organizational/operational barriers poses the challenge of distinguishing what the barriers actually are; as the barrier definition moves further away from a physical, concrete object, so it becomes increasingly blurry to distinguish items that are barriers from items that are not. It should also be noted that the FEP distinction between events and processes is not always obvious, as these primarily only differ in terms of duration. Another point to put forward is how the results of the two approaches can be communicated in the latter stages of the risk assessment. The authors’ experience from this project perhaps suggest that the technical-barrier approach is

4252

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

somewhat easier to communicate in terms of the results of the analysis. Essentially, the example here used an abandonment schematic as a starting point for identifying the barriers of the system. Each barrier was investigated in terms of failure modes, which were then visualized in a fault tree, showing their role in leading to a leakage. In particular fault and event trees, notwithstanding excessive complexity, are generally easier to explain and understand. This is perhaps partly because of their more widespread use than process influence diagrams or interaction matrices, which to a greater extent require an accompanying explanation in most cases. It is also the view of the authors that this communicative advantage of the barrier approach makes the process easier to document and more transparent. However, the FEP approach also provides cases where its advantages become evident when compared to the barrier approach. The FEP approach is perhaps better at looking at the overall risk in a predefined system, which should mainly be evaluated against acceptance criteria, typically where any preventive measures are prohibitively expensive to install, or out of human control. Thus, it is most useful to differentiate between different locations with different features, as opposed to the design of a system given a location. This is probably why it has found such relevance for CO2 storage projects, where different fields are evaluated and compared, and the geology and abandoned wells are taken as is. Table 6 summarizes the comparison between the FEP and barrier approaches. Table 6. Summary of comparison between the FEP and the barrier approach. Comparison basis

FEP approach

Barrier approach

System definition

Part of identification

Initial activity (prior to identification)

System is refined based on identified FEPs

Barriers are established from barrier elements

System suitability

Applicable when it is difficult to abstract a system into a model, or the ambiguity in system borders are high

Applicable for clearly defined systems that can be described in terms of barriers, or for engineering of systems

Identification

Open search screened for relevance

Restriction to impact on barriers

Heavily dependent on checklists to ensure coverage

Not all risk reduction might be accounted for as barriers may be neglected

Focus

Attributes of the system and their interactions

Components of the system and how they might fail

Typical methods

Process influence diagrams, interaction matrices

Hazard-barrier matrices, FMECA, event trees, fault trees, bow-tie diagrams

Uncertainty focus

Focus on consequences

Focus on failure frequencies

Challenges

To ensure all relevant FEPs are considered Analysis less specified

Avoiding purely technical focus Defining the barriers, in particular for nonphysical barriers Only considers the barriers, thus a limited system view

Legislation suitability

Acceptance criteria of exposure

Requirements on barriers in place, and reliability of barriers

Communication

Scenarios and risk matrices

Bow-ties and trees

Focus on risk acceptance

Focus on system engineering

7. Conclusions This paper has addressed two different approaches, or mindsets, to parts of the risk management process; the FEP approach and the barrier approach. The motivation for the comparison arose from the different origins of two approaches, where the FEP has its origins in the nuclear waste management industry and the barrier approach is closely

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

4253

tied to in particular the petroleum industry. This coincided with the fact that the research program REPP-CO2, a Czech-Norwegian pilot project for geological storage of CO 2, presented the opportunity for experts with experience from both sets of approaches, to make comparisons as part of the project’s risk assessment activity related to loss of containment from the storage complex. This paper has outlined the basic steps of each approach, and then showed how each approach was performed in a practical example, based on experience from the REPP-CO2 project. Using an abandoned legacy well from the Brodske LBr-1 field in the Czech Republic, the case was used as a basis to make comparisons between the two, with regards to issues such as pros and cons, their role in the risk management process, methods and techniques used in their execution, suitability to types of systems, communicative ability towards decision makers, etc. The overall message based on our findings is that the FEP and the barrier approach simply represent two different means to the same end; they constitute different ways to represent and analyze a given system, and use, to a certain extent, different techniques in doing so. The subsequent differences primarily stem from this difference in key system building blocks; in much the same way that differences between two languages manifests itself in cultural and social differences, so too can the linguistics and nomenclature shape the processes and key mindsets of each. Yet at the same time, as with languages within the same family, there are similarities in the shape of shared objectives and similar approaches unifying them in certain aspects. Acknowledgements The authors are grateful to Norway Grants for financial support of “Preparation of a Research Pilot Project on CO2 Geological Storage in the Czech Republic (REPP-CO2)” with project number NF-CZ08-OV-1-006-2015. We would also like to express our gratitude to MND, a.s. and Palivovy kombinat Usti, s.p. for provision of site-related (or wellrelated) data., and to the invaluable work of Miro Pereszlényi and Juraj Franců, for providing essential data used in the risk assessment of the project.

Appendix A. A.1. Example of a fault tree for leakage from an abandoned well

4254

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

References [1] IPCC, Climate Change 2007: Fourth Assessment Report (AR4), 2007, Intergovernmental Panel on Climate Change. [2] IPCC, Climate change 2013: The Physical Science Basis (Summary for Policymakers) . Contribution of Working Group I to the Fifth Assessment Report, Stocker, T.F., Qin, D, Editor 2013, Intergovernmental Panel on Climate Change: Switzerland. [3] IPCC, Carbon dioxide capture and storage - Special Report, 2005, Intergovernmental Panel on Climate Change: Cambridge University Press, Cambridge, United Kingdom. [4] Morgan, G., Wilson, E.J, Policy brief - Regulation of carbon capture and storage, 2008, International Risk Governance Council (IRGC): Geneva, Switzerland. [5] Directive 2009/31/EC of the European Parliament and of the Council of 23 April 2009 on the geological storage of carbon dioxide and amending Council Directive 85/337/EEC, European Parliament and Council Directives 2000/60/EC, 2001/80/EC, 2004/35/EC, 2006/12/EC, 2008/1/EC and Regulation (EC) No 1013/2006 (Text with EEA relevance), 2009: L 140/114, Official Journal of the European Union. [6] NTC, NORSOK Z-013 Rev. 2 - Risk and emergency preparedness analysis, 2001, Norwegian Technology Centre (NTC): Oslo, Norway. [7] ISO, ISO 31000-2009 Risk management -- Principles and guidelines, 2009, the International Organization for Standardization (ISO). [8] Aven, T., Foundations of risk analysis, 2nd edition, 2012, Chichester, United Kingdom: John Wiley & Sons, Ltd. [9] IEA, A review of the international state of the art in risk assessment guidelines and proposed terminology for use in CO 2 geological storage, 2009, Report Number 2009-TR7, International Energy Agency Greenhouse Gas (IEA GHG) R&D Programme. [10] Le Guen, Y., Le Gouevec, J., Chammas, R., Poupard, O., Van Der Beken, A., Jammes, L, CO2 storage: Managing the risk associated with well leakage over long time scales. SPE Projects, facilities and construction, 2009. 4(3): p. 87-96. [11] Bai, M., Song, K., Li, Y., Sun, J., Reinicke, K.M, Development of a novel method to evaluate well integrity during CO 2 underground storage. SPE Journal, 2015. 20(3). [12] Bournea, S., Crouch, S., Smith, M, A risk-based framework for measurement, monitoring andverification of the Quest CCS Project, Alberta, Canada. International Journal of Greenhouse Gas Control, 2014. 26: p. 109-126. [13] Loizzo, M., Bois, A.P., Etcheverry, P., Lunn, M.G, An evidence-based approach to well-integrity risk management. SPE Economics & Management, 2015. 7(3): p. 100-111. [14] Watson, T.L., Bachu, S, Evaluation of the potential for gas and CO2 leakage along wellbores. SPE Drilling and Completion, 2009. 24(1): p. 115-126. [15] Viswanathan, H.S., Pawar, R.J., Stauffer, P.H., Kaszuba, J.P., Carey, J.W., Olsen, S.C., Keating, G.N., Kavetski, D., Guthrie, G.D, Development of a hybrid process and system model for the assessment of wellbore leakage at a geologic CO 2 sequestration site. Environmental Science and Technology, 2008. 42(19): p. 7280-6. [16] http://www.geology.cz/repp-co2/english [17] PAMINA (2010) PAMINA Handbook. www.pamina.eu [18] IAEA (1981), Safety Assessment for the Underground Disposal of Radioactive Wastes. International Atomic Energy Agency, Safety Series Report No. 56, IAEA, Vienna. [19] IAEA (1983), Concepts and examples of safety analyses for radioactive waste repositories in continental geological formations. International Atomic Energy Agency, Safety Series Report No. 58, IAEA, Vienna. [20] OECD NEA (2000), Features, Events and Processes (FEPs) for Geologic Disposal of Radioactive Waste – An International Database. [21] Cranwell, R.M., Guzowski, R.V., Campbell, J.E. and Ortiz, N.R. (1982), Risk Methodology for Geologic Disposal of Radioactive Waste: Scenario Selection Procedure. Report of US Nuclear Regulatory Commission NUREG/CR-1667 (SAND80-1429), NRC Washington DC (revised and reissued 1987). [22] d’Alessandro, M. and Bonne, A. (1981), Radioactive Waste Disposal in a Plastic Clay Formation. A Site Specific Exercise of Probabilistic Assessment of Geological Containment. Harwood Academic Press, New York. [23] Nagra (1985a), Project Gewähr 1985. Nuclear Waste Management in Switzerland: Feasibility Studies and Safety Analyses. Nagra Project Report NGB 85-09 (English Summary), Baden, Switzerland. [24] Nagra (1985b), Projekt Gewähr 1985. Endlager für schwach und mittelaktive Abfälle: Sicherheitsbericht. Nagra Projektbericht NGB 85-08, Baden, Switzerland. [25] Andersson, J. (editor) (1989), The Joint SKI/SKB Scenario Development Project. SKB Report TR 89-35 and SKI Report No. TR 89:14, Stockholm, Sweden. [26] CGS Europe (Fetched 04.10.2016): http://repository.cgseurope.net/eng/cgseurope/knowledge-repository/key-reports/evaluation/6/2/3.aspx [27] Wildenborg AFB, Leijnse AL, Kreft E, Nepveu M, Obdam ANM, Orlic B, Wipfler EL, van der Grift B, van Kesteren W, Gaus I, Czernichowski-Lauriol I, Torfs P, Wojcik R. Risk assessment methodology for CO2 storage – the scenario approach. In: Benson SM, editor. The CO2 Capture and Storage Project (CCP) for carbon dioxide storage in deep geologic formations for climate change mitigation, Vol. 2: Geologic Storage of Carbon Dioxide with Monitoring and Verification. Elsevier Publishing, Oxford, UK; 2005: 1293-1316. [28] Chadwick RA, Arts R, Bernstone C, May F, Thibeau S, Zweigel P (2008). Best Practice for the Storage of CO 2 in Saline Aquifers. Occasional Publication No. 14, British Geological Survey, Keyworth, UK. [29] Savage D, Maul PR, Benbow S, Walke RC. A generic FEP database for the assessment of of long-term performance and safety of the geologic storage of CO2. Quintessa Report QRS-1060A-1; 2004; 73pp (http://www.quintessa-online.com/FED_DB_report.pdf) [30] Stenhouse MJ, Zhou W, Savage D, Benbow S. Framework methodology for long-term assessment of the fate of CO2 in the Weyburn field. In: Thomas DC, Benson SM, editors. Carbon dioxide capture for storage in deep geologic formations results from the CO 2 Capture Project, 2, Elsevier Ltd; 2005: 1251-61. [31] Ayash SC, Dobroskoka AA, Sorensen JA, Wolfe SL, Steadman EN, Harjua JA. Probabilistic approach to evaluating seismicity in CO2 storage risk assessment. Energy Procedia, 1; 2009: 2487-94.

Øystein Arild et al. / Energy Procedia 114 (2017) 4237 – 4255

4255

[32] Hnottavange-Telleen K, Krapac I, Vivalda C. Illinois Basin – Decateur Project: initial risk assessment results and framework for evaluating site performance. Energy Procedia, 1; 2009: 2431-8. [33] Oldenburg CM, Doughty C. Overview of reservoir simulation and risk assessment for WESTCARB’s Kimberlina Phase III Pilot. Proceedings of the 8th Annual Conference on Carbon Capture and Sequestration Anchorage, AK October 1-2, 2008: 26pp. [34] Paulley A, Metcalfe R, Limer L (2010). Systematic FEP and scenario analysis to provide a framework for assessing long-term performance of the Krechba CO2 storage system at In Salah. Energy Procedia, 4; 2011: 4, 4185-4192. [35] Chadwick A, Arts R, Bernstone C, May F, Thibeau S, Zweigel P, editors (2007). Best practice for the storage of CO 2 in sailne aquifers: observations and guidelines from the SACS and CO2STORE projects. CO2STORE Project Report CO2STORE_BPM_final; 2007: 273pp. [36] Kreft E, Bernstone C, Meyer R, May F, Arts R, Obdam A, Svensson R, Eriksson S, Durst P, Gaus I, van der Meer B, Geel C (2007). “The Schweinreich structure”, a potential site for industrial scale CO2 storage and a test case for safety assessment in Germany. International Journal of Greenhouse Gas Control, 1: 2007; 74-79 [37] Larsen M, Bech N, Bidstrup T, et. al. Kalundborg case study, a feasibility study of CO2 storage in onshore saline aquifers. CO2STORE. GEUS Report 2007/280; 2007: 79pp. [38] Thomas DC, Benson SM (editors). Carbon Dioxide Capture for Storage in Deep Geologic Formations - Results from the CO2 Capture Project: Vol 1 - Capture and Separation of Carbon Dioxide from Combustion, Vol 2 - Geologic Storage of Carbon Dioxide with Monitoring and Verification. Elsevier, Jan 6, 2005. [39] Sklet S (2005). Safety Barriers on Oil and Gas Platforms – Means to Prevent Hydrocarbon Releases. Doctoral thesis for the degree of doktor ingeniør. Trondheim, December 2005. Norwegian University of Science and Technology, Department of Production and Quality Engineering. [40] Sobral J, Soares CG. Risk Management Based on the Assessment of Safety Barriers, Mechanical Engineering Department, ISEL, Portugal, ISBN 978-972-8954-42-0. http://dx.doi.org/10.14195/978-972-8954-42-0_22. [41] Hollnagel E (1999). Accidents and barriers, pp. 175-180 in Proceedings CSAPC’99, In Hoc JM, Millot P, Hollnagel E, Cacciabue PC (Eds.). Villeneuve d’Asq. France: Presses Universitaires de Valenciennes. [42] Rausand M (2013). Risk Assessment: Theory, Methods, and Applications. John Wiley & Sons, Jun 12, 2013. [43] Harms-Ringdahl L (2009). Analysis of safety functions and barriers in accidents. In Safety Science 47 (2009) 353-363. [44] PSA (2013). Principles for barrier management in the petroleum industry. PSA, 29.01.2013. http://www.ptil.no/getfile.php/PDF/Barrierenotatet%202013%20engelsk%20april.pdf [45] Standards Norway (2013). NORSOK D-010 Rev. 4 – Well integrity in drilling and well operations, Rev. 4, June 2013, Standards Norway, Lysaker, Norway. [46] IEA Greenhouse Gas R&D Programme (IEA GHG), “Long Term Integrity of CO2 Storage – Well Abandonment”, 2009/08, July 2009. [47] de Rocquigny E (2012). Modelling Under Risk and Uncertainty: An Introduction to Statistical, Phenomenological and Computational Methods. ISBN: 978-0-470-69514-2, Wiley, April 2012. [48] Condor J, Unatrakarn D, Wilson M, Asghari K (2011). A Comparative Analysis of Risk Assessment Methodologies for the Geologic Storage of Carbon Dioxide, In: Proceeding of the 10th International Conference on Greenhouse Gas Technologies (GHGT-10) Amsterdam 4036-4043 [49] Torgergsen HEB; Haga HB; Sangesland S; Aadnøy BS; Sæbø J; Johnsen S; Rausand M; Lundeteigen MA (2012). An Introduction to Well Integrity. 2012.