Advanced monitoring and simulation for underground gas storage risk management

It is crucial to ensure the safety and integrity of underground gas storage (UGS) infrastructure for energy reliability in California, and many other places around the world. To address the risk management need in UGS industry, we take advantage of recent advances in downhole fiber optic monitoring and coupled well-reservoir simulation to provide unprecedented understanding of gas flow in wells at UGS sites. We have combined advanced monitoring and simulation of UGS operations into a decision-support system called the Integrated Risk Management and Decision Support System (IRMDSS). The IRMDSS framework includes three components: (i) mechanistic models, (ii) continuous and frequent monitoring data, and (iii) a supervisory interface for performing analyses using the models and monitoring data. The goal of the IRMDSS is to equip UGS operators with real-time monitoring data and simulation tools that can alert them to potential failures, detect early leakage, and support mitigation decision-making to prevent otherwise larger failures. We demonstrate an application of the IRMDSS by analyzing the temperature and pressure response to a hypothetical leak. Through a review of distributed temperature sensing (DTS) data collected at an operating UGS facility we show that DTS can uniquely and precisely identify the depth of the gas-water-contact in the well annulus, and that DTS can provide an early warning signal of upward gas flow as would occur in a well blowout scenario. When combined with modeling analysis, a rough leak rate can be roughly estimated to understand the severity of the leakage conditions and to support the mitigation decision needed.


Introduction
The main purpose of underground gas storage (UGS) is to meet varying demand for natural gas (predominantly methane, CH 4 ) over daily to seasonal time scales.For example, in California limitations on the import rate of natural gas by transmission pipelines and from in-state gas production make UGS necessary to reliably meet winter peak heating demand (CCST, 2018).A schematic of the main components of a UGS site is shown in Fig. 1 for storage in a porous media reservoir, which could be a saline aquifer or a depleted oil or gas reservoir.Whether UGS is carried out in caverns, aquifers, or depleted gas or oil reservoirs such as those used in California, incidents of various kinds involving gas leakage and fires/explosions have been documented around the world over the many decades that UGS has been carried out (Evans, 2008(Evans, , 2009;;Folga et al., 2016).
The main hazard of UGS is that natural gas is highly flammable when mixed with air at certain concentrations, making gas leakage at the ground surface a severe safety hazard and threat to surface infrastructure (Miyazaki, 2009).At the same time, the tendency for gas leakage is ever-present because of the high pressure of the stored gas and the repeated injection and withdrawal cycles which stress the well-formation storage system.Failure of a well can result in a loss of containment (LOC) of natural gas.While this LOC can occur anywhere along a failed (leaking) well, the most serious manifestation is a large-scale surface blowout, such as the one that occurred at the Aliso Canyon UGS facility in California in October 2015 (e.g., Conley et al., 2016;Freifeld et al., 2016;Pan et al., 2018).LOC can also occur due to failure of the natural system to contain gas, e.g., by fracturing or faulting of the caprock, with or without associated failure of wells (e.g., Evans and Schultz, 2017;Araktingi et al., 1984;Chen et al., 2013).Either well leakage or leakage through fractures at sufficiently high rates can cause unacceptable gas loss and/or potentially catastrophic damage to natural gas storage facilities at the ground surface.The present-day necessity to use natural gas for meeting the peak winter heating load in California, the well-known hazards associated with natural gas storage, and the recent high-profile incident in California point out the urgent need for a risk management system that is thorough, robust, and reliable.
As shown in Fig. 1, there are many surface and subsurface components of UGS systems relied upon to transport and contain high-pressure gas between the transmission pipeline and the storage reservoir.Failures of one or more of these components arising from any number of causes, e.g., accidents, poor maintenance, and/or errors in operation, can result in incidents with catastrophic consequences.UGS operators follow government regulations and their own internal risk management protocols and procedures to safely operate their UGS surface and subsurface infrastructure.In California, the surface infrastructure consisting of pipes, compressors, expanders, and gas-processing units is regulated by the California Public Utilities Commission (Interagency Task Force on Natural Gas Storage Safety, 2016), while the wells which can extend up to two miles downward into the subsurface are regulated by CalGEM (formerly, the Department of Oil, Gas, and Geothermal Resources) (California Department of Conservation, 2021).In contrast to surface infrastructure, wells at UGS sites are challenging to monitor and maintain because they are not easily observable or accessible.
We have built on recent advances in subsurface monitoring and coupled well-reservoir simulation to develop an Integrated Risk Management and Decision-Support System (IRMDSS) for improved UGS risk management.The IRMDSS has been developed to improve LOC risk management for the subsurface components of UGS, specifically wells and geomechanical aspects controlling caprock integrity.The underlying concept of the IRMDSS framework is to integrate continuous monitoring data available from new fiber-optic distributed sensing approaches and the prediction capability of advanced mechanistic models.The combination of monitoring and modeling allows the operator to quickly identify off-normal conditions and carry out what-if simulations to guide decision-making in preventing and mitigating LOC incidents.Specifically, the IRMDSS is designed to integrate three risk management components to provide better information for decision-making: 1.A set of mechanistic models that can be run to simulate and evaluate potential impact and mitigation strategies for UGS under various operational and failure scenarios; 2. Advanced monitoring technologies to provide new and continuously updated monitoring data to identify off-normal conditions and potential or imminent risk; 3. A supervisory interface (SI) to integrate system components and to perform analyses using models and monitoring data, along with visualization data and model results, with the goal of providing the key information needed to support evidence-based and defensible decision-making.
The general IRMDSS framework can be applied to any UGS site, but our focus during development of the framework has been on subsurface UGS facilities in depleted hydrocarbon reservoirs (porous media).The mechanistic models incorporated in the framework and the specific monitoring technologies and data stored in the SI are site-and wellspecific, but the workflow is generic, i.e., how the monitoring data and models can be integrated within the SI for analyzing scenarios and evaluating impacts and mitigation strategies.For demonstration here, the Honor Rancho UGS site in Santa Clarita, California, owned by Southern California Gas Company (SoCalGas), is used as the case study Fig. 1.Schematic of UGS system components showing surface infrastructure (enclosed by upper long-dashed boundary) and the site surface and subsurface system components (shaded area enclosed by lower short-dashed boundary).The IRMDSS focuses on the subsurface components but includes the wellheads and topography that are at the intersection of the surface and subsurface domains (modified after Oldenburg et al., 2018, Chap. 1.0).
at which an active UGS well was instrumented for IRMDSS development and demonstration.An example use case is presented in Appendix A and will be discussed further below.
In this paper, we present the IRMDSS framework and an example of the integration of monitoring data and advanced mechanistic model simulation.The example shows how real-time temperature data from a downhole fiber-optic system and coupled well-reservoir modeling can be used to identify and assess an incipient well failure before it becomes a large-scale blowout.

Background and definitions
In the context of UGS, a failure scenario is a single event or process, or a sequence of events or processes, that involves the failure of one or more components relied upon in a UGS system to safely contain highpressure gas in its intended reservoir and surface infrastructure.Such failure is known as LOC, and involves potentially severe related consequences (e.g., fire or explosion) depending on the scenario.The risk addressed in the IRMDSS can be defined as the product of the likelihood (e.g., probability of occurrence) and the consequences (e.g., severity) of a specific failure scenario (e.g., a large-scale well blowout for UGS).Risk assessment is the quantitative or semi-quantitative evaluation of the likelihood (e.g., annual average frequency of occurrence) and the severity (e.g., cost of lost natural gas, cost of damage to infrastructure, potential loss of use of the facility) of various failure scenarios, the product of which is used to estimate risk.Risk can be reduced by reducing the likelihood of the failure scenario to happen, an activity known as risk prevention.Risk can also be reduced by decreasing the potential consequences of the failure scenario, an activity known as risk mitigation.Risk management can be thought of as a collection of all of the activities including hazard identification, risk assessment, prevention, and mitigation all aimed at reducing risk to acceptable levels within the context of the overall objectives of the industrial operation (NRC, 2009).Evidence-based and data-informed decision-making are essential for effective risk management.This section provides a review of the current risk management practices that are common in the UGS industry, including the role played by monitoring technologies and engineering and mechanistic (simulation) models.

Standard monitoring practice and qualitative risk assessment at UGS sites
The current standard monitoring programs employed at UGS sites include wellhead pressure (tubing and casing), temperature, surface leakage monitoring and detection, and well-logging and well inspections.A typical practice for pressure monitoring in depletion-drive reservoirs is to monitor wellhead pressure and then compute the corresponding bottomhole (reservoir) pressure (BHP) using gas thermodynamic models.The problem with this approach is that variable or unknown temperature of the column of gas in the wellbore leads to a significant uncertainty in the density of the wellbore fluid which then gets carried over into the estimate of the BHP.Similar to BHP estimates in oil reservoirs (e.g., Ponomareva et al., 2021), these uncertain pressure estimates may lead to erroneous estimates of gas inventory, which may mask detection of even moderate leaks when using conventional gas inventory approaches for leak detection.
Various logging tools can be used to evaluate and characterize properties like cement bond quality, casing wall thickness, and mechanical integrity (i.e., pressure-holding capacity) (Ellis and Singer, 2007).In California, one of the required methods for identifying leaks (CalGEM (nee DOGGR) Requirements for California Underground Gas Storage Projects, §1726.6) in a gas storage well is to perform annual noise and temperature logs.Similarly, casing pressure testing must be carried out on 24-month intervals or on an approved well-specific frequency interval.The year-long interval between logs and the two-year interval for pressure testing creates the possibility of an LOC incident evading detection over an extended time, during which a leak could grow into a more serious incident.On the other hand, increasing the well logging frequency may not be an effective solution to risk reduction because the very act of doing the logging carries with it LOC risk associated with shutting in the well and installing pressure control equipment to facilitate logging.In addition, logging surveys require operators to be present onsite to lower the logging tool down the borehole, which carries risk to personnel, and is expensive and time-consuming.
Depending on the results of well logging and mechanical integrity testing, the well may be assessed to have a higher or lower likelihood of failing in one way or another.Other data points operators can use for assessing likelihood of failure come from statistics of failures of UGS facilities themselves (Evans, 2008(Evans, , 2009;;Folga et al., 2016;Evans and Schultz, 2017).Regarding the consequences part of risk assessment, depending on logging results and possibly the location of the well (e.g., its proximity to workers or offsite populations), the potential consequences of a well failure resulting in LOC can be estimated qualitatively.

Changing role of models for UGS risk assessment
Traditionally, reservoir engineering methods (e.g., Katz and Tek, 1981) involving long-term observations and development of experience with the reservoir have been used in the UGS industry to predict future behavior of the system to aid in interpretation of measurements.Recently, advanced mechanistic models have begun to gain favor in understanding certain aspects of a natural gas storage facility (e.g., to understand the leakage processes and pathways at the Leroy UGS facility (Chen et al., 2013)).A wellbore simulator was used in 2015-2016 to understand the failure of several kill attempts at the Aliso Canyon UGS facility well blowout in California (Pan et al., 2018).In the study by Pan et al. (2018), different scenarios of killing the SS-25 well were simulated during the time of the blowout incident using the T2Well simulator (Pan and Oldenburg, 2014;Pruess et al., 1999) as constrained by well and gas release data to understand why various kill approaches were not working.Another example of an advanced model is the TOUGH-FLAC simulator, developed at LBNL by coupling TOUGH2 and FLAC3D (Rutqvist, 2011;Pruess et al., 1999).TOUGH-FLAC was used to analyze if caprock integrity might be compromised using the proposed increased operation pressure at two Canadian gas storage facilities (Walsh et al., 2015).These studies are examples of mechanistic modeling applications to UGS that demonstrate the usefulness and effectiveness of simulation in risk management, e.g., in evaluating mitigation strategies and supporting decision-making regarding adjustments in operations to mitigate risk.

Current risk management approach for UGS facilities
The standard overall risk management approach for UGS operation includes three steps: 1) threat (or hazard) identification, 2) development of risk mitigation activities, and 3) development of investment plans to reduce or mitigate risk.As applied currently, this approach usually focuses on hazard and threat identification without use of mechanistic models that can potentially simulate and predict system failure and evaluate preventive measures (simulate what-if scenarios).Moreover, the current risk-evaluation approach does not capture the dynamics of system risks that may change rapidly because current data-collection approaches rely on static or periodically collected data and do not take advantage of continuously updated monitoring data and updated mechanistic model simulations.The result is that risk assessments are not updated effectively to give the operator the most current information for decision-making.It is important to note that continuously updated data not only allow the risk assessment to reflect current conditions, but continuous data also allow the operator to understand how conditions are changing over time, which may provide evidence to evaluate multiple hypotheses for what processes and trends are occurring.
Recently, a more comprehensive risk-based approach to well Y. Zhang et al.
integrity management was developed and advocated by a team that included federal and state regulators along with natural gas storage operators to address the need for better and more consistent risk management within the UGS industry.This approach is referred to the American Petroleum Institute Recommended Practice 1171 (API RP 1171, 2015): Functional Integrity of Natural Gas Storage in Depleted Hydrocarbon Reservoirs and Aquifer Reservoirs.The approach includes five steps: 1) data collection, documentation, and review, 2) hazard and threat identification, 3) risk assessment, 4) risk treatmentdeveloping preventive and mitigative measures, and 5) periodic review and reassessment.As described in API RP 1171, dynamic monitoring data can play a significant role in helping identify potential risks, developing preventive measures before catastrophic events happen, and in guiding mitigative measures when such catastrophic events happen.
The approach we have developed (the IRMDSS framework) as described below is aligned with the API 1171 approach in that the IRMDSS merges mechanistic process models with continuously collected real-time data to evaluate site scenarios and provide indicators of potential threats.The IRMDSS is a platform that allows operators to carry out integrated monitoring and modeling.

Overview
The IRMDSS framework consists of three components: (i) mechanistic (simulation) models, (ii) continuous and frequent monitoring data from advanced monitoring technologies, and (iii) a supervisory interface.The basic function of the SI is to store models and data for a UGS site, and to provide a user-friendly environment to run simulations and analyze monitoring data.In short, the SI is a platform for a user to perform scenario analysis and provides key information for decision support.Although the mechanistic models and monitoring data are sitespecific, the design of the SI is generic, i.e., the IRMDSS workflows and framework can be applied to any UGS site.

Models
The models considered essential for managing UGS risks are shown in Fig. 2 and include reservoir, geomechanical, geohazard and wellbore models.While the reservoir, geomechanical, and wellbore models are mechanistic, the geohazard model is distinct in that it takes a probabilistic approach and is intended to be carried out infrequently, as discussed below.

• Reservoir model
Reservoir modeling is used in the IRMDSS to assess and predict the response of reservoir pressure to natural gas injection and withdrawal (I/W).The code used for numerical reservoir simulation is iTOUGH2 (Finsterle, 2004), with a fluid property module appropriate for water and CH 4 (EOSCH4).The equation of state module EOSCH4 models fluid properties for two components (water and CH 4 ) and two phases (aqueous phase and gas phase).The model is built based on site-specific geological conditions (natural containment features such as caprock and sealing faults), engineered components (wells), and rock properties of the storage reservoir (porosity, permeability, pore fluids).With the focus on modeling pressure change in the reservoir, the reservoir model uses a simplified conceptualization for wells whereby they are modeled as source/sink terms with refined mesh around them in the reservoir domain.The main purpose of the reservoir model is to simulate pressures in space and time in the reservoir during I/W operations under various operational or risk mitigation scenarios.Disagreement between bottomhole pressure data and reservoir model forecasts may indicate off-normal behavior that could warrant further evaluation.

• Geomechanical model
The geomechanical model is used to simulate stress changes and deformation in the reservoir and overburden due to gas I/W in the storage reservoir, and also potentially due to other I/W activities (such as those related to oil production) in strata above or below the storage reservoir.In general, deformation of hydrocarbon reservoirs can lead to porosity and permeability changes that may affect gas flow, pressure, and stress conditions in the storage reservoir (e.g., Martyushev et al., 2019).The stress state of the UGS site geology over years can affect both wellbore and caprock integrity, as well as fault stability.The main goal of the geomechanical model in the IRMDSS is to evaluate caprock integrity over long-term UGS I/W operations.The methods used for geomechanical modeling are embodied in the TOUGH-FLAC code, a coupling of the TOUGH multiphase porous media flow simulator and FLAC (Rutqvist, 2011).

• Wellbore model
The wellbore model is used to simulate withdrawal, injection, and leakage (blowout) processes in the well.The code implemented in the IRMDSS is T2Well, which couples fluid and heat flow between well and the reservoir (Pan and Oldenburg, 2014).Briefly, T2Well models two-phase flow in the well using the drift flux model to account for inertia and for friction losses, and couples flow in the well to flow in the porous media reservoir where Darcy's law is used.Details of T2Well methods are provided in Appendix B. The wellbore model can be used to predict pressure and temperature response patterns under normal and/or abnormal (leaking) conditions within a wellbore.The main purpose of a wellbore model in the IRMDSS is to diagnose leakage at early stages through comparison against observed pressure and temperature data, or analyze leakage incidents to estimate losses and impacts.In addition, it can also be used to simulate various pressure control procedures (e.g., well kills) for leaking wells and help identify optimal procedures for each type of well configuration and gas storage system to minimize the impacts of well failure.
Unlike the reservoir model, the wellbore model considers only one well at a time, but this model is quite detailed in its consideration of processes and includes the key mechanisms of two-phase non-isothermal multicomponent flow coupled to the porous reservoir.By this approach, T2Well models should be developed individually for each well based on the well diagram and current condition/characteristics. The reservoir elements in the wellbore model serve to provide an approximate link to the reservoir by providing more realistic boundary conditions for the wellbore model than are provided by other wellbore modeling approaches.However, if the focus of an analysis is on a reservoir process rather than a process in an individual well, the reservoir model discussed previously should be used.
Currently the wellbore model and reservoir model are independent of each other for computational efficiency.However, if both reservoir and certain well(s) need to be modeled accurately, the two models can be coupled (i.e., well bottom elements can be connected to the corresponding elements in the reservoir as the average well radius is used at those locations).

• Geohazard analysis
Geohazard analysis is performed to provide probabilistic seismic hazard analysis (PSHA), probabilistic fault displacement hazard analysis, and a pseudo-probabilistic earthquake-induced landslide hazard analysis.The main purpose of the analysis in the IRMDSS system is to help diagnose if a certain condition (e.g., unexpected LOC with resulting natural gas plume at the surface) could be caused by a geohazard (e.g., fault displacement, or landslide).The geohazard analysis is carried out by examining geotechnical data (e.g., topography, climate, surface geology, seismicity, etc.) and estimating likelihoods for failures such as slope failure, landslide or events such as seismicity.For example, results of the PSHA are presented in terms of ground motion as a function of annual exceedance frequency.It not only provides a mean probability that an event may happen within a (long) period of time, but also provides the 5th and 95th percentiles of the probability as a measure of uncertainty.Unlike the previous three models, the analysis does not rely on how the field is operated.Unless more site characterization information becomes available, there is no reason to repeat the analysis and update the result.In other words, the geohazard analysis results are relatively static.

Monitoring
The advanced monitoring technologies currently integrated into the IRMDSS include: • Downhole quartz pressure/temperature sensors: These sensors provide real-time measurements of pressure and temperature at the bottom of the well.These direct downhole measurements avoid the potential uncertainties arising from the current practice of estimating downhole conditions using wellhead measurements and associated assumptions about well-fluid/gas-column composition and temperature.In addition, the direct measurement of reservoir pressure can improve the accuracy of gas inventory estimates in pressure-depletion storage systems.
• Fiber-optic Distributed Temperature Sensing (DTS) DTS comprises optoelectronic devices that measure temperatures by means of optical fibers (Dakin et al., 1985;Selker et al., 2006;Tyler et al., 2009).Temperatures are recorded along the optical fiber cable, thereby forming a continuous temperature profile.A DTS interrogator is the size of a standard personal computer and can measure along an optical fiber up to several kilometers in length.DTS temperature resolution is about 0.02 • C for a 1-hr integration time, or 0.1 • C for 5 min-integration time.Spatial resolution along the cable can be as high as 25 cm.The main advantage of DTS is that it provides continuous temperature profiles 24/7.Temperature profiles and their changes over time are very sensitive to upward and downward migration of fluids in wells, making these data critical for assessing normal and off-normal flow behavior.DTS profiles in combination with a wellbore model analysis can provide invaluable understanding of flow processes in the well as will be shown in the case study below.
• Fiber-optic Distributed Acoustic Sensing (DAS) DAS technology uses fiber-optic cables as a linear array of acoustic sensors that records the acoustic field at high spatial and temporal resolution (Parker et al., 2014;Hartog et al., 2017;and Bakulin et al., 2020).Data can be recorded along the borehole at spatial density as high as 25 cm.The characteristics of the acoustic noise generated along the borehole will change continuously during UGS I/W operations.DAS signals representing the typical noise patterns for different stages of operation can be defined over time as being "normal."With this long-term normal baseline, anomalies in the acoustic profile recorded in DAS signals can be identified and used as an indicator to the operator that the well is behaving differently from normal, a potential early indication of an LOC incident in need of further investigation.For example, turbulence generated by channelized flow across perforations or noise associated with leaks generate high-amplitude acoustic signals that deviate from background noise, enabling identification of anomalous behavior of the system.
The above three technologies comprise the downhole monitoring components of the IRMDSS, which can be instrumented together through one hybrid electro-optic cable.Fig. 3 shows the design of the downhole hybrid fiber-optic cable.The copper lines are used to operate the downhole pressure-temperature gauge, and the fiber-optic lines acquire DAS and DTS data.Unlike the current practice for noise and temperature logging, which is done annually at UGS sites in California, fiber optic measurements can be made autonomously.The high-spatial resolution of the DAS/DTS measurements enable identifying localized anomalies.The unique features provided by these novel downhole monitoring technologies make them a promising tool for long-term, insitu monitoring of UGS.
Additional technologies used in the IRMDSS but not as closely integrated as the fiber approaches include: • Interferometric Synthetic Aperture Radar (InSAR) for ground deformation This technology uses satellites to measure millimeter-scale changes in the satellite-to-surface distance which can be translated into surface deformation over spans of days to years (Massonnet and Feigl, 1998).The ground deformation may be due to many causes, such as groundwater pumping and excavation.Well leaks, reservoir leaks and fault motion can also produce detectable surface movements (e.g., Vasco et al., 2010).The measured surface deformation can then be transformed to infer the volume changes within the reservoir associated with pressure changes due to natural gas storage operations.The goal is to use the estimate of reservoir volume change and the observed range changes to identify anomalous events.Many space agencies (e.g., The European Space Agency, the Japanese Space Agency, and the Canadian Space Agency) operate InSAR satellite systems.The German government operates TerraSAR-X and the Italian government operates COSMO-SkyMed.The data are often freely available or available at low cost for non-commercial use such as hazard mitigation, thereby providing cost-effective long-term monitoring.In order to extract the range change the data must be processed in order to remove atmospheric effects, orbital errors, and the influence of topography.There are both public and commercial software products that allow an organization to process InSAR data.Some service companies will process InSAR data for a fee.The advantage of InSAR is that the cost is low and the data-collection process is non-intrusive.
• Unmanned Aerial System (UAS)/Drone gas leak monitoring UAS drone surveys can be used to monitor CH 4 atmospheric concentrations at various low elevations above the ground surface for surface LOC detection.Drone surveys can be done at different scales: a survey using unmanned aerial vehicle (UAV) can be used to delineate a CH 4 plume at the UGS site scale while hand-carried, or a vehicle-driven drone can be used for local leakage detection on the well-pad scale.Frequent surveys or installation of permanent sensors at certain locations continuously measuring atmospheric CH 4 concentration and windspeed at high frequency can be used to estimate leakage fluxes and source locations using the eddy covariance approach as demonstrated for CO 2 leakage by Lewicki et al. (2009).

Bringing it all together: IRMDSS function and integration
Monitoring data and model capabilities are integrated in the IRMDSS framework so that UGS operators can detect off-normal behaviors and simulate and evaluate what-if scenarios for risk prevention (lowering the likelihood of incidents) and mitigation (lowering the consequences of incidents).Fig. 4 illustrates the relationships between the various functions of the IRMDSS.The centerpieces of the framework are the intake and analysis of advanced monitoring data (the "monitoring" box in the middle of Fig. 4), and use of that data by advanced mechanistic modeling and related analyses (the "modeling" box in the middle of Fig. 4).There are a number of methods related to data display, filtering, and model analysis that the system manages under user control.The operator can use the IRMDSS to aid in anomaly detection, risk quantification, and development of mitigation strategies.
The IRMDSS SI is implemented using JavaScript and python.The main utilities built into the SI include: • Provide facility for IRMDSS users to run various pre-defined scenarios for UGS operation using model input files stored in the IRMDSS framework • Serve as a database for site data (map), monitoring data and model data (input/output); • Provide data visualization • Provide a platform for combining monitoring data with analytical models to perform analysis for safe reservoir operations, anomaly detection and location, and to quantify and analyze UGS data/performance anomalies; • Provide use cases to demonstrate how to perform analyses using tools integrated into IRMDSS for UGS risk management and decision support.
Listed on the left-hand side of Fig. 4 are several use cases that can be accessed in the system to provide a suggested workflow for the IRMDSS

IRMDSS demonstrations 2.3.1. Overview
To demonstrate the IRMDSS, we present here an example use case.Most of the IRMDSS use cases consist of the following general activities or steps: 1. Monitor (data collection); 2. Detect (is there an anomaly?); 3. Locate (where is it?);4. Quantify (how bad is it?);5. Analyze (what could be the cause, how is it evolving, how can it be fixed?); 6. Inform the decision (what are the indicated potential risk management actions?).

Example: tubing leak analysis based on monitoring and modeling of well flow
In this demonstration of the integration of data and mechanistic modeling in the IRMDSS, we present a common UGS problem involving interpretation of downhole temperature data in the context of a flowing well with possible LOC occurring (see Use Case 2 in Appendix A).The general workflow follows the steps 1-6 outlined above.
The scenario begins with use of the IRMDSS at a UGS site to plot monitoring data being collected including DTS and DAS profiles along with wellhead pressures.A schematic well diagram is shown in Fig. 5.Under normal conditions, the annulus has a liquid column filled up to 1022 m depth with no annulus-tubing connection.Fig. 6 shows annulus wellhead pressure and gas flowrate during gas injection/withdrawal (see Fig. 6, second Y axis).Gas injection started at time 2 h with a rate of 2 kg/s or 104 cf/s, when a tubing leak was triggered.Wellhead pressure in the annulus (Fig. 6a) was significantly elevated and then became relatively stable at ~22 MPa, indicating an off-normal tubing-annulus connection.Wellhead pressure in the tubing (Fig. 6b) experienced a spike but typically the wellhead tubing pressure can be noisy when injection starts making the signal hard to interpret.In addition, real time DTS data indicate sudden heating and subsequent cooling at a depth of 3700-5000 ft (~1100-1500 m) (Fig. 7a), as compared to the expected smooth temperature transition at those depths without leakage (Fig. 7b).The temperature anomaly indicates potential leakage.Wellhead and bottomhole temperatures can be extracted as a time series to demonstrate abnormal temperatures at the two locations, as shown in Fig. 8.In summary, there are at least two independent measurements, annulus wellhead pressure and DTS temperature profiles over time, that point to the existence of a tubing leak.This description so far comprises Steps 1 and 2 (monitor and detect anomaly).Note that all of the data shown in Figs.6-8 are synthetic data, i.e., we used a model UGS well and the mechanistic simulator T2Well to generate these synthetic data for demonstration purposes.Details of the T2Well model properties of the well are presented in Appendix B.
Step 3 is to locate the leak.The local cooling, shown by the virtual DTS data plotted in Fig. 7, provides an approximate range of depth where the tubing hole is, but the duration of the cooling depends on the size of the tubing leak; if it does not last long and the DTS sampling is not frequent enough (every 10 min at the demonstration well), the exact location may be hard to pinpoint.However, the exact location can be  Specifically, Fig. 9a shows a vertical temperature profile of DTS measurements from the UGS demonstration well at the time that injection started, a typical observation made just prior to start-up of injection.Note the oscillations with depth in temperature above 1200 m depth level and the relatively smaller oscillations with depth below 1200 m.These variations arise from the clamping of the DTS cable to the tubing and the variation in thermal conductivity of the adjacent fluid in the annulus.Fig. 10 shows that during the installation of the tubing string, the IRMDSS fiber-optic cable was strapped at intervals onto the tubing using metal bands.The metal bands are locations where the DTS cable is in direct thermal communication with the tubing and thus closely follows the tubing temperature.When there is a gradient in temperature between the fluid flowing in the tubing and the formation temperature, the lower thermal conductivity of gas in the annulus relative to water leads to larger oscillations in the temperature, and the higher thermal conductivity of the liquid damps out the oscillations.Another way to understand the difference in oscillations above and below the gas-water contact is higher thermal conductivity fluid within the annulus leads to smaller thermal gradients, and lower thermal conductivity gas leads to higher thermal gradients.These thermal oscillations are most pronounced when the well is undergoing a large thermal transient, such as at the start of injection or withdrawal.
Fig. 9b shows virtual data on how the liquid-gas contact changes over time in the annulus for the analyzed scenario.The liquid-gas contact was initially at 1022 m, and then the liquid in the annulus started to flow into the tubing until the liquid-gas contact eventually stabilized at around 1500 m (which can be found based on DTS profiles).This indicates the leak in the tubing is at a depth of 1500 m, as shown in Fig. 9b.
Step 4 is to quantify the size of a leakage orifice, or crack in tubing in this scenario.In the T2Well model, the size of the crack is quantified by the area and the perimeter of the opening.Quantification of crack size and shape can be determined by carrying out a number of simulations with a variety of crack sizes (Table 1) to compare to DTS measurements.Fig. 11 shows the temperature deviation from the baseline (temperature if there were no leakage) for a few examples.Notice the cracks in Figs.11a and b have the same area, but different perimeters; the holes in Figs.11a and c have the same perimeter, but different area.The small, medium, and large leak areas are highlighted for easy comparison.The general observation from these simulations is the temperature deviation due to leakage is mostly determined by the area of the crack rather than  the shape, i.e., the smaller the area is, the stronger the local cooling is.The perimeter of the crack at constant area (an indicator of elongation of the crack) does not seem to have much impact on the local cooling.For smaller leak size, the cooling is initially stronger and it takes longer time for the cooling to disappear.By comparing the simulated and the observed (virtual) temperature deviation, it can be determined the area of the crack is about 5 × 10 − 4 -6 × 10 − 4 m 2 (for reference, if this hole were circular, the diameter would be ~1 inch).
Similarly as for temperature, pressure deviations in the annulus from the baselines are calculated (Fig. 12) and compared to the observed (virtual) pressure deviation (wellhead pressures can be measured in both annulus and tubing).The conclusions are similar to those for the temperature deviation.The area of the crack is an influential parameter affecting annulus pressure and temperature change due to leakage.The perimeter does not have much influence.The pressure increase in the annulus for smaller leaks is slower compared to that for bigger leaks.
In theory the area of the crack can be estimated without knowing the shape of the crack.In addition, dynamic flow and temperature data over time along with well-flow modeling can be used to estimate the changes in the size of the tubing crack (or hole) over time.Although these estimates could have very large uncertainty, the information may be useful in evaluating possible causes of the hole (e.g., corrosion at a threaded junction, result of prior damage noted in well record).The operator can also choose to run in a slickline to set a plug in the tubing and then pressure up the tubing with liquid.The next decision can depend on the estimated crack size and if the tubing can hold pressure within a set tolerance.In summary, we have demonstrated Use Case 2 of the IRMDSS to analyze a tubing leak and help support risk management decisions related to this leak.

Table 1
List of the size of the leakage holes used in the simulations.
Y. Zhang et al.

Discussion
As we have shown, advances in modeling and monitoring can be used to improve UGS safety and manage risk.From the test applications of the IRMDSS based on the demonstration example presented here, it was shown that: • Unexpected changes in the location of the gas-liquid interface in the annulus are an indication of a potential well integrity issue.Current practice is to identify the interface based on the use of a sonic waterlevel monitoring system.The sonic measurements are highly inaccurate, and could result in a level determination accurate to only ±20 m.In comparison, the DTS measurement that is part of the Fig. 11.Temperature deviation from the baseline for the size of the hole listed in Table 1.IRMDSS provides for continuous monitoring of the annulus fluid level and with an accuracy of ±50 cm.• Determining the size of a casing or tubing leak could be important for understanding the severity of the condition and allow for estimation of pressures within the annulus.The wellbore model combined with downhole monitoring data as integrated in the IRMDSS provides a way to estimate leak rate.
In terms of the monitoring technologies demonstrated, we showed that fiber-optic DTS monitoring provide continuous, high-resolution measurements of the temperature within the borehole, which enable an in-situ and accurate assessment of the wellbore conditions at a level not possible with other monitoring technologies.Currently the fiber optic sensing instruments may result in a higher upfront cost compared to the typical well inspections required by regulation.However, one has to keep in mind there is no well work-over related to these technologies, the cost and risk of which will depend on the well inspection frequency.With the cost of fiber-optic sensing instruments rapidly decreasing, they promise to become cost-efficient tools for long-term monitoring in UGS.

Conclusions
UGS has played and will continue to play a critical role in the near future to meet energy demand during the peak winter heating period in California.Because many UGS facilities utilize wells that were installed decades ago and then were re-purposed for UGS, it is essential to have rigorous monitoring programs and up-to-date risk management approaches to address the safety concerns related to containing highpressure flammable gas at these facilities.
In this paper, we described a risk management framework for UGS facilities called the IRMDSS.This risk management framework integrates three main components: (i) mechanistic models and analyses, (ii) advanced monitoring technologies, and (iii) supervisory interface built around several use cases.The mechanistic and analytical models provide defensible answers to "what-if" questions, helping analyze anomalies and evaluate mitigation strategies.Advanced monitoring technologies provide near real-time monitoring data that can provide the input to trigger alarm systems for early warning of off-normal behavior, and help identify potential threats that can allow operators to take preventive measures.Lastly, the supervisory interface provides a user-friendly environment for running models and performing analysis, and use cases provide a workflow and guidance for various UGS risk management scenarios.Demonstration of the IRMDSS showed how integrating monitoring data and results from simulations using mechanistic models can be used to characterize the leak and/or carry out various what-if scenarios useful for decision-making in risk management.

Declaration of competing interest
The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Appendix B. T2Well modeling of a leaking UGS well
T2Well is a numerical simulator for modeling non-isothermal, multi-phase, and multicomponent fluid and energy flow in integrated well-reservoir systems (Pan et al., 2011a(Pan et al., , 2011b;;Pan and Oldenburg, 2014).In T2Well, the flow in the well is described by the two-phase momentum equations whereas the flow in the reservoir is described by multiphase Darcy law (Table A2-1).By applying the DFM, the two-phase momentum equations are lumped into a momentum equation of the mixture (Eqs.B2-1), which can be solved for the mixture velocity u m (Pan et al., 2011a): In Eqs.B2-1, t is time, z is distance, A is cross sectional area of the flow path, γ is a phase-slip term (a complex function of local two-phase flow regime described by DFM), p is pressure, Г is the perimeter of the cross sectional area, f is the friction coefficient (a function of Reynolds number and other geometric parameters), ρ m is the mixture density, g is gravitational acceleration, and θ is the inclination angle.We use special friction factors to model lateral connections between the tubing and annulus.
The thermophysical properties and phase diagnostics are calculated using the equation of state model for real gases and brine implemented in a research version of EOS7C (Oldenburg et al., 2004).Properties of the well and reservoir are presented in Tables B2-2 and B2-3.

Fig. 2 .
Fig. 2. Block diagram schematic of (1) the large-scale geomechanical model that includes the reservoir and overburden, (2) the reservoir flow model, and (3) the wellbore flow model.The Geohazard analysis comprises induced seismicity and landslide hazard analysis.

Fig. 3 .
Fig. 3. Cable configuration for the fibers to acquire DTS and DAS data and to operate the downhole pressure-temperature gages.

Fig. 4 .
Fig. 4. Relationships between the major functions of the IRMDSS framework for handling the Use Cases shown on the left-hand side.

Fig. 6 .
Fig. 6.First Y-axis shows synthetic pressure measurements for the leakage case and expected measurements under normal conditions (i.e., no leakage) (a) in the annulus at wellhead; (b) in the tubing at wellhead.Second Y axis shows the injection (+) and withdrawal rates (− ) in units of kg/s.

Fig. 7 .
Fig. 7. Temperature profile (a) from an anomalous DTS measurement; and (b) expected if there were no leakage.Assuming the injection and well leak start at time 2 hr.

Fig. 9 .
Fig. 9. (a) DTS vertical profile from real downhole measurements; (b) simulation results showing how the liquid-gas contact in the annulus changes over time for the assumed scenario.

Fig. 10 .
Fig. 10.Photograph of the tubing being lowered into the IRMDSS demonstration well showing the straps that hold the DTS cable onto the tubing between intervals where the cable tends to bulge outward from the tubing.

Fig. 12 .
Fig. 12. Pressure deviation in the annulus relative to the no-leak baseline for the sizes of hole listed in Table1.
Governing equations solved in T2Well (see Nomenclature for definition of symbols)

Table A -
1 (continued ) Locate leak Workflow Note the thermal anomaly location (depth) from DTS and/or temperature log Dataflow Extract temperature data from IRMDSSdb, and plot it vs. length along well.If available, plot data from multiple times to look at time-evolution.UC 2.2.Correlate with well construction record Workflow Correlate leakage location with well construction logs (joint locations, age of tubing) to understand potential cause/reason/type of leakage Dataflow Extract well construction logs and plot them at the same scale as the temperature along the well.UC 2.3.Estimate leakage rate Workflow Shut-in the well Vent flow and then allow pressure build-up in the annulus.Continue to monitor casing pressure and analyze the rate of pressure build-up or changes in the rate to estimate the leakage rate.Dataflow Measured annular casing pressure data are recorded in the IRMDSSdb.Extract P vs. time data and plot to estimate the leakage rate.

Table B2 -2
Dimensions of the demonstration well assumed in this study

Table B2 -3
Representative prototypical reservoir properties assumed for the storage reservoir.