Maximum admissible pressure in salt caverns used for brine production and hydrocarbon storage

. Tightness is a fundamental prerequisite to any underground storage. In storage salt caverns, a safe maximum admissible pressure must be selected to avoid product loss. The tensile strength of salt is small, and cavern pressure must be kept lower than geostatic pressure or, more precisely, lower than the least compressive stress at the cavern wall. The vertical stress can be assessed through density logs. The redistribution of stresses in the rock mass, due to the visco-plastic nature of rock salt, must be taken into account. A couple of cases in which a hydraulic connection between one cavern and another cavern, or between a cavern and the edge of a salt dome, are known. These connections originated in geological anomalies rather than in the creation of a fracture. There exists a pressure threshold, lower than the geostatic pressure, for which micro-fracturing and an increase in salt permeability occur, vindicating the position that a safety margin is needed when selecting the maximum pressure. Well tightness is important as well; it depends on several factors, among which are the quality of the cement, and the maximum ﬂ uid pressure in the cavern and along the access well. A tightness test is mandatory. The Nitrogen Leak Test is the most common such test. A review of selected gas-storage sites shows that, in most cases, the maximum admissible gradient at the casing shoe is 0.018 MPa/m (0.8 psi/ft), and up to 0.019 MPa/m (0.85 psi/ft) in some American states, values that are consistent with the considerations listed above.


Introduction
Tightness is a fundamental prerequisite to any underground storage. When compared with a pressure vessel, which raises similar problems, salt caverns exhibit a couple of differences. Stored volumes are much larger in a cavern. External pressure, instead of being atmospheric, is proportional to depth; at a 1000-m depth, it is more than 20 MPa. The walls of the cavern, instead of being composed of steel and reinforced concrete, are composed of unlined rock, whose tensile strength is quite small. In sharp contrast with a pressure vessel, fluid pressure in a cavern must be lower than external pressure. However, as in a pressure vessel, it is the piping (the access well to the cavern, the only manmade part of the system) which is the weakest point of the storage system. As a pressure vessel, a salt cavern can be tested for tightness accurately; gas storage in aquifer layers or depleted reservoirs cannot.
The objective of this paper is to discuss the maximum admissible fluid pressure in a salt cavern. In the first section, the state of stresses in the salt formation (to which fluid pressure must be compared) and how it can be measured, are discussed. In this context, a difference between the primary (virgin) and secondary (resulting from cavern creation and operation) state of stresses must be made. In the second section, the first mechanism possibly leading to tightness loss, fracturing of the rock mass, is discussed. This issue has been discussed by recent research. In the third section, a second mechanism, loss of well tightness (which also strongly depends on product pressure), is considered, and tightness tests are discussed. In the last section, the maximum admissible pressures in several gas storage sites or, more precisely, the maximum admissible pressure gradients, are compared. The conclusion suggests a set of simple rules.
2 State of stresses in a salt formation

Stresses in a salt formation
From the experience gained in gas-or oil-well operations, it is known that a fracture can be created in an unlined interval of a borehole when a sufficiently high fluid pressurecompared to the in situ state of stressis applied in the interval. This technique is used for stimulating production wells or for measuring in situ stresses (frac-test). For this reason, fluid pressure in a cavern must be compared to the in situ stresses in the formation at cavern depth.

Virgin state of stress
A fundamental difference must be made between the "virgin" or "primary" state of stress (that which existed before the cavern was created) and the "secondary" state of stresses (which results from cavern creation and operation). These two notions are different, especially in the case of visco-plastic rocks, such as halite and other evaporites, as their mechanical behaviour is not reversible. (Over time, very different stress distributions in the rock mass can be associated to the same cavern pressure.) It is known from Continuum Mechanics that at each point of a continuum (e.g. a rock mass), the state of stresses can be represented by a tensor (a symmetric 3 Â 3 matrix), or r = [r ij ], r ij = r ji . For any such symmetric matrix, there exist three orthogonal directions, called the "principal" (or "main") directions such that, when these directions are selected to define a basis of the three-dimensional space, the stress tensor is represented by a matrix having nondiagonal elements that are zero. The three diagonal elements are the principal stresses. When the vertical stress is principal, the two other principal stresses are horizontal. In such a case, it is usual to note r v (the vertical stress), r H (the most compressive horizontal stress), and r h (the least compressive horizontal stress), respectivelyi.e. r H < r h < 0 (compressive stresses are negative). The socalled strike-slip faulting regime corresponds to r v < r H < r h < 0 and the reverse faulting regime to r H < r h < r v < 0. When the three principal stresses are equal (as is the case in a fluid at rest), the state of stresses is said to be isotropic. A measure of the gap between the actual state of stress and an isotropic state of stress is the deviatoric stress, ffiffiffiffiffiffiffi ffi 3J 2 p , J 2 = s ij s ji /2, s ij = r ij À r kk d ij . The deviatoric stress is an indicator of the intensity of shear stresses. It vanishes to zero when the state of stresses is isotropic. In addition, the stress tensor must satisfy the "equilibrium" condition, divr + qg = 0, where q is the density of the rock, and g is the gravity acceleration.
These conditions alone do not allow the stress tensor to be computed. In addition, a constitutive law for the rock mass, the history of the mechanical and thermal loadings (at geological scale) and boundary conditions must be specified (Baumann et al., 2018(Baumann et al., , 2020. For a rock mass, this is the difficult part of the problem, as neither the constitutive law nor the history and boundary conditions are perfectly known. In many cases, assumptions must be made.

The isotropic assumption
Most authors consider that rock salt behaves as a viscous fluid when long periods of time (dozens of years or centuries) are considered. In a fluid at rest, the three principal stresses are equal (the "isotropic" assumption). For example, "In depth below 500 m isostatic [isotropic] stress condition can be assumed in salt rock formations due to the creeping behaviour of salt rock" (Klafki et al., 1998, p. 276). When the state of stress is isotropic, r v = r H = r h = ÀP 1 < 0, where P 1 is the geostatic pressure; P 1 = P 1 (z) can be computed using the equilibrium equation: dP 1 /dz = q(P, T)g, g > 0 when z is oriented downward. When overburden density is approximately constant, P 1 (z) = " qgz, where " q is the average density of the overburden, and " qg (in psi/ft or bar/m) is the geostatic gradient, or volumetric weight, having a typical value of 0.022-0.023 MPa/m. (In many cases, rock density is q = 2200-2300 kg/m 3 , and g = 9.81 m/s 2 .)

Actual state of stress in a salt formation
The isotropic assumption (r v = r H = r h ), however, does not seem to be true in several cases. This is a difficult issue: as will be seen, measuring in situ stresses is not an easy task. It is noticeable that some authors believe that the state of stress is less likely to be isotropic in domal salt (because domes are the seat of long-term active flow, and equilibrium has not had enough time to be reached), while others believe that the opposite is truethat the state of stresses in bedded salt is more complex, as salt beds often are composed of many layers, among which are competent non-salt layers that do not behave as a fluid.

Density-based assessment of in situ stresses
The simplest way to assess the vertical in situ stress (r v < 0) consists of assuming that this stress is principal all the way from ground level to the considered depth. This assumption is reasonable, though it is not proven. Most often, rock density, q = q(z), is known through density logs performed when drilling a borehole. Under this assumption, the vertical stress at depth z is provided by an integration: Note that this method says nothing of the two horizontal principal stresses, except when an isotropic state of stress is assumed: r v (z) = r h (z) = r H (z).

Frac tests
A hydraulic or pneumatic frac test consists of isolating an interval in the open hole of the well (for instance, by using a straddle packer). The two ends of the packer are sealed to the rock formation. There is a water (or brine, or gas) outlet in the middle of the packer that allows fluid pressure in the packer to be applied to the salt wall of the isolated interval. Hydraulic and pneumatic tests are performed in a salt formation in which the injected fluid is either saturated brine (for the hydraulic test) or nitrogen (for the pneumatic test). Fluid pressure in the packer is increased swiftly until the fracture breakdown pressure, P c (see Fig. 1), is reached; this is observed when the pressure-vs.-injected fluid volume curve reaches a maximum followed by an abrupt pressure drop. The injection rate is then controlled so that a plateau is reached and injected fluid pressure is constant (fracture propagation pressure). After some time, injection is stopped, and the flowrate vanishes ( Fig. 1). Several such "frac cycles" are performed. The re-frac pressure, P r , is derived from the pressure-injected volume curve during re-frac. The shut-in pressure (P si ) is derived from the shut-in phase, as explained by Rummel et al. (1996), during the last re-frac cycle (see Fig. 1). It is generally assumed that hydraulic fractures propagate in the direction of least resistance (planes of weakness) or perpendicular to the least compressive stress. In the absence of weakness, the shut-in pressure is deemed to equal the least compressive stress at test depth in the rock mass. By definition, r H r h < 0; hence, r V r H À P si = r h < 0, or r H r h r v = ÀP si < 0. The second option (the least compressive stress is vertical) generally is considered as being less credible. In some cases, determining the fracture propagation pressure and the shut-in pressure is not straightforward (Guo et al., 1993 suggest eight different methods). The fracture breakdown pressure, or P c , equals the minimum principal stress plus the "tensile strength", P c = |r h | + T, T > 0, which is somewhat of a misnomer, as, in fact, T is related to the fracture toughness of the rock mass, rather than the tensile strength measured, for instance, through "Brazilian" tests. In the case of rock salt, the tensile strength is often considered to equal T = 1-3 MPa.
Note that the flowrate (Q)-versus-pressure rate ð _ PÞ curve when a fracture is created exhibits a very different pattern when a cavern is considered (instead of an unlined interval in a wellbore). Its slope is the cavern (or interval) compressibility or Q= _ P = bV. Cavern compressibility is larger than any interval compressibility by 5 or 6 orders of magnitude and, in general, the notion of a breakdown pressure (an abrupt pressure drop) does not exist in a full-size cavern, except when the amount of fluid seeping into the fracture is very large.

Examples of frac tests in salt formations
Several examples are considered here. Rummel et al. (1996) performed an extensive hydraulic fracturing program in Krummhörn K6, an 1815-m deep, 8-½ 00 (21.3 cm) borehole drilled out in the Groothusen salt dome (Zechstein 2 salt). A double-straddle packer was used, and 11 hydro-frac tests were carried out successively between 1300-and 1800-m depths (approximately). Each test included several re-frac cycles for reliable determination of the shut-in pressure. Rummel considered that "well documented" data were obtained. The shut-in pressure profile, based on 11 tests, was P si (MPa) = 29.38 + 0.0194(z À z 0 ) (m), z 0 = 1300 m, and the average shut-in pressure gradient (defined as P si (z = 1510 m)/1510 m) was 0.0221 MPa/m between 1300 and 1720 m (TVD), "in good agreement with the vertical stress profile derived from various geophysical logs for the overburden density" (p. 1). Note, however, the difference between the shut-in pressure gradient (0.0221 MPa/m) and the gradient inferred from the 11 tests (0.0194 MPa/m), which is smaller than the volumetric weight of salt, or 0.021-0.022 MPa/m (it should be equal). These inconsistencies suggest some degree of uncertainty. Schmidt (1993) describes pneumatic frac tests performed in the stratified salt deposits at Xanten and Epe (Germany). At Xanten, tests were performed in the 900-970-m deep Upper Werra salt (coarsely grained with intercalations of clay and anhydrite) and the 1029-1146-m deep Lower Werra salt (finely grained and pure). Fracture breakdown pressure in the Upper Werra salt (three tests performed) was reached at a gradient of 0.0255 ± 0.0001 MPa/m; the shut-in pressure gradient was 0.0234 ± 0.0001 MPa/m. In the Lower Werra salt (four tests performed), the fracture breakdown gradient was 0.0226 ± 0.0002 MPa/m, and the shut-in pressure gradient was 0.02165 ± 0.00005 MPa/m (Schmidt explains the difference by the lower density of the potash-rich "Middle" Werra). At Epe, figures in the Upper Werra salt (2 tests) and in the Lower Werra salt (1 test) are almost identical: 0.025 ± 0.01 MPa/m (breakdown gradient) and 0.0242 ± 0.004 MPa/m (shut-in gradient), respectively. Here, again, the (relatively small) difference between tests results is related to different density distributions.
In Staudtmeister and Schmidt (2000), the authors discuss different methods used performing tests in the Rüdersdorf K101 well in Germany; there were four pneumatic tests and two hydraulic tests in the interval selected for future cavern emplacement, from 1280 m to 1600 m, and BoreHole Gravimetry Measurements (BHGM) down to 1280 m (location of the cavern roof). BHGMs consist of measuring the vertical gravity gradient at a given depth, which is related to the average density of the rock surrounding the well. BHGM densities are influenced by rock density Fig. 1. Schematic frac-test procedure (above) and determination of shut-in pressure (below) (Rummel et al., 1996). changes far from the well, and a geological model of the salt formation must be built. Interestingly, Staudtmeister and Schmidt (2000) note that, based on the experience at Etzel, Krummhörn, Reckrod and Bremen Lesum, shut-in pressures during hydraulic measurements "systematically lie 5-10% above the vertical primary stress component" (p. 334). Pneumatic tests provided lower shut-in pressures. Conversely, uncertainties affect density-based estimates of the vertical pressure, and upper and lower values were selected. Their conclusions can be summarized as follows: Schreiner et al. (2004) consider that "under domal salt conditions . . . the three principal stresses are not equal . . . In a first assumption, the resulting pressure gradients should be significantly lower than in a bedded salt formation; i.e., in the order of 0.18 bar/m" (p. 1). However, "testing of various salt dome locations of NE Germany . . . documented that the measured minimal stress values are significantly higher, i.e. 1.0-1.5 MPa, than the estimated lithostatic pressure" (p. 1). Pneumatic tests were performed at depths of 920-1380 m, and the shut-in pressure was 1-1.5 MPa higher than the estimated lithostatic stress: The authors performed computations at geological time scales (>1 Ma), taking into account salt rise and glaciation, and proved that the state of stress in the salt dome was almost isotropic, but higher than the lithostatic stress by 1-1.3 MPa. According to Horvath and Wille (2009), the weight of the overburden can be measured through "density determination from rock samples, analysis of litho-density logs, hydraulic fracture tests and borehole gravity measurements . . . The pressure determined by fracture tests (the so-called "shut-in pressure") is thought to represent the [least-compressive] principal stress. However, fracture tests have been observed to provide formation pressure values about 5% higher [than other methods] " (p. 84).
Also, as Klafki et al. (1998) note: "in situ measured primary stresses are higher than calculated from rock densities" (p. 276).

The role of secondary stresses
Most authors accept that the shut-in pressure and the least compressive stress are equal (ÀP si = r h ) when rock behaviour reasonably can be considered as elastic (i.e. reversible): when fluid pressure in the well is equal to the overburden pressure (P 1 ), the state of stress in the rock mass equals what it was ("virgin state of stress") before the well was drilled. This is incorrect in the case of rock salt. Consider the following sequence: the well, of radius a, is drilled out rapidly; the pressure drop in the wellbore is DP = P 1 À P i > 0; and the initial state of stresses is elastic: The wellbore then is kept open for several months. The Norton-Hoff law (_ e = Ar n , 3 < n < 6) is assumed (see, for instance, Wang et al., 2015); when steady state is reached, the stress distribution is, At this point, a frac test is performed, and pressure is increased abruptly to the geostatic pressure, P i = P 1 . The (secondary) stress distribution then is: This stress distribution depends on cavern pressure history (through DP). Note that when n = 1, the linear viscoelastic stress distribution is the same as the linear elastic stress distribution (the reason is that stress distribution results from (1) equilibrium condition (2) compatibility conditions which are the same for strains and strain rates): in the case of elastic behaviour, or when n = 1, there is no "secondary" stresses, r rr (r) = r uu (r) = r zz (r) = ÀP 1 (instead of Eq. (6)). When n 6 ¼ 1, at the cavern wall, the two "secondary" tangential stresses are less compressive than the wellbore pressure (P i = P 1 )for instance, r uu + P 1 = 2(1À1/n)DP > 0, and, in a salt formation, shut-in pressure should be significantly smaller than geostatic pressure. This idea was mentioned first by Wawersik and Stone (1989), and a comprehensive discussion can be found in Brouard et al. (2007), Djizanne et al. (2012), and Manivannan and Bérest (2019), leading to the conclusion that breakdown pressure may be much smaller than the original (primary) minimum horizontal stress. It must be observed, however, that though this conclusion is perfectly correct from a mathematical perspective, low breakdown pressures have never been observed during actual frac tests.

A tentative conclusion
Lessons drawn from frac tests are equivocal. Although frac tests are helpful, it is not safe to select high maximum admissible pressures in a cavern based only on favourable results from frac tests; it seems reasonable to adopt the Horvath and Wille (2009) conclusion that "density logs have proved . . . to supply data of sufficient quality" [for determining vertical pressure] (p. 88).
3 The risk of fracturing or increasing the permeability of the salt formation In Section 1, micro-fracturing was a technique allowing the measurement of the state of stresses in the rock mass. For a cavern in operation, fracturing is a major risk, possibly leading to tightness loss. Consequently, the product pressure must be smaller than (the absolute value of) the (secondary) least compressive stress, and a safety margin must be managed. For this reason, fracturing risks are small in actual caverns.

Loss of tightness of salt cavern walls
Fracking can lead to the creation of a hydraulic connection between a cavern and another cavern, or between a cavern and the external of the dome, or the external of a beddedsalt formation. A few cases of such connection are known. However, except for two of them, the origin of the connection seems to be a natural weakness in the salt formation.

Breach, conduits, fractures
In this paper, a "conduit" is a long narrow pipe linking two caverns, or linking a cavern and the exterior of the salt formation. A "breach" is a wide opening created, for instance, when a thin wall or roof fails. On August 3, 2012, a sinkhole was discovered in the swamp near Bayou Corne, Louisiana, USA. It quickly was suspected that the sinkhole was related to Oxy3, a 3395 ft. -(1050-m) deep and 2200 ft. -(670-m) high brine cavern located near the edge of the Napoleonville salt dome. In 2011, Oxy3 did not pass an MIT (Mechanical Integrity Testi.e., tightness test). Further investigation proved that, at the edge of the dome, a sheath composed of loose and soft sediments allowed those sediments to flow from ground level to a breach created in the lower part of the cavern, as through an hourglass (Bérest, 2017).
Clovelly salt dome Cavern No. 14, Louisiana, did not pass an MIT. This cavern is close to the side of the dome. Further investigation suggested that brine leaked to the exterior of the dome through a 2170-ft (660-m) deep "inhomogeneity" (McCauley et al., 1998). In these two brine production caverns, a breach was created, and it is possible, in a context where the wall between the cavern and the exterior of the dome was thin, that MITs, performed at a testing gradient of 0.018 MPa/m, played a role.
More puzzling are the following examples. At Mont Belvieu, Texas, USA in 2004, an MIT, followed by the observation of pressure evolutions, proved that Cavern 16E was hydraulically connected with the neighbouring Cavern 2E (as seen in Fig. 2, during an MIT on Well 16E, wellhead pressure decreased consistently as pressure was increasing at the 2E wellhead); its origin is likely to be an anomalous zone inside the dome (Cartwright and Ratigan, 2005). At Spindletop, Texas, gas originating from the Centana No. 1 natural gas storage leaked into the Gladys No. 2 brine, although the minimum distance between the two caverns is 120 m (Fig. 3). Asymmetric growth and brine contamination by sylvite during an earlier enlargement of Centana No. 1 suggest the presence of an anomalous zone (Johnson, 2003). In the Arabali (Turkey) brine field, a hydraulic connection was detected between Caverns a-98 and a-117. Sonar surveys (Fig. 4) proved that a 9-m high, 30-m long, 2-m wide (30 ft Â 100 ft Â 7 ft) slot was created between the two caverns, exactly coinciding with the vertical plane crossing through the hanging strings of each of the two caverns (Kirmic and Raōōlowicz, 2003).
In the three first cases, pressures in the caverns were never close to geostatic pressure, and creation of a connection between two caverns originated in the presence of a weak zone (porous and permeable) called the Anomalous Zone, quite common in Gulf Coast domes, and also responsible for large block falls in salt caverns.
The term "Anomalous Features" (AFs) has been used by Kupfer (1990) to designate unusual features found in the stocks of Gulf Coast salt domes. Based on observations made in rock-salt mines, he identified ten major groups of AFs, including such items as: intense structural folding, the presence of "impurities" (e.g., anhydrite, shales, and sandstones), gas releases, connate brine seeps, exceptionally large crystal size, potash, hydrocarbons, etc. He observed  that these unusual features tended to cluster in linear trends through salt stocks; and, if they contained three or more AFs, [he] designated such trends as "Anomalous Zones (AZs) " (Thoms and Neal, 1992, p. 1;see, also, Looff, 2017).
More relevant for our concern is the Veendam case. At Veendam (the Netherlands), "Magnesium chloride is extracted from several thick layers [. . .] at a depth varying from 1300 to 1600 m. These layers are embedded in the upper part of a large halite deposit of the Zechstein III (Leine) evaporation cycle", Figure 5 (Fokker et al., 2004, p. 2). At such a depth in a MgCl 2 cavern, creep closure is much faster than in salt (NaCl) caverns. The mining method consists of selecting a rather high brine pressure in the cavern to allow the Mg-salt to flow (squeeze) at a rate comparable to the solution-mining rate. (Over time, cavern volume remains roughly constant.) On April 20, 2018, "a sudden pressure drop occurred in the cluster (a labyrinth composed of many roughly permeable conduits interconnecting nine caverns). The wellhead pressure (which was typically 8.8 MPa; saturated MgCl 2 brine volumetric weight 0.013 MPa/m; cavern pressure 85% of geostatic, and the gradient 0.185 MPa/m at cavern depth, significantly higher than in a standard NaCl producing cavern) dropped by about 2.5 MPa after 1 day and by about 3 MPa after 2 days, after which the situation stabilized" (Smit, 2019, p. 2). Based on cluster compressibility, the brine volume that seeped from the cluster during the 30 first minutes after the pressure drop was estimated to be 25 000 m 3 . It has been hypothesized that the initial fracture or breach through the relatively thin salt layer at the top cluster opened in the overlying Buntsandstein layer, where the state of stresses is suspected to be strongly anisotropic.

Effects of high cavern pressure (lower than geostatic)
During cavern operation life, maximum cavern pressure is kept significantly smaller than geostatic pressure (typically below 80%, see Sect. 5). This is not true after the cavern is plugged and abandoned. At least two mechanisms, brine warming and cavern creep closure, lead to pressure increase in a cavern. In some cases, in the long term, cavern fluid pressure is larger than geostatic pressure, leading to the onset of a fracture. Brouard Consulting (2019) has discussed a couple of known examples. There is an abundant literature dedicated to this topic (not discussed in this paper), and some useful lessons can be learned.

Cavern compressibility and permeability increase
In Section 2.2.2, cavern compressibility (or interval compressibility during a frac-test), or bV, was defined as the ratio between the rate of injected volume in a cavern (Q inj ) and the resulting cavern pressure increase rate ð _ PÞ: where V is the volume of the cavern, and b is the factor of compressibility (in MPa À1 ). The factor of compressibility is the sum of the brine factor of compressibility (b b = 2.7 Â 10 À4 /MPa; a more complete discussion can be found in Van Sambeek et al., 2005; and the factor of compressibility of the cavern (the elastic "box" that contains the brine volume) or b c . This second factor depends on the elastic properties of the rock mass (E, m) and the shape of the cavern: for a typical cavern, b c = 1.3 Â 10 À4 /MPa and b = b b + b c = 4 Â 10 À4 /MPa. (In fact, the factor of compressibility is larger in a flat cavern or when gas is trapped in the cavern (Bérest et al., 1999).) On the right-hand side of equation (7), brine permeation through cavern walls (ÀQ out ) is mentioned; its significance is discussed below. Figure 6 is an example of a cavern compressibility measurement (Thiel, 1993). Cavern compressibility is bV = 79.6 m 3 /MPa, Cavern volume is unknown. From Thiel's paper it can be inferred that casing shoe depth is 840 m, approximately, a depth at which cavern pressure when the wellhead is opened (halmostatic pressure) is 10 MPa. When tubing pressure increases from 4.5 MPa to 5.1 MPa, the testing pressure gradient increases from (10 + 4.5)/840 = 0.0172 MPa/m to 0.018 MPa/m (for comparison, the geostatic gradient is 0.022-0.023 MPa/m). In this gradient range, the relation between injected volume and pressure increase is almost perfectly linear, and brine outflow (Q out ) though the cavern walls is exceedingly small. Equation (7) can be integrated as bVDP = DV inj .
A high-pressure test was performed in a brine-filled cavern at Etzel (Germany) in 1990-1992 (Rokahr et al., 2003). It was observed that the apparent cavern compressibility factor, b, increased significantly (Fig. 7) when the cavernpressure gradient increased from 0.019 MPa/m (it was 3.7 Â 10 À4 /MPa) to 0.0205 MPa/m (it was 4.7 Â 10 À4 / MPa) and above. Durup (1990Durup ( , 1994) performed a pressure build-up test in the EZ58 wellbore at Etrez (France) in which the pressure was increased through step-by-step brine injections. The open-hole length was 198 m. The test lasted 6 h. On Figure 8, the pressure at well-bottom depth (871 m) is plotted against the cumulated injected volume. (Wellbore compressibility, bV, is the inverse of the slope of this curve.) When pressure increased from 14.5 MPa to 20.5 MPa (from 0.017 MPa/m to 0.023 MPa/m at a 871-m depth), wellbore compressibility increased from bV = 9.7 litres/MPa to bV = 24 litres/MPa. These two tests strongly suggest that if compressibility is constant when cavern (or borehole) pressure is relatively low, the "apparent" compressibility significantly increases when cavern pressure is high. This can be attributed to an increase in brine outflow through cavern wall.   . At low pressure, apparent compressibility is a slowly increasing function of pressure; a pressure threshold can be observed above which apparent compressibility drastically increases. This threshold seems to be significantly smaller than the virgin geostatic pressure. In fact, when successive tests are considered, compressibility is smaller and smaller, and the threshold is higher and higher, Brückner et al. (2003), described a test performed in a 22 m 3 cavern leached out at a depth of 448 m from a drift at the Bernburg Mine in Germany; cavern pressure was increased step by step from zero. At the beginning of the test, 8.8 litres of brine were injected in the cavern, pressure increased by 1 MPa, and cavern compressibility was bV = 8.8 liters/MPa (b = 4 Â 10 À4 /MPa). During the second step, pressure increased from 1.23 to 3 MPa, and the compressibility factor decreased to b = 3.6 Â 10 À4 / MPa. (Some air unavoidably was left in the cavern; when a cavern contains a small fraction of air x = v/V, its compressibility is b + x/P, a decreasing function of air pressure.) During the next steps, cavern compressibility increased. It was b = 4.1 Â 10 À4 /MPa when pressure increased to 7 MPa (a gradient of 7/448 = 0.0156 MPa/m) and when pressure increased to 9 MPa (a 0.02 MPa/m gradient) during the last step, an "exponential" increase in compressibility was observed.

Fracture versus micro-fractures
From these tests, a drastic increase in the apparent compressibility factor, reflecting an increase in the actual permeation through the cavern walls, is observed when cavern pressure is higher than a certain threshold. When cavern pressure is close enough to (but lower than) geostatic pressure, the formation of micro-fractures and permeability increase can be considered a certainty. This micro-fracking process is much smootherand more difficult to detectthan what can be observed during a standard frac test. Data suggest that the threshold pressure might be 85-90% of the geostatic pressure (a gradient of 0.0185-0.019 MPa/m). In fact, it is likely that this threshold is site-dependent and depends on cavern pressure history. (For instance, a swift pressure increase following a long idle period, which leads to an unfavourable distribution of secondary stresses, might lower the pressure threshold, as explained in Sect. 2.2.4. For gas storage, thermal compressive stresses generated by gas compression can play a favourable role.) At any case, when selecting pressure cycles, it is suggested that numerical computations be performed to check that gas pressure can never be much larger than the (secondary) least compressive stress at the cavern wall during operation. Various attempts have been made at modelling the poro-mechanical problem of pressure-permeability evolution after the onset of micro-fractures (Lux et al., 2006;Minkley et al., 2012;Rokahr et al, 1998;Schreiner et al., 2010;Sicsic and Bérest, 2014;Wolters et al., 2012;Zander-Schiebenhöfer, 2002). This is a difficult problem.
It is tempting to state that a gas storage cavern is "perfectly tight". From a scientific perspective, this is not exact. When gas pressure is high, it is likely that small microfractures open, permeability increases, and gas is allowed to flow from the cavern. However, when a   (Durup, 1994). reasonable maximum pressure is selected: this flow is small; salt permeability remains exceedingly low except for a relatively thin zone at cavern wall; and a part of the gas that seeps from the cavern flows back when inventory and gas pressure are low.

Seepage through the well
Selection of the maximal admissible pressure in a salt cavern is guided by two objectives: avoiding fracture creation at cavern wall; and preventing fluid leakage through the access well. The second topic is discussed in this section.

Leaks in actual salt caverns
Thousands of storage caverns have been operated worldwide for decades. Only a small number of leaks are known. This has been discussed by Réveillère et al. (2017) and Bérest et al. (2019). Most of the leaks originated from the failure of a steel casing due to overstretching, shearing, corrosion, milling or fatigue, sometimes followed by gas permeation through the cement sheath (Fig. 10). Well integrity results from: (a) the properties of the rock mass, (b) the quality of the cementing job, (c) the well architecture (i.e. the number and the length of the cemented casings), (d) the nature of the stored products, and (e) the pressure and pressure changes of the stored fluids.

Product pressure
Generally speaking, the pressure gap between the products and the fluids contained in the cement and the rock formations, a decreasing function of depth, is the driving force for product leakage. Onset of a leak is more likely when this gap is higheri.e., when product pressure is higher.
Gaseous products raise more difficult problems than do liquid products. On one hand, they are less viscous, and the gas flow-rate is faster; on the other hand, gases are much less dense than liquids. When a leak appears, gas pressure remains almost constant along the leak path, and gas pressure is able to fracture rock formations at shallow depth, where geostatic pressure is low (Fig. 11).

Rock formations
Tight and plastic rock formations, such as salt and clay, can have a very favourable effect in that they naturally creep and tend to tighten around the well. This improves the bonds between the cement and the casing, and between the cement and the rock formation (Bérest and Brouard, 2003).

Cement, a weak point
The cement between the steel casing and the rock mass is an engineered material, and its tightness basically depends on the quality of the cementing job. The cemented annular space includes two interfaces: that between the cement and the casing steel; and that between the cement and the rock mass. These interfaces are possible weak points, especially in gas storage caverns, because the cement shrinks and expands alternatively when large pressure swings are applied to the cavern gas. Most often, the cemented part of the well is weaker than the rock formation itself.
Since the origin of oil drilling, progress has been made in cementing workmanship. In Texas, for example, Nicot (2009) mentions the following: use of centralizers (1930); calliper surveys (1940); tagging of the cement plug, introduction of improved cement additives adapted to temperature, pressure and chemical specific conditions (1940); and improvement of the quality of material used in well construction. Nicot also outlines the promulgation by the Texas Railroad Commission of specific plugging instructions (1934,1967), promulgation of the Drinking Water Act, publication of API national standards (starting in 1953), and increased scrutiny by the State (after 1983). Effective tools allow assessment of the quality of the cement (CBL/VDL, high-frequency measurements, etc.). However, appraising the quality of a cement job is not easy. Experience proves that cement quality can be scattered. For salt cavern wells, with casing diameters larger than in oil fields, Kelly and Fleninken (1999) proposed the notion of a Cement Evaluation Logging Program to minimize uncertainties.

Tightness test
Cementing remains a difficult job, and it is recognized universally that a tightness test (Mechanical Integrity Test [MIT]) must be performed before commissioning a cavern. A tightness test consists of increasing cavern pressure to the maximum operating pressure (or slightly more) and monitoring cavern evolution over several days. The best method (Nitrogen Leak Test [NLT]) consists of lowering a nitrogen column to develop a brine-nitrogen interface below the last casing shoe in the cavern neck and monitoring the interface location over a couple of days: too fast an interface rise is a sign of poor tightness. Monitoring wellhead pressures during the test provides additional information. When the cavern has no neck, lowering a light hydrocarbon column (instead of a nitrogen column) can provide good results. In some countries, tightness tests are performed periodically during the entire operating life of a cavern. Acceptance criteria were proposed by Crotogino (1995) (resolution of the testing system must be smaller than 50 kg/day and the maximum admissible leak rate is 150 kg/day) and in 1993 by Thiel (the computed leak rate must be smaller than 1000 bbls/yr). In most cases, the results of the test performed before commissioning a cavern meet these criteria. (This is a remarkable achievement: when Thiel's fail/pass criterion is selected, the leak rate is smaller than 0.03%/yr in a 3-mbbls cavern.) When they do not, various techniques allow identification of the weak zones of the cement column and repair of the well before performing a second tightness test (see, for instance, McLeod et al., 2011).
The testing pressure must be selected carefully. It must be equal to or larger than the maximum operating pressure. Several companies prefer that the testing pressure equal the maximum operating pressure (Quintanilha de Menezes et al., 2001), as testing the well above the operating pressure can be harmful for future well integrity. Conversely, other companies prefer selecting a higher pressure, which provides additional confidence. One advantage of this second option is that, after several years of satisfactory operation, increasing maximum pressure is easier, as the cavern already has been tested for pressures higher than those used in operation.
Maximum testing pressure must be smaller than the vertical stress (0.022-0.023 MPa/m, typically), which can be assessed through density logs and/or frac-tests (Fig. 12). However, some safety margin must be left. There are two reasons for this, as explained above: on one hand, the (secondary) least compressive stress is not always the vertical stresseven if they often are equal; on the other hand, the cement behind the last steel casing often is weaker than the rock mass itself. 5 Maximum admissible pressure in a salt cavern 5.1 Definitions

Margin of safety
The empirical, or pragmatic, approach consists of (1) estimating the weight of the overburden at cavern-shoe depth using density logs (density-based vertical stress), assuming that it equals the vertical stress, and (2) selecting a maximum admissible pressure that is a fraction (80-85%) of the vertical stress. This 15-20% margin of safety takes into account such factors as geological uncertainties, imperfectly known physical or mechanical processes (secondary stresses), and possible cement weaknesses, as explained above. Note that the tensile strength of the rock, which equals 5-10% of the vertical stress, typically, is not taken into account, which errs on the safe side. This method is robust, as it is based on simple mechanical principles and reliable measurements (density logs). In addition, performing frac tests can be useful, as they provide the value (an upper bound, in fact) of the least compressive stress (shut-in pressure). The maximum operating pressure must be re-assessed in Fig. 10. Schematic of leak developments cases with an intermediate outlet accumulation Réveillère et al., 2017). Fig. 11. Illustration of a gas leak: the gap between gas pressure and geostatic pressure decreases when gas rises in the cementation; it is positive at shallow depth.
the (rare) case that the shut-in pressure is smaller than the vertical stress, computed as explained above. Research on cementation (its evolution with time, fracturing mechanisms, logs) must be fostered, but it is doubtful that this research affects, in the short term, the rule mentioned above, which relies primarily on experience.

Assessing rock-mass volumetric weight
The SI unit for rock density (q) is kg/m 3 . The unit for volumetric weight, qg, is MPa/m. Determining the actual density of the rock formations above the caverns is important in such a context. Pereira (2012) states that "typical values of the overburden stress gradient may range from a low of 21.5 kPa/m (0.92 psi/foot) for a domal salt overlain by soft sediments, to a high of about 26 kPa/m (1.14 psi/foot) for a bedded salt largely overlain by dense limestone and anhydrite layers" (p. 6-2) (see also Schreiner et al., 2010). Misinterpretation is possible, as explained by Rokahr et al. (2000). Before the Etzel test, described in Section 2.2.1, it was assumed that the lithostatic gradient was 0.0241 MPa/m (1.06 psi/ft). Additional investigations from a newly referenced borehole, and three existing boreholes, led to a revised value of 0.0204-0.0211 MPa/m (0.9-0.93 psi/ft)a significantly smaller figure. Lithodensity logs are convenient to use. Density measurements at the laboratory also can be used; they provide a lower bound of the in situ rock density, which errs on the safe side.

Pressure gradient
Density, which is a site-specific notion, must be measured on a case-by-case basis. However, regulators often prefer rules that can be applied uniformly state-wide and define a maximum allowable pressure gradient, dP max /dz (e.g. in MPa/m, or psi/ft), independently of local overburden densities values. This rule generally is accepted in the U.S. For instance, Texas Administrative Code § 3.97(k)(2) stipulates that "The maximum operating pressure at the casing seat shall not exceed 0.85 psi/ft of depth". In 2003, the Kansas Department of Health & Environment stated that "The maximum allowable operating pressure for underground natural gas storage wells shall not exceed 0.75 psi/ft", or 0.017 MPa/m (Poyer and Cochran, 2003, p. 199; note that in Kansas, storage caverns are 200-to 300-m deep). In a report prepared for the SMRI, Pereira (2012) indicates that "the maximum regulated pressure gradient is 0.9 psi/ft (0.0204 MPa/m) in Louisiana and Mississippi and 80% of fracture pressure or 0.8 psi/ft in Canada". In France, Germany and the UK, the maximum admissible pressure is "negotiated case by case" (Pereira, 2012, pp. 6-14).

Typical values of maximum pressure gradient in gas caverns
Most caverns meet this criterion (Tab. 1). Rummel et al. (1996)  The risk of a significant leak is greater when fluid pressure is higher, and that must be considered carefully. A high admissible pressure can be accepted when a large amount of information is available to increase confidence in the outcome.
For instance, Arnold et al. (2014) mentioned that "The storage site Bernburg is operated since the early 1970's [. . .] the rock mechanical dimensioning of caverns has been developed and enhanced continuously using comprehensive investigations [. . .] the most recently approved rock mechanical dimensioning includes a P max of 100 bars casing shoe depth is 490 m (gradient 2.04)" (0.0204 MPa/m, 0.9 psi/ft) (p. 138). Johansen (2010) describes the Torup gas storage in Denmark. When the first caverns were created in 1981, the maximum pressure gradient was 0.0175 MPa/m (0.77 psi/ft). When the last cavern was leached out in 1992, the accepted gradient was 0.0184 MPa/m (0.81 psi/ft). In these two cases, the increase in maximum admissible pressure was vindicated by the experience drawn from decades of satisfactory operation of existing caverns. In our opinion, setting the maximum admissible pressure above the standard value (80-85% of the overburden weight) must be justified through a specific "safety file" that contains discussions of such topics as local sensitivity of the storage site (a layer of salt or plastic clay several hundreds of meters thick above the cavern roof is favourable, and a permeable cap rock within a small distance from the cavern roof is unfavourable), along with density log files, results of the MITs, etc.

Brine production and liquid storage caverns
In most cases, liquid pressure in brine production caverns is much smaller than in gas storage caverns. At rest, brine production is halmostatici.e. at depth z (in m), it equals the weight, q b gz, of a saturated brine column whose volumetric weight is q b g = 0.012 MPa/m. During operation, pressures are higher than this figure because of head losses; however, they remain much lower than the geostatic pressure. However, in two sites in the Netherlands, Veendam (Smit, 2019, see Sect. 3.1) and Frisia (Duquesnoy and de Lange 2015), in which creep-prone magnesium salts are leached out, brine pressures are higher than usual.
In strategic oil storage caverns, product pressure can be kept halmostatic. However, caverns often are shut in during idle periods, and product pressure increases (due to the surrounding salt, brine, and product warming and creep closure). An advantage is that creep closure rate is lessened when product pressure is higher than halmostatic. Caverns are vented from time to time to avoid too high a product pressure. However, the maximum admissible pressure must be selected carefully to avoid micro-fracturing (see Sect. 3.3).

Conclusion
1. Except when regulations stipulate state-wide rules, selection of the maximum pressure in a gas-storage cavern must be based on assessment of the vertical stress, which can be computed readily from density logs. Fracture tests also may be helpful, but they provide an upper bound of the actual vertical stress. 2. The maximum operating pressure must be selected to avoid fracturing at the cavern wall, which, in principle, occurs when cavern pressure is larger than the minimum principal stress in the rock mass. However, in situ tests strongly suggest that micro-fracturing may develop when cavern pressure is larger than a certain threshold, possibly 85-90% of the geostatic pressure, and is likely to depend on past pressure history. It is recommended that numerical computations be performed and that it be verified that the selected operating mode does not lead to unfavourable secondary stress redistribution in the rock mass. 3. The access well and its cementation often are weaker than the rock mass, and fluid pressure in the well at shallow depth is larger than the stresses in the rock mass. Tightness must be checked before commissioning and, when possible, during the cavern's operational life. The most common test is the Nitrogen Leak Test performed at a pressure at least equal to the selected maximum admissible pressure. 4. In most existing caverns, the maximum admissible gradient at casing shoe depth is found between 0.018 MPa/m or 0.8 psi/ft (typically, in Europe) and 0.019 MPa/m or 0.85 psi/ft (typically, in North America). These values are consistent with the findings above.