Since the 2010 Macondo incident, the oil industry has made many strides in improving offshore blowout prevention and preparedness. This includes manufacturing over 20 large subsea capping stacks with other supporting subsea source control equipment (e.g. cutting tools for debris removal, injection and monitoring equipment for subsea dispersants) , and routinely conducting emergency exercises to demonstrate the ability to simulate deploying their subsea control equipment defined in their source control emergency response plans, often on short notice for government initiated unannounced exercises. In 2017, Anadarko partnered with U.S. and Mexican government agencies to conduct a joint-preparedness exercise to demonstrate a binational response to a hypothetical pollution incident that would threaten the border zone of both countries. The exercise conduced in accordance with the Mexico – US (MEXUS) Plan, a bilateral agreement between both countries for offshore spill that would originate in one country and could impact the other country. Coordinating a drill that involved over 300 participants from multiple companies and organizations took several years. A short coming of previous similar exercises have been the lack of visualization and sense of realism. A fit-for-purpose visualization simulator was used improve the overall training and learning experience. The visual simulator is coupled with a dynamic multi-phase simulator to ensure that the physics of the blowout and intervention operations are as realistic as possible. The improved visualizations and physics of the source-control operation significantly improved the learnings compared to previous exercise events. This paper explains the general methodology for closing a capping stack, and, more importantly, the planning process that made the drill successful.

The Well IXTOC No. 1 was drilled 94 km northwest of Ciudad del Carmen, Campeche, in the Gulf of Mexico (GoM). On June 3, 1979, well control was lost and the well blew out (Lugo 1981). For 9 months and 22 days an average of 10,000 to 30,000 barrels of oil per day were discharged into the water, which affected the shorelines of both the U.S. and Mexico. In the aftermath, an agreement was signed in 1980 between the U.S. and Mexico to establish a joint contingency plan to handle discharges of hydrocarbons and other hazardous substances into the marine environment. After 20 years of cooperative work, the MEXUS Plan was signed, which provides standard operational procedures with respect to joint responses in case of pollution incidents that may affect the coastal waters or marine environment of the other country. The agreement calls for joint pollution response exercises to be conducted to exercise the bilateral coordination and joint response system. The first full-scale exercise was held in 2002, followed by tabletop exercises, workshops and full-scale exercises over the following years.

The Deepwater Horizon/Macondo blowout occurred on April 20, 2010. This incident had a major impact on GoM regulations and blowout control preparedness. In the years that followed, the industry worked together to create industry consortiums, groups and mutual aid agreements with the objectives of preventing or mitigating future incidences. More than 20 subsea capping stacks and associated equipment for source-control operations have been built. Industry groups such as the API, NORSOK, IOGP, and ISCWSA have made recommendations and procedures for source-control guidelines. Oil-spill and source-control exercises have become common practice for most operators. The Bureau of Safety and Environmental Enforcement's (BSEE) 30 CFR Part 254 regulations require that offshore operators exercise their entire oil spill response plan every three years, either through one exercise or a series of separate exercises. BSEE may also initiate unannounced exercises (GIUEs), on a no-notice basis, to evaluate an operator's response preparedness. BSEE guidelines for conducting an exercise can be found in the 2016 National Preparedness for Response Exercise Program (PREP) Guidelines (BSEE 2016).

In 2014, the U.S. Coast Guard (USCG) approached Anadarko to consider participation as an oil and natural gas operator for a multi-year MEXUS exercise series consisting of a workshop in 2015 and a tabletop exercise in 2016, culminating in a combined national Preparedness for Response Exercise Program (PREP) full-scale exercise (FSE) in 2017 (Drieu 2017). The 2017 MEXUS exercise emphasized awareness, prevention, response and recovery from a major oil spill incident involving all local, state, federal, tribal and international response teams and focusing on multi-agency notification, initial response coordination and the use of the Incident Command System.

In the early days of blowout control, the planning and execution of a kill operation was almost solely done by a few select well-control specialists, such as the iconic pioneers Kinley, Patton, Adair, Bowden, Boots and Coots. To this day, the well-control specialists are often highly focused professionals who are very protective of their expertise and skills. In the event of a blowout, these specialists will without doubt serve very important roles; however, relying entirely on a few individuals has been found not to work to the benefit of the wider public interest. As an example, the well-control specialists could be called out on other jobs or have moved into new roles or retirement. In recent decades, a multidisciplinary approach has been used more often to plan source-control operations, which was the case during the Macondo response. A multidisciplinary approach is often defined as drawing appropriately from multiple disciplines to redefine problems outside of normal boundaries and reach solutions based on a new understanding of complex situations.

The MEXUS full-scale exercise included more than 300 participants, ranging from people without any well-control background to seasoned veterans. In addition to Anadarko and USCG, participants included representatives from the U.S. and Mexican governments from both federal and state agencies and industry companies ranging from operators, service providers, and original equipment manufacturers to industry consortiums. Source-control teams were broken into various groups such as flow engineering, flowback, production storage, logistics, capping, debris removal, etc. An overview of the source control roles and responsibilities within the incident command system can be found in the IOGP Report 594, Source Control Emergency Response Planning Guide for Subsea Wells.

With a wide variety of people and tasks, a major challenge was naturally to ensure that the drill becomes a good learning experience for everybody. An observation on drills in the past is that people often become disengaged, which is often linked to people not understanding what is going on or not being challenged properly.

Fortunately for the petroleum industry, the probability of a blowout is relatively low. In the 2019 risk assessment data directory published by the International Association of Oil & Gas Producers (IOGP 2019), exploration drilling has the highest probability of a blowout of any operation. For normal appraisal wells in the US GoM, the average frequency of a blowout is 1.3 × 10−3 per drilled well.

A painful reminder from historical blowouts is that the consequence of a blowout may be loss of lives, massive environmental pollution, destruction of assets and irreparable damage to the reputation of the petroleum industry. Risk is often defined as likelihood times consequence; that is, although the probability of a blowout is low, the overall risk is high due to potentially catastrophic consequences. A side effect of low occurrence is that most people in the petroleum industry will never gain enough real experience to effectively respond to future events unless they specialize in this line of work. For anybody who is at risk of having to respond or be involved in a blowout recovery, extensive training and realistic exercises should be common routines.

As with any hazardous task, it is often difficult to provide a realistic training experience while also ensuring a safe and effective learning environment. A story often heard is that the Samurais in ancient Japan used real swords when practice fighting each other. After almost running out of sparring partners, the samurais eventually switched to wooden swords to simulate real fights in a safer environment while minimizing the risk of serious injury. Similarly, the airline industry uses simulators to artificially re-create aircraft flight for pilot training, design, or other purposes. In the petroleum industry, simulators have also been extensively used over the last decades to train personnel, such as when learning how to operate a choke while circulating out a kick or learning to maneuver autonomous underwater vehicles. In addition to learning by lectures and reading material, simulators improve training and preparedness for real events.

In source-control operations, simulators play an important role for both well planning, contingency planning and emergency response. When a blowout occurs, it is crucial to bring the well under control in the most efficient and safe manner possible. As such, a trial-and-error approach is simply unacceptable. Instead, a digital twin of the blowout scenario will be created, and numerous simulations will be run to optimize the source-control plan. That is, the kill operation can fail in the simulations, so it won't fail for the actual operation.

An example of a multiphase flow simulator that is tailor-made for source-control operations is OLGA-WELL-KILL, which is the first fully transient wellbore simulator and still the most advanced model available to the industry for source-control simulations. The simulator was first used in 1989 on the SAGA 2/4-14 blowout recovery (Rygg 1990) and has since been instrumental in bringing some of the most well-known blowouts under control, including Macondo, Montara and Elgin.

The simulator has been specifically adapted to calculation of pump rates and mud volumes for a variety of blowout situations, and it can handle numerous well-flow configurations, from a single vertical well to multiple horizontal wells with complex completions. The model can be used to analyze blowout flow, kill point, pumping schedule, casing design, kill-fluid properties and volumes, temperature, pressure and other related parameters. The results may be presented versus time for a complete dynamic and volumetric response.

VROV is a 3D interactive real-time simulation system which supports the complete range of AUVs, inspection and work class ROVs, and the full spectrum of sensor and intervention subsystems (GRI 2019). Since 1999, VROV has set the standard in interactive, real-time subsea simulation, featuring fully interactive tether dynamics, manipulator functionality and high-fidelity sonar and graphics simulation (Figure 11). VROV can be run in pre-scripted or fully interactive mode.

The goal of the system is to enhance safety and productivity of marine assets and operations:

  • As an instructional tool, VROV provides a cost-efficient opportunity for a trainee to gain valuable stick-time and operational familiarity while minimizing risk to personnel and ROV equipment.

  • As a design and engineering tool, it consistently demonstrates its value in testing the form and function of subsea assets, including vehicles, tools and structures control software, and in facilitating training in operation and installation of assets.

In a collaboration between GRI and Trendsetter Engineering, subsea source-control equipment such as capping stacks and associated hardware has been rendered into the VROV simulator. This allows an ROV operator to practice deployment, installation and shut-in operations of a capping stack. Figure 2 shows a screenshot of the simulator as a subsea capping stack is installed on a BOP. A continuous feed of the subsea operations can be shown in multiple views, such as bird-eye view and ROV view.

Figure 1:

VROV portable simulator

Figure 1:

VROV portable simulator

Close modal
Figure 2:

Capping stack visualized in VROV

Figure 2:

Capping stack visualized in VROV

Close modal

For the MEXUS drill, a realistic blowout scenario and script were created to challenge the participants to analyze the well-flow situation and to execute a soft shut in process in accordance with a safe, approved soft shut-in procedure for the capping operation. The soft shut in procedure would be developed with the Source Control Management, approved at the Unified Command with government agencies, and identified all necessary equipment and people to carry out this critical operation to stop the flow of the well without compromising well integrity, such breaking down the containment at the casing shoe.

Both VROV and OLGA-WELL-KILL were used as integral part of the exercise. The VROV simulator was displayed on monitors throughout the incidence command center, which allowed all participants a visual representation of the ongoing operation. This is similar to what would occur after an actual blowout; as an example, during the Macondo response continuous ROV feeds showed the condition of the wellhead, discharge of hydrocarbons, and any of the source-control operations.

The OLGA-WELL-KILL simulator was used to predict the physics of the blowout and subsequent operations. That is, simulations had been run in advance to estimate a realistic blowout scenario with respect to discharge rate, pressure, temperature etc. The results had been programmed into the VROV simulator.

Some of the important engineering tasks required for a subsea capping operation are described by Oskarsen et. al. (2017), including deployment, installation and shut-in operation of the capping stack. All operations were visualized during the MEXUS drill using VROV.

As part of creating the optimal soft shut-in procedure, it is necessary to predict the behavior of the flowing wellbore throughout the operation. A concept that has been widely used in the industry for post-Macondo source control exercises is the development of pressure-response curves (PRC).

There are many different types of subsea capping stacks available, which vary in weight, ratings and hardware configuration. The subsea capping stack deployed during the MEXUS drill was rated for 15,000 psi and was configured with a main bore and four side outlets. The main bore was closed with a blind/shear ram, while two of the side-outlets were closed with gate valves and the remaining two outlets were closed with chokes. Pressure sensors are located inside the capping stack and an ROV panel included the corresponding pressure gauges.

During the shut-in operation, the pressure inside the stack will increase as the outlets are closed in, until a final shut-in pressure is achieved. The pressure reading from the ROV panel will be used during the shut-in operation for downhole diagnostics. For example, if well integrity is compromised, an underground cross-flow may be initiated, which will likely result in a lower pressure reading inside the capping stack. In a worst-case scenario, a shallow formation may fracture, which could lead to a broach to surface. On many historical blowouts, this has resulted in a cratered wellhead, which means that there are no further mitigation options to control the blowout from the mudline. Instead, the blowout must be stopped with a relief well, which will likely take a much longer time.

One of the main objectives during the MEXUS drill was to develop a soft shut-in procedure for closing in the outlets of the capping stack. For various blowout scenarios, OLGA-WELL-KILL was used to calculate what the pressure should read as the outlets are closed. This process includes a sensitivity on reservoir properties and a well-integrity assessment addressing casing loads and possible fractured formations. After developing pressure response curves (PRC) for the different scenarios, a safe operating window is agreed upon by the participants. That is, as long as the pressure inside the capping stack falls in between the min and max PRC, the outlets can continue to be closed in. However, if the recorded pressure is outside the safe operating window, the shut-in operation should be halted, and downhole diagnostics performed to determine the cause of the abnormal pressure reading. Using sound engineering judgement, the decision must be made to continue with the shut-in process or possibly to open the outlets back up to relieve pressure and commence a cap-and-flow operation where the hydrocarbons are diverted to a production facility. The flowback operation would then continue until a relief well intersects the blowing well.

Figure 3 shows the PRC plot developed during the MEXUS drill. As seen, when the main bore is closed using the blind/shear ram, the pressure inside the stack is not expected to increase. This is because the total flow area of the four outlets is greater than the flow area of the wellbore. After the main bore is closed, both side outlets fitted with chokes are closed in sequence. This is done as an integrity test of the Capping Stack without imparting unnecessary back pressure into the reservoir until ready to do so. The two chokes are opened back up, and the gate valves are closed in sequence. At this point the pressure inside the stack is expected to increase. Finally, the two chokes are closed again, until the capping stack is fully shut in and the well is contained.

Figure 3:

Pressure response curve plot used as part of the shut-in procedure.

Figure 3:

Pressure response curve plot used as part of the shut-in procedure.

Close modal

After successfully installing the capping stack and finalizing the shut-in procedure, the call is made to initiate the shut-in operation. The ROV operators will at this time position the ROVs as shown in Figure 4, where one of the ROV maneuvers around the capping stack while closing the outlets in the predetermined sequence while the other ROV is monitoring the pressure gauges on the ROV panel.

Figure 4:

Two ROV's working on the subsea capping stack – left ROV is closing an outlet using a torque tool, while right ROV is monitoring the ROV panel.

Figure 4:

Two ROV's working on the subsea capping stack – left ROV is closing an outlet using a torque tool, while right ROV is monitoring the ROV panel.

Close modal

Figure 5 shows the ROV camera on the pressure gauges. Exercise participants use the camera image to read the pressure inside the capping stack during the shut-in operation. For the MEXUS drill, the VROV simulator was pre-programmed with an abnormal pressure response that would indicate a possible broach scenario being initiated during the very last part of the soft shut-in sequence. As the outlets were closed, the participants read off the recorded pressure and compared it to the PRC plot prepared as part of the shut-in procedure. When the abnormally low pressure was observed, the participants, who were monitoring the pressure response curves relative to the capping stack pressure gauges during shut in process, immediately. called to stop further closing of the capping stack. Subsequently, it triggered the participants to initiate diagnostics of possible failure mechanisms.

Figure 5:

Gauges on the ROV panel show pressure inside the capping stack

Figure 5:

Gauges on the ROV panel show pressure inside the capping stack

Close modal

A discussion of possible reasons for the low pressure commenced where one plausible hypothesis was that the choke had “washed out” and was bleeding pressure inside the stack. The choke was tested and found to be working correctly. Following a process of elimination, it was correctly concluded that there was a high probability of a shallow casing having failed that could lead to a possible broach if the ROV continued to close the capping stack openings. Ultimately, the decision was made to open the capping stack back up and preparation for a flowback operation was initiated.

Full-scale oil spill exercises tie up a lot of resources and can be very costly for the involved parties. Furthermore, the participants may have busy schedules and may feel that the exercise is taking away time from their normal day-to-day jobs. This makes it very important to plan the drill to be a valuable and successful event. In the past, it would be a facilitator's role to narrate all the events occurring during the drill, but often participants would become confused and/or disengaged as the event progressed. Another major challenge in the past has been to keep communication flowing between the various groups in the incidence command organization. Very often, some of the groups did not get proper notification of the ongoing operation and were not able to provide their necessary input.

For the MEXUS full-scale exercises, the solution to these challenges was to place large screens in all incidence command center rooms showing ROV feeds of the source-control operation. This allowed continuous visualization of the well status and current operation, which mimics real-world events.

Coupling VROV with OLGA-WELL-KILL gave visualization of the source-control operations with proper physics. During the MEXUS full scale exercise, the simulator was run in a prescripted mode, but it could also have been used in a fully interactive mode. The simulator can also show multiple views of operations, including bird-eye view and ROV view.

Based on observations and feedback from the MEXUS full-scale exercise, the visualization provided realism like an actual event, which also improved engagement, learning and understanding.

As a final note, technology exists today that can train personnel in peace time for a war-time event. When boarding an airplane, it is of course preferred that the pilots have a lot of flight experience. If the pilots have little to no practical flight experience, at least passengers would hope that they have a lot of proper simulator training. Nobody would feel very confident if they announced before take-off that the pilots have no practical experience or simulator training, but on a few occasions, they've sat around a table and talked about how they will fly the airplane.

Bureau of Safety and Environmental Enforcement,
2016 National Preparedness for Response Exercise Program (Prep) Guidelines
.
GRI Simulations, 2019, GRI VROV (VIRTUAL REMOTELY OPERATED VEHICLE)
.
IOGP Report 434-02, September 2019, Risk Assessment Data Directory Blowout Frequency, International Association of Oil & Gas Producers, Version 1, www.iogp.org/bookstore/product/risk-assessment-data-directory-blowout-frequencies/ (accessed 6 December 2019).
IOGP Report 594, January 2019, Source Control Emergency Response Planning Guide for Subsea Wells, International Association of Oil & Gas Producers, Version 1, ww.iogp.org/bookstore/product/594/ (accessed 1 February 2020).
Drieu
Michael,
Sams
Michael,
and
Wilson
Kelly
(
2017
)
One Gulf – Commitment to Preparedness
.
International Oil Spill Conference Proceedings: May 2017
,
Vol. 2017
,
No. 1
, pp.
2743
2761
.
Oscar Luis Ulloa Lugo and Ignacio Osorio De Leon : Ixtoc No.1, Blowout And Control Operation, SPE Deep Drilling and Production Symposium, 5–7 April, Amarillo, Texas 1981, SPE-9697-MS.
Oskarsen, Emilsen, Paknejad, Cargol, and See: How to Develop a Well Specific Blowout Contingency Plan That Covers Engineering Analysis of the Deployment, Installation, and Soft Shut-In of a Subsea Capping Operation, SPE Annual Technical Conference and Exhibition, 26–28 September 2016, Dubai, UAE, SPE 181393.
Rygg,
O.B.
and
Gilhuus,
T.
1990
.
Use of a Dynamic Two-Phase Flow Simulator in Blowout Kill Planning
.
Presented at the SPE Annual Technical Conference and Exhibition
,
New Orleans
,
23–26 October
.
SPE-20433-MS.