ICS helps structure blowout response plan

Petrobras uses Incident Command System to plan for first, continued responses in worst-case well control scenarios

By Frederico de Azevedo Maia, Fernanda Azevedo Cavalcante Fernandes, Alfonso Humberto Celia Silva, Petrobras

To establish an effective blowout response, drilling hazards must be assessed. Once the potential hazards are understood, it is logical to recognize that blowouts are the most important hazard during the well construction process to be considered. This article describes how Petrobras is approaching blowout response.

Along with comprehending well-construction hazards, the first steps to understanding blowouts means establishing a way to reduce risks by running a hazard assessment during the well design phase.

Important characteristics to consider are:

• Geological aspects;

• Properties associated with the production of each geologic zone;

• Fluid properties, fluid pressures in each zone, types of fluid (oil, gas, contaminants), plus water, sand and other toxic elements that may be present; and

• The structural density of each zone and abnormal characteristics.

Operational aspects that should be considered are:

• Drilling rig limitations, including capabilities as far as pump pressure and flow, maximum well depth, corrosion and erosion protection on lines and accessories, critical supplies and spare parts, flare locations, maximum BOP pressure, and how to identify gas presence and abnormal flow in the drilling fluid;

• Well design critical points, including what could go wrong and how to return to normal operations, what kind of well logging (define the range) needs special attention and what to do for each case during the critical stage of well construction, as well as pre-planning a relief well (location, drilling rig and supplies).

• Minimum rig team qualifications to understand risk-control actions associated with well design;

• Pre-job meeting to discuss all critical tasks with the team;

• Safety job assessment to ensure critical jobs have procedures with safety points; and

• Understanding the emergency response plan (ERP) is a must for the rig operation team; this understanding would be useful to all other personnel on the rig as well.

Once these considerations are made and the potential hazards are understood, we must look at the problem itself – the blowout. The first step is to understand the blowout process: If you know how blowouts develop, it would be easier to establish measures to control them.

To achieve this understanding, it is necessary to identify the average timeline when control of the well is lost. This timeline represents well behavior in blowout conditions.

In this step, the blowout growth path and its critical points must be identified. To identify these critical points is to consider the points that could lead to a worst-case scenario and consider them critical. The interactions of each point with all other identified points should then be assessed. This assessment should identify the root causes of each critical point and its interactions with others; this makes it possible to take the measures necessary to prevent or reduce their effects, as well as the effects of their interaction.

Once the root cause and consequences are established, a determination can be made as to what competencies and capabilities will be required of the people involved in order to establish correct procedures and associated resources (personnel, equipment and supplies) to control each critical point.

The Incident Command System (ICS) protocol is an important tool that can be used to solve this complex problem (variable numbers, competencies and capabilities of personnel involved at different points of the incident timeline). The ICS organization chart and communication system determine the organization and resources that would be needed to run an orchestrated response to an incident.

The blowout incident management is divided into two phases:

• Immediate response – where all procedures must be correctly undertaken by the rig floor team, and they must react immediately.

• If the first response does not achieve the desired results and the incident dynamics continue to escalate, a continued response mode shall be implemented. The principal steps to improve continued-response management are:

o Assess the incident – what are the problems and the probable paths of incident escalation;

o Set an incident action plan (IAP) – what needs to be done immediately after first response to control the situation and to prevent incident escalation;

o Take actions to apply these plans;

o Consider the planning, logistics, and administrative and finance aspects;

o Use a communication system to exchange information and make a critical evaluation of the incident action plan’s effectiveness;

o The post-incident plan is not within the scope of this article.

Kick signals

To react as soon as possible to a blowout, the entire drilling rig team must work to identify kick signals. The sooner the signals are identified, the easier the well could be controlled. Decisions must be taken by the drilling team to control a kick without delay because the window of time for the correction is very small.

The most common cause of inflows is the loss of the first inflow barrier – drilling fluid hydrostatic pressure is less than the formation pressure. The driller must observe the values of the variables, defined in the well design; if the levels are beyond the set limits, the well is likely taking a kick. Depending on how far beyond the parameters and which stage of well construction is under way, it can be easy to re-establish the wellbore equilibrium pressure and prevent a blowout.

Another consideration is the well shut-in consequences. If the wellhead safety devices (WHSD) stop the flow and the pressures in the wellhead are controlled to an acceptable level, the well is controlled and the next step is to establish the tie-back to kill it.

However, if, instead of stopping the flow, there is a failure in the WHSD (leakages) or if it is necessary to reduce the wellhead pressure to prevent an underground blowout (casing shoe or cementing limit pressures exceeded), the situation becomes much more difficult to control. In this case, it is necessary to establish countermeasures to reduce these pressures. Such countermeasures may involve complex procedures and additional resources to maintain the well pressure relief flow without fluids leakage to the atmosphere or environment.

As all initial procedures to shut in the well are set by the first-response plan (FRP), it’s critical that all procedures and resources are included in the FRP. All resources listed must remain mobilized and ready for use.

The FRP makes up the basis for the training of the rig team, especially the operations group.

Once drill exercises and audits (on the integrity inspection and maintenance program) are run, it is assumed that the FRP is capable of efficiently controlling the incident. In case any doubts arise about its efficiency during the drills, FRP reviews shall be made.

Applying ICS

Once well-kill procedures are completed, the incident is solved; however, it is easy to recognize the complexity of customized procedures, operations, resources and, most importantly, the specialized personnel that set and execute these procedures and their support accessories.

Again, the ICS becomes an important tool to guarantee that all objectives are efficiently attended. This emergency management protocol establishes an array of hierarchy and duties, as well as its capabilities, responsibilities, registers, documentation and communications flow.

The ICS protocol is useful from small occurrences to big incidents such as Macondo. It could be adapted to any incident condition and could be used in escalating situations or after-incident control when the situation is normalized.

Figure 2 shows the Petrobras emergency organization chart (EOC) that is run to support a blowout response. The ICS chart has been simplified, with the command and support sections (logistics, and administration and finance) excluded. In a real application, these shall be considered.

Under the operations section, executing the plans begins with the drilling rig team (the yellow boxes). If the incident escalates, the company man and an “ERBO” team (Portuguese for blowout response “transpire” team) are added. This could be a specialized team or a single person linked directly to the planning section to execute the procedures established in the ERP’s first-response plan or continued-response plan (incident action plan).

Simultaneously, the HSE team works with the emergency team to apply safety countermeasures supporting the rig team’s actions.

The planning section is where, after the first response, the IAP will be established and revised after each critical analysis of its effectiveness. After the blowout behavior is identified, it is necessary to then identify the personnel competencies needed to produce an IAP in accordance with the incident dynamics. Often, the company will need to deploy competencies and capabilities from different assets and maybe even from another country. The goal is to associate all the necessary and high-level knowledge and know-how to develop the best IAP within the time and information available at the moment.

At Petrobras, this specialized group is called CARBO, which in Portuguese means blowout coordinator support team. This team is made up of specialists ranging from engineers and well designers from operational units to top well research engineers from CENPES, Petrobras’ research center. With this group, Petrobras is capable of setting an adequate IAP to support the ERBO team on the drilling rig.

Figure 3 shows an example of applying the ICS in a typical incident escalation flow. The first two steps represent application of the FRP. The on-site personnel immediately use their capabilities, acquired through training, in this initial phase. In this example, a small abnormal situation is controlled by one employee – this represents the operational response in a basic case. For the first response to be effective, it is important that the procedures are applied and that all associated resources are ready for use.

A part of the first-response procedures is to trigger the next phase – the continued-response management – if more resources are needed. This is accomplished through an alarm system.

This phase begins with the first-command staff meeting to evaluate the effectiveness of the first response and determine if the FRP procedures should be revised or if the first IAP needs elaboration. To conduct this meeting, information that was registered (formal and mentally) by the first-response team must be communicated; this is part of the ERP. If the incident scene was identified and is part of the scenarios foreseen in the ERP, this information will be used to support the first meeting.

During this meeting, the commander defines the objectives and the most important strategies that guide the response effort. In this sequence, if the first response is effective, the incident is controlled and eliminated.

Yet if the incident continues, the response actions that are being applied should be reviewed, and new response actions may need to be established.

In applying the ICS protocol (Figure 6), the goals are:

• To evaluate the objectives and their defined strategies;

• To identify the necessary related tactical-response actions;

• To plan the tactical action (timing, resources and supplies) that attend the strategies to achieve the objectives.

Three tasks are planned – two meetings and a work planning session. The first meeting aims to define the response in a broader sense (legislation compliance, difficulties, gross resources and supplies that need to be associated). The next meeting will define in more detail what tactics are associated with the identified strategy and how they could be applied (procedures and resources).

Once the tactical actions and their operational procedures are established, the resources needed to allow their effective execution must be planned. All resources and associated supplies will be identified and quantified, with their deployment time and location scheduled.

The logistics section is responsible for ensuring the resources and supplies are available, as well as for their mobilization.

One key point is that these three steps are not necessarily executed separately. Depending on the incident dynamics, the team may realize these steps in one operation or work session.

If the results of the strategic actions are agreed upon by all the necessary disciplines, the command staff establishes the tactical options for each strategy. If the decision to apply these tactics is not reached, the issue is returned for a new objective/strategy meeting that would consider command staff suggestions. If the command staff decides that the defined strategies and tactics can achieve the objectives, then the strategies and tactics will be completed with all the documents and information necessary (to facilitate purchase identification or mobilization from the company warehouse, including outsourcing or personnel qualifications) to deploy them.

After all tactical procedures and their associated resources, including personnel and supplies, are defined, the entirety of this information will be evaluated in a meeting of the command staff with the purpose of securing the commander’s approval of the strategies and tactical actions and the priority of these strategies.

Once approved by the commander, the tactical actions are broken down by detail to be applied. This includes training personnel and guaranteeing that the logistics team is able to supply the necessary resources for the operational team (Figure 7). The qualifications and level of instruction for the team to be trained should be considered, as well as the training technique to be applied.

Again, these three steps are not necessarily executed separately and may be realize in one operation or work session.

For the resources needed, care must be taken with their transportation. The delivery route and means of transportation of the resources should be defined (from company, warehouse or supplier) so as to guarantee identification, mobilization and deployment at the determined site.

The necessary financial resources shall be available, the cost-control actions shall be in place, and the administrative means to control personnel work hours are set in motion.

As these procedures are running, the task teams must continue to inform their commander, through the hierarchy line, the level of effectiveness or failures of the measures taken. This is important feedback for the management of the incident.

The final step of the ICS management cycle is a diagnosis (Figure 8 ) of the incident response and its effectiveness.

If the incident is not totally resolved, feedback from the operational teams and the IAP are analyzed, and the need for a review or other IAP is considered. A new incident management cycle will be run again.

If the response resolves the incident, all typical response activities are terminated, and the command staff establishes a post-incident plan.

Conclusion

To effectively respond to a blowout or a similar scenario, it is necessary to consider these points:

• Understanding of the incident dynamics and behavior is essential;

• An emergency response plan focusing on the first-response actions and continued-response management must be established.

For continuous-response management, a systematic organization of competencies that could generate a continuous IAP is needed. The ICS protocol perfectly fits the organizational resource management and operational planning needs to attend the objectives of controlling the incident.

This article is based on a presentation at the 2011 IADC Well Control Conference of the Americas Conference & Exhibition, 25-26 August, San Antonio, Texas.