Well Control Risk Assessment, Human Factors, and Management of Change

Risk assessment makes the response usable

Well control risk assessment connects anticipated hazards, available barriers and the actions the crew can actually take. Pressure calculations are necessary, but a correct number cannot overcome an unprepared valve, an incompatible crossover or an unclear instruction. Before an operation, the crew should understand the applicable well programme, warning signs, pressure window, equipment limitations and escalation route. The required assessment and documentation follow the operator's system; a toolbox discussion communicates the plan but does not replace engineering approval or barrier verification.

Start with the operation rather than a generic list. Drilling into a potential reservoir raises questions about anticipated pressure and detection. Tripping adds swab, displacement and hole-fill risks. Running casing changes the internal flow path and available closure devices. Cementing introduces fluids of different densities and periods when returns may have several legitimate sources. A subsea operation also needs the current choke-line friction, riser condition and disconnect arrangements. Each phase can change which observations mean trouble and which first response is suitable.

Identify hazards and available controls

A useful assessment states the hazard, its possible consequence, the preventive control, the detection method and the contingency. For example, an unexpected pressure increase can overcome the planned hydrostatic head; the controls include suitable density, a verified pressure window, trend monitoring and prepared containment. A plugged flow sensor can conceal an increase in returns; independent pit-volume monitoring and an agreed instrument-failure response reduce that vulnerability. Two indicators with a shared failed power supply are not independent protection merely because they have different display names.

Record who has authority to approve the plan and who carries out each action. A contingency that says only “inform somebody” leaves a gap if the driller must recognise an influx and begin the instructed first response immediately. Conversely, authority to take that first response does not authorise an improvised kill method or an unapproved change in mud density. Level 3 practice includes timely action and a useful handover to the supervisor.

Management of change

An unexpected pore pressure, altered fluid specification, failed barrier, changed equipment configuration or unavailable competent person may invalidate assumptions in the original plan. Use the applicable Management of Change process before dependent work proceeds. The process evaluates the new hazard, checks equipment and pressure limits, updates procedures and identifies approvals and communication. A change can be temporary and still require review. A replacement component with the same nominal size may have a different pressure, temperature or service qualification.

Consider a planned trip with a functioning trip tank. If the trip-tank instrument fails, writing “use the pits” in the log does not establish an equally sensitive replacement. The team must determine what can be measured, its uncertainty, the approved alternative and whether the operation can proceed. If the remaining measurement cannot resolve the expected stand displacement, the missing capability is a substantive well control problem. A changed plan needs briefing at the point of work and inclusion in the next handover.

Human factors and communication

Confirmation bias can make a crew interpret a pit gain as a transfer because a transfer is the explanation they expect. Verify the actual transfer time, source, destination and volume rather than accepting a plausible story. Alarm fatigue can cause a repeated warning to be ignored; record and resolve faulty alarms through the approved process rather than quietly disabling them. Competing tasks can divert attention from returns while connections or pipe handling occupy the floor. Allocate the monitoring responsibility explicitly.

A shared picture of the well should include both measurements and uncertainty. Say “the selected pits gained 3 bbl in two minutes with no logged transfer” rather than “everything seems strange.” Distinguish an observation from an interpretation and state the action taken. Closed-loop communication means the recipient repeats or acknowledges the critical instruction and the sender confirms that it was understood. An acknowledgement is not proof that a valve has moved or a pressure seal exists; verify the relevant result as well.

A practical handover example

Suppose the crew changes mud density while background gas rises and one return-flow channel is intermittent. The next driller needs the old and current density, when treated fluid should reach the bit, the trend and lag information, the faulty channel, the remaining monitoring arrangement and the approved response. “Mud is heavier now” omits the transient fluid distribution and detection limitation. Record pump strokes and the relevant circulation endpoints so the next shift can place observations in the same time sequence.

Stop-work authority and the approved warning-evaluation and influx-response procedures support prompt action. Conventional shut-in, shallow-gas diversion and evacuation address different conditions; risk assessment identifies the applicable response before an event. The objective is a crew that recognises deviations, communicates clearly, acts within its role and preserves the information needed for safe supervision.