Well Control Basics – Primary, Secondary and Tertiary Barriers

Stand on a drilling location at night and the whole place hums. Pumps thump, the shakers rattle, and thousands of feet below your boots there is rock holding gas and oil under enormous pressure. Most of the time that pressure stays exactly where it belongs. So what keeps it there, and what happens when it tries to get out? What is well control, and how do the primary, secondary and tertiary barriers work together?

Well control is the practice of keeping formation fluids (oil, gas and water) from entering the wellbore in an uncontrolled way, and regaining control quickly if they do. It works in three layers. Primary well control is the weight of the drilling fluid itself, which pushes back harder than the formation pushes on the well. Secondary well control is the blowout preventer and surface equipment that seal the well and let the crew circulate an influx out safely. Tertiary well control covers last-resort measures, such as relief wells, plugs and capping, used when the first two layers fail.

What Is Well Control in Plain Terms?

Think of a well as a long straw pushed into a sealed, pressurized can. If whatever is inside the straw is heavy enough, nothing from the can comes up. If it gets too light, the can starts pushing its contents up the straw. Well control is everything the crew does to keep the straw's contents heavy enough, and to slam the top shut if they are not.

The fluids in the rock are called formation fluids, and the pressure they sit under is called formation pressure or pore pressure. When those fluids get into the wellbore without anyone intending it, that event is called a kick. If a kick is not caught and controlled, it can grow into a blowout, which is an uncontrolled release of fluids at surface or into another formation underground.

I grew up hearing grown men talk about wells the way farmers talk about weather. Respectful, a little wary, never casual. That attitude is the heart of well control. The equipment matters, but the mindset matters more.

What Are the Three Levels of Well Control?

The industry describes well control in three levels. Each one exists because the one before it can fail.

1. Primary well control: the hydrostatic pressure of the drilling fluid column holds formation fluids in place.
2. Secondary well control: if fluids enter the well, the blowout preventer (BOP) closes and the choke manifold is used to circulate the influx out and restore primary control.
3. Tertiary well control: if the BOP or the well itself cannot hold, crews turn to emergency measures such as relief wells, cement or barite plugs, or capping stacks.

You will also hear people talk about "barriers" rather than levels. A barrier is anything that stops flow, such as the fluid column, cemented casing, the BOP or a downhole plug. The usual rule in modern operations is that at least two independent, tested barriers should be in place at all times. If one fails, the other is still standing.

How Does Primary Well Control Work?

Primary well control is quiet and unglamorous. It is simply the weight of the mud. A column of fluid exerts pressure at the bottom based on its density and its true vertical depth, and drillers calculate it with a familiar formula:

Hydrostatic pressure (psi) = 0.052 × mud weight (pounds per gallon) × true vertical depth (feet)

If that hydrostatic pressure is higher than the pore pressure in the open rock, formation fluids stay put. The mud engineer and the driller aim for a window. Too light, and the well can take a kick. Too heavy, and the mud can fracture weak rock and leak away into it, which is called lost circulation.

What Can Weaken Primary Control?

The mud column does not have to be wrong on paper to fail in practice. Several everyday events can reduce bottomhole pressure:

• Not keeping the hole full when pipe is pulled out, so the fluid level drops.
• Swabbing, where pulling pipe too fast acts like a plunger and draws formation fluid in.
• Lost circulation, which drops the fluid level in the annulus.
• Drilling into a higher-pressure zone than expected.
• Gas-cut or diluted mud that lowers the average density of the column.

This is why tripping is watched so closely, and why the trip tank and the trip sheet exist. Many of the worst kicks in drilling history started not while making hole, but while pulling pipe.

How Does Secondary Well Control Work?

Secondary well control begins the moment the crew realizes formation fluid is entering the well. The first job is to recognize it. Learning the warning signs of a kick in drilling, like a pit gain or flow with the pumps off, is the single most valuable skill a new hand can pick up.

Once a kick is suspected, the driller shuts the well in using the blowout preventer. The BOP is a stack of large valves on top of the wellhead. Annular preventers seal around whatever is in the hole, while ram preventers use steel blocks to close on pipe, close an open hole, or cut through pipe in an emergency.

Shutting in stops the flow, but it does not finish the job. The kick is still in the well. The crew reads the shut-in drillpipe pressure and shut-in casing pressure, calculates the mud weight needed to balance the formation, and then circulates the kick out through the choke manifold. An adjustable choke holds back pressure so that bottomhole pressure stays constant while the influx comes up and the heavier "kill mud" goes down.

What Kill Methods Do Crews Use?

The two most common circulating methods are:

• The Driller's Method: circulate the kick out with the original mud first, then circulate a second time with kill-weight mud.
• The Wait and Weight Method: weight up the mud first, then pump kill mud in a single circulation while the kick is removed.

There are other methods for special cases, such as the volumetric method when circulation is not possible. Which one gets used depends on the well, the rig and the operator's procedures. Either way, the goal is the same: get primary control back.

What Is Tertiary Well Control?

Tertiary well control is what people hope never to use. It comes into play when the well cannot be shut in or controlled with the BOP and normal circulation. That might mean the BOP failed, the casing or wellhead failed, or an underground blowout is moving fluid from one zone into another.

Common tertiary measures include:

• Relief wells, drilled to intercept the original wellbore deep underground so heavy mud and cement can be pumped in to kill it.
• Barite or cement plugs set downhole to seal off the flowing zone.
• Capping stacks and specialized well-control teams that work on a blowout at surface or on the seafloor.

These operations can take days, weeks or months. When you hear about a well that flowed for a long time before it was stopped, you are hearing about tertiary well control. The cost in money, environmental damage and sometimes lives is why the first two levels get so much attention.

Why Do Crews Talk About Two Barriers?

Ask an experienced driller why the industry insists on two independent barriers, and you will usually get a short answer: because things break. Mud weight can be miscalculated. A cement job can channel. A seal can wear out.

The two-barrier idea means one failure alone should not lead to a disaster. While drilling, the primary barrier is usually the mud column, and the secondary barrier is the BOP along with the casing, cement and wellhead below it. During completion or abandonment, the barriers might be a packer, a plug, cement or a closed valve on the tree. The specific barriers change; the principle does not.

Barriers also have to be tested. A barrier nobody has verified is really just a hope. That is why BOPs are pressure tested on a schedule, why casing is tested after it is cemented, and why plugs get tagged or pressure tested before anyone relies on them.

Who Is Responsible for Well Control on a Rig?

On paper, the driller is the first line of defense. The driller watches the pit volume, flow and pressures from the doghouse or the driller's cabin, and the driller is the one who shuts the well in. But in practice, well control belongs to everyone on location.

• The derrickhand often tends the pits and mud system and may be the first to notice a gain.
• The floorhands handle the pipe, install the safety valve if needed, and help line up the well.
• The mud logger and mud engineer watch gas readings, mud properties and returns.
• The toolpusher and company representative lead the kill and make the big calls.

Most drilling contractors and operators require certified well control training for key positions. Programs accredited under IADC WellSharp are widely used across the industry, and offshore regulators set their own requirements on top of that.

What Happens When Well Control Fails?

When all the layers fail at once, the result is a blowout. Gas reaches surface, finds an ignition source, and the rig can catch fire. Offshore, the consequences can include loss of life, loss of the rig and major oil spills. On land, crews have been killed on locations that looked routine right up until they did not.

I think about those crews when I read the dry language of incident reports. The failures are rarely one big mistake. They are usually a chain: a missed sign on the trip sheet, an alarm that was turned off, a test result explained away. Every link was a chance to stop it. The OSHA well control eTool lays out those hazards in plain language and is worth reading even if you never set foot on a rig floor.

The good news is that well control works far more often than it fails. Kicks happen, crews catch them, the well gets shut in, and the kick is circulated out. Most people outside the industry never hear about those days, because nothing bad happened.

What Is Well Control Really About, Beyond the Barriers?

At its simplest, well control is keeping the rock's pressure where it belongs. Primary control is the mud weight. Secondary control is the BOP and the choke used to shut in and kill a kick. Tertiary control is the emergency work that happens when the first two fail.

The reasoning behind all of it is the same: no single barrier is perfect, so you build in layers and test them. The equipment gets the headlines, but people who pay attention to small changes in the pits are what make the system work.

If you are new to the industry, start with the warning signs of a kick and learn them until you could recite them half asleep. Everything else in well control builds on catching trouble early.

← All Resources