Operating a Subsurface Heat Institution

Abstract

A deep-crust station operates two plants at once. One is visible, inspectable, and fast: pumps, valves, exchangers, turbines, treatment, and controls. The other is geological, inferred, and slow: pressure diffusion, fracture conductivity, thermal depletion, chemistry, and induced stress. I define an operating doctrine that keeps both inside a common envelope. The control room organizes work by plant state, preserves independent well barriers, reconciles mass and energy, tracks sensor confidence, and assigns explicit authority for seismic and process shutdown. Dispatch follows customer value without forcing the reservoir through damaging transients. Procedures are tested in simulation and drills, then improved from event evidence. The station earns reliability through disciplined response to change, not through the pretense that steady state will persist.

Two clocks govern the station

Surface equipment responds in seconds or minutes. A valve closes, a pump accelerates, or a turbine trips. Reservoir pressure may diffuse for hours or months. The thermal front evolves across years. An operator action can therefore solve an immediate plant problem while creating a delayed geological one.

The operating model carries both clocks. Fast control protects pressure, flow, rotating equipment, and people. Supervisory control schedules wells and stages within seismic, thermal, chemical, and long-term limits. Reservoir engineers update forecasts, but the control room always has an approved current envelope.

I define a plant state rather than a loose collection of set points: offline and isolated, monitoring only, cold circulation, thermal ramp, normal service, constrained service, controlled shutdown, emergency shutdown, and intervention. Each state declares valid flow paths, required barriers, available sensors, alarm limits, and permitted transitions.

The envelope is multidimensional

One maximum injection pressure cannot describe safe operation. Limits include pressure at several locations, rate, cumulative volume, temperature ramp, annular behavior, pump margin, vibration, chemistry, fluid inventory, event response, monitoring availability, and customer return conditions.

I represent the permitted state as

$$\mathcal{O}=\{x: g_i(x,\hat r,u)\leq0,\ i=1,\ldots,n\},$$

where $x$ is measured plant state, $\hat r$ is inferred reservoir state, and $u$ is current operation. Uncertainty in $\hat r$ reduces the allowable region. Losing seismic stations or a pressure gauge therefore changes permitted operation even if measured values remain normal.

Limits have action, owner, response time, and restoration criteria. An alarm with no decision is noise. An override with no expiry is configuration drift.

Make every shift a model test

At shift handover, operators review plant state, wells in service, barriers, overrides, maintenance, seismic response, reservoir forecast, chemistry, weather, customer demand, and unresolved anomalies. The log distinguishes facts, interpretations, and decisions.

Mass, energy, and pressure balances run continuously. For each period,

$$\Delta E=E_{\mathrm{produced}}-E_{\mathrm{delivered}}-E_{\mathrm{rejected}}-E_{\mathrm{loss}}.$$

Persistent imbalance can indicate measurement error, unaccounted storage, heat loss, phase uncertainty, or an incorrect model. Automated reconciliation flags the issue but does not invent a correction without traceability.

The reservoir forecast declares expected injectivity, production temperature, tracer response, event behavior, and pressure at monitoring wells. Actual response updates it. Operations become a continuous sequence of small experiments rather than a long period between special tests.

Dispatch the wells gently

Electricity markets and heat customers can value flexibility. The subsurface has ramp limits. Rapid cold injection creates thermal stress. Fast pressure change can alter seismic response. Flow reversals move chemistry and debris. Frequent cycling loads casing, cement, valves, pumps, and seals.

The surface plant can absorb some demand variation through multiple conversion trains, bypass, electrical storage, or thermal storage while wells move more slowly. A dispatcher optimizes net value subject to well and reservoir constraints.

Well rotation distributes thermal draw and creates inspection windows. It also changes pressure and can disturb scale. A planned rotation includes a modeled transient, sampling, barrier test, and observation period.

Customer contracts state ramp and interruption rights consistent with physical limits. Backup heat or power covers justified service levels. The institution must not promise flexibility that can only be delivered by spending geological safety margin.

ProtectFast equipment and barrier control

Pressure, speed, flow, vibration, trips, relief, and emergency isolation.

StewardSlow reservoir and thermal control

Pressure diffusion, seismic response, chemistry, impedance, and decline.

ServeCustomer and grid dispatch

Deliver contracted temperature, power, availability, and response.

LearnEvidence and configuration loop

Reconcile forecasts, anomalies, work, software, and actual plant state.

Control chemistry as actively as pressure

Injection and production chemistry is sampled on schedule and after changes. Online measurements watch selected fast indicators. Scale coupons, corrosion probes, filters, solids, and exchanger performance provide slower evidence.

Treatment dosage follows measured demand and approved ranges. A control failure cannot inject unlimited chemical. Storage, transfer, and dosing use containment and mass balance. Incompatible chemicals are physically separated.

Startup and shutdown receive special chemistry procedures. Stagnant hot brine, oxygen ingress, cooling, flashing, and mixed fluids can create corrosion or deposits absent at steady state. Flush and preservation states are designed rather than improvised.

Produced gases are monitored and managed. Venting and treatment comply with the environmental basis. An unexpected gas composition can indicate a changed flow path or geological interaction and triggers reservoir review.

Degraded operation is a designed mode

Losing one production well should not force unsafe flow through the remaining well. Losing a plant train should not block the fluid path. Losing grid connection should not blind seismic monitoring or leave hot fluid trapped. Redundancy is useful only when transitions have been tested.

The station classifies functions:

Priority	Examples	Degraded requirement
Life and public safety	Well barriers, fire, gas detection, emergency communication	Remain continuously available or drive safe shutdown
Geological safety	Seismic, pressure, inventory, shutdown control	Maintain required coverage for any injection
Asset protection	Cooling, lubrication, chemistry, drainage	Continue through controlled stop and preservation
Commercial service	Generation and heat delivery	Reduce or interrupt within contract

Backup power supports safe state for the time required, including delayed reservoir monitoring. Black-start procedures are practiced. Manual local control remains possible where common software or network failure could otherwise remove all authority.

Respond to anomalies before naming them

An anomaly is a discrepancy requiring controlled attention, not a diagnosis. If injection and production mass cease to reconcile, operators reduce to a state that remains safe under both a meter fault and a real leak. Diagnosis follows.

The response sequence is observe, validate the signal, bound immediate consequence, stabilize the plant, gather discriminating evidence, and decide. Premature certainty can drive the wrong action. A suspected sensor failure still reduces confidence until proven.

DetectRecognize disagreement or limit approach StabilizeEnter a safe bounded state DiscriminateTest competing explanations RestoreVerify condition before service

Events are classified by process safety, seismic, environmental, reliability, or commercial consequence, yet investigation examines their coupling. A valve trip can create a pressure transient, seismic response, customer interruption, and chemistry excursion.

Train judgment, not recital

Operators learn geology, hydraulics, thermodynamics, well barriers, process systems, seismic protocol, chemistry, and customer interfaces at the depth required for their decisions. Procedures support action but cannot enumerate every geological surprise.

Simulation presents ambiguous signals, sensor faults, delayed seismicity, conflicting customer requests, and maintenance under constrained staffing. Teams practice communication with authorities and communities as well as technical control.

Shift competence includes knowing when to stop. Production incentives are separated from safety authority. Any qualified operator can initiate a conservative hold, with escalation required to resume rather than to pause.

The operating institution becomes mature when its decisions remain clear under pressure, its degraded states are familiar, its models admit disagreement, and every shift leaves a better account of how the rock and machines actually behave.