Pump by Priority

1Introduction

The operating model of upstream oil and gas has evolved through four discrete generations: manual route loops, SCADA-augmented surveillance, Exception-Based Surveillance with mobile dispatch (the Pump by Exception model formalized in industry vendor briefs of the era and operationalized at scale through the late 2010s), and, beginning in approximately 2022, a fourth generation we refer to as Pump by Priority. Each generation tightened the loop between observed deviation and field action; each generation also inherited and propagated the assumptions of its predecessor. The current generation departs from prior models in a non-trivial way: it replaces deterministic threshold detection and rule-based prioritization with a stochastic-optimization loop in which detection, scoring, routing, execution, and learning are co-designed and continuously refined.

The motivating problem is acute. A lease operator responsible for 150 wells in the Permian routinely faces 30 to 50 active exceptions per shift (ANSI/ISA, 2016); the dollar spread between the highest-value and lowest-value alarm in that queue regularly exceeds two orders of magnitude; and the operator has no calibrated mechanism for triage beyond proximity, recency, or institutional habit. The five structural failure modes of EBS (alarm overload, undifferentiated severity, drift of nominal operating bands as wells decline, absence of economic context, and absence of outcome-driven learning) are not addressable by incremental improvements to alarm engines, mobile delivery layers, or SCADA coverage. They require a different architecture.

Contributions. This paper makes four contributions:

1. We formalize Pump by Priority as a stochastic constrained optimization problem over a per-shift task assignment with a closed-loop learning component (Section 3).
2. We present the mathematical formulations underlying each of the eight core subsystems (detection, scoring, routing, learning, sensor validation, multi-source observation fusion, active sensing under value-of-information (Oilfield Sudoku), and confidence-aware handoff) together with algorithm pseudocode and complexity analysis (Sections 5 to 12).
3. We derive a sufficient condition under which the closed-loop dynamics are contractive, ensuring that scoring accuracy improves monotonically in expectation over feedback cycles (Theorem 8.1).
4. We present field-validated benchmarks from a 5,000-plus-well production deployment and a complementary gas-distribution deployment, and characterize the regime in which the framework dominates classical EBS (Section 13).

Scope and audience. The paper is intended for two audiences: operating leaders (COOs, VPs of Operations, SCADA/OT leaders) evaluating the transition from EBS to a closed-loop model; and researchers and applied engineers building industrial AI systems for upstream operations. We have endeavored to make Sections 1 to 2, Section 13, and the discussion sections (14 to 17) accessible without specialized mathematical background, while the technical sections (3 to 12) require working familiarity with stochastic optimization, machine learning, and operations research.

2Related Work

Exception-based management. The doctrine of exception-based management traces to Drucker (1954), who formalized the principle that managerial attention should be reserved for outliers from expected performance. The framework moved into manufacturing through statistical process control (Shewhart, 1931) and the Toyota Production System (Ohno, 1988), and into information-technology operations through alarm-management platforms in the 1990s. The ANSI/ISA (2016) standard (ANSI/ISA-18.2-2016) codifies alarm rationalization for the process industries; EEMUA (2013) (EEMUA 191) provides complementary guidance. The Alvarez & Marsal whitepaper on Exception-Based Surveillance (Alvarez & Marsal, 2015) quantified the operational impact in upstream oil and gas: a shift in lease-operator value-added time from approximately 25% to 60%, and a typical well-to-operator ratio improvement from 20:1 to 30:1 or 40:1. The mobile-delivery product generation of the late 2010s represents the canonical field realization of the model. These references constitute the operational prior on which the present work builds.

Decline-curve analysis. The Arps family of decline curves (Arps, 1945) remains the dominant parametric model for production decline in upstream wells. Modern extensions incorporate Bayesian updates as data accumulates (Cheng et al., 2008), hierarchical priors over field-level populations, and probabilistic forecasts via Gaussian process regression (Ramsay & Silverman, 2010). Our anomaly-detection layer (Section 5) treats the per-well Arps fit as a heteroscedastic prior over expected production and tests deviations under a posterior-predictive distribution.

Vehicle routing. The vehicle routing problem (VRP) and its extensions (Toth & Vigo, 2014) are a standard formalism for field-crew dispatch. The variant relevant here is the multi-objective VRP with hard constraints (qualification, regulatory, time windows), soft penalties (geographic clustering, fairness), and stochastic task durations. Exact methods (branch-and-cut, column generation) are intractable at our scale (10 to 40 crews × 200 to 600 candidate tasks per day with re-optimization every 15 to 30 minutes). We adopt Adaptive Large Neighborhood Search (ALNS) (Ropke & Pisinger, 2006), which has shown strong empirical performance on VRP variants of this scale and admits online warm-starting from the prior shift's solution.

Contextual bandits and online learning. The closed-loop learning component (Section 8) is formulated as a contextual bandit over scoring-weight vectors with linear payoff structure (Li et al., 2010; Abbasi-Yadkori et al., 2011). We use a LinUCB-style algorithm with regret bound Õ(√T) adapted to the operational setting in which actions correspond to scoring-weight perturbations and contexts to the per-shift queue characteristics. Concept-drift detection follows Gama et al. (2014) using sequential CUSUM tests on prediction-error residuals.

Industrial AI and agentic operations. Boston Consulting Group (2025) and McKinsey & Company (2024) characterize the emerging industrial-AI value pool and the agentic-operations operating-model shift. The Stanford AI Index (2024) reports a 99% reduction in LLM inference cost from 2018 to 2025, which is a precondition for the kind of pervasive in-cab and control-room AI assistance described in Section 12. The aging-workforce trend documented by the Bureau of Labor Statistics (2025) (28% of U.S. lease operators aged 55+) provides the structural rationale for replacing tribal-knowledge triage with algorithmic prioritization.

3Problem Formulation

We model the upstream field operation as a discrete-time stochastic system over shifts indexed by t ∈ {0, 1, 2, ...}. The asset base is a set of N wells W = {w₁, ..., w_N}; the field force is a set of K crews C = {c₁, ..., c_K}. We let T_t denote the set of candidate field tasks at shift t, including SCADA-driven exceptions, scheduled maintenance, predictive-maintenance recommendations, inspection windows, and regulatory items.

where v_i(c, σ) is the realized economic value of completing task i via crew c given the crew's full ordering σ.

After execution, the system observes realized outcomes r_t = {r_i,t} for completed tasks, which feed back into the parameter update θ_t+1 = L(θ_t, s_t, π_t, r_t) where L is the learning operator (Section 8). The closed-loop dynamic is illustrated in Figure 1. Equation (1) is the per-shift sub-problem; the global problem is the infinite-horizon discounted reward optimization

where R_t aggregates per-shift realized value net of cost.

Decomposition. Solving (2) jointly is intractable. We adopt a tractable decomposition in which the per-shift sub-problem (1) is solved by combining (a) a learned scoring function (Section 6) that approximates E[v_i | s_t], (b) a constrained-routing solver (Section 7) that constructs (π, σ) given those scores, and (c) an outer learning loop (Section 8) that updates the scoring-function parameters using observed outcomes.

4System Architecture: The Six-Step Closed Loop

The operational system implements six tightly coupled subsystems, summarized in Table 1. Each subsystem corresponds to a step in the per-shift loop; the loop closes via the learning operator L.

The remainder of the paper treats each subsystem in turn. Figure 1 renders the loop schematically.

5Asset Modeling and Anomaly Detection

The detection layer replaces fixed alarm thresholds with a per-well probabilistic model of expected production behavior, against which observed signals are evaluated. The model has two components: (a) a Bayesian-updated parametric prior over the well's expected production decline, and (b) a heteroscedastic confidence band that captures the per-well noise envelope.

5.1Decline-Curve Prior

We adopt the Arps hyperbolic model (Arps, 1945) for the expected production rate of well w at time τ since first production:

with parameter vector φ_w = (q_i^(w), D_i^(w), b^(w)) denoting initial rate, initial decline, and hyperbolic exponent. The exponential and harmonic cases are recovered as b → 0 and b = 1, respectively.

Bayesian update. Rather than fitting φ_w once at completion, we maintain a posterior p(φ_w | D_w^(t)) updated each shift with the production data D_w^(t) = {(τ_j, q_j)} observed through shift t. Under the working assumption of independent Gaussian noise q_j | φ_w ~ N(q_w(τ_j | φ_w), σ²_w) and a hierarchical prior over φ_w conditioned on field-level population statistics, the posterior is computed via standard Monte Carlo or, in production, via a Laplace approximation around the maximum a posteriori (MAP) estimate. The MAP estimate at shift t is

with p₀ the field-level prior. The posterior-predictive expected rate at time τ^* is q̂_w(τ^*) = q_w(τ^* | φ̂_w^(t)).

5.2Heteroscedastic Confidence Band

Wells exhibit non-stationary noise: variance grows under choke changes, water-cut shifts, and equipment wear. We model the per-well variance as a learned function of operating conditions u_w:

where ψ(·) is a feature map and η_w a learned coefficient vector. The 1−α confidence band around the expected rate is then q̂_w(τ^*) ± z_1−α/2 · σ_w(τ^* | u_w).

5.3Anomaly Score and Detection Algorithm

Given an observed reading q_obs at time τ^*, the standardized anomaly score is

We declare an anomaly when |z_w| ≥ κ persistently over a window of L shifts (persistence requirement to suppress single-reading transients). The detection algorithm is summarized in Algorithm 1.

Complexity. Per-well update is dominated by the MAP optimization in (4), which is O(|D_w| · d_φ · I) for I Newton iterations and parameter dimension d_φ = 3. With warm-starting from the prior shift's MAP, I is typically 2 to 5 in production. Total per-shift detection cost is O(N · |D_w| · d_φ), which is embarrassingly parallel over w.

Multivariate extension. Univariate scoring suffices when production rate is the dominant signal; for compound failure modes (rod-pump fault, ESP wear, gas-lock) we extend to a multivariate Mahalanobis score

with q_obs the multivariate signal vector and Σ_w the empirical covariance. We default to univariate scoring with multivariate escalation when |z_w| ≥ κ₁ and a secondary signal also deviates.

6Economic Value Estimation

The scoring layer converts a detected anomaly into an estimated dollar impact. This is the substrate that allows the system to discriminate between a $200/day nuisance and a $15,000/day production loss: the substrate that classical EBS lacks.

6.1Value-at-Risk Formulation

Let task i be associated with well w_i. The realized cash-flow loss if task i is deferred from shift t to shift t + Δ_i is

where q̂_w is the expected (uncompromised) production rate, q^deferred_w is the rate under deferment (capturing partial production loss, escalating failure risk, and the probability of compounding failures), p(τ) is the realized commodity price, WI is working interest, r is the effective royalty/NRI complement, and C_op is the per-shift operating cost component attributable to the task.

Probabilistic deferred-rate model. The deferred rate q^deferred_w(τ) is itself a random function. A common parametric form is the conditional hazard model

where F_w is the cumulative failure-progression CDF conditional on the current state, and LossFactor captures the partial-production state (e.g., 60% rate under partial pump efficiency).

6.2Risk-Adjusted Score

We adopt a mean-variance risk-adjusted score for ranking:

with λ ≥ 0 the operator's risk-aversion parameter (calibrated from operating-leader preferences; typical values λ ∈ [0.3, 1.0]). The expectation and variance are computed by Monte Carlo over the joint distribution of decline-parameter posterior, deferment hazard, and price uncertainty. In production we use S Monte Carlo samples (typically S = 256) with antithetic variates for variance reduction.

Hard constraints, not weights. Safety and regulatory exposure are not additive penalty terms in (10). They are encoded as hard constraints on the feasible set H_t in (1). A task that violates a safety or regulatory constraint cannot be dispatched, regardless of its dollar score. This is a deliberate architectural choice that distinguishes the framework from naive utility-maximization formulations in which safety can be traded against cash flow.

6.3Scoring Algorithm

Complexity. Per-task scoring is O(S · H) where H is the evaluation horizon of (8) (typically 1 to 7 days at hourly resolution). For |T_t| ~ 10³ tasks per shift, total scoring cost is ~10⁵ to 10⁶ floating-point operations, easily parallelizable, completing in under 1 second on commodity infrastructure.

6.4Score Calibration

The scoring function is calibrated against realized outcomes via the learning loop (Section 8). At deployment, the scoring weights (e.g., the effective utility-curvature parameter λ, and the hyperparameters of the deferment-hazard model F_w) are initialized from field-level priors. Subsequent updates adjust these weights in response to observed gaps between predicted S_i and realized V_i.

7Constraint-Aware Daily Routing

Given a scored task set {(i, S_i)}_i∈Tt and a crew set C, the routing layer constructs the per-shift assignment π^*_t and per-crew ordering σ^c*_t. This is the multi-objective extension of the capacitated vehicle routing problem with hard constraints.

7.1MILP Formulation

Let binary variable x_ic indicate that task i is assigned to crew c, and let y_ijc indicate that crew c travels from task i to task j. Let t_i denote the scheduled start time of task i, d_i its duration, [a_i, b_i] its allowable time window, and T_c the shift duration of crew c. The MILP is

The objective trades realized score against routing cost ρ_ij (travel time and fuel) and an explicit unassignment penalty γ_i for high-value tasks left undispatched. Qualification constraints encode that crew c must hold the operator qualification (q_ic = 1) for task i; shift-duration constraints encode the realistic envelope; time-window constraints encode regulatory inspection windows, lone-worker restrictions, and customer-coordination windows. The safety/regulatory constraint set g_h(·) ≤ 0 encodes hot-work permits, gas-test currency, JSA completion, isolation states, and basin-specific rules (e.g., setback constraints, capture targets, OCC seismicity protocols).

7.2Adaptive Large Neighborhood Search

Solving (11) to optimality is intractable at industrial scale (|T_t| ~ 200 to 600, |C| ~ 10 to 40, with re-optimization required every 15 to 30 minutes). We adopt Adaptive Large Neighborhood Search (Ropke & Pisinger, 2006) with a portfolio of destroy and repair operators. The high-level algorithm is summarized in Algorithm 3.

Destroy and repair operators. The destroy portfolio includes (i) random removal, (ii) worst removal (remove tasks contributing least to objective per unit time), (iii) related removal (Shaw removal, removing geographically related tasks), and (iv) cluster removal (removing whole crew sub-tours). The repair portfolio includes (i) greedy insertion, (ii) regret-k insertion, and (iii) best-position insertion respecting all hard constraints. Operator weights are updated adaptively via the reaction parameter β ∈ [0, 1]: w^(k+1) = (1 − β)w^(k) + β · π^(k)_score, with π_score a function of recent operator-induced improvement.

Warm-starting and re-optimization. Re-optimization mid-shift (triggered by newly emerged high-score tasks, completion telemetry, or constraint changes) warm-starts from the current solution, allowing meaningful convergence within seconds. The ALNS framework is well suited to this because the destroy-repair operators can target the parts of the solution affected by the new information.

Empirical performance. On benchmark instances drawn from a 200-well, 15-crew Permian deployment, ALNS achieves within 2% of the MILP optimum (computed offline via branch-and-cut on a 4-hour wall budget) in under 30 seconds of wall time with B = 30s.

7.3Multi-Objective Treatment

When operating leaders explicitly want to weight competing objectives (cash flow vs. deferred-production reduction vs. asset reliability), we use the weighted-sum scalarization

with Σ_k α_k = 1, α_k ≥ 0. The weights are calibrated from explicit operator-leader preferences and refined via the learning loop.

8Closed-Loop Learning

The learning operator L updates the scoring-function parameters in response to realized outcomes. This is the component that distinguishes the framework from static rule-based EBS systems and is the principal source of compounding accuracy.

8.1Contextual Bandit Formulation

We treat the choice of scoring-weight vector θ_t ∈ ℝ^d_θ as an action in a contextual bandit problem. The context c_t is a feature representation of the per-shift queue (queue size, exception types, basin, weather, price regime, crew composition). The reward R_t(c_t, θ_t) is the realized cash-flow value of the shift (net of costs), observed after execution. We assume linear reward structure

where φ(·) is a feature map and β^* is an unknown parameter vector estimated online.

8.2LinUCB-Style Online Update

We use a regularized least-squares estimator with confidence bound (Li et al., 2010; Abbasi-Yadkori et al., 2011). Let A_t = λ_rI + Σ^t−1_s=1 φ_sφ^⊤_s and b_t = Σ^t−1_s=1 φ_sR_s. The online estimate is β̂_t = A⁻¹_tb_t. At shift t + 1, the chosen weight is

where the second term is the uncertainty bonus driving exploration. The exploration coefficient α_t = √½ log(2T/δ) provides anytime regret Õ(d_θ√T) at confidence 1 − δ (Abbasi-Yadkori et al., 2011).

8.3Convergence Properties

The closed-loop dynamic over scoring weights is a stochastic approximation. Under standard conditions, the scoring-prediction error has a contraction property:

The proof follows the standard self-normalized martingale argument of Abbasi-Yadkori et al. (2011); we omit the algebra. The operational interpretation: scoring-prediction accuracy improves at rate 1/√T in the number of completed shifts, with the constant determined by the feature dimensionality, the reward noise, and the regularization.

8.4Concept-Drift Detection

Operational reality is non-stationary: well behavior changes with age, equipment, weather, and commodity-price regime. A static bandit will degrade under drift. We monitor the standardized residual stream

and apply a one-sided CUSUM test (Page, 1954):

with reference value k and alarm threshold h. When G_t > h, we declare drift and trigger one of (a) sliding-window re-estimation of β̂ over the last W shifts, or (b) full hyperparameter re-validation if drift persists. See Gama et al. (2014) for a survey of alternative drift-detection methods.

9Data Quality and Sensor Validation

The detection and scoring layers are only as good as the SCADA data they consume. A non-trivial share (commonly 5 to 15% in production fields) of incoming readings exhibit sensor drift, communication errors, or stale-data artifacts. The data-quality agent treats raw SCADA as a noisy observation of a latent process state and applies robust state-estimation.

9.1State-Space Model

For each sensor channel, we model the latent true value x_t and observed reading y_t as

with process noise w_t ~ N(0, Q) and observation noise v_t ~ N(0, R). The standard Kalman filter (Kalman, 1960) provides recursive estimates of the posterior mean x̂_t|t and covariance P_t|t:

9.2Outlier Robustness

Pure Kalman filtering breaks down under sensor outliers (spikes from communication faults, recalibration events). We adopt a Huberized update in which the innovation ν_t = y_t − Hx̂_t|t−1 is passed through

with S_t = HP_t|t−1H^⊤ + R and Huber constant c ≈ 1.345 (the classical 95%-efficiency choice). When |ν_t| > c_flag√S_t with c_flag > c, the reading is flagged as anomalous and routed for human inspection before it can propagate into scoring.

9.3Drift Detection

In addition to spike detection, the data-quality agent monitors slow drift via a CUSUM on standardized innovations (parallel to Algorithm 4). When drift on a sensor channel exceeds a threshold, the agent recommends a calibration intervention and downweights that channel's influence in scoring until intervention is completed.

10Multi-Source Observation Fusion

Detection and scoring are only as good as the state estimate they consume. In real upstream operations, the latent state of a well, tank, or pad is observed by a heterogeneous mixture of sources with very different cadences, fidelities, and failure modes. A single tank, for example, is simultaneously instrumented by some subset of:

• SCADA tank-level transmitters (radar, ultrasonic, or differential-pressure), at minute-to-hourly cadence, accurate to ~1 to 3% of span when calibrated but prone to drift, stuck values, and freeze-off;
• Human gauges taken by the pumper on a route frequency (typically daily, sometimes every two-to-three days, sometimes by-exception), accurate to ~1/4 inch on a strapping chart with a non-zero operator bias;
• Run tickets and haul tickets, an effectively exact volume reading at a discrete event time (oil sale, water haul, condensate sale) with the ticket arriving asynchronously into the data layer;
• Gas-meter-derived production inference, in which metered gas at the separator or sales meter is converted to oil and water volumes via a calibrated gas-oil-ratio (GOR) and water-cut estimate and aggregated to a tank-level inflow forecast;
• Pump runtimes and well-test allocation, in which downhole pump-displacement times runtime, scaled by well-test-derived efficiency, provides an independent inflow estimate per well in the tank's allocation network.

No single source is sufficient. The SCADA transmitter drifts, the gauge is read once a day with bias, the ticket arrives hours late, the gas-derived estimate inherits all of the uncertainty in the GOR model, and the runtime estimate is only as good as the most recent well test. Together, however, they overdetermine the state, and the framework's job is to fuse them into a single calibrated posterior over the latent quantity of interest (tank level, well rate, line pressure) with an honest uncertainty bound.

10.1Heterogeneous Observation Models

Let x_t ∈ ℝⁿ denote the latent state of an asset at time t. For a tank, x_t is the true total liquid level (or the partitioned oil/water levels under emulsion modeling); for a well, x_t is the instantaneous oil, gas, and water rate vector; for a flowline, x_t is the line pressure and average density. We have M observation sources, each with its own observation map h^(m) and noise model:

where u_t are exogenous inputs (temperature, pressure, separator settings), μ^(m)_v is the per-source bias, and R^(m)_t is the per-source noise covariance, which is itself time-varying and conditioned on operating regime. The observation is not necessarily available at every t; we denote by M_t ⊆ {1, ..., M} the set of sources that produced an observation at time t.

Source-specific instances of (22). Concrete realizations for the tank-level example:

• SCADA transmitter (m = 1): h⁽¹⁾(x_t) = x_t + b^(t)₁ with bias b^(t)₁ evolving via a slow random walk; R⁽¹⁾ small under nominal operation and dilated when drift is suspected.
• Pumper gauge (m = 2): h⁽²⁾(x_t) = x_t + b₂ with a per-pumper bias b₂ learned from history; R⁽²⁾ on the order of (1/4 inch)² per the strapping-chart resolution.
• Haul ticket (m = 3): a delta observation, h⁽³⁾(x_t−) − h⁽³⁾(x_t+) = q_ticket, where t− and t+ bracket the load event and q_ticket is the metered volume hauled; R⁽³⁾ is small (truck meters are well calibrated) but the load-event timestamp may be uncertain by ~30 minutes.
• Gas-derived inference (m = 4): h⁽⁴⁾(x_t) = ∫_t0^t Q_g(τ)/GOR(τ) dτ − (hauled to date), where Q_g is metered gas rate and GOR is a Bayesian-updated GOR estimate; R⁽⁴⁾ inherits the GOR posterior variance and is therefore much larger than R⁽¹⁾ or R⁽²⁾.
• Pump-runtime allocation (m = 5): h⁽⁵⁾(x_t) = Σ_w η_w · runtime_w(t) summed over the wells in the allocation network, with per-well efficiency η_w from the most recent well test.

10.2Information-Filter Fusion

The natural Bayesian fusion form for asynchronous, heterogeneous Gaussian observations is the information filter (the information-form dual of the Kalman filter). Let Ω_t|t = P⁻¹_t|t and ξ_t|t = Ω_t|tx̂_t|t denote the information matrix and information vector. Each observation source contributes additively in information space:

where H^(m) is the Jacobian of h^(m) linearized around the predicted state (for linear h, H^(m) is just the observation matrix). The estimate and covariance are recovered as x̂_t|t = Ω⁻¹_t|tξ_t|t, P_t|t = Ω⁻¹_t|t.

Why the information form. The information-filter representation is the right primitive for multi-source fusion for three reasons. First, sources combine additively in information space, so adding or removing a source is a single matrix add or subtract, with no re-derivation of gain matrices. Second, a source that is uninformative about a particular state component (e.g., the gas-derived inference is uninformative about an emulsion split) contributes a rank-deficient matrix whose information is naturally zero in the relevant subspace, with no special-case logic required. Third, asynchronous arrival is handled by simply summing the contributions of whichever sources produced an observation in the current update window.

10.3Material-Balance-Constrained Dynamics

The latent state is not free to evolve arbitrarily: physical conservation laws constrain it. The tank-level case is the cleanest example. Letting L_t denote total liquid level (height × strap-area) at time t, mass balance requires

where q_in(τ) is the instantaneous inflow rate, q_out(τ) the outflow (truck loading), and w_t a small process-noise term capturing evaporation, instrument bias drift, and any unmodeled losses. Both q_in and q_out are themselves partially observed via the same fusion machinery: q_in from gas-derived inference plus pump-runtime allocation, q_out from ticket events. The constraint (25) couples the level estimate to the flow estimates, so a tank that appears to be losing volume faster than the metered outflow indicates is automatically suspect.

Joint-state fusion. We augment x_t to include both the level L_t and the instantaneous flow rates {q_in, q_out}; (25) becomes a linear dynamic in the joint state. The information filter of Section 10.2 then propagates the joint posterior. The off-diagonal of Ω_t|t captures the constraint-induced correlation: a measurement that informs L_t also informs the unobserved component of the flow, because the constraint says they must reconcile.

10.4Disagreement Detection

The most operationally consequential property of multi-source fusion is that sources can be tested against each other. For each source m at time t, the innovation is

Under the null hypothesis that all sources are calibrated and the model is correct, ν^(m)_t ~ N(0, S^(m)_t) and the Mahalanobis statistic

is χ²-distributed with degrees of freedom equal to the dimension of the observation. A large value of T^(m)_t flags that source m disagrees with the fused state estimate beyond what is jointly compatible.

The interpretation of a disagreement is operationally rich:

• One source disagrees with the rest: that source is likely drifting (sensor calibration), biased (operator), stuck (RTU), or has had a process change (recalibration, equipment swap). The fix is a calibration intervention; the source is downweighted in scoring until calibrated.
• All sources mutually disagree with the model: the dynamics model is misspecified, typically a leak (negative material-balance residual exceeding ticketed outflows), theft (negative residual that co-occurs with a vehicle-presence signal), or an unmodeled commingling event.
• Two sources agree against a third: the third is the outlier with high probability. Bayes-optimal updating downweights the third source's contribution until intervention.

In all three cases the disagreement is itself a high-priority signal that enters the scoring queue, with the dollar impact estimated from the magnitude and persistence of the discrepancy. A tank whose fused level estimate disagrees with the SCADA reading by more than two posterior standard deviations for three consecutive shifts is one of the most economically valuable tasks in the queue: it almost always indicates either a billable production loss (theft, leak, allocation error) or a calibration drift that is propagating into accounting.

10.5Fusion Algorithm

Algorithm 6 summarizes the asynchronous multi-source update. The algorithm is the workhorse that produces the calibrated state estimate consumed by detection (Section 5), scoring (Section 6), and the active-sensing layer (Section 11).

Complexity. The fusion update is O( Σ_m d²_m · n + n³ ) per shift, where d_m is the observation dimension of source m and n is the latent-state dimension. For a tank with n = 3 (level, inflow, outflow) and five sources of unit observation dimension, the total is negligible. For an entire field with n ~ 10³ to 10⁴ latent states (every well, every tank, every flowline), we exploit sparsity in Ω (the conservation graph is locally connected) and use sparse-Cholesky updates, bringing the per-shift cost into the seconds range on commodity hardware.

Operational consequence. The fused state estimate, together with the per-source consistency flags and the discrepancy tasks, are the inputs to the scoring layer of Section 6. The discrepancy tasks D_t enter the priority queue with their own dollar-impact estimate; they often outrank conventional production-deferment tasks because their downside is unbounded (silent loss, theft, mis-allocation). This is the architectural reason that an operator running on partial SCADA, or no SCADA at all, can still realize most of the value of the framework: the fusion layer reconstructs a calibrated state estimate from whatever sources are present, and the disagreement-detection layer surfaces problems that no individual source could detect on its own.

11Oilfield Sudoku: Active Sensing and Value of Information

The framework so far is reactive: it consumes whatever observations arrive and produces the best state estimate possible. The next layer is active: the system decides what to observe next, based on which observations would most reduce the uncertainty of decisions that matter. This is the analog of the choice a Sudoku solver faces when several cells admit multiple candidates: not every cell is equally valuable to resolve.

11.1The Sudoku Analogy, Formally

Consider the operational state as a large lattice of partially observed cells. Each cell corresponds to a state component of interest: a tank level, a well's instantaneous rate, a compressor's discharge pressure, an emission point's instantaneous methane rate, a meter's calibration offset. The cells are connected by physical-conservation and process-physics constraints: a tank's level must equal cumulative inflow minus cumulative outflow; the sum of allocated well rates must match the metered group total; the gas-oil ratio of a well must lie in a known band conditional on reservoir state; the upstream pressure of a compressor must exceed its discharge. These constraints play the role of the row, column, and box rules of Sudoku.

The job of the inference layer is to compute π_t. The job of the active-sensing layer is to decide, given π_t, which observation to make next.

11.2Bounded-Uncertainty Targeting

The simplest active-sensing rule is also the most operationally useful: flag any cell whose posterior uncertainty exceeds a configured bound. Let σ^(t)_i = √Var[x⁽ⁱ⁾_t | O_t, C_t] be the marginal posterior standard deviation of cell i. Given a per-cell bound σ̄_i, the set of flagged cells is

The bound σ̄_i is set from the downstream decision the cell informs. For a tank level whose uncertainty drives a hauling-trigger decision, σ̄_i might be a fraction of the hauling-trigger threshold. For a methane emission rate whose uncertainty drives regulatory-compliance reporting, σ̄_i might be a fraction of the reporting threshold. For an allocated well rate whose uncertainty drives royalty accounting, σ̄_i might be set so that the accounting error stays within materiality.

Each flagged cell becomes a candidate measurement task: "send a pumper to manually gauge tank T-401," "schedule a well test on well W-227," "calibrate the gas meter at site G-12," "run a multi-rate pressure transient on well W-309."

11.3Information Gain and Value of Information

A measurement task is not free: it costs windshield time, equipment, and (often) production deferment. The active-sensing layer therefore ranks candidate measurements by their value of information: the expected reduction in downstream decision regret per unit of measurement cost.

Information gain. The classical information-theoretic measure of a candidate measurement y^(m*) is the expected reduction in posterior entropy:

For Gaussian posteriors, (29) reduces to a closed form in terms of the determinant of the posterior covariance before and after the candidate observation:

The information form makes (30) cheap to evaluate: adding source m^* to the information matrix is the rank-d_m* update of Section 10.2, and the determinant of the post-update covariance is computable via the matrix-determinant lemma.

Value of information. Information gain is the right metric only when every state component matters equally. In practice, some cells inform high-value decisions and some inform low-value decisions. The decision-theoretic generalization is the value of information: the expected reduction in decision regret obtained by acquiring the measurement. Formally, let a^*(π) denote the optimal action under posterior π, and let U(a, x) denote the utility of action a when the true state is x. The value of information of candidate measurement m^* is

where π_+m* is the updated posterior after observing m^* and c(m^*) is the measurement cost. The first term is the expected utility of the best action under the post-measurement posterior, the second is the expected utility under the current posterior, and the difference is what the measurement is operationally worth.

Sufficient conditions for VoI-positive measurements. A useful operational corollary: when the optimal action does not change across plausible realizations of y^(m*), VoI(m^*) − c(m^*) ≤ 0 and the measurement is not worth its cost. This is the formal version of the intuition that you do not gauge a tank whose level is well below the hauling trigger; the decision (do not haul) does not change with the measurement, so the measurement has no operational value.

11.4Generating the Measurement Queue

Algorithm 7 generates the measurement-task queue. The output is a set of ranked measurement tasks that enter the routing solver of Section 7 on the same queue as production-driven tasks. The Sudoku-style framing is operationally consequential: measurement work competes for crew-day allocation with production work, on the same dollar substrate. A pumper may be dispatched to gauge a tank because the value of resolving the tank's uncertainty exceeds the value of the next production task in the queue, and the system's job is to make that comparison transparently.

11.5Closing the Loop: Measurement Outcomes Refine Future Priorities

The acquired measurement updates the posterior via the fusion machinery of Section 10; the updated posterior changes the set of flagged cells, the next round of candidate measurements, and the relative ranking of production work. The active-sensing layer is therefore not a one-shot procedure but a continuous co-optimization: at every shift, the system jointly schedules production work to capture cash flow that is already certain enough to act on and measurement work to resolve uncertainty about cells whose resolution is operationally valuable. This is, in the limit, the operational analog of solving Sudoku: every shift the system fills in a few more cells, narrows the candidate sets for cells that remain, and re-evaluates which empty cells are now worth resolving.

11.6Two Worked Examples

Tank-level reconciliation. A tank with conflicting sources: SCADA reads 8.4 ft, last pumper gauge (two days ago) read 8.9 ft, gas-derived inference projects 9.1 ft, ticket history is consistent with no recent haul. The fused estimate is L̂ = 8.7 ft with σ = 0.35 ft, and the chi-square test flags the SCADA innovation as marginally inconsistent (T⁽¹⁾ = 6.8, τ_warn = 5.99 for χ²₁ at 1.5%). The bound for this tank is σ̄ = 0.2 ft (set from the hauling-trigger materiality), so the cell is flagged. The candidate measurements are: (a) a pumper visit with manual gauge, cost c = $80 in windshield time, VoI ≈ $1,200 (it resolves the tank-level uncertainty and identifies whether the SCADA is drifting); (b) a SCADA-transmitter calibration, cost c = $450, VoI ≈ $1,500 (it also reduces future uncertainty); (c) wait one shift for a new ticket event, cost c ≈ $0, VoI ≈ $200 (a ticket event may or may not arrive). The system schedules option (a) in the next routable window; option (b) is queued for the following day if the gauge confirms drift.

Well rate during a price-spike regime. A high-rate well's most recent well test was 28 days ago; the allocated rate is 410 BOPD with posterior σ = 60 BOPD. The price strip has lifted from $72 to $84/bbl since the last well test, magnifying the dollar value of resolving the uncertainty. The bound for this well is σ̄ = 25 BOPD, set from royalty materiality. The cell is flagged. The candidate measurement is a four-hour separated well test, cost c ≈ $2,500 in deferred production and crew time; the VoI evaluation under the post-measurement posterior accounts for the next-quarter accounting impact and the operational value of recalibrated allocation, returning VoI ≈ $11,400. The well-test task is added to the queue and routes naturally onto the next compatible shift.

Operational consequence. In both examples, the measurement task competes for crew-day allocation against production tasks on the same dollar substrate. This is the architectural property that operationally distinguishes the framework: the system does not separate "operations" from "measurement and surveillance". They are the same loop, ranked on the same queue, optimized against the same utility function.

12Confidence-Aware Honest Handoff

The execution layer is responsible for delivering the ranked plan to field crews and for recognizing when the system's own confidence is too low to recommend a fully autonomous decision. We refer to this as honest handoff: the system should escalate to a human when, and only when, the marginal value of human judgment exceeds the cost of human interruption.

12.1Confidence Estimation

For each scored task i, the scoring algorithm (Section 6) returns both a point estimate S_i and an uncertainty σ̂_Si. We define a confidence score

which is high when the uncertainty is small relative to the estimate and low when the estimate is statistically indistinguishable from zero or from neighboring scores.

12.2Handoff Policy

The handoff policy is a function π_h : (S_i, σ̂_Si, c_t) → {auto, human} that maps the scoring output and context to either autonomous dispatch or human escalation. The policy is implemented as a threshold rule with context-dependent thresholds:

High-confidence and below-threshold-value decisions are auto-executed. Low-confidence decisions are escalated. Critically, very-high-value decisions are also escalated (the second clause), reflecting the operational reality that high-stakes interventions should pass under a human eye regardless of model confidence.

12.3In-Cab Copilot

The execution layer also provides an in-cab natural-language interface. A pumper can interrogate the plan, the well's history, the relevant SOP, the regulatory window, or the escalation path via voice or text. The copilot is grounded in the operator's data via retrieval-augmented generation; it does not extrapolate beyond the plan that the scoring and routing layers produced. The copilot's role is to make the ranked plan legible to the field, not to make autonomous dispatch decisions.

13Empirical Results

13.1Deployment Context

The reference deployment is a top 25 private upstream producer operating 5,000+ wells across the Western Anadarko, Permian, and Wyoming basins. A complementary deployment is a western gas-distribution utility. Both deployments use the same architectural framework. Results below are aggregate across these deployments unless otherwise noted.

13.2Headline Outcomes

Table 2 summarizes the headline operational outcomes at 12 months post-deployment, measured against pre-deployment baselines on the same well count and the same crew composition. All figures in the table are deployment figures from these reference deployments.

13.3Decomposition

To attribute outcomes to subsystems, we ran a sequence of ablation deployments at a single basin. The marginal contribution of each subsystem to the 15% FCF uplift was approximately:

• Replacing static thresholds with per-asset Arps-based detection (Section 5): +3.5 percentage points.
• Adding economic scoring (Section 6): +6.0 percentage points.
• Adding constraint-aware routing (Section 7): +3.0 percentage points.
• Adding closed-loop learning (Section 8): +1.5 percentage points by 12 months; trending higher with deployment maturity.
• Data-quality agents (Section 9): +1.0 percentage point and an ~80% reduction in false-positive scoring.

The dominant contributor is economic scoring. This is consistent with the theoretical argument in Section 3: the gap between EBS and Pump by Priority is principally the addition of a calibrated value substrate.

13.4Comparison to EBS Baseline

Table 3 summarizes the structural comparison between classical EBS and the proposed framework. The comparison is architectural, not benchmark-by-benchmark, because the operating loop differs by design.

14Discussion

14.1When Does the Framework Dominate EBS?

The framework dominates classical EBS in expected dollar terms whenever the variance in per-task value across the candidate task set is large relative to the noise in the value estimates. Concretely, if Var_i∈Tt[V_i] ≫ E_i[σ̂²_Si], then prioritization by score captures most of the available value gap.

In low-variance operations (small fields with homogeneous wells, where every task is roughly equally valuable), the framework converges to EBS performance, with the additional cost of the AI infrastructure. The practical rule is that fields with ≥ 200 wells and > 10× spread in per-well production rates are firmly in the regime where Pump by Priority dominates.

14.2The Three Failure Modes of Industrial AI Adoption

In Section 2 we noted three structural failure modes for industrial-AI adoption:

1. The Era-3 trap. Deploying isolated AI use cases (anomaly detection on a tank battery, a document copilot, a domain LLM) without changing the work loop. The use cases work in isolation; the morning routine is unchanged. The diagnostic is whether the foreman's morning workflow changed.
2. The build-it-yourself trap. Standing up an internal data-engineering team to build the loop from data-platform primitives and custom UI. The initial build is seven figures and the maintenance is seven figures per year; the model degrades by month nine because no team is doing drift detection. Pump by Priority requires the six elements of QA discipline (constraint enforcement, confidence-aware routing, drift detection, outcome feedback, audit trail, honest handoff). Building those six elements is what AI-product vendors do for a living.
3. The string-tools-together trap. Duct-taping a CMMS, routing tool, chat AI, EHS platform, and SCADA dashboard. None of these tools was designed for closed-loop ranked work execution. Integrations are brittle, the pumper opens five apps in the truck cab, and dashboard theater results.

The honest architectural claim is that priority-driven operations cannot be retrofitted onto a CMMS, a routing tool, or a SCADA dashboard. The QA discipline, the closed loop, and the data-layer-up design are not features that can be added to a system designed for something else.

14.3Organizational Implications

The framework reshapes the operating organization. The foreman moves from dispatcher to approver, spending the majority of the morning reviewing exceptions the system flagged rather than building the day's plan. The superintendent calibrates scoring weights on a weekly cadence rather than building the next week's plan. The VP Operations observes plan-versus-actual on a single command view rather than waiting for a month-end deck. Crews leave the yard knowing not only what to do but why each task is on the ranked queue (the in-cab copilot makes the rationale legible). The well-to-operator ratio plausibly reaches 60:1 or higher in mature implementations, an essential structural response to the documented aging-workforce trend (Bureau of Labor Statistics, 2025).

15Limitations and Threats to Validity

Decline-curve model misspecification. The Arps model in Section 5.1 is a parametric prior that fits the bulk of conventional and unconventional production behavior well, but it is misspecified for wells with strong transient effects (flowback, multi-flush behavior in tight reservoirs, infill-related interference). We mitigate by adopting a mixture of parametric forms (exponential, hyperbolic, harmonic) with a switching prior, but the model is not guaranteed to fit every well.

Linear-reward assumption. The contextual-bandit analysis in Section 8 assumes a linear reward structure in (c_t, θ_t). Real reward surfaces are non-linear; the linear approximation is acceptable in a neighborhood of the operating point but can drift under regime change. The CUSUM drift detector mitigates this in the limit, but the regret bound in Theorem 8.1 should be read as asymptotic in stable regimes, not as a finite-sample guarantee under arbitrary non-stationarity.

Out-of-distribution operating regimes. The system is trained on historical operating regimes. A novel regime (a sudden price collapse, a regulatory regime change such as a new methane-capture mandate, an unprecedented weather event) will be out-of-distribution. The honest-handoff policy is the primary guard against silent over-confidence in this case, but the residual risk is non-zero.

Data-quality dependencies. The framework requires meaningful SCADA coverage to realize the full ablation contribution from Section 13; that said, the statistical-physics-based scoring can run on partial-SCADA operations using manual gauges, run tickets, lease files, and production accounting. We have validated the framework on operations ranging from full-SCADA to nearly-no-SCADA; the model's accuracy bands widen but the loop remains structurally sound.

Generalizability. The empirical results in Section 13 are from two deployments. Generalizability across operator type (private vs. public), basin geology, and operating philosophy is a matter of continued empirical validation. The framework itself is operator-agnostic by design; the calibration is operator-specific.

16Future Work

Several directions extend the framework. (i) Multi-agent operational systems: extending the single-loop architecture to a coordinated multi-agent system in which specialized agents (anomaly detection, scoring, routing, regulatory compliance, predictive maintenance) operate as a team with structured inter-agent communication and a supervisory layer. (ii) Cross-operator federated learning: anonymized operational patterns shared across operators via federated training, expanding the effective training set without disclosing operator-specific data. (iii) Self-structuring scoring models: continual-learning techniques that adapt the scoring function's feature representation in addition to its weights, in response to long-horizon drift. (iv) Reservoir-aware routing: integration of pressure-transient and material-balance signals into the routing constraint set, enabling joint optimization of field-execution and reservoir-management decisions. (v) Formal verification of safety constraints: adopting model-checking and runtime-monitoring techniques from formal-methods research to certify that the hard-constraint set H_t is never violated, even under adversarial drift or out-of-distribution inputs.

17Conclusion

This paper formalized Pump by Priority as a closed-loop stochastic optimization problem and presented the mathematical formulations and algorithms required to implement it at industrial scale. The framework comprises six interlocking subsystems (per-asset anomaly detection against Bayesian-updated decline-curve priors, risk-adjusted economic value estimation, constraint-aware ALNS routing, contextual-bandit closed-loop learning, robust Kalman-based sensor validation, and confidence-aware honest handoff), each with explicit pseudocode and complexity characterization. We characterized the operating regime in which the framework dominates classical Exception-Based Surveillance, derived a regret bound on closed-loop learning, and presented field-validated benchmarks from a 5,000-plus-well production deployment, measured against pre-deployment baselines: 15% free-cash-flow uplift on the same crew, 35% fewer miles driven, and TRIR from 1.8 to 0.3. The framework is vendor-neutral; the reference implementation is the WorkSync platform. The conceptual contribution is the recognition that the gap between EBS and the next operating model is not a better alarm engine but a calibrated economic substrate, a constrained-optimization routing layer, and a closed-loop learning mechanism that together transform an alarm list into a decision system.

Acknowledgments

The authors thank the operating leadership and field crews of the reference deployments for the access, calibration partnership, and outcome data that made empirical validation possible. The frame of reference for exception-based management owes a debt to the operational economics work of Alvarez & Marsal (Alvarez & Marsal, 2015) and to the mobile-delivery product generation that operationalized pump by exception in the field.

Appendix A Notation Summary

Appendix B Extended Empirical Results

B.1Convergence of the Online Learner

Figure 2 shows a schematic of the empirical regret of the LinUCB-based online learner over the first 180 shifts of deployment at the reference site. The empirical curve closely tracks the theoretical Õ(√T) bound from Theorem 8.1; observed CUSUM-triggered re-estimation events (typically 1 to 3 per quarter) introduce small, transient regret spikes followed by recovery.

B.2Per-Subsystem Ablation Detail

The decomposition in Section 13 was computed via a sequence of A/B deployments on subsets of the reference field. The ablation budget was 6 weeks per subsystem, with a 1-week stabilization period before measurement. We report the median across A/B-period replicates; the standard error bars (omitted from the main text for compactness) are typically 0.5 to 1.0 percentage points.

B.3Sensitivity of Scoring to Price Regime

The Monte-Carlo scoring of Algorithm 2 integrates over price-scenario uncertainty. We have run sensitivity analyses across price regimes ranging from $45 to $95/bbl WTI. The relative ranking of high-impact vs. low-impact tasks is robust across this range; the absolute score values scale approximately linearly with the price level. This implies that the framework's prioritization is robust to price-regime shifts, although the realized dollar uplift is naturally a function of the prevailing price level.