Well Integrity Annulus Pressure, MAASP Thresholds, and Two-Barrier Envelope Registers: Governing Sustained Casing Pressure and Handover Holds

Topics: well barrier annulus pressure software, oil and gas asset integrity, upstream oil and gas software.

Upstream production and well-engineering teams ask a critical operational question: How should upstream operators structure software registers for sustained casing pressure (SCP), Maximum Allowable Annulus Surface Pressure (MAASP) thresholds, and two-barrier envelope verification? Distinct from daily drilling activity reporting (O001) and topside static pressure-vessel mechanical integrity (O101), this workflow governs the subsurface-to-wellhead barrier register across producing, injecting, and suspended wells. It links each casing annulus (A, B, C, and conductor/outer strings) to its calculated and wall-loss-derated MAASP, evaluates bleed-down and build-up recovery curves to diagnose micro-annulus or tubing-connection leaks, and enforces formal digital handover holds between Production Operations and Well Intervention / Workover teams.

When annulus pressures are recorded on standalone SCADA historian tags without an underlying barrier data model, three systemic failures occur:

1. Unlinked MAASP derating: A wireline multi-finger caliper or ultrasonic casing log identifies $12%$ internal/external wall loss on the $9\text{-}5/8\text{ in.}$ production casing, or a wellhead seal assembly is downgraded, but the control-room high-pressure alarm remains set to the original new-build design MAASP.
2. Undifferentiated thermal vs sustained pressure: Field operators routinely bleed off annulus pressure after well start-up without recording the bled gas/liquid volume or the $24\text{-hour}$ pressure recovery slope, masking a failing production packer or tubing hanger seal until gas migrates into an outer casing string close to the surface shoe fracture gradient.
3. Broken two-barrier handovers: A slickline or coiled-tubing crew rigging up on a well discovers only at the wellsite that the Surface Controlled Subsurface Safety Valve (SCSSV) is on a temporary leak-rate dispensation while the B-annulus is operating at $78%$ of MAASP—leaving the crew without two independent tested barriers.

Scope and well-integrity engineering boundary

A well-integrity software register is an engineering surveillance, barrier-status ledger, and operational handover control system; it is not an autonomous well-control controller, a downhole pressure simulator replacement, or a substitute for statutory well-examiner signoff.

• Qualified Well Integrity Authority boundary: MAASP threshold formulas, casing burst/collapse derating factors, formation shoe fracture margins, acceptable bleed-down frequencies, and barrier element acceptance criteria (such as API RP 14B / ISO 10417 SCSSV leak rates) must be calculated, reviewed, and signed off by a qualified Senior Well Integrity Engineer and, where required by jurisdiction, an Independent Well Examiner.
• No autonomous valve actuation or dispensation invention: The software must never automatically actuate Christmas tree master/wing valves, bleed annuli through automated choke solenoids without operator permit control, or auto-grant barrier dispensations when a primary or secondary barrier element fails verification.
• Strict adherence to international standards: Data structures must align with API RP 90-1 (Annular Casing Pressure Management for Offshore Wells), API RP 90-2 (Annular Casing Pressure Management for Onshore Wells), ISO 16530-1 (Well Integrity — Life Cycle Governance), and NORSOK Standard D-010 (Well Integrity in Drilling and Well Operations).

1. Step 1 — Record intake & baseline identification: Upstream oil and gas operators frequently track A-, B-, and C-annulus pressures on disconnected offshore platform gauges or weekly field spreadsheets that fail to link live pressure readings to the weakest component in the **Well Barrier Envelope (WBE)** or the current **Maximum Allowable Annulus Surface Pressure (MAASP)**.
2. Step 2 — Cross-system reference & custody linkage: A governed well-integrity register separates benign **Thermal Casing Pressure (TCP)** from hazardous **Sustained Casing Pressure (SCP)** by logging standardized bleed-down and $24\text{-hour}$ pressure build-up tests, computing gas/liquid influx rates, and enforcing upper alarm ($50\%\text{ MAASP}$) and diagnostic action ($75\%\text{ MAASP}$) bands.
3. Step 3 — Exception quarantine & authority check: Every well must maintain an explicit **Well Barrier Schematic (WBS)** under NORSOK D-010 and ISO 16530-1 / API RP 90-1/90-2 showing independent **Primary** and **Secondary** barrier envelopes; when any barrier element fails a leak-rate or pressure-integrity test, the register automatically blocks production-to-intervention handovers until a qualified Well Integrity Engineer signs off.
4. Step 4 — Verified disposition & audit trail closure: Software tracks telemetry, bleed/build-up curves, and handover interlocks, but never overrides downhole safety valves, never invents regulatory MAASP waivers, and leaves all barrier-envelope acceptance and fitness-for-service decisions to licensed Well Integrity Engineers.

Structuring the two-barrier envelope and MAASP data model

To prevent spreadsheet drift, the well-integrity software register must model three tightly coupled tables for every wellbore:

1. Component-level Well Barrier Schematic (WBS) register

Rather than treating a well as a single pass/fail asset, NORSOK D-010 and ISO 16530-1 require modeling each individual Well Barrier Element (WBE)—such as the reservoir caprock/cemented liner, production packer, completion tubing string, downhole SCSSV, production casing string, casing hanger seal assembly, and Christmas tree master/swab valves, and assigning each element to the Primary Barrier Envelope, the Secondary Barrier Envelope, or a shared common point. Each element carries its design differential pressure rating, installation depth, elastomer/metallurgy class (e.g., sour service $\text{H}_2\text{S}$ NACE MR0175/ISO 15156), test frequency, last verified leak rate, and current health state.

2. Multi-criterion MAASP calculation and derating ledger

For any given annulus $k$ (e.g., B-annulus between the $9\text{-}5/8\text{ in.}$ production casing and the $13\text{-}3/8\text{ in.}$ intermediate casing), the design surface pressure limit is governed by the minimum of four physical failure modes:

$$\text{MAASP}{\text{design},k} = \min\Big(\Delta P{\text{burst,outer}},; \Delta P_{\text{collapse,inner}},; \Delta P_{\text{wellhead,seal}},; \Delta P_{\text{frac,shoe}}\Big)$$

Where each term accounts for hydrostatic fluid gradients inside the annulus ($\rho_{\text{ann}}$) and in the adjacent inner/outer strings at the critical True Vertical Depth ($\text{TVD}$). Critically, when corrosion logs, sustained casing wear, or elevated-level temperature derate the outer casing burst or inner casing collapse resistance by a verified factor $f_{\text{derate}} \in (0, 1]$, the operational limit becomes:

$$\text{MAASP}{\text{op},k} = \text{MAASP}{\text{design},k} \times f_{\text{derate}}$$

Simultaneously, the register must enforce a Minimum Allowable Annulus Surface Pressure ($\text{MAASP}_{\text{min}}$) floor whenever high pressure in an outer annulus (such as B-annulus) could collapse the inner tubing or production casing if the inner annulus is bled down to $0\text{ psig}$.

3. Standardized bleed-down and $24\text{-hour}$ build-up test log

Under API RP 90-1/90-2, a single static pressure reading cannot distinguish thermal fluid expansion from a downhole barrier leak. When an annulus crosses its diagnostic threshold, the software issues a structured bleed-down work order requiring the field technician to:

• Bleed the annulus through a calibrated needle valve and portable gas/liquid meter over a bounded duration ($t_{\text{bleed}} \le 60\text{ min}$) without violating the minimum inner-string collapse floor.
• Record initial pressure $P_i$, final bled pressure $P_{\text{bled}}$, vented standard gas volume $V_{\text{std}}$, and recovered liquid volume $V_{\text{liq}}$ (plus fluid density and $\text{H}_2\text{S}/\text{CO}_2$ cut).
• Capture high-frequency pressure recovery over $24\text{ hours}$ ($P_{24}$). If the pressure remains flat near $P_{\text{bled}}$ while well thermal duty is steady, the excursion is logged as Thermal Casing Pressure (TCP). If the pressure rebounds toward $P_i$, the software calculates the recovery ratio $R_{24} = P_{24}/P_i$ and the equivalent downhole gas leak rate $q_{\text{sc}}$ to classify the severity of Sustained Casing Pressure (SCP).

• Primary control scope: well barrier annulus pressure software across maintenance and connected ERP/EAM records.
• Segregation boundary: Operational status updates never auto-close engineering, safety, or finance sign-off gates.
• Verification cadence: Reconcile open exceptions, overrides, and late adjustments at each shift or period close.

Illustrative worked example: B-annulus MAASP derating, SCP bleed/build-up diagnosis, and handover hold

All figures below are illustrative and synthetic. Consider an offshore gas-lifted production well (WELL-ALPHA-07) on a fixed platform with $4\text{-}1/2\text{ in.}$ production tubing inside $9\text{-}5/8\text{ in.}$ production casing (A-annulus, active gas-lift injection) and $9\text{-}5/8\text{ in.}$ casing inside $13\text{-}3/8\text{ in.}$ intermediate casing (B-annulus, nominally dead fluid column above cement top at $1,420\text{ m TVD}$, with the $13\text{-}3/8\text{ in.}$ shoe at $1,850\text{ m TVD}$).

Step 1: Operational MAASP and threshold band calculation for B-annulus

The platform Senior Well Integrity Engineer evaluates the four governing surface limits for the B-annulus:

1. $13\text{-}3/8\text{ in.}$ outer intermediate casing burst margin at surface/shallow depth (with $0.50\text{ safety factor}$): $\Delta P_{\text{burst,outer}} = 1,780.0\text{ psig}$.
2. $9\text{-}5/8\text{ in.}$ inner production casing collapse margin when A-annulus is depressurized for slickline work: $\Delta P_{\text{collapse,inner}} = 1,620.0\text{ psig}$.
3. Wellhead B-annulus secondary packoff seal rating: $\Delta P_{\text{wellhead,seal}} = 2,000.0\text{ psig}$.
4. $13\text{-}3/8\text{ in.}$ intermediate casing shoe fracture margin at $1,850\text{ m TVD}$ (assuming a gas-filled annulus gradient worst case per API RP 90-1): $\Delta P_{\text{frac,shoe}} = 1,450.0\text{ psig}$.

Thus, the new-build design MAASP for B-annulus is governed by the shoe fracture criterion:

$$\text{MAASP}_{\text{design,B}} = \min(1,780.0,; 1,620.0,; 2,000.0,; 1,450.0) = 1,450.0\text{ psig}; (100.0\text{ barg})$$

Following an ultrasonic casing inspection log that identified localized internal wear on the $13\text{-}3/8\text{ in.}$ string and cement bond degradation above the shoe, the Well Integrity Engineer enters a verified derating factor of $f_{\text{derate}} = 0.88$. The software updates the active operational limit and control bands:

$$\text{MAASP}_{\text{op,B}} = 1,450.0 \times 0.88 = 1,276.0\text{ psig}$$

$$\text{Upper Alarm Threshold } (50%\text{ MAASP}_{\text{op,B}}) = 0.50 \times 1,276.0 = 638.0\text{ psig}$$

$$\text{Diagnostic & Escalation Trigger } (75%\text{ MAASP}_{\text{op,B}}) = 0.75 \times 1,276.0 = 957.0\text{ psig}$$

Step 2: Bleed-down and $24\text{-hour}$ build-up test evaluation

Over a $14\text{-day}$ period, wireless pressure transmitters on the WELL-ALPHA-07 B-annulus record a climb from $180.0\text{ psig}$ to a stabilized plateau of $P_i = 780.0\text{ psig}$. Because $780.0\text{ psig}$ exceeds the $50%$ Upper Alarm Threshold ($638.0\text{ psig}$) at $61.13%$ of $\text{MAASP}_{\text{op,B}}$, the software triggers a mandatory API RP 90-1 Bleed-Down / Build-Up Diagnostic Work Order (WO-SCP-2026-114):

• The field technician connects a calibrated orifice/turbine bleed manifold and bleeds the B-annulus over $t_{\text{bleed}} = 45.0\text{ min}$ from $P_i = 780.0\text{ psig}$ down to a floor of $P_{\text{bled}} = 120.0\text{ psig}$ (avoiding complete depressurization to prevent shock-cooling or elastomer unseating).
• During the $45.0\text{-minute}$ bleed, the meter records $V_{\text{std}} = 14.85\text{ sm}^3$ of dry methane-rich gas ($\text{C}1 = 91.4%$, matching A-annulus lift-gas isotopic signature) and $V{\text{liq}} = 0.042\text{ m}^3$ ($42.0\text{ L}$) of completion brine.
• The needle valve is closed at $t = 0\text{ h}$ ($P_0 = 120.0\text{ psig}$). After $t_{\text{buildup}} = 24.0\text{ h}$, the B-annulus pressure climbs back to $P_{24} = 762.0\text{ psig}$.

The software computes the $24\text{-hour}$ pressure build-up $\Delta P_{\text{buildup}}$, recovery ratio $R_{24}$, and mean build-up slope $\dot{P}_{\text{avg}}$:

$$\Delta P_{\text{buildup}} = P_{24} - P_{\text{bled}} = 762.0 - 120.0 = 642.0\text{ psig}; (44.264\text{ bar})$$

$$R_{24} = \frac{P_{24}}{P_i} = \frac{762.0}{780.0} = 0.97692 \approx 97.69%$$

$$\dot{P}{\text{avg}} = \frac{\Delta P{\text{buildup}}}{t_{\text{buildup}}} = \frac{642.0\text{ psig}}{24.0\text{ h}} = 26.75\text{ psig/h}$$

Step 3: Equivalent gas leak rate into the B-annulus headspace

From the fluid level and bleed response, the gaseous headspace volume at the top of the B-annulus is determined to be $V_{\text{gas}} = 0.320\text{ m}^3$, at a mean wellhead/upper-annulus temperature $T_{\text{avg}} = 335.0\text{ K}$ ($61.85^\circ\text{C}$), standard temperature $T_{\text{sc}} = 288.15\text{ K}$ ($15.0^\circ\text{C}$), atmospheric pressure $P_{\text{atm}} = 14.696\text{ psia}$, and mean gas compressibility factor $Z = 0.91$. Using the real-gas accumulation relationship over the $24.0\text{-hour}$ build-up window:

$$q_{\text{sc}} = \frac{V_{\text{gas}} \cdot \Delta P_{\text{buildup}} \cdot T_{\text{sc}}}{P_{\text{atm}} \cdot Z \cdot T_{\text{avg}} \cdot t_{\text{buildup}}}$$

Substituting the exact values:

$$\text{Numerator} = 0.320 \times 642.0 \times 288.15 = 59,197.536\text{ m}^3\cdot\text{psi}\cdot\text{K}$$

$$\text{Denominator} = 14.696 \times 0.91 \times 335.0 \times 24.0 = 107,521.969\text{ psi}\cdot\text{K}\cdot\text{h}$$

$$q_{\text{sc}} = \frac{59,197.536}{107,521.969} = 0.55056\text{ sm}^3/\text{h}; \left(13.213\text{ sm}^3/\text{d}\text{ or } 9.176\text{ L/min std gas}\right)$$

Because the $9\text{-}5/8\text{ in.}$ production casing exhibits a confirmed $97.69%$ pressure recovery within $24\text{ hours}$ and an ongoing gas influx of $13.21\text{ sm}^3/\text{d}$ ($9,176\text{ cm}^3/\text{min}$ std gas, exceeding the API RP 90-1 / NORSOK D-010 $0.42\text{ sm}^3/\text{min}$ [$420,000\text{ cm}^3/\text{min}$] catastrophic blowby limit? No—note that $9.176\text{ L/min} = 0.00918\text{ sm}^3/\text{min}$ is below the $0.42\text{ sm}^3/\text{min}$ API RP 14B surface safety valve limit, confirming a persistent micro-leak through a $9\text{-}5/8\text{ in.}$ premium thread connection above the cement top that rapidly pressurizes the small $0.320\text{ m}^3$ liquid-packed B-annulus headspace toward $\text{MAASP}_{\text{op,B}}$).

Step 4: Two-barrier envelope status and handover interlock

On the WELL-ALPHA-07 Well Barrier Schematic, the $9\text{-}5/8\text{ in.}$ production casing is a shared element of the Secondary Barrier Envelope. The software transitions WELL-ALPHA-07 from Green (Two Intact Envelopes) to Orange (Single Barrier Degraded — Active SCP Management):

• A planned slickline zone-change handover (PTW-SLK-089) scheduled for the following week is automatically placed on integrity hold because rigging up slickline compromises the Christmas tree swab/wing barrier configuration while the secondary casing barrier has unmitigated SCP.
• The Well Integrity Engineer evaluates a rigless annular pressure-activated sealant squeeze ($₹42.50\text{ lakh}$ / $$51,200$) with a $30\text{-day}$ continuous bleed/pressure-regulating management dispensation versus deferring the slickline intervention until a full tubing/casing patch workover.

Independent arithmetic verification

• Derated MAASP and control bands: $1,450.0 \times 0.88 = 1,276.0\text{ psig}$; $1,276.0 \times 0.50 = 638.0\text{ psig}$; $1,276.0 \times 0.75 = 957.0\text{ psig}$. Initial utilization $= 780.0 / 1,276.0 = 0.611285 \approx 61.13%$.
• Build-up recovery and slope: $\Delta P_{\text{buildup}} = 762.0 - 120.0 = 642.0\text{ psig}$. Recovery ratio $= 762.0 / 780.0 = 0.976923 \approx 97.69%$. Mean slope $= 642.0 / 24.0 = 26.750\text{ psig/h}$.
• Gas influx rate check: Numerator $= 0.320 \times 642.0 \times 288.15 = 59,197.536$. Denominator $= 14.696 \times 0.91 \times 335.0 \times 24.0 = 107,521.9692$. Quotient $= 59,197.536 / 107,521.9692 = 0.550562\text{ sm}^3/\text{h}$. Daily rate $= 0.550562 \times 24 = 13.2135\text{ sm}^3/\text{d}$. Per-minute rate $= 550.562\text{ L} / 60\text{ min} = 9.176\text{ std L/min}$, independently verified.

Workflow, owner roles, exception handling and recovery controls

Bounded pilot and implementation check

Before rolling out a well-integrity and annulus pressure register across an entire field, verify four acceptance tests on a pilot pad or platform ($15\text{--}25\text{ wells}$):

• ACT-O104-01 (Four-mode MAASP & inner-collapse floor verification): Confirm that for $100%$ of pilot wells, each annulus (A, B, C) stores all four candidate pressure limits (outer burst, inner collapse, wellhead seal, shoe fracture), automatically selects the minimum as $\text{MAASP}{\text{design}}$, applies the engineer-approved corrosion derating factor $f{\text{derate}}$, and calculates the minimum inner-collapse bleed floor $\text{MAASP}_{\text{min}}$.
• ACT-O104-02 (TCP vs SCP bleed/build-up classification): Inject synthetic and historical bleed-down/build-up datasets; verify that the software rejects any bleed closure lacking metered gas/liquid volumes or a $24\text{-hour}$ recovery reading, and accurately computes the recovery ratio $R_{24}$ and gas influx rate $q_{\text{sc}}$.
• ACT-O104-03 (Two-barrier schematic inheritance): Simulate a failed SCSSV inflow test on a well that already has an active B-annulus SCP flag; confirm that the Well Barrier Schematic immediately transitions from Orange (single degraded barrier) to Red (two-barrier envelope breach) and notifies the Well Integrity Authority.
• ACT-O104-04 (Well intervention e-PTW handover block): Attempt to issue a slickline or coiled-tubing handover certificate on a well with an unapproved annulus pressure above $75%\text{ MAASP}_{\text{op}}$; verify that the register blocks permit issuance until a countersigned barrier restoration plan is attached.

Next actions

1. Audit current MAASP sheets against post-drilling logs: Extract existing spreadsheet MAASP values for the top $25$ high-rate or sour-service wells and reconcile them against the most recent caliper/ultrasonic wall-loss logs and actual fluid densities in the A-, B-, and C-annuli.
2. Standardize portable bleed-down metering kits: Equip field operators with calibrated digital pressure recorders and portable gas/liquid bleed meters so every annulus bleed event captures $P_i$, $P_{\text{bled}}$, $V_{\text{std}}$, $V_{\text{liq}}$, and $P_{24}$ rather than unmeasured atmospheric venting.
3. Map every wellbore to a digital two-barrier schematic: Configure Primary and Secondary Well Barrier Envelopes per NORSOK D-010 / ISO 16530-1 in the asset integrity database, linking every valve and casing string to its CMMS test work orders.
4. Couple the barrier register to the e-PTW / handover gate: Enforce an automated pre-job check requiring a Green WBS status—or a time-bounded dispensation signed by the Senior Well Integrity Engineer—before any well-intervention crew can accept handover of a well.

Frequently Asked Questions

How should upstream operators structure software registers for sustained casing pressure (SCP), Maximum Allowable Annulus Surface Pressure (MAASP) thresholds, and two-barrier envelope verification?

Teams should govern well barrier annulus pressure software by linking every transaction to its source evidence, timestamp, and assigned owner before permitting downstream posting. Distinct from O001 (drilling daily report) and O101 (topside static equipment AIM); O104 tracks wellhead/downhole barrier element test records, annulus bleed-down/build-up trends, and well-intervention handover holds while bounding engineering authority to qualified well-integrity engineers. Rather than relying on informal spreadsheet overrides, the workflow enforces a documented verification gate and preserves the original observation whenever a correction is recorded.

How does oil and gas asset integrity handle exceptions and mismatches?

When a discrepancy occurs during oil and gas asset integrity, the system routes the blocked record into an owned exception queue rather than silently dropping or auto-adjusting the balance. Assigned operational, quality, and finance owners must review and approve exceptions before posting. Each exception retains the original quantity, date, and counterparty reference until the designated reviewer resolves the variance with supporting evidence.

What should teams test before automating upstream oil and gas software?

Before scaling upstream oil and gas software, run a bounded pilot using historical records that include partial receipts, late updates, duplicate messages, and rejected lines. Verify that the integration preserves idempotency, maintains a clear segregation of duties between operational entry and financial approval, and produces an auditable trail for every state transition.

Summary and next actions

1. Map the current well barrier annulus pressure software record boundaries, system of record, and named approval owners before changing workflow rules.
2. Separate operational status updates from engineering, safety, or financial disposition sign-off.
3. Validate exception queues, duplicate handling, and cutoff reconciliation in a bounded pilot before production rollout.