Annulus pressure management: MAWOP, SCP and the monthly review

Introduction

A B annulus reading 85 bar, behind casing rated to several hundred bar, looks comfortable. Against the shoe it is 64% of the limit, and amber.

Every producing well has pressure in places where, in an ideal world, there would be none. The A annulus warms up when the well comes on and its pressure rises. An outer annulus slowly builds pressure over months. Someone bleeds it off, writes the volume in a logbook and moves on. Whether that is routine or the first sign of a failed barrier depends on three things: the limit the reading is compared against, the diagnosis of where the pressure comes from, and whether anybody reviews the pattern rather than the latest number.

This post covers annulus pressure management for operating wells: the barrier envelopes and the register that describes them, how MAWOP is derived in outline, how to tell thermal pressure from sustained casing pressure, what a bleed-down and build-up test tells you, how a traffic-light status is set, the integrity tests that prove the barriers, and the monthly review that ties it together. It draws on ISO 16530-1 and ISO/TS 16530-2, NORSOK D-010 and API RP 90 and RP 90-2, and on the general expectations of the UK and Norwegian regulators.

Barrier envelopes and the barrier register

Well integrity rests on the two-barrier philosophy that NORSOK D-010 sets out and that most operators' policies adopt: wherever a well can flow, there should be two independent, tested well barriers between the reservoir and the environment. Each barrier is an envelope of well barrier elements (WBEs) that together contain the pressure.

For a typical producer:

• The primary barrier is usually the production casing or liner and its cement below the packer, the production packer, the tubing below the subsurface safety valve (SSSV), and the SSSV itself.
• The secondary barrier is usually the production casing and its cement above the packer, the wellhead and tubing hanger, the annulus access valves, and the Christmas tree master valve.

NORSOK D-010 well barrier schematics show the primary envelope in blue and the secondary in red, and give acceptance criteria for each WBE: how it is designed, installed, tested initially and monitored in service. The useful insight for annulus management is that every annulus sits between two envelopes or forms part of one. The A annulus, between tubing and production casing, is bounded by elements of the primary barrier on one side and the secondary on the other. Pressure in it tells you something about both.

The barrier register is the record that makes this usable. For each well it should hold:

If the register is a set of linked workbooks that one engineer understands, the programme depends on that engineer. ISO 16530-1, which covers well integrity governance over the life cycle, puts weight on defined roles, competence and documented basis precisely because of this.

MAWOP, MAASP and MAP: one idea, several names

The terms differ by document, but the idea is the same: the highest pressure an annulus can be allowed to see at the wellhead without putting any element of the well at risk.

• MAWOP, maximum allowable wellhead operating pressure, is the API RP 90 term and the one used in US offshore practice. API RP 90-2 applies the same approach to onshore wells.
• MAASP, maximum allowable annular surface pressure, is the term used in the ISO 16530 series, NORSOK D-010 and OEUK guidance.
• MAP, a maximum allowable pressure for the annulus, is how many operators' own policies simply phrase it.

Whatever the name, the operator's integrity policy should say which term it uses, how the value is calculated, what margins are applied, and when it must be recalculated.

How the limit is derived, in outline

The limit is the lowest of a set of candidate values, each representing an element that could fail first. For an annulus those candidates normally include:

1. The burst rating of the outer string forming the annulus, derated by the factor the method or policy specifies, and reduced for any known wear or corrosion (see sour service materials and CO₂ corrosion prediction for why that allowance changes over a well's life).
2. The burst rating of the next string outward, at a higher fraction (API RP 90 uses 80%), because it must contain the pressure if the outer string of the annulus fails.
3. The collapse rating of the inner string, similarly derated.
4. The rated working pressure of the wellhead section, hanger, valves and outlets on that annulus.
5. The formation strength at the outer string's shoe, where the annulus is open to formation, less the hydrostatic head of the annulus fluid.
6. For the A annulus, the ratings of the packer and any completion equipment exposed to annulus pressure.

API RP 90 gives specific derating fractions for each string, and the ISO 16530 series describes the calculation with its fluid gradients. Use the fractions from the current edition of the document your policy adopts, not from memory or an inherited spreadsheet. A complete calculation checks each element at its own depth with the internal and external fluid gradients; the surface-only outline below shows how the governing candidate emerges.

Worked example (illustrative). B annulus between 7 in 29 lb/ft N-80 production casing and 9⅝ in 47 lb/ft N-80 intermediate casing, inside 13⅜ in 68 lb/ft K-55 surface casing. The 9⅝ in shoe is at 2,500 m TVD with a formation integrity test (FIT) of 1.74 SG equivalent; the annulus fluid is 1.20 SG brine. Pipe ratings are the published API minimum values. All values are surface pressures in bar (1 psi = 0.0689 bar). The 80% outer-string fraction is the API RP 90 value; the other fractions are example policy values only.

In words, the shoe limit is the difference between the FIT equivalent density and the annulus fluid density, multiplied by gravity and the shoe's true vertical depth, converted from pascals to bar.

The formation at the shoe governs, by a wide margin. That is common for outer annuli and is the reason the shoe test result, and the annulus fluid density, belong in the register with their sources. An FIT is a lower bound on formation strength, since the test stops before the formation breaks down, so a limit built on it is conservative; a leak-off test would give the actual value and may raise the limit. Change the brine, or find that the shoe test was recorded in the wrong units, and the limit moves.

Thermal pressure versus sustained casing pressure

Most annulus pressure is thermal. When a well starts up, the fluids in a closed annulus heat and try to expand against steel that barely gives. For a liquid-full annulus with rigid walls, the pressure rise per degree is roughly the ratio of the fluid's thermal expansion coefficient to its compressibility; for water the rule of thumb is roughly 10 bar per °C.

ΔP / ΔT ≈ α / κ

Water at about 40 °C:
  α ≈ 3.85 × 10⁻⁴ per °C,  κ ≈ 4.4 × 10⁻⁵ per bar
  α / κ = 3.85 × 10⁻⁴ / 4.4 × 10⁻⁵ = 8.75 ≈ 8.8 bar per °C

A 20 °C average rise in a rigid, liquid-full annulus:
  ΔP ≈ 20 × 8.75 = 175 bar

Real annuli see far less because the casing balloons, a gas cap compresses and fluid leaks off into formation, but the arithmetic shows why a closed annulus on a newly started well can reach a meaningful fraction of its limit with no leak at all. Thermal pressure tracks production rate and temperature, falls when the well is shut in and cools, and, once bled, does not come back unless the temperature rises again.

Sustained casing pressure (SCP) is different. API RP 90 describes it as pressure that rebuilds after being bled down and that is not caused solely by temperature or deliberately applied by the operator. It means there is communication with a pressure source: the tubing through a leaking connection, hanger or packer, or a formation through poor cement or a casing leak. SCP is not automatically an emergency, but it is always a barrier question. If an annulus that forms part of the secondary envelope is now connected to a pressure source, that envelope is no longer what the schematic says it is.

Bleed-down and build-up tests: thermal pressure or SCP?

The bleed-down and build-up test is the main diagnostic tool. Bleed the annulus through a small needle valve while recording pressure, the volume and type of fluid returned and the time taken; then shut in and record the build-up. In US offshore waters, BSEE's casing pressure management rules (30 CFR Part 250, Subpart E) require a diagnostic test of annuli showing sustained casing pressure, and API RP 90 describes the bleed-down and build-up procedure. Elsewhere the operator's policy sets the details.

What the results point towards:

Three practical rules make the diagnosis defensible. Measure what comes out, by volume and by type, not just the pressure. Record the fluid level, because a gas cap changes how pressure responds. And never let a single bleed-off decide the classification: one rebuild may be thermal after a rate change, and one quiet month does not clear a well with an SCP history. The trend over several cycles is the evidence.

Repeated bleeding has a cost. Each bleed removes liquid from the annulus, replaces it with gas, reduces the hydrostatic head and can draw more gas in from the source. A well whose annulus is bled every week without diagnosis can get steadily worse.

Traffic-light status

A status scheme turns readings into decisions that people outside the integrity team can act on. The ISO 16530 series describes categorising wells by integrity status, and most operators show that as colours. The bands are the operator's policy, not a universal standard; the fictional demo tenant on barrierledger.com, for example, uses different ones. An illustrative scheme, with each band as a percentage of the governing limit for that annulus:

In the worked example, a B annulus reading of 85 bar against the 132.4 bar limit is 85 / 132.4 = 64% of the limit: amber under this policy, and a prompt to look at the trend and run a diagnosis rather than a reason to bleed it and move on.

A good scheme also has explicit rules for the things that are not a reading: an annulus with no valid limit, a reading that is missing or out of date, a test that is overdue, a reading in an ambiguous unit. These should produce a named exception, not a default colour. A well that shows green because nobody entered this month's B annulus reading is a well whose status is unknown.

Integrity tests

Readings show how the barriers are behaving; tests prove that they work. A typical operating-phase programme includes:

• Subsurface safety valve tests, closing the valve and measuring the inflow against the acceptance rate. API RP 14B's familiar criterion is 400 cm³/min of liquid or 15 scf/min (about 0.42 m³/min) of gas.
• Tree valve leak tests on the master and wing valves.
• Annulus pressure tests to confirm the integrity of the tubing, packer and casing that bound the A annulus.
• Wellhead and hanger seal tests, including void and test-port checks.
• Gas-lift and annulus safety valve tests where fitted.

Test types and frequencies come from the integrity policy, often set by well type and risk, in the same way that intervals are set for relief valve maintenance and SIS proof testing. Each test record needs its test pressure, acceptance criterion, result, date, who performed and witnessed it, and the evidence (charts, data files, reports). A test result filed in an email folder does not exist when the auditor asks for it, and an overdue test is itself a status input: a barrier that has not been proven within its interval should not be shown as healthy.

The monthly review and its governance

The monthly review is where annulus management becomes a programme rather than a set of readings. It should walk, in a fixed order:

1. Every well in scope with its status and governing limit, and what changed since last month.
2. Every annulus in amber or red, with its trend, diagnosis and open actions.
3. Every overdue or upcoming integrity test.
4. Every status override, with its reason and who approved it.
5. Bleed-offs, leaks and incidents logged in the period.
6. Open actions with owners, due dates and ageing.

Then it is signed off, and the period is closed. Governance is what makes the review defensible later, and it is the same discipline a GHG verifier applies to an emissions inventory:

• Overrides need a reason and a second person. An engineer who downgrades a red to an amber because the pressure is "known thermal" should have to say so and have it approved.
• Closed periods stay closed. A later correction is a recorded restatement with its reason and approval, not an edit to last month's spreadsheet.
• Limits have provenance. Every governing limit carries its source, date and reference, so a changed value is visible as a change.
• Policy changes are controlled. Changing a band or a test interval is a management of change decision, not a cell edit.

These expectations are consistent with what regulators look for. In the UK, well integrity is regulated by HSE; offshore, HSE acts jointly with OPRED as the Offshore Safety Directive Regulator. The Offshore Installations and Wells (Design and Construction, etc.) Regulations 1996 require every well to be examined under a well examination scheme by an independent and competent person, and OEUK's Well Life Cycle Integrity Guidelines describe practice. In Norway, Havtil (formerly the Petroleum Safety Authority) expects two independent, tested barriers and points to NORSOK D-010 as the recognised standard for well barriers. Neither regulator prescribes a particular spreadsheet or system, but both expect the operator to show how a status was decided, by whom and on what basis.

Common errors

• A limit with no source. A MAWOP in a spreadsheet cell with no calculation, date or reference behind it cannot be defended or updated.
• Limits never recalculated after a wear log, a fluid change, a change of service or a new shoe test.
• Mixed units. psi, bar and kPa in one register, or gauge and absolute pressures mixed, turn a green into a red or the reverse.
• Bleeding without diagnosing. Routine bleed-offs that are logged but never trended hide a developing SCP.

Where BarrierLedger fits

We built BarrierLedger, FEEC's well integrity software, to keep this record in one traceable system: the barrier register, well schematics, annulus pressures against MAWOP/MAP, integrity tests and the monthly review. Each monitored annulus carries its governing limit as master data with its source, date and reference, and readings are assessed as a percentage of the governing limit against the bands in the method profile for that well type, with your integrity policy setting the bands, cadences and tolerances. The MAWOP/MAP values themselves are entered or imported, not derived by the platform. Sustained casing pressure has its own exception path using the criteria in your policy, and no single bleed-off reclassifies a well on its own.

Tests are scheduled from your policy and tracked as due, upcoming or overdue with their evidence attached. In the monthly review, status overrides need a reason and a second person's approval, approved periods lock, and a later change is a restatement. BarrierLedger produces in-house integrity reports; it does not file anything with a regulator or certify compliance. There is more on our BarrierLedger page.

Conclusion

Annulus pressure management is a chain: a register that describes the barriers, a limit for each annulus with a documented basis, a diagnosis that separates thermal pressure from sustained casing pressure, a status scheme with explicit rules for missing data, tests that prove the barriers, and a review that closes each month with a trail. A weak link anywhere turns the reading on the gauge into a number nobody can stand behind.

If you want an independent look at your well register, annulus limits or monthly review process, see our well integrity services or talk to us.