Methodology
The producer method, in plain language.
A summary of the method BarrierLedger applies to offshore platform producer wells (offshore-platform-producer-v0), signed on 22 September 2026. It states the rules. The numeric thresholds, windows, tolerances and grace periods are set in the tenant’s policy, and are not published here.
The barrier model
Two barrier envelopes, primary and secondary.
The method follows the two-barrier philosophy. Which elements belong to which envelope decides whether a failure can set Red.
Primary envelope
The completion, tubing, casing, cement and DHSV. A failed or unverified primary element can set Red.
Secondary envelope
The A annulus and B annulus. An outcome on either sets Yellow at most, with the condition still flagged.
Uncontrolled flow
Defined as flow of formation fluid outside the intended conduit that the installed barriers cannot control — reaching surface, or entering an interval it was not intended to. It is the other condition that sets Red, and it must be recorded: a shut-in is a controlled state.
What an assessment reads
Explicit inputs, each with its provenance.
An assessment reads only what is recorded. A required input that is missing is named as a gap, never filled with an assumed value.
Annuli in scope
- A annulus (tubing × production casing): monitored and assessed; a governing limit is required.
- B annulus (production casing × surface casing): monitored and assessed; a governing limit is required.
- C annulus (surface casing × conductor): not required; assessed like any other annulus when the operator monitors it and supplies a governing limit.
The governing limit, as master data
MAWOP/MAP is supplied by the operator, never derived by the platform. Each limit carries:
- the governing value and its unit
- a governing-basis text stating in words what the value represents and what it governs
- the source
- the source date
- the reference/document — a citable identifier or file reference
- the supplied-vs-computed flag
- an expiry/review date by which the value must be re-confirmed
Its source is one of the operator's integrity policy, a condition or approval issued by a regulator, a design or manufacturer document or a recorded test or verification report. Where two limits apply, the reading is compared with the lower, and the record says which governed.
Readings
The current reading is the latest one dated on or before the assessment date; a future-dated reading never stands in for it. The reading history feeds the sustained-rise rule. Readings are stored at full precision and rounded for display only.
The tenant’s policy
The band boundaries for each annulus, the trend window and rate, the staleness age, the SCP criteria, the test frequencies and grace periods, and the tolerances are set in the tenant’s policy: the method’s documented values, or the operator’s own under request and approval. Each change creates a new settings version, and every assessment records the version it used.
Outcomes and status
One outcome per annulus, one status per well.
Each assessed annulus gets exactly one outcome. When several conditions hold, the highest in this order wins, and every condition that held is still recorded as a flag.
| Outcome, highest first | Effect on the well |
|---|---|
| unassessable | distinct unassessable state, never Green |
| scp | Yellow where the annulus is a secondary barrier; Red only when a primary element also failed or uncontrolled flow is present |
| exceedance | Yellow where the annulus is a secondary barrier; Red only on a primary-barrier failure or uncontrolled flow |
| sustained-rise | Yellow |
| elevated-and-stale | Yellow |
| elevated | Yellow |
| stale or missing | Yellow |
| normal | Green |
Bands
Sustained rise
Red
A primary barrier element (completion, tubing, casing, cement and DHSV) has failed or is unverified, or uncontrolled flow is recorded. An excursion on a secondary annulus does not set Red on its own, and a well recorded only as shut in is in a controlled state.
Yellow
No Red condition, and at least one of: a secondary element degraded or failed; a required test past its grace period; an annulus outcome of elevated, elevated-and-stale, sustained-rise, stale or missing; an open data assumption or an input without provenance. Every Yellow carries an open action with an owner and a due date.
Green
Only when every monitored annulus has a current reading whose outcome is normal, every required test is current, every barrier element is verified, no data-quality exception or masking override is open, and the method for the well’s own type is in force for the organisation.
Unassessable
A state of its own, outside the Red, Yellow and Green ladder. It is never shown as Green and never folded into Yellow.
What moves a well up
What moves a well down
Sustained casing pressure
SCP is its own exception path.
An annulus whose pressure meets the sustained criteria and cannot be bled to zero takes the scp outcome. It is never a footnote and never suppressed.
Criteria
The sustained threshold, hold period, confirming readings and tolerance are set in the tenant’s policy, as a share of the governing limit, so they scale with each annulus’s own limit.
Who declares it
The integrity engineer and client admin may declare an SCP, with the reason, the evidence and the declarer recorded. The rule also fires from the data alone, so it does not depend on anyone remembering to declare it.
What closes it
Either a successful bleed-off test or a run of sustained normal readings, with the evidence, its reference and the person closing it recorded. A bleed-off counts only when it meets the criteria set in the tenant’s policy; repeated failed attempts escalate to the integrity engineer.
Its effect
Yellow where the annulus is a secondary barrier; Red only when a primary element also failed or uncontrolled flow is present.
A rise triggers a diagnostic
When the sustained-rise rule fires, a bleed-off or SCP diagnostic action is due by the end of the calendar month in which it fired.
Never by one bleed
No single bleed-off reclassifies a well as normal unless it meets the closing criteria.
Tests and due dates
A late test is visible before it is Yellow.
Test frequencies and grace periods are set in the tenant’s policy, per test type and annulus.
- Inside the grace period a test is late and an action opens, but the status does not change.
- Once past grace the status becomes Yellow.
- An overdue test escalates to the integrity engineer, and the escalation repeats until the exception is closed. Escalation re-notifies; it does not raise the status further.
- Any recorded due date, such as an SCP diagnostic’s, is treated the same way.
When a well cannot be assessed
Unknown is never shown as fine.
A well is assessed only under the method written for its own well type, once that method is in force for the organisation. It is unassessable when:
- its well type has no method in force for the organisation;
- a monitored annulus has no valid governing limit with its full provenance; or
- the inputs a rule needs are absent, so no rule can run.
Such a well still appears on dashboards, reports and the monthly review, labelled with its reason. It blocks its own completion in the review, not the locking of the period. A method written for one well type is never applied to another: the methods for offshore platform water/gas injection wells, offshore platform disposal wells, land production wells, land injection wells and land disposal wells are written and not yet signed.
Provenance
Every result can be explained later.
Each assessment records inputs hash, source-file hashes, method-profile version, engine/build version, schema version and override and approval records, with the readings and governing limit it used.
- The same inputs under the same method version always give the same outcome and flags.
- A re-run is a new record: it never overwrites an earlier assessment.
- A corrected input produces a new assessment that names the one it supersedes.
- An assessment made under an earlier version keeps that version; a later change does not reinterpret it.
Proposed changes
Proposed, unsigned.
A set of changes to the producer method has been drafted for the method owner’s signature. Until it is signed, the method above is the one in force, and the engine does not change.
- E-6 barrier mapping: proposed, unsigned
- E-7 SCP definition: proposed, unsigned
- E-8 bleed criterion: proposed, unsigned
- E-9 trend rule: proposed, unsigned
- E-10 well lifecycle: proposed, unsigned
- E-11 failed tests and unmapped element kinds: proposed, unsigned
Reference set
What this summary is not
The method summary
Take the summary to your integrity engineer.
Ask for this summary as a PDF through the enquiry form. We reply by e-mail within one business day.