WO2016022069A2

WO2016022069A2 - Safety device and method

Info

Publication number: WO2016022069A2
Application number: PCT/SG2015/000135
Authority: WO
Inventors: Colin Stuart; Sean FOO; Yulia LEVINSKAYA
Original assignee: Stuart Wright Pte.Ltd.
Priority date: 2014-08-07
Filing date: 2015-08-06
Publication date: 2016-02-11
Also published as: GB201414030D0; WO2016022069A3

Abstract

A safety apparatus and method are disclosed. The apparatus and method are for monitoring integrity and/or blowout risk of a production phase well. The apparatus comprises: an inlet port for receiving fluid from a wellhead annulus bleed port; an analyser for receiving fluid from the inlet port and analysing physical and/or chemical properties of the fluid, wherein the analyser is configured to determine well-integrity based on the physical and/or chemical analysis. The inlet port is configured for external connection to a well-head annulus bleed port. The wellhead is preferably a surface wellhead, such as an onshore land well or an offshore fixed platform well having bleed ports for a plurality of well annuli. The analysis may comprise a comparison of measured properties of well annulus fluids before and after bleed down to determine if the annulus is in communication with a sustained flow source which may be indicative of a well integrity failure. The analysis may determine critical pressure thresholds and compare them to existing annulus pressure values for safe operation of the well.

Description

SAFETY DEVICE AND METHOD

Technical Field

The present invention relates to safety devices and methods to increase well safety at oil and/or gas production sites. For example, the devices and methods allow triggering of early warnings to allow well-site and office based personnel to plan, intervene and prevent loss of well control events. More specifically, but not exclusively, the present invention relates to surface wells during the production phase.

Background

The current oil and gas industry is evolving with increasing amounts of automation and digitalization being utilized in various disciplines. This is due to an increasing level of operational complexity which companies are undertaking. These complex operations require strict and intelligent control measures to ensure activities are safe for personnel and the environment. Modern safety rules and regulations are implemented to remove or reduce the probability of safety, health and environmental incidents. This requires real-time monitoring of assets and real-time analysis of data in order to comply with safety rules and regulations and to keep operations incident-free.

One of the driving forces for constant real-time monitoring in the oil and gas industry is to prevent blowout events. These well control incidents are often caused by well integrity failures, which are not detected by well-site or operation teams. Well blowouts occur in wells under construction, and equally in wells already in production, or suspended.

According to the NORSOK D-010 Standard, well integrity is defined as "the application of technical, operational, and organizational solutions to reduce the risk of uncontrolled release of formation fluids throughout the life cycle of the well." The Petroleum Exploration Society of Australia offers the following definition of well integrity for consideration: "The instantaneous state of a well, irrespective of purpose, value or age, which ensures the veracity and reliability of the barriers necessary to safely contain and control the flow of all fluids within or connected to the well". A well blowout can also be described in the same manner.

The consequences of blowouts include devastating environmental impact, financial losses, forfeits and deprivations to the company, severe trauma to personnel and the loss of life. The top priority for every oil and gas organization is to ensure operations are safe for personnel and the environment. Making sure that well conditions are appropriately monitored, and that early warning of an impending blowout condition is available, will increase operational safety.

The consequences of well blowouts can be significant in environmentally sensitive areas with presence of underground freshwater aquifers. Well integrity failures and blowouts may inevitably lead to freshwater contaminations.

Examples of well integrity failures such as incorrect casing material selection and poor cementation (planning and execution) can create pathways, external to the borehole, allowing natural gas to be released directly into drinking aquifers. The availability of a technology that is able to identify the early onset of barrier failures and provide early warnings will allow oil and gas organizations to intervene early to restore the integrity of wells.

The majority of blowouts occur unexpectedly, which is why the

consequences are usually catastrophic. Unfortunately, as post factum blowout analysis shows, many of the situations leading to actual or possible loss of containment can be detected before the incident occurs and therefore prevented.

Currently, the sampling and analysis of well-fluids is essentially manual in nature. The process currently requires human access, is time consuming, and is too costly to be imposed on a regular basis. To perform a chemical analysis of a well fluid sample, it first needs to be collected from the well, properly stored and sent to a remote laboratory for analysis. Significant time is required before the results of the laboratory analysis are available for interpretation, which can only be performed by qualified professionals.

A finding is significant cost of information delay. This factor results in critical information not being available instantly. Consequently, decision makers are unable to draw the right conclusions causing further delays or mishap. Loss of production and costly intervention workovers during the production phase can be minimised if accurate well integrity information is readily available.

US 2011/040501 is an automated system for monitoring fluids, but this system relates to the monitoring of reservoir fluids for testing underground formations surrounding a borehole, such as for well construction or development.

US 5366017 A describes an invention related to existing communication passages in subsea wells only which allow connection to the production equipment at the surface. It provides method to monitor pressure in the 'B' annulus using existing means of communication in subsea wellhead and tree configurations. Using these existing passages, communication lines can be connected to the gauge or other monitoring equipment located at the surface. The device describes pressure monitoring aspects of the annulus pressure through the wellhead.

EP 26771155 A1 describes a system and method designed to ensure flow in the production flowline of a well. The system and method include means for taking sample from the production flowline, measuring properties of this sample, processing data obtained and preventing possible flow issues which may occur in the flowline (clogging, ice formation, etc). The method is based on the iterative process of modifying at least one control parameter of the sample until a transition occurs, wherein the said transition would cause a flow assurance issue. The purpose of the invention is to identify possible problems which may cause issues with flow assurance in the main production flowline and take preventive steps against them. The primary function of the device is to optimise well production and achieves this by connection to a production flowline. The said method of determining flow assurance issues will not allow the identification of leak sources within the well, and flagging these well integrity issues.

GB2475409 A discloses an invention which is described as a pressure relief valve. It is to be installed between inner and outer annuli in order to bleed off excess pressure, which may damage the tubular, below the damaging threshold. A pressure gauge may also be installed within the outer annulus to monitor operation of the relief valve. This device is installed inside a well. US2013/275099 A1 describes a method of determining the limit of failure in the wellbore solely for drilling operations. It determines the mud weight limit while drilling to prevent the collapse of the wellbore wall. This method is for drilling operations and is not applicable to producing or suspended wells.

US2011/192598 A1 describes using MEMS sensors for various well treatments and systems associated with these applications. These MEMS sensors are introduced into the drilling fluid or into the cement slurry during well cementing operations. Any disturbance identified by the MEMS sensors through movement of fluids inside the wellbore will trigger alarms. However, this configuration is not suited to detect any potential leak source above where the MEMs sensors are placed, especially if shallow leaks have occurred inside the wellbore. Accordingly, these shallow leak fluids will preferentially migrate towards the surface following the path of least resistance, thereby causing minimal fluid disturbance deeper in the wellbore where the MEMs sensors might be.

Summary of the Invention

As mentioned above, the processes to be monitored at the well-head in order to prevent a blowout on production and suspended wells are complex, numerous and time consuming. The complexity makes it extremely difficult to analyse the process manually. In general, the oil and gas industry and in particular the area of well engineering is notably in need of a new generation of devices, which will help to improve safety of well operations and monitoring. As such, the industry is in need of an intelligent system, which is capable of collecting samples from producing or suspended wells, performing diagnostics on these samples, comparing these samples to a library of existing fluids in order to identify the origins of the leak source, and generating an output (such as a graphical output) representing these results to identify well integrity and blowout risks based on the condition of the well. This "fingerprinting" of the samples may be analysed in conjunction with other data such as pressure reduction/build-up and temperature changes to detect the likely source of the problem. Special algorithms will identify impeding unsafe conditions, flagging these by automated alerts. The present invention differs from prior art apparatus and methods, as follows:

1. The apparatus is an external device for connection, or connected to, a wellhead other than common gauges which are typical on wells. The apparatus does not require any specific passages to be present in the well in order to perform its function as it can be connected to the existing wellhead outlet.

2. The external device is capable not only of monitoring, which are key features of common gauges, but are also capable of performing diagnostics, through the use of processor or analyser. In preferred embodiments, a key difference of the present invention from any fix scale pressure gauge is that the present apparatus is capable of determining pressure threshold values (such as MAASP) automatically based on well specific data and the current well condition. The apparatus may automatically determine (and update by recalculating) this threshold value for every annulus on wells. Typical gauges are not able to perform this comparison against such regularly updated data. This updating may be especially critical since well conditions may change with time, thus affecting the threshold value.

3. Some prior art devices exist with sensing capability which perform diagnostics and further conditioning capabilities to adjust a parameter of the fluid components to determine the onset of a flow transition wherein this flow transition will cause a flow assurance issue in the production flowline. The present invention differs in that the sensors and diagnostics are designed to prevent loss of containment of any annuli in the well. This may be by continuously measuring the properties of the annuli fluids and their pressures and interpreting these data to allow the prediction of the onset of failure to allow early intervention on that well.

4. No prior art methods analyse sample composition and properties and compare to a library of reference fluids in a database, with the sole purpose of identifying the original leak source within a well, reservoir or shallow aquifer and determining blowout risk. For example, steps of taking a sample, determining the properties of sample and comparing them against data stored within a database library are used to identify the likely source of where the bled fluid came from originally, which is further used to identify the leak path within the annulus or production flowline.

5. Another aspect of the inventive method is to analyse in conjunction with the fingerprinting results, other data such as pressure reduction/build up and temperature changes to confirm the existence of the annulus being in

communication with a sustained flow source capable of generating long term flow, thus, subjecting well to a blowout risk

The present invention relates to a method and device for early

warning/prevention of impending blowout conditions on producing or suspended wells. The present invention further provides methods of data analysis, which may include the generation of graphical outputs to understand the integrity of the well barriers. The invention may also take necessary remedial action if the integrity of the well is diagnosed to be compromised. The present invention provides apparatus which may be described as safety apparatus for monitoring well integrity (that is, the integrity of the well). The apparatus is preferably configured for location at the surface and may be for attachment to existing outlets on the wellhead. The apparatus is configured for use of production phase or post-completion wells, such as producing or suspended wells. The apparatus may be known as a wellhead safety apparatus. The apparatus comprises: an inlet port for receiving fluid from a well annulus or production flowline; an analyser for receiving fluid from the inlet port and analysing physical and/or chemical properties of the fluid, wherein the analyser is configured to determine well-integrity status based on the physical and/or chemical analysis. The apparatus' inlet port may be a well head outlet port, that is, an inlet port for receiving an outlet from a well head. The apparatus may compare the results of the physical and/or chemical analysis to a database or library of existing or known fluids to identify potential leak sources in the well. Subsequently, the apparatus may produce an output such as a graphical output or report indicating well integrity status. It is believed no prior device or system is adapted to determine well-integrity and blowout risk and in an independent manner such as the present invention. The wellhead may be a surface wellhead, preferably having bleed ports for multiple annuli. For example, the surface wellhead may be an onshore land well or an offshore fixed installation well.

The connection to the bleed port is preferably such that the apparatus can be located external to, that is, outside from, the annuli and wellhead.

Instead of being directed to determining well-integrity the safety apparatus could determine a risk of blow-out. The two parameters of well-integrity and blowout risk are related since an integrity failure could result in a blow-out.

The safety apparatus may be configured to determine blow out risks based on the determined well-integrity status.

The inlet port may be configured for connection to a well-head annulus bleed port, or a production flowline, for example, to be able to correlate produced fluids with any similar fluids produced from any annuli to prevent a loss of containment issue which in a most significant case would lead to uncontrollable blowout. Preferably the connection is an external connection, that is, the apparatus is external to the well annulus and well head. The inlet port may be configured for connection to an existing well-head annulus bleed port. The connection allows the apparatus to be installed at the surface that is onshore land wells and offshore fixed installations wells (more on this later) that allow access to multiple, or preferably all wellhead annuli. In general this will be non-subsea wells. Fluids from the well-head annuli and/or production flowline can be bled, sampled and analysed by the apparatus. Comparison may be made between the measurement results of the production flowline and one or more annuli, or between multiple annuli. The comparison may allow the identification of the route or course of fluid ingress as a result of leaking component(s). The analysis may allow trace of chemical components in annuli specific to a particular formation to be detected thereby indicating fluid inflow and communication. This may be used in conjunction with pressure and temperature data collected by the apparatus to determine a failure of well-integrity. By the term well integrity or integrity of a well we mean an unexpected breach or leak of any component in the well structure. This could be flow from the production tubing to an annulus or could be inflow from surrounding formation etc. Output from the analysis may take the form of a report (such as a graphical report) on the condition of well-barriers, such as some or all of tubing, casing, liner, packers, cement, drilling and completion fluids, wellhead components etc. as set out herein.

In an alternative embodiment the inlet port may be configured for connection to a production flowline.

The analyser may be arranged to compare measured properties of well annulus or production flowline fluids to stored data, the stored data may comprise one or more of:

specifications of the well annulus or flowline;

historical data for said well annulus or flowline; and

a library of data for identifying fluids and compositions,

thresholds for safe operation of the well; and

based on the comparison provide an output indicating the integrity of the well.

The analyser may be arranged to compare a measured value of surface pressure with calculated values of MAASP depending on the as-built conditions of the well.

The analyser may be arranged to compare a measured value of physical/chemical parameters with calculated and/or stored values of said parameter, and if the measured value is outside of predetermined limits by comparing to the calculated or stored value, the analyser triggers an alarm. The alarm may be provided by a graphical output indicating a failure of well integrity which could potentially lead to a blowout situation.

The apparatus is preferably located outside of the wellbore and wellhead. The analyser may comprise one or more sensors coupled to the inlet port, the one or more sensors arranged to measure a pressure and/or temperature of the fluid at inlet conditions corresponding to those in the annulus or flowline. By inlet conditions corresponding to those in the annulus or flowline, we mean that the pressure and/or temperature is equal to that in the annulus or flowline, such as at the wellhead level.

The analyser may comprise a sampling channel for receiving sample fluid bled from the well annulus or production flowline through the inlet port, transmitting the sample fluid to sensors within the analyser or apparatus, and performing physical and chemical analysis at a pressure which may be different from the inlet conditions sensors. Usually, but not exclusively, this pressure is a reduced pressure.

The safety apparatus may comprise a filter for removing solid or potentially solid particles from the sample fluid which could damage the sensors performing the chemical and physical analysis.

The safety apparatus may comprise sensors for determining at least one of temperature, pressure, density and viscosity of the sample fluid at a pressure reduced or different from the inlet conditions.

The safety apparatus may comprise one or more separators for separating the gaseous phase from the liquid phase of the fluid sample and in the liquid phase for separating oil from water. The one or more separators may be microfluidic separators having a porous membrane of oleophobic or hydrophobic material. Other separators may be used for the same purposes.

The safety apparatus may be arranged such that the separated water and oil liquid phases are pumped separately to the sensors for measuring properties of the oil and water phases.

The safety apparatus may comprise an array of MEMS sensors arranged to measure properties of the oil and water phases. Other types of sensors may be used for the same purposes.

The safety apparatus may comprise sensors for determining one or more properties such as alkalinity, salinity, pH, and resistivity of the sample fluid.

The safety apparatus may comprise a composition evaluator for performing compositional analysis of the sample fluid. The composition evaluator may be arranged to receive and analyse the gaseous phase of the sample fluid. The composition evaluator may be an infra-red spectrometer, such as a multichannel Fourier transform infra-red spectrometer. Other types of evaluator or spectrometer may be used to perform a compositional analysis of the fluid.

The safety apparatus may comprise a flush unit arranged to flush the samples from the analyser after analysis to a disposal unit arranged to receive the samples for safe disposal. The present invention provides a well-head comprising the safety apparatus set out above, wherein the safety apparatus is coupled to a well-head annulus bleed port or production flowline at the well-head to receive fluid from the well-head annulus bleed port or production flowline. The wellhead is preferably a surface wellhead. The apparatus is preferably located externally to the well bore and annuli.

An aspect of the invention provides a system comprising a device connected externally to the side outlets of surface wellheads, wherein the said device is able to analyse compositional properties of annuli fluid(s) through bleed down operations conducted on the wellhead outlets. In a preferred embodiment, a microfluidic separator is housed within the device capable of separating various fluid phases like gas, liquid, and oil. Separated fluid phases are directed to dedicated sensors capable of analysing specific aspects of fluid/gas composition and properties in real time. The bled fluid/gas composition and properties may be compared or fingerprinted to a database library of existing fluid(s) and gas(es) to identify potential leak sources in the well and blowout risks associated with the well integrity issues identified. The database library may contain data with regards to properties and composition of reservoir hydrocarbons, shallow water aquifers, and drilling and completion fluids used throughout a well's lifeeycle. The identification of the bled fluid/gas accurately to its original source may allow instant well integrity warning triggers to be made available to well-site and office based personnel to plan, intervene and prevent loss of well control events. The fingerprinting results may be analysed in conjunction with other data such as pressure reduction/build-up and/or temperature changes in order to determine the blowout risks and detect the likely source of the problem. The results from this analysis can be used to trigger alarms in real-time when necessary, optionally in conjunction with generating a well-integrity report for management personnel on both site and remote bases respectively.

Real time sampling and analysis of bled well-fluids at the well site, coupled with the ability to identify the bled fluid/gas accurately to its original source allows instant well integrity warning triggers to be made available to well-site and office based personnel to plan, intervene and prevent loss of well control events. The present invention also provides a method of diagnosing well integrity. The method comprises: coupling a flow conduit or channel from well integrity analysis apparatus to an annulus bleed port at the well-head or to a production flowline; the well integrity analysis apparatus receiving fluids from the flow conduit, analysing physical and/or chemical properties of the fluids, and based on the analysis of the fluid generating an output of a diagnosis of well-integrity. For example, the flow conduit or channel may be configured for connection to an existing well-head annulus bleed port. The output may be a graphical output depicting the diagnosis of well integrity by fingerprinting or comparison to a database or library of existing of known fluid(s), liquid(s) and/or gas(es) to identify potential leak sources in the well. Blow-out risks may be determined based on the diagnosis of well-integrity.

In an alternative embodiment the flow conduit may be coupled to a production flowline.

The present invention provides a method of well-integrity analysis, comprising: comparing measured properties of well annulus or production flowline fluids to stored data, such as in a database or library, the stored data comprising one or more of: specifications of the well annulus or flowline; historical data for said well annulus or flowline; thresholds for safe operation of the well; and a library of data for identifying fluids and compositions, and based on the comparison providing an output indicating the integrity of the well. The output may be a graphical output. This method may be included as part of the safety device or may be applied separately. In particular, the method may be used on measured data produced by the safety device or by measured data produced manually such as by laboratory analysis. The method may be stored on a machine-readable storage medium.

In an alternative embodiment the measured properties may be of a production flowline.

The measured properties may comprise physical properties measured at the well-head or production flowline at conditions corresponding to those in the well-head or production flowline, and the comparison is to historical physical data for said well, which may be stored in the analyser. Conditions corresponding to those in the well-annulus or flowline may be conditions of equal pressure and/or temperature to those in the well-annulus or flowline.

The measured properties may comprise physical and/or chemical properties measured on fluids bled from the well-annulus or production flowline.

The measured properties may comprise chemical properties of the fluids and the comparison is to the library of data for identifying fluids and compositions.

The method may comprise determining well blow-out risks based on pressure and/or temperature changes determined from the measured properties, and optionally providing a graphical output.

The step of comparing may comprise tracking changes in fluids by comparing to historical data, such as stored in a database or library of the analyser.

The method may comprise triggering an alarm when the measured data exceeds defined limits.

The method may comprise triggering an alarm when analysis of measured data indicates the integrity of the well or annulus is compromised.

The method may comprise providing a graphical output in the form of a report depicting measured properties, results of the analysis performed by the analyser and potential warnings in case the risk of blowout exceeds certain limits.

The method may comprise calculating a maximum safe pressure of the annulus or flowline of the well and comparing this to a measured pressure.

The maximum safe pressure may be the maximum allowable annulus or flowline surface pressure. That is, the maximum pressure that an annulus is permitted to contain, as measured at the well-head without compromising the integrity of any element of the annulus.

The method may comprise re-calculating the maximum safe pressure if a change of one or more of the following occurs: service type, fluid density, well tubing or casing thickness, and reservoir pressure.

The method may comprise receiving measured pressures from one or more annuli or flowlines of a well and determining if changes have occurred in one or more of them which is indicative of a failure of well structure, for example, leaks between the annuli and/or the production flowline, potentially causing an uncontrollable blowout. Additionally, a tabular output in the form of a report may be generated to represent the results.

The method may comprise receiving measured pressures from one or more annuli or flowlines from a well and determining the location of a failure of well structure. Location may mean which barrier or annulus and may also mean which feature or component of the barrier/annulus has been compromised.

The well structure may be one of: safety valve, accessory, packer, liner, hanger, casing, or tubing for one or more of the annuli and flowlines.

The method may further comprise storing specifications of the annulus or flowline, such as pressure and/or temperature specifications, and/or mechanical specifications of the casings etc. in the library or database of the analyser.

Comparative analysis between related annuli or flowlines allows the determination of failures in barriers between annuli and flowlines for a given well, which may lead to severe consequences such as blowouts. The determination may preferably trigger early warning through a graphical and/or tabular output report on well-integrity risks.

The various methods described herein may include an early step in the method of measuring a parameter relating to the well. The parameter could be any of the parameters described herein, but in particular could be well annulus bleed fluid pressure and/or temperature. The methods may also include an additional step performed in response to alerts or alarms, especially those alerts or alarms indicating a high risk of loss of well integrity or a significant blow-out risk. The additional step may include controlling a physical device or parameter, such as a well valve or seal. For example, the device or parameter could be controlled to reduce the temperature or release annulus or other well pressure. The step of controlling may control other parameters to reduce the risk

associated with a well-integrity alert or blow-out alarm. In one example, if the annulus pressure is greater than a threshold value as flagged by the apparatus or method, there will be a final step of being able to control the annulus pressure such that it becomes lower than the threshold value. In other embodiments the apparatus or method may determine a link between a parameter which is close to, or has exceeded a threshold value for an alert or alarm and may instruct a user of appropriate action to be taken. For example, instead of the method or apparatus automatically controlling the parameter such as by opening or closing a valve, an instruction such as "bleed off pressure of annulus" may be output.

The present invention provides a computer program adapted to perform the method steps set out above. The present invention provides one or more computer readable storage media having stored thereon instructions to

implement the computer program or method steps set out above.

In one embodiment, the computer program comprises steps for performing a method of well-integrity analysis, comprising: comparing measured properties of well annulus or production flowline fluids to stored data, such as in a database or library, the stored data comprising one or more of: specifications of the well annulus or flowline; historical data for said well annulus or flowline; thresholds for safe operation of the well; and a library of data for identifying fluids and

compositions, and based on the comparison providing an output indicating the integrity of the well, and optionally the output may be a set of instructions to be performed to address well integrity issue(s) identified by the apparatus. The output may be a graphical/tabular output.

Brief Description of the Drawings

Embodiments of the present invention and aspects of the prior art will now be described with reference to the accompanying drawings, of which:

figure 1 is a perspective diagram of a conventional well-head Christmas tree;

figure 2 is a block-diagram of a safety device according to an embodiment of the present invention for monitoring well-integrity and providing an indication of blow-out risk;

figure 3 is a block-diagram of a safety device according to a further embodiment of the present invention for monitoring well-integrity and providing an indication of blow-out risk, including connection to a control room; figure 4 is a perspective diagram of a well-head Christmas tree connected to a safety device of the present invention;

figure 5 is a block-diagram of a safety device according to a further embodiment of the present invention for monitoring well-integrity and providing an indication of blow-out risk, including a database/log of information;

figure 6 is a block diagram of a detailed embodiment of the safety device of present invention, arranged to perform physical and/or chemical analysis on fluids bled from a well-annulus or production flowline;

figure 7 is a perspective diagram showing an embodiment of a safety device according to the present invention;

figure 8 is a perspective diagram showing a microfluidic separator module of the safety device;

figure 9 is a perspective diagram showing a MC-FTIR spectrometer module of the safety device;

figure 10 shows a schematic and breadboard arrangement of the optics for the MC-FTIR;

figure 11 is a perspective diagram showing a MEMS sensor board module of the safety device;

figure 12 is a schematic diagram showing two different A-annuli to illustrate MAASP calculation;

figure 13 is a schematic diagram showing two different B-annuli to illustrate MAASP calculation;

figure 14 is a schematic diagram showing two different C-annuli to illustrate MAASP calculation;

figure 15 is a graph showing an example of surface pressure response for a non-thermal pressure source;

figure 16 is a graph showing an example of surface pressure response for a thermal pressure source;

figure 17 is a graph showing an example of surface pressure and temperature response for a non-thermal pressure source;

figure 18 is a graph showing an example of surface pressure and temperature response for a possible thermal pressure source; figure 19 shows an example computing apparatus;

figure 20 shows an example of a subsea wellhead;

figure 21 shows an example of a surface wellhead;.

figure 22 illustrates an example user interface showing well setup and definition characteristics;

figure 23 illustrates an example output showing MAASP analysis

calculation, warnings and alerts;

figure 24 illustrates an example output showing sustained casing pressure (SCP) analysis calculation, warnings and alerts;

figure 25 illustrates an example output showing fluid analysis calculation, warnings and alerts;

figure 26 illustrates an example output showing gas analysis calculation, warnings and alerts;

figure 27 shows an embodiment of a blowout prevention and well-integrity warning system in accordance with an embodiment of the invention;

figure 28 illustrates an analysis method in accordance with an embodiment of the invention; and figures 29-32 illustrate four example analyses which performed according to an example an embodiment of the invention. Detailed Description

Figure 1 shows a conventional well-head and flowline Christmas tree. The well comprises a central flowline 10 and two surrounding annuli 20, 30. The flowline is accessed at the top of the Christmas tree by the four turn-wheel valves 40 shown. The inner annulus 20 is accessed by the middle two turn wheel valves 42, and the outer annulus 30 is accessed by the lower two turn-wheel valves 44. As shown in the figure, each of the flow line and annuli may include a readout gauge 50 permanently or temporarily connected to the Christmas tree. In figure 1 the flowline includes a gauge, shown to the top-right of the tree after the valves. Each of the annuli also includes gauges. For the annuli two gauges are provided for each annulus. Conventionally the gauges may be pressure or temperature gauges. For the flowline the gauges are preferably pressure and temperature gauges. Also for the annuli pressure and a temperature gauges may be provided. Any monitoring of the gauges at the well-head requires manual inspection. A person is needed to be present at the well-head to read the gauges. For continual monitoring or monitoring at frequent regular intervals this becomes time-consuming and takes considerable man-hours. Furthermore, the information available is limited to pressure and temperature. Monitoring of pressure or temperature at the well-head may occur infrequently such that the intervals between readings may be days, weeks or even months so sudden changes in the pressure and temperature, which could indicate an impending safety problem, may be missed.

Figure 2 is a block-diagram of a safety device 100 adapted for monitoring well-integrity and/or providing an indication of blow-out risks. The safety device provides automated monitoring. The parameters of well-integrity and blow-out risks are different but closely linked. For example, an early indication that the integrity of one or more of the well barriers has been compromised may be evidenced by a pressure increase in the well or well-annulus. If action is not taken the pressure increase could ultimately lead to blowout. The safety device 100 of figure 2 is adapted for connection to a well annulus at a wellhead location at the surface, via inlet 110. Alternatively or additionally, the safety device may be adapted for connection to a production flowline via inlet 10. As shown in figure 4, the safety device may be connected to the inner and outer annuli of the well. In each connection line is included a valve for turning on flow from the respective annulus. These valves may be electronically controlled to avoid manual intervention. Alternate connection of the safety device to each annulus allows monitoring of each annulus. Comparative analysis between the two can also be performed. In other embodiments, the safety device may only be connected to a single annulus or flowline, or may be connected to more annuli and flowlines.

Figure 2 schematically shows inlet 110 of safety device connected to a well annulus or flowline. The safety device includes one or more sensors 120 connected to the inlet 110. The sensors are for performing sensing and/or measurement of physical and/or chemical parameters of fluid received through the inlet. Analyser 130 is connected to the sensor(s) 120 and receives signals from the sensors providing an indication of the physical and/or chemical parameters.

In one embodiment the safety device 100 receives fluid from the well annulus or production flowline at the conditions in the well-annulus or production flowline. In this embodiment the sensors comprise pressure and temperature sensors. Although some fluid is received from the annulus or production flowline through the inlet 110, only a small amount is received and no through path or pressure reduction device is included such that the sensing is performed at pre- bleed or effectively in-situ conditions of the well annulus or production flowline. The measurements of pressure and temperature may provide information in themselves regarding blow-out risks and/or well-integrity. However, more information may be obtained by comparison to a history, log, or specification for the well or annulus being sensed. Figure 5 shows the safety device including a database 160 such as a log of historical data from the annulus of well.

Comparison with the historical data will give an indication if the pressure and temperature are changing and the magnitude of such changes. This in turn gives an indication of the current well-integrity status. Comparison to a specification provides information regarding whether measured parameters are outside expected limits, thereby also giving an indication of the risk of blowout arising from a lapse in the integrity of the well.

Additional information on the well-integrity status may be obtained by performing the measurements on more than one annulus (and/or the production flowline) in combination with one or more annuli. A comparison of these

measurements may provide an indication of which well barrier has an integrity breach.

More information on the use of the in-situ pressure and temperature measurements is given in the section "Surface Temperature Information/Triggers" later in this document.

In figure 2, the analyser 130 receives the signal from the sensor(s) and performs an analysis according to the above methods and provides an output. The output may take a number of forms. The output may preferably be a graphical and/or tabular output. In a detailed embodiment as shown in figure 3, all of the sensed data and analysis may be supplied to a control room 140 which may be remotely located. In addition the graphical and/or tabular output generated based on the results of the analysis may be supplied to the control room. The data, analysis and output or report may be communicated to the control room via wired or wireless link. More preferably, the results of the analysis alone are output or communicated to the control room. In a simpler embodiment the safety device itself includes a visual output indicating a status. The visual output may be a screen, for example showing the graphical/tabular output, or may simply be lights indicating safe or unsafe operation. In both detailed and simple embodiments the safety device may initiate an alarm if unsafe well operation is detected, and/or a warning alert if well operation is deteriorating. The alarm or alert may be provided at the safety device itself. Alternatively, and as shown in figure 3, the alarm or alert 150 may be provided in the control room 140 based on a signal from the safety device.

The analyser may be implemented by incorporating a suitable computing apparatus in the safety device. An example of a suitable computing apparatus is shown in figure 19. The computing apparatus 500 may comprise one or more processors 510, working memory 520 such as RAM associated with the processors, optionally non-volatile storage 530 such as disk drives. As mentioned above, a visual output may be provided comprising a display screen 540. This in combination with a keyboard 550 and/or pointing device 560 may provide a graphical user interface.

The present invention is preferably implemented by connection to, or communication with, one or more wellhead annulus bleed ports. In this preferred arrangement the apparatus is envisaged to be used on wellheads where access to one or more, or preferably, all wellhead annuli ("A, "B", "C" and "D" annulus, if provided) is possible. Without access to all wellhead annuli within a well system, it will not be possible to perform bleed off operations on all of the 4 annuli, and thereafter determining the collective well integrity status of the entire well system based the chemical and/or physical properties and fingerprinting analysis.

Furthermore, any wellhead system without any annuli access will not allow the installation of pressure and temperature gauges within or external to the wellhead. Without this pressure and temperature sensing and monitoring capability on the annulus, it will not be possible to determine if the annulus MAASP has been exceeded, or if there is presence of Sustained Casing

Pressure (SCP) risk.

In general, surface wellhead systems permit access to all wellhead annuli. Surface wellhead systems are typically applied in onshore land wells and offshore fixed installation wells. Offshore fixed installation wells can be drilled from jack-up rigs and/or drilled and produced from fixed platform installations. Any surface wellhead systems on onshore land wells are typically located on the surface ground level. Any surface wellhead systems on jack-up rigs or fixed platform installations are typically located on the rig/platform level above the sea level.

Conversely, subsea wellhead systems generally only permit access to the "A" annulus. Subsea wellhead systems are located on the seabed below the sea level. Due to the complexity of the subsea environment, subsea wellhead systems are designed to meet the specific subsea requirements of producing and monitoring these subsea wells. Hence, the design of subsea wellhead systems is significantly different from surface wellhead systems.

Figure 20 shows an example subsea casing and wellhead configuration.

The production, intermediate and surface casings are all housed within a high pressure housing with an inner diameter designed with a landing shoulder located in the bottom section of the wellhead body. Subsequent casing hangers land on the previous casing hanger installed. Individual casings are suspended from each casing hanger top, and accumulate upwards within this high pressure housing. Based on the figure provided, the respective annuli are annotated against the various casings and wellhead. Where the casings terminate at the subsea wellhead, it can be observed that there are no wellhead annulus outlets available for a typical subsea wellhead system. No "A" annulus is shown on this diagram because the production tubing is not available. The "A" annulus envelope comprises the production tubing and the production casing. Figure 21 shows an example surface wellhead and casing configuration. Individual casings are landed and sealed within a flanged wellhead spool section after each casing string has been run, cemented and set. Bored through each wellhead spool section is an annulus outlet capable of providing direct access to the contents between the previous and current casing strings. No "A" annulus is shown on this diagram because the production tubing is not available. The "A" annulus envelope comprises the production tubing and the production casing. In this example there is no "D" annulus outlet. However, for wells with more casing strings installed, it is possible to have a "D" annulus wellhead outlet.

Hence, in summary surface well heads have more accessible wellhead annuli than subsea wells, making the present invention particularly suited to surface wells.

Figure 6 is a block diagram of an embodiment of the present invention. The diagram of safety device 200 is arranged to perform physical and/or chemical analysis on fluids preferably bled from a well-annulus or alternatively (or additionally) production flowline. The embodiment shown in figure 6 also includes pre-bleed measuring sensors 120' which are similar to the sensors 120 of figure 2. Hence, the embodiment may also include the sensing and functionality related to in-situ or pre-bleed sensing. The focus of this embodiment is physical arid/or chemical analysis of bled fluids. The embodiment may or may not include the pre-bleed measurements, although they are shown in figure 6 and contribute to the understanding of the well status. Hence, the focus of the embodiment of figure 6 differs from the embodiment of figure 2 in that the sensing and analysis is primarily focused on bled fluids. The bled fluids are at a different pressure and/or temperature to those in-situ which are used by the safety device of figure 2 for measurements.

The device of figure 6 bleeds fluids preferably from the well annulus to which it is connected. After bleeding, the fluids are transferred to a pressure reduction unit (not shown in figure 6) to reduce the fluid pressure such that physical and/or chemical analysis can be performed. After completion of the pressure reduction the fluids are input to the post-bleed analysis unit 201. In some scenarios the fluid pressure may be such that pressure reduction is optional because it is not required or it may be provided externally to the safety device.

In the post-bleed analysis unit 201 the pressure and temperature are measured by sensors 220. The measurement of pressure at this point performs a number of functions, such as i) confirming that the pressure has been reduced to the expected value, and ii) provides information for any sensors that are temperature or pressure sensitive to allow a calibration factor to take account of the pressure and/or temperature. After the pressure and temperature

measurements have been taken measurements of other physical parameters are taken by sensors 225. The sensors may include sensors to measure viscosity and density. Subsequently the sample is filtered by filter 240 to remove solid particles which could damage further sensors. The sample fluid may comprise a mixture of liquids and gas. The liquids may include water-based and oil-based liquids. Separator 250 performs separation of the fluids into the three

constituents: i) gas; ii) oil-based liquids; and iii) water-based liquids. In a preferred embodiment the gas is first separated from the liquid, and then the oil and water based liquids are separated from each other.

The water-based liquid, oil-based liquid and gas are transmitted to respective sensors 260, 262 and 264. The respective sensors may include sensors to determine the chemical composition of each component and sensors for determining further physical parameters. The compositional sensors may include spectrometers, interferometers, and/or solid state sensors. The additional physical parameters measured may include density and viscosity for oil-based liquids, and density, viscosity, alkalinity, salinity, pH, and resistivity for water- based liquids. Alternatively, the sample may be flushed to the well's safe drain system.

After sensing by sensors 260, 262, and 264, the sample is transmitted to disposal system. The sensors or the whole of the safety device may also be flushed at this point to remove residual parts of the sample prior to analysing the next sample. The disposal system may also receive any of the flushed residual sample. The disposal system may store the sample for manual disposal. Analyser 230 receives signals from post-bleed pressure and temperature sensor 220, sensor for other physical parameters (density viscosity) 225, sensors for water-based liquids 260, sensors for oil-based liquids 262, sensors for gas analysis 264, and optionally 120' indicative of the measured results from the sensors. The analyser performs analysis on the results to provide an indication of well-integrity and/or blow-out risks, preferably through the generation of a graphical and/or tabular output.

The analyser may include a number of different approaches for analysing data from the sensors to arrive at an evaluation of blow-out risk and/or well integrity status. These different approaches can be summarised as:

i) comparison to historical data stored in the database;

ii) matching to a library of compositional data;

iii) comparison of measured data to specification for the well or annuli; iv) comparative analysis between related annuli (and/or flowlines); and v) forecast analysis for potential impending failures.

The comparison to historical data may, for example, be the comparison of measured values of pre-bleed pressure or temperature for a particular well- annulus over a period of hours, days, weeks or months. A comparison may be performed by a trend-line analysis to look for increasing pressure, such as unexpected or sudden increases, or slow increases over longer periods of time.

The historical analysis may also be used in the preparation of forecast

information, such as by forward extension of trend-line analysis. This is one particular example of how the approaches above interact. The approaches should not be considered as separate but they may be linked together and used simultaneously.

Matching to a library of compositional data will be of use when

compositional analysis has been performed on the gas or liquid phases of the sample. The library may include pre-populated spectroscopy data for common and less common constituents found at the well surface, in the well at sub- surface, may include indicators of surrounding formation composition, and also may include indicators relating to the composition and properties of drilling and completion fluids, such as may be introduced during well construction. The analysis may determine if particular compositions exceed expected levels in a particular well or annulus which could indicate failure of a well barrier. The analysis may also highlight compounds that are normally found in a flowline or annulus that are found elsewhere indicating barrier breach.

Comparative analysis between related annuli (or flowlines) allows the determination of failures in barriers between annuli (and flowlines) for a given well. The comparison may be aided by knowledge of pressures and temperatures in the respective annulus (or flowline) which could give an indication of the driving direction of forces on either side of the barrier. This would allow the direction of flow of certain components to be mapped to the actual compositional data.

Comparative analysis can also be extended to nearby wells operating in the same oil field to compare irregularities in composition. The comparative analysis is not limited to compositional data but can also be used for physical properties such as pressure and temperature to gain an indication when a particular annulus (or flowline) is being affected by an adjacent one.

Figure 7 shows a specific embodiment of a safety device. The safety device may be a portable device which is sufficiently compact and light weight to make it transferrable to any remote location by vehicle, helicopter, boat, or plane and be compact enough to be permanently attached to the surface wellhead. The safety device shall be connected to at least one of the well's annuli (and/or flowline) via existing outlets on the wellhead to collect samples, see figure 4 for a preferred device attachment option. The annuli (or flowline) pressures and temperatures are measured prior to any bleeding of the annuli (or flowline) fluid. The same measurements are repeated after bleeding and upon collection of the fluid sample. After bleeding and collection of a sample, the fluid is transferred into a pressure reduction unit. After pressure reduction further physical parameters are measured. These include density and viscosity. The sample itself is filtered to remove any solid particles which can damage the sensors and other sensitive micro equipment of the safety device. After filtration the sample is transferred into a separator, which separates gas from fluids first, after which it separates oil and water. In one example, the separator may be a microfluidic separator.

Alternatively, or in combination with the microfluidic separator, other types of separator may be used. The gaseous part of the sample is pumped to a spectrometer for composition analysis. The spectrometer may be a multi-channel Fourier transform infra-red spectrometer. The water and oil-based liquid parts are pumped onto a sensor board to perform testing which analyses their properties. The sensor board may comprise of MEMS sensors. Alternatively, in combination with the MEMS sensors other types of sensors may be used for the same purposes. Once analysis is completed, samples are flushed into a disposal unit. The flushing process which includes a rinse through of the sensors to remove any residue of the samples is preferred so that the sensors are left clean for subsequent use. The samples are discarded into the well's safe drain system. Alternatively, the samples may be stored for future retrieval.

The data obtained by the safety device from its sensors and spectrometer is transferred to a data acquisition unit where it is analysed. Using the results of the analysis, a display, report, or other graphical or tabular indication of the analysis is generated. Alerts or alarms relating to the outcomes of the analysis are also generated. The combination of the display or report and alerts together provide comprehensive information about well barrier integrity status, and optionally related blow-out risk.

The safety device, such as shown in figure 7, contains a number of modules for performing the fluid analysis. The first module is the separator and is shown in more detail in figure 8. The embodiment of figure 8 is a microfluidic separator which consists of a membrane having a porous part. However, alternatively other types of separator may be used. In figure 8 the membrane is supported by a microsieve. The porous part of the membrane is wetted by one fluid or fraction of the sample, which is able to be transmitted through the pores due to its ability to wet the membrane surface. The other fluids or fractions are transferred for further separation. The membrane's composition will determine the separator's transmitting capabilities. For example, the membrane may be manufactured using an oleophobic material in order to be able to transmit water- based solutions or components, or it may be manufactured from hydrophobic material in order to transmit oil-based solutions or components. Both of these types of membrane may be used to transmit gases. One of the principles of microfluidic separator operation is that the pressure across the membrane surface is maintained below the capillary breakthrough values of the second, "non-wetting" fluid. The flow rate is maintained such that the flow rate through the membrane is significantly less than the flow rate across the membrane in order to prevent the membrane from fouling.

The separator is connected to the fluid inlet and may include several valves (where required), and a micropump to ensure fluid flow through the separator and control the pressure across the membrane surface. The separator separates the sample annulus (or flowline) bleed fluid into three substances: gas, oil and water in order to perform real-time testing and measurements for each of the three phases.

The second module in the safety device is the spectrometer. An example of a suitable spectrometer is a MC FTIR spectrometer (Multi Channel Fourier Transform Infra-Red spectrometer) such as shown in figure 9. Other types of spectrometer or composition analyser may alternatively be used. An example of an MC FTIR is provided in "Multichannel Fourier-Transform Interferometry for Fast Signals", S. P. Heussler et al., Optics Express, Vol. 19, No. 13, p12628- 12633, 2011. After the fluid sample has been separated, the gaseous part is transferred to the spectrometer chamber for composition analysis. The

composition analysis measures the amounts of C1-C12, O2, CO2, H2S.

Additionally, the amounts of other compounds or elements may be measured. The analysis allows the tracing of formation compounds in the well's annuli (or flowline). It can also be used for identifying different annuli fluids mixing with each other, which could indicate potential threats to well barrier integrity and possible blowout risks.

The MC FTIR spectrometer shown in figure 9 uses multi-mirror array technology. This technology is described in "Single-Shot-Capable Fast

Multichannel Fourier Transform Interferometer based on Microfabricated 3D

Multimirror Array", Moser et al., Micro-optics, Proc. Of SPIE, Vol. 8428, 2012. Conventional Fourier transform interferometry uses mechanical scanning interferometers (e.g. Michelson type), which are characterized by one scanning mirror. The disadvantage of this technology is it is incapable of measuring fast signals. The multichannel Fourier transform infrared spectrometer of figure 9 is capable of single-shot operation even for fast signal pulses. This is due to the large number of non-moving mirrors on a single chip instead of having a single moving mirror. Another advantage of the MC-FTIR is its size which facilitates use in field applications. In the current application the MC-FTIR spectrometer may be used for measurement of gas, as well as water and oil composition, detection of H2S, C02 and other hydrogen- and carbon-based components.

Additional detail of the optical arrangement of the MC-FTIR is shown in figure 10, which comprises an optical source, collimating and focussing optics to focus a light beam in the sample and then re-collimate the light onto a multi- mirror array and on towards a detector array. The multi-mirror array imparts a stepwise varying optical path difference from different parts of the MMA. The light beam is refocused after reflection from the MMA, and subsequently passes through an aperture on to detector array. The MMA introduces the phase variation required for interferometric analysis. The MC-FTIR has a number of advantages which are particularly suited to the current application.

i) Time to scan the interferogram. The MC-FTIR spectrometer uses a single beam pulse and hence it requires less time to scan the interferogram of the sample. Spectrometers require that during scanning the incoming beam has a constant and uniform intensity, which can be difficult for field use when a moving mirror is used as in conventional spectrometers. The fixed mirror of the MC-FTIR overcomes this problem. Operational speed is also important as the less time required to perform the test, the faster results are produced and the faster realtime knowledge of a situation in the well is updated. It is important to have results as soon as possible, for example when presence of hydrocarbons in the annulus is suspected.

ii) Simpler scanning optics. The scanning optics of interferometers normally requires high precision motion control and any wobbling of the scanning mirror would affect the results of the analysis significantly. They also may require additional tracking devices (such as a laser which tracks the mirror movement), which adds to the complexity of the system. The fixed mirror of the MC-FTIR has no movement and so eliminates this problem.

iii) Allows use in field conditions. Normally single-mirror spectrometers are highly sensitive to vibration as it may affect the sensitive scanning optics and moving parts inside the device. The multi-channel FTIR spectrometer does not have moving parts; hence, it is much more resistant to shaking and vibration, which are unavoidable at the well site.

iv) No need for amplitude beam splitter. In normal spectrometers around 50% of the probing beam energy is lost because even a perfect beam splitter sends back the probing beam to the source. In MC FTIR spectrometer a wavefront beam splitter is used, which allows for efficient interferogram

modulation and environmental stability. Simpler optics allows for more intensive use of the device, provides a more compact size (which is efficient for transport of the device to remote locations by helicopter and hand-held), lighter weight and less costly setups.

The third module of the safety device is the sensor board or sensor array, such as shown in detail in figure 11. The sensor board analyses water and oil properties, including but not limited to:

- density and viscosity for oil; and

- density, viscosity, alkalinity, pH, resistivity and salinity for water.

Figure 11 shows a schematic of the sensor board having two layers. The top layer may be for sensing of oil-based liquids. The bottom layer, which has more sensor elements, may be for sensing of water based liquids. Sensors can be any type of microsensors or MEMS or any combination thereof, which suit the purpose of measurement. For example, for pH sensing an ion-sensitive field effect transistor (ISFET) may be used. For measuring viscosity and density of the sample, an example can be a resonant MEMS microsensor with a thin top plate vibrating at resonance in its first bending mode could be used. To measure salinity of the sample, an example can be a microsensor with micro electrodes or system with liquid crystalline polymer to measure conductivity and calculate salinity might be installed. Resistivity can be calculated by measuring conductivity of the sample, which could be performed by an example sensor such as Micro-

Varicon Dielectric/Conductivity Sensor.

After the sample has been analysed, it is transferred into a flushing unit, where it is safely stored for further disposal. Another option is that after bleeding the sample is transferred directly into a storage container without analysing, and is held there for future laboratory tests as and when required. The storage container can be a removable type in the case where a sample must be transferred to remote locations for analysis.

The data obtained by all systems are transferred into a data acquisition unit, which is part of the analyser. The data may be stored in memory such as in

RAM or on a non-transitory storage medium. The analyser processes the information and performs detailed analysis of the current barrier integrity status.

The analyser produces a graphical/tabular output based on the results of the analysis. The data acquisition centre uses the information obtained from the sensors in order to:

• Monitor the condition of well's annulus such as based on bleed fluid(s);

• Monitor the change in trace chemicals or elements such as H2S, C02;

• Monitor the change in gas/oil composition;

• Analyse the current state of the well's integrity;

· Predict possible issues with well integrity and analyse possible cause of abrupt changes in monitored values (well's walls perforation, leakage, etc.);

• Provide a graphical/tabular output which may be in the form pf report showing results of the analysis, confirming the well integrity status and current blowout risks; and/or

• Flag/provide alerts to a possible loss of integrity and blowout condition. The data acquisition module comprises a system for data processing and analysis. The module collects data from multiple sensors and processes and analyses it using algorithms developed for this device. The module generates a detailed report about a well's integrity status and blowout risk indication, such as in the form or a graphical/tabular output, which will allow real-time trending, optimization of well's operation and control and prevention of potential blowout risks. The results of the analysis provide:

• A display of the data obtained: numerically and graphically, with the

possibility of a built-in touch-screen display. The graphical data will use the information obtained during previous sampling in order to show the trends in the well's operation and integrity status;

• Log/store historical data;

• Interpret, model and analyze the data;

• Generate detailed graphical/tabular outputs in the form of reports;

· Export data in format preferred by end user: pdf, MS Word (RTM), Excel (RTM), etc.;

• Trigger alarms in case dangerously high or low values of measured

parameters are detected, or calculated blowout risks exceed safe margin;

• Allow prediction of selected values for further measurements; and/or · Propose possible ways of well integrity optimization and blowout risk

prevention.

The data acquisition module may also comprise tools for data transfer onto external devices, such as USB, Serial Port, Ethernet cable, WiFi module, and 'cloud storage' options. It may also have firmware for the device control and operation as well as an efficient graphical user interface and efficient calculation capabilities. The device should be able to operate using batteries, solar power or AC/DC as well as pneumatic power (including natural gas). As discussed above, the data acquisition module may comprise a realtime system to analyse data and provide a graphical/tabular output for the end user to take action on well integrity issues and blowout prevention. This system may be connected to the analyser and/or sensors via cables, WiFi, wires or other modes of connection allowing data exchange. This system may be combined with several units to receive data from all of them and perform analysis to provide a combined output. For example, the system may gather data from several wells located nearby (each well having an apparatus attached to its respective wellhead) and identify overall trends common to the nearby wells. The system may be able to analyse those trends and may provide a graphical/tabular output corresponding to those trends.

The said system may consist of several modules allowing users to set up projects and a model of the well(s)' architecture, populate the library with reference fluids including their composition and properties, view data gathered from different apparatuses attached to different wells, and view the

graphical/tabular output provided by the system corresponding to those wells.

For example, in one embodiment, the system may have a first module

(which we refer to as the "Project and Security" module) where a user inputs data regarding the respective well(s) corresponding to the location, site or project. An example of this is shown in figure 22. The user inputs and stores information defining the well such as the well's geological data, total depth of the well, casing and cementing details, completions details (in case the apparatus is installed onto a producing well) or suspension details (in case apparatus is installed on the suspended or abandoned well). The system may allow setting up security to define allowed users and their permissions to control the system. User profiles are also stored in this module which may consist of personal and contact information; i.e. name, e-mail, phone number and role based permissions associated with any particular user. User roles with different permissions may be defined within this system. For example, in one embodiment, the administrator role can be assigned to a senior engineer who has a user profile within the system. The administrator role may allow him to set up projects and wells accordingly within the system and create other users and roles and assign such roles to other users. The administrator may also have unlimited access to other modules. The system may also allow setting up user-specific alerts for situations when the well integrity has been compromised. The type of user-specific alert may also be set up. For example, certain users may be alerted via SMS and certain users may be alerted via email or another type of pre-defined alert message. In one embodiment, levels of priority may also be assigned to alerts. For example, in the case of a severe well integrity compromise on a well, a priority level of 1 is assigned and the alert is sent out to the senior staff via a distribution list pre-defined in the "Project and Security" module. In case of minor issues or regular reporting, a priority level of 5 may be assigned and the alert sent out to the staff assigned to monitor the condition of the well on a regular basis.

The system may have a library module which may contain information on reference fluids and their properties, formations and their properties, casings, cementing data and/or other related information which may be used for further analysis and generation of the graphical/tabular output. Most importantly, the library may include pre-populated spectroscopy data for common and less common constituents found at the well surface, in the well at sub-surface, may include indicators of surrounding formation composition, and also may include indicators relating to the composition and properties of drilling and completion fluids introduced during well construction. The library module may be populated by the users assigned to an administrative role and/or by users specifically assigned to the library control only. The system may be able to self-populate the library automatically with the new data gathered from existing wells.

The system may contain a "Raw data" module containing sample composition and properties information gathered from sensors and other sensing devices on apparatuses installed on different wells. This information may include: pressure and temperature data acquired by the pressure and temperature sensors installed on respective or annulus ports, composition data from the respective wells acquired by sensors/spectrometers/other sensing devices. Users may have access to the most recent bleed data and historical ones as well.

The system may contain an "Analysis" module which may display information gathered after analysis of the data which may be performed by the analyser. The "Analysis" module is shown in figures 23, 24, 25, 26 representing some possible embodiments of the invention. The analysis module may perform MAASP calculations as per the method described below, provide graphical outputs depicting trends in the system (pressure, temperature and composition changes), compare the results to the respective fingerprints stored in the library based on the parameters identified and, from this analysis determine the current well integrity status and blowout risk based on this status. An example display of the MAASP calculation output is shown in figure 23. Figure 24 shows an example of the display resulting from sustained casing pressure (SCP) risk analysis, such as after recording two sets of bleed-off data. Figures 25 and 26 respectively show a display illustrating the results of fluid analysis and gas analysis.

In another embodiment, the system may monitor several wells located nearby and the information about these wells could be stored in the system under the same project to allow cross-monitoring of the wells. For example, rising levels of H2S on several wells could be identified by the system and collectively reported. Subsequently an alarm could be triggered to take immediate action in case such trends are identified by the system.

In one embodiment, the system may contain a "Reporting" module which would produce graphical/tabular outputs for the end user. The graphical/tabular output provided by the system may contain and is not limited to:

- General information about the well such as the location,

completion/production details, duration in days of well monitoring, etc.

- Status of the well

- Schematic of the well

- CasingTdata, cementing data

- Installed equipment details

- Type of system/apparatus installed on the well

- Raw data gathered from the sensors

- Results of the analysis performed by the system, which may include graphical trends produced by the system, warnings and alerts based on the results of the analysis

- System recommendations on restoring well integrity and eliminating blowout risks should the well integrity be identified as compromised

The report produced by the system may be distributed to a pre-defined list of users stored in the system. Depending on the well integrity status identified by the system, the reports may be assigned a priority label. The priority label which is contingent on the well integrity status is used to determine the recipients for the report. To illustrate the point further, if the well integrity is compromised and the consequent blowout risks identified as high, the report would be assigned priority level 1 and distributed to senior management and key engineers in order to raise full awareness on the critical status of the well. On the other hand, if the well integrity is validated, a priority level of 5 may be assigned to the report and distributed only to frontline operations personnel assigned to monitor the well condition on a regular basis.

From the description provided above, the steps described above may be performed on appropriate computer hardware and may store information, execute the methods and provide graphical/tabular results described herein. This hardware may be a part of the analyser and the methods may take the form of the algorithms executed by the software. The programs and algorithms may be stored on the storage device included in the computer system. These algorithms and rules may include programs to perform calculations as per the methods described below in this document, to issue a command to perform additional measurements on a certain well, to issue an alarm, to display/send/issue a graphical/tabular output via other devices.

associated with a well-integrity alert or blow-out alarm. In one example, if the annulus pressure is greater than a threshold value as flagged by the apparatus or method, there will be a final step of being able to control the annulus pressure such that it becomes lower than the threshold value. Optionally the apparatus or method may determine a link between a parameter which is close to, or has exceeded, a threshold value for an alert or alarm and may instruct a user of appropriate action to be taken. For example, instead of the method or apparatus automatically controlling the parameter such as by opening or closing a valve, an instruction such as "bleed off pressure of annulus" may be output.

In general, this system operates based on the data retrieved from the sensors or other sensing devices assembled within the apparatus, as shown in figure 27. Multiple safety apparatuses may be connected to an analysis unit which may perform the functions set out above and receive inputs from a user interface. The hardware carrying out the instructions performed by the system may be physically connected to the sensors via wiring and/or cables, or it may receive the data via other modes of communication such as wireless internet. Steps of the method of the invention are set out in figure 28. The user interface and other components described in this document, can be implemented on a computer, network or other apparatus capable of performing the functions described in the method of figure 28. No limitation is imposed onto the

programming language to create the software based on this method.

Depending on the well type and platform/installation set up, the safety device may be configured to tie into any existing electronics infrastructure whereby the flow of information can result in the trigger of local audible alarms at or near the well site, for example if there are dedicated operators monitoring production in a control room or equivalent.

The safety device of the present invention and corresponding method are especially suitable for measuring fluid properties and will provide personnel with real-time analysis to help determine the well integrity condition for any well, to help mitigate the risk associated with annular pressure build-up, to minimize production down-time and to support well integrity management analysis by expediting annular fluids tests which are critical for well diagnosis and blowout evidence. Another capability of the device and method in one embodiment is the real-time analysis of a multi-phase fluid. A sample is taken by the device at the surface directly from the well, directing all the individual phases of the liquid into the sensor analysis system which includes an array of sensors and a

spectrometer system. A MC-FTIR spectrometer measures the properties of gas and oil fluid phases, the analyser processes the measurement results, analyses it and produces a report in the form of a graphical/tabular output. The resulting data can be transmitted from the oil-well or rig where the analysis is being performed to any other desirable remote location.

Analyser

The analyser or data acquisition module is a key element of the safety device. Although described herein with reference to being part of the safety device, the analyser could be used separately for example on data obtained from manual testing of annuli fluids (and/or flowline fluids). For example, the analyser could be implemented as computer program code arranged to put aspects of the invention into effect when executed on suitable computer apparatus. Such computer program code may be stored on one or more computer readable media, transmitted as a signal over a network, and provided in other ways familiar to the skilled person.

The analyser is configured to provide a detailed and comprehensive report on the condition of well barriers. The analyser software takes into account the properties measured by the sampling and testing units. A change in the values of these properties can reflect transient processes occurring in the wellbore, which may result in failures of well barrier integrity.

As discussed above, the annuli fluids are separated into three phases (gas, water and oil) and directed to different sensors in order to measure various chemical and physical properties. The output, which is sent to the analyser, is compared to existing information about known fluids' compositions and their properties. The safety device stores a library of existing fluid properties and compositions, which are compared to the output of the sensors to generate fingerprinting results of the fluid. Also, the system may store historical data of the particular well in order to track changes of various fluid properties over time, identify potentially dangerous changes (unexpected build-ups, dropdowns, excess fluctuations of values) with respect to the particular well and perform continuous analysis of well-barrier integrity in time.

The 'fingerprinting' results are analysed in conjunction with other data such as pressure reduction/build-up and temperature changes in order to determine both the blowout risks and detect the likely source of the problem. The results from this analysis can be used to trigger alarms in real-time when necessary, in conjunction with generating a well-integrity report for management personnel on both site and remote bases respectively.

The analyser includes algorithms for calculating various scenarios with the well, such as barrier integrity failure, pressure build up, and valves in wrong positions. Examples of the algorithms and expertise embedded in the analysis module to allow identification of a fault, impending fault, or natural change, include:

surface pressure information/triggers;

bleed pressure build-up profiles and rates;

surface temperature information/triggers;

density information/triggers;

alkalinity, pH, resistivity and salinity information/triggers;

hydrogen sulphide information/triggers; and

gas information/triggers.

We now provide more detail regarding how each of these might be implemented. a. Surface Pressure Information/Triggers

Pressure build-up or reduction in one or more annuli can be due to several reasons:

• Intentional pressure build-up by the well operator to increase pressure in one or more annuli; • Communication of an annulus with a pressure source, such as reservoir, lift gas, water injection or shallow over-pressured zones (for example, due to hydrocarbon migration or changes in the formation overburden); and/or

• Temperature changes that occur within the well that create thermally

induced pressure.

Communication with a pressure source can happen due to one or more of these reasons:

• Loss of cement integrity;

0 · Hanger seal failure;

• Loss of formation integrity including: depletion collapse, excessive

injection pressure, etc.;

• Casing, liner, tubing degradation as a result of

corrosion/erosion/fatigue/stress overload;

5 · Valves in wrong position;

• Loss of tubing, packer and/or seal integrity; and

• Annulus crossover valve leak in a subsea Xmas tree.

Any unexpected change of annuli pressure (increase or decrease) may o signal a loss of well barrier integrity. This is why it is important to constantly

monitor pressures and analyse their behaviour.

For every annulus a maximum allowable annulus surface pressure

(MAASP) can be determined. MAASP, is the greatest pressure that an annulus is permitted to contain, as measured at the wellhead, without compromising the5 integrity of any barrier element of that annulus. The analyser is configured to calculate MAASP automatically depending on the specific condition of a well it is installed on. This is preferably according to international standard ISO TS 16350- 2:2013(E). MAASP shall be recalculated each time if:

• There are changes in well barrier acceptance criteria (for example, o reduced casing wall thickness due to long term degradation that will

reduce its burst and collapse ratings, or intentional changes in equipment such as a replacement blow-out-preventer, Christmas tree or well head installed with different pressure rating);

• There are changes in the service type of the well (for example, an existing oil producing well will be converted in a water injection well);

· There are annulus fluid density changes;

• Known tubing and/or casing wall thickness loss has occurred; or

• There are changes in reservoir pressures outside the original load case calculation. The analyser is provided with the following information, if applicable, before calculating MAASP:

• Maximum pressure to which the annulus was tested;

• Details of the mechanical specifications, such as liner thickness and

pressure ratings;

· Details of as-constructed well (for example, all installed casings, their dimensions and installed depths);

• Details of all fluids in the annulus (density, volume, stability) and in

adjacent annuli or tubing;

• Details of casing cementation, such as cement tensile and compressive strength performance;

• Details of formation strength, permeability and formation fluids;

• Adjustments for wear, erosion and corrosion, which should be considered when determining the appropriate MAASP to study; .

• Details of surface-controlled subsurface safety valve (SCSSV) control line actuation pressures; and

• When pressure devices are installed in a casing.

The analyser calculates MAASP automatically as per ISO TS 16350- 2:2013(E), depending on which annulus it is connected to. A well may comprise many annuli. The A-annulus would be the annulus between the production tubing and production casing, for example as shown in figure 12. The production casing may be surrounded by one or more further casings. The B-annulus is the annulus between the production casing and the next outer casing, for example as shown in figure 12.

Each annulus may have numerous points at which the MAASP may be calculated. The MAASP may vary as parameters used in the calculation vary.

Figure 12 shows examples of two different A annuli for calculating MAASP. The first example is shown as case 1 , and has long string production casing. The second example, shown as case 2, has a production liner.

There follow some examples of calculations for the A annulus as per ISO TS 6350-2:2013(E) (see figure 12):

1 . The safety valve collapse MAASP (see point 1 in figure 2) may be calculated using equation 1 :

PMAASP ⁼ Ppc,sv ~ [DTVD,SV ' (V¾G,A ~

Equation 1 where PMAASP is the maximum allowable pressure for the safety valve at highest MG (mud gradient) in the annulus or lowest MG (mud gradient) in tubing, Ppc.sv is casing collapse pressure resistance subject to safety factor of safety valve, DTVD.SV is the true vertical depth of the safety valve (relative to the wellhead and not the rotary Kelly bushing), VPMG.A is the mud or brine pressure gradient in the A annulus, and VPMG.TGB is the mud or brine pressure gradient in the tubing.

2. The accessory collapse MAASP (see point 2 in figure 12) may be calculated using equation 2:

PMAASP ⁼ PPC,ACC ~ [DTVD.ACC '

Equation 2 where PMAASP is the maximum allowable pressure for the accessory at highest MG (mud gradient) in annulus or lowest MG in tubing (as for equation 1 ), PPCACC is the casing collapse pressure resistance subject to safety factor of accessory, DTVD.ACC is the true vertical depth of the accessory (relative to the wellhead and not the rotary Kelly bushing), VPMG.A is the mud or brine pressure gradient in the A annulus (as for equation 1 ), and VPMG.TGB is the mud or brine pressure gradient in the tubing (as for equation 1 ).

3. The packer collapse MAASP (see point 3 in figure 12) may be calculated using equation 3:

PMAASP ⁼ PPC.PP ~

Equation 3 where PMAASP is the maximum allowable pressure for the packer at highest MG (mud gradient) in annulus or lowest MG in tubing, PPC.PP is the casing collapse pressure resistance subject to safety factor of packer, D_TVD,PP is the true vertical depth of the packer (relative to the wellhead and not the rotary Kelly bushing), VPMG.A is the mud or brine pressure gradient in the A annulus, and VPMG.TGB is the mud or brine pressure gradient in the tubing.

4. The packer element rating MAASP (see point 3 in figure 12) may be calculated using equation 4:

PMAASP ⁼ {PTVD.FORM ^' ^SFSJORM) + PPKR ~ [PTVD,PP ' VPMG,A) Equation 4 where DTVD.FORM is the true vertical depth of the formation, VSFS.FOR is the formation strength gradient at immediately below the packer element in the life cycle, PPKR is the pressure rating of the packer element (it may require de-rating during the life cycle), D_TVD,PP is the true vertical depth of the production packer, and VPMG.A is the mud or brine gradient in the A annulus. 5. For the case where a liner is included (see case 2 of figure 12) the liner element rating MAASP (see point 3, case 2 of figure 12) may be calculated using equation 5 which is similar to equation 4: PMAASP ⁼ {PTVD.FORM '

Equation 5 where D_TVD,FO M is the true vertical depth of the formation, VS_FS,FOR is the formation strength gradient at immediately below the liner element in the life cycle, PLE is the pressure rating of the liner element (it may require de-rating during the life cycle), D_TVD,PP is the true vertical depth of the liner, and VPMG.A is the mud or brine gradient in the A annulus.

6. The liner hanger packer burst rating MAASP (see case 2, point 4 in figure 12) may be calculated using equation 6:

PMAASP ⁼ PPC,LH ~ [D_TVD,LH ^■ ( _MGLA - VP_BF,_B)] Equation 6 where PPC.LH is the casing collapse pressure resistance subject to safety factor of liner hanger, D_TVD,PP is the true vertical depth of the liner hanger (relative to the wellhead and not the rotary Kelly bushing), VPMG,A is the mud or brine pressure gradient in the A annulus, and VP_BF,B is the base fluid pressure gradient in the B annulus. B annulus is the annulus between the production casing and the next outer casing. Base fluid is assumed on the basis that the residual mud in the B- annulus has decomposed. It can be necessary to substitute this gradient for a formation pressure under some circumstances.

7. The tubing collapse MAASP (see point 5 in figure 12, for case 1 and case 2) may be calculated using equation 7:

PMAASP — PPC,TBG ~ \PTVD,PP '

Equation 7 where PPC.TBG is the casing collapse pressure resistance subject to safety factor- of tubing, VPMG.A is the mud or brine pressure gradient in the A annulus,

VPMCTBG is the mud or brine pressure gradient in tubing, and DTVD.PP is the true vertical depth of the packer (relative to the wellhead and not the rotary Kelly bushing). It can be necessary to adjust depth of the tubing for other depths relevant to check (for different tubing weight/sizes, etc.).

8. The formation strength MAASP (see point 6 in figure 12, case 2) may be calculated using equation 8:

PMAASP = D_TVDISH · ( S_F - VPMG,A) Equation 8 where DTVD.SH is the true vertical depth of the casing shoe (relative to the wellhead and not the rotary Kelly bushing), VPMG.A is the mud or brine pressure gradient in the A annulus, and VSFS.A is the formation strength gradient subject to annulus A.

If the cement quality in the liner lap and annulus is uncertain, then the liner hanger rating would be used.

9. The outer (production) casing burst MAASP (see point 7A, case 1 in figure 12), may be calculated using equation 9:

PMAASP ⁼ P ΡΒ,Ρ - [D_TVD,LH · {VPMG,A - VPBF,B)] Equation 9 where ΡΡΒ,Ρ is the casing burst pressure resistance subject to safety factor of casing, D_TVD,LH is the true vertical depth of the liner hanger (relative to the wellhead and not the rotary Kelly bushing), VPMG.A is the mud or brine pressure gradient in the A annulus, and VP_BF,B is the base fluid pressure gradient in the B- annulus. 10. The outer (production) casing burst MAASP (see point 7A, case 2 in figure 12), may be calculated using equation 10:

PMAASP ⁼ ΡρΒ,ρ - [DTVD.PP ^■ ( PMCA - VP_BF,B)] Equation 10 where P_PB,p is the casing burst pressure resistance subject to safety factor of casing, VPMG.A is the mud or brine pressure gradient in the A annulus, VPBF.B is the base fluid pressure gradient in the B-annulus, and DJVD.PP is the true vertical depth of the production packer (relative to the wellhead and not the rotary Kelly bushing). It can be necessary to adjust depths of packer or hanger (see equation (9)) for other depths relevant to check (for different tubing weight/sizes etc.).

1 1 . The liner lap burst MAASP (see point 7B, case 2 in figure 12) may be calculated using equation 1 1 :

PMAASP ⁼ ΡΡΒ,Ρ - [D_TVD,PP^■ (V MCA - VPBF.B)] Equation 1 1 where P_PB,p is the casing burst pressure resistance subject to safety factor of packer, D_TVD,PP is the true vertical depth of the production packer (relative to the wellhead and not the rotary Kelly bushing), VPMG.A is the mud or brine pressure gradient in the A annulus, and VPBF.B is the base fluid pressure gradient in the B- annulus. It can be necessary to substitute the formation pressure for VPBF.B in some circumstances. MAASP for the wellhead (Figure 12, point 8) equals wellhead working pressure rating. Annulus test pressure is MAASP for the annulus test pressure.

12. The casing rupture disc MAASP may be calculated using equation 2:

PMAASP— PPB,RD [D_TVD,RD ^■ (VPMCA - VPBF.B)] Equation 12 where PPB.RD is the casing burst pressure resistance subject to safety factor of rupture disc, D_TVD,RD is the true vertical depth of the rupture disc (relative to the wellhead and not the rotary Kelly bushing), VPMGA is the mud or brine pressure gradient in the A annulus, and VPBF.B is the base fluid pressure gradient in the B- annulus.

Figure 13 shows examples of two different B annuli for calculating MAASP. The first example, labelled as case 1 , has the top of the cement (TOC) in the B- annulus below the previous casing shoe. The second example, labelled as case 2, has the top of the cement in the B-annulus overlapping the previous casing shoe.

There follow some examples of calculations for the B annulus as per ISO TS 16350-2:2013(E) (see figure 13):

13. The formation strength MAASP (see figure 13, point 1 ) may be calculated using equation 13:

P MAASP ⁼ DTVD,SH,B ^' (VS_FSiB - VP_MGiB) Equation 13 where D_TVD,SH,B is the true vertical depth of casing shoe of the B-annulus (relative to the wellhead and not the rotary Kelly bushing), VS_FS,B is the formation strength pressure gradient in the B-annulus, and VP G.B is the mud pressure gradient in the B-annulus. It is necessary to account for degraded mud, cement spacers and washes.

14. The inner (production) casing collapse MAASP (figure 13, point 2), may be calculated using equation 14:

PMAASP — Ppc,A - [DTVD.TOC ^■ (V _MG,B - VP_WCjA)] Equation 14 where P_PC,A is the A-annulus casing/liner collapse pressure resistance, VP_MG,B is the mud or brine pressure gradient in the B-annulus, VPMG.A is the mud or brine pressure gradient in the A-annulus, and D_TVD,TOC is the true vertical depth of the top of cement (relative to the wellhead and not the rotary Kelly bushing). Depth of the top of cement can be adjusted for other depths relevant to check.

15. The outer casing burst MAASP (figure 13, point 3) may be calculated using equation 15: 0 PMAASP ⁼ Ppc.B ~ [D_TVD,SH · ( PMG.B - VP_BF,c)] Equation 15 where PPC.B is the B-annulus casing/liner collapse pressure resistance, D_TVD,SH is the true vertical depth of the casing shoe (relative to the wellhead and not the rotary Kelly bushing), VPMG.B is the mud or brine pressure gradient in the B-5 annulus, and VPBF.C is the base fluid pressure gradient in the C-annulus.

MAASP for the wellhead (figure 13, point 4) is equal to the wellhead working pressure rating. Annulus test pressure is equal to MAASP. 0 16. The casing rupture disc MAASP may be calculated using equation 16:

PMAASP ⁼ PPB,RD ~ [D_TVD,RD · (VPMCB - V _BF,c)] Equation 16 where PPC.RD is the casing burst pressure resistance subject to safety factor of 5 rupture disc, DTVD.RD is the true vertical depth of the rupture disc (relative to the wellhead and not the rotary Kelly bushing), VP_MG,B is the mud or brine pressure gradient in the B-annulus, and VP_BF,C is the base fluid pressure gradient in the C- annulus. o Figure 14 shows two different C annuli for calculating MAASP. The first example, labelled as case 1 , has the top of the cement (TOC) below the previous casing shoe. The second example, labelled case 2, has the top of cement in the C- annulus overlapping the previous casing shoe.

Calculation of MAASP for the C-annulus and subsequent annuli is same as for B- annulus.

The calculation does not account for any potential loss of fluid to the formation that can change the pressure regime. It is therefore necessary to review the formation permeability and not just the formation strength. b. Bleed Pressure Build-Up Profiles and Rates

There are various possible causes of pressure build-up, which include: i) thermally induced pressure; ii) operator-imposed pressure'; and iii) sustained casing pressure.

Thermally induced casing pressure is the result of thermal expansion of trapped welibore fluids usually caused by differential temperature between static conditions and producing conditions when production is initiated.

The operator also may impose a pressure on the casing annulus for different purposes such as, gas lift, thermal management, etc.

Another type of pressure is sustained casing pressure, which is usually the result of a well component leak that permits the flow of fluid across a well control barrier (tubing connection leak, packer leak, etc.) or because of uncemented or poorly cemented formations and damaged cement.

As per international standards (API RP 90, American Petroleum Institute,

2006; and ISO 165-300, 2013) if the surface pressure build up has been observed (not imposed by the operator), it is necessary to understand, whether these surface pressures are sustained or thermally induced. Hence, it is required to perform at least 2 annuli bleeds with 24 hours between. This test is done to determine if the pressure can be bled completely off and to determine if the pressure will build back up and the rate at which it builds. The accepted mode of determination whether the source of the annuli pressures are fed from a sustained reservoir source, rather than thermal, is as follows: 1. The pressure build-up rate (psi/min) for the second bleed should be more than the pressure build-up rate for the first bleed.

2. The final annulus pressure after 24 hours from the second annulus bleed, will be more than the final annulus pressure after 24 hours from the first annulus bleed.

Both of these factors would indicate that there is some external source of pressure rather than the source being within the well's annulus. In the example of figure 15 the pressure before the first bleed is 500psi (3.44 MPa) which reduces to 400psi (2.76 MPa) immediately after the first bleed. After 24 hours the pressure has increased to 450psi (3.10 MPa). Immediately after the second bleed the pressure has been reduced to 400psi again. After a further 24 hours the pressure has risen to 475psi (3.28 MPa). Hence, in figure 15, both of the conditions above have been met indicating the pressure is from a non-thermal source, such as an external source. In this case preventive measures must be taken by the operator crew.

In figure 16, the pressure 24 hours after the second bleed is less than the pressure 24 hours after the first bleed. Thus, the conditions above are not met and the pressure build-up can be considered to be due to a thermal source. c. Surface Temperature Information/Triggers

During the annuli bleeds described above, the temperature as well as pressure may be measured. The observed surface temperature should not indicate that the bleed pressure response is influenced by thermal changes. For example, thermal changes may be caused by changes to production parameters. In figure 17, the temperature drops after the bleeds and remains

approximately constant between bleeds. Hence, there does not appear to be a correlation between the pressure and temperature, thereby indicating the pressure response is related to a non-thermal source. In figure 18 in the 24 hours after each bleed the pressure increases and so does the temperature. The temperature also drops immediately after each bleed. The tracking of pressure by the temperature indicates that there is possible thermal source. The safety device tracks changes in temperature and pressure at the same time in order to detect the above described patterns and provide conclusions on a possible source of surface pressure increases. d. Density Information/Triggers

Density measurements are essential for ensuring well integrity. A change in density of the fluid under investigation may be a signal of external fluids coming into the annulus, leak of a well barrier and loss of fluids into the formation, internal barrier failure and mixing of fluids within the annulus, etc.

Density measurements may be taken for oil and water based fluids using appropriate sensors after separation. In order to perform the analysis and analyse density fluctuations in time, the safety device may include in its database the following information relating to the annulus:

• Properties relating to the drilling fluid(s) used for the annulus for the 'drilling' activity, including:

o Base oil/liquid (water) density used to build mud; and

o Range of Mud Weights (collected from existing Daily Drilling Reports);

• Properties relating to the completion fluid(s) used for the annulus for the

- 'completion' activity, including:

o Base oil/liquid (water) density used to build completion; and

o Range of completion fluid densities (collected from existing DDRs); • Properties relating to the reservoir/aquifer fluids the annulus can be exposed to, including:

o Sampled density of produced water from aquifer source; and

o Sampled density of produced hydrocarbons from reservoir.

After taking density measurements of the bled fluid, the safety device performs fingerprinting of the measured density in case there is similarity to any particular density fingerprint within the database. If measured density is within or out of the corresponding density fingerprint margins, then appropriate alarms can be triggered. Examples of density fingerprinting resulting in alarms, may include the following cases:

1. Density fingerprint indicates A-annulus by tubing (production string) leak;

2. Density fingerprint indicates casing by casing leak; and

3. Density fingerprint indicates communication within poorly isolated

reservoir/aquifer source in annulus itself.

The safety device shall be able to track density build-ups and drop-downs, which are not within the expected range, as well as when density values tend to specific density fingerprints from the database. In the latter case this would be reflected as a warning rather than an alarm in the report. e. Viscosity Information/Triggers

Viscosity measurements are taken in order to analyse fluid properties and track their condition (in a similar manner as for fluid density). Viscosity

measurements may be taken for oil and water based fluids, which are transferred to corresponding sensors after separation. The safety device may include in its database the following information relating to the annulus it is connected to:

• Properties relating to the drilling fluid(s) used for the annulus, including:

o Base oil/liquid (water) viscosity used to build mud; and

o Range of viscosities (collected from existing Daily Drilling Reports); • Properties relating to the completion fluid(s) used for the annulus for the "completion" activity, including:

o Base oil/liquid (water) viscosity used to build completion;

o Range of completion fluid viscosities (collected from existing DDRs); · Properties relating to the reservoir/aquifer fluids the annulus can be exposed to, including:

o Sampled viscosity of produced water from aquifer source; and o Sampled viscosity of produced hydrocarbons from reservoir.

After taking viscosity measurements of the bled fluid, the safety device performs comparison of the data obtained to the viscosity fingerprints within ^"the database. When measured values do not match values from the database, appropriate alarms are to be triggered, such as for the following cases:

1. Viscosity fingerprint indicates A annulus by tubing (production string) leak;

2. Viscosity fingerprint indicates casing by casing leak; and

3. Viscosity fingerprint indicates communication within poorly isolated

reservoir/aquifer source in annulus itself.

Viscosity triggers are usually used in conjunction with density triggers. The safety device may be configured to be able to determine viscosity build-ups with tendency to go outside allowed margins and give a warning in the report. f. Alkalinity, pH, Resistivity and Salinity Information/Triggers

Alkalinity, pH, resistivity and salinity measurements may be taken for water based fluids, which are transferred to appropriate sensors after separation. The safety device may include in its database the following information relating to the annulus it is connected to:

• Properties relating to the drilling fluid(s) used for the annulus during "drilling" activity, including:

o Base liquid (water) alkalinity, pH, resistivity and salinity used to build mud; and o Range of alkalinity, pH, resistivity and salinity (collected from Daily Drilling Reports)

• Properties relating to the completion fluid(s) used for the annulus during

"completion" activity, including:

o Base liquid (water) alkalinity, pH, resistivity and salinity used to build completion; and

o Range of completion fluid alkalinity, pH, resistivity and salinity

(collected from DDRs);

• Properties relating to the aquifer fluids the annulus can be exposed to,

including:

o Sampled alkalinity, pH, resistivity and salinity of produced water from aquifer source.

After taking alkalinity, pH, resistivity and salinity measurements of the bled fluid, the safety device compares the measured alkalinity, pH, resistivity and salinity for similarity to any particular fingerprint within the database. Appropriate alarms may be triggered for cases including the following:

1. Alkalinity, pH, resistivity and salinity fingerprint indicates A annulus by tubing (production string) leak;

2. Alkalinity, pH, resistivity and salinity fingerprint indicates casing by casing leak; and

3. Alkalinity, pH, resistivity and salinity fingerprint indicates communication within poorly isolated reservoir/aquifer source in annulus itself.

Alkalinity, pH, resistivity and salinity triggers are usually used in

conjunction with density and viscosity triggers. The safety device may be arranged to determine unexpected build-ups and reductions of the above described parameters as well as tendencies, when they tend to potentially dangerous values. Under these conditions, a warning in the report is given for the well crew to ensure all barriers are functioning properly. g. Hydrogen Sulphide Information/Triggers Hydrogen Sulphide (H₂S) is a highly dangerous chemical substance to people, the environment and equipment. Even small concentrations of H₂S in air can cause severe health consequences and even death, if not detected early, or when not wearing appropriate safety equipment. H₂S is also a highly corrosive chemical, which can damage equipment and pose a serious blowout risk. This is why it is important to trigger an early alarm in the case H₂S is detected in the sample. Presence of H₂S in the sample can also be due to the failure of the primary barrier integrity and an indication that formation fluids have entered the annulus. H₂S shall be detectable by spectrometry such as the MC FTIR spectrometer as one of the components of composition analysis.

The safety device may be arranged to provide two types of H₂S triggers. The first trigger will be flagged as per the table below for human health related risks (see Table 1 ) and the second trigger will be based on fingerprinting against produced fluids from reservoir sources containing H2S.

Table 1 - Flags for first type of alarm for H₂S The first trigger shall generate an alarm at any concentration of H₂S as the strong indicative smell of this substance is sometimes not recognized by people due to fatigue of the human smelling sense. h. Gas Information/Triggers

Gas measurements may be taken for direct gas and separated gas from water and oil phase fluids by spectrometer, such as the MC FTIR spectrometer. Additional sensor may also be used. The safety device may include in its database the following information relating to the annulus it is connected to:

o Range of gas (composition) observed while drilling (collected from

existing Daily Drilling Reports)

• Properties relating to the reservoir/aquifer fluids the annulus can be exposed to, including:

o Sampled gas of produced water from aquifer source; and

o Sampled gas of produced hydrocarbons from reservoir.

After taking gas measurements of the bled fluid, the safety device compares the results with those stored in the database. If the measured gas shows similarity to any particular gas fingerprint within the database, appropriate alarms are to be triggered, for example, for the following cases:

1. Gas fingerprint indicates A-annulus by tubing (production string) leak;

2. Gas fingerprint indicates casing by casing leak; and

3. Gas fingerprint indicates communication within poorly isolated reservoir/aquifer source in annulus itself.

These measurements/triggers combine to provide important information about well barrier integrity status and possible causes of leaks/fails, which may all be included in a report. Example Embodiment In an example embodiment of the present invention, the analyser may perform four separate analyses to determine Well Integrity risks. All of these analyses may be derived from bleed down data.

The first analysis determines the Well Integrity risks associated with hazardous H2S levels to personnel and the environment. The second analysis determines any Sustained Casing Pressure (SCP) risks based on pressure and temperature build-up rates performed after annulus bleed operations. The third analysis determines the appropriate MAASP value based on the annulus's architecture data and current well condition, and compares the results to measured annulus surface pressures to determine any failure risk(s) of

mechanical components within the operating annulus. The fourth analysis matches bled fluid(s)' properties to an existing database, in order to determine whether any leakages from another source are present in the annulus. The process and methodology of the fourth analysis is common across the various fluid properties (i.e. Density, viscosity, pH, Chlorides, H2S, and gas

compositions).

Example flowcharts of the 4 separate analyses are provided in figures 29- 32. Trigger points or threshold for various risk alarm levels are user customisable, but indicative values are provided in the example flowcharts for illustrative purposes.

Analysis 1 : Determining hazardous H2S levels

The flow chart for this first analysis is shown in figure 29. The process commences when a bleed operation is performed and a fluid sample enters the H2S sensor. The sensor performs measurements to determine levels of H2S concentration.

If H2S is detected in the sample, the analyser shall determine the risk level associated with the H2S measurement. If H2S levels are lower than 10 ppm but greater than zero, the device shall trigger a low risk alarm. If H2S levels are greater than 10 ppm but less or equal to 50 ppm, the apparatus shall trigger a medium risk alarm. Finally, if the level of H2S is higher than 50 ppm, the device shall trigger a high risk alarm. These trigger values for the alarms are provided as examples but other values may be used or may be customised by the user.

The alarms may be of audio warning at the site, graphical output to any control room (if available) and auto emails sent to office based management teams or other types of alarms such as light indication on the body of the apparatus.

Analysis 2: Determining Sustained Casing Pressure (SCP) Risks

The flow chart for this second analysis is shown in figure 30. The process commences by conducting two separate bleed operations of the well's annulus. Between the first bleed operation and the second, the well is shut in for a known duration to monitor for any pressure and temperature build up effects. After the second bleed operation, the well is similarly shut in for a known duration and the pressure and temperature profile monitored. The pressure and temperature measurement of the bleed sample can be performed by the apparatus or gathered from any existing pressure and temperature gauges on the wellhead annulus outlet.

The analyser determines the pressure and temperature build up rates following both bleed operations. Once all pressure and temperature build up rates are determined, the analyser identifies whether the pressure build up rate following the first bleed operation has increased or decreased compared to the second bleed operation. Simultaneously, the analyser determines whether the temperature build up rate following the first bleed operation has increased or decreased compared to the second bleed operation. If the pressure and temperature build up rates following the second bleed operation are greater than those from the first bleed operation, the system shall generate a warning message and alarm that anomalous results are obtained and further investigation is required to determine the cause of increased temperature and pressure build up rates. Further assessments are required since it cannot be adequately determined if the increase in pressure build up rates are a direct result of increased temperature build up rates, or contributed through a sustained pressure source external to the wellbore. If the pressure build up rate following the second bleed operation is greater than that from the first bleed operation, and the temperature build up rates have either remained constant or decreased in magnitude, a high risk alarm and warning message shall be provided by the apparatus. The cause of the increase in pressure build up rates cannot be attributed to temperature effects. The only plausible cause of increase in pressure build up rates is through a leak from a sustained external pressure source, like a hydrocarbon reservoir, into the annulus.

If the pressure build up rate following the second bleed operation is less than that from the first bleed operation, and the temperature build up rates have either remained constant or decreased in magnitude, a low risk status shall be provided by the apparatus. A decrease in pressure build up rates is indicative that there is no direct communication between the annulus and a sustained external pressure source.

If the pressure and temperature build up rates following the second bleed operation are both less than those from the first bleed operation, the system shall generate a warning message and alarm, that anomalous results are obtained, and further investigation is required. Further assessments are required since it cannot be adequately determined if any possible communication between the annulus and a sustained external pressure source might be masked by a decrease in temperature effects.

This process flow chart can be applied on all annulus ("A", "B", "C", or "D") of the well. Analysis 3: Determining Annulus MAASP and potential mechanical failures

The flow chart for this third analysis is shown in figure 31. The flowchart is an example of how a MAASP value can be determined for the "A" annulus of land and fixed offshore well types. It does not represent the process of how the "B", "C" and "D" annulus would be determined separately. For further details refer to Cases 1 and 2 and calculation points 1-8 of the A-annulus in Figure 12 and in the respective sections of the description. The system may determine whether any measured surface A annulus pressure exceeds its minimum rated MAASP limit. The analyser system shall determine the minimum rated MAASP limit of an "A" annulus based on a user defined well architecture data (casings and liners configuration, packer, safety valve and accessories data, casing shoe data, and fluid density data), which will then be used to determine the relevant "Case" and their respective calculated MAASP point values. Then the analyser system acquires any recently measured "A" annulus surface pressure, and compares it against the minimum rated "A" annulus MAASP limit. Alarms and warnings may be triggered based upon user defined thresholds. As an example, 70% of a MAASP surface pressure limit can be defined as a threshold. Any measured "A" annulus surface pressure greater than the threshold value triggers a high risk Well Integrity failure of the

mechanical operating envelope. Any measured "A" annulus surface pressure greater than the threshold value but lower than the MAASP limit can trigger an impending Well Integrity failure of the mechanical operating envelope. No Well Integrity failure alarm will be triggered if the measured "A" annulus surface pressure is lower than the threshold value.

Analysis 4: Determining Reservoir communication risks based on Fingerprinting results of bleed fluid properties

The flow chart for this fourth analysis is shown in figure 32. The flowchart represents how the density of a bled fluid sample can be matched to an existing fluid in a database. This process and methodology is common across all fluid properties (i.e. Density, viscosity, pH, Chlorides, H2S, and gas compositions).

The system may perform fingerprinting analysis to determine whether leakages from reservoir source(s) into the annulus are present. After a bleed operation from the annulus is performed, the bleed sample is separated into the fluid, gas and water phases by the apparatus. As an example, the water phase of the sample is transferred to the sensors for its properties analysis. Subsequently, properties like the water sample's density can be measured. Once the density value is determined, the analyser compares the sample's density to reference fluid(s) density values stored in the database. For example, if the measured density of the water sample is within the specified density range of a shallow aquifer connected to the current well, the apparatus shall trigger a well integrity alarm indicating that the bled fluid density matches the density of the shallow aquifer. This indicates an annulus to aquifer communication. If the measured density value is not within the density range of the database reference fluids, no alarms will be is triggered.

As is evident from the example embodiment described above there is particular synergy in performing the analysis based on bleed events, and in particular wellhead annulus bleed events, because in such a case sufficient information including pressure, temperature, other physical and chemical parameters are capable of performing all four of the analyses above. However, in some embodiments it may not be necessary to perform an annulus bleed down, whereas in others a single bleed down may be sufficient. Nevertheless in preferred embodiments it is preferable to use parameters in addition to measured and stored pressure and temperature, which can be derived during bleed down operations.

During bleed down operations, the following occurrences will happen to an annulus provided the annulus is pressurised. For example, the annulus has a surface pressure greater than zero.

1. Some quantities of fluids will be removed from the annulus; and

2. The annulus pressure will reduce as a result of the removal of the fluids. In view of the two above mentioned occurrences, it will always be possible to perform the following provided the apparatus is connected downstream to the annulus:

1. Determine Sustained Casing Pressure (SCP) risks due to annulus pressure reductions and pressure build ups;

2. Determine if any hazardous levels of H2S is present that might pose danger to personnel and the environment, since fluids will be removed from the annulus and can be measured and analysed by the apparatus; and

3. Determine if any leaks are evident by way of fingerprinting the fluid properties (comparing to stored data), since fluids will be removed from the annulus and can be measured and analysed by the apparatus. If the apparatus is connected to existing pressure and temperature gauges, it will be able to determine if the MAASP (or any lower threshold pressure defined) has been exceeded at any times.

The safety device and method according to the present invention utilize unique analysis algorithms, which represent a step change improvement in monitoring of oil and gas well integrity, and provide automated early warnings of an impending unsafe condition. Recent examples in and out of the public domain of blowouts show the urgent need for such a device.

The person skilled in the art will readily appreciate that various

modifications and alterations may be made to the above described embodiments without departing from the scope of the appended claims. For example, different configurations of sensors, order of method steps, types of trigger used, calculation for particular pressure trigger, and form of alarm may be used.

Claims

CLAIMS:

1. Safety apparatus for monitoring integrity of a production phase well, the apparatus comprising:

an inlet port for receiving fluid from a wellhead annulus bleed port;

an analyser for receiving annulus fluid from the inlet port and analysing physical and/or chemical properties of the fluid,

wherein the analyser is configured to determine well-integrity based on the physical and/or chemical analysis.

2. The safety apparatus of claim 1 , wherein the inlet port is configured for external connection to a well-head annulus bleed port.

3. The safety apparatus of claim 1 or claim 2, wherein the wellhead is a surface wellhead.

4. The safety apparatus of claim 3, wherein the surface wellhead is installed on an onshore land well or an offshore fixed platform well having bleed ports for a plurality of well annuli.

0

5. The safety apparatus of any of claims 1 to 4, wherein the safety apparatus is configured to determine blow out risk based on the determined well-integrity.

6. The safety apparatus of any preceding claim, wherein the analyser is

5 arranged to compare measured properties of well annulus or production flowline fluids to stored data, the stored data comprising one or more of:

specifications of the well annulus or flowline;

historical data for said well annulus or flowline;

a library of data for identifying fluids and compositions;

o thresholds for safe operation of the well; and

based on the comparison providing an output indicating the integrity of the well.

7. The safety apparatus of claim 6, wherein the library of data comprises a library of properties of reference fluids for identifying the leak source in the well, reservoir or aquifer.

5

8. The safety apparatus of any preceding claim, wherein the analyser is arranged to compare measured properties of well annulus fluids before and after bleed down to determine if the annulus is in communication with a sustained flow source indicative of a well integrity failure.

i o

9. The safety apparatus of claim 6 or 7, wherein the analyser is arranged to compare a measured value of surface pressure with calculated values of MAASP for components within the well structure.

15 10. The safety apparatus of claim 6, wherein the analyser is arranged to

compare a measured value of physical/chemical parameters with calculated values of said parameter, and if the measured value is outside of predetermined limits compared to the calculated value, the analyser triggers an alarm.

20 11. The safety apparatus of any preceding claim, wherein the analyser

comprises one or more sensors coupled to the inlet port, the one or more sensors arranged to measure a pressure and/or temperature of the fluid at inlet conditions corresponding to those in the annulus.

25 12. The safety apparatus of any preceding claim, wherein the analyser

comprises a sampling channel for receiving sample fluid bled from the well annulus through the inlet port, transmitting the sample fluid to sensors and performing physical and chemical analysis at a pressure reduced from the inlet conditions sensors.

3 0

13. The safety apparatus of claim 12, further comprising a filter for removing solid particles from the sample fluid.

14. The safety apparatus of claim 12 or 13, further comprising sensors for measuring at least one of temperature, pressure, density and viscosity of the sample fluid at a pressure reduced from the inlet conditions.

15. The safety apparatus of any of claims 12 to 14, further comprising one or more separators for separating the gaseous phase from the liquid phase of the fluid sample and in the liquid phase for separating oil from water.

16. The safety apparatus of claim 15, wherein the one or more separators are microfluidic separators having a porous membrane of oleophobic or hydrophobic material.

17. The safety apparatus of claim 15 or claim 16, further arranged such that the separated water and oil liquid phases are pumped to sensors for measuring properties of the oil and water phases.

18. The safety apparatus of claim 17, further comprising an array of MEMS or other types of sensors arranged to measure properties of the oil and water phases.

19. The safety apparatus of any of claims 12 to 18, further comprising sensors for measuring one or more of alkalinity, salinity, pH, and resistivity of the sample fluid.

20. The safety apparatus of any of claims 12 to 19, further comprising a composition evaluator for performing compositional analysis of the sample fluid.

21. The safety apparatus of claim 20, wherein the composition evaluator is arranged to receive and analyse the gaseous phase of the sample fluid.

22. The safety apparatus of claim 20 or 21 , wherein the composition evaluator is an infra-red spectrometer, such as a multi-channel Fourier transform infra-red spectrometer.

23. The safety apparatus of any preceding claim, comprising a flush unit arranged to flush the samples from the analyser after analysis to a disposal unit arranged to receive the samples for disposal.

24. A well-head comprising the safety apparatus of any of claims 1 to 23, wherein the safety apparatus is coupled to a well-head annulus bleed port at the well-head to receive fluid from the well-head annulus bleed port.

25. A method of diagnosing integrity of a well, comprising:

coupling a flow conduit from well integrity analysis apparatus to an annulus bleed port at the well-head;

the well integrity analysis apparatus receiving fluids from the flow conduit, analysing physical and/or chemical properties of the fluids, and based on the analysis of the fluid generating a diagnosis of well-integrity.

26. The method of claim 25 wherein the generated diagnosis of well-integrity is displayed as a graphical and/or tabular output.

27. The method of claim 25 or 26, wherein the wellhead is a surface wellhead. 5

28. The method of any of claims 25 to 27, further comprising determining blow out risk based on the diagnosis of well-integrity.

29. The method of any of claims 25 to 28, comprising measuring a pressure and/or temperature of the fluid at inlet conditions corresponding to those in the o annulus by one or more sensors coupled to the flow conduit.

30. The method of any of claims 25 to 29, comprising receiving a sample fluid bled from the well annulus flowline through the flow conduit, transmitting the sample fluid to sensors and performing physical and chemical analysis of the sample at a pressure reduced from the well annulus or production flowline conditions.

31. The method of claim 30, further comprising filtering the sample to remove solid particles.

32. The method of claim 30 or 31 , further comprising sensing at least one of temperature, pressure, density and viscosity of the sample fluid at a pressure reduced from the inlet conditions.

33. The method of any of claims 30 to 32, further comprising separating the gaseous phase from the liquid phase of the fluid sample and in the liquid phase separating oil from water.

34. The method of any of claims 30 to 33, further measuring one or more of alkalinity, salinity, pH, and resistivity of the sample fluid.

0

35. The method of any of claims 30 to 34, further comprising performing compositional analysis on the sample fluid.

36. The method of claim 35, wherein the composition analysis is performed on5 the gaseous phase of the sample fluid.

37. A method of analysis of integrity of a well, comprising:

comparing measured properties of well annulus fluids to stored data, the stored data comprising one or more of:

o specifications of the well annulus or flowline;

historical data for said well annulus or flowline;

a library of data for identifying fluids and compositions; thresholds for safe operation of the well; and

38. The method of claim 37, wherein the step of providing an output comprises providing a graphical and/or tabular output indicating the integrity of the well and/or an assessment of the blowout risk.

39. The method of claim 37 or 38, wherein the library of data comprises a library of properties of reference fluids for identifying the leak source in the well, reservoir or aquifer.

40. The method of any of claims 37 to 39, wherein the comparison is that of measured properties of well annulus fluids before and after bleed down to determine if the annulus is in communication with a sustained flow source indicative of a well integrity failure.

41. The method of any of claims 37 to 40, wherein the measured properties comprise physical properties measured at the well-head annulus at conditions corresponding to those in the well-head annulus , and the comparison is to historical physical data for said well.

42. The method of any of claims 37 to 41 , wherein the measured properties comprise physical and/or chemical properties measured on fluids bled from the well-annulus.

43. The method of any of claims 37 to 42, wherein the measured properties comprise chemical properties of the fluids and the comparison is to the library of data for identifying fluids and compositions.

44. The method of any of claims 37 to 43, further comprising determining well blow-out risk based on pressure and/or temperature changes determined from the measured properties.

45. The method of any of claims 37 to 44, wherein the step of comparing comprises tracking changes in fluids by comparing to historical data and/or reference data.

46. The method of any of claims 37 to 45, further comprising triggering an alarm when the measured data exceeds defined limits.

47. The method of claim 46, further comprising triggering an alarm when analysis of measured data indicates the integrity of the well or annulus is compromised.

48. The method of any of claims 37 to 47, further comprising calculating a maximum safe pressure of the annulus of the well and comparing this to a measured pressure.

49. The method of claim 48, wherein the maximum safe pressure is the maximum allowable annulus surface pressure.

50. The method of claim 48 or claim 49, further comprising re-calculating the maximum safe pressure if a change of one or more of the following occurs:

service type, fluid density, well tubing or casing thickness, and reservoir pressure.

51. The method of any of claims 37 to 50, further comprising receiving measured pressures from one or more annuli of a well and determining if changes have occurred in one or more of them which is indicative of a failure of well structure.

52. The method of any of claims 37 to 51 , further comprising receiving measured pressures from one or more annuli from a well and determining the location of a failure of well structure.

53. The method of claim 51 or 52, wherein the well structure is one of: safety valve, accessory, packer, liner, hanger, casing for one or more of the annulus.

54. The method of claim 37 to 53, further comprising storing specifications of the annulus.