You’ve seen it: six engineers in a room, asked to sketch the barrier envelopes for a routine gas producer, and you get six different drawings. Disagreements surface immediately. Does the tubing hanger belong to the primary or secondary envelope? Does production casing cement count without a bond log? Can a closed surface valve be an envelope element at all?
The issue isn’t typically the hardware itself. It’s about what the diagram claims. A barrier diagram isn’t just an inventory of equipment shaded in two colors. It’s a fundamental assertion: for every credible source of pressurized fluid in the well, two independent envelopes exist between that source and an uncontrolled release. Crucially, every element within each envelope must be verified to withstand its actual load. A diagram that can’t be interrogated element by element against that claim is, frankly, just decoration.
The Four Failures of Most Barrier Diagrams
Diagrams that crumble under scrutiny almost always fall victim to the same four critical errors. Understanding these failures is the first step toward building a truly robust well barrier diagram.
1. Element Thinking Over Envelope Thinking
The most common mistake is shading individual components rather than tracing a continuous, closed surface. An envelope, by definition, is continuous; it has no gaps. If you can trace a line along your shaded elements and find an unshaded interface that breaks the path, your envelope doesn’t exist as claimed, and your diagram is asserting something untrue.
Apply the leak-path test to every diagram: start at the reservoir face, walk outward along every possible fluid path, and confirm that the path crosses a shaded, qualified, and verified envelope element exactly once. Common paths engineers overlook include the annulus above the packer, control-line bores, gas-lift valve ports, the interface between the packer seal and the casing wall, and flow through a sliding sleeve that is closed but not pressure-tested in the closed position.
For each envelope, ask: if this envelope alone were removed, where exactly would the fluid go? If the answer isn’t a specific, complete flow path terminating at a defined receptor (surface, seabed, or a named formation), your envelope isn’t properly defined.
2. Shared Elements Presented as Independent
Two envelopes relying on the same physical component are not truly independent; they are one envelope drawn twice. The production casing is a classic example: it often forms part of the secondary envelope for the reservoir while simultaneously containing the annulus pressure that the primary envelope’s packer seals against. A casing failure in this scenario defeats both barriers. This isn’t always unacceptable—sometimes it’s unavoidable—but it must be explicitly visible on the diagram and stated in the accompanying text, not hidden by simply shading the same tube in two colors.
Always check for these common accidental couplings:
- Production casing serving as both secondary containment and the packer’s sealing surface.
- The tubing hanger sealing both the tubing bore and the A-annulus, meaning a single hanger seal failure breaches both envelopes.
- The wellhead body itself, which almost always appears in both envelopes and is genuinely a single point of failure.
- A single hydraulic supply feeding both the SSSV and a downhole isolation valve, making one control-system fault a common-cause failure.
3. Presence Confused with Verification
An element shaded on a diagram is a claim that it is working. Your diagram should detail, for each element, the verification method, the date, and the load the verification demonstrated. Cement across a zone isn’t a barrier because it was pumped; it’s a barrier because a log or a pressure test showed isolation across a defined interval. A packer isn’t verified by being set; it’s verified by an inflow test or a positive test in the direction the differential will actually act.
Direction matters more than many engineers realize. Many elements are qualified in one direction only. A retrievable packer tested from above proves nothing about its behavior under a large upward differential during a bullhead kill. A flapper SSSV tested from above is tested in its design direction; the same valve holds nothing from below. Shading a component without recording test direction produces a diagram that is confidently wrong.
The most useful column to add to your element table isn’t “test pressure” but “maximum differential this element will see in the worst credible operating case.” Elements are routinely tested to a round number that might be lower than the differential imposed by a shut-in after stimulation or a full evacuation during a nitrogen kickoff. The test result looks fine until you compare it against the actual load case—a comparison few make unless the diagram forces it.
4. No Defined State
A barrier diagram is valid for exactly one well state. The envelopes during production, during a wireline intervention with the SSSV locked open, during a shut-in with the tree closed, and during a suspension with plugs set are four distinct diagrams. A diagram without a declared state in its title block invites misapplication to conditions it was never designed for. Any intervention that opens the tubing bore or defeats an element requires its own diagram, showing what has temporarily replaced the defeated element.
Building a Robust Barrier Diagram: The Operational Approach
To create a barrier diagram that truly aids operational decision-making, follow a disciplined process and adopt clear conventions:
Drawing Conventions That Prevent Disputes
- Two distinct fills, plus a third for defeated or unverified elements: This forces an explicit decision on doubtful items rather than allowing ambiguity.
- Envelope drawn as a continuous traced outline, not per-component shading: This makes any gaps visually obvious and immediately flags a broken barrier.
- Numbered elements keyed to a table with test method, date, direction, and rating: Separates the claim (on the diagram) from the evidence (in the table).
- Well state and applicable date range in the title block: Prevents reuse in the wrong condition and ensures context.
- Shared elements marked with an explicit common-cause flag: Clearly surfaces dependencies instead of hiding them.
Construction Sequence for Scrutiny-Proof Diagrams
Follow these steps to build your diagram:
- State the well condition the diagram represents, with dates.
- List every pressure source: reservoir, injected fluid, trapped annular pressure, hydrostatic head, and any charged shallow zone.
- For each source, identify the relevant receptor—surface, seabed, or a specific formation with a lower fracture gradient.
- Trace the primary envelope as a closed outline between each source and its receptor.
- Trace the secondary envelope independently. Where an element appears in both, flag it explicitly as a common-cause dependency.
- Build the element table: include the rating, verification method, verification date, test direction, and the worst credible differential the element will see.
- Re-run the leak-path test on the finished drawing, walking every path, including control lines and side-pocket ports.
- Record what monitoring proves the envelopes are still intact between verifications—annulus pressure trend, valve function test interval, gauge readings.
Failure Modes and Lessons Learned
Even with the best planning, things can go wrong. The goal is to catch failures on paper before they manifest in the field. The core lesson from the four failure modes is constant vigilance and a refusal to accept ambiguity.
If your diagram shows a shared element, you must have a clear understanding of the implications. Can the well be operated safely with that common-cause failure point, or does it require additional mitigation or a different operational approach? For instance, if the wellhead body is a shared element, its inspection and maintenance regimen becomes critical for both envelopes.
Always challenge the verification. Just because a packer was run and set doesn’t mean it’s a barrier. What was the test pressure? In what direction? Did it hold? What was the actual differential applied? If the test was 500 psi from above, but a bullhead kill could impose 2000 psi from below, that packer is not a verified barrier for the kill operation.
Finally, remember that monitoring is part of the envelope. An envelope verified once and never watched again degrades silently. Your diagram should name, for each envelope, the routine measurement that would reveal its failure and the response threshold. If no such measurement exists, the envelope is unmonitored, and that fact belongs on the drawing as a critical operational note.
The Bottom Line
The true purpose of a barrier diagram is to make an unsafe well look unsafe on paper before it looks unsafe in the field. A diagram that always comes out “green” isn’t reassuring; it means your drawing convention lacks the capacity to express a problem. The most valuable barrier diagrams in any well file are the ones with an element shaded in the “unverified” or “defeated” color, accompanied by a written justification for why operations continued anyway. Those are the diagrams that were actually used to think with, to challenge assumptions, and to manage risk effectively.
Have a question about your well? Reach out via the contact page.