Summary This paper focuses on safety systems used in Challis field subsea wells. Itexamines the design philosophy covering subsurface tubing and annulus shut-in, as well as the requirement to maintain annulus integrity with gas-lift valves(GLV's). The paper covers design, development, and testing of safety equipment, which should aid in design of completions for similar applications. Introduction Offshore completions require safety systems to prevent injury to persons, damage to equipment, and serious pollution. Subsea completions presentadditional complexity in terms of installation, reliability, and mode ofequipment failure. The Challis field in the Timor Sea is being developedexclusively with subsea completions equipped with gas lift, which will beginearly in the life of the field. This remote marginal development, which uses afloating production facility, requires low capital and production facility, requires low capital and has minimal operating costs. Costly subsea workoversshould be avoided to ensure that operating costs are minimized. Therefore, itis important that the surface-controlled subsurface safety valve (SCSSV) andthe GLV, traditionally the prime components for failure in a completion, becritically examined. The use of gas lift in a well introduces hydrocarbons intothe annulus and creates a potential leak path through the GLV. A catastrophicfailure in which the subsea tree is forcibly pulled off the completion mayresult in a large amount of gas escaping from the annulus and the potential forthe well to flow back through the GLV. A design specification for thecompletion included both tubing and annulus shutoff when the subsea tree failsand requires that the valve have a 10-year working life. At Challis, tandemtubing-retrievable SCSSV's were used to achieve a tubing shutoff system capableof operating for the 10-year life of the well. A unique solution developed for@ annulus safety system consisted of a shear orifice GLV and an annulus safetyvalve below the tubing hanger. Background Subsea completions should be designed to withstand a catastrophic failure inwhich the subsea tree is removed forcibly from the well. This could occur whenan anchor chain or fishing net is dragged over the subsea tree. Two generalfailure modes can be identified in subsea completions: mechanical failure aboveand below the tubing hanger. In failure below the tubing hanger, which is themore serious of the two, the SCSSV's must be located at a position in thetubing that is below the calculated point of failure. The SCSSV then shuts inthe tubing, but because the tubing is no longer supported by the tubing hanger, it may fail from the resulting high compressional forces. Tubing failure causedby excess buckling or failure at the packer seal system could occur, dependingon the particular design and the condition of the components. Corrosion willsignificantly increase the chance of a leak developing in the tubing. A leakmay occur at a depth greater than the SCSSV setting depth, allowing well fluidto flow into the annulus. If insufficient hydrostatic head is present in theannulus, the well will flow present in the annulus, the well will flowuncontrolled. To circumvent this problem, a secondary tubing hanger can beinstalled below the failure point (Fig. 1) and a weak joint positioned abovethe secondary hanger to ensure that the tubing fails at a predetermined pointin the completion. The predetermined point in the completion. The primary roleof the secondary tubing hanger primary role of the secondary tubing hanger isto support the tubing at an intermediate point in the completion, although italso may point in the completion, although it also may be desirable toincorporate an annulus isolation feature by use of an annulus packoffarrangement. The packer may be ported to allow flow communication through itand to include some kind of annulus shutoff device, such as an SCSSV. Analternative to using a secondary tubing hanger is to position the SCSSV's belowthe casing packer. This configuration has several advantages:protection from casing, tubing, and GLV leaks;setting below the depth at which earth movements occur;protection from directionally drilled offset wells;setting below the depth at which hydrates and paraffins occur; andisolation of the formation from kill fluid circulated above the packer. The disadvantage of this design is that the SCSSV's are located at a much greaterdepth and therefore must be capable of operating at higher temperatures. Thenew design of deep-set SCSSV'S, which use nonelastomeric seals in both staticand dynamic modes, allows them to operate reliably at high temperatures. JPT P. 80