52 Oilfield Review

At the Ready: Subsurface Safety Valves

James GarnerSugar Land, Texas, USA

Kevin MartinBPAberdeen, Scotland

David McCalvinHouston, Texas

Dennis McDanielKerr-McGee Oil & Gas Corp.Houston, Texas

For help in preparation of this article, thanks to PhillipHodge, Houston, Texas.ScaleGard is a mark of Schlumberger. Teflon is a registeredtrademark of E.I. DuPont de Nemours & Co. Inc.

Subsurface safety valves provide the ultimate protection against uncontrolled flow

from producing oil and gas wells in case of catastrophic damage to wellhead equip-

ment. Their use offshore is legislated in many parts of the world to protect people

and the environment. Safety valves have evolved from the relatively simple downhole

devices of the 1940s to complex systems that are integral components in offshore

well completions worldwide.

Subsurface safety systems provide emergency,fail-safe closure to stop fluid flow from a well-bore if surface valves or the wellhead itself aredamaged or inoperable. Safety valves are essen-tial in offshore wells and in many land wellslocated in sensitive environments, or in wellsthat produce hazardous gases. They are installedto protect people, the environment, petroleumreserves and surface facilities. Successful instal-lation, dependable operation and reliability ofsafety-valve systems are crucial to efficient andsafe well performance.

Perhaps the most regulated component of anoil or gas well, the safety-valve system must sat-isfy stringent technical, quality and operationalrequirements. Scrutiny of safety-valve design,manufacture and operation by regulatory bodiesand operators requires valve manufacturers toapply a level of diligence and testing beyond thatof related well-completion and flow-controlequipment. This reflects the crucial role of safety valves.

The winds and waves of Hurricane Liliimpacted about 800 offshore facilities, includingplatforms and drilling rigs, as the Category 4storm passed through the oil-producing regionoffshore Louisiana, USA, in September andOctober of 2002. Despite sustained winds of145 miles/hr [233 km/hr], the US MineralsManagement Service (MMS) reported that thestorm caused no fatalities or injuries to offshoreworkers, no fires and no major pollution.1 Six

platforms and four exploration rigs were dam-aged substantially by the storm. There were ninereported leaks of oil; only two exceeded one bar-rel. None of these spills was associated with thesix severely damaged platforms.

Prevention of accidents is an importantaspect of the MMS safety strategy. The lack ofsignificant news relating to spills during thisstorm is a testament to the success of estab-lished safety protocols. As part of the safety sys-tem, subsurface safety valves serve a relativelyunglamorous but critical role. By working prop-erly when other systems fail, these valves are afinal defense against the disaster of uncontrolledflow from a well.

In principle, a safety valve is a simple device.Most of the time it is open to allow flow of pro-duced fluids, but in an emergency situation itautomatically closes and stops that flow. Toeffect this task, sophisticated engineeringdesigns and state-of-the-art materials have beendeveloped. The valve’s closure mechanism must close and seal after months of sitting in theopen position and years after its installation.Special procedures and technologies applied toreopening the valve after closure ensure its continued reliability.

Wells are drilled and completed underdiverse conditions, so before an appropriate sub-surface safety valve is selected and installed, athorough review of the reservoir, wellbore andenvironmental conditions must be conducted.

1. Congdon B, Fagot C and Winbush D: “MMS PreliminaryReport Finds Most Facilities Withstood Hurricane Lili; 6 Platforms Out of 800 with Severe Damage; MMS BuoyProvides Important Data,” US Minerals ManagementService News Release (October 15, 2002),http://www.gomr.mms.gov/homepg/whatsnew/news-real/021016.html.The Minerals Management Service is the US agencythat manages the nation’s oil, natural gas and other mineral resources on the outer continental shelf in federal offshore waters.

Winter 2002/2003 53

This analysis should consider these factorsthroughout the predicted life of a completion, ifnot the life of a well. Oil and gas developmentsin deepwater and high-pressure, high-tempera-ture (HPHT) reservoirs impose additional engi-neering challenges in the design and installationof safety valves.

In such environments, where well interven-tion is both difficult and costly—often exceedingseveral million dollars, excluding lost produc-tion—the importance of reliable safety-valveoperation is even greater. This article reviews theevolution, design and installation of subsurfacesafety valves through examples from operationsin the North Sea and Gulf of Mexico.

Disaster Drives DevelopmentThe first safety device to control subsurface flowwas used in US inland waters during the mid-1940s. This Otis Engineering valve was droppedinto the wellbore when a storm was imminentand acted as a check valve to shut off flow if therate exceeded a predetermined value. A slicklineunit had to be deployed to retrieve the valve.

Those first valves were deployed only asneeded, when a storm was expected. The use ofsubsurface safety valves was minimal until thestate of Louisiana passed a law in 1949 requiringan automatic shutoff device below the wellheadin every producing well in its inland waters.

Unfortunately, most disastrous situationsoccur unexpectedly. Surface facilities, includingthe surface safety systems, can be damaged bystorms or vehicles impacting them. Boats dragging anchors or other devices can dam-age facilities on the bottoms of lakebeds or on the seafloor. Accidents have sometimes occurred when surface safety equipment is temporarily bypassed during logging and well-intervention operations.

The need for a new and more reliable type ofsubsurface safety valve was driven by accidentsin Lake Maracaibo, Venezuela, in the mid-1950s.Tanker ships hitting platforms in the lake resultedin well blowouts. Producers wanted a valve thatwould protect the environment in case of severedamage to surface facilities, while maximizingproduction. The result was a surface-controlledvalve that was normally closed—meaning thevalve was closed unless an action kept it open.That action was fluid pressure transmitted to thevalve through a hydraulic line from the surface.

A 1969 blowout in a well in the Santa BarbaraChannel off California, USA, led to 1974 regula-tions that required the use of subsurface safetysystems on all offshore platforms and installa-tions in US federal waters. These regulations

relied on requirements and recommendations setforth by an American Petroleum Institute (API)task group comprising manufacturers and usersof subsurface safety valves.2 The API has pub-lished key guidelines for many aspects of thedesign and completion of oil and gas wells.

The International Organization for Standard-ization (ISO) revised the work of the API taskgroup to meet global needs. These ISO standardsare widely applied for international offshore pro-jects and also for many land-based develop-ments. In the US, the MMS enforces therequirements of federal and state legislation.Similar government bodies, such as the Healthand Safety Executive in the UK and theNorwegian Petroleum Directorate in Norway, per-form this function in their respective countries.

Standards and recommendations developedby various industry collaborations have led tohigher safety awareness and a greater commit-ment to mitigate human and environmental risk.This is critically important as the industry movesto exploit petroleum reserves in operating condi-tions that are significantly more demanding andsevere, and environmentally more sensitive thanthose confronted in 1974. The challenges of safeoil and gas production in deepwater and HPHTreservoirs elevate industry collaboration effortsfrom beneficial to essential.

Safety-Valve OperationsModern safety valves are an integral part of sys-tems that protect almost all offshore productioninstallations and a growing number of land-based facilities. These systems protect peopleand the environment, and limit unwanted movement of produced fluids to the surface. Asinsurance against disaster, they must lie essen-tially dormant for extended periods, but be oper-ational when needed. Development of today’ssophisticated valves occurred in distinct steps.

Early subsurface safety valves were actuatedby a downhole change in production flow rate. Aflow tube in such valves is equipped with a chokebean, which is a short, hard tube that restrictsflow, creating a differential pressure between thetop and bottom of the tube. Production fluid flow-ing through this choke creates a differential pres-sure across the bean—the pressure on the lowerface of the choke bean is higher than the pres-sure on the upper face. When the force on thelower face exceeds the combination of pressureon the upper face and the force of the powerspring holding the valve open, the flow tubemoves up and allows the flapper to hinge into theflow stream and close against a seat, sealing offflow. The flow rate to close the valve can be setduring manufacture by spring and spring-spacer

selection and by adjusting the hole size throughthe bean (above).

Safety valves that are actuated in this mannercreate a restriction in the wellbore that can limitproduction even when they are open. For manyyears after the introduction of safety valves inthe 1940s, proration was in effect in the US mar-ket, so wells typically were produced at rateslower than their maximum deliverability.3 A hin-drance to well-production efficiency caused byvalve design and installation was not considereda serious issue at that time.

54 Oilfield Review

FSFS

P2

P1

F2 F2

Flapper

Valvespring

F1 F1

Flow

> Typical subsurface-controlled safety valve.Early safety valves were relatively simple in operation and created a significant restriction toproduction. The force of the valve spring, FS, actson the flow tube to keep the flapper valve in anormally open position. The pressure below therestriction is P1 and that above is P2. These pres-sures act on the exposed faces of the piston,creating a force F1 – F2 to close the valve. Whenfluid flows upward, the constriction creates apressure differential that increases closureforce. The spring force is preset for a specificflow rate, so when the flow rate reaches thatcritical rate, the piston moves up, releasing theflapper to close and shut off fluid flow.

Winter 2002/2003 55

These downhole-actuated—or subsurface-controlled—safety valves have two major limita-tions. Since a significant variation in fluid flow orpressure is required to actuate them, thesevalves can be used only when normal productionis restricted to a level that is less than the maxi-mum capability of a well. This actuation level isadjusted and set before the safety valve isinstalled in the wellbore. Also, since a significantflow-rate change is required to actuate the shut-off, the valve will not operate in low-flow condi-tions in which fluid flow is less than the presetproduction level.

A new type of valve became necessary whenenergy markets changed during the 1970s, andmore production was demanded from wells.However, when well productivity is maximized, itmay be difficult or impossible to have enoughadditional flow downhole to overcome the springforce and close a subsurface-controlled safetyvalve. Under such conditions, reliable operationof flow-velocity type subsurface-controlledequipment can no longer be assured.

Controlling safety-valve operation from a sur-face control station and effecting reliable closureindependent of well conditions were key objec-tives for design engineers. In the early 1960s,Camco, now a part of Schlumberger, introducedsurface-controlled subsurface safety-valve(SCSSV) systems to meet these needs (left).Later design improvements led to an internalvalve profile that creates minimal disruption tofluid flow within the production conduit while thevalve is open.

An SCSSV is operated remotely through acontrol line that hydraulically connects the safetyvalve, up and through the wellhead, to an emer-gency shutdown system with hydraulic-pressuresupply. The design is fail-safe: through the con-trol line, hydraulic pressure is applied to keep thevalve open during production. If the hydraulicpressure is lost, as would occur in a catastrophicevent, the safety valve closes automaticallythrough the action of an internal power-springsystem—a normally-closed fail-safe design.

With an SCSSV, activation no longer dependson downhole flow conditions. External controlalso allows the valve to be tested when desired,an important improvement for a device that may be installed for years before its primary use is required.

2. The regulations use API Specifications 14A and 14B.3. A prorated well is one in which the maximum production

rate is fixed by law.

FLFL

FSFS

FHFH

FU FU

Lock

Seal

Tubing

Casing

Hydraulic-control line

Seal

Valvespring

FlowFlow tubeand piston

Flapper

> Surface-controlled subsurface safety valve (SCSSV). The more recentSCSSV design is a normally closed valve, with the spring force, FS, acting topush the piston upward and release the flapper to close the valve. Controlpressure transmitted from surface through a hydraulic-control line actsagainst the spring to keep the flapper valve open during production. This con-centric-piston design, which has been replaced in many modern valves by arod-piston design, has a ring-shaped area between the piston and the valvebody that the hydraulic pressure acts upon to generate the opening force FH.The small difference in the piston-wall cross sections between the upper (U)and lower (L) faces of the piston adds a small additional upward force, FL – FU.

Closure systems—Early safety-valve closuremechanisms typically had two main designs: aball- or a flapper-valve assembly (above). Theball-valve design is a sphere—the ball—with alarge hole through it. When this hole is alignedwith the production tubing, flow is unimpeded.Rotating the ball 90˚ blocks flow. Ball valves aremechanically more complex to operate since lin-ear movement of the control mechanism, often apiston, must be converted into rotational motionof the ball on the seal. The ball-valve mechanismalso is sensitive to an increase in friction causedby debris or accumulations of scale or paraffin.

The flapper-valve design, pioneered by Camcoin the late 1950s, has become the most com-monly used closure mechanism in the industry,including the challenging severe-service applica-tions where reliability over the life of a well isrequired. A flapper acts like a door. A flow tubemoves in one direction to push the flapper openand allow flow through the valve. Moving theflow tube back from the flapper allows a torsionspring to close the valve and block flow.

A flapper-valve mechanism is less susceptibleto malfunction than a ball-valve assembly andoffers several advantages during operation.

Debris in the flow stream and solids buildup fromscale or paraffin are less likely to prevent closureof a flapper valve than a ball valve. A ball valvecan be damaged more easily by a dropped wire-line tool or other equipment lost in the wellbore.Fluids can be pumped through flapper valveswithout damage to the flapper sealing surface.

The primary function of a subsurface safetyvalve is to close and block flow when emergencyconditions require halting well production. TheAPI has set an acceptable leakage rate of5 scf/min [0.14 m3/min] for newly manufacturedsubsurface safety valves. This is considered suf-ficient to contain the wellbore pressure.

Schlumberger valves are tested to a more strin-gent standard than that required by the API spec-ifications. A valve must close against 200 and1200 psi [1.4 and 8.3 MPa], and no more than onebubble of nitrogen can escape within 30 secondsat either test pressure differential.

After actuation—After an incident that acti-vates a safety valve, it may be necessary to pumpweighted fluids downhole to control, or kill, thewell. Safety valves are usually installed abovemost other downhole assemblies, so a method isneeded to pass kill fluids through a closed safetyvalve. The increased pressure provided by pump-ing the well-control fluids will open a flappervalve and allow fluids to pass easily through thesafety-valve assembly. Once the kill-weight fluidsare in place the flapper valve’s torsion spring willreturn it to the closed position.

When it is time to put a well back on produc-tion, the safety valve must be reopened.Typically, the positive pressure from below holdsthe subsurface safety valve closed. In the earliestand simplest designs, tubing pressure wasapplied from surface to open the valve, but deliv-ering the pressure required may be inconvenientor impractical due to availability of equipment ortime and cost constraints.

56 Oilfield Review

Ball valve

Flapper valve

> Key features of ball and flapper valves. A ballvalve has a sphere with a hole through it, allowingflow through the valve when the hole is alignedwith the tubing. Rotating the ball 90˚ places thesolid part of the ball in the flow stream, stoppingflow (top). The more common flapper valve workslike a hinge with a spring. When the flow tube isdown, the flapper is open, and when it is pulledup, the flapper closes (bottom).

Valve spring

Dart

Flapper

> Typical safety-valve self-equalization mechanism. Manu-factured from erosion-resistant materials, a self-equaliza-tion system is designed to operate on a fail-safe basis withminimal interruption to the overall integrity and operatingreliability of the safety valve. When the flapper is closed, as shown in the tool diagram and in the inset (left), the dart(red) rests in a seat and the flow tube (tan) is slightly abovethe flapper seal. A small increase in control pressure movesthe flow tube down slightly and opens a flow path aroundthe dart (middle). When the pressures above and below theflapper are equalized, the flow tube moves down to fullyopen the flapper valve, and the dart moves into anotherseat (right).

Winter 2002/2003 57

Flapper-type safety valves today include anactuation mechanism that opens the valve using asmall pressure differential that does not damagethe closure mechanism. Self-equalizing valves usethe same actuation mechanism and also feature amechanism to simplify equalizing pressure fromabove and below the closed flapper (previouspage, right). When the self-equalizing valve isclosed, there is a gap between the lower end ofthe flow tube and the flapper. A small increase incontrol-line pressure moves the flow tube downenough to unseat the equalizing dart, which opens asmall flow path to the production tubing below theflapper. The pressure equalizes above and belowthe flapper, allowing the valve to open smoothly.

The self-equalization mechanisms in ball-valve designs require application of a highhydraulic pressure that may damage the morecomplex closure system inherent in these typesof valves.

The potential drawback of a pressure-equalization system is that any mechanism orfluid path that bypasses the closure assemblypresents a potential leak path that may con-tribute to safety-valve failure or malfunction. Thispotential is minimized as much as possiblethrough rigorous designs and manufacturingmethods that set high standards for accuracy,reliability and quality assurance.

In certain applications, the functionality of aninternal pressure-equalizing mechanism is anessential completion-design feature. It may notbe possible to equalize pressure against a closedvalve by pumping fluid into the wellbore at sur-face. For example, on isolated or remote wells, itmay be difficult and expensive to pump fluid intoa wellbore when needed; the equipment may not be readily available or may be expensive totransport to the location. For these wells, a self-equalizing valve may be used to minimize thepressure required at surface.

Generally, the preferred option is to minimizeuse of self-equalizing systems during well designby selecting applications and operational proce-dures that do not require such valves.

Conveyance systems—There are two typicalmethods for conveying and retrieving safetyvalves: tubing and slickline. The method chosenfor a downhole application influences valvegeometry and its effect on fluid flow from thewellbore (right).

Tubing-conveyed, tubing-retrievable safetyvalves are designed to be an integral componentof the production-tubing string and are installedduring well completion with the tubulars and other downhole equipment. For surface-controlled valves, the hydraulic-control line to

surface is attached directly to the safety valveand secured to the production-tubing string as itis run into the wellbore. The primary benefit oftubing-retrievable valves is that production isunhindered; the safety-valve internal diameter isessentially equivalent to that of the productiontubing. The full-diameter bore also permits accessto the lower wellbore with tools and instrumentsfor flow control, well monitoring or service.

A slickline-conveyed, slickline-retrievablesafety-valve assembly is placed in the wellboreafter the production-tubing string and surface-wellhead equipment have been installed. It seatsand locks into a special landing nipple that wasplaced in the production-tubing string at thedesired setting depth, either as a component ofthe tubing string or as an integral element of thedesign of a tubing-conveyed safety valve. Thelanding nipple has a control line to surface to pro-vide hydraulic pressure for operating the valve.

In most cases, slickline-retrievable valves areeasier and less expensive to remove from thewellbore for maintenance or inspection than tub-ing-retrievable designs. Most tubing-retrievablevalves are designed to use slickline-retrievablevalves as a secondary system; if such a tubing-retrievable valve malfunctions, the slickline-retrievable valve can be installed until the nextplanned workover that requires tubing to bepulled. In a small percentage of completions, aslickline-conveyed valve system is used as theprimary safety valve.

A slickline-retrievable SCSSV must have apressure connection with the hydraulic-controlline from surface. The landing nipple has two pol-ished areas on either side of a hydraulic port.Sealing elements on the outside of the slickline-retrievable valve mate with these polished boresin the nipple. Once a valve is locked in place, theseals contain the hydraulic pressure and sepa-rate it from wellbore fluids.

Material selection—In a wellbore environ-ment, where fluids can be corrosive or erosive,and have the potential to precipitate scale andorganic solids, it is difficult for any downholeequipment to maintain a high degree of readi-ness and reliability over an extended period oftime. Flow-wetted parts, which are in contactwith production fluids, must be designed to resistcorrosion, erosion and the buildup of precipitatesor solids.

Flow-wetted surfaces of Schlumberger sub-surface safety valves can be protected with asurface treatment of ScaleGard scale-depositionresistant coating. This is a Teflon-based productwith an enhanced binder that is applied to sur-faces by a spray and bake process. The 0.0013- to0.002-mm (0.00005- to 0.00008-in.) thick coatingdoes not interfere with the operation of comple-tion-equipment assemblies with moving or recip-rocating parts, and is slightly flexible. AScaleGard treatment imparts the same excellentfriction-reduction properties as Teflon materialeven under conditions of poor lubrication.

Surface control panel

Hydraulic-control line

Flow coupling

Seals

Tubing-retrievablesafety valve

Hydrauliclanding nipple

Flow coupling

Slickline-retrievablesafety valve

> Comparison of slickline- and tubing-retrievable safety-valve systems. Theslickline-retrievable system typically locks into a landing nipple in the com-pletion string and seals on either side of the control-line port to isolate thecontrol fluid from wellbore fluids (left). The tubing-retrievable system is anintegral part of the completion string (right). The inside diameter of the valveis similar to the inside diameter of the production tubing.

Scale, which comprises various inorganicsalts that precipitate from aqueous solution,resists adhering to parts with ScaleGard protec-tion since Teflon surfaces resist wetting by bothaqueous and organic solutions. ScaleGard coat-ings also have excellent chemical and heat resis-tance. Material selection, component design andthe coating of flow-wetted parts contribute to theeffectiveness and dependability of subsurfacesafety valves.

Valve-System IntegrityIn the past, safety-valve systems have malfunc-tioned because of failure or problems with com-ponents other than the SCSSV itself. For pistonand flapper components in the device to operateproperly, the control line, control fluid and sur-face control systems also must be designed,manufactured, installed and maintained properly.

Small amounts of debris in the hydraulic con-trol fluid have caused safety-valve systems tomalfunction. The primary protection from thisreliability hazard is to provide operating person-nel with the facilities and training to apply high

standards for operating and maintaining a sub-surface safety system throughout its life.Additional protection comes from Schlumbergercontrol-fluid filtering systems that can beinstalled in surface and downhole equipment tominimize this risk. Several deepwater safety-valve designs now include this filtering system asan integral component to ensure operationalintegrity for the life of a well installation.

The safety-valve control fluid must functionproperly throughout exposure to a wide range oftemperatures and pressures. The fluid mustmaintain viscosity, lubricity and general condi-tions that ensure continuous satisfactory opera-tion of a safety valve. The closing time for asafety valve—time elapsed between initiatingaction at the surface controls and valve closure—depends largely on safety-valve designand setting depth, and viscosity of the controlfluid. A control fluid must be matched to all antic-ipated operating conditions to ensure optimizedperformance of a safety valve.

Historically, oil-base control fluids have beenused. However, the control systems used for

modern well systems often are designed to ventcontrol pressure at the seafloor to reduce operat-ing response time. Environmentally safe, water-base control fluids were developed for thisfunction, and they typically maintain the highperformance requirements of oil-base control fluids. Synthetic fluids are now available for situations in which the operating environmentexceeds the chemical and temperature capabili-ties of water- or oil-base fluids.

Safety valves typically undergo functionaltesting to API specifications at the time of manu-facture; many local governmental bodies regulateand require such testing. Since operational sensi-tivities vary by type of valve, model and manufac-turer, the specific operating manual must beconsulted to establish operational procedures andconstraints for a specific valve design.

Advanced safety-valve systems should beengineered to handle a valve malfunction, sosafe production can resume as quickly as possi-ble. Many regulatory bodies prohibit productionwithout a functional safety-valve system. Thewell should have contingency tools in place, withmodes of operation prepared to resume or con-tinue production safely until the next scheduledmajor intervention or workover. For example, as acontingency, some tubing-retrievable safety-valve systems are designed to be locked openand have a slickline-retrievable safety-valveassembly inserted to use the same control sys-tem, as described above. Although the secondaryvalve assembly may restrict flow somewhat, pro-duction can be continued while preserving thenecessary functionality for well safety.

Turbulent flow can generate material lossfrom tubular walls above and below a restrictionor profile change in production tubulars, such asmay occur with a safety valve. Heavy-wall flowcouplings often are installed in the tubing aboveand below safety-valve assemblies to protect thestring from damaging erosion at these points.Flow couplings are always recommended—insome cases required by regulation—with slick-line-retrievable safety-valve assemblies, becauseof the greater restriction and increased turbu-lence created by the change in internal profile ofthe flow conduits.

Optimizing Flow SafelyA systems approach frequently is used to selectproduction tubulars and completion componentsfor oil and gas wells. This ensures that the over-all performance of the assembled completionstring is compatible with reservoir deliverabilityand that the conduit between the reservoir andsurface facilities is efficient.

58 Oilfield Review

Chemical-injectionmandrel at 11,435 ft

Subsurface safetyvalve at 937 ft

Production packerat 12,339 ft

Liner and lowercompletion

Chemical-injectionmandrel at 11,571 ft

Aberdeen

St. Fergus

Shetland Islands

Orkney Islands

N o r t h

Se

a

UK

150 km750

100 miles500

Bruce field

> Bruce field, offshore Aberdeen, Scotland. On the right is a Bruce field wellbore design. The SCSSV isplaced at the shallow depth of 937 ft [286 m]. Chemical-injection mandrels are much lower in the well.

Winter 2002/2003 59

Completions are designed to minimize theeffects of corrosion and erosion to be expectedfrom produced fluids and solids. Production con-ditions can change or may exceed expected performance such that it may be possible to pro-duce a well at rates higher than anticipated.Production engineers then have two options ifthey wish to use the existing completion: con-strain production according to the limitations ofthe original completion design; or investigatehow production levels can be increased whilemaintaining an acceptable safety factor withinthe limits of installed equipment.

BP adopted the latter approach for gas wellsin the Bruce field, located in the northern NorthSea (previous page). Development began in 1992,with first oil and gas produced in 1993. A study toassess the impact of production changes onsafety-valve operation focused on subsea wellscompleted in the late 1990s with 51⁄2-in. tubingand Camco TRM-4PE tubing-retrievable safetyvalves. This valve design incorporates nonelas-tomeric dynamic seals—made of a spring-ener-gized filled Teflon material—and a self-equalizingsystem (right).

Well testing and early production data sup-ported a rock-mechanics finding that the Brucereservoir formation was competent and had min-imal potential for sand production. Recentlyrevised operating guidelines adopted by BP atBruce field had identified 230 ft/sec [70 m/s] as the maximum fluid velocity for nominal solids-free gas production (sand production<0.1 lbm/MMscf [0.0016 g/m3]). On this basis, BPraised the production-velocity limit for solids-free, multiphase-flow conditions on Bruce fieldcompletions. However, several wells were rate-constrained by the 110 ft/sec [34 m/s] operatinglimit of installed safety valves.

BP estimated that the additional productionallowed by increasing the fluid-velocity limit from 110 to 230 ft/sec on the Bruce field wellswould be 15 to 20 MMscf/D [425,000 to566,000 m3/d] for each well. Recompletion orworkover to allow this increase in productionwas not considered feasible, so the limits on SCSSV performance and capability were re-evaluated.

Operational testing of subsurface safetyvalves under flowing conditions, known as gas-slam testing, is routinely performed as part of theproduct design-validation process, using API andISO specifications. These standard tests are per-formed at relatively low flow rates—tens of feetper second.

Hydraulic-controlline

Valve spring

Flapper

> TRM-4PE safety-valve assembly used in the Bruce field. The tubing-retrievable TRM series has a compact and simple design suitablefor a wide range of completion types. The number of seals and con-nections incorporated within the valve assembly is minimized toreduce the risk of leakage.

For higher gas flow-rate conditions, special-ized equipment is required to slam test valvesand monitor valve performance. The previousSchlumberger flow-rate restriction of 110 ft/secfor operation of the TRM-4PE-series safety valvewas set using these conventional design tests.

Additional safety-valve slam tests were per-formed at the BG Technology Limited test facilityat Bishop Auckland in the UK, one of only threefacilities worldwide capable of performing suchgas-slam tests under conditions that are as closeas possible to Bruce field conditions.

The primary objective of these tests was todetermine if the TRM-4PE-series safety valvescould be safely and reliably used at producingconditions of 230 ft/sec. Part of this processestablished the maximum gas-flow velocityagainst which the safety valve will slam closedmultiple times while maintaining reliable opera-tion and sealing to an acceptable leak rate—thespecified API allowable leak rate of 5 scf/min.Reliable operation is determined by measuringrepeatable and consistent valve hydraulic operat-ing pressures. The gas-slam-testing procedureand associated instrumentation were designedto monitor performance of key safety-valve components including the flapper and seat mechanism, hydraulic system and equalizing-valve-activation mechanism.

Valve closure was tested at a series of massflow rates with visual inspection of critical com-ponents after each test series. Initial tests at110 ft/sec were first conducted to establish abaseline for the operating performance of thevalve hydraulic system and closure mechanism.Staged increases in mass flow rate were applied(below). Precise measurements of leakage weremade upon initial closure and again followingfive open and close cycles.

The goal was to successfully test the safetyvalve at 230 ft/sec. This was achieved, and addi-tional, more aggressive flow rates were appliedto establish the limit of the current valve design.Tests of 400 ft/sec [122 m/s] were successfully

applied to effect closure, although the rate of350 ft/sec [107 m/s] was deemed to be the reli-able limit of operation for the standard valvecomponents in use.

As a result of testing performed on the safetyvalve and the engineering study conducted onthe completion system, the production-rate limitfor the applicable Bruce field wells wasincreased from 110 to 230 ft/sec. This increasewas made with the knowledge that equipmentperformance was assured and that any questionsrelating to the safety or security of the well hadbeen successfully resolved.

After 12 months, the incremental rate benefitfrom each of the rate-constrained wells in theBruce field was 9 MMscf/D [255,000 m3/d] and 400B/D [63.6 m3/d]. In addition, the test results implyrate increases may be considered for additionalcompletions with similar SCSSV installations.

Valve-System ConsiderationsSince the 1980s, several oil and gas companieshave collaborated on a major study of SCSSVreliability, including data from valve manufactur-ers and operating companies with offshore inter-ests in Brazil, Denmark, The Netherlands,Norway and the UK. The study, originally under-taken by the Foundation for Scientific andIndustrial Research at the Norwegian Institute ofTechnology (SINTEF) and currently managed byWellmaster, remains the largest yet undertakeninto subsurface safety-valve operational experi-ence. Conclusions of the SINTEF report from1989 have influenced safety-valve developmentin the years since.4 These conclusions include thefollowing findings:• Tubing-retrievable safety valves are more reli-

able than slickline-retrievable valves.• Flapper valves are more reliable than ball

valves.• Nonequalizing valves are more reliable than

self-equalizing valves.• The need for routine functional testing to identify

problems should be balanced against the risk

of imposing conditions or damage during test-ing that affect the operation or reliability ofsafety valves.

Advances in materials science and compo-nent design coupled with superior quality assur-ance in materials and construction continue toimprove the reliability of safety-valve systemswhile meeting the stringent gas-slam testingrequirements and need for large dimensions forflow of modern high-production well designs. TheSINTEF and Wellmaster studies show that meantime to failure of tubing-retrievable flappervalves improved from 14 years in 1983 to morethan 36 years in a 1999 study.5

Technical and economic influences drive thedevelopment of technology in different ways.Current subsurface safety-valve application categories can be segmented broadly as conven-tional, HPHT and deepwater.

Conventional safety-valve systems areinstalled in predictable or known wellbore condi-tions and require little or no specialist engineer-ing or materials. Operators anticipate such wellswill have some form of economically viable wellintervention during their life, which typically isless than that of advanced wells for which inter-vention is not planned or feasible. The key driverin selecting components in a conventional instal-lation is reliability at an economic price.

Completion designs for HPHT and deepwaterenvironments have a higher standard of reli-ability, with an emphasis on safe and efficientoperation that optimizes production from thereservoir through the entire life of a well. Thesemore extreme applications require proven designconcepts that minimize the number of seals andconnections to reduce potential leak paths, anduse materials that will be unaffected by theanticipated environment and applied loadsthroughout the life of a valve.

Interventions are becoming more costly, evenwhen they are planned in advance. Well-comple-tion components must last over increasinglyextended periods. The costs, complexity and haz-ards caused by initiation of workover operationsor slickline interventions may be prohibitive on subsea wells. The engineering and quality-assurance activities for such demanding andinterdependent design conditions typicallyrequire solutions to be developed on a case-by-case or project basis.

60 Oilfield Review

4. Molnes E, Holand P, Sundet I and Lindqvist B: “Reliabilityof Surface Controlled Subsurface Safety ValvesPhase III, Main Report,” SINTEF Report STF F89030, SINTEF, Trondheim, Norway (October 1989).

5. “Experience Databases,” Wellmaster Web site, wellmas-ter.iku.sintef.no/expdb.htm, viewed December 9, 2002.

Target velocity,ft/sec

Upstreampressure, psi

Upstreamtemperature, °C

Flow rate,Mscf/D

Measuredvelocity, ft/sec

Mass flowrate, lbm/sec

Leak rate atclosure,scf/min*

Leak rate after5 cycles,scf/min*

110

150

230

300

350

400

740

739

751

755

739

723

19

20

15

14

11

11

63.40

86.84

137.23

179.80

209.88

235.08

110

152

230

297

350

401

36.74

50.33

79.54

104.16

121.65

136.26 0.130

0

0

0

0

0

0.167

0.200

0.130

0

0

0

* The specified API allowable leak rate is 5 scf/min [0.14 m3/min]

> Slam test results.

Winter 2002/2003 61

Engineers and designers of downhole equip-ment are under constant pressure to make themost of available wellbore geometry withoutsacrificing reliability or system value. Casing sizeis largely determined by drilling conditions, soengineers who design completion equipment,including safety valves, must provide the desiredfunctionality without sacrificing available flowarea in the production conduit. High-strengthmaterials allow reduction in the wall thickness ofcomponents, although compatibility with anypotentially corrosive fluids in a wellbore alsomust be examined.

Similarly, designing valves for HPHT installa-tions requires a more rugged construction forload- or pressure-bearing components. Advancedmaterial selection and component design are thekey tools in resolving this problem. The innova-tive curved flapper closure system is one exam-ple of how creative design engineers havemanaged to increase the safety-valve internaldiameter without increasing the external dimen-sions of a valve assembly (above). Safety valveswith curved flappers match the internal and out-side diameters of smaller casing sizes betterthan previously thought possible.

Setting Valves at Great DepthThe depth for placing an SCSSV is limited by thehydraulic working area required to effect closureof the valve. Today, essentially all subsurfacesafety valves are normally closed valves, requir-ing a positive force to keep them open. That forceis supplied by pressure in the hydraulic-controlline to surface, but the constant force that isapplied is the hydrostatic pressure of the fluid inthe hydraulic line. In the event of control-line

leakage, the control pressure could increase if adenser fluid from the tubing annulus leaks intothe control line. To ensure fail-safe operation, theclosing pressure of a safety-valve spring mecha-nism must exceed the pressure potentiallyapplied in either of these cases.

Camco introduced a rod-piston actuation system in 1978 that has been adopted by theindustry for both tubing- and wireline-retrievablevalves (above). The hydraulic area is restricted to

> Safety-valve curved flapper. The curved flapperdesign allows a larger inside diameter for the production conduit. The wings of the flapper are profiled to fit within a smaller radius than wouldbe possible with a conventional flat-flapperdesign. This can offer important advantageswhen wellbore or safety-valve geometry is critical.

> Rod-piston SCSSV. In this valve design, the hydraulic-control pressure, FH,acts on a rod piston, replacing the larger, ring-shaped hydraulic area of a con-centric-piston valve design. This much smaller cross-sectional area allowssmaller springs, which is significant for valves placed at great depth.

the cross-sectional area of a small rod piston thatoperates the flow tube. In addition to dramati-cally decreasing the effect of control-fluid hydro-static pressure, the seal diameters are smaller,so less force is needed to overcome seal friction.Setting depths in excess of 2000 ft [609 m] truevertical depth (TVD) are possible with a rod-pis-ton valve. With even smaller rod-piston designs,deep-set valves can be rated to work at 8000 ft[2438 m] TVD. Several mechanisms have beenused to overcome this depth restriction, includingbalance lines and gas-spring systems.

Greater depth can also be achieved by usinga gas spring—a nitrogen-charged chamber—asa balancing force that acts in conjunction withthe valve power spring. This charge is preset toreflect the worst-case hydrostatic pressure in thehydraulic-control line at the valve’s installed

depth, thus allowing valve-setting depths greaterthan 12,000 ft [3658 m] TVD. Recently, three TRC-DH safety valves were placed at depths rangingfrom 10,047 to 10,060 ft [3062 to 3066 m] in theGulf of Mexico, setting an industry record.

Higher well pressures and temperatures alsorequired changes in SCSSV seal design.Elastomeric sealing materials are susceptible todegradation at high temperature and in hostilechemical environments. Over time, the reliabilityand efficiency of a safety valve using elastomericsealing may deteriorate. Camco developed thefirst safety valve that replaces elastomeric sealswith metal-to-metal sealing systems.6 In recentyears, this technology has been coupled withmetal spring-energized filled Teflon sealing sys-tems to meet the ever-increasing severity ofsafety-valve applications.

Exploiting reservoirs in deep water dependson solving technical challenges that only a fewyears ago were thought to be insurmountable.Kerr-McGee Oil & Gas Corp. focuses on develop-ing high-potential core-production areas, such asthe frontier deepwater environment, with a rigor-ous approach to cost, quality and technology.Their expertise and rapid response to opportuni-ties and challenges allow Kerr-McGee to com-plete developments and achieve early productionwithin aggressive time frames. The Nansen andBoomvang developments that came on stream in the first half of 2002 benefited from thisapproach (above).7

Located in the Gulf of Mexico about 135 miles[217 km] south of Galveston, Texas, USA, theNansen field lies in 3678 ft [1121 m] of water.

62 Oilfield Review

Nansen field

G u l f o f M e x i c o

Boomvangfield

USA

Galveston, Texas

> Nansen field, Gulf of Mexico. The Nansen facilities were constructed with a truss spar, shown in the photograph.

Winter 2002/2003 63

The field is developed with a combination of sub-sea, wet-tree wells and dry-tree wells on theplatform (for more on wet and dry trees, see“High Expectations from Deepwater Wells,”page 36). At this water depth, a deep-set safety-valve system with a nitrogen-charged spring isrequired. With this system, the safety valve alsocan be positioned below the critical area in awellbore where formation of scale, paraffin orsimilar wellbore deposits could impact the oper-ation or reliability of the valve-closure mecha-nism. The neighboring Boomvang field wasdeveloped in parallel using similar technologies.

Kerr-McGee had a long, successful historyusing Camco subsurface safety valves, includingthe tubing-retrievable TRC-DH series deep-setsafety valve, and experience working withSchlumberger on previous projects. The companyinvolved Schlumberger engineers in well planningand completion design for the Nansen project.The TRC-DH safety valve was used for both sub-sea and platform wells on the Nansen develop-ment (right).

Close cooperation between Kerr-McGee andSchlumberger engineers helped resolve chal-lenges efficiently without impacting the criticaltimeline. For example, long lead times often arerequired for material sourcing in ambitious pro-jects, so requirements for special materials orunusual equipment specifications were identifiedearly. This included obtaining material for manu-facturing valve components, because the rela-tively large diameter of safety-valve componentsrequires material in sizes that are not alwayscommonly available.

Kerr-McGee engineers demanded redundantfeatures and safe operating characteristics. TheTRC-DH safety-valve series was specificallydeveloped for this type of deepwater application.The valve design incorporates a dual-piston-operated control system that provides completeoperating redundancy. The gas-spring systemprovides substantially lower control-line pres-sures at greater setting depths compared withconventional valve systems. The surface control-line pressure for gas-spring valves in the Nanseninstallation is less than 5000 psi [34.5 MPa] atsurface, compared with 10,000 psi [68.9 MPa]

6. Blizzard WA: “Metallic Sealing Technology in DownholeCompletion Equipment,” Journal of PetroleumTechnology 42, no. 10 (October 1990): 1244–1247; andMorris AJ: “Elastomers Are Eliminated in High-PressureSurface-Controlled Subsurface Safety Valves,” SPEProduction Engineering 2, no. 2 (May 1987): 113–118.

7. For information about the Nansen and Boomvang devel-opment: “World’s First Truss Spars—Nansen &Boomvang,” Supplement to Hart’s E&P and Oil and GasInvestor (Fall 2002).

> TRC-DH safety-valve assembly used in the Nansen field. Dual operating pis-tons allow operational redundancy. A gas-spring mechanism is designed tobalance the weight of the control-line fluid and allows use of low control pres-sure at surface. This valve is designed for deep-set and high-pressure applica-tions. The flow tube rests on the nose seal when the flapper is open. Thisspring-loaded Teflon ring prevents debris and solids from accumulating in theflapper and seat areas.

that would be required for conventional valveoperating systems. Using this valve series con-tributes significantly to reliability of the controland operating system and reduces hazards asso-ciated with extreme-pressure hydraulic systems.

Kerr-McGee selected 31⁄2-in. TRC-DH-10-Ftubing-retrievable safety valves for all three ofthe subsea wells tied to the Nansen develop-ment (above). The nine dry-tree wells used eight31⁄2-in. valves and one 41⁄2-in. valve. Three 41⁄2-in.valves of the same specification were selectedfor critical subsea completions in the neighboringBoomvang development.

The compact design of the TRC-DH safetyvalves provides the principal dimensions of5.750-in. outside diameter (OD) and 2.750-in.inside diameter (ID) for the 31⁄2-in. valves, and7.437-in. OD with 3.688-in. ID for the 41⁄2-in.valves. Most of the components for this safety-valve series are machined from 13 chrome high-strength stainless steel, resulting in a workingpressure of 10,000 psi for both valve sizes. The

valve design incorporates a nose-seal system onthe flow tube. This is a spring-loaded Teflon ringthat the bottom of the flow tube rests on whenopen, thereby preventing debris and solids fromaccumulating in the flapper and seat.

The completion design for all of the Nansen wells placed the safety valves at 7425-ft[2262-m] true vertical depth. At this depth, temperatures were high enough that there wasminimal risk of hydrates or precipitated solidsinhibiting the valve operation. Since all valveswere placed at the same depth, a common gas-spring pressure was applied to the valves duringmanufacture. Designing the completions to besimilar to one another was a key factor in realiz-ing economic benefit and eliminating proceduralproblems and their associated delays.

Work on these subsea wells requires a deep-water drilling rig for well access, a costly and pro-duction-delaying process that reinforces the needfor reliability in safety-valve operation. The dualoperating systems incorporated in each valve areindependent and fully redundant control systems.This significantly reduces the risk of having to per-form a well intervention or workover operationshould there be a hydraulic-control system prob-lem within the downhole safety-valve system.

A project-management approach to the selec-tion, manufacture and installation of the safetyvalve and associated system components duringthis multiwell project allowed lessons learned tobe quickly incorporated into the design process forsubsequent installations. For example, during theNansen project, minor changes in material specifi-cation, product design and installation procedureswere implemented as early experience highlightedopportunities for improvement. Engineering designchanges and amended procedures improved thecontrol-line clamping system, which simplifiedsafety-valve installation. This level of integrationgives both suppliers and manufacturers a sharedresponsibility for safety and environmental issuesthat are key success indicators for projects such asthe Nansen development.

To date, Kerr-McGee and Schlumberger haveinstalled 10 safety valves, all of which are oper-ating as designed and without failure. The suc-cesses and lessons learned at Nansen andBoomvang fields—including metallurgy, manu-facture, design, operations and personnel aspectsfor safety-valve systems—will be carried for-ward to other deepwater developments in theGulf of Mexico.

Future ChallengesThe trend toward more complex reservoir devel-opment continues to present challenges fordesigners of safety-valve systems. Petroleumreserves today are exploited from deeper waterand in harsher producing and operating conditionsthan ever before. In these more hostile condi-tions, material selection is critical for increasingequipment resistance to corrosion and materialdegradation over extended production periods.

An essentially unlimited setting depth couldbe achieved by developing subsurface safetyvalves that incorporate solenoids to activate thevalve. This would alleviate the problem of pres-sure contributions from the weight of fluid in thecontrol line or leaks in that line.8

The need for compact equipment and closeengineering tolerances also presents design andengineering challenges for valves placed inextreme environments. Advanced coating materi-als and application techniques, such as theScaleGard coating, have been developed toenhance resistance to surface deposits on flow-wetted and selected valve components. Recentimprovements in chemical-injection technologyallow use of ScaleGard coating within the safetyvalve to prevent accumulations of production-borne contaminants and help to ensure safety-valve system reliability.

Larger safety-valve sizes will soon be needed.In some areas, for example Norway, plans formonobore completions with large-diameter pro-duction tubulars highlight the need for 95⁄8-in.safety-valve systems. The forces resulting frompressure acting on such large component areasare far beyond those of conventionally sizedequipment and present significant additionalchallenges to design engineers.

The success and reliability of features devel-oped in the past are key to the development ofinnovative safety valves for the future. Use ofelectronic control equipment in advanced com-pletion systems is increasing (see “Advances inWell and Reservoir Surveillance,” page 14.) Thistechnology has proven its reliability and function-ality, providing real-time indications of produc-tion behavior. State-of-the-art equipment nowdelivers these real-time advantages to downholesafety systems in situations that, above all oth-ers, require rapid response. This critical compo-nent of a safety system requires focus andexpertise to continue development and ensuresafety and efficient operation throughout a well’s life. —MA/BA/GMG

64 Oilfield Review

8. Going WS and Pringle RE: “Safety Valve Technology forthe 1990s,” paper SPE 18393, presented at the SPEEuropean Petroleum Conference, London, England,October 16–19, 1988.

Mudline and wellheadat 3980 ft

Chemical-injectionmandrel at 6462 ft

Chemical-injectionmandrel at 7377 ft

Subsurface safetyvalve at 7425 ft

Production tubing

Production packer andflow-control systemsat 10,600 ft

> Nansen field wellbore diagram. The chemical-injection mandrels are placed above the SCSSVin the Nansen field.