Journal of Loss Prevention in the Process Industries 23 (2010) 936e953Contents lists available at ScienceDirect Journal of Loss Prevention in the Process Industries journal homepage: www.elsevier.com/locate/jlp 20 Years on lessons learned from Piper Alpha. The evolution of concurrent and inherently safe design Binder Singh a, *, Paul Jukes a, Ben Poblete a, b, Bob Wittkower a a b IONIK1 ConsultingeJP Kenny Inc., 15115 Park Row, 3rd Floor, Houston, TX 77084, USA Cameron, Houston, TX, USA a r t i c l e i n f o Article history: Received 28 May 2010 Received in revised form 15 July 2010 Accepted 30 July 2010 Keywords: Integrity management Safety Corrosion ALARP Key performance indicators Lessons learned a b s t r a c t It has now been well over 20 years since the North Sea Piper Alpha disaster in 1988. There have been many lessons learned; some documented others just etched in memory. The event chronicled many significant changes in the offshore industry. The emanating point for most sweeping changes has been the Cullen Report and the UK North Sea industry. This paper reviews some of the critical lessons and identifies many ‘secondary’ finer points that constitute important learnings. The paper looks at major changes instigated by step changes in safety criticality. It is argued that the ‘second tier’ modes of failure such as corrosion, materials degradation, environmental cracking, erosion, plant ergonomics, etc. need to be better examined. These mechanisms are dangerous threats to the integrity of deep subsea assets, and it is noted that such root causes of failure as witnessed or predicted have yet to be fully appraised. The authors’ use wide experiences and case histories to highlight such concerns, offering rational fit-forpurpose solutions. The industry disconnections between, urgency to build, knowledge transfer, and management of change, are refocused. Powerful advances in risk-based mechanical, process, materials, and corrosion engineering are emphasized and the use of key performance indicators (KPIs) are reasoned for best life-cycle integrity. To keep up with the pace of growth in the deepwater sector, methods of concurrent and inherently safe design have evolved in a world where the practicalities and costs of modification, repair and retrofit are extremely difficult. Hence getting it right at the outset is paramount. Thus the drive for purposeful investment, at design is more justifiable, than the traditional practice of postponing costs (and problems) to operations. In this way the ominous ‘gray’ zone between the two cost centers is better bridged for reasons of safety and commercial advantage. Ó 2010 Elsevier Ltd. All rights reserved. 1. Introduction After the recent 20th anniversary of the Piper Alpha offshore disaster a paper was prepared and delivered to the OTC conference in Houston Texas, in May 2009 and a upon invitation the exercise was repeated for the Offshore Brazil conference in Macae, Brazil in June 2009. This paper is based on an adaptation of the OTC paper (Singh, Jukes, Wittkower, & Poblete, 2009). On the 6th of July 1988, the world’s worst offshore oil industry disaster occurred on the Piper Alpha platform in the UK sector of the North Sea. The loss of life was staggering: 167 dead, with 62 survivors, and dozens badly injured. Much has been written and debated on the incident. This paper examines a new angle on the * Corresponding author. Tel.: þ1 281 675 1020. E-mail address:
[email protected] (B. Singh). 1 IONIK now rebranded to: Wood Group Integrity Management. 0950-4230/$ e see front matter Ó 2010 Elsevier Ltd. All rights reserved. doi:10.1016/j.jlp.2010.07.011 subject matter, in the context of inherently safe design, and the allied second tier items of interest. These are the corrosion-related items that have been accepted as pertinent over the years, but often erroneously perceived with less priority. This is largely because the subject matter is considered too specialistic, or complex and often requiring costly subject matter expertise. As a result, corrosion integrity is sometimes dangerously taken off the agenda by nonsubject-appreciative project or even industry leaders. This paper delves into this contentious area, examines the role of corrosion mechanisms in the root cause analyses of most significant failures and virtually all loss of performance issues. The interpretations are made with the support of solid observations and new understandings in the direct context of integrity and corrosion management. The authors come from a mixed blend of offshore disciplines, with over 80 years of combined experience, predominantly from the North Sea and Gulf of Mexico. The objectives are aimed to be educational and not controversial, but the opinions are strong, and considered very worthy of continued debate and development. and a greater sense of public and industry responsibility by the new generation of engineers and scientists. The Piper Alpha accident was a monumental event. Many more offshore. subsea and integrity-related courses have evolved worldwide. and Mumbai 11/27. the ultimate decision maker or breaker can and often is the commercial sensibility. 2007. 1984. and indeed the alignment of bad sequences. & Smith. and more efficient engineering practices for the oil industry. In reality integrity management (IM) is far more complex than maintenance (a common misnomer). whereupon critical events occurring at a certain juncture in time.. as seems to be the norm under such events. This has been promulgated by the better realization by professionals in the industry that designing to build the asset. etc. has fallen into place. but human and engineering errors were seen to hideously come into play. London 7/7. Three Mile Island. Poblete. JP Kenny. families. some of which may be discerned as at a secondary level. coupled with powerful commercial pressures. The major differential has. better applied knowledge management. but was modified to act as a major gas processing and gathering hub. Overall the report led to the effective dissolution of the prescriptive regulations sanctioned up to that point. especially since it transcends both the capital expenditure (CAPEX) and operating expenditure (OPEX) cost centers. structure. safer. The Piper Alpha was commissioned in 1976. Rather. 1998. considered to be in the same league as Chernobyl. but a greater sense of responsibility to the public. Singh. Fontana. perhaps. Regarding the best way forward it is important to identify all integrity-related threats. 1990.1. no single root cause event that was to blame. & Flannery. merit and worthiness in the arena. in that people (certainly in the British Isles and the North Sea community) often remember where they were on the day. events or circumstances are invariably all time dependent and thus multi-dimensional in nature. 2005. This meant it was handling large amounts of high-pressure gas. Lord Cullen Report. Folk. 2004. and replaced same with the evolution of the goal-setting integrity regulations in the UK and with derivatives thereof. the parameters affecting IM are non-linear and influential during IM pre-planning. which may be due to the fact that it was offshore and involved a heavily manned producing platform. 2. more focused research. Garcia. Root causes Regarding the accident there was. This has traditionally made IM a difficult subject to grasp. largely at postgraduate level. the center piece of most if not all being the ensuing public inquiry and the Cullen Report which was published in 1990 (Lord Cullen Report. The Cullen report has tended to be the main stay reference source for all new offshore design and operational guidelines the world over. maintenance and repair difficult. but one can still discern a good dose of professionalism. and pressure plant can no longer be based on projected revenues alone. Flixborough. 1990). Neal. 2003. and that was a reflection of the non-electronic transfer of documentation. In that way the Piper Alpha seems to have uniqueness about it. Jukes. Singh. Yes. Many studies have looked at that aspect. Wood Group HSE Matters. 1 and 2. These have been realized by better. Challenger. 1980. And indirectly has supported strongly the need for inherently safe designs and procedures. as might be expected in today’s computer driven age. The latter is an important point. This is largely regulatory driven. perhaps. in terms of impact a top-five engineering disaster on the global scale. The rapid technology advances of the day. much to the advantage and betterment of the industry. and the environment. Britton. with the benefit of hindsight. 2008. 2008). And in many ways it is historically comparable to other high-impact human events such as the Kennedy assassination. post planning. with the benefit of hindsight but also with strong opinions forged over time (BBC web pages. Piper Alpha before accident e Courtesy Wood Group (Wood Group HSE Matters. Piper Alpha explosion e adapted (Coastal Training Technology Corporation. 2006. making inspection. It was also commonly noted for truck loads of documents being delivered to the courthouses of London and Aberdeen. On the plus side the major outcome of the disaster has been far better. 1. 2005e2008. 2007. action and reaction. Singh. see Figs. albeit with the potential to give similar disastrous results if not taken fully into account. . but more from the viewpoint of these second tier issues. and subject-matter experts of the day. with a dispersed plant layout. 2007. New York 9/11. 1. been that the disaster was de facto man made. Some regions have used the findings rigorously whereas others have used them less in depth. and the paper takes a critical view of the changes that have been instigated since Piper Alpha. clearly had a lot to do with the event. which usually arise within lower profile Fig. This was the culmination of a thorough two year inquiry involving many interviews with survivors. NTSB). and this paper looks at some of these important issues. The majority of these are materials performance and corrosion related. & Perich. with many others on the outside offering immediate opinions on the many public affairs programs of the day. It is. Singh et al. though not a deliberate act in any way. 2008). 2000e2008. it was a confluence of many critical factors that were almost the ‘perfect storm’ often described as the jigsaw or ‘Swiss Cheese’ effect. BBC web pages). / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 937 Fig. Britton. etc. not so much from the large structural engineering angle. with tragic results. pipeline. (BP Booklet.B. Coastal Training Technology Corporation. Kletz. and as a consequence the failure jigsaw fell into place. Lees. Private Correspondences with Messrs Ben Poblete (LR/Cameron). To that effect first-rate universities across the North American. UMIST/University of Manchester Corrosion Center. monitoring. do we pick materials for immediate fitness for service at fabrication (‘just build it’) or fitness for materials life-cycle performance? The answer is now emerging as a requirement for both. The subtle debate now ongoing is at the material selection stage. JP Kenny. in fact. Overall most offshore regions. human error. are readily available for the interested reader (BBC web pages.3.’ This suggests the designs are suitable at construction. 2007. wear and tear. There are many other important derivations from the Cullen report. in particular the North Sea. As these people pick up practical experience and supplement the traditional engineering and sciences. Permit-to-work systems (ideally fail safe and tamper proof). Singh et al. This has proved to be a step change in offshore safety and engineering performance. especially the SE Asia regions and offshore India. 2008. and training procedures Poor communications (all levels) Poor emergency management (including with regard to surrounding platforms) The Cullen report (Lord Cullen Report. inspection. which still has a tempering effect on employee involvement (Hibbert. Essentially in the context of this paper the Cullen report. 2006. etc. WGIM Internal Training Modules. In other words. suitably trained and educated offshore engineers and scientists must be provided by our educational institutes. Emergency response and incident reporting (effectively by training and changes in attitude and culture).e. The electronic age of software and modeling analyses has made documentation preparation and transfer so much easier that we are only limited by our ability to assimilate and interpret the information across multidiscipline areas (API 14E RP. etc.. JPKeIonik. and to that effect the materials engineering specialist is having an ever-more assertive role to play within the large multidiscipline teams usually engaged on high capital projects (JPKeIonik. but with positive results. it is believed. It has to be said that most of the activities listed above still fall in the grey area of judgment. Coastal Training Technology Corporation. whether to select carbon steel and then carefully manage the operational corrosion. with strong opinions tested for CAPEX and OPEX scenarios. i. better rationale for engineering conservatism and pragmatic safety. JPKenny/University of Houston. Private Correspondences with Messrs Ben Poblete (LR/Cameron). Gulf of Mexico (GOM). 2005e2008. Singh & Krishnathasan. Mueller. which included in summary: The transfer of government responsibility for offshore health and safety to the Health and Safety Executive (HSE) was generally received well. Singh et al.. taken many years to come to fruition. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 design parameters. namely the distinction being made. and better use of loss prevention studies. 2008. not necessarily regulation) has given greater confidence for the new. 2001. For a better. the causes were variously reported over the first year as: metal fatigue. Overall review of legislation. 2007). or to select the corrosion-resistant alloy (CRA) option with minimal corrosion management. The full report is a public document. Industry changes The many ensuing industry changes identified since the disaster have. and much educational material.. and therefore better engineering practices for the offshore and energy industries generally. 2000e2008). and therefore risk management (Singh et al. and more efficient work force and management. The very heartening implementation of best practices (by choice. Systematic approach to safety. Singh et al. European. Verification and intervention when necessary. challenging deepwater explorations and subsea tie backs in the GOM and the new frontier Arctic regions (JP Kenny. Better work force involvement (crucial but sensitive). 2008). poor maintenance. safer. Although there is sometimes a dangerous disconnect between theory and the actual practice of implementation. 2007. video s/DVDs. 2005e2008). The goal-setting idea replaces the prescriptive method.938 B. University of Tulsa. 2008. The contrary arguments are usually cost-center based. JP Kenny. and Australian regions in particular are churning out scores of postgraduates annually in the key disciplines of materials.2. requirements for design review. SCOTA/UKOOA. 2005e2008. definition of best practices. and maintenance. but without unnecessarily going outside the scope of this paper. DOT Regulations. Ramachandra. erosion. 1990) made over 106 recommendations. and other studies have highlighted many reasons for the disaster. The rest of the world (ROW) has responded in a slower manner. the most damning of which were: Poor plant design (including with regard to modifications and changes) Breakdown of the permit-to-work system Bad maintenance management Inadequate safety auditing. Due to the media frenzy of the day. this can only be a boon to the integrity management discipline. the Safety Case. Singh. (Note: the public observed this as government taking some responsibility. 2008. 1. 2007. shown through various studies that reportable . pigging. 2008. 2007. but the gradual drift of this meaning has evolved to ‘life-cycle fitness-for-purpose’ and this appears to be adopted and embraced by the more recent generation of engineers (typically 5e10 years experience) as they enter the fray. corrosion and integrity engineering (Ohio University. for example pressure (leak) containment. UK HSE. UMIST/University of Manchester Corrosion Center. inadequate operating procedures. and in that case best practices must therefore be interpreted and applied through the identification of safety-critical systems and components. and Australia have embraced the new culture of safety. 2006. The most notable changes again in the context of this paper are interpreted as follows: Changes to offshore asset design. 2007. This is where core personnel competencies come into play. 1995. 2000e2008). etc. 1983e1995). 1. New goal-setting legislation. Singh et al. 1983e1995. bad work practices. proactive risk analysis. it is quite clear that management of change (MOC) is and will continue to be the best tool available in the ever-improving area of knowledge management (Deepwater Corrosion Services Inc. 2006). risk reduction.. responsibility of everyone (senior management and down the line). The concept of better work force involvement is a sensitive issue since it is still commonly expressed by workers in the field that an over exuberance with offshore safety at the metaphorical ‘coal face’ can lead to the ‘not required back’ (NRB) factor. more latitude for concept creativity.) The establishment of a Safety Case regime (This was to entail independent verification). There are two schools of thought. 2005). too. For the important GOM region it has been stated that the regulations conferred by the governing Mineral Management Services (MMS) are ‘fit-for-purpose. corrosion analysis. Implementation The implementation of the Cullen report recommendations has. etc. There is a strong case. a major achievement (Private Correspondences with Messrs Ben Poblete (LR/Cameron). pipelines.B. The structures. 1995. relocation. and must. The ‘Swiss Cheese’ Analogy as applied to materials engineering. 2001). with unprecedented population growth. with the intent that by paying more focused attention to these parameters and findings that the integrity management discipline will be more substantively improved. and environmentally friendly solutions. hopefully to reinforce some of the many lessons learned over the past 20 years or so. The resolution of the corrosion aspect will. Threats to asset integrity It is very important for society to progress positively and look at lessons learned in all disciplines from time to time.. here evidently the dangerous proximity of the risers to the control and radio room areas was. The use of modern-day corrosion risk assessment techniques are under development and application. food. but there are still problems and issues. advanced inspection techniques. 2005e2008). 1995. 2004. pressure plant. It is hoped that ultimately these will be implemented by the weight of motivation. JPKenny/Ionik. 2008. in virtually all cases eliminate the closure of the jigsaw effect. Singh. and pertinent (safety-critical parts) thereof (JPKeIonik. and competition for sustaining resources such as water. It is argued that more attention should and must be made to the secondary tier items such as root cause corrosion mechanisms. and parts thereof must be designed and operated at optimum conditions. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 939 incidents that impact safety issues in the UK sector have been significantly reduced by some 75%. 3. These and other related points of view are made in the paper. The burden for doing this is not high. and energy. firstly the industry tendency to avoid the acceptance of external consultants’ advice if the recommendations are not supported by more experienced personnel. It is to this effect that this paper is targeted. One of the greatest threats to any asset integrity is the degradation of the asset with respect to time. sometimes referred as the jigsaw or ‘Swiss Cheese’ effect. JPKeIonik. with the benefit of hindsight. thereby preventing the failure. blast walling. have all been very instrumental in making this industry safer and better equipped to tackle the challenges faced ahead. but the results would be extremely positive. implementation of MOC. etc. And in that regard Fig. 2005e2008).4. often even if the consultation seems logical and safety sensible. Singh et al. efficient. A close examination of the modes of failure reveals the uncanny role of corrosion dissolution at either the macro or micro level (whether it be by alloy. is how the learning and knowledge management process works. in the engineering field the need is most pressing. identified. Apparently some platform corrosion issues were left for over four years (JPKeIonik. the tragedy could have been avoided. and the more newly defined roles and responsibilities for pertinent decision makers. therefore. etc. The second point of observation is the concept of addressing root cause effects. 1.e. i. the design life or. and new initiatives. rather than an ad hoc to-do item. 1984. However. embrittlement. In that context the most dominant degradation phenomena per se is corrosion. the concepts of knowledge management. In almost all major comparable disaster cases the commonality has been the confluence of many variables coming into a tragic alignment. UK HSE. SCOTA/UKOOA. 2005e2008). This aspect is best illustrated by an adaption of the ‘Swiss Cheese’ effect as shown in Fig. 2007). mixed metal galvanic. crevice corrosion. The case of the central riser argument for the Piper Alpha is cited. On a positive note. advanced monitoring and inspection techniques.) the outcome is the same: severe loss of material properties and/or load carrying capabilities (Fontana. The world is changing fast. whilst retaining mechanical integrity over the life cycle. Nowadays virtually all new designs insist on the risers being on the outside perimeter of the offshore asset. This clearly means the industry is on the right track. It is argued in this paper that in almost all cases the loss of materials performance as stimulated by corrosion is the root cause effect. The Piper Alpha condensate pump problems that initiated the whole tragic sequence of events were plagued with corrosion problems the attendance to which was seemingly consistently delayed as lower priority. take note of demand for production. and demands for best safe. etc. though in reality some degree of mandatory regulation may be ultimately required (IONIK JIP. SCOTA/UKOOA. UK HSE. the life cycle. then again. unfortunately. 2001). . If corrosion management as a recognized discipline had been in place. The Cullen report also identified two areas of under emphasis that may be appropriately reasoned. therefore. more appropriately. It is strongly argued that one new recommendation that would be instrumental in helping improve this aspect an order of magnitude would be the ‘mandatory’ requirement for each asset to submit a clear annual corrosion integrity statement on the facility. 3. The oil and gas industry is pivotal to such growth. And it has to be said that companies today often have very valuable lessons-learned meetings after major projects are concluded. in fact. but no action taken (design change. 2000e2008.). That. underway for such formal lesson learnings on an ongoing basis (BP Report. MOCs. riser or topsides equipment there is in practice nearly always a precedent.) then coupled with concurrent changes. corrosion. studies (late 80s and 90s) revealed the important need for corrosion management. pigging and inspection.. The concept and consolidation of the corrosion and erosion JIPs have helped to bridge the link between industry and academia. and have had a role in the development of the laboratory and field testing programs. mechanical integrity. 2005e2008). Thereafter. such as the use of inert I-Rod type inserts. mid-late 90s the terminology seemed to reach a consensus at integrity management (IM). with incidents related to fire. since there is a lack of code guidance per internal corrosion. In terms of proportion.. For the upstream oil and gas industry. Singh et al. 2006. 2000e2008). 2008). typically by over 50% in practice (JPKenny/Ionik. all of which come into play at varying levels of intensity. revisions. The cost factors are easily justified by reduced OPEX costs over the life cycle. especially where corners are cut to meet production and cost issues. As an example the threat breakdown for risers. inspection. 2008) Corrosion must be considered a functional hazard for this approach to be applicable. 1997). thus working applied design life solutions can normally be formulated.5. 2003. thus leading to the term inspection management. even then only with the force of regulation. Fig. WGIM Internal Training Modules. Alternatively the Joint Industry Projects (JIP) might be seen as the conduit for best technology advancement and best knowledge interpretation and management in this regard. 2008). USA) before significant paradigm shifts in attitudes are made. That concept was likely first coined by researchers at UMIST/Manchester when that group realized that corrosion control really defaulted to corrosion management as the discipline was a fine balance of integrity and finance management (UMIST/University of Manchester Corrosion Center. very important to include the pressure vessel and piping community and it is believed that lobby led to the evolution of mechanical integrity management. The aftermath Post Piper Alpha. there is a forceful argument that suggests that by strongly utilizing ISD in the Integrity Management basis (typically by best materials selection. (Fontana. risk. and in reality it usually takes an event like the Piper Alpha or Carlsbad (New Mexico. 2007. 1. such as the translation of horizontal pipeline flow regimes to vertical regimes with a potentially high-risk corrosion activity at the base transition. provided subject-matter expertise is wisely used and safety is not impaired (JPKeIonik. chemicals. with the appropriate sign-off from subject-matter experts in materials. Most career offshore engineers do in fact observe near misses on a regular basis. the qualitative nature of risk-based judgments is honed to a more easily repeatable and consensus-based decision gate system.6. The early work by Fontana et al. pretty much year round. JPKeIonik. and mitigation procedures. 2005e2008. such as area ultrasonic testing (UT) mapping and thermal imaging in the highrisk underside (six o’clock positions). however. 2005e2008. important to continue with fundamental or near fundamental research to help understand failure mechanisms better so more permanent solutions can be implemented as time marches on. 1983e1995). Whether the corrosion failure is on pipeline. quickly converting to a tactical (nuts and bolts detail) type corrosion control manual. Once concurrent design and ISD . Some examples of recent KPI studies and their application are presented later. 2008. though more recent work is pointing to more than ten (JPKeIonik. 2000e2008). Singh et al. ongoing document modified or revised as new data or findings become apparent and usually encompass detailed. 2007. This ‘Achilles heel’ will always be there but hopefully minimized as leadership and the industry progress. especially at supports whereupon several major failures have been observed due to crevice corrosion being accelerated where wet marine air has condensed out high chloride pockets in susceptible areas (Deepwater Corrosion Services Inc. and perhaps warranting greater latitude on the monitoring side. ALARP. The plan is a live. though quite similar. IM is still effectively a corrosion management exercise and that was argued in early pioneering studies by Prodger et al. (Prodger. Singh et al. University of Tulsa. 2006. etc. The use of thermal spray aluminum (TSA) coatings is also a very viable solution for all topsides equipment external and internal surfaces. Further. CP/coatings. 2008. being responded to with duly diligent team actions. with valuable results (Ohio University. etc. corrosion hazard. JPKeIonik. whereupon many studies (Canadian/Russian in particular) over the past 10 years or so have shown that internal corrosion is the dominant cause of failure. intrusive probes and coupons. has been modified and applied to IM studies (Singh. and studies. Singh & Krishnathasan. 2005). a truly best practices regime can be set up. However the potential for mishaps is always there. 2003. It was. in the same vein. 1995. 1984) suggested eight clearly defined corrosion mechanisms.. which forms the basis of the life-cycle IM plan. However the ‘pay now or pay more’ later theory has never fully made the grade. is to ensure that the results are interpreted and applied by skilled and experienced personnel. Singh et al. and therefore aid (technical and legal) argument defensibility. chemical injection. chemicals. leaks. topsides equipment. etc. On the plus side there are many fit-for-purpose solutions. leading to the conclusion that IM was effectively 80% corrosion related. The concept of ALARP is often interwoven into the risk analysis and/or safety management from the very beginning (JP Kenny. This is a significant problem in the GOM where warm temperatures (>21 C) and regional humidity levels are routinely >80%. the term seemed to be broadened to cover for monitoring. 1. and inherently safe design The commonly accepted approach to safety assurance or ALARP is now to ensure on the basis of suitable and sufficient evidence that risk is as low as reasonably practicable (ALARP). / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 there are many mechanisms of corrosion. SCOTA/UKOOA. will have particular nuances to be taken account of. etc. reliability. poor inspection. Singh & Krishnathasan. and to that effect the concept of key performance indicator (KPI). 2007). WGIM Internal Training Modules. pigging. As with all good science and engineering it is vital to quantify critical parameters. 2008. These must always be considered and applied and agreed on a project-specific basis.. This is a reflection of onshore technologies being carefully transferable to offshore applications. it is common to delineate these into the major damage threats. covering all assets (marine/ offshore/industry). topsides pressure equipment will be safety critical.940 B. geometries. Singh et al. In time. The concept of a corrosion management strategy (CMS) has therefore evolved. which if used correctly can virtually eliminate crevicing geometries (Deepwater Corrosion Services Inc. this supplies the high-level approach to IM. one way forward is to use the concept of ALARP to define the limitations or boundaries of the corrosion parameter. Since inherently safe design (ISD) is often perceived as a costly CAPEX discipline. 2005e2008. Singh & Krishnathasan. The trick however. fluid sampling. 4 depicts the ALARP triangle with the processes and descriptions for each segment. Similarly. preferably staffers who are very cognizant of the JIP data being generated. At the same time it is however. and is usually a system FEED-type study. There should also be a greater emphasis on the external corrosion aspect... Thus. (JPKenny/ University of Houston. e risk high* Modeling underway used-relevance very high* Modeling underway used-relevance high Now better quantified e as part of separate JIP study at Ohio University. Marsh. H2S (sour corrosion and cracking). (Ohio University. etc.. etc. NACE International e The Corrosion Society. and natural wear and tear i. 2008.’ encompassing multiple mechanisms.. Jukes. 5) galvanic.) is a good yardstick for successful external corrosion control. are pivotal to project success. The recommendations coming out of the JIPs are membership supported (largely operator companies and key consultants. provocative discussion. Note 3: the use of industry-accepted HML risk designations and simplified go/hold/ no go (green. New build versus old build Most new engineering applications (green field) invariably involve a design code or recommended practice as a reference point. subsea. corrosion fatigue. The results are applicable to all assets tension leg platform (TLP). move closer towards amalgamation then the case for concurrent and inherently safe design (CISD) may become a university taught and thus industry practiced discipline.e. International Standards Organization (ISO). The net effect is that in many.1. 6) selective leaching. engineering companies. This problem area has plagued the industry for many decades. Singh et al. empirical testing. is often a battle of being ‘smart to out smart’ often identified as the Achilles heel in the IM process (JPKeIonik. 2005e2008. There are actually more than 10 recognized mechanisms of corrosion. in other words. good in that it stimulates solid. For offshore and subsea conditions the critical mechanisms are a function of reservoir composition. amber. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 941 2. top of line (TOL). in fact. and when. Note 1: perceptions asterisked (*) are best given as ‘localized. 9) stress corrosion cracking (SCC). Having the right blend of multidisciplined engineers is key to success if multi-facetted failure mechanisms and root causes are to be properly addressed. commercial aspects. In the USA the challenge is being met by the continued growth of two major JIPs. The only real question being. Singh. and microbially influenced corrosion (MIC). at Ohio University under the auspices of Nesic et al. One example of that is pipeline cathodic protection (CP) and coatings. from both sides of the aisle: from the operator and the engineering contractor (IONIK JIP. monitoring good-viable Modeling difficult but R&D done. 2007. as a result the competitive forces at work.). 2006). rather than if. have justifiable and defensible arguments as support. embrittlement. on the one hand. medium risk Empirical/experience. 2) pitting. Garcia. HML must always be assigned by materials/corrosion specialists and. 2007). 2002. 2.B. 4) erosion (including impingement/cavitation). case history. namely the need for revenue as against best safe technology (BAST). 1999e2002. Nyborg. 2008). As with all engineering projects. but life-cycle fitness-for-purpose is really about managing all mechanical and corrosion-related degradation mechanisms. Both JIPs effectively tackle and model corrosion and erosion and MIC modes of failure through an exhaustive combination of theoretical modeling. Note 2: the assessment of risk can be qualitative. and field trials. embrittlement and loss of material properties. largely because the mechanisms of corrosion are complex and often multifaceted (Jepson & Research Workers. relevance high risk* Relevant modeling used. These are usually industry-accepted guidance documents that have been developed over many years. This is reflected in the weak argument often used that the design complies with the regulations. 2005). been through many cycles of peer review. 3) crevice. 7) intergranular. and thus their findings have received solid acceptance industry wide. including: stress overload. bottom of line (BOL). etc. motivated. mobile drilling unit (MODU). and thus best workable fit-for-purpose solutions can be attained. whereupon code compliance (Det Norsk Veritas (DNV). and at Tulsa University under the guidance of Rybicki et al. 2007). and low-risk (HML) nomenclature has been adopted for simplicity and consistency. (University of Tulsa. 8) fretting/wear. etc. medium-. fully implemented. and the most dangerous threats are therefore CO2 (sweet) corrosion. separate JIPs underway at Ohio/Tulsa Univ. relevance medium risk Modeling hard (danger ‘mesa’ scale related attack). viz: 1) uniform corrosion. weaknesses in design leading to failures down the road can be expected. Unfortunately. Also all high-risk phenomena can be mitigated down to low risk with diligent. Fig. dissolution of the metal under aggressive environments. or semi quantitative. This often adversarial development is. That alone is not enough. return on investment (ROI). The balance of academia and industry ensures that the decision-making process is not skewed by overriding commercialism. & Delille. Corrosion mechanisms per upstream and subsea Uniform corrosion Pitting corrosion Crevice corrosion Galvanic corrosion Stress corrosion Erosion corrosion Corrosion fatigue MIC CO2 corrosion H2S corrosion TOL Well addressed via theory. where. The ALARP triangle depicting the importance of corrosion risk assessment in the risk management and loss prevention exercise. etc. topsides. hydrogen damage. Nyborg & . spar. project viability. the JIPs are commonly used as a reference point. surveillance and corrosion management procedures provided they are. however if materials engineers are not strong enough to debate their corner hard and strong. provided the appropriate expertise is deployed to allow for the subtle differences across assets and systems. red) traffic signal type decision gates is a really good evolution in the design and operational integrity management process. filling the void that has long been present. Ultimately these will tend to be perceived as the industry standards. and tested via experience. Once at the tactical stage it is found that corrosion under multiphase hydrocarbon flows presents the most challenging and integrity-threatening condition. fixed. 4. The high-. medium risk and reliability in practice Modeling used-relevance high risk* Interpretative used-relevance high risk Very subjective. Reference to established codes gives the design and end client credence and confidence in its workability. where possible.. Singh et al. 10) Other creep/embrittling. it may be a minimum requirement. Singh et al. if not most. cases the project remit becomes ‘design to build’ rather than the preferred ‘design for the life cycle’. etc. that is not the case for internal corrosion. This work seems to be leading the way globally and in the absence of bone fide codes of practice and standards. schedule. the most popular being that of corrosion modeling. 2007). 2008. if not. The modeling we do should anticipate that and hopefully these guidelines presented will provide a framework for that. suitable modeling calculations. It is clear that most are . JP Kenny. 2002). The most common threat to pipeline integrity has been mixed CO2 or sweet corrosion. Tulsa SPPS (Tulsa JIP). regulations and inherently safe design Ultimately the integration of ISD into mainstream engineering practice will almost certainly happen. OLGAÒ (corrosion module inclusive). however that will probably change and regulations in most regions will likely refer to best practice modeling or corrosion analyses to ensure that corrosion integrity is accounted for within the integrity management process (Singh et al. Singh et al. 2006). Generally most models have a ‘black box’ critical analysis. Predict/Socrates.). 2007. In practice the greatest criticisms of the modeling approach have been the noneagreement of calculated corrosion rates to the observed field values. Nyborg & Dugstad. 2005e2008. Singh et al. Thus it can be construed that the main objective of corrosion modeling or corrosion assessment has evolved to differentiating (at build) whether or not the carbon steel will be acceptable as the main flowline material. such that failures can be eliminated or arrested to tolerable values. there is little room for error. Rules. Cassandra 93/95. differential aeration. reasonable risk-based ALARP driven decisions are considered justifiable. therefore. Nevertheless the deepwater campaigns continue and it is up to engineering companies to offer justifiable but realistic solutions and where proven data or correlations are not available. Wood Group HSE Matters. provided the caveats are defined. and whilst most have individual strengths and weaknesses. 2006). All the models can really do is give a general guidance as to the corrosivity of the media involved. The impact of this decision can be crucial since the CAPEX/OPEX ratio is greatly affected and will often make or break the project. NACE. 2004. The latter is difficult but would have the greatest impact if it could wrap up flow assurance. Norsok M506. ECE. whereupon existing assets often badly corroded need to be assessed for remaining life and ongoing corrosion. The research is still closely guarded though it has evolved to be more pragmatic and project risk-orientated (deterministic/theoretical). 2007. As a rule almost all have little proven consistency of confidence to field observed corrosion rates. 2008. etc. or. 1999e2002. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 Dugstad. perhaps. 2008. Lord Cullen Report. Multicorp v4 (Ohio JIP). That was seen to be quite possibly the ultimate snafu in offshore history. absolute values of corrosion rate still cannot be reliably predicted without reservation using any of the 15 or so models available (IONIK JIP. It has been found that the best way to do this in a convincing and reasonable manner is to utilize interpretation of the relevant and available rules and codes of practice. It is recommended that these be used on a case-by-case basis. weather the analysis justifies the use of CRAs as the design basis. US DOI-MMS Federal Register. 2008. Singh. though some claim. since repairs or retrofit can be very costly or practically impossible. and safety inextricably to production and. stagnation fluid chemistry. corrosion.. and other decision makers to continue with producing. 2008). Nyborg. 2007. etc. perhaps more akin to the UK goal-setting requirements. 1990. offshore installation managers (OIM). revenue. 2002. this and other influencing parameters. or on the host facility (e. For deepwater applications whether subsea at >4000 ft. 2007). It is expected to have solid calibration capabilities with ultimately. Offshore corrosion failure case histories Even post Piper Alpha there have been many integrity and corrosion-related failures. Thus. for steel that means the development of a pragmatic corrosion allowance. and some of the more important types are presented for illustrative purposes only. This is a controversial argument but one that would help eliminate the pressures on project managers. It has therefore been necessary to develop methods of resolution. which is all the more important in an evermore litigatious society (IONIK JIP. a flow assurance-linked corrosion modeling package seemingly viable.2. 2008. The problem seems to be that the localized component is rarely addressed in a transparent manner. therefore. US DOI-MMS. Whilst external sea water corrosion control is regulatory driven. though specific differences (usually more onerous may be relevant if North Sea rules and the Safety Case are applied). and there are some criticisms as well as positives. when adjoining platforms continued to fuel the fires on the hapless Piper Alpha (BP Booklet. the vital need for the corrosion predictions to be pragmatic and done to the best possible reliability.g. As far as the GOM region is concerned a mixture of prescriptive and performance related criteria are applicable. crevice pH. the case for internal corrosion is only heavily implied though not specifically regulatory or code compliance driven.. 2. The US federal regulations have stirred debate in the US.g. the industry seems to have embraced the impending rules (DOT Regulations. In particular the Government Mineral Management Services (MMS) now slated to be the Bureau of Ocean Energy (BOE) have defined potential incidents of non-compliance (PINCs). ULL model and others. though as alluded to earlier the combined efforts of academia and regulatory authorities will be the most likely catalyst. (likely> 15) e. Nevertheless. As alluded to previously there are many models available. industry experience and best judgment. understood and accepted by the client (Jepson & Research Workers. Coastal Training Technology Corporation. The onus is. Nyborg. 3. Lipucor. & Ahmed. US DOI-MMS Federal Register. This can be a challenge as critical parameters such as existing pre-corrosion condition and/or existing inspection data are not always readily available. The rules are US-specific but should serve as a template for defensible corrosion prediction. on diligent designers to ensure that best safe technologies and techniques are utilized to understand and predict corrosion mechanisms and corrosion rates. The same arguments apply for old build (brown field). 2007. Ramachandra. 2008). JPKenny/Ionik. The main advancement is likely to be a greater specificity regarding internal corrosion. Nyborg. In practice. That change was expected to be imminent and may still happen within the Federal Rules though there is a powerful lobby against the changes such that the rule change approval may be delayed (Singh & Krishnathasan. and more and more are trying to include.942 B. TLP/SPAR/MODU. 2007). This is mainly due to the fact that the designs attend essentially only to the base CO2 corrosion case. the common critique is invariably unreliable correlation to the laboratory and more importantly field experience (IONIK JIP. Overall. Marsh. the use of a suitable modeling or JIP study would no doubt be accepted as a supporting reference to the regulations. Hydrocorr. 2007). Similarly the Federal Register may be used to support the requirement for diligent corrosion assessment and management thereof (JPKeIonik. 2007. In reality even with the large amount of corrosion work done over several decades. Krishnathasan. 2007). often under fault conditions. and these may be interpreted as a corner stone boundary condition for predictive corrosion control to help focus the designer’s attention and attitude towards safety (Singh. though the JIPs appear to be more transparent at least to the member companies. and exclude a truly meaningful localized component. with no reference to localized criteria or parameters such as crevice/deposit size. Nevertheless predictive modeling does serve a useful purpose in this regard. 2002). at the steel catenary risers (SCR). by individual member companies. in that it led to strident changes in regulatory requirements via the Dept of Transportation (DOT) (NTSB. Aug 2000. Noting that the corrosion was concentrated at the girth and seam welds at the bottom position. the first US equivalent of Piper Alpha. Case history #3 Catastrophic failure of choke sleeve on offshore facility. adapted (Singh et al. adapted (Kletz. Failure mechanism analysed to be combined erosion/cavitation and impingement. 2003). such as those offered by the JIPs.3. no on-line monitoring. Impinging cavitation forces can far exceed the proof stresses of most alloys adapted (Singh et al. with 72% wall loss.. Tragically 12 outdoor campers were deceased.. 3. The first is. Singh et al. produced water system sensitive to poor protective filming..2.1. This should be of much advantage to the industry as a whole by infusing an alternative layer of checks and balances to drive the research for better understandings and ergo better solutions.4. Case history # 2 Depicting failed manifold on a fixed platform due to isolated erosion defect of the steel upstream of an inhibitor injection point. NM. 3. . / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 943 solvable by better using existing knowledge and widely available techniques. including more recently. Age 10 years. 2005e2008. Root cause determined a combined corrosion mechanism dominated by chloride/CO2/microbial as exemplified in the micro image below. 2003. Singh et al. 3. Case history # 1 Top plate aftermath of the Carlsbad. 1998). existing modeling predictive techniques. perhaps. 3. 2000e2008). A number of examples (Case Histories # 1e5) illustrate the role of corrosion in the integrity management process. The many worldwide applied R&D projects are geared around this dangerous mechanism. Adapted (Singh et al. 2003). many of which are now expanding beyond the closely knit operators to the engineering design houses and consulting groups.B.. 2003). The remaining examples are chosen to represent the types of failure most commonly witnessed. Case history #4 Sweet (CO2) corrosion is probably the most insidious type of localized corrosion observed in pipelines and topsides pipework. WGIM Internal Training Modules. DOT Regulations). there are many others available in the literature and industry project files (JP Kenny. pipeline failure. 1. 2004. where possible. 4. etc. In contrast target corrosion rates for passivating surfaces can be <0. velocity (PTV) data as well as close scrutiny and time periodicity of inhibitor dosing losses.944 B. Both thought to be within one year. corrosion and flow aspects Essentially. loss of corrosion inhibitor for more than approximately two to three days in a row is not tolerable. As guidance deviations to 0. although every now and then a unique new mechanism or mode of failure is unveiled (API 580. JPKeIonik. Hierarchy and rules Once the main corrosion threats are identified. Risk-based matrices are often used to balance accepted risk (high-H. 2007. 2002. low-L) against consequences and confidence levels (refer to Fig. Baker. recommended practices and technical papers as well as actual relatively recent industry experiences via projects (API 1 7D. Marsh. This step change is often necessary in practice to allow fit-for-purpose solutions to be identified. Threats perceived for passivation. though an attempt has been made to focus on relatively recent developments and practices evolving mainly over the past several years. 1984. a three or six month basis at first year for new facility depending on production water cut realized in practice and thereafter on an annual basis. 2007. The data can quite often then be revised as the more fundamental and experimental data and equations are verified by subsequent testing. That is more viable now with the new generation of multiphase flow meters out on the market. on . Fontana. Data beyond these frames would raise a red flag. commissioning or unplanned shutdowns. The corrosion defect propagation is often during steady state operations. The right hand side (RHS) showing excessive flaking of Thermal Spray Aluminum (TSA) coating accelerated by uncoated steel or possibly CRAs in the immediate vicinity. The most challenging corrosion failures are seen to be instigated during transient or excursionary physical or chemical conditions. University of Tulsa. Dalziell. The hierarchy or order of such events is best expressed as follows: CMS > Inspection > Corrosion Monitoring > Pigging > Mitigation/ Control Once the sequence has been applied on a component-bycomponent or segment-by-segment basis. 2002). and so analysts often end up re-inventing the wheel in terms of solutions. and a total of 18 days per annum is the equivalent to a 95% availability factor. 2008.15 mm/y may be tolerated for short periods (<2 weeks) and maximum of 0. field extrapolations and project experience. The target corrosion rate for steel should be set at 0. possibly due to inadequate alloy chemistry. BBC web pages. 2008). the major corrosion-related threats are: Sweet/sour (CO2/H2S) corrosion (under close attention of JIPs) Under-deposit corrosion (particulates or sand) Dead leg corrosion (mini or maxi stagnation fluid sites) Sand erosion high-velocity impacts at bends. 2005e2008. to be immediately attended to by the chemical inhibition vendor. API 2RD RP. DNV. often at start up. It is considered that within the modern offshore industry. 2008. Massey. PTV adjustments focused around that threshold number. it is usual to formulate a corrosion management strategy (CMS) plan of action. oil and gas lines) All the above threats should be quantifiable with diligent integrated on-line corrosion monitoring (coupons/probes/fluid analyses/ ultrasonic (U/T). observed at first ROV inspection (Deepwater Corrosion Services Inc. and as such this review can only be an insight. 2005e2008. The pertinent interpretation and argument is that if corrosion were to be more formally recognized as a hazard risk. and a closer acceptance of best corrosion data within corrosion management strategies (API 1 7D). but must usually be addressed at initiation if corrosion control is to be effective.1 mm/y and all chemical. recording and analysis of critical pressure. 2006. API 14E RP. However not all case histories are reported (company confidential). Coastal Training Technology Corporation. 1970. Case histories’ footnote It is quite common for a precedent to be found in most failure case examples. 2007. must be examined via accelerated corrosion tests. the guidelines are based on second principles (applied) rather than the first principles (fundamental) as presented in the early text. 2002.e. but also at straights Microbial episodic biofilms in particular TOL corrosion. Deepwater Corrosion Services Inc.5. 2008). etc. Thus the better use of hazards and operability (HAZOP) studies and failure modes and effects analysis (FMEA) as discussed later. JP Kenny. Singh et al. Case history #5 The left hand side (LHS) showing over-active deep-sea anodes. The volume of work being done by JIPs and the oil industry majors is prodigious. 2004.05 mm/y. 2000. Singh et al. BP Report. API 580.. Engineering integrity. then the formal techniques of hazard analysis will be better applied. 2008. mainly per gas lines Loss of passivity at the CRA surfaces must be assessed for all (i. 2004. 5 as a simplified example). DOT Regulations.2 mm/y accepted for shorter periods (<3 days). with ‘sign off’ by appropriate technical authorities. tees. 2005e2008. That invariably requires very close monitoring. 3. an appropriate written continued-fitness-for-purpose statement should be made. This draws. Data beyond that should be re-examined and other methods deployed to investigate. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 3. and/or high quantity presence of uncoated steel or local CRA components. temperature. JPKenny/University of Houston. The ‘guaranteed’ performance of corrosion inhibitors under cocktailed (mixed flow assurance chemicals) is a vital requirement in many solution options (JPKeIonik. 4. post 2000 (Ohio University. so that industry wide cross asset lessons learned are a powerful tool. medium-M. 2007). on a variety of standards. etc).. EEMUA. JPKenny/Ionik. using real fluid samples for best representation.6. 2007. Mueller. As a result of recent dialogue between various company CAPEX and OPEX groups it seems there is a moving away from target corrosion rates. As a rule. In practice such values could be up to and well in excess of 10 mm/y. and that the real value in corrosion modeling is not so much the absolute values but the trends and changes. and thereafter using an additive assessment for the erosion parameter. 2007. Erosion corrosion is still a major threat to offshore and subsea assets. SCOTA/UKOOA. Since the mechanisms of corrosion and erosion acting together can be very intricate and multifaceted. Many matrices are used ranging from 3  3 to 10  10. 1980. The latter may be solid pipe or steel pipe lined or clad with CRA. 2005. Table 1 shows typical best practice CRAs considered for the offshore industry. 2007.B. 2005e2008. Poblete. in practice help to address corrosion and erosion issues. Lees. US DOIMMS Federal Register. and better more inherently safer materials selection. 1994. Vars Operator Standardization. In any event the solutions must be fit for the life-cycle targeted. In cases of major conflict or disagreement it is always recommended to use the worst-case corrosion/thinning values for best conservatism. typically at 3e4 mm thickness. 2005e2008). 5. even though on balance total costs and economics are favorable over the complete life cycle. and typically may either use thicker steel (greater corrosion allowances) or stipulate the use of a more corrosion-resistant alloy (CRA). Wood Group HSE Matters. The key is to quantify within the context of pre-agreed needs and ensure all parties understand the implications (JPKeIonik. 2000e2008. with related failures being thought to account for more than 30% of all internal degradation-related hydrocarbon releases. 2005.1 mm/y (JPKeIonik. 2007. Singh & Krishnathasan. 2004. 2008. Singh. 2003. Singh & Krishnathasan. 2006). Inherently safe design The technical challenge from an engineering perspective is to accept that corrosion initiation often occurs under non-steady conditions whilst propagation thereof is often under steady state operation. Useful guidance on the concept of CA can be obtained from many sources (Kletz. Ohio University. Regarding the ongoing evolution of inherently safe design it is interesting to note that even after so many years since the Piper Alpha there is still significant project resistance to the formulation of safer designs. Guidance and caveats For carbon steel. Singh & Krishnathasan. Shreir. 2000e2008. NTSB). the real value of corrosion and indeed erosion modeling is mostly in helping the decision-making process per materials selection and the differentiation between the use of carbon steel or the alternate CRAs (JP Kenny. It should be remembered that the models only give general or uniform corrosion rates. 2008. Therein sits the predicament for the corrosionist. & Dalzell. 1995). US DOI-MMS. And if the corrosion rate can be worked out from historical data or from modeling studies (i. 2006. Showing a 5  5 risk matrix based on high-. There are many corrosion and erosion models commercially available (>15) and if access to these is available these should be explored. UK HSE/TUVNEL. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 945 Fig. SCOTA/ UKOOA. engineers often resort to a ‘first pass’ methodology of establishing corrosion rates and derived corrosion allowance (CA). 2005e2008). Smart. WGIM Internal Training Modules. The subject is ever complex and such decision making often has to rely on the planned design economics and the project costs entailed capital expenditure (CAPEX) versus operating expenditure (OPEX) (Singh et al. Either way. and low-risk corrosion events. 2003. 1983e1995. 2001. such as at Ohio and Tulsa universities must be performed to assess this parameter (Ohio University. Less than 3 mm is not recommended due to possible mechanical wrinkling effects that would impact the integrity of the liner (JPKeIonik. 2005e2008. Neal. 2006. JPKeIonik. and use commercial models if available). . or loss of containment (Private Correspondences with Messrs Ben Poblete (LR/Cameron). In practice such problems at excursionary conditions. Singh. 2007. 2008) and as such may be used as a preliminary guidance document.. The interpreted risk of failure is usually depicted as the product of probability and consequence of the failure. 2008). namely what data to use to support one’s design rationale. If medium or high risks of erosion are present then more advanced analyses available from independent testing or the various JIPs already in place. University of Tulsa. 1990. Lord Cullen Report. UMIST/University of Manchester Corrosion Center. 2000e2008. UK HSE. however. the commercially available models or the publicly available freeware such as Norsok M506 or Cassandra 93/95) then an adjudged allowance (usually consensus agreed with the client) for erosion can be made (JPKeIonik. Singh et al.e. 4. 1995. Cassandra 93 and Cassandra 95 at minimum. if not there are options outside that approach. 1990. University of Tulsa. Singh et al. 2007.05 or 0.2. 2005e2008). Mueller. Private Correspondences with Messrs Ben Poblete (LR/Cameron). NORSOK Standard M001. 2008). Also using more than one model allows a cross-checking device (use any three of the freewares available e Norsok. medium-. 5.. typically for low-risk erosion rate scenarios this might be quantified at KPI values of 0. 2007). 2007. 1998. 2007. 2007. since many similar software packages are often available as in-house spreadsheets or issued by certain companies for project-specific analyses. 2007. Both are strict but actually enforce better dialogue. JP Kenny. Most projects these days are often schedule driven. thus better legitimizing the risk-based approach. localized eddies and temperature gradients. 2005e2008. critical crevice temperature (CCT) and critical pitting temperature (CPT). transparent. flowline availability. 2008). ring pair corrosion monitoring (RPCMÔ) spools (or equivalents). From a predictive erosion perspective it is important to allow for total wall thinning due to corrosion and erosion type degradation mechanisms. loss of mechanical properties or corrosion must be considered a hazard.. in this way allows the more formal use of powerful advanced techniques such as HAZOP. the most frequently used alternative CRA material choices tend to be the nickel alloys. etc.946 B. wall thickness mapping. 2007). with attention to all corrosion threats under all service or non-service conditions. Singh et al. etc. Generally if this calculation shows a total corrosion allowance (CA) value of CA > 10 mm then intervention via a suitably selected CRA material either as a solid material or as a lining or cladding option is often considered. 2008. any corrosion management strategy (CMS) used must be a fully auditable with a unified approach to retaining integrity of the production facilities. 2004.. JPKeIonik. etc. bends. alloy 625 and alloy 825. guided wave ultrasonics. but care should be taken to alleviate changes in local surface polarization at undercut sites. Some operators put this threshold at 8 mm (or even 6 mm depending on the level of conservatism supported). And there are promising solution options with internal coatings/clad/liners. environmental protection. By defining corrosion as a bone fide hazard. Singh et al. typically 13% Cr and 316SS respectively. If applied diligently. ISD. This provides the defensible risk criteria basis for public and environmental concerns. To that effect engineers should consider utilizing the principles of inherently safe design (ISD) to build in sufficient conservatism and safety (Dalziell. 2008. ISO. thermal imaging. jumpers. can be made.. FMEA (failure modes and effects analysis). Either way the final decision is based on the economics of the project and the cost implications both at capital expenditure (CAPEX) and operating expenditure (OPEX) stages of the project. or chemical excursion corrosion testing. generally speaking pipelines beyond 15 km length will tend to look more closely at carbon steel with highly diligent and aggressive first-in-class chemical inhibition typically with >95% efficiency and >95% availability.). and the various JIPs. 2005e2008. and ultimately promote safer life cycle. and to significant technical advantage amalgamating such groups (JPKeIonik. ISD e Inherently safe design e designing such that material and corrosion failures are avoided or reduced to acceptable levels. etc. industrial and academic sources now available (JPKeIonik. composition. Hence in principle standard laboratory assessments should always be supported by non-standard and fully representative testing and field observations. meaning that fast but detailed advice is sought through guidelines from many sources. Singh & Krishnathasan. etc. Singh. often with major degradation issues and problems with continued operability or fitness for service. 2007). societies (NACE. and to meet all goals for safe operation. 2005e2008). To that effect authoritative suggestions for nonstandard. 2005). more lateral thinking. 6. Nevertheless the intensive use of reliable corrosion and erosion monitoring such as intrusive (probes and coupons). The order of corrosion resistance is interpreted as: Alloy 625 > SD > DSS z Alloy 825 > 316LSS > 304LSS. 2005e2008. used concurrently to save time and money usually means less moving parts. pressureetemperatureevelocity (PTV). and KPIs As part of any inherently safe design or study. Ohio University. design to ALARP can mean ‘fail safe’ or ‘safe life’ depending on objectives. Hitherto these would be considered strictly steady state only. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 Table 1 CRA localized corrosion tendencies. interpretation oilfield only. API. and revenue management. In practice. inaccurate prediction of erosion/corrosion. ALARP and ISD e In future may likely be accepted legal terms in a court of law. University of Tulsa. are proving to be very good early warning systems for high-risk components (JPKeIonik. JPKeIonik. since corrosion and degradation can kick in fairly soon after start up. Designers should engage the services of experienced chemical vendors in this subject matter. and discontinuities. Alloy 304 Stainless steel (SS) 316SS Alloy 825 22 Cr duplex (DSS) 25 Cr super duplex (SD) Alloy 625 PREN 19 25 33 37 47 51 CCT ( C) <0 <0 <5 20 35 57 CPT ( C) Localized corrosion risk 15 20 30 30 60 77 High risk Medium risk Mediumelow risk Mediumelow risk Low risk Low risk emphasis on reliability. with the martensitic and austenitic stainless steels also commonly being used. Corrosion. 2004. 2007. and testing and are sensitive to contact electrochemistry. The values are thought to be more applicable to static conditions and not sensitive to flow. upset. One proven method for that is the quantifiable key performance indicator route. Where required. etc. greater . The values given are based on empirical formulae. ISD (inherently safe design). The close synergy between flow assurance and corrosion integrity is now more apparent and many companies are now quite successfully. greater accountability. The inhibitors in that case would need to be highly proficient at addressing such sites under crevice corrosion conditions. and non-intrusive (acoustic transducers). Singh et al. ETA (event tree analysis). as well as specific operator experiences as for susceptible connecting jumpers in particular. subsequently reducing the critical gaming of financial incentives to a less dominant and overriding parameter. 2005e2008. defining: corrosion risk w probability corrosion failure  consequences. integrity.. The alloy elemental compositions and mechanical properties are available in supplier’s literature. field signature methods (FSMÔ). solutions. they can offset CAPEX with reduced OPEX (Dalziell. as risk exemplified by pitting resistance equivalent (PREN). though in principle if the flow regime can alter the pitting potential then some sensitivity could be recognized. ALARP e Keeping material and corrosion failures ‘As Low as Reasonably Practicable’. Some of these difficult but definable trends can be addressed via interrogation of commercially available computational fluid dynamic modeling (CFD) such as the various flow assurance type modeling. Internal coating options are also feasible but would likely still need parallel inhibition schemes to cover for the protection of damaged coating sites. within the JIP test rigs. FTA (fault tree analysis). Some important definitions as part of broad ISD and integrity management programs can be described as follows: HAZARDS e Materials degradation. can lead to conflict between the codes. From a mechanical integrity perspective it is very important for engineers to think carefully beyond the immediate design codes of practice. and the use of CRAs. Another major factor is the length of the pipeline. accelerated damage of chokes. Singh & Krishnathasan. red flag > 500 ppm). Microbial activity sessile (at wall) < 10 cells/cm2 (>100 colonies/ cm2 e red flag). Water chemistry and microbial KPIs Reservoir and condensing fluids/waters cannot be easily controlled. and scaling inhibitors. Damage resulting from accidental impact or structural overload. problems counteracted by specialty treatments such as flow assurance additives. accept >90%). total red flagged as corrosion stimulators and no more than three days consecutively proposed be allowed. T.a. corrosion fatigue/vibration/fretting damage. H2S. Environmental cracking e stress corrosion cracking (SCC). Some studies have previously examined these aspects. hull piping. corrosion. Integrated pigging and corrosion monitoring to adjust inhibitor dosing rates. etc.g... Dissolved oxygen < 20 ppb. V. Intelligent pig runs to be considered every 5 years. verify per chemical vendor). and can be defined via corrosion loops (i. vessels. to eliminate corrosion driving upset conditions. CO2. etc.1. etc. sand levels.. corrosion under insulation (CUI).. toughness.1 mm/y. The latter is a powerful new concept. 6. linked to or carrying production fluids.. 2006. manifolds. such as Corrosion under Insulation (CUI) across all systems. flanges. Other valuable KPIs Specific KPIs for external CP and external corrosion under insulation (CUI) usually need to be specifically developed. for example the SCR/flowline CP potentials (versus Ag/AgCl cell) are now reasonably well established at: À900 to À1000 mV defined as well protected <À800 V defined as compliant-CP protected according to code. All inhibitors (including cocktail mixtures) to be available at 100% (minimum ideally >95%. and many such approaches have been successfully introduced. external corrosion.2.e. This will be best defined at the CAPEX i. via fire water deluge testing. With regard to this for accepted ‘clean’ systems consider the following rationale: Define HML risk criteria in context of failure modes and probability. control units. fabrication and construction defects.05 mm/y. consequences thereof. etc. CMS) document will result in a campaign-driven prioritized inspection. design stage. etc.g. seizing. as with all advanced offshore/ subsea projects. etc. Ratio flow assurance steady states/unsteady states (excursions) to be defined. vertical segments (SCR). 6. More than 18 days p. and thus more defensible monitoring philosophies and monitoring detail. Singh et al. Primary KPIs defined (corrosion) Individual corrosion rates interpreted from the coupon and ER data are time dependent.5e6. ergo a better informed inspection interval. sulfide/sulfur. and conversely cold temperature loss of properties. All inhibitors (including cocktail mixtures used) to be efficient at >95%. however these all should remain within the design envelope. premature fasteners/nuts/bolts failure due to intermetallic phases. Noting that CUI can be realized as a major threat if piping/vessel insulation gets sodden e. Microbial activity planktonic (in-stream) < 1 colony/ml (>10 colonies/ml e red flag). 2007. For example. sulfate reducing bacteria (SRB) counts. mechanical fatigue and thermal creep. of particular interest to ‘live’ flowline segments. the key performance indicators (KPIs) (Singh. galling. Total iron deposits < 1000 ppm (often arbitrary threshold. H2S < 5 ppm. À800 to À850 mV defined as marginal protection >À800 mV defined as out of compliance (typically observed À700 to À800 mV) . TLP.5e5. overheat for critical electrical cabinets. Cleaning pig runs and sampling residues targeted at one per month minimum. etc.5. The CMS will therefore form a vehicle to ensure continued operability minimizing and controlling corrosion to acceptable levels.). The focus of which is usually corrosion risk. JPKeIonik. (though this is often challenged as the threshold may be too restrictive). erosion. Singh et al. to be defined and agreed with red flag alarms set.. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 947 The integrity management and (thus corrosion management i.B. Inhibitor dosing pumps to have >97% availability with redundancy as necessary. Embrittlement phenomena (clamps. P. Bearing that in mind we can define the primary corrosion KPIs as follows: All corrosion rates to be <0. hydrogen embrittlement. All CRAs to maintain passivity and exhibit corrosion rates <0. and a quantified confidence level. >125 ppm (or per vendor). in absence of data use a pessimistic pH 4. chlorides. is a continuing learning and improving process (IONIK JIP. and monitoring of safety-critical and economically critical elements within the facilities.e. These KPIs are guideline examples only and would be fine tuned on a case-by-case basis. Organic acids prefer <100 ppm (observe excursions >200 ppm. iron counts. but also other associated integrity threats within qualitative and quantitative ISD boundaries as shown below: Internal corrosion. and. or better as data dictates. 6. members. and to be within 10% of steady state values. 2008. parts of the infrastructure or systems that are expected to yield similar corrosion activity). chemical treatment. the process is ongoing however. Malfunction of protective safety devices. This can be done by using relatively simple but meaningful goal-setting targets. Residual inhibitors to be defined and maintained e. water cut. risk levels to a confidence rating. etc. Topsides leak rates minimized e appropriate settings per offshore asset MODU. Sand < 10 ppm. Damage from welding stray currents during installation and commissioning operations on/offshore. etc. Design. and monitored. material. 2008). Key physical and chemical variables monitored for operational envelopes. relating HML. or indeed such loops may be defined to cover for a specific high-risk mechanism. arbitrarily we can select guiding KPIs as follows: pH 5. and loss of reliability to include corrosion scale build up.e. electrostatic discharges. sulfide stress cracking (SSC). horizontal flowline segments. trying to take the best of Safety Case interpretations for applicability to the GOM region in particular. 2005e2008).3. Time dependent failure effects per localized corrosion... g. Secondary KPIs defined (reliability) KPIs pertinent to reliability are described below for flowline segments. increased dosing) can be accommodated. Such engineering must involve the development of non-standard corrosion testing (field and laboratory) often under accelerating conditions. hydrogen patch probes. Unfortunately the agreement between actual field practice and these predictions has tended to be poor. Thamala. pressure systems. 2005e2008). this is the key variable that can quite literally decide the viability of a major subsea project.c. and critical components.g. Models do not allow for localized corrosion. Flow assurance aspects are not fully attended. Lee. but with emphasis that this is but step one in the corrosion management exercise (JPKeIonik. WGIM Internal Training Modules. this is due to a number of factors.g. SCOTA/UKOOA. minor). typically: Models assume uniform wastage (in reality hardly ever the case). It is therefore reasoned that pragmatic. via compatible inhibitors diligently applied. values and chemistry are maintained at steady state values (e. >95%). Recent research has shed some interesting light on this combination and the impact on surface passivity (Hahn. competitive advantage. (IONIK JIP. the most efficient are the removable coupons. corrosion. 2005e2008). Most will be data-base driven and using the TLP existing maintenance work books as benchmarks: Overall system production time availability e a commercial target (e. Other decisions not covered directly may be addressed as ALARP linked KPI issues. Therefore for a typical project we can focus on the pipeline corrosion integrity. acoustic techniques. and confirm optimum CA values for effective life-cycle operations. Corrosion management is an ongoing discipline often required way past the available fundamental R&D. JPKeIonik. Outputs can be erroneous because inputs are often non representative. V. linear polarization resistance (LPR) probes. 6. 2000e2008) MIC analyses. <5 ppm (max 10 ppm). impedance. There may be other defining caveats such as design envelope constraints.948 B. as well as more appropriate methods of corrosion monitoring such as FSM or RPCM (instrumented spool techniques) (JPKeIonik. and the chemistry of the environment are rarely applied without the encompassing discipline of mechanical 6. potential versus time (via platinum stud reference). especially if the ratio approaches or exceeds 20. Minimum system production availability e commercial decision. 2008. and some examples are given below: . and to that effect there are many corrosion monitoring techniques available. pitting. real time radiography. incipient). Excursions beyond that should be <2 days at a time unless reactive procedures (e. advanced engineering is key to safe and efficient operations. 2005e2008). repair time e compare equivalent items on similar assets Overall run time e compare equivalent items similar assets Failures rates (rotating items e. ideally live field data. microbial. guided wave.). and usefully utilized. To that effect the use of pre-determined risk factors for localized corrosion has been explored and recommended as an acceptable way forward. Nevertheless. are available but are rarely used beyond the laboratory. 2008. Models do not include other mechanisms (erosion. however it appears that beyond 120 ppm the scenarios must be closely looked at. Scale measurement devices with advanced monitoring and pigging are also under review (JPKeIonik.000 h). 2005e2008). biostuds. flowline and piping corrosion integrity design. To deliver this. it is suggested a definition of projectspecific KPIs are made. electrical resistance (ER) probes. via fine tuning of project experience and JIP data as accrued. Typically. Monitoring tools It is recommended that the use of advanced U/T.4. best representative fluid sampling. Ensure 100% inventory and spares for all critical items. though some claims are made. fluid/ residue sampling. this time lag enforces risk-based solutions to progress important energy projects. If in the 50e120 ppm zone the combination of H2S and CO2 may be acceptable pending testing. This has been the case for core predictive tool for pipeline. area U/T and various in situ spool mapping methods (JPKenny/Ionik.7. 1995). The inhibitor cocktails must work at 90e95% efficiency with a high availability not to fall below 95% unless specified circumstances are agreed. etc. and they would need to be identified by materials engineers on a project-specific basis 6. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 KPI definitions for CUI are very project specific and temperature related and are omitted herein for reasons of brevity and commercial sensitivity. Predictive modeling The use of predictive corrosion modeling has been focused on the high-risk CO2/sweet corrosion areas pertinent to offshore applications. 2008).6. The greatest threat to inhibitor performance seems to be sand erosion at highly turbulent cases and sand under-deposit corrosion within laminar flow regimes (IONIK JIP.. Key parameters such as fluid shear stress at the wall are not well defined. deferred. T. Operating P. JPKeIonik. 2004. etc.5. Failure severity mitigation (HML equivalent to: urgent. degraded. 2005e2008). Maintenance free operating period e MFOP w minimum failure free operating period. 2005e2008.g. Failures rates per type of equipment e compare equivalent items similar assets Damage rates per vibration/fretting issues e compare equivalent items similar assets. Æ10%). electrochemical noise. It is reasoned that the main materials selection and corrosion assessment output or deliverable should be accepted as being the corrosion allowance. Mechanical aspects and inherent safety Materials. and pigging must also be aligned to corrosion modeling predictions. 6. Clearly to quantify KPIs requires data. Failures severity (HML equivalent to: dangerous. and sustainability in solving some of the most complex technical and political challenges that are facing the industry. Invariably this will depend on the steady state design envelopes described and maintained. JPKeIonik. Other advanced techniques such as a. Souring H2S levels remain negligible. # failures per 100. Singh et al. The most appropriate to offshore industry are commonly described and vetted for their advantages and disadvantages as they pertain to a successful project-specific corrosion and integrity management regime (JPKeIonik. inspection. etc. 2008. thermal imaging. 2005e2008. Often this needs to be plugged in by corrosion and integrity engineering using best risk-based judgments. 2007.. an appropriate strategy to control slugging can be developed.9.). often well above the API-recommended limits (API 14E RP). A typical pipe-in-pipe (PIP) system. wax behavior. and typically that would require expertise in the areas of pipeline. the project may be blocked. and is therefore an inherently safer design (JPKeIonik. erosion. retrofit. Typically wall thicknesses have to be relatively thick. Hydrate formation. For deepwater assets (>3000e10. Wax/asphaltene management: To prevent and manage paraffin deposition.8. The PIP systems allow a range of advanced and highly efficient insulation materials to be used to achieve the requisite heat transfer properties required. Based on this type of analysis. 2008). In the long term. The integration of analysis tools with design codes is a key challenge. 6. 2005). and should therefore not be considered in complete isolation. process chemists. erosion. wax/asphaltenes. chemical treatment and pigging may be used. 2005)). down time of pipelines. making a heavy pipe string. 2006). and to that effect qualified and experienced people are vital. emulsion. and damaging erosion/corrosion (JPKenny/University of Houston. hydrostatic collapse. dangerous and often impractical.B. Rybicki. Ohio University. corrosion. 6) rapidly are becoming the design configuration of choice for deepwater and extremely Fig.. repair. forming. Inadequate design in this area can lead to unwanted blockages. 2008. installation techniques. bringing in the effects of irregular corrosion thinning complicates further. assessment. Singh et al. 6. metallurgy. especially if new (greenfield) designs are to be inserted into older (brownfield) infrastructure. etc. Corrosion: The recommended material solution may be the use of carbon steel flowlines combined with near continuous . and limit state based design seems more applicable for complex high temperature designs. Stress based design is not applicable for high temperatures. flow assurance. dynamic analysis of the flowline and risers must be conducted to evaluate the potential severity of liquid slugging. become extremely costly. These disciplines must cohesively fit into an advanced offshore pipeline project.. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 949 engineering. with typically a NiFe inner pipe high nickel (36%) steels being selected for extra inherently safer/integrity characteristics (Singh et al. etc. Much of which is found to be best achieved at the interface between academia and industry via the operator-sponsored JIPs. Jukes et al. Thus strong technical leadership. and could possibly lead to excessively thick pipelines. combination of either chemical treatment and/or thermal insulation may be used. and core competency are crucial to making the new challenging designs workable. These are matters that need to be addressed. 6. slugging. The use of strain based design codes. There are a number of engineering challenges regarding the flow assurance and related scaling issues within pipelines. which are often exercises in knowledge management across assets and indeed regions (Singh et al. To that effect it is vital for offshore teams to be multidisciplined. 1997. The use of JIP orientated corrosion modeling acting as de facto inherently safe promoting standards will have enormous benefits in this regard (IONIK JIP. However monitoring the life-cycle integrity of such systems can be a challenge but creative options are continually being looked at (McLaury. corrosion. There are a number of pipeline design codes. wax behavior. cathodic protection/ coatings. A cost/benefit analysis of these solutions should be conducted before final selection of a paraffin management strategy is made. and assures greater degree of mechanical integrity. Singh et al. 2005e2008). welding. especially for multiphase fluids transitioning from deepwater to shallow water. University of Tulsa. riser systems. Liquid slugging: Transient. and each one is different. In addition for extreme cases such as LNG transportation. and thus have significant impact on installation lay barges and existing equipment capabilities. cold Arctic applications. 2007). and multiphase flows can be more critical design issues.10. Thus material selection.000 ft) the arguments for asset integrity become more critical since inspection. component operational performance. topsides. These devices (ER e intrusive or acoustic non-intrusive) can be used to monitor erosion and optimize well flow rates. CP/coatings must be inherently safe and optimized to be cost effective. and therefore loss of valuable productivity. or remedial action. Erosion: Various types of sand and erosion monitors are available for installation within/on subsea tree and manifold piping. The role of academia taking the lead in this process cannot be overemphasized as the best placed ‘tempering’ organization. If these targets cannot be met. There are many parameters. These systems are important components of subsea developments where untreated well fluids may have to be transported large distances and wax and hydrate problems have to be effectively managed. with the will and motivation to engage in contentious often adversarial debate. thus forcing materials engineering to be highly predictive in nature. a combination of thermal insulation. thus designs have to take cognizance of best workable solutions. Pipe-in-pipe options The new pipe-in-pipe (PIP) options (Fig. Hydrate management: To prevent and manage hydrate formation. The flow assurance strategy comprises a combined design and management philosophy for all of the following depending upon the fluid properties and operating conditions such as: hydrate formation. uniformity in codes for pipeline design would be beneficial. Invariably the key driver is the revenue and savings combination. & Shirazi. most of which are interrelated. and multiphase flow (JPKeIonik. etc. and to a degree inherently safe. scale. pipe-in-pipe-in-pipe (PIPIP) configurations (three concentric pipes. Design code application and limitations There is a considerable grey area of uncertainty regarding the interface between mechanical design codes and corrosion. 6. Once in place there is little room for error. 2005e2008.. These are real engineering challenges on top of basic mechanical design to resist stress. Flow assurance solutions Hydrate formation. MMS and HSE web pages (JPKeIonik. In addition. If this approach can be suitably linked to ISD there would be substantial benefit to the cause of CISD. The review shows some uncanny parallels to the Piper Alpha case. The results are attractive and promising in terms of scheduling. Bending Moment. Actions from the alerts Compile and issue a shutdown specific isolation protocol. albeit often in the distant future. operability. Singh et al. therefore. Flow assurance strategy should also be applied during detailed system design. then difficulties can prove to be hard to surmount. including subsea manifolds. such as the possibility of sour service being incurred post water injection scenarios. Buckling Curvature. and if taught (included) within future engineering curricula a big step forward for the engineering community as a whole. such as downhole equipment. increased use of exotic materials. 6. cost. temperature. and can therefore be expected to deliver significant improvements pertaining to. and standardization is a powerful tooling for challenging deepwater campaigns. Plastic Strain. 2005e2008)). to minimize or eliminate junction galvanic effects. a design philosophy and functional specifications can be developed for the following elements: Sizing of well tubing and completion design. The fear seems to be that over exposure to materials selection and corrosion analysis is cost prohibitive. such as seals. based on review of practices elsewhere in the company and in other worldwide affiliates. Similar arguments and predicaments exist for advanced engineering criticality assessment (ECA). Singh et al. Significant potential for integration within CMS programs. The typical strategy is best adopted early in the conceptual and planning phase of the project prior to specifying and ordering the main components of the system. and rationalize existing design methodologies. if the developments are similar in nature (water depths. concurrent design. It is more appropriate in the context of this paper. The main threat to integrity is wetting of the annulus insulation by breeched inner wall. Von Mises Stress. and. 7. to reduce the span stress. etc. 2005e2008. Standardization of designs One major way forward still under development. 7. 6. Prevention of these through diligent integrity management would clearly play a significant role in prevention by design. sift through best practices applicable to each region. Smart. There have been many recent safety alert examples. Lessees and operators should repair malfunctioning equipment in lieu of using alternative methods such as opening a manual Used properly. The main advantages from standardization are driving down costs. 2007). with potentially similar outcomes. Thus. Detail design. umbilical.1. Also rigorous equipment specification is required. though care must be taken at interfaces. predictive and proactive measures. many recent insights have been identified with respect to the potential for similar causes or similarities due to incidents that have happened since the Piper Alpha disaster. Long-term supply chain relationships. and reducing schedule time. and other relevant post accident studies. and the verification of drawing board detail to as received and built components is vital especially in the global market place. manpower resources. pressure. HSE perspective Following review of the MMS (future BOE) and UK HSE step changes in safety alerts.950 B. Lessons learned (must be a continual process). Management of detailed materials testing and quality procedures is crucial. corrosivity. One such solution is to make the pipeline more buoyant. trees.12. Axial and Hoop Stress. such as initiating causes. To ensure that the pipeline does not get over stressed at the touch down point with the seabed. over the period (2000e2008). / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 inhibitor injection or the use of corrosion-resistant alloys (CRAs).). This was done with a view to aid plausible corrective actions. Pigging strategy (subsea or surface launching). The document should cover vent/isolation tagging standards and documentation required for large-scale shutdowns. quality. 2007). Lateral Movement. when all predictions point to a sour service development over the life cycle. especially if expensive equipment has already been purchased or allocated. bend restrictors can be used to limit the bending curvature. in a very awkward position. and details are readily available in the public domain (via CBS (Baker. and the lack of inspectability thereof. However when unexpected variables enter the decision-making process.11. 2008). Chemical injection. developing operating procedures as well as offshore production operations to maximise profitability of the field development. topsides chemical delivery system. budgets. a critical component of successful design for high pressure/high temperature (HP/HT) is a thorough understanding of the materials and welding issues. Thermal management (insulation or heating). trying to justify non-sour materials selection. paying particular attention to material selection for components. such as corrosionresistant alloys (CRAs).. flowlines. In reality the benefits to be exploited are: Common health and safety culture down the supply chain. 1990. The combination of ISD. including the subsea chemical distribution. Focused front end engineering design (FEED). and predictability. throughout the system offers alternative solutions. control system and topsides equipment. Effective Axial Force. the use of meaningful corrosion and integrity management can also play a valuable role in such accident prevention. commonality of IM issues. The decision is usually made via corrosion modeling prediction techniques. The results pointed to two main types of actions: those related to design safety and those related to work permits and lockout/tagout. standardization has the ability to collate. Much work is currently in progress in that regard (Jukes et al. risers and export system. Sizing of all flowlines. Major program standardizations are presently being undertaken on projects in the GOM and overseas for major clients (JPKeIonik. Loadings that must be reviewed are: Axial. and fitness for service (FFS) whereupon new flaw sizing criteria need to be appraised at design and during service accordingly. Under these circumstances materials and corrosion engineers can find themselves . University of Tulsa. Materials and welding For both equipment and flowlines.. schedule. either solid or as liners. Based on the flow assurance analysis results. Support in the context of inherently safer designs. is to generate the standardization of designs. to identify the best actions derived from the alerts as exemplified below. Fire protection/deluge systems must not be compromised and as a rule be ‘fail safe’ with 100% availability or redundancy. and a ‘stop work policy’ in place as the job scope changes. then not acting on them should be considered a zero option (Private Correspondences with Messrs Ben Poblete (LR/Cameron). 2007). 2008). operating best practices of work permit systems and lockout/tagout remain a key to accident prevention generally. detailing all sitespecific procedures prior to work being implemented. and/or determine the condition of the ring gaskets prior to the performance of future operations (gasket failure and ensuing corrosion-related leaks are very common offshore). and maintain records of these activities (API 14E RP. Singh & Krishnathasan. that deck drains are not piped to a pressure line before entering a sump tank. monitor the environmental conditions. A discussion of the findings shows three main types of recommendations that parallel the findings of Piper Alpha: (a) There must be an effective work permit system including the use of lockout/tagout. Schematic depicting the crucial relationships between reactive. Promoting life-cycle integrity and parallel safety procedures. Supervisors must provide adequate job instructions and planning prior to the work. and that piping for produced water does not tie into the piping for the wastewater from the living quarters. the clear evaluation is that potentially dangerous incidents continue from time to time at offshore facilities. Thus it is essential to perform necessary actions to ensure the safety and reliability of these critical components. safety in design is vital to building in prevention long before problems occur. 2007). and made fail safe. Since a failure on a dynamic riser could pose a significant impact to safety. The national consensus standard for dynamic risers. Lessees and designated operators should be able to trace the history of ring gaskets in the field regardless of previous ownership. 7. Finally. and active corrosion analyses. and oriented in the proper position according to prevailing winds to minimize the migration of gas back to the living quarters. Personnel must be familiar with and utilize lockout and tagout procedures to isolate equipment and process piping during work programs. Lessees and operators shall review piping to ensure that deck drains have adequate trap mechanisms to prevent gases (corrosion leaks) from migrating through. and energy supply. These methodologies are interrelated and must Fig. Barrier and tag off for access under strict permit to work only. APIRecommended Practices are currently under revision (Baker. Corrosion prevention and detection and in the larger view the use of integrity management systems are essential to proactively prevent these from occurring.B. ageing or wear related. 8. Simultaneous operations must be clearly communicated to all appropriate parties. Noting that a very high proportion of equipment maintenance work is corrosion. without jeopardizing the scope intention of the work (applies particularly to contractors/inspectors who can find themselves under pressure to complete and go). 2000e2008). proactive. The MMS potential incidents of non-compliance (PINCs) were also created to address that matter (US DOI-MMS. (c) Asset holders must have a formalized culture of safety which is implemented and acted upon. height. In addition. Lessees and operators should review flare boom lines to ensure that they are designed of proper length. The MMS will consider adopting this standard into its regulations for outer continental shelf pipelines. The Government requires lessees and operators to perform strict maintenance and inspections. Hazards must be identified as work proceeds. Corrosion risk management practice In reality the current corrosion business practices for most oil and gas operations is a balance of three risk management methodologies. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 951 liquid dump valve when the automatic liquid dump valve fails or blind flanging off a pressure relief line when a safety device ruptures. . Singh et al. The revised version is expected to include guidance on integrity management for dynamic risers. and (b) There must be design review that is comprehensive enough to think ahead to the probable scenarios and consequences of the design. the environment. It is important for the future deepwater and arctic offshore community to look more closely at new designs and new solutions from both a materials fabrication and the materials performance basis. and if taught within future university engineering curricula give a major leadership role for the engineering discipline and community as a whole. The methodologies are: Reactive Corrosion Monitoring. 7. Wood Group. understanding. low. 2008). The use of commonly accepted high. We owe it to the memory of Piper Alpha. Concluding remarks The Piper Alpha review has been a work in progress. Finally the findings. with many derived findings. History has shown that major step change progress is usually made after major disasters and often through non-conventional means. and case history examples from Deepwater Corrosion Services.’ which can be a barrier to innovative solutions (Edison. MCS Kenny. the blend of experienced and newly qualified engineers can help to minimize negative often dysfunctional ‘group think. and designing out the problem areas. Indeed if the combination of ISD. The powerful role of Academia whether through JIPs or self driven changes in university curricula will be instrumental in the paradigm shift required and perhaps expected. to aggressive corrosion and erosion conditions. Additionally the use of new quantifiable confidence grading is a powerful new concept. The use of an annual corrosion integrity statement by the asset operators is strongly recommended to ensure fitness-for-purpose is continually maintained. with the physical parameters. It is therefore important for the engineering companies to stay abreast of safety-critical findings as they are unraveled and to participate in such leading edge activities. and developments will it is believed come from a closer liaison between industry and academia as exemplified by the JIPs already in place. can help better meet the life-cycle objectives. creative inspection. it is logical that resolution of same must involve multidisciplined engineering teams. in tandem with best industry practices. thus inspection interval. is best done by multidisciplined project groups in small step sequences. Active Corrosion Monitoring. Corrosion. is gratefully acknowledged. The importance of understanding the root cause (s) of any corrosion issue is critical in providing pragmatic cost-effective corrosion risk management solutions. concurrent design. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 be balanced and reviewed on a continuous basis. especially for safety-critical elements such as steel catenary risers (SCR). most likely through diligent but limited regulatory control. J P Kenny. Singh & Krishnathasan. as matters of priority. By using effective and simplified designs. and less direct manpower. The main advantage being that it eliminates the erroneous premise that to comply with codes and standards is all that is needed. Proactive Corrosion Monitoring. In particular operating company group standards and international associations are clearly making the case quite forcefully (International Association of Oil & Gas Producers (OGP). It is also expedient to examine and better quantify the relationships between excursionary or nonsteady corrosion phenomena. and not necessarily those of the companies. and a positive paradigm shift has been noted when applied. with the offshore operators. and corrosion. and to find methods to enforce near continual chemical injection when warranted. and assure that safe inspectability is always practical. microbial activity. JPKeIonik. and pressure containment plant. less maintenance. life-cycle integrity and fitness for service. Of the findings to date it is recommended to act on the Piper Alpha findings and look beyond at the secondary issues pertinent to offshore design integrity. 9. and corrosion plus souring activity. 2008. and potential leak sources at interfaces. And since most offshore failures are the result of multiple parameters or events precipitating to a break point. and be prepared to look at alternative approaches to design/operational issues even if they emanate from unconventional sources. It is emphasized that these methodologies are equally important during the conceptual to detailed design of an integrity management system. However predictive modeling and JIP driven corrosion management programs are pushing for pragmatic solutions into the right direction. Permission of the OTC Committee in Houston to use the OTC paper as template is appreciated. The new solution sets. 2008. The use of continually refreshed multidisciplinary teams is paramount to enhancing creativity. It is concluded that by applying the principles of concurrent and inherently safe design. and standardization. and MIC phenomena are major areas of weakness within failure mode and effects. conclusions and specifically KPI-based recommendations most of which are capable of being tailored to new and existing projects. The unique JIP blend of highly motivated and qualified researchers combined with experienced oilfield personnel has led to many breakthroughs in offshore and subsea corrosion integrity issues (API 2RD RP. such as materials performance. It is considered that these corrosion risk management methodologies will always be the underlying factors in the business decisions of all oil and gas operators. Setting the goals is paramount. focusing on critical combinations such as corrosion plus erosion.952 B. medium. Educational material from Coastal Training Technology Corporation. The most valuable observation is the need for continued life-cycle vigilance. however the volume of literature now more openly available in the industry will supply the required leverage needed. ergo monitoring philosophies and monitoring detail. The decision on how to manage the corrosion business risk is highly dependent on the corporate senior management policy of handling their operational or capital expenditures. but serious traction. with a strong materials engineering content. Companies must continually re-educate staff so that lessons learned are not forgotten. and sometimes to the creativity of solutions. since the North Sea experience has shown that ‘over regulation’ can impose major financial burdens often to the detriment of the project. is correctly deployed it can give a powerful impetus for challenging deepwater projects. interpretation and opinions expressed are those of the authors. Singh et al. and control. . risk definitions and simplified go/hold/no go traffic signal type decision gates is a significant evolution in the design and operational integrity management process. erosion. Vars Operator Standardization). Thanks are due to Miss Sonia Singh for assistance with the re-write and formatting. 2005e2008). PTV. Acknowledgements The authors acknowledge the support of WGIM. The inter-relations of the three methodologies are shown below in Fig. and indeed other preventable disasters. relating HML risk levels to a repeatable confidence level. and identifying the hazards. and Cameron. A clear advantage would be for industry to accept corrosion as a hazard thereby opening it up to more formal written schemes of corrosion integrity risk analyses. The methodology and KPI techniques advised require difficult changes and lateral thinking. safer offshore assets can be achieved. Management of change (MOC) of the order required for meaningful ISD will in practice always be difficult. (March 2006). Nashville plenary lecture. Britton. Risk based inspection (1st ed).. Offshore standard. NACE. crime. K.Teh. N. L. BBC web pages... Cox. (Reprinted 1993). J. (Dec 2008). Various articles regarding the Piper Alpha disaster. NACE.. B. 72. (2003). conflicting views CO2 corrosion. # 03114.254. L. Perich. & material issues related to flowline pipe-in-pipe (PIP) systems.. J. (2007). P. (2004). Butterworth Heinemann. (2007/8). integrity management and pigging. OH (research data). M. Neal. (August 2004). DVD Piper Alpha spiral to disaster. Erosion research report #115. & Perich. Corrosion engineering. Singh. Asset integrity e the key to managing major incident risks.. (ca. NORSOK Standard M001. Folk.. Poblete. (2007). ISSN 175118471.. LR private correspondences 1997e1999. & Dalzell. S. (January 2007). Corrosion allowance e not always a simple concept. J. Singh. NACE. (2003). (1994). Annual OTC. The Causes of Accidents. D. thesis. Paper # ISOPE-2008-TPC-297. materials performance. Design of risers for floating production systems. R. materials.com. DOT Regulations. 23e24 Oct 2007. S/EPT/096/04 e erosion guidelines (rev 3). (1990). (ca 2008). B. best practices for risk based inspection (TWI/Sun Alliance). Company report 2008 e article..D. W.). professional engineering. thesis. MKOPS. Ph. Pipeline pigging & integrity management conference: Making the link between inherently safe design.. & Delille.. T. Corrosion and integrity management literature. L. A. W. 4e7th May 2009. NACE Corrosion. Fontana. Thompson. Singh.. Business case report (77447. Garcia. Ramachandra. NTSB Carlsbad pipeline failure report # PAR 03/01. W.). Chris Robbins (UK HSE). Garcia. R. BP Booklet. (ca 2008). (1998). Ohio University. T4B series e arctic pipelines. web pages www. Singh. 2008).. Corrosion. C-In-C. B. HMSO. Strong et al. Specification for Subsea Wellhead and Christmas tree equipment. 21(11). Singh. J. Smart. experience basis e various projects 2005e2008. Paper 02233. (Oct 2008). Chair: professor S. (2002). Singh. Vol. P. Denny/G. Offshore & pipeline regulations e PINC listings. (1980). G. R.. UK HSE/TUV-NEL. & Flannery. & LRIM corrosion management ppt. Athens. Critical thermal. Corrosion control handbook (3rd ed. B. UK. F. Thamala. by Singh/ Bradley. B. (ca 2004/5). Vars operator standardization documents for subsea materials 2006e2008. 1984). Submarine pipeline systems OS-F 101. (2004). R. Singh. Dalziell. OH (advance findings). Chair: professor E. Kletz. (2000e2008). B. Houston.03). Singh et al. private communications. B. Houston. by AEG/IONIK. N.D. (2007/8). (May 2002). NACE. & Smith. Baker Petrolite. Jukes. Wood Group HSE Matters. (2008/9). J... NACE Corrosion. FFS. offshore integrity management e 20 years on: overview of lessons learnt post Piper Alpha. Includes support literature from Alberta Energy & Utilities Board (Canada). San Antonio. B. TOL corrosion NACE paper #07555. J. et al. Houston. Mechanics of fluids. Paper # 05553 NACE. Pipeline and Gas Technology Journal. and punishment (panel session e Garrity.. Paper # 86598. Shreir. (2006).S. JPKeIonik. & Krishnathasan. . Materials and corrosion course modules. corrosion reports. A. M. B. Sunbury. 194 Guidelines for materials selection & corrosion control for subsea oil/gas production equipment. Lees. Singh. Singh. Houston. JIMECHE Publication. L.. Lord Cullen Report. Materials selection and inherently safe design. TX. Van Nostrand Reinhold Co.. Roxar (USA). / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 953 References API 1 7D. 191 Oct 3 2007/Proposed Rules 30CFR parts 250. JPKenny/University of Houston. Krishnathasan. Private correspondences with Messrs Ben Poblete (LR/Cameron). DNV RP 0501. G. & Van Oostendorp.. J. (2007). P. SPE.). JPKenny/Ionik. Offshore corrosion failure analyses: series of case histories. A review of erosion corrosion in oil and gas production. and tension leg platforms. HSE alerts and safety notices 2005e2008. (June 2008). McLaury. Hahn. & Poblete.. and corrosion studies. (2007).5. Jukes. (Dec. Shirazi. Prodger. B. The team development life cycle e a new look. Garcia. Nesjic. BP report no. WGIM internal training modules. (ca 1995). API 2RD RP. Ohio University. Erosion and corrosion JIP. Tulsa Univ. rev B. Wittkower. F. SPE # 38842 SPE Tech. N. (Feb 2007). Massey. Contract research report 363/2001. JP Kenny. (2002). TX. Ohio University. In Flow induced corrosion symposium: Fundamental studies and industry experience. T. 12e15th Feb 2008. JP Kenny. CFR 49 parts 192/195 per gas and liquid pipelines. Integrity management e learning from past major industrial incidents booklet 14. A. IONIK JIP.. Rybicki. Folk. M. API 14E RP. Averting disaster. Vols. Poblete. Materials selection. International Association of Oil & Gas Producers (OGP). in-house spreadsheets & toolboxes. Report #415. J.. Pipeline engineering course modules. In Texas A&M process safety conference. Report e the BP US Refineries Independent Safety Review Panel. Predicting pipeline corrosion. (Jan 2000). thesis.. rev 4. E. et al.B. RIP # 06R206. (2007/8). Graeme Dalzell (TBS3). B. (Nov 2008). (MayeJune 2008). ASM presentation. Aberdeen. T. Athens. (2000e2008). Jukes. (2004). (Feb 2007).. B. version 1991. (January 2007).. Inherently safe design... US DOI-MMS. Offshore piping design section 2. Conf. J. Defense AT&L. (1983e1995). Singh. B. corrosion. B. R. Erosive wear in piping systems 1999. S. No. SPE paper #109209. Tulsa University (advance findings). Mueller. US DOI-MMS Federal Register. Hibbert. Butterworths. R. Loss prevention in the process industries. Butterworth Heinemann. (1990)Public inquiry into the Piper Alpha disaster. Van Wylen Press. P. NACE. (2005). M. & Dugstad. K. rust and reliability. R. Nyborg. P. Deepwater Corrosion Services Inc. From the North Sea to the Gulf of Mexico e making the link between corrosion research and best practice. T. B.. UK HSE. T. Trevor Kletz (Author). UMIST/University of Manchester Corrosion Center (J. DNV. (1970). (Dec 1997). Paper # OTC 20051-PP. (2008/9). S. University of Tulsa. API 580. the lessons of Piper Alpha. Overview CO2 corrosion models. (1997). (2004).. The 3 R’s e risk. (2001). K. K. Coastal Training Technology Corporation.253. Engineering pragmatic solutions for CO2 corrosion problems. Edison. Jukes.). P. EEMUA. J. The effects of multiphase flow on sweet corrosion in oil and gas pipelines-vars early work presentations from Ohio University. Nyborg. Nashville. E. (2007).stoprust. Internal experience basis. Baker. UK. Cormon (USA). Dawson/G. Corrosion modeling JIP.. IMechE Journal. Britton. D. A. & Research Workers (1999e2002). E. SCOTA/UKOOA. G. & Ahmed. G. Lee. Jepson. The inherent safe design of an offshore installation. What went wrong e Case histories of process plant disasters (4th ed. Rybicki. Marsh.256. 1 and 2. Ph.