Deepwater Asset Integrity Management

Deep Offshore Technology International 2010 (Paper 107)
DEEPWATER ASSET INTEGRITY MANAGEMENT INTERPRETATION OF LESSONS LEARNED POST PIPER ALPHA Dr. Binder Singh, Dr. Paul Jukes, Bob Wittkower, Ben Poblete* IONIK Consulting-JP Kenny-MCS Inc. WOOD GROUP 15115 Park Row, 3rd Floor Houston, TX 77084 *Affiliation Cameron, Houston/TX ABSTRACT Since the North Sea Piper Alpha disaster in 1988, many significant changes have been implemented across many world offshore regions. Even after more than 20 years, the emanating point for these sweeping changes has been the Cullen Report and the UK North Sea industry. This paper presents an interpretation of the early and later lessons learned, as considered applicable to mainly (but not exclusively) GOM deepwater assets and pipelines. The focus is on the many so called 'secondary' finer points related to materials, corrosion, and integrity; these tend to get overlooked somewhat, but recent experiences and observations reveal the strong case for a careful re-appraisal. The understanding, monitoring and control of such failures can be critical in reconstituting integrity, if pragmatic life cycle safety and performance are to be recognized. It is argued that these second tier modes of failure such as, latent internal corrosion, erosion, environmental cracking, and other degradation phenomena, have become more critical in deepwater projects, since fixing or re-habilitating the problem is just far too costly and/or even impossible to attend. The authors use career wide experiences post Piper Alpha to highlight the worries and concerns offering where plausible rational pragmatic solutions, illustrated through related case histories. Conclusions and recommendations are based on cross asset interpretations, and where possible verified, with solutions offered. Additionally industry disconnects between knowledge transfer and management under this tutelage are identified. The evolving methods of ‘concurrent design’ and inherently safe design are discussed, and as a result powerful advances in mechanical, materials, and corrosion engineering thought are emphasized and the use of Key Performance Indicators (KPI`s) and Key Failure Indicators (KFI`s) are reasoned for best life cycle integrity management. This is important for deepwater assets where 'surprise" failures, environmental and political 'snafus' are not really an option. It is construed that a more purposeful design investment at CAPEX is more amenable than at OPEX, and the 'gray ' zone between the two cost centers must be better bridged to industry advantage. INTRODUCTION After the recent 20th Anniversary of the Piper Alpha offshore disaster a paper was prepared and delivered to the OTC conference in Houston Texas, in May 2009 and a upon invitation the exercise was repeated for the Offshore Brazil conference in Macae, Brazil in June 2009. This paper is based on an adaptation of the OTC paper. 1 and a more recent paper given to the Mary Kay O Connor Process Safety Center at Texas A&M University.2 On the 6th of July 1988, the world’s worst offshore oil industry disaster occurred on the Piper Alpha platform in the UK sector of the North Sea. The loss of life was staggering: 167 dead, with 62 survivors, and dozens badly injured. Much has been written and debated on the incident. This paper examines a new angle on the subject matter, in the context of Inherently Safe Design, and the allied second tier items of interest. These are the corrosion-related items that have been accepted as pertinent over the years, but often erroneously perceived with less priority. This is largely because the subject matter is considered too specialistic, or complex and often requiring costly subject matter expertise. As a result, corrosion integrity is sometimes dangerously taken off the agenda by non-subject-appreciative project or even industry leaders. This paper delves into this contentious area, examines the role of corrosion mechanisms in the root cause analyses of most significant failures and virtually all loss of performance issues. The interpretations are made with the support of solid observations and new understandings in the direct context of integrity and corrosion management. The authors come from a mixed blend of offshore disciplines, with over 80 years of combined experience, predominantly from the North Sea and Gulf of Mexico. The objectives are aimed to be educational and not controversial, but the opinions are strong, and considered very worthy of continued debate and development. The Piper Alpha accident was a monumental event. It is, perhaps, in terms of impact a top-five engineering disaster on the global scale, considered to be in the same league as Chernobyl, Challenger, Three Mile Island, Flixborough, etc.3-8 In terms of cost, it was also very expensive (estimated at more than $3.4b 2 ). And in many ways it is historically comparable to other high-impact human events such as the Kennedy assassination, New York- 9/11, London 7/7, and Mumbai 11/27, in that people (certainly in the British Isles and the North Sea community) often remember where they were on the day. In that way

2

the Piper Alpha seems to have uniqueness about it, which may be due to the fact that it was offshore and involved a heavily manned producing platform. The major differential has, with the benefit of hindsight, been that the disaster was de facto man made, in that the original platform had many major design changes made to convert it into a gathering and distribution hub. Though not a deliberate act in any way, many human and engineering errors were seen to hideously come into play. Many studies have looked at that aspect, the center piece of most if not all being the ensuing public inquiry and the Cullen Report which was published in 1990.3 This was the culmination of a thorough two year inquiry involving many interviews with survivors, families, and subject-matter experts of the day, with many others on the outside offering immediate opinions on the many public affairs programs of the day, as seems to be the norm under such events. It was also commonly noted for truck loads of documents being delivered to the courthouses of London and Aberdeen, and that was a reflection of the nonelectronic transfer of documentation, as might be expected in today’s computer driven age. The Cullen report has tended to be the main stay reference source for all new offshore design and operational guidelines the world over. Some regions have used the findings rigorously whereas others have used them less in depth. Overall the report led to the effective dissolution of the prescriptive regulations sanctioned up to that point, and replaced same with the evolution of the goal setting integrity regulations in the UK and with derivatives thereof. On the plus side the major outcome of the disaster has been far better, safer, and more efficient engineering practices for the oil industry. And indirectly has supported strongly the need for Inherently Safe Designs and procedures. These have been realized by better, more focused research, better applied knowledge management, and a greater sense of public and industry responsibility by the new generation of engineers and scientists.4-19 Many more offshore, subsea and integrity-related projects and courses have evolved worldwide, largely at contract research or post-graduate level, much to the advantage and betterment of the industry.5-23 This has been promulgated by the better realization by professionals in the industry that designing to build the asset, structure, pipeline, and pressure plant can no longer be based on projected revenues alone. Yes, the ultimate decision maker or breaker can and often is the commercial sensibility, but a greater sense of responsibility to the public, and the environment, has fallen into place. This is largely regulatory driven, but one can still discern a good dose of professionalism, merit and worthiness in the arena. Root Causes Regarding the accident there was, perhaps, no single root cause event that was to blame. Rather, it was a confluence of many critical factors that were almost the ‘perfect storm’ often described as the jigsaw or ‘swiss cheese’ effect , whereupon critical events occurring at a certain juncture in time, and as a consequence the failure sequence fell into place, with tragic results. In reality integrity management (IM) is far more complex than basic maintenance (a common misnomer), the parameters affecting IM are non linear and influential during IM pre-planning, post planning, action and reaction, etc., and indeed the alignment of bad sequences, events or circumstances are invariably all time dependent and thus multi-dimensional in nature. This has traditionally made IM a difficult subject to grasp, especially since it transcends both CAPEX and OPEX cost centers. The Piper Alpha was commissioned in 1976, but was modified to act as a major gas processing and gathering station. This meant it was handling large amounts of high-pressure gas, with a dispersed plant layout, making inspection, maintenance and repair difficult. The rapid technology advances of the day, coupled with powerful commercial pressures, clearly had a lot to do with the event, and this paper looks at some of these important issues, with the benefit of hindsight but also with strong opinions forged over time. 9-18 Regarding the best way forward it is important to identify all integrity-related threats, some of which may be discerned as at a secondary level, albeit with the potential to give similar disastrous results if not taken fully into account. The majority of these are materials performance and corrosion related. The latter is an important point, and the paper takes a critical view of the changes that have been instigated since Piper Alpha, not so much from the large structural engineering angle, but more from the viewpoint of these second tier issues, which usually arise within lower profile design parameters, for example pressure (leak) containment, corrosion analysis, erosion, wear and tear, inspection, monitoring, pigging, and maintenance, etc. Thus it is not hard to see that once the Piper Alpha was converted to its hub status, it became more important to continue producing and as a result the inspection, maintenance and corrosion control aspects became of lesser importance. After the disaster it became apparent that the Piper suffered serious corrosion problems, particularly regarding the condensate pumping systems, which were in fact later determined to be at the heart of the problem on that fateful day. Essentially the condensate pumps were under much delayed repair and maintenance schedules. On the day the work was underway but incompleted, thus the supervisor prepared a permit to work (ptw) for the work to be continued by the next shift. The pump was temporarily blanked off, and the paperwork submitted. Unfortunately the ptw got mislaid and the next shift erroneously switched on the pump since the backup was offline, the blind flange failed and a massive leak of gas under high pressure was released. A detonation was inevitable, thereafter the fire fighting systems failed, other platforms continued to feed into the hub and the disaster as we know it unfolded.12

3

Figure 1: Piper Alpha before Accident - Courtesy Wood Group.11

Figure 2: Piper Alpha explosion–adapted.12,13 After the accident, due to the media frenzy of the day, the causes were variously reported over the first year as: metal fatigue, poor maintenance, inadequate operating procedures, bad work practices, human error, etc. The full report is a public document, and much educational material, videos/DVDs etc. are readily available for the interested reader. 12,13,17 Essentially in the context of this paper the Cullen report, and other studies have highlighted many reasons for the disaster, the most damning of which were: • • • • • • • • • • • • • Poor plant design, (including with regard to rapid modifications and changes) Breakdown of the permit to work system (ptw probably not fully tested under all scenarios) Bad maintenance management Inadequate safety auditing, and training procedures Poor communications (all levels) Poor emergency management (including with regard to action of surrounding platforms)

The Cullen report3 made over 106 recommendations, which included in summary: The transfer of government responsibility for offshore health and safety to the Health and Safety Executive (HSE) was generally received well. (Note: The public observed this as government taking some responsibility, too.) The establishment of a Safety Case regime (entailing independent verification). Overall review of legislation, definition of best practices, and better use of loss prevention studies. Better work force involvement (crucial but sensitive). Verification and intervention when necessary. Permit-to-work systems (ideally fail safe and tamper proof). Systematic approach to safety, responsibility of everyone (senior management and down the line).

4

•

Emergency response and incident reporting (effectively by training and changes in attitude and culture).

It has to be said that most of the activities listed above still fall in the grey area of judgment, and in that case best practices must therefore be interpreted and applied through the identification of safety critical systems and components, proactive risk analysis, risk reduction, and therefore risk management.15 There are many other important derivations from the Cullen report, but without unnecessarily going outside the scope of this paper, it is quite clear that management of change (MOC) is and will continue to be the best tool available in the ever-improving area of knowledge management.16,19,20-28 The electronic age of software and modeling analyses has made documentation preparation and transfer so much easier that we are only limited by our ability to assimilate and interpret the information across multidiscipline areas.29,621 This is where core personnel competencies come into play. For a better, safer, and more efficient work force and management, suitably trained and educated offshore engineers and scientists must be provided by our educational institutes. To that effect first-rate universities across the North American, European, and Australian regions in particular are churning out scores of postgraduates annually in the key disciplines of materials, corrosion and integrity engineering.22,38,39,42 As these people pick up practical experience and supplement the traditional engineering and sciences, this can only be a boon to the integrity management discipline, and therefore better engineering practices for the offshore and energy industries generally.24-71The concept of better work force involvement is a sensitive issue since it is still commonly expressed by workers in the field that an over exuberance with offshore safety at the metaphorical ‘coal face’ can lead to the ‘not required back’ (NRB) factor, which still has a tempering effect on employee involvement.10,63 Industry Changes The many ensuing industry changes identified since the disaster have, in fact, taken many years to come to fruition. Overall most offshore regions, in particular the North Sea, GOM, and Australia have embraced the new culture of safety. Although there is sometimes a dangerous disconnect between theory and the actual practice of implementation. The rest of the world (ROW) has responded in a slower manner, but with positive results, especially the SE Asia regions and offshore India. The very heartening implementation of best practices (by choice, not necessarily regulation) has given greater confidence for the new, challenging deepwater explorations and subsea tie backs in the GOM and the new frontier Arctic regions. 9,16The most notable changes again in the context of this paper are interpreted as follows: • • • Changes to offshore asset design, requirements for design review, more latitude for concept creativity, better rationale for engineering conservatism and pragmatic safety. New goal-setting legislation, i.e. the Safety Case, and better use of Subject Matter Experts (SME’s). The goal setting idea replaces the prescriptive method. This has proved to be a step change in offshore safety and engineering performance.

For the important GOM region it has been stated that the regulations conferred by the governing MMS are ‘fit for purpose.’ This suggests the designs are suitable at construction, but the gradual drift of this meaning has evolved to ‘life-cycle fitness for purpose’ and this appears to be adopted and embraced by the more recent generation of engineers (typically 5-10 years experience) as they enter the fray. The subtle debate now ongoing is at the material selection stage. There are two schools of thought, namely the distinction being made, whether to select carbon steel and then carefully manage the operational corrosion, or to select the corrosion resistant alloy (CRA) option with minimal corrosion management. The contrary arguments are usually cost-center based, with strong opinions tested for CAPEX and OPEX scenarios. In other words, do we pick materials for immediate fitness for service at fabrication (‘just build it’) or fitness for materials life cycle performance? The answer is now emerging as a requirement for both, and to that effect the materials engineering specialist is having an ever-more assertive role to play within the large multidiscipline teams usually engaged on high capital projects.9,28,33 Implementation The implementation of the Cullen report recommendations has, it is believed, shown through various studies that reportable incidents that impact safety issues in the UK sector have been significantly reduced by some 75%; a major achievement. 10,21,23 This clearly means the industry is on the right track, but there are still problems and issues. It is argued that more attention should and must be made to the secondary tier items such as root cause corrosion mechanisms, advanced monitoring and inspection techniques, etc. This aspect is best illustrated by an adaption of the ‘Swiss Cheese’ effect 2,12 as shown in Figure 3. It is to this effect that this paper is targeted, with the intent that by paying more focused attention to these parameters and findings that the integrity management discipline will be more substantively improved. The Cullen report also identified two areas of under emphasis that may be appropriately reasoned, firstly the industry tendency to avoid the acceptance of external consultants’ advice if the recommendations are not supported by more experienced personnel, often even if the consultation seems logical and safety sensible. The case of the central riser argument for the Piper Alpha is cited; here evidently the dangerous proximity of the risers to the control and radio room areas was, in fact, identified, but no action taken (design change, relocation, blast walling, etc). Nowadays virtually all new designs insist on the risers being as far away as possible from the accomodations. The second point of observation is the concept of addressing root cause effects. The Piper Alpha condensate pump problems that initiated the whole tragic sequence of events were plagued with corrosion

5

problems the attendance to which was seemingly consistently delayed as lower priority. Apparently some platform corrosion issues were left for over four years. 28 If corrosion management as a recognized discipline had been in place, rather than an ad hoc to-do item, then again, with the benefit of hindsight, the tragedy could have been avoided. That, unfortunately, is how the learning and knowledge management process works. And it has to be said that companies today often have very valuable lessons-learned meetings after major projects are concluded. There is a strong case, and new initiatives, underway for such formal lesson learnings on an ongoing basis. 21,27,49,50

 

‘SWISS CHEESE ANALOGY’
AKA:  Jigsaw effect, Chain of events,  Perfect Storm, Murphy’s  law, etc.   Hazards Align and Losses Accumulate
Erosion, Cavitation, wear New Mechanism(s) LME, CUI, 8,10,12 etc

4

etc

P.T.W

Localized Pitting

3 2 Hazards

1

Losses

Management Snafu, Adverse Project Decisions Structural Integrity, Mechanical Strength, Loss of Properties, Weld defects, etc Operations, Steady State, Out of Envelope, Excursions, Transients, Ergonomics, Human Error, etc

Uniform Corrosion, Poor Inspection data, etc

Materials Performance, Fracture, Embrittlement, SCC, etc,

Figure 3 The ‘Swiss Cheese’ Analogy as applied to materials engineering The use of modern-day corrosion risk assessment techniques are under development and application. It is hoped that ultimately these will be implemented by the weight of motivation, though in reality some degree of mandatory regulation may be ultimately required.28,55 These and other related points of view are made in the paper, hopefully to reinforce some of the many lessons learnt over the past 20 years or so. In almost all major comparable disaster cases the commonality has been the confluence of many variables coming into a tragic alignment, sometimes referred as the jigsaw or ‘swiss cheese’ effect. It is argued in this paper that in almost all cases the loss of materials performance as stimulated by corrosion is the root cause effect. A close examination of the modes of failure reveals the uncanny role of corrosion dissolution at either the macro or micro level (whether it be by alloy, embrittlement, crevice corrosion, mixed metal galvanic, etc) the outcome is the same: severe loss of material properties and/or load carrying capabilities.14,23 The resolution of the corrosion aspect will, therefore, in virtually all cases eliminate the closure of the jigsaw effect, thereby preventing the failure. On a positive note, the concepts of knowledge management, advanced inspection techniques, implementation of MOC, and the more newly defined roles and responsibilities for pertinent decision makers, etc., have all been very instrumental in making this industry safer and better equipped to tackle the challenges faced ahead. It is strongly argued that one new recommendation that would be instrumental in helping improve this aspect an order of magnitude would be the ‘mandatory’ requirement for each asset to submit a clear annual corrosion integrity statement on the facility, and pertinent (safety critical parts) thereof.28 The burden for doing this is not high, but the results would be extremely positive. Threats to Asset Integrity It is very important for society to progress positively and look at lessons learnt in all disciplines from time to time. However, in the engineering field the need is most pressing. The world is changing fast, with unprecedented population growth, and competition for sustaining resources such as water, food, and energy. The oil and gas industry is pivotal to such growth, and must, therefore, take note of demand for production, and demands for best safe, efficient, and environmentally friendly solutions. The structures, pipelines, pressure plant, and parts thereof must be designed and operated at optimum conditions, whilst retaining mechanical integrity over the life cycle. One of the greatest threats to any asset integrity is the degradation of the asset with respect to time, i.e. the design life or, more appropriately, the life cycle. In that context the most dominant degradation phenomena per se is corrosion. And in that regard there are many mechanisms of corrosion, all of which come into play at varying levels of intensity. The early work by Fontana et al14 suggested eight clearly defined corrosion mechanisms, though more recent work is pointing to more than ten. 18,21,28,42 For the upstream oil and gas industry, it is common to delineate these into the major damage threats, whereupon many studies (Canadian/Russian in particular ) over the past 10 years or so have shown that internal corrosion is the dominant cause of failure, typically by over 50% in practice.42,49 Whether the corrosion failure is on pipeline, riser or topsides equipment there is in practice nearly always a precedent, thus working applied design life solutions can normally be formulated. At the same time it is however, important to continue with fundamental or near fundamental research to help understand failure mechanisms better so more permanent solutions can be implemented as time marches on. The concept and consolidation of the corrosion and erosion JIP`s have helped to bridge the

6

link between industry and academia, with valuable results. 38,39 The trick however, is to ensure that the results are interpreted and applied by skilled and experienced personnel, preferably staffers who are very cognizant of the JIP data being generated, and have had a role in the development of the laboratory and field testing programs. As an example the threat breakdown for risers, though quite similar, will have particular nuances to be taken account of, such as the translation of horizontal pipeline flow regimes to vertical regimes with a potentially high-risk corrosion activity at the base transition. Similarly, topsides pressure equipment will be safety critical, and perhaps warranting greater latitude on the monitoring side, such as area U/T mapping and thermal imaging in the high-risk underside (six o`clock positions). There should also be a greater emphasis on the external corrosion aspect, especially at supports whereupon several major failures have been observed due to crevice corrosion being accelerated where wet marine air has condensed out high chloride pockets in susceptible areas.15,18,19 This is a significant problem in the GOM where warm temperatures (>21°C) and regional humidity levels are routinely > 80%, pretty much year round. On the plus side there are many fit-for-purpose solutions, such as the use of inert I-Rod type inserts, which if used correctly can virtually eliminate crevicing geometries.19,28 The use of TSA coatings is also a very viable solution for all topsides equipment external and internal surfaces. This is a reflection of onshore technologies being carefully transferable to offshore applications, provided subject matter expertise is wisely used and safety is not impaired.28,33 The Aftermath Post Piper Alpha, studies (late 80s and 90s) revealed the important need for corrosion management. That concept was likely first coined by researchers at UMIST when that group realized that corrosion control really defaulted to corrosion management as the discipline was a fine balance of integrity and finance management.22 Thereafter, the term seemed to be broadened to cover for monitoring, chemicals, pigging and inspection, thus leading to the term inspection management. It was, however, very important to include the pressure vessel and piping community and it is believed that lobby led to the evolution of mechanical integrity management. And in time, mid to late 90s the terminology seemed to reach a consensus at integrity management (IM). In terms of proportion, IM is still effectively a corrosion management exercise and that was argued in early pioneering studies by Prodger et al54, leading to the conclusion that IM was effectively 80% corrosion related, covering all assets (marine/offshore/industry). The concept of a corrosion management strategy (CMS) has therefore evolved, this supplies the high-level approach to IM, and is usually a system FEED-type study, quickly converting to a tactical (nuts and bolts detail) type corrosion control manual, which forms the basis of the life cycle IM plan. The plan is a live, ongoing document modified or revised as new data or findings become apparent and usually encompass detailed, risk, reliability, inspection, intrusive probes and coupons, pigging, fluid sampling, chemical injection, and mitigation procedures, and studies. As with all good science and engineering it is vital to quantify critical parameters, and to that effect the concept of KPI, has been modified and applied to IM studies.9,27,33 Thus, the qualitative nature of risk-based judgments is honed to a more easily repeatable and consensus-based decision gate system. Some examples of recent KPI studies and their application are presented later. These must always be considered and applied and agreed on a project specific basis, with the appropriate sign-off from subject matter experts in materials, corrosion, CP/coatings, etc. Most career offshore engineers do in fact observe near misses on a regular basis, with incidents related to fire, leaks, mechanical integrity, topsides equipment, poor inspection, etc., being responded to with duly diligent team actions. However the potential for mishaps is always there, especially where corners are cut to meet production and cost issues. This ‘Achilles heel’ will always be there but hopefully minimized as leadership and the industry progress. ALARP, Corrosion Hazard, and Inherently Safe Design The commonly accepted approach to safety assurance or ALARP is now to ensure on the basis of suitable and sufficient evidence that risk is as low as reasonably practicable (ALARP). The concept of ALARP is often interwoven into the risk analysis and/or safety management from the very beginning 9,16,28,33 Corrosion must be considered a functional hazard for this approach to be applicable. Figure 4 below depicts the ALARP triangle with the processes and descriptions for each segment. Further, since there is a lack of code guidance per internal corrosion, one way forward is to use the concept of ALARP to define the limitations or boundaries of the corrosion parameter, and therefore aid (technical and legal) argument defensibility. Since Inherently Safe Design (ISD) is often perceived as a costly CAPEX discipline, there is a forceful argument that suggests that by strongly utilizing ISD in the Integrity Management basis ( typically by best materials selection, geometries, chemicals etc.) then coupled with concurrent changes, revisions, MOC’s etc in the same vein, a truly best practices regime can be set up. The cost factors are easily justified by reduced OPEX costs over the life cycle. However the ‘pay now or pay more’ later theory has never fully made the grade, and in reality it usually takes an event like the Piper Alpha or Carlsbad (USA) before significant paradigm shifts in attitudes are made, even then only with the force of regulation. Alternatively the JIP’s might be seen as the conduit for best technology advancement and best knowledge interpretation and management in this regard. Once concurrent design and ISD move closer towards amalgamation then the case for concurrent and inherently safe design (CISD) may become a university taught and thus industry practiced discipline. There are actually more than 10 recognized mechanisms of corrosion, viz: 1) uniform corrosion, 2) pitting, 3) crevice, 4) erosion (including impingement / cavitation), 5) galvanic, 6) selective leaching, 7) intergranular, 8) fretting/wear, 9) stress

7

corrosion cracking (SCC, corrosion fatigue, hydrogen damage, embrittlement etc),10) Other creep/embrittling, etc20. For offshore and subsea conditions the critical mechanisms are a function of reservoir composition; and the most dangerous threats are therefore CO2 (sweet) corrosion, H2S (sour corrosion and cracking), bottom of line (BOL), top of line (TOL), and microbially influenced corrosion (MIC). Once at the tactical stage it is found that corrosion under multiphase hydrocarbon flows presents the most challenging and integrity-threatening condition. This problem area has plagued the industry for many decades, so much so that there are many studies looking at these issues across the world at universities and industrial research centers. In the USA the challenge is being met by the continued growth of two major JIPs, at Ohio University under the auspices of Nesic et al38, and at Tulsa University under the guidance of Rybicki et al.39 Both JIPs effectively tackle and model corrosion and erosion and MIC modes of failure through an exhaustive combination of theoretical modeling, empirical testing, and field trials. This work seems to be leading the way globally and in the absence of bone fide codes of practice and standards, the JIPs are commonly used as a reference point. The recommendations coming out of the JIPs are membership supported (largely operator companies and key consultants, engineering companies, etc), and thus their findings have received solid acceptance industry wide. The balance of academia and industry ensures that the decision-making process is not skewed by overriding commercialism. Ultimately these will tend to be perceived as the industry standards, filling the void that has long been present. The results are applicable to all assets (TLP, MODU, spar, fixed, subsea, topsides, etc.) provided the appropriate expertise is deployed to allow for the subtle differences across assets and systems, in other words, from both sides of the aisle: from the operator and the engineering contractor.9,55,57

ALARP RISK TRIANGLE As applied to Corrosion Assessment

INSIGNIFICANT RISKCorrosion Events Negligible

TOLERABLE RISK REGION Corrosion Manageable Risk reduction benefits practicable Consequences acceptable

UNACCEPTABLE RISK –CONSEQUENCES TOO BAD Material/Corrosion failures not Acceptable Justifiable only in very exceptional cases

Figure 4: The ALARP triangle depicting the importance of corrosion risk assessment in the risk management and loss prevention exercise. Having the right blend of multidisciplined engineers is key to success if multi-facetted failure mechanisms and root causes are to be properly addressed. CORROSION MECHANISMS PER UPSTREAM AND SUBSEA Uniform corrosion Pitting corrosion Crevice corrosion Galvanic corrosion Stress corrosion Erosion corrosion Corrosion fatigue MIC CO2 Sweet corrosion H2S Corrosion Top of line Corrosion Well addressed via theory, and viable monitoring. Modeling difficult but R&D done, relevance high risk* Relevant modeling used, relevance medium risk Modeling hard (danger ‘mesa’ scale related attack), medium risk Empirical/experience, medium risk and reliability in practice Modeling used-relevance high risk* Interpretative used-relevance high risk Very subjective, separate JIPs underway at Ohio/Tulsa Univ. – risk high* Modeling underway used-relevance very high* Modeling underway used-relevance high Now better quantified- Modeling part of separate JIP studies at Ohio University.

8

Note 1: Perceptions asterisked (*) are best given as ‘localized,’ encompassing multiple mechanisms. Also all highrisk phenomena can be mitigated down to low risk with diligent, motivated, surveillance and corrosion management procedures provided they are, in fact, fully implemented. Note 2: The assessment of risk can be qualitative, or semi quantitative. The high-, medium-, and low-risk (HML) nomenclature has been adopted for simplicity and consistency. HML must always be assigned by materials/corrosion specialists and, where possible, have justifiable and defensible arguments as support. Note 3:The use of industry accepted HML risk designations and simplified go/hold/no go (green, amber,red) traffic signal type decision gates is a really good evolution in the design and operational integrity management process. As with all engineering projects, commercial aspects, project viability, return on investment (ROI), schedule, etc. are pivotal to project success. The net effect is that in many, if not most, cases the project remit becomes ‘design to build’ rather than the preferred ‘design for the life cycle’. This often adversarial development is, on the one hand, good in that it stimulates solid, provocative discussion, and thus best workable fit for purpose solutions can be attained, however if materials engineers are not strong enough to debate their corner hard and strong, weaknesses in design leading to failures down the road can be expected. The only real question being, where, and when, rather than if, as a result the competitive forces at work, namely the need for revenue as against best available safe technology (BAST), is often a battle of being’smart to out smart’ as identified as the Achilles heel in the IM process. 15,28 This is reflected in the weak argument often used that the design complies with the regulations. That alone is not enough, it may be a minimum requirement, but life cycle fitness for purpose is really about managing all mechanical and corrosion related degradation mechanisms, including: stress overload, embrittlement and loss of material properties, and natural wear and tear i.e. dissolution of the metal under aggressive environments. New Build Versus Old Build Most new engineering applications (green field) invariably involve a design code or recommended practice as a reference point. These are usually industry-accepted guidance documents that have been developed over many years, been through many cycles of peer review, and tested via experience, case history etc. Reference to established codes gives the design and end client credence and confidence in its workability. One example of that may be pipeline cathodic protection and coatings, whereupon code compliance (DNV, ISO, NACE, etc.) is a good yardstick for successful external corrosion control. Unfortunately, that is not the case for internal corrosion, largely because the mechanisms of corrosion are complex and often multi-faceted. 62,64-67,69 It has therefore been necessary to develop methods of resolution, the most popular being that of corrosion modeling. The most common threat to pipeline integrity has been mixed CO2 or sweet corrosion. In reality even with the large amount of corrosion work done over several decades, absolute values of corrosion rate still cannot be reliably predicted without reservation using any of the 15 or so models available.49-55-67 All the models can really do is give a general guidance as to the corrosivity of the media involved. Thus it can be construed that the main objective of corrosion modeling or corrosion assessment has evolved to differentiating (at build) whether or not the carbon steel will be acceptable as the main flowline material, or, if not, weather the analysis justifies the use of CRAs as the design basis. The impact of this decision can be crucial since the CAPEX/OPEX ratio is greatly affected and will often make or break the project. Thus, the vital need for the corrosion predictions to be pragmatic and done to the best possible reliability. In practice the greatest criticisms of the modeling approach have been the non–agreement of calculated corrosion rates to the observed field values. For deepwater applications whether subsea at >4000 feet, at the steel catenary risers (SCR), or on the host facility (e.g. TLP/SPAR/MODU etc.), there is little room for error, since repairs or retrofit can be very costly or practically impossible. Nevertheless the deepwater campaigns continue and it is up to engineering companies to offer justifiable but realistic solutions and where proven data or correlations are not available, reasonable risk based ALARP driven decisions are considered justifiable. The same arguments apply for old build (brown field), whereupon existing assets often badly corroded need to be assessed for remaining life and ongoing corrosion. This can be a challenge as critical parameters such as existing pre-corrosion condition and/or existing inspection data are not always readily available. Nevertheless predictive modeling does serve a useful purpose in this regard, provided the caveats are defined, understood and accepted by the client.64-67 Rules, Regulations and Inherently Safe Design Ultimately the integration of ISD into mainstream engineering practice will almost certainly happen, though as alluded to earlier the combined efforts of academia and regulatory authorities will be the most likely catalyst. Whilst external sea water corrosion control is regulatory driven, the case for internal corrosion is only heavily implied though not specifically regulatory or code compliance driven, however that will probably change and regulations in most regions will likely refer to best practice modeling or corrosion analyses to ensure that corrosion integrity is accounted for within the integrity management process. 9 That change was expected to be imminent and may still happen within the Federal Rules though there is a powerful lobby against the changes such that the rule change approval may be delayed. 11-33 The onus is, therefore, on diligent designers to ensure that best safe technologies and techniques are utilized to understand and predict corrosion mechanisms and corrosion rates, such that failures can be eliminated or arrested to tolerable values. As far as the GOM region is concerned a mixture of prescriptive and performance related criteria are applicable. In particular the MMS potential incidents of non-compliance (PINC`s) may be interpreted as a corner stone boundary condition for predictive corrosion

9

control to help focus the designer’s attention and attitude towards safety. 27,52 Similarly the MMS Federal Register may be used to support the requirement for diligent corrosion assessment and management thereof. 28,32 It is recommended that these be used on a case-by-case basis, though specific differences (usually more onerous may be relevant if North Sea rules and the safety case are applied). In practice, for carbon steels that means the development of a pragmatic corrosion allowance. It has been found that the best way to do this in a convincing and reasonable manner is to utilize interpretation of the relevant and available rules and codes of practice, suitable modeling calculations, industry experience and best judgment. The US federal regulations have stirred debate in the US, and there are some criticisms as well as positives. Overall, the industry seems to have embraced the impending rules.16,24,32 The main advancement is likely to be a greater specificity regarding internal corrosion, perhaps more akin to the UK goal setting requirements. The modeling we do should anticipate that and hopefully these guidelines presented will provide a framework for that. The rules are US-specific but should serve as a template for defensible corrosion prediction, which is all the more important in an ever-more litigatious society.55,58 As alluded to previously there are many models available, (likely>15) e.g. Norsok M506, Cassandra 93/95, ECE, Hydrocorr, Lipucor, Multicorp v4 (Ohio JIP), OLGA® (corrosion module inclusive), Predict/Socrates, Tulsa SPPS (Tulsa JIP), ULL model and others, and whilst most have individual strengths and weaknesses, the common critique is invariably unreliable correlation to the laboratory and more importantly field experience.55,67 As a rule almost all have little proven consistency of confidence to field observed corrosion rates. This is mainly due to the fact that the designs attend essentially only to the base CO2 corrosion case, and exclude a truly meaningful localized component, though some claim, and more and more are trying to include, this and other influencing parameters. The problem seems to be that the localized component is rarely addressed in a transparent manner, with no reference to localized criteria or parameters such as crevice/deposit size, stagnation fluid chemistry, crevice pH, differential aeration, etc. Nevertheless, the use of a suitable modeling or JIP study would no doubt be accepted as a supporting reference to the regulations. Generally most models have a ‘black box’ critical analysis, though the JIPs appear to be more transparent at least to the member companies. The research is still closely guarded though it has evolved to be more pragmatic and project risk-orientated (deterministic/theoretical). It is expected to have solid calibration capabilities with ultimately, a flow assurance-linked corrosion modeling package seemingly viable, perhaps, by individual member companies (e.g. via greenfield/brownfield ‘what if scenario’ brainstorming). The latter is difficult but would have the greatest impact if it could wrap up flow assurance, corrosion, and safety inextricably to production and, therefore, revenue. This is a controversial argument but one that would help eliminate the pressures on project managers, offshore installation managers (OIM), and other decision makers to continue with producing, often under fault conditions. That was seen to be quite possibly the ultimate snafu in offshore history, when adjoining platforms continued to fuel the fires on the hapless Piper Alpha.2,8,9,11 OFFSHORE CORROSION FAILURE CASE HISTORIES Even post Piper Alpha there have been many integrity and corrosion-related failures, and some of the more important types are presented for illustrative purposes only. It is clear that most are solvable by better using existing knowledge and widely available techniques, including more recently, existing modeling predictive techniques, such as those offered by the JIPs, many of which are now expanding beyond the closely knit operators to the engineering design houses and consulting groups. This should be of much advantage to the industry as a whole by infusing an alternative layer of checks and balances to drive the research for better understandings and ergo better solutions. A number of case histories depicted below illustrate the role of corrosion in the integrity management process. The first is, perhaps, the US equivalent of Piper Alpha, in that it led to strident major changes in regulatory requirements via the DOT.6,24 The remaining examples are chosen to represent the types of failure most commonly witnessed; there are many others available in the literature and industry project files. 17,18,42

10

Ref NTSB Report PAR 03/01

Case History # 1 Top plate shows the macro image aftermath of the Carlsbad, NM, pipeline failure, in Aug 2000. The size of the crater is self evident, and tragically 12 outdoor campers were deceased. The root cause was determined to be a combined corrosion mechanism dominated by chloride/CO2/microbial activity as exemplified in the micro image below. The corrosion was concentrated at girth and seam welds at the BOL position, with 72% wall loss noted, adapted.5

Weldment
MOST DAMAGE DOWNSTREAM

flow

Acid clean scales

Case History # 2 Depicting failed manifold on a fixed platform due to isolated erosion defect of the steel upstream of an inhibitor injection point. Age 10 years, no on-line monitoring, produced water system sensitive to poor protective filming, adapted.18
g p

Dimpling at leading edge of erosive wear front

Major flow excursions Note-clean zero corrosion products. Differentiate~Erosion/Impingement/Cavitation

11

Case History #3 Catastrophic failure of choke sleeve on offshore facility. Failure mechanism analysed to be combined erosion/cavitation and impingement. Impinging cavitation forces can far exceed the proof stresses of most alloys adapted.18

Mesa-Interface

Case History #4 Sweet (CO2) corrosion is probably the most insidious type of localized corrosion observed in pipelines and topsides pipework. The many worldwide applied R&D projects are geared around this dangerous mechanism. Adapted. 18

LHS: Over Active Anode

TSA Coating: Accelerated Attack

Case History #5 LHS: Over-active deep-sea anodes, possibly due to inadequate alloy chemistry, and/or high quantity presence of uncoated steel or local CRA components. RHS: Similarly excessive flaking of TSA coating accelerated by uncoated steel or possibly CRAs in the immediate vicinity. Both thought to be within one year, observed at first ROV inspection.19 Case Histories Footnote It is quite common for a precedent to be found in most failure case examples, so that industry-wide cross asset lessons learned are a powerful tool. However not all case histories are reported (company confidential), and so analysts often end up re-inventing the wheel in terms of solutions, although every now and then a unique new mechanism or mode of failure is unveiled.44 The most challenging corrosion failures are seen to be instigated during transient or excursionary physical or chemical conditions, often at start up, commissioning or unplanned shutdowns. The corrosion defect propagation is often during steady state operations, but must usually be addressed at initiation if corrosion control is to be effective. That invariably requires very close monitoring, recording and analysis of critical PTV data as well as close scrutiny and time periodicity of inhibitor dosing losses etc. That is more viable now with the new generation of multiphase flow meters out on the market. As a rule, loss of corrosion inhibitor for more than approximately two to three days in a row is not tolerable, and a total of 18 days per annum is the equivalent to a 95% availability factor. The assured performance of corrosion inhibitors under cocktailed (mixed with flow assurance chemicals) is a vital requirement in many solution options.28,65,69

12

HIERARCHY AND RULES Once the main corrosion threats are identified, it is usual to formulate a CMS plan of action. The hierarchy or order of such events is best expressed as follows: CMS > Inspection > Corrosion Monitoring > Pigging > Mitigation/Control Once the sequence has been applied on a component-by-component or segment-by-segment basis, an appropriate written continued-fitness-for-purpose statement should be made, on a three or six month basis at first year for new facility depending on production water cut realized in practice and thereafter on an annual basis, with ‘sign off’ by appropriate technical authorities. It is considered that within the modern offshore industry, the major corrosion-related threats are: • • • • • • • Sweet/sour (CO2/H2S) corrosion (under close attention of JIPs) Under deposit corrosion (particulates or sand) Dead leg corrosion ( mini or maxi stagnation fluid sites) Sand erosion high-velocity impacts at bends, tees etc., but also at straights Microbial episodic biofilms in particular TOL corrosion, mainly per gas lines Loss of passivity at the CRA surfaces must be assessed for all (i.e. oil and gas lines)

All the above threats should be quantifiable with diligent integrated on-line corrosion monitoring (coupons/probes/fluid analyses/ultrasonic (U/T) etc). The target corrosion rate for steel should be set at 0.05 to 0.1mm/y and all chemical, PTV adjustments focused around that threshold number. As guidance deviations to 0.15 mm/y may be tolerated for short periods (<2 weeks) and maximum of 0.2mm/y accepted for shorter periods (<3days). Data beyond these frames would raise a red flag, to be immediately attended to by the chemical inhibition vendor. In contrast target corrosion rates for passivating surfaces can be < 0.05 mm/y. Data beyond that should be re-examined and other methods deployed to investigate. As a result of recent dialogue between various company CAPEX and OPEX groups it seems there is a moving away from target corrosion rates, and a closer acceptance of best corrosion data within corrosion management strategies.48Any threats perceived for passivation, must be examined via accelerated corrosion testing in laboratory, using real fluid samples for best representation. Risk-based matrices are often used to balance accepted risk against consequences and confidence levels (refer to Figure 5 below as a simplified example). The pertinent interpretation and argument is that if corrosion were to be more formally recognized as a hazard risk, then the formal techniques of hazard analysis will be better applied. Thus the better use of HAZOP and FMEA as discussed later.
Quantify Corrosion Risk - Decision Matrix
Interpret Risk as ~ Probability Failure x Consequence

Probability

5

4

HIGH

3

MEDIUM

2

LOW

1

2

3

4

5

Consequences

Figure 5: Showing a 5x5 risk matrix based on high, medium, and low risk corrosion events. The interpreted risk of failure is usually depicted as the product of probability and consequence of the failure. Many matrices are used ranging from 3x3 to 10x10. The key is to quantify within the context of pre-agreed needs and ensure all parties understand the implications.28,33 Engineering Integrity, Corrosion and Flow Aspects Essentially, the guidelines are based on second principles (applied) rather than the first principles (fundamental) as presented in the early text. This step change is often necessary in practice to allow fit for purpose solutions to be identified. The data can quite often then be revised as the more fundamental and experimental data and equations are verified by subsequent

13

testing, field extrapolations and project experience. The volume of work being done by JIPs and the oil industry majors is prodigious, and as such this review can only be an insight, though an attempt has been made to focus on relatively recent developments and practices evolving mainly over the past several years, post 2000.38,39 This draws, where possible, on a variety of standards, recommended practices and technical papers as well as actual relatively recent industry experiences via projects 9-53 and as such may be used as a preliminary guidance document. Erosion corrosion is still a major threat to offshore and subsea assets, with related failures being thought to account for more than 30% of all internal degradation-related hydrocarbon releases, or loss of containment. 10,21,28 Since the mechanisms of corrosion and erosion acting together can be very intricate and multifaceted, in practice help to address corrosion and erosion issues, engineers often resort to a ‘first pass’ methodology of establishing corrosion rates and derived corrosion allowance (CA), and thereafter using an additive assessment for the erosion parameter. Useful guidance on the concept of CA can be obtained from many sources.3-7,26 And if the corrosion rate can be worked out from historical data or from modeling studies (i.e. the commercially available models or the publicly available freeware such as Norsok M506 or Cassandra 93/95) then an adjudged allowance (usually consensus agreed with the client) for erosion can be made.28 It should be remembered that the models only give general or uniform corrosion rates, and that the real value in corrosion modeling is not so much the absolute values but the trends and changes. Also using more than one model allows a crosschecking device (use any three of the freewares available- Norsok, Cassandra 93 and Cassandra 95 at minimum, and use commercial models if available). In cases of major conflict or disagreement it is always recommended to use the worst-case corrosion/thinning values for best conservatism. There are many corrosion and erosion models commercially available (>15) and if access to these is available these should be explored, however, if not there are options outside that approach, since many similar software packages are often available as in-house spreadsheets or issued by certain companies for projectspecific analyses. Either way, the real value of corrosion and indeed erosion modeling is mostly in helping the decisionmaking process per materials selection and the differentiation between the use of carbon steel or the alternate CRAs.16,33 Guidance and Caveats For carbon steel, typically for low risk erosion rate scenarios this might be quantified at KPI values of 0.05 or 0.1 mm/y.28 If medium or high risks of erosion are present then more advanced analyses available from independent testing or the various JIPs already in place, such as at Ohio and Tulsa universities must be performed to assess this parameter. 38,39 In practice such values could be up to and well in excess of 10 mm/y. Therein sits the predicament for the corrosionist, namely what data to use to support one's design rationale. The subject is ever complex and such decision making often has to rely on the planned design economics and the project costs entailed capital expenditure (CAPEX) versus operating expenditure (OPEX).9,15 In any event the solutions must be fit for the life cycle targeted, and typically may either use thicker steel (greater corrosion allowances) or stipulate the use of a more corrosion-resistant alloy (CRA). The latter may be solid pipe or steel pipe lined or clad with CRA, typically at 3-4mm thickness. Less than 3mm is not recommended due to possible mechanical wrinkling effects that would impact the integrity of the liner.28 Table 1 shows typical best practice CRA`s considered for the offshore industry. Regarding the ongong evolution of inherently safe design it is interesting to note that even after so many years since the Piper Alpha there is still significant project resistance to the formulation of safer designs, and better more inherently safer materials selection, even though on balance total costs and economics are favorable over the complete life cycle. INHERENTLY SAFE DESIGN The technical challenge from an engineering perspective is to accept that corrosion initiation often occurs under non-steady conditions whilst propagation thereof is often under steady state operation. In practice such problems at excursionary conditions, can lead to conflict between the codes, inaccurate prediction of erosion/corrosion, accelerated damage of chokes, bends, jumpers, and discontinuities etc. Appropriate reliability, availability, maintainability (RAM) studies should help in this regard. Some of these difficult but definable trends can be addressed via interrogation of commercially available computational fluid dynamic modeling (CFD) such as the various flow assurance type modeling, as well as specific operator experiences as for susceptible connecting jumpers in particular. And there are promising solution options with internal coatings/clad/liners, but care should be taken to alleviate changes in local surface polarization at undercut sites, localized eddies and temperature gradients, etc. Nevertheless the intensive use of reliable corrosion and erosion monitoring such as intrusive (probes and coupons), and non intrusive (acoustic transducers), field signature methods (FSM), ring pair corrosion monitoring (RPCM) spools (or equivalents), guided wave ultrasonics, wall thickness mapping, thermal imaging, etc., are proving to be very good early warning systems for high risk components.28 The close synergy between flow assurance and corrosion integrity is now more apparent and many companies are now quite successfully, and to significant technical advantage amalgamating such groups. 28,33,69 From a mechanical integrity perspective it is very important for engineers to think carefully beyond the immediate design codes of practice, since corrosion and degradation can kick in fairly soon after start up, often with major degradation issues and problems with continued operability or fitness for service. To that effect engineers should consider utilizing the

14

principles of inherently safe design (ISD) to build in sufficient conservatism and safety. 16,27,28,45 Some important definitions as part of broad ISD and integrity management programs can be described as follows: • HAZARDS- Materials degradation, loss of mechanical properties or corrosion must be considered a hazard, thus better legitimizing the risk based approach, defining: corrosion risk~ probability corrosion failure x consequences. By defining corrosion as a bone fide hazard, in this way allows the more formal use of powerful advanced techniques such as HAZOP, FMEA(failure modes and effects analysis), FTA(fault tree analysis), ETA(event tree analysis), ISD, etc. ALARP- Keeping material and corrosion failures ‘As Low as Reasonably Practicable’. This provides the defensible risk criteria basis for public and environmental concerns, subsequently reducing the critical gaming of financial incentives to a less dominant and overriding parameter. ISD- Inherently Safe Design- designing such that material and corrosion failures are avoided or reduced to acceptable levels, design to ALARP can mean ‘fail safe’ or ‘safe life’ depending on objectives. In practice, used concurrently to save time and money usually means less moving parts, greater emphasis on RAM, and the use of CRAs, with attention to all corrosion threats under all service or non-service conditions. ALARP and ISD- In future may likely be accepted legal terms in a court of law. Both are strict but actually enforce better dialogue, greater accountability, more lateral thinking, and ultimately promote safer life cycle, transparent, solutions. If applied diligently, they can offset any extended CAPEX with reduced OPEX. 15,28,45 Table 1: CRA localized corrosion tendencies, as risk exemplified by pitting resistance equivalent (PREN), critical crevice temperature (CCT) and critical pitting temperature (CPT) interpretations for oilfield applications only. ALLOY 304SS 316SS Alloy 825 22 Cr Duplex (DSS) 25 Cr Super Duplex (SD) Alloy 625 PREN 19 25 33 37 47 51 CCT (°C) <0 <0 <5 20 35 57 15 20 30 30 60 77 CPT (°C) LOCALIZED CORROSION RISK High Risk Medium Risk Medium-Low Risk Medium-Low Risk Low Risk Low Risk

•

•

•

Note: The values are based on empirical formulae, composition, and testing and are sensitive to contact electrochemistry. The alloy elemental compositions and mechanical properties are available in supplier’s literature. The order of corrosion resistance is: Alloy 625 > SD > DSS ≈ Alloy 825 > 316LSS > 304LSS. The values are generally thought to be more applicable to static conditions and not sensitive to flow, though in principle if the flow regime can alter the pitting potential then some sensitivity could be recognized. Hence in principle standard laboratory assessments should always be supported by non-standard and fully representative testing and field observations. To that effect we can make authoritative suggestions for future non-standard, PTV upset, or chemical excursion corrosion testing, within the JIP test rigs, etc., which hitherto are strictly steady state. From a predictive erosion perspective it is important to allow for total wall thinning due to corrosion and erosion type degradation mechanisms. Generally if this calculation shows a total CA value of CA>10mm then intervention via moving toward a suitably selected CRA material either as a solid material or as a lining or cladding option is often considered. Some operators and designers put this threshold at 8mm. Either way the final decision is based on the economics of the project and the cost implications both at capital expenditure (CAPEX) and operating expenditure (OPEX) stages of the project. However, recent studies may be forcing a better more seamless transition between these cost centers. 71-73 Another major factor is the length of the pipeline, and generally speaking pipelines beyond 15 km length will tend to look more closely at carbon steel with highly diligent and aggressive first-in-class chemical inhibition typically with >95% efficiency and >95% availability. Internal coating options are also feasible but would likely still need parallel inhibition schemes to cover for the protection of damaged coating sites. The inhibitors in that case would need to be highly proficient at addressing such sites under crevice corrosion conditions. Designers should engage the services of experienced chemical vendors in this subject matter. Where required, the most frequently used alternative CRA material choices tend to be the nickel alloys, alloy 625 and alloy 825, with the martensitic and austenitic stainless steels also commonly being used, typically 13% Cr and 316SS respectively. Most projects these days are often schedule driven, meaning that fast but detailed advice is sought through guidelines from many sources, societies (NACE, API, ISO etc), and the various JIPs, industrial and academic sources now available. 28,38,39

15

CORROSION, ISD, INTEGRITY, AND KPI’s As part of any inherently safe design or study, any corrosion management strategy (CMS) used must be a fully auditable with a unified approach to retaining integrity of the production facilities, and to meet all goals for safe operation, environmental protection, flowline availability, and revenue management. One proven method for that is the quantifiable key performance indicator route. The integrity management and (thus corrosion management i.e. CMS) document will result in a campaign-driven prioritized inspection, chemical treatment, and monitoring of safety-critical and economically critical elements within the facilities. This will be best defined at the CAPEX i.e. design stage. Some studies have previously examined these aspects, trying to take the best of safety case interpretations for applicability to the GOM region in particular, and many such approaches have been successfully introduced. The process is ongoing however, and, as with all advanced offshore/subsea projects, is a continuing learning and improving process. 28,55 The CMS will therefore form a vehicle to ensure continued operability by minimizing and controlling corrosion to acceptable levels. This can be done by using relatively simple but meaningful goal setting targets, the key performance indicators (KPIs). 9,27,33 The focus of which is usually corrosion risk, but also other associated integrity threats within qualitative and quantitative ISD boundaries as shown below: • • • • • • • • • • Internal corrosion, external corrosion, corrosion under insulation (CUI), erosion; Noting that CUI can be realized as a major threat if piping/vessel insulation gets sodden e.g. via fire water deluge testing. Environmental cracking (SCC, SSC, hydrogen embrittlement, corrosion fatigue vibration / fretting damage, etc.); Embrittlement phenomena (clamps, flanges, premature fasteners / nuts / bolts failure due to intermetallic phases, seizing, galling, etc.); Time dependent failure effects per localized corrosion, mechanical fatigue and thermal creep, and conversely cold temperature loss of properties, toughness etc.; Damage resulting from accidental impact or structural overload, of particular interest to ‘live’ flowline segments, manifolds, vessels, members, etc., linked to or carrying production fluids; Damage from welding stray currents during installation and commissioning operations on/offshore; Malfunction of protective safety devices, and loss of reliability to include corrosion scale build up, overheating for critical electrical cabinets, control units, electrostatic discharges, etc; Design defects, material fabrication defects and construction defects, problems counteracted by specialty treatments such as flow assurance additives, corrosion, and scaling inhibitors, etc. For the KPI system to work a full “buy in” has to be demonstrated from Company (top to bottom). And a more robust interpretation of the MMS PINC`s5 and Sarbane Oxley Act73 would be a positive step forward. Historical case histories must be collated and lessons learned, such as the so called ‘Morales Incident’ to strengthen the conviction for better diligence and appreciation of the CAPEX/OPEX interface. 72

Primary KPI’s Defined (Corrosion) Individual corrosion rates interpreted from the coupon and ER data are time dependent, and can be defined via corrosion loops (i.e. parts of the infrastructure or systems that are expected to yield similar corrosion activity). For example, horizontal flowline segments, vertical segments (SCR), hull piping etc., or indeed such loops may be defined to cover for a specific high risk mechanism, such as CUI across all systems. These KPIs are guideline examples only and would be fine tuned on a case by case basis, best verified by SME consensus. Bearing that in mind we can define the primary corrosion KPIs as follows: • • • • • • All corrosion rates to be < 0.1 mm/y, (though this is now challenged as the threshold may be too restrictive); All CRAs to maintain passivity and exhibit corrosion rates <0.05 mm/y; All inhibitors ( including cocktail mixtures used ) to be efficient at >95%; All inhibitors (including cocktail mixtures) to be available at 100% (min.ideal >95%, accept >90%); Inhibitor dosing pumps to have >97% availability with redundancy as necessary; Topsides leak rates minimized - appropriate settings per offshore asset MODU,TLP etc;

16

• • • •

Key physical and chemical variables monitored for operational envelopes, and to be within 10% of steady state values, to eliminate corrosion driving upset conditions; Ratio flow assurance steady states/unsteady states (excursions) to be defined, and monitored. More than 18 days per annum, being red flagged as corrosion stimulators and no more than three days consecutively proposed be allowed; P,T,V, water cut , CO2, H2S, chlorides, iron counts, sulfide / sulfur, SRB counts, sand levels, etc., to be defined and agreed with red flag alarms set. With regard to this for accepted ‘clean’ systems we propose the following rationale: Define HML risk criteria in context of failure modes and probability, consequences thereof, and quantified confidence levels. The latter is a powerful new concept, relating HML, risk levels to a confidence rating, ergo an inspection interval, and thus monitoring philosophies and monitoring detail.

Water Chemistry and Microbial KPI’s Reservoir and condensing fluids/waters cannot be easily controlled, however these all should remain within the design envelope, arbitrarily we can select guiding KPIs as follows: • • • • • • • • • • pH 5.5 to 6.5, in absence of data use a pessimistic pH 4.5 to 5; Dissolved Oxygen < 20 ppb; H2S < 5 ppm; (‘mild sour’ possibly at 5-20 ppm) Sand < 10 ppm; Microbial activity planktonic (in-stream) <1 colony/ml, (>10 colonies/ml - red flag); Microbial activity sessile (at wall) <10 cells/cm2 (>100 colonies/cm2 - red flag); Total iron deposits <1000 ppm (often arbitrary threshold, verify per chemical vendor); Organic acids prefer <100 ppm (observe excursions >200ppm, red flag>500ppm); Residual inhibitors to be defined and maintained e.g. >125 ppm (or per vendor). Cleaning pig runs and sampling residues targeted at one per month minimum, or better as data dictates. Integrated pigging and corrosion monitoring to adjust inhibitor dosing rates. Intelligent pig runs to be considered every 5 years.

Other Valuable KPI’s Specific KPIs for external CP and external corrosion under insulation (CUI) usually need to be specifically developed, for example the SCR/flowline CP potentials (vs Ag/AgCl cell) are now reasonably well established at: • • • • -900 to -1000 mV defined as well protected < -800 V defined as compliant- CP protected according to code. -800 to -850 mV defined as marginal protection > -800 mV defined as out of compliance (typically observed -700 to -800 mV)

KPI definitions for CUI are very project specific and temperature related and are omitted herein for reasons of brevity and commercial sensitivity. Secondary KPI’s Defined (Reliability) KPIs pertinent to reliability are described below for flowline segments, pressure systems, and critical components. Most will be data-base driven and using existing maintenance work books and RAM analyses as benchmarks: • • • • • • Overall system production time availability – a commercial target ( e.g. >95% ); Minimum system production availability - commercial decision; Ensure 100% inventory and spares for all critical items; MFOP ~ maintenance free operating period- MFFOP ~ minimum failure free operating period, repair time - Compare equivalent items on similar assets Overall Run Time - Compare equivalent items similar assets Failures rates (rotating items e.g. # failures per 100,000 hrs);

17

• • • • •

Failures severity (HML equivalent to: dangerous, degraded, incipient); Failure severity mitigation (HML equivalent to: urgent, deferred, minor); Failures rates per type of equipment- compare equivalent items similar assets Damage rates per vibration / fretting issues - compare equivalent items similar assets. Other decisions not covered directly may be addressed as ALARP linked KPI sensitive issues.

Predictive Modeling The use of predictive corrosion modeling has been focused on the high-risk CO2/sweet corrosion areas pertinent to offshore applications. This has been the case for core predictive tool for pipeline, flowline and piping corrosion integrity design. Unfortunately the agreement between actual field practice and these predictions has tended to be poor; this is due to a number of factors, typically: • • • • • • Models assume uniform wastage (in reality hardly ever the case); Models do not allow for localized corrosion, though some claims are made; Models do not include other localized mechanisms (wear, pitting, microbial, top of line corrosion (TOL) etc), though separate studies/JIP`s are in progress in these areas. Outputs can be erroneous because inputs are often non representative; Key parameters such as fluid shear stress at the wall are not well defined. Flow assurance aspects are not fully attended (major growth area).

It is reasoned that the main materials selection and corrosion assessment output or deliverable should be accepted as being the corrosion allowance, but with emphasis that this is but step one in the corrosion management exercise.28 Nevertheless, this is the key variable that can quite literally decide the viability of a major subsea project. Therefore for a typical project we can focus on the pipeline corrosion integrity, and confirm optimum CA values for effective life-cycle operations. Invariably this will depend on the steady state design envelopes described and maintained, via compatible inhibitors diligently applied. To deliver this, it is suggested a definition of project specific KPIs are made, and some examples are given below: • • Operating P, T, V, values and chemistry are maintained at steady state values (e.g. +/-10%). Excursions beyond that should be <2 days at a time unless reactive procedures (e.g. increased dosing) can be accommodated. Souring H2S levels remain negligible, <5ppm (max 10 ppm). If in the 50-120 ppm zone the combination of H2S and CO2 may be acceptable pending testing, however it appears that beyond 120 ppm the scenarios must be closely looked at, especially if the ratio approaches or exceeds 20. Recent research has shed some interesting light on this combination and the impact on surface passivity.59,60,61 The inhibitor cocktails must work at 90-95% efficiency with a high availability not to fall below 95% unless specified circumstances are agreed. The greatest threat to inhibitor performance seems to be sand erosion at highly turbulent cases and sand under-deposit corrosion within laminar flow regimes.28,54 There may be other defining caveats such as design envelope constraints (including ‘commercial- in- confidence’ RAM studies) identified by materials engineers on a project specific basis.

•

•

Monitoring Tools It is recommended that the use of advanced U/T, inspection, and pigging must also be aligned to corrosion modeling predictions, as well as more appropriate methods of corrosion monitoring such as FSM or RPCM (instrumented spool techniques 28,42), MIC analyses, thermal imaging, real time radiography, guided wave, potential versus time (via platinum stud reference) E-t, best representative residue, fluid sampling, etc. 28,54 Corrosion management is an ongoing discipline often required way past the available fundamental R&D; this time lag enforces risk based solutions to progress important energy projects. To that effect the use of pre-determined risk factors for localized corrosion has been explored and recommended as an acceptable way forward, and usefully utilized, via fine tuning of project experience and JIP data as accrued. It is therefore reasoned that pragmatic, advanced engineering is key to safe and efficient operations, competitive advantage, and sustainability in solving some of the most complex technical and political challenges that are facing the industry. Such engineering must involve the development of non-standard corrosion testing (field and laboratory) often under accelerating conditions.

18

Clearly to quantify KPI’s requires data, ideally live field data, and to that effect there are many corrosion monitoring techniques available. The most appropriate to offshore industry are commonly described and vetted for their advantages and disadvantages as they pertain to a successful project specific corrosion and integrity management regime. 28 Typically, the most efficient are the removable coupons, electrical resistance (ER) probes, linear polarization resistance (LPR) probes, biostuds, fluid/residue sampling, acoustic techniques, area U/T and various in situ spool mapping methods. 21,28,49 Other advanced techniques such as a.c. impedance, electrochemical noise, hydrogen patch probes etc., are available but are rarely used beyond the laboratory. Scale measurement devices with advanced monitoring and pigging are also under review.28 Mechanical Aspects and Inherent Safety Materials, corrosion, and the chemistry of the environment are rarely applied without the encompassing discipline of mechanical engineering. To that effect it is vital for offshore teams to be multidisciplined, and typically that would require expertise in the areas of pipeline, topsides, metallurgy, corrosion, cathodic protection/coatings, process chemists, etc. Figure 8 below shows how some of these disciplines might fit into an advanced offshore pipeline project. Solid technical leadership, and core competency are crucial to making the new challenging designs workable, and to a degree inherently safe, and to that effect qualified and experienced people are vital, as are the will and motivation to engage in contentious often adversarial debate. Much of which is found to be best achieved at the interface between academia and industry via the operatorsponsored JIPs. The role of academia taking the lead in this process can not be over-emphasized. For deepwater assets (>3,000 ft to 10,000 ft) the arguments for asset integrity become more critical since inspection, retrofit,repair etc., become extremely costly, dangerous and often impractical, thus forcing materials engineering to be highly predictive in nature. There are many parameters, most of which are inter-related, and should therefore not be considered in complete isolation. Invariably the key driver is the revenue and savings combination. If these targets cannot be met, the project may be blocked. Thus material selection, corrosion, assessment, welding, CP/coatings must be inherently safe and optimized to be cost effective. These are real engineering challenges on top of basic mechanical design to resist stress, hydrostatic collapse, flow assurance, riser systems, installation techniques (Reel, S-lay, J-lay, etc), component operational performance, etc. Typically wall thicknesses have to be relatively thick, making a heavy pipe string, and thus have significant impact on installation lay barges and existing equipment capabilities. Once in place there is little room for error, or remedial action, thus designs have to take cognizance of best workable solutions, which are often exercises in knowledge management across assets and indeed regions.9 There are a number of engineering challenges regarding the flow assurance and related scaling issues within pipelines. Hydrate formation, wax behavior, erosion, and multiphase flow;28 these are matters that need to be addressed. Inadequate design in this area can lead to unwanted blockages, down time of pipelines, and therefore loss of valuable productivity. Design Code Application and Limitations There is a considerable grey area of uncertainty regarding the interface between mechanical design codes and corrosion. Often this needs to be plugged in by corrosion and integrity engineering using best risk based judgments. There are a number of pipeline design codes, and each one is different. In the long term, uniformity in codes for pipeline design would be beneficial. Stress based design is not applicable for high temperatures, and could possibly lead to excessively thick pipelines. The use of strain based design codes, and limit state based design seems more applicable for complex high temperature designs. The integration of analysis tools with design codes is a key challenge; bringing in the effects of irregular corrosion thinning complicates further. The latter has been code addressed for ‘continued fitness for purpose’ of certain localized defects, pitting clusters, interactive corrosion sites, etc. 76,77 And the use of JIP orientated corrosion modeling acting as de facto inherently safe promoting standards will have enormous benefits in this regard.38,39,55 Pipe-in-Pipe Options The new pipe-in-pipe (PIP) options (Figure 6 below) rapidly are becoming the design configuration of choice for deepwater and extremely cold Arctic applications. The PIP systems allow a range of advanced and highly efficient insulation materials to be used to achieve the requisite heat transfer properties required, and assures greater degree of mechanical integrity, and is therefore an inherently safer design.28,57

19

Figure 6: A typical pipe-in-pipe (PIP) System These systems are important components of subsea developments where untreated well fluids may have to be transported large distances (long subsea tie backs) and wax and hydrate problems have to be effectively managed. In addition for extreme cases such as LNG transportation, Pipe- in-Pipe-in-Pipe (PIPIP) configurations (three concentric pipes, with typically a NiFe inner pipe high nickel (36%) steels being selected for extra inherently safer /integrity characteristics.15 However monitoring the life cycle integrity of such systems can be a challenge but creative options are continually being looked at. 15,56 Flow Assurance Solutions Hydrate formation, wax behavior, erosion, and multiphase flows can be more critical design issues, especially for multiphase fluids transitioning from deepwater to shallow water. The flow assurance strategy comprises a combined design and management philosophy for all of the following depending upon the fluid properties and operating conditions such as: hydrate formation, wax/asphaltenes, scale, forming, emulsion, slugging, and damaging erosion/corrosion.20 • • Hydrate Management: To prevent and manage hydrate formation, combination of either chemical treatment and/or thermal insulation may be used. Wax/Asphaltene Management: To prevent and manage paraffin deposition, a combination of thermal insulation, chemical treatment and pigging may be used. A cost/benefit analysis of these solutions should be conducted before final selection of a paraffin management strategy is made. Liquid Slugging: Transient, dynamic analysis of the flowline and risers must be conducted to evaluate the potential severity of liquid slugging. Based on this type of analysis, an appropriate strategy to control slugging can be developed. Erosion: Various types of sand and erosion monitors are available for installation within/on subsea tree and manifold piping. These devices (electrical resistance (ER) intrusive probes or acoustic non-intrusive) can be used to monitor erosion and optimize well flow rates, often well above the API recommended limits. 29 Corrosion: The recommended material solution may be the use of carbon steel flowlines combined with near continuous inhibitor injection or the use of corrosion resistant alloys (CRAs). The decision is usually made via corrosion modeling prediction techniques. The main threat to integrity is wetting of the annulus insulation by breeched inner wall, and the lack of inspectability therof. Much work is currently in progress in that regard though preset school of thought is that any corrosion issues should be self contained since the systems are most often “closed”. 57,69

• •

•

The typical strategy is best adopted early in the conceptual and planning phase of the project prior to specifying and ordering the main components of the system, such as downhole equipment, trees, flowlines, control system and topsides equipment. Flow assurance strategy should also be applied during detailed system design, developing operating procedures as well as offshore production operations to maximise profitability of the field development. Based on the flow assurance analysis results, a design philosophy and functional specifications can be developed for the following elements: • • • • • Sizing of well tubing and completion design; Sizing of all flowlines, risers and export system, including subsea manifolds; Thermal management (insulation or heating); Chemical injection, including the subsea chemical distribution, umbilical, topsides chemical delivery system; Pigging strategy, cleaning and smart (subsea or surface launched).

20

One such solution is to make the pipeline more buoyant, to reduce the span stress. To ensure that the pipeline does not get over stressed at the touch down point with the seabed, bend restrictors can be used to limit the bending curvature. Standardization of Designs One major way forward still under development, is to generate the standardization of designs, if the developments are similar in nature (water depths, pressure, temperature, corrosivity, etc.). The main advantages from standardization are driving down costs, and reducing schedule time. If this approach can be suitably linked to ISD there would be substantial benefit to the cause of CISD, The fear seems to be that over exposure to materials selection and corrosion analysis is cost prohibitive. In reality the benefits to be exploited are: • • • Common health and safety culture down the supply chain; Support in the context of inherently safer designs. Long-term supply chain relationships, including; focused FEED, detailed design, commonality of IM issues; lessons learned (this must be a continual process), all with significant potential for integration within CMS programs,

Used properly, standardization has the ability to collate, and rationalize existing design methodologies, sift through best practices applicable to each region, and can therefore be expected to deliver significant improvements pertaining to; cost, schedule, quality, operability, and predictability. Major program standardizations are presently being undertaken on projects in the GOM and overseas for major clients.28,39,40 The results are attractive and promising in terms of scheduling, manpower resources, and, therefore, budgets. However when unexpected variables enter the decision making process, such as the possibility of sour service being incurred post water injection scenarios, then difficulties can prove to be hard to surmount, especially if expensive equipment has already been purchased or allocated. Under these circumstances materials and corrosion engineers can find themselves in a very awkward position, trying to justify non-sour materials selection, when all predictions point to a sour service development over the life cycle, albeit often in the distant future. Similar arguments and predicaments exist for advanced engineering criticality assessment (ECA), and fitness for service (FFS) whereupon new flaw sizing criteria need to be appraised at design and during service accordingly. The combination of ISD, concurrent design, and standardization is a powerful tooling for challenging deepwater campaigns, and if taught (included) within future engineering curricula a big step forward for the engineering community as a whole. Materials and Welding For both equipment and flowlines, a critical component of successful design for HP/HT is a thorough understanding of the materials and welding issues. Management of detailed materials testing and quality procedures is crucial, and the verification of drawing board detail to as received and built components is vital especially in the global market place. Also rigorous equipment specification is required, paying particular attention to material selection for components, such as seals. In addition, increased use of exotic materials, such as corrosion resistant alloys (CRAs), either solid or as liners, throughout the system offers alternative solutions, though care must be taken at interfaces, to minimize or eliminate junction galvanic effects. Loadings for installation and operations that must be reviewed are: axial, lateral movement; effective axial force; axial and hoop stress; von mises stress; bending moment; plastic strain, buckling; curvature; spanning/stability, etc. HSE PERSPECTIVE Following review of the MMS and UK HSE step changes in safety alerts, many recent insights have been identified with respect to the potential for similar causes or similarities due to incidents that have happened since the Piper Alpha Disaster. This was done with a view to aid plausible corrective actions. The results pointed to two main types of actions: those related to design safety and those related to work permits and lockout/tagout. Thus, the use of meaningful corrosion and integrity management can also play a valuable role in such accident prevention. Prevention of these through diligent integrity management would clearly play a significant role in prevention by design, predictive and proactive measures. There have been many recent safety alert examples, and other relevant post accident studies, over the period (2000-2008), and details are readily available in the public domain (via CBS,41 MMS and HSE web pages28). It is more appropriate in the context of this paper, to identify the best actions derived from the alerts as exemplified below: Actions from the Alerts • Compile and issue a shutdown specific isolation protocol, based on review of practices elsewhere in the company and in other worldwide affiliates. The document should cover vent/isolation tagging standards and documentation required for large-scale shutdowns; Lessees and operators should repair malfunctioning equipment in lieu of using alternative methods such as opening a manual liquid dump valve when the automatic liquid dump valve fails or blind flanging off a pressure relief line when a PSE ruptures.

•

21

•

Lessees and operators shall review piping to ensure that deck drains have adequate trap mechanisms to prevent gases (corrosion leaks) from migrating through, that deck drains are not piped to a pressure line before entering a sump tank, and that piping for produced water does not tie into the piping for the wastewater from the living quarters. Lessees and operators should review flare boom lines to ensure that they are designed of proper length, height, and oriented in the proper position according to prevailing winds to minimize the migration of gas back to the living quarters. Barrier and tag off for access under strict permit to work only. Supervisors must provide adequate job instructions and planning prior to the work, without jeopardizing the scope intention of the work (applies particularly to contractors/inspectors who can find themselves under pressure to complete and go). Hazards must be identified as work proceeds, and a ‘stop work policy’ in place as the job scope changes. Fire protection/deluge systems must not be compromised and as a rule be ‘fail-safe’ with 100% availability or redundancy. Personnel must be familiar with and utilize lock-out and tag-out procedures to isolate equipment and process piping during work programs. Simultaneous operations must be clearly communicated to all appropriate parties, and made fail safe, detailing all sitespecific procedures prior to work being implemented. Lessees and designated operators should be able to trace the history of ring gaskets in the field regardless of previous ownership, and/or determine the condition of the ring gaskets prior to the performance of future operations (gasket failure and ensuing corrosion related leaks are very common offshore). The US Minerals Management Service (MMS) requires lessees and operators to perform strict maintenance and inspections, monitor the environmental conditions, and maintain records of these activities.29,33 Since a failure on a dynamic riser could pose a significant impact to safety, the environment, and energy supply. Thus it is essential to perform necessary actions to ensure the safety and reliability of these critical components. The national consensus standard for dynamic risers, API-recommended practice 2RD is currently under revision.41 The revised version is expected to include guidance on integrity management for dynamic risers. The MMS will consider adopting this standard into its regulations for outer continental shelf pipelines.

•

•

• • • • •

•

•

A discussion of the findings shows three main types of recommendations that parallel the findings of Piper Alpha: (a) There must be an effective work permit system including the use of lockout/tagout (b) There must be rigorous design review that is comprehensive enough to think ahead to the probable scenarios and consequences of the design. (c) Asset holders must have a formalized culture of safety which is implemented and acted upon. Promoting life cycle integrity and parallel safety procedures, then not acting on them should be considered a zero option. 10 Noting that a very high proportion of equipment maintenance work is corrosion, ageing or wear related, the clear evaluation is that potentially dangerous incidents continue from time to time at offshore facilities. Corrosion prevention and detection and in the larger view the use of integrity management systems are essential to proactively prevent these from occurring. In addition, safety in design is vital to building in prevention long before problems occur. The MMS potential incidents of noncompliance (PINCs) were also created to address that matter.52 Finally, operating best practices of work permit systems and lockout/tagout remain a key to accident prevention generally. CORROSION RISK MANAGEMENT PRACTICE In reality the current corrosion business practices for most oil and gas operations is a balance of three risk management methodologies. These methodologies are interrelated and must be balanced and reviewed on a continuous basis. The methodologies are: • • • Reactive Corrosion Monitoring; Proactive Corrosion Monitoring; Active Corrosion Monitoring.

The decision on how to manage the corrosion business risk is highly dependent on the corporate senior management policy of handling their operational or capital expenditures. It is emphasized that these methodologies are equally important during the conceptual to detailed design of an integrity management system. However the initial step of an extended CAPEX to cover

22

for these areas is critical. The inter-relations of the three methodologies are shown below in Figure 7. The importance of understanding the root cause (s) of any corrosion issue is critical in providing pragmatic cost-effective corrosion risk management solutions. Likewise the analysis of early inspection and corrosion data is vital for best future predictions.

Figure 7: Schematic depicting the crucial relationships between reactive, proactive, and active corrosion analyses. It is considered that these corrosion risk management methodologies will always be the underlying factors in the business decisions of all oil and gas operators. Management of change (MOC) of the order required for meaningful ISD will in practice always be difficult, however the volume of literature now more openly available in the industry will supply the required leverage needed. In particular operating company group standards and international associations are clearly making the case quite forcefully.53,71 CONCLUDING REMARKS The Piper Alpha review has been a work in progress, with many derived findings, conclusions and specifically KPI-based recommendations most of which are capable of being tailored to new and existing projects. The most valuable observation is the need for continued life cycle vigilance, most likely through diligent but limited regulatory control, since the North Sea experience has shown that ‘over regulation’ can impose major financial burdens often to the detriment of the project, and sometimes to the creativity of solutions. More recently the issue of designing for subsea tiebacks has become increasingly more sensitive since the new pipeline is (green field), but is tieing into an existing (brown) field infrastructure. Thus the issues of compatibility and corrosion integrity become far more critical, especially at interfaces, a problem that was identifiable with Pipe Alpha, but perhaps not fully addressed at the time. In the future these may become pronounced issues as long subsea tie backs (greenfield) are introduced into older (brownfield) assets. It is concluded that by applying the principles of concurrent and inherently safe design, in tandem with best industry practices, to aggressive corrosion and erosion conditions, safer offshore assets can be achieved. By using effective and simplified designs, creative inspection, less maintenance, and less direct manpower, can help better meet the life cycle objectives, life cycle integrity and fitness for service. Indeed if the combination of ISD, concurrent design, and standardization, is correctly deployed it can give a powerful impetus for challenging deepwater projects, and if taught within future university engineering curricula give a major leadership role for the engineering discipline and communityas a whole. Setting the goals is paramount, and identifying the hazards, and designing out the problem areas, is best done by multidisciplined project groups in small step sequences. A clear advantage would be for industry to accept corrosion as a hazard thereby opening it up to more formal written schemes of corrosion integrity risk analyses. The use of commonly accepted high, medium, low, risk definitions and simplified go/hold/no go traffic signal type decision gates is a significant evolution in the design and operational integrity management process. The methodology and KPI techniques advised require difficult changes and lateral thinking, but serious traction, and a positive paradigm shift has been noted when applied. The main advantage being that it eliminates the erroneous premise that to comply with codes and standards is all that is needed. Additionally the use of new quantifiable confidence grading is a powerful new concept, relating HML risk levels to a repeatable more reliable level; thus inspection interval, ergo monitoring philosophies and monitoring detail. As a result KPI’s can be both high level, and drill down to more rigorous manifestations.

23

The use of continually refreshed multidisciplinary teams is paramount to enhancing creativity; the blend of experienced and newly qualified engineers can help to minimize negative often dysfunctional ‘group think,’ which can be a barrier to innovative solutions.28,70 Corrosion, erosion, and MIC phenomena are major areas of weakness within failure mode and effects, understanding, and control. However predictive modeling and JIP driven corrosion management programs are pushing for pragmatic solutions into the right direction. The unique JIP blend of highly motivated and qualified researchers combined with experienced oilfield personnel has led to many breakthroughs in offshore and subsea corrosion integrity issues.33,34 It is therefore important for the engineering companies to stay abreast of safety critical findings as they are unraveled and to participate in such leading edge activities, with the offshore operators. Of the findings to date it is recommended to act on the Piper Alpha findings and look beyond at the secondary issues pertinent to offshore design integrity; such as materials performance, and corrosion, focusing on critical combinations such as corrosion plus erosion, microbial activity, and corrosion plus souring activity, as matters of priority. It is also expedient to examine and better quantify the relationships between excursionary or non-steady corrosion phenomena, with the physical parameters, PTV, and to find methods to enforce best RAM analyses along with near continual chemical injection when warranted, and assure that safe inspectability is always practical. The use of an annual corrosion integrity statement by the asset operators is strongly recommended to ensure fitness for purpose is continually maintained. And since most offshore failures are the result of multiple events precipitating to a break point, it is logical that resolution must involve multi-disciplined engineering teams, with a strong materials engineering content. The role of better leadership and training beyond profit motives alone has also been recently emphasized.74 It is important for the future deepwater and arctic offshore community to look more closely at new designs and new solutions from both a materials fabrication and the materials performance basis, especially for safety critical elements such as SCR’s, and pressure containment plant, and potential leak sources at interfaces. Companies must continually re-educate staff so that lessons learned (and near misses) are not forgotten, and be prepared to look at alternative approaches to design/operational issues even if they emanate from unconventional sources.72,73 Better cooperation between the CAPEX and OPEX cost centers is vital if full advantage of lessons learned from Piper Alpha and other disasters are to be realized. In reality this may take the form of an extended CAPEX commitment. History has shown that major step change progress is usually made after major disasters and often through non-conventional means. The new solution sets, and developments vis-a- vis ISD will it is believed come from a closer liaison between industry and academia as exemplified by the JIPs already in place. The powerful role of academia whether through JIP`s or self driven changes in university curricula will be instrumental in the paradigm shift required and perhaps expected. ACKNOWLEDGEMENTS The authors acknowledge the support of IONIK Consulting/J P Kenny/MCS, and Wood Group. The input of Cameron expertise is much appreciated. The use of educational material from Coastal Training Technology Corporation, and failure case history examples from Deepwater Corrosion Services, Houston, Texas, is also gratefully acknowledged. The permission of the OTC Committee in Houston to use the OTC paper as template for this paper is appreciated. Many thanks are due to Kimberley McCollom for her assistance with the documentation and formatting. And finally the findings, interpretation and opinions expressed are those of the authors, and not necessarily those of the companies. REFERENCES 1. 2. B. Singh, P. Jukes, R. Wittkower, B. R. Poblete, Annual OTC, Offshore Integrity Management - 20 Years On: Overview of Lessons Learnt Post Piper Alpha, paper# OTC 20051-PP , Houston TX, 4th -7th May 2009. B. Singh, P. Jukes, R. Wittkower, B.R. Poblete, Mary Kay O’Connor Process Safety Center Beyond Regulatory Compliance: 20 years on lessons learned from Piper Alpha – The evolution of concurrent and inherently safe design. Oct 27-28, 2009. Lord Cullen Report, Public Inquiry into the Piper Alpha Disaster, Volumes 1 and 2, Pub. HMSO 1990 (Reprinted 1993). Lees F.P., Loss Prevention in the Process Industries, Butterworths 1980. Kletz T. What Went Wrong- Case Histories of Process Plant Disasters, Butterworth Heinemann 4Th Ed 1998. NTSB Carlsbad Pipeline Failure Report # PAR 03/01 Neal M., IMECHE Publication, The Causes of Accidents.ISSN 1751-18471, January 2007. BP booklet, Integrity Management- Learning from Past Major Industrial Incidents Booklet 14, Sunbury, UK, 2004.

3. 4. 5. 6. 7. 8.

24

9.

Singh. B., T. Folk, P. Jukes, J. Garcia,W. Perich, From the North Sea to the Gulf of Mexico- Making the Link between Corrosion Research and Best Practice, RIP # 06R206, NACE 2006.

10. Private Correspondences with Messrs Ben Poblete (LR/Cameron), Graeme Dalzell (TBS3), Trevor Kletz (Author), Chris Robbins (UK HSE), 2000-2008. 11. Wood Group HSE Matters. Company Report 2008- Article The lessons of Piper Alpha. 12. Coastal Training Technology Corporation, DVD Piper Alpha Spiral to Disaster, 2007. 13. BBC web pages. Various articles regarding the Piper Alpha Disaster. 14. Fontana M.G. Corrosion Engineering, Van Wylen Press ca. 1984 15. Singh B., J.N. Britton, B.R.Poblete, G.Smith, The 3 R`s- Risk Rust and Reliability, paper# 05553 NACE 2005. 16. JP Kenny, T4B Series –Arctic Pipelines, Materials, FFS, and Corrosion studies. C-In-C, Dec. 2008 17. JP Kenny HSE Alerts and Safety Notices 2005-2008 18. Singh B., J.N.Britton, D.Flannery, Offshore Corrosion Failure Analyses: Series of Case Histories, # 03114, NACE 2003. 19. Deepwater Corrosion Services Inc. Houston, web pages www.stoprust.com, 2008/9. 20. JPKenny/University of Houston, Pipeline Engineering course modules, by AEG/IONIK groups, 2008. 21. SCOTA/UKOOA Materials and Corrosion Course Modules, by Singh/Bradley, Aberdeen UK ca 1995. 22. UMIST/University of Manchester Corrosion Center-(J.L.Dawson/G.E. Thompson, W.Cox, et al) 1983-1995. 23. UK HSE Contract Research Report 363/2001, Best Practices for Risk Based Inspection (TWI/Sun Alliance), 2001. 24. DOT Regulations, CFR 49 Parts 192/195 per Gas and Liquid Pipelines. 25. B. Singh, T. Folk, P. Jukes, J. Garcia, W. Perich*, D. Van Oostendorp, Engineering Pragmatic Solutions for CO2 Corrosion Problems, NACE Corrosion 2007. 26. R.A Mueller Corrosion Allowance-Not always a Simple Concept, Materials Performance, March 2006. 27. Singh B, Materials Selection and Inherently Safe Design, ASM Presentation, Houston, Feb 2007. 28. JPK-Ionik Corrosion and Integrity Management Literature, Experience basis- various projects 2005-2008. 29. API 14E RP Offshore Piping Design Section 2.5, Version 1991 30. DNV RP 0501 Erosive Wear in Piping Systems 1999 (2002) 31. UK HSE/TUV-NEL Erosion Research Report #115, 2003. 32. US DOI-MMS Federal Register Vol. 72, No. 191 Oct 3 2007 / Proposed Rules 30CFR parts 250,253,254,256. 33. B. Singh and K. Krishnathasan, Pipeline Pigging & Integrity Management Conference: Making the link between Inherently Safe Design, Integrity Management and Pigging, Houston 12-15th Feb 2008. 34. API 2RD RP Design of Risers for Floating Production Systems, and Tension Leg Platforms. 35. NORSOK Standard M001 Materials Selection, Rev 4, August 2004 36. EEMUA 194 Guidelines for Materials Selection & Corrosion Control for Subsea Oil/Gas Production Equipment, 2004. 37. B.S. Massey Mechanics of Fluids, Van Nostrand Reinhold Co. 1970. 38. Ohio University Corrosion Modeling JIP, Chair: Professor S. Nesjic, 2007/8 39. University of Tulsa, Erosion and Corrosion JIP, Chair: Professor E. Rybicki, 2007/8 40. J. Smart. A Review of Erosion Corrosion in Oil and Gas Production. Flow Induced Corrosion Symposium: Fundamental Studies and Industry Experience. NACE Corrosion 1990. 41. Baker J.A., Report – The BP US Refineries Independent Safety Review Panel, January, 2007. 42. Ionik Consulting Internal Training Modules, A. Denny/ G. Strong et al. Includes support literature from Alberta Energy & Utilities Board (Canada), Roxar (USA), Cormon (USA), 2000-2008. 43. Shreir L.L. Corrosion Control Handbook, Butterworth Heineman, 3rd Ed 1994.

25

44. API 580, Risk Based Inspection, First Edition, May 2002. 45. Dalziell G. Inherently Safe Design, Paper# 86598, SPE 2004. 46. Poblete B.R., B. Singh, G. Dalzell, The Inherent Safe Design of an Offshore Installation, Texas A& M Process Safety Conference, MKOPS, Oct 23/24Oct, 2007 47. DNV RP 0501 Erosive Wear in Piping Systems 1999 (2002). 48. API 17D Specification for Subsea Wellhead and Christmas Tree Equipment. 49. JPKenny/Ionik Internal Experience Basis, Corrosion Reports, In-House Spreadsheets & Toolboxes. 50. BP Report No. S/EPT/096/04- Erosion Guidelines (Rev 3), 2004. 51. DNV offshore Standard- Submarine Pipeline Systems OS-F101, Jan 2000. 52. US DOI-MMS Offshore & Pipeline Regulations - PINC Listings Feb 2007. 53. Vars Operator Standardization Documents for Subsea Materials 2006-2008. 54. Prodger M., LR Private Correspondences 1997-1999, & LRIM Corrosion Management ppt Dec 1997 55. IONIK JIP Business Case Report (77447.03) Rev B, Nov 2008. 56. McLaury B., J. Wang et al, (Tulsa Univ.) SPE # 38842 SPE Tech. Conf, San Antonio, TX, Oct 1997. 57. Jukes, P., B.Singh, J.Garcia, F.Delille, Critical Thermal, Corrosion, & Material Issues Related to Flowline Pipe-in-Pipe (PIP) Systems. Paper # ISOPE -2008-TPC-297. 58. NACE Nashville Plenary Lecture Corrosion, Crime, and Punishment, (Panel Session-Garrity. K., et al), Nashville 2007. 59. Lee J., Ph.D. Thesis Ohio University, Athens, OH, ( Research Data) ca 2004/5. 60. Hahn. J. Ph.D. Thesis Ohio University Athens, OH, (Advance findings) ca 2008. 61. Thamala. K., M.S. Thesis, Tulsa University, (Advance findings) ca 2008. 62. Ramachandra S. Baker Petrolite, private communications, 2007/8. 63. Hibbert. L., Averting Disaster, Professional Engineering, IMechE Journal, Vol. 21, No. 11, June 2008. 64. Nyborg R.N, A. Dugstad, TOL Corrosion NACE Paper #07555, NACE 2007. 65. Marsh J., T.Teh, Conflicting Views CO2 Corrosion, SPE paper #109209, 2007. 66. Jepson P. et al, The Effects of Multiphase Flow on Sweet Corrosion in Oil and Gas Pipelines-Vars early work presentations from Ohio University, 1999-2002. 67. Nyborg R., Overview CO2 Corrosion Models, Paper 02233, NACE 2002. 68. Uff J., Risk in Engineering etc. Inst. Mech. Eng 90th Thomas Hawksley Memorial Lecture, December 2002. 69. Singh B, K. Krishnathasan, T. Ahmed, Predicting Pipeline Corrosion, Pipeline and Gas Technology Journal, Oct 2008. 70. Edison, E. The Team Development Life Cycle- A New Look, Defense AT&L May-June 2008. 71. International Association of Oil & Gas Producers (OGP). Asset Integrity-The key to managing major incident risks. Report #415, Dec 2008. 72. Woodhouse, J. PAS-55 Asset Management: Concepts and Practices, ReliabilityWeb.com. 73. Morales Incident, Study Guide, Murdoch Center for Engineering Professionalism, Texas Tech University, 2003. 74. Beavers J.T. Sarbanes-Oxley Impacts Plant Personnel Too, Hydrocarbon Processing, Aug 2006. 75. Hopkins A. The Frank Lees Memorial Lecture, MKOPSC, Beyond Regulatory Compliance, Texas A&M, Oct 27-28, 2009. 76. ASME B31G, Method for Determining the Remaining Strength of Corroded Pipelines, New York, NY,ASME International. 77. DNV RP F101, Corroded Pipelines, Oct 2004.