Deepwater Asset Integrity Management

Deep Offshore Technology International 2010 (Paper 107) DEEPWATER ASSET INTEGRITY MANAGEMENT INTERPRETATION OF LESSONS LEARNED POST PIPER ALPHA Dr. Binder Singh, Dr. Paul Jukes, Bob Wittkower, Ben Poblete* IONIK Consulting-JP Kenny-MCS Inc. WOOD GROUP 15115 Park Row, 3rd Floor Houston, TX 77084 *Affiliation Cameron, Houston/TX ABSTRACT Since the North Sea Piper Alpha disaster in 1988, many significant changes have been implemented across many world offshore regions. Even after more than 20 years, the emanating point for these sweeping changes has been the Cullen Report and the UK North Sea industry. This paper presents an interpretation of the early and later lessons learned, as considered applicable to mainly (but not exclusively) GOM deepwater assets and pipelines. The focus is on the many so called 'secondary' finer points related to materials, corrosion, and integrity; these tend to get overlooked somewhat, but recent experiences and observations reveal the strong case for a careful re-appraisal. The understanding, monitoring and control of such failures can be critical in reconstituting integrity, if pragmatic life cycle safety and performance are to be recognized. It is argued that these second tier modes of failure such as, latent internal corrosion, erosion, environmental cracking, and other degradation phenomena, have become more critical in deepwater projects, since fixing or re-habilitating the problem is just far too costly and/or even impossible to attend. The authors use career wide experiences post Piper Alpha to highlight the worries and concerns offering where plausible rational pragmatic solutions, illustrated through related case histories. Conclusions and recommendations are based on cross asset interpretations, and where possible verified, with solutions offered. Additionally industry disconnects between knowledge transfer and management under this tutelage are identified. The evolving methods of ‘concurrent design’ and inherently safe design are discussed, and as a result powerful advances in mechanical, materials, and corrosion engineering thought are emphasized and the use of Key Performance Indicators (KPI`s) and Key Failure Indicators (KFI`s) are reasoned for best life cycle integrity management. This is important for deepwater assets where 'surprise" failures, environmental and political 'snafus' are not really an option. It is construed that a more purposeful design investment at CAPEX is more amenable than at OPEX, and the 'gray ' zone between the two cost centers must be better bridged to industry advantage. INTRODUCTION After the recent 20th Anniversary of the Piper Alpha offshore disaster a paper was prepared and delivered to the OTC conference in Houston Texas, in May 2009 and a upon invitation the exercise was repeated for the Offshore Brazil conference in Macae, Brazil in June 2009. This paper is based on an adaptation of the OTC paper. 1 and a more recent paper given to the Mary Kay O Connor Process Safety Center at Texas A&M University.2 On the 6th of July 1988, the world’s worst offshore oil industry disaster occurred on the Piper Alpha platform in the UK sector of the North Sea. The loss of life was staggering: 167 dead, with 62 survivors, and dozens badly injured. Much has been written and debated on the incident. This paper examines a new angle on the subject matter, in the context of Inherently Safe Design, and the allied second tier items of interest. These are the corrosion-related items that have been accepted as pertinent over the years, but often erroneously perceived with less priority. This is largely because the subject matter is considered too specialistic, or complex and often requiring costly subject matter expertise. As a result, corrosion integrity is sometimes dangerously taken off the agenda by non-subject-appreciative project or even industry leaders. This paper delves into this contentious area, examines the role of corrosion mechanisms in the root cause analyses of most significant failures and virtually all loss of performance issues. The interpretations are made with the support of solid observations and new understandings in the direct context of integrity and corrosion management. The authors come from a mixed blend of offshore disciplines, with over 80 years of combined experience, predominantly from the North Sea and Gulf of Mexico. The objectives are aimed to be educational and not controversial, but the opinions are strong, and considered very worthy of continued debate and development. The Piper Alpha accident was a monumental event. It is, perhaps, in terms of impact a top-five engineering disaster on the global scale, considered to be in the same league as Chernobyl, Challenger, Three Mile Island, Flixborough, etc.3-8 In terms of cost, it was also very expensive (estimated at more than $3.4b 2 ). And in many ways it is historically comparable to other high-impact human events such as the Kennedy assassination, New York- 9/11, London 7/7, and Mumbai 11/27, in that people (certainly in the British Isles and the North Sea community) often remember where they were on the day. In that way

2

the Piper Alpha seems to have uniqueness about it, which may be due to the fact that it was offshore and involved a heavily manned producing platform. The major differential has, with the benefit of hindsight, been that the disaster was de facto man made, in that the original platform had many major design changes made to convert it into a gathering and distribution hub. Though not a deliberate act in any way, many human and engineering errors were seen to hideously come into play. Many studies have looked at that aspect, the center piece of most if not all being the ensuing public inquiry and the Cullen Report which was published in 1990.3 This was the culmination of a thorough two year inquiry involving many interviews with survivors, families, and subject-matter experts of the day, with many others on the outside offering immediate opinions on the many public affairs programs of the day, as seems to be the norm under such events. It was also commonly noted for truck loads of documents being delivered to the courthouses of London and Aberdeen, and that was a reflection of the nonelectronic transfer of documentation, as might be expected in today’s computer driven age. The Cullen report has tended to be the main stay reference source for all new offshore design and operational guidelines the world over. Some regions have used the findings rigorously whereas others have used them less in depth. Overall the report led to the effective dissolution of the prescriptive regulations sanctioned up to that point, and replaced same with the evolution of the goal setting integrity regulations in the UK and with derivatives thereof. On the plus side the major outcome of the disaster has been far better, safer, and more efficient engineering practices for the oil industry. And indirectly has supported strongly the need for Inherently Safe Designs and procedures. These have been realized by better, more focused research, better applied knowledge management, and a greater sense of public and industry responsibility by the new generation of engineers and scientists.4-19 Many more offshore, subsea and integrity-related projects and courses have evolved worldwide, largely at contract research or post-graduate level, much to the advantage and betterment of the industry.5-23 This has been promulgated by the better realization by professionals in the industry that designing to build the asset, structure, pipeline, and pressure plant can no longer be based on projected revenues alone. Yes, the ultimate decision maker or breaker can and often is the commercial sensibility, but a greater sense of responsibility to the public, and the environment, has fallen into place. This is largely regulatory driven, but one can still discern a good dose of professionalism, merit and worthiness in the arena. Root Causes Regarding the accident there was, perhaps, no single root cause event that was to blame. Rather, it was a confluence of many critical factors that were almost the ‘perfect storm’ often described as the jigsaw or ‘swiss cheese’ effect , whereupon critical events occurring at a certain juncture in time, and as a consequence the failure sequence fell into place, with tragic results. In reality integrity management (IM) is far more complex than basic maintenance (a common misnomer), the parameters affecting IM are non linear and influential during IM pre-planning, post planning, action and reaction, etc., and indeed the alignment of bad sequences, events or circumstances are invariably all time dependent and thus multi-dimensional in nature. This has traditionally made IM a difficult subject to grasp, especially since it transcends both CAPEX and OPEX cost centers. The Piper Alpha was commissioned in 1976, but was modified to act as a major gas processing and gathering station. This meant it was handling large amounts of high-pressure gas, with a dispersed plant layout, making inspection, maintenance and repair difficult. The rapid technology advances of the day, coupled with powerful commercial pressures, clearly had a lot to do with the event, and this paper looks at some of these important issues, with the benefit of hindsight but also with strong opinions forged over time. 9-18 Regarding the best way forward it is important to identify all integrity-related threats, some of which may be discerned as at a secondary level, albeit with the potential to give similar disastrous results if not taken fully into account. The majority of these are materials performance and corrosion related. The latter is an important point, and the paper takes a critical view of the changes that have been instigated since Piper Alpha, not so much from the large structural engineering angle, but more from the viewpoint of these second tier issues, which usually arise within lower profile design parameters, for example pressure (leak) containment, corrosion analysis, erosion, wear and tear, inspection, monitoring, pigging, and maintenance, etc. Thus it is not hard to see that once the Piper Alpha was converted to its hub status, it became more important to continue producing and as a result the inspection, maintenance and corrosion control aspects became of lesser importance. After the disaster it became apparent that the Piper suffered serious corrosion problems, particularly regarding the condensate pumping systems, which were in fact later determined to be at the heart of the problem on that fateful day. Essentially the condensate pumps were under much delayed repair and maintenance schedules. On the day the work was underway but incompleted, thus the supervisor prepared a permit to work (ptw) for the work to be continued by the next shift. The pump was temporarily blanked off, and the paperwork submitted. Unfortunately the ptw got mislaid and the next shift erroneously switched on the pump since the backup was offline, the blind flange failed and a massive leak of gas under high pressure was released. A detonation was inevitable, thereafter the fire fighting systems failed, other platforms continued to feed into the hub and the disaster as we know it unfolded.12

3

Figure 1: Piper Alpha before Accident - Courtesy Wood Group.11

Figure 2: Piper Alpha explosion–adapted.12,13 After the accident, due to the media frenzy of the day, the causes were variously reported over the first year as: metal fatigue, poor maintenance, inadequate operating procedures, bad work practices, human error, etc. The full report is a public document, and much educational material, videos/DVDs etc. are readily available for the interested reader. 12,13,17 Essentially in the context of this paper the Cullen report, and other studies have highlighted many reasons for the disaster, the most damning of which were: •

Poor plant design, (including with regard to rapid modifications and changes)

•

Breakdown of the permit to work system (ptw probably not fully tested under all scenarios)

•

Bad maintenance management

•

Inadequate safety auditing, and training procedures

•

Poor communications (all levels)

•

Poor emergency management (including with regard to action of surrounding platforms)

The Cullen report3 made over 106 recommendations, which included in summary: •

The transfer of government responsibility for offshore health and safety to the Health and Safety Executive (HSE) was generally received well. (Note: The public observed this as government taking some responsibility, too.)

•

The establishment of a Safety Case regime (entailing independent verification).

•

Overall review of legislation, definition of best practices, and better use of loss prevention studies.

•

Better work force involvement (crucial but sensitive).

•

Verification and intervention when necessary.

•

Permit-to-work systems (ideally fail safe and tamper proof).

•

Systematic approach to safety, responsibility of everyone (senior management and down the line).

4

•

Emergency response and incident reporting (effectively by training and changes in attitude and culture).

It has to be said that most of the activities listed above still fall in the grey area of judgment, and in that case best practices must therefore be interpreted and applied through the identification of safety critical systems and components, proactive risk analysis, risk reduction, and therefore risk management.15 There are many other important derivations from the Cullen report, but without unnecessarily going outside the scope of this paper, it is quite clear that management of change (MOC) is and will continue to be the best tool available in the ever-improving area of knowledge management.16,19,20-28 The electronic age of software and modeling analyses has made documentation preparation and transfer so much easier that we are only limited by our ability to assimilate and interpret the information across multidiscipline areas.29,621 This is where core personnel competencies come into play. For a better, safer, and more efficient work force and management, suitably trained and educated offshore engineers and scientists must be provided by our educational institutes. To that effect first-rate universities across the North American, European, and Australian regions in particular are churning out scores of postgraduates annually in the key disciplines of materials, corrosion and integrity engineering.22,38,39,42 As these people pick up practical experience and supplement the traditional engineering and sciences, this can only be a boon to the integrity management discipline, and therefore better engineering practices for the offshore and energy industries generally.24-71The concept of better work force involvement is a sensitive issue since it is still commonly expressed by workers in the field that an over exuberance with offshore safety at the metaphorical ‘coal face’ can lead to the ‘not required back’ (NRB) factor, which still has a tempering effect on employee involvement.10,63 Industry Changes The many ensuing industry changes identified since the disaster have, in fact, taken many years to come to fruition. Overall most offshore regions, in particular the North Sea, GOM, and Australia have embraced the new culture of safety. Although there is sometimes a dangerous disconnect between theory and the actual practice of implementation. The rest of the world (ROW) has responded in a slower manner, but with positive results, especially the SE Asia regions and offshore India. The very heartening implementation of best practices (by choice, not necessarily regulation) has given greater confidence for the new, challenging deepwater explorations and subsea tie backs in the GOM and the new frontier Arctic regions. 9,16The most notable changes again in the context of this paper are interpreted as follows: •

Changes to offshore asset design, requirements for design review, more latitude for concept creativity, better rationale for engineering conservatism and pragmatic safety.

•

New goal-setting legislation, i.e. the Safety Case, and better use of Subject Matter Experts (SME’s).

•

The goal setting idea replaces the prescriptive method. This has proved to be a step change in offshore safety and engineering performance.

For the important GOM region it has been stated that the regulations conferred by the governing MMS are ‘fit for purpose.’ This suggests the designs are suitable at construction, but the gradual drift of this meaning has evolved to ‘life-cycle fitness for purpose’ and this appears to be adopted and embraced by the more recent generation of engineers (typically 5-10 years experience) as they enter the fray. The subtle debate now ongoing is at the material selection stage. There are two schools of thought, namely the distinction being made, whether to select carbon steel and then carefully manage the operational corrosion, or to select the corrosion resistant alloy (CRA) option with minimal corrosion management. The contrary arguments are usually cost-center based, with strong opinions tested for CAPEX and OPEX scenarios. In other words, do we pick materials for immediate fitness for service at fabrication (‘just build it’) or fitness for materials life cycle performance? The answer is now emerging as a requirement for both, and to that effect the materials engineering specialist is having an ever-more assertive role to play within the large multidiscipline teams usually engaged on high capital projects.9,28,33 Implementation The implementation of the Cullen report recommendations has, it is believed, shown through various studies that reportable incidents that impact safety issues in the UK sector have been significantly reduced by some 75%; a major achievement. 10,21,23 This clearly means the industry is on the right track, but there are still problems and issues. It is argued that more attention should and must be made to the secondary tier items such as root cause corrosion mechanisms, advanced monitoring and inspection techniques, etc. This aspect is best illustrated by an adaption of the ‘Swiss Cheese’ effect 2,12 as shown in Figure 3. It is to this effect that this paper is targeted, with the intent that by paying more focused attention to these parameters and findings that the integrity management discipline will be more substantively improved. The Cullen report also identified two areas of under emphasis that may be appropriately reasoned, firstly the industry tendency to avoid the acceptance of external consultants’ advice if the recommendations are not supported by more experienced personnel, often even if the consultation seems logical and safety sensible. The case of the central riser argument for the Piper Alpha is cited; here evidently the dangerous proximity of the risers to the control and radio room areas was, in fact, identified, but no action taken (design change, relocation, blast walling, etc). Nowadays virtually all new designs insist on the risers being as far away as possible from the accomodations. The second point of observation is the concept of addressing root cause effects. The Piper Alpha condensate pump problems that initiated the whole tragic sequence of events were plagued with corrosion

5

problems the attendance to which was seemingly consistently delayed as lower priority. Apparently some platform corrosion issues were left for over four years. 28 If corrosion management as a recognized discipline had been in place, rather than an ad hoc to-do item, then again, with the benefit of hindsight, the tragedy could have been avoided. That, unfortunately, is how the learning and knowledge management process works. And it has to be said that companies today often have very valuable lessons-learned meetings after major projects are concluded. There is a strong case, and new initiatives, underway for such formal lesson learnings on an ongoing basis. 21,27,49,50

 

‘SWISS CHEESE ANALOGY’ AKA:  Jigsaw effect, Chain of events,  Perfect Storm, Murphy’s  law, etc.   Hazards Align and Losses Accumulate Erosion, Cavitation, wear

Localized Pitting

New Mechanism(s) LME, CUI, 8,10,12 etc

etc

P.T.W

Hazards

1

Management Snafu, Adverse Project Decisions

Losses

Uniform Corrosion, Poor Inspection data, etc

4

3 2

Materials Performance, Fracture, Embrittlement, SCC, etc,

Structural Integrity, Mechanical Strength, Loss of Properties, Weld defects, etc

Operations, Steady State, Out of Envelope, Excursions, Transients, Ergonomics, Human Error, etc

Figure 3 The ‘Swiss Cheese’ Analogy as applied to materials engineering The use of modern-day corrosion risk assessment techniques are under development and application. It is hoped that ultimately these will be implemented by the weight of motivation, though in reality some degree of mandatory regulation may be ultimately required.28,55 These and other related points of view are made in the paper, hopefully to reinforce some of the many lessons learnt over the past 20 years or so. In almost all major comparable disaster cases the commonality has been the confluence of many variables coming into a tragic alignment, sometimes referred as the jigsaw or ‘swiss cheese’ effect. It is argued in this paper that in almost all cases the loss of materials performance as stimulated by corrosion is the root cause effect. A close examination of the modes of failure reveals the uncanny role of corrosion dissolution at either the macro or micro level (whether it be by alloy, embrittlement, crevice corrosion, mixed metal galvanic, etc) the outcome is the same: severe loss of material properties and/or load carrying capabilities.14,23 The resolution of the corrosion aspect will, therefore, in virtually all cases eliminate the closure of the jigsaw effect, thereby preventing the failure. On a positive note, the concepts of knowledge management, advanced inspection techniques, implementation of MOC, and the more newly defined roles and responsibilities for pertinent decision makers, etc., have all been very instrumental in making this industry safer and better equipped to tackle the challenges faced ahead. It is strongly argued that one new recommendation that would be instrumental in helping improve this aspect an order of magnitude would be the ‘mandatory’ requirement for each asset to submit a clear annual corrosion integrity statement on the facility, and pertinent (safety critical parts) thereof.28 The burden for doing this is not high, but the results would be extremely positive. Threats to Asset Integrity It is very important for society to progress positively and look at lessons learnt in all disciplines from time to time. However, in the engineering field the need is most pressing. The world is changing fast, with unprecedented population growth, and competition for sustaining resources such as water, food, and energy. The oil and gas industry is pivotal to such growth, and must, therefore, take note of demand for production, and demands for best safe, efficient, and environmentally friendly solutions. The structures, pipelines, pressure plant, and parts thereof must be designed and operated at optimum conditions, whilst retaining mechanical integrity over the life cycle. One of the greatest threats to any asset integrity is the degradation of the asset with respect to time, i.e. the design life or, more appropriately, the life cycle. In that context the most dominant degradation phenomena per se is corrosion. And in that regard there are many mechanisms of corrosion, all of which come into play at varying levels of intensity. The early work by Fontana et al14 suggested eight clearly defined corrosion mechanisms, though more recent work is pointing to more than ten. 18,21,28,42 For the upstream oil and gas industry, it is common to delineate these into the major damage threats, whereupon many studies (Canadian/Russian in particular ) over the past 10 years or so have shown that internal corrosion is the dominant cause of failure, typically by over 50% in practice.42,49 Whether the corrosion failure is on pipeline, riser or topsides equipment there is in practice nearly always a precedent, thus working applied design life solutions can normally be formulated. At the same time it is however, important to continue with fundamental or near fundamental research to help understand failure mechanisms better so more permanent solutions can be implemented as time marches on. The concept and consolidation of the corrosion and erosion JIP`s have helped to bridge the

6

link between industry and academia, with valuable results. 38,39 The trick however, is to ensure that the results are interpreted and applied by skilled and experienced personnel, preferably staffers who are very cognizant of the JIP data being generated, and have had a role in the development of the laboratory and field testing programs. As an example the threat breakdown for risers, though quite similar, will have particular nuances to be taken account of, such as the translation of horizontal pipeline flow regimes to vertical regimes with a potentially high-risk corrosion activity at the base transition. Similarly, topsides pressure equipment will be safety critical, and perhaps warranting greater latitude on the monitoring side, such as area U/T mapping and thermal imaging in the high-risk underside (six o`clock positions). There should also be a greater emphasis on the external corrosion aspect, especially at supports whereupon several major failures have been observed due to crevice corrosion being accelerated where wet marine air has condensed out high chloride pockets in susceptible areas.15,18,19 This is a significant problem in the GOM where warm temperatures (>21°C) and regional humidity levels are routinely > 80%, pretty much year round. On the plus side there are many fit-for-purpose solutions, such as the use of inert I-Rod type inserts, which if used correctly can virtually eliminate crevicing geometries.19,28 The use of TSA coatings is also a very viable solution for all topsides equipment external and internal surfaces. This is a reflection of onshore technologies being carefully transferable to offshore applications, provided subject matter expertise is wisely used and safety is not impaired.28,33 The Aftermath Post Piper Alpha, studies (late 80s and 90s) revealed the important need for corrosion management. That concept was likely first coined by researchers at UMIST when that group realized that corrosion control really defaulted to corrosion management as the discipline was a fine balance of integrity and finance management.22 Thereafter, the term seemed to be broadened to cover for monitoring, chemicals, pigging and inspection, thus leading to the term inspection management. It was, however, very important to include the pressure vessel and piping community and it is believed that lobby led to the evolution of mechanical integrity management. And in time, mid to late 90s the terminology seemed to reach a consensus at integrity management (IM). In terms of proportion, IM is still effectively a corrosion management exercise and that was argued in early pioneering studies by Prodger et al54, leading to the conclusion that IM was effectively 80% corrosion related, covering all assets (marine/offshore/industry). The concept of a corrosion management strategy (CMS) has therefore evolved, this supplies the high-level approach to IM, and is usually a system FEED-type study, quickly converting to a tactical (nuts and bolts detail) type corrosion control manual, which forms the basis of the life cycle IM plan. The plan is a live, ongoing document modified or revised as new data or findings become apparent and usually encompass detailed, risk, reliability, inspection, intrusive probes and coupons, pigging, fluid sampling, chemical injection, and mitigation procedures, and studies. As with all good science and engineering it is vital to quantify critical parameters, and to that effect the concept of KPI, has been modified and applied to IM studies.9,27,33 Thus, the qualitative nature of risk-based judgments is honed to a more easily repeatable and consensus-based decision gate system. Some examples of recent KPI studies and their application are presented later. These must always be considered and applied and agreed on a project specific basis, with the appropriate sign-off from subject matter experts in materials, corrosion, CP/coatings, etc. Most career offshore engineers do in fact observe near misses on a regular basis, with incidents related to fire, leaks, mechanical integrity, topsides equipment, poor inspection, etc., being responded to with duly diligent team actions. However the potential for mishaps is always there, especially where corners are cut to meet production and cost issues. This ‘Achilles heel’ will always be there but hopefully minimized as leadership and the industry progress. ALARP, Corrosion Hazard, and Inherently Safe Design The commonly accepted approach to safety assurance or ALARP is now to ensure on the basis of suitable and sufficient evidence that risk is as low as reasonably practicable (ALARP). The concept of ALARP is often interwoven into the risk analysis and/or safety management from the very beginning 9,16,28,33 Corrosion must be considered a functional hazard for this approach to be applicable. Figure 4 below depicts the ALARP triangle with the processes and descriptions for each segment. Further, since there is a lack of code guidance per internal corrosion, one way forward is to use the concept of ALARP to define the limitations or boundaries of the corrosion parameter, and therefore aid (technical and legal) argument defensibility. Since Inherently Safe Design (ISD) is often perceived as a costly CAPEX discipline, there is a forceful argument that suggests that by strongly utilizing ISD in the Integrity Management basis ( typically by best materials selection, geometries, chemicals etc.) then coupled with concurrent changes, revisions, MOC’s etc in the same vein, a truly best practices regime can be set up. The cost factors are easily justified by reduced OPEX costs over the life cycle. However the ‘pay now or pay more’ later theory has never fully made the grade, and in reality it usually takes an event like the Piper Alpha or Carlsbad (USA) before significant paradigm shifts in attitudes are made, even then only with the force of regulation. Alternatively the JIP’s might be seen as the conduit for best technology advancement and best knowledge interpretation and management in this regard. Once concurrent design and ISD move closer towards amalgamation then the case for concurrent and inherently safe design (CISD) may become a university taught and thus industry practiced discipline. There are actually more than 10 recognized mechanisms of corrosion, viz: 1) uniform corrosion, 2) pitting, 3) crevice, 4) erosion (including impingement / cavitation), 5) galvanic, 6) selective leaching, 7) intergranular, 8) fretting/wear, 9) stress

7

corrosion cracking (SCC, corrosion fatigue, hydrogen damage, embrittlement etc),10) Other creep/embrittling, etc20. For offshore and subsea conditions the critical mechanisms are a function of reservoir composition; and the most dangerous threats are therefore CO2 (sweet) corrosion, H2S (sour corrosion and cracking), bottom of line (BOL), top of line (TOL), and microbially influenced corrosion (MIC). Once at the tactical stage it is found that corrosion under multiphase hydrocarbon flows presents the most challenging and integrity-threatening condition. This problem area has plagued the industry for many decades, so much so that there are many studies looking at these issues across the world at universities and industrial research centers. In the USA the challenge is being met by the continued growth of two major JIPs, at Ohio University under the auspices of Nesic et al38, and at Tulsa University under the guidance of Rybicki et al.39 Both JIPs effectively tackle and model corrosion and erosion and MIC modes of failure through an exhaustive combination of theoretical modeling, empirical testing, and field trials. This work seems to be leading the way globally and in the absence of bone fide codes of practice and standards, the JIPs are commonly used as a reference point. The recommendations coming out of the JIPs are membership supported (largely operator companies and key consultants, engineering companies, etc), and thus their findings have received solid acceptance industry wide. The balance of academia and industry ensures that the decision-making process is not skewed by overriding commercialism. Ultimately these will tend to be perceived as the industry standards, filling the void that has long been present. The results are applicable to all assets (TLP, MODU, spar, fixed, subsea, topsides, etc.) provided the appropriate expertise is deployed to allow for the subtle differences across assets and systems, in other words, from both sides of the aisle: from the operator and the engineering contractor.9,55,57

ALARP RISK TRIANGLE As applied to Corrosion Assessment

INSIGNIFICANT RISKCorrosion Events Negligible

TOLERABLE RISK REGION Corrosion Manageable Risk reduction benefits practicable Consequences acceptable

UNACCEPTABLE RISK –CONSEQUENCES TOO BAD Material/Corrosion failures not Acceptable Justifiable only in very exceptional cases

Figure 4: The ALARP triangle depicting the importance of corrosion risk assessment in the risk management and loss prevention exercise. Having the right blend of multidisciplined engineers is key to success if multi-facetted failure mechanisms and root causes are to be properly addressed. CORROSION MECHANISMS PER UPSTREAM AND SUBSEA Uniform corrosion

Well addressed via theory, and viable monitoring.

Pitting corrosion

Modeling difficult but R&D done, relevance high risk*

Crevice corrosion

Relevant modeling used, relevance medium risk

Galvanic corrosion

Modeling hard (danger ‘mesa’ scale related attack), medium risk

Stress corrosion

Empirical/experience, medium risk and reliability in practice

Erosion corrosion

Modeling used-relevance high risk*

Corrosion fatigue

Interpretative used-relevance high risk

MIC

Very subjective, separate JIPs underway at Ohio/Tulsa Univ. – risk high*

CO2 Sweet corrosion

Modeling underway used-relevance very high*

H2S Corrosion

Modeling underway used-relevance high

Top of line Corrosion

Now better quantified- Modeling part of separate JIP studies at Ohio University.

8

Note 1: Perceptions asterisked (*) are best given as ‘localized,’ encompassing multiple mechanisms. Also all highrisk phenomena can be mitigated down to low risk with diligent, motivated, surveillance and corrosion management procedures provided they are, in fact, fully implemented. Note 2: The assessment of risk can be qualitative, or semi quantitative. The high-, medium-, and low-risk (HML) nomenclature has been adopted for simplicity and consistency. HML must always be assigned by materials/corrosion specialists and, where possible, have justifiable and defensible arguments as support. Note 3:The use of industry accepted HML risk designations and simplified go/hold/no go (green, amber,red) traffic signal type decision gates is a really good evolution in the design and operational integrity management process. As with all engineering projects, commercial aspects, project viability, return on investment (ROI), schedule, etc. are pivotal to project success. The net effect is that in many, if not most, cases the project remit becomes ‘design to build’ rather than the preferred ‘design for the life cycle’. This often adversarial development is, on the one hand, good in that it stimulates solid, provocative discussion, and thus best workable fit for purpose solutions can be attained, however if materials engineers are not strong enough to debate their corner hard and strong, weaknesses in design leading to failures down the road can be expected. The only real question being, where, and when, rather than if, as a result the competitive forces at work, namely the need for revenue as against best available safe technology (BAST), is often a battle of being’smart to out smart’ as identified as the Achilles heel in the IM process. 15,28 This is reflected in the weak argument often used that the design complies with the regulations. That alone is not enough, it may be a minimum requirement, but life cycle fitness for purpose is really about managing all mechanical and corrosion related degradation mechanisms, including: stress overload, embrittlement and loss of material properties, and natural wear and tear i.e. dissolution of the metal under aggressive environments. New Build Versus Old Build Most new engineering applications (green field) invariably involve a design code or recommended practice as a reference point. These are usually industry-accepted guidance documents that have been developed over many years, been through many cycles of peer review, and tested via experience, case history etc. Reference to established codes gives the design and end client credence and confidence in its workability. One example of that may be pipeline cathodic protection and coatings, whereupon code compliance (DNV, ISO, NACE, etc.) is a good yardstick for successful external corrosion control. Unfortunately, that is not the case for internal corrosion, largely because the mechanisms of corrosion are complex and often multi-faceted. 62,64-67,69 It has therefore been necessary to develop methods of resolution, the most popular being that of corrosion modeling. The most common threat to pipeline integrity has been mixed CO2 or sweet corrosion. In reality even with the large amount of corrosion work done over several decades, absolute values of corrosion rate still cannot be reliably predicted without reservation using any of the 15 or so models available.49-55-67 All the models can really do is give a general guidance as to the corrosivity of the media involved. Thus it can be construed that the main objective of corrosion modeling or corrosion assessment has evolved to differentiating (at build) whether or not the carbon steel will be acceptable as the main flowline material, or, if not, weather the analysis justifies the use of CRAs as the design basis. The impact of this decision can be crucial since the CAPEX/OPEX ratio is greatly affected and will often make or break the project. Thus, the vital need for the corrosion predictions to be pragmatic and done to the best possible reliability. In practice the greatest criticisms of the modeling approach have been the non–agreement of calculated corrosion rates to the observed field values. For deepwater applications whether subsea at >4000 feet, at the steel catenary risers (SCR), or on the host facility (e.g. TLP/SPAR/MODU etc.), there is little room for error, since repairs or retrofit can be very costly or practically impossible. Nevertheless the deepwater campaigns continue and it is up to engineering companies to offer justifiable but realistic solutions and where proven data or correlations are not available, reasonable risk based ALARP driven decisions are considered justifiable. The same arguments apply for old build (brown field), whereupon existing assets often badly corroded need to be assessed for remaining life and ongoing corrosion. This can be a challenge as critical parameters such as existing pre-corrosion condition and/or existing inspection data are not always readily available. Nevertheless predictive modeling does serve a useful purpose in this regard, provided the caveats are defined, understood and accepted by the client.64-67 Rules, Regulations and Inherently Safe Design Ultimately the integration of ISD into mainstream engineering practice will almost certainly happen, though as alluded to earlier the combined efforts of academia and regulatory authorities will be the most likely catalyst. Whilst external sea water corrosion control is regulatory driven, the case for internal corrosion is only heavily implied though not specifically regulatory or code compliance driven, however that will probably change and regulations in most regions will likely refer to best practice modeling or corrosion analyses to ensure that corrosion integrity is accounted for within the integrity management process. 9 That change was expected to be imminent and may still happen within the Federal Rules though there is a powerful lobby against the changes such that the rule change approval may be delayed. 11-33 The onus is, therefore, on diligent designers to ensure that best safe technologies and techniques are utilized to understand and predict corrosion mechanisms and corrosion rates, such that failures can be eliminated or arrested to tolerable values. As far as the GOM region is concerned a mixture of prescriptive and performance related criteria are applicable. In particular the MMS potential incidents of non-compliance (PINC`s) may be interpreted as a corner stone boundary condition for predictive corrosion

9

control to help focus the designer’s attention and attitude towards safety. 27,52 Similarly the MMS Federal Register may be used to support the requirement for diligent corrosion assessment and management thereof. 28,32 It is recommended that these be used on a case-by-case basis, though specific differences (usually more onerous may be relevant if North Sea rules and the safety case are applied). In practice, for carbon steels that means the development of a pragmatic corrosion allowance. It has been found that the best way to do this in a convincing and reasonable manner is to utilize interpretation of the relevant and available rules and codes of practice, suitable modeling calculations, industry experience and best judgment. The US federal regulations have stirred debate in the US, and there are some criticisms as well as positives. Overall, the industry seems to have embraced the impending rules.16,24,32 The main advancement is likely to be a greater specificity regarding internal corrosion, perhaps more akin to the UK goal setting requirements. The modeling we do should anticipate that and hopefully these guidelines presented will provide a framework for that. The rules are US-specific but should serve as a template for defensible corrosion prediction, which is all the more important in an ever-more litigatious society.55,58 As alluded to previously there are many models available, (likely>15) e.g. Norsok M506, Cassandra 93/95, ECE, Hydrocorr, Lipucor, Multicorp v4 (Ohio JIP), OLGA® (corrosion module inclusive), Predict/Socrates, Tulsa SPPS (Tulsa JIP), ULL model and others, and whilst most have individual strengths and weaknesses, the common critique is invariably unreliable correlation to the laboratory and more importantly field experience.55,67 As a rule almost all have little proven consistency of confidence to field observed corrosion rates. This is mainly due to the fact that the designs attend essentially only to the base CO2 corrosion case, and exclude a truly meaningful localized component, though some claim, and more and more are trying to include, this and other influencing parameters. The problem seems to be that the localized component is rarely addressed in a transparent manner, with no reference to localized criteria or parameters such as crevice/deposit size, stagnation fluid chemistry, crevice pH, differential aeration, etc. Nevertheless, the use of a suitable modeling or JIP study would no doubt be accepted as a supporting reference to the regulations. Generally most models have a ‘black box’ critical analysis, though the JIPs appear to be more transparent at least to the member companies. The research is still closely guarded though it has evolved to be more pragmatic and project risk-orientated (deterministic/theoretical). It is expected to have solid calibration capabilities with ultimately, a flow assurance-linked corrosion modeling package seemingly viable, perhaps, by individual member companies (e.g. via greenfield/brownfield ‘what if scenario’ brainstorming). The latter is difficult but would have the greatest impact if it could wrap up flow assurance, corrosion, and safety inextricably to production and, therefore, revenue. This is a controversial argument but one that would help eliminate the pressures on project managers, offshore installation managers (OIM), and other decision makers to continue with producing, often under fault conditions. That was seen to be quite possibly the ultimate snafu in offshore history, when adjoining platforms continued to fuel the fires on the hapless Piper Alpha.2,8,9,11 OFFSHORE CORROSION FAILURE CASE HISTORIES Even post Piper Alpha there have been many integrity and corrosion-related failures, and some of the more important types are presented for illustrative purposes only. It is clear that most are solvable by better using existing knowledge and widely available techniques, including more recently, existing modeling predictive techniques, such as those offered by the JIPs, many of which are now expanding beyond the closely knit operators to the engineering design houses and consulting groups. This should be of much advantage to the industry as a whole by infusing an alternative layer of checks and balances to drive the research for better understandings and ergo better solutions. A number of case histories depicted below illustrate the role of corrosion in the integrity management process. The first is, perhaps, the US equivalent of Piper Alpha, in that it led to strident major changes in regulatory requirements via the DOT.6,24 The remaining examples are chosen to represent the types of failure most commonly witnessed; there are many others available in the literature and industry project files. 17,18,42

10

Ref NTSB Report PAR 03/01

Case History # 1 Top plate shows the macro image aftermath of the Carlsbad, NM, pipeline failure, in Aug 2000. The size of the crater is self evident, and tragically 12 outdoor campers were deceased. The root cause was determined to be a combined corrosion mechanism dominated by chloride/CO2/microbial activity as exemplified in the micro image below. The corrosion was concentrated at girth and seam welds at the BOL position, with 72% wall loss noted, adapted.5

Weldment MOST DAMAGE DOWNSTREAM

flow

Acid clean scales

Case History # 2 Depicting failed manifold on a fixed platform due to isolated erosion defect of the steel upstream of an inhibitor injection point. Age 10 years, no on-line monitoring, produced water system sensitive to poor protective filming, adapted.18 g

p

Dimpling at leading edge of erosive wear front

Major flow excursions Note-clean zero corrosion products. Differentiate~Erosion/Impingement/Cavitation

11

Case History #3 Catastrophic failure of choke sleeve on offshore facility. Failure mechanism analysed to be combined erosion/cavitation and impingement. Impinging cavitation forces can far exceed the proof stresses of most alloys adapted.18

Mesa-Interface

Case History #4 Sweet (CO2) corrosion is probably the most insidious type of localized corrosion observed in pipelines and topsides pipework. The many worldwide applied R&D projects are geared around this dangerous mechanism. Adapted. 18

LHS: Over Active Anode

TSA Coating: Accelerated Attack

Case History #5 LHS: Over-active deep-sea anodes, possibly due to inadequate alloy chemistry, and/or high quantity presence of uncoated steel or local CRA components. RHS: Similarly excessive flaking of TSA coating accelerated by uncoated steel or possibly CRAs in the immediate vicinity. Both thought to be within one year, observed at first ROV inspection.19 Case Histories Footnote It is quite common for a precedent to be found in most failure case examples, so that industry-wide cross asset lessons learned are a powerful tool. However not all case histories are reported (company confidential), and so analysts often end up re-inventing the wheel in terms of solutions, although every now and then a unique new mechanism or mode of failure is unveiled.44 The most challenging corrosion failures are seen to be instigated during transient or excursionary physical or chemical conditions, often at start up, commissioning or unplanned shutdowns. The corrosion defect propagation is often during steady state operations, but must usually be addressed at initiation if corrosion control is to be effective. That invariably requires very close monitoring, recording and analysis of critical PTV data as well as close scrutiny and time periodicity of inhibitor dosing losses etc. That is more viable now with the new generation of multiphase flow meters out on the market. As a rule, loss of corrosion inhibitor for more than approximately two to three days in a row is not tolerable, and a total of 18 days per annum is the equivalent to a 95% availability factor. The assured performance of corrosion inhibitors under cocktailed (mixed with flow assurance chemicals) is a vital requirement in many solution options.28,65,69

12

HIERARCHY AND RULES Once the main corrosion threats are identified, it is usual to formulate a CMS plan of action. The hierarchy or order of such events is best expressed as follows: CMS > Inspection > Corrosion Monitoring > Pigging > Mitigation/Control Once the sequence has been applied on a component-by-component or segment-by-segment basis, an appropriate written continued-fitness-for-purpose statement should be made, on a three or six month basis at first year for new facility depending on production water cut realized in practice and thereafter on an annual basis, with ‘sign off’ by appropriate technical authorities. It is considered that within the modern offshore industry, the major corrosion-related threats are: •

Sweet/sour (CO2/H2S) corrosion (under close attention of JIPs)

•

Under deposit corrosion (particulates or sand)

•

Dead leg corrosion ( mini or maxi stagnation fluid sites)

•

Sand erosion high-velocity impacts at bends, tees etc., but also at straights

•

Microbial episodic biofilms in particular

•

TOL corrosion, mainly per gas lines

•

Loss of passivity at the CRA surfaces must be assessed for all (i.e. oil and gas lines)

All the above threats should be quantifiable with diligent integrated on-line corrosion monitoring (coupons/probes/fluid analyses/ultrasonic (U/T) etc). The target corrosion rate for steel should be set at 0.05 to 0.1mm/y and all chemical, PTV adjustments focused around that threshold number. As guidance deviations to 0.15 mm/y may be tolerated for short periods (