20 Years On Lessons Learned From Piper Alpha. The Evolution of Concurrent and Inherently Safe Design

Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
Contents lists available at ScienceDirect
Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp
20 Years on lessons learned from Piper Alpha. The evolution of concurrent and inherently safe design
Binder Singh a, *, Paul Jukes a, Ben Poblete a, b, Bob Wittkower a
a b
IONIK1 ConsultingeJP Kenny Inc., 15115 Park Row, 3rd Floor, Houston, TX 77084, USA Cameron, Houston, TX, USA
a r t i c l e i n f o
Article history: Received 28 May 2010 Received in revised form 15 July 2010 Accepted 30 July 2010 Keywords: Integrity management Safety Corrosion ALARP Key performance indicators Lessons learned
a b s t r a c t
It has now been well over 20 years since the North Sea Piper Alpha disaster in 1988. There have been many lessons learned; some documented others just etched in memory. The event chronicled many signicant changes in the offshore industry. The emanating point for most sweeping changes has been the Cullen Report and the UK North Sea industry. This paper reviews some of the critical lessons and identies many secondary ner points that constitute important learnings. The paper looks at major changes instigated by step changes in safety criticality. It is argued that the second tier modes of failure such as corrosion, materials degradation, environmental cracking, erosion, plant ergonomics, etc. need to be better examined. These mechanisms are dangerous threats to the integrity of deep subsea assets, and it is noted that such root causes of failure as witnessed or predicted have yet to be fully appraised. The authors use wide experiences and case histories to highlight such concerns, offering rational t-forpurpose solutions. The industry disconnections between, urgency to build, knowledge transfer, and management of change, are refocused. Powerful advances in risk-based mechanical, process, materials, and corrosion engineering are emphasized and the use of key performance indicators (KPIs) are reasoned for best life-cycle integrity. To keep up with the pace of growth in the deepwater sector, methods of concurrent and inherently safe design have evolved in a world where the practicalities and costs of modication, repair and retrot are extremely difcult. Hence getting it right at the outset is paramount. Thus the drive for purposeful investment, at design is more justiable, than the traditional practice of postponing costs (and problems) to operations. In this way the ominous gray zone between the two cost centers is better bridged for reasons of safety and commercial advantage. 2010 Elsevier Ltd. All rights reserved.
1. Introduction After the recent 20th anniversary of the Piper Alpha offshore disaster a paper was prepared and delivered to the OTC conference in Houston Texas, in May 2009 and a upon invitation the exercise was repeated for the Offshore Brazil conference in Macae, Brazil in June 2009. This paper is based on an adaptation of the OTC paper (Singh, Jukes, Wittkower, & Poblete, 2009). On the 6th of July 1988, the worlds worst offshore oil industry disaster occurred on the Piper Alpha platform in the UK sector of the North Sea. The loss of life was staggering: 167 dead, with 62 survivors, and dozens badly injured. Much has been written and debated on the incident. This paper examines a new angle on the
* Corresponding author. Tel.: 1 281 675 1020. E-mail address: binder.singh@wgim.com (B. Singh). 1 IONIK now rebranded to: Wood Group Integrity Management. 0950-4230/$ e see front matter 2010 Elsevier Ltd. All rights reserved. doi:10.1016/j.jlp.2010.07.011
subject matter, in the context of inherently safe design, and the allied second tier items of interest. These are the corrosion-related items that have been accepted as pertinent over the years, but often erroneously perceived with less priority. This is largely because the subject matter is considered too specialistic, or complex and often requiring costly subject matter expertise. As a result, corrosion integrity is sometimes dangerously taken off the agenda by nonsubject-appreciative project or even industry leaders. This paper delves into this contentious area, examines the role of corrosion mechanisms in the root cause analyses of most signicant failures and virtually all loss of performance issues. The interpretations are made with the support of solid observations and new understandings in the direct context of integrity and corrosion management. The authors come from a mixed blend of offshore disciplines, with over 80 years of combined experience, predominantly from the North Sea and Gulf of Mexico. The objectives are aimed to be educational and not controversial, but the opinions are strong, and considered very worthy of continued debate and development.
B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
937
Fig. 1. Piper Alpha before accident e Courtesy Wood Group (Wood Group HSE Matters, 2008).
The Piper Alpha accident was a monumental event, see Figs. 1 and 2. It is, perhaps, in terms of impact a top-ve engineering disaster on the global scale, considered to be in the same league as Chernobyl, Challenger, Three Mile Island, Flixborough, etc. (BP Booklet, 2004; Kletz, 1998; Lees, 1980; Lord Cullen Report, 1990; Neal, 2007; NTSB). And in many ways it is historically comparable to other high-impact human events such as the Kennedy assassination, New York 9/11, London 7/7, and Mumbai 11/27, in that people (certainly in the British Isles and the North Sea community) often remember where they were on the day. In that way the Piper Alpha seems to have uniqueness about it, which may be due to the fact that it was offshore and involved a heavily manned producing platform. The major differential has, with the benet of hindsight, been that the disaster was de facto man made, though not a deliberate act in any way, but human and engineering errors were seen to hideously come into play. Many studies have looked at that aspect, the center piece of most if not all being the ensuing public inquiry and the Cullen Report which was published in 1990 (Lord Cullen Report, 1990). This was the culmination of a thorough two year inquiry involving many interviews with survivors, families, and subject-matter experts of the day, with many others on the outside offering immediate opinions on the many public affairs programs of the day, as seems to be the norm under such events. It was also commonly noted for truck loads of documents being delivered to the courthouses of London and Aberdeen, and that was a reection of the non-electronic transfer of documentation, as might be
expected in todays computer driven age. The Cullen report has tended to be the main stay reference source for all new offshore design and operational guidelines the world over. Some regions have used the ndings rigorously whereas others have used them less in depth. Overall the report led to the effective dissolution of the prescriptive regulations sanctioned up to that point, and replaced same with the evolution of the goal-setting integrity regulations in the UK and with derivatives thereof. On the plus side the major outcome of the disaster has been far better, safer, and more efcient engineering practices for the oil industry. And indirectly has supported strongly the need for inherently safe designs and procedures. These have been realized by better, more focused research, better applied knowledge management, and a greater sense of public and industry responsibility by the new generation of engineers and scientists. Many more offshore, subsea and integrity-related courses have evolved worldwide, largely at postgraduate level, much to the advantage and betterment of the industry. This has been promulgated by the better realization by professionals in the industry that designing to build the asset, structure, pipeline, and pressure plant can no longer be based on projected revenues alone. Yes, the ultimate decision maker or breaker can and often is the commercial sensibility, but a greater sense of responsibility to the public, and the environment, has fallen into place. This is largely regulatory driven, but one can still discern a good dose of professionalism, merit and worthiness in the arena. 1.1. Root causes Regarding the accident there was, perhaps, no single root cause event that was to blame. Rather, it was a conuence of many critical factors that were almost the perfect storm often described as the jigsaw or Swiss Cheese effect, whereupon critical events occurring at a certain juncture in time, and as a consequence the failure jigsaw fell into place, with tragic results. In reality integrity management (IM) is far more complex than maintenance (a common misnomer), the parameters affecting IM are non-linear and inuential during IM pre-planning, post planning, action and reaction, etc., and indeed the alignment of bad sequences, events or circumstances are invariably all time dependent and thus multi-dimensional in nature. This has traditionally made IM a difcult subject to grasp, especially since it transcends both the capital expenditure (CAPEX) and operating expenditure (OPEX) cost centers. The Piper Alpha was commissioned in 1976, but was modied to act as a major gas processing and gathering hub. This meant it was handling large amounts of high-pressure gas, with a dispersed plant layout, making inspection, maintenance and repair difcult. The rapid technology advances of the day, coupled with powerful commercial pressures, clearly had a lot to do with the event, and this paper looks at some of these important issues, with the benet of hindsight but also with strong opinions forged over time (BBC web pages; Coastal Training Technology Corporation, 2007; Fontana, 1984; JP Kenny, 2005e2008, 2008; Private Correspondences with Messrs Ben Poblete (LR/Cameron), 2000e2008; Singh, Britton, & Flannery, 2003; Singh, Britton, Poblete, & Smith, 2005; Singh, Folk, Jukes, Garcia, & Perich, 2006; Wood Group HSE Matters, 2008). Regarding the best way forward it is important to identify all integrity-related threats, some of which may be discerned as at a secondary level, albeit with the potential to give similar disastrous results if not taken fully into account. The majority of these are materials performance and corrosion related. The latter is an important point, and the paper takes a critical view of the changes that have been instigated since Piper Alpha, not so much from the large structural engineering angle, but more from the viewpoint of these second tier issues, which usually arise within lower prole
Fig. 2. Piper Alpha explosion e adapted (Coastal Training Technology Corporation, 2007; BBC web pages).
938
design parameters, for example pressure (leak) containment, corrosion analysis, erosion, wear and tear, inspection, monitoring, pigging, and maintenance, etc. Due to the media frenzy of the day, the causes were variously reported over the rst year as: metal fatigue, poor maintenance, inadequate operating procedures, bad work practices, human error, etc. The full report is a public document, and much educational material, video s/DVDs, etc. are readily available for the interested reader (BBC web pages; Coastal Training Technology Corporation, 2007; JP Kenny, 2005e2008). Essentially in the context of this paper the Cullen report, and other studies have highlighted many reasons for the disaster, the most damning of which were: Poor plant design (including with regard to modications and changes) Breakdown of the permit-to-work system Bad maintenance management Inadequate safety auditing, and training procedures Poor communications (all levels) Poor emergency management (including with regard to surrounding platforms) The Cullen report (Lord Cullen Report, 1990) made over 106 recommendations, which included in summary: The transfer of government responsibility for offshore health and safety to the Health and Safety Executive (HSE) was generally received well. (Note: the public observed this as government taking some responsibility, too.) The establishment of a Safety Case regime (This was to entail independent verication). Overall review of legislation, denition of best practices, and better use of loss prevention studies. Better work force involvement (crucial but sensitive). Verication and intervention when necessary. Permit-to-work systems (ideally fail safe and tamper proof). Systematic approach to safety, responsibility of everyone (senior management and down the line). Emergency response and incident reporting (effectively by training and changes in attitude and culture). It has to be said that most of the activities listed above still fall in the grey area of judgment, and in that case best practices must therefore be interpreted and applied through the identication of safety-critical systems and components, proactive risk analysis, risk reduction, and therefore risk management (Singh et al., 2005). There are many other important derivations from the Cullen report, but without unnecessarily going outside the scope of this paper, it is quite clear that management of change (MOC) is and will continue to be the best tool available in the ever-improving area of knowledge management (Deepwater Corrosion Services Inc, 2008; DOT Regulations; JP Kenny, 2008; JPKenny/University of Houston, 2008; JPKeIonik, 2005e2008; Mueller, 2006; SCOTA/UKOOA, 1995; Singh, 2007; Singh et al., 2007; UK HSE, 2001; UMIST/University of Manchester Corrosion Center, 1983e1995). The electronic age of software and modeling analyses has made documentation preparation and transfer so much easier that we are only limited by our ability to assimilate and interpret the information across multidiscipline areas (API 14E RP; Ramachandra, 2007). This is where core personnel competencies come into play. For a better, safer, and more efcient work force and management, suitably trained and educated offshore engineers and scientists must be provided by our educational institutes. To that effect rst-rate universities across the North American, European, and Australian regions in particular are churning out scores of postgraduates annually in the key disciplines of
materials, corrosion and integrity engineering (Ohio University, 2007; UMIST/University of Manchester Corrosion Center, 1983e1995; University of Tulsa, 2007; WGIM Internal Training Modules, 2000e2008). As these people pick up practical experience and supplement the traditional engineering and sciences, this can only be a boon to the integrity management discipline, and therefore better engineering practices for the offshore and energy industries generally. The concept of better work force involvement is a sensitive issue since it is still commonly expressed by workers in the eld that an over exuberance with offshore safety at the metaphorical coal face can lead to the not required back (NRB) factor, which still has a tempering effect on employee involvement (Hibbert, 2008; Private Correspondences with Messrs Ben Poblete (LR/Cameron), 2000e2008). 1.2. Industry changes The many ensuing industry changes identied since the disaster have, in fact, taken many years to come to fruition. Overall most offshore regions, in particular the North Sea, Gulf of Mexico (GOM), and Australia have embraced the new culture of safety. Although there is sometimes a dangerous disconnect between theory and the actual practice of implementation. The rest of the world (ROW) has responded in a slower manner, but with positive results, especially the SE Asia regions and offshore India. The very heartening implementation of best practices (by choice, not necessarily regulation) has given greater condence for the new, challenging deepwater explorations and subsea tie backs in the GOM and the new frontier Arctic regions (JP Kenny, 2008; Singh et al., 2006). The most notable changes again in the context of this paper are interpreted as follows: Changes to offshore asset design, requirements for design review, more latitude for concept creativity, better rationale for engineering conservatism and pragmatic safety. New goal-setting legislation, i.e. the Safety Case. The goal-setting idea replaces the prescriptive method. This has proved to be a step change in offshore safety and engineering performance. For the important GOM region it has been stated that the regulations conferred by the governing Mineral Management Services (MMS) are t-for-purpose. This suggests the designs are suitable at construction, but the gradual drift of this meaning has evolved to life-cycle tness-for-purpose and this appears to be adopted and embraced by the more recent generation of engineers (typically 5e10 years experience) as they enter the fray. The subtle debate now ongoing is at the material selection stage. There are two schools of thought, namely the distinction being made, whether to select carbon steel and then carefully manage the operational corrosion, or to select the corrosion-resistant alloy (CRA) option with minimal corrosion management. The contrary arguments are usually cost-center based, with strong opinions tested for CAPEX and OPEX scenarios. In other words, do we pick materials for immediate tness for service at fabrication (just build it) or tness for materials life-cycle performance? The answer is now emerging as a requirement for both, and to that effect the materials engineering specialist is having an ever-more assertive role to play within the large multidiscipline teams usually engaged on high capital projects (JPKeIonik, 2005e2008; Singh et al., 2006; Singh & Krishnathasan, 2008). 1.3. Implementation The implementation of the Cullen report recommendations has, it is believed, shown through various studies that reportable
939
incidents that impact safety issues in the UK sector have been signicantly reduced by some 75%; a major achievement (Private Correspondences with Messrs Ben Poblete (LR/Cameron), 2000e2008; SCOTA/UKOOA, 1995; UK HSE, 2001). This clearly means the industry is on the right track, but there are still problems and issues. It is argued that more attention should and must be made to the secondary tier items such as root cause corrosion mechanisms, advanced monitoring and inspection techniques, etc. This aspect is best illustrated by an adaption of the Swiss Cheese effect as shown in Fig. 3. It is to this effect that this paper is targeted, with the intent that by paying more focused attention to these parameters and ndings that the integrity management discipline will be more substantively improved. The Cullen report also identied two areas of under emphasis that may be appropriately reasoned, rstly the industry tendency to avoid the acceptance of external consultants advice if the recommendations are not supported by more experienced personnel, often even if the consultation seems logical and safety sensible. The case of the central riser argument for the Piper Alpha is cited; here evidently the dangerous proximity of the risers to the control and radio room areas was, in fact, identied, but no action taken (design change, relocation, blast walling, etc.). Nowadays virtually all new designs insist on the risers being on the outside perimeter of the offshore asset. The second point of observation is the concept of addressing root cause effects. The Piper Alpha condensate pump problems that initiated the whole tragic sequence of events were plagued with corrosion problems the attendance to which was seemingly consistently delayed as lower priority. Apparently some platform corrosion issues were left for over four years (JPKeIonik, 2005e2008). If corrosion management as a recognized discipline had been in place, rather than an ad hoc to-do item, then again, with the benet of hindsight, the tragedy could have been avoided. That, unfortunately, is how the learning and knowledge management process works. And it has to be said that companies today often have very valuable lessons-learned meetings after major projects are concluded. There is a strong case, and new initiatives, underway for such formal lesson learnings on an ongoing basis (BP Report, 2004; JPKenny/Ionik; SCOTA/UKOOA, 1995; Singh, 2007). The use of modern-day corrosion risk assessment techniques are under development and application. It is hoped that ultimately these will be implemented by the weight of motivation, though in reality some degree of mandatory regulation may be ultimately required (IONIK JIP, 2008; JPKeIonik, 2005e2008).
These and other related points of view are made in the paper, hopefully to reinforce some of the many lessons learned over the past 20 years or so. In almost all major comparable disaster cases the commonality has been the conuence of many variables coming into a tragic alignment, sometimes referred as the jigsaw or Swiss Cheese effect. It is argued in this paper that in almost all cases the loss of materials performance as stimulated by corrosion is the root cause effect. A close examination of the modes of failure reveals the uncanny role of corrosion dissolution at either the macro or micro level (whether it be by alloy, embrittlement, crevice corrosion, mixed metal galvanic, etc.) the outcome is the same: severe loss of material properties and/or load carrying capabilities (Fontana, 1984; UK HSE, 2001). The resolution of the corrosion aspect will, therefore, in virtually all cases eliminate the closure of the jigsaw effect, thereby preventing the failure. On a positive note, the concepts of knowledge management, advanced inspection techniques, implementation of MOC, and the more newly dened roles and responsibilities for pertinent decision makers, etc., have all been very instrumental in making this industry safer and better equipped to tackle the challenges faced ahead. It is strongly argued that one new recommendation that would be instrumental in helping improve this aspect an order of magnitude would be the mandatory requirement for each asset to submit a clear annual corrosion integrity statement on the facility, and pertinent (safety-critical parts) thereof (JPKeIonik, 2005e2008). The burden for doing this is not high, but the results would be extremely positive. 1.4. Threats to asset integrity It is very important for society to progress positively and look at lessons learned in all disciplines from time to time. However, in the engineering eld the need is most pressing. The world is changing fast, with unprecedented population growth, and competition for sustaining resources such as water, food, and energy. The oil and gas industry is pivotal to such growth, and must, therefore, take note of demand for production, and demands for best safe, efcient, and environmentally friendly solutions. The structures, pipelines, pressure plant, and parts thereof must be designed and operated at optimum conditions, whilst retaining mechanical integrity over the life cycle. One of the greatest threats to any asset integrity is the degradation of the asset with respect to time, i.e. the design life or, more appropriately, the life cycle. In that context the most dominant degradation phenomena per se is corrosion. And in that regard
Fig. 3. The Swiss Cheese Analogy as applied to materials engineering.
940
there are many mechanisms of corrosion, all of which come into play at varying levels of intensity. The early work by Fontana et al. (Fontana, 1984) suggested eight clearly dened corrosion mechanisms, though more recent work is pointing to more than ten (JPKeIonik, 2005e2008; SCOTA/UKOOA, 1995; Singh et al., 2003; WGIM Internal Training Modules, 2000e2008). For the upstream oil and gas industry, it is common to delineate these into the major damage threats, whereupon many studies (Canadian/Russian in particular) over the past 10 years or so have shown that internal corrosion is the dominant cause of failure, typically by over 50% in practice (JPKenny/Ionik; WGIM Internal Training Modules, 2000e2008). Whether the corrosion failure is on pipeline, riser or topsides equipment there is in practice nearly always a precedent, thus working applied design life solutions can normally be formulated. At the same time it is however, important to continue with fundamental or near fundamental research to help understand failure mechanisms better so more permanent solutions can be implemented as time marches on. The concept and consolidation of the corrosion and erosion JIPs have helped to bridge the link between industry and academia, with valuable results (Ohio University, 2007; University of Tulsa, 2007). The trick however, is to ensure that the results are interpreted and applied by skilled and experienced personnel, preferably staffers who are very cognizant of the JIP data being generated, and have had a role in the development of the laboratory and eld testing programs. As an example the threat breakdown for risers, though quite similar, will have particular nuances to be taken account of, such as the translation of horizontal pipeline ow regimes to vertical regimes with a potentially high-risk corrosion activity at the base transition. Similarly, topsides pressure equipment will be safety critical, and perhaps warranting greater latitude on the monitoring side, such as area ultrasonic testing (UT) mapping and thermal imaging in the highrisk underside (six oclock positions). There should also be a greater emphasis on the external corrosion aspect, especially at supports whereupon several major failures have been observed due to crevice corrosion being accelerated where wet marine air has condensed out high chloride pockets in susceptible areas (Deepwater Corrosion Services Inc, 2008; Singh et al., 2003, 2005). This is a signicant problem in the GOM where warm temperatures (>21 C) and regional humidity levels are routinely >80%, pretty much year round. On the plus side there are many t-for-purpose solutions, such as the use of inert I-Rod type inserts, which if used correctly can virtually eliminate crevicing geometries (Deepwater Corrosion Services Inc, 2008; JPKeIonik, 2005e2008). The use of thermal spray aluminum (TSA) coatings is also a very viable solution for all topsides equipment external and internal surfaces. This is a reection of onshore technologies being carefully transferable to offshore applications, provided subject-matter expertise is wisely used and safety is not impaired (JPKeIonik, 2005e2008; Singh & Krishnathasan, 2008). 1.5. The aftermath Post Piper Alpha, studies (late 80s and 90s) revealed the important need for corrosion management. That concept was likely rst coined by researchers at UMIST/Manchester when that group realized that corrosion control really defaulted to corrosion management as the discipline was a ne balance of integrity and nance management (UMIST/University of Manchester Corrosion Center, 1983e1995). Thereafter, the term seemed to be broadened to cover for monitoring, chemicals, pigging and inspection, thus leading to the term inspection management. It was, however, very important to include the pressure vessel and piping community
and it is believed that lobby led to the evolution of mechanical integrity management. In time, mid-late 90s the terminology seemed to reach a consensus at integrity management (IM). In terms of proportion, IM is still effectively a corrosion management exercise and that was argued in early pioneering studies by Prodger et al. (Prodger, 1997)., leading to the conclusion that IM was effectively 80% corrosion related, covering all assets (marine/ offshore/industry). The concept of a corrosion management strategy (CMS) has therefore evolved, this supplies the high-level approach to IM, and is usually a system FEED-type study, quickly converting to a tactical (nuts and bolts detail) type corrosion control manual, which forms the basis of the life-cycle IM plan. The plan is a live, ongoing document modied or revised as new data or ndings become apparent and usually encompass detailed, risk, reliability, inspection, intrusive probes and coupons, pigging, uid sampling, chemical injection, and mitigation procedures, and studies. As with all good science and engineering it is vital to quantify critical parameters, and to that effect the concept of key performance indicator (KPI), has been modied and applied to IM studies (Singh, 2007; Singh et al., 2006; Singh & Krishnathasan, 2008). Thus, the qualitative nature of risk-based judgments is honed to a more easily repeatable and consensus-based decision gate system. Some examples of recent KPI studies and their application are presented later. These must always be considered and applied and agreed on a project-specic basis, with the appropriate sign-off from subject-matter experts in materials, corrosion, CP/coatings, etc. Most career offshore engineers do in fact observe near misses on a regular basis, with incidents related to re, leaks, mechanical integrity, topsides equipment, poor inspection, etc., being responded to with duly diligent team actions. However the potential for mishaps is always there, especially where corners are cut to meet production and cost issues. This Achilles heel will always be there but hopefully minimized as leadership and the industry progress. 1.6. ALARP, corrosion hazard, and inherently safe design The commonly accepted approach to safety assurance or ALARP is now to ensure on the basis of suitable and sufcient evidence that risk is as low as reasonably practicable (ALARP). The concept of ALARP is often interwoven into the risk analysis and/or safety management from the very beginning (JP Kenny, 2008; JPKeIonik, 2005e2008; Singh et al., 2006; Singh & Krishnathasan, 2008) Corrosion must be considered a functional hazard for this approach to be applicable. Fig. 4 depicts the ALARP triangle with the processes and descriptions for each segment. Further, since there is a lack of code guidance per internal corrosion, one way forward is to use the concept of ALARP to dene the limitations or boundaries of the corrosion parameter, and therefore aid (technical and legal) argument defensibility. Since inherently safe design (ISD) is often perceived as a costly CAPEX discipline, there is a forceful argument that suggests that by strongly utilizing ISD in the Integrity Management basis (typically by best materials selection, geometries, chemicals, etc.) then coupled with concurrent changes, revisions, MOCs, etc. in the same vein, a truly best practices regime can be set up. The cost factors are easily justied by reduced OPEX costs over the life cycle. However the pay now or pay more later theory has never fully made the grade, and in reality it usually takes an event like the Piper Alpha or Carlsbad (New Mexico, USA) before signicant paradigm shifts in attitudes are made, even then only with the force of regulation. Alternatively the Joint Industry Projects (JIP) might be seen as the conduit for best technology advancement and best knowledge interpretation and management in this regard. Once concurrent design and ISD
941
2. Corrosion mechanisms per upstream and subsea

Uniform corrosion Pitting corrosion Crevice corrosion Galvanic corrosion Stress corrosion Erosion corrosion Corrosion fatigue MIC CO2 corrosion H2S corrosion TOL Well addressed via theory, monitoring good-viable Modeling difcult but R&D done, relevance high risk* Relevant modeling used, relevance medium risk Modeling hard (danger mesa scale related attack), medium risk Empirical/experience, medium risk and reliability in practice Modeling used-relevance high risk* Interpretative used-relevance high risk Very subjective, separate JIPs underway at Ohio/Tulsa Univ. e risk high* Modeling underway used-relevance very high* Modeling underway used-relevance high Now better quantied e as part of separate JIP study at Ohio University.
Fig. 4. The ALARP triangle depicting the importance of corrosion risk assessment in the risk management and loss prevention exercise. Having the right blend of multidisciplined engineers is key to success if multi-facetted failure mechanisms and root causes are to be properly addressed.
Note 1: perceptions asterisked (*) are best given as localized, encompassing multiple mechanisms. Also all high-risk phenomena can be mitigated down to low risk with diligent, motivated, surveillance and corrosion management procedures provided they are, in fact, fully implemented. Note 2: the assessment of risk can be qualitative, or semi quantitative. The high-, medium-, and low-risk (HML) nomenclature has been adopted for simplicity and consistency. HML must always be assigned by materials/corrosion specialists and, where possible, have justiable and defensible arguments as support. Note 3: the use of industry-accepted HML risk designations and simplied go/hold/ no go (green, amber, red) trafc signal type decision gates is a really good evolution in the design and operational integrity management process.
move closer towards amalgamation then the case for concurrent and inherently safe design (CISD) may become a university taught and thus industry practiced discipline. There are actually more than 10 recognized mechanisms of corrosion, viz: 1) uniform corrosion, 2) pitting, 3) crevice, 4) erosion (including impingement/cavitation), 5) galvanic, 6) selective leaching, 7) intergranular, 8) fretting/wear, 9) stress corrosion cracking (SCC), corrosion fatigue, hydrogen damage, embrittlement, etc., 10) Other creep/embrittling, etc. (JPKenny/ University of Houston, 2008). For offshore and subsea conditions the critical mechanisms are a function of reservoir composition; and the most dangerous threats are therefore CO2 (sweet) corrosion, H2S (sour corrosion and cracking), bottom of line (BOL), top of line (TOL), and microbially inuenced corrosion (MIC). Once at the tactical stage it is found that corrosion under multiphase hydrocarbon ows presents the most challenging and integrity-threatening condition. This problem area has plagued the industry for many decades. In the USA the challenge is being met by the continued growth of two major JIPs, at Ohio University under the auspices of Nesic et al. (Ohio University, 2007), and at Tulsa University under the guidance of Rybicki et al. (University of Tulsa, 2007). Both JIPs effectively tackle and model corrosion and erosion and MIC modes of failure through an exhaustive combination of theoretical modeling, empirical testing, and eld trials. This work seems to be leading the way globally and in the absence of bone de codes of practice and standards, the JIPs are commonly used as a reference point. The recommendations coming out of the JIPs are membership supported (largely operator companies and key consultants, engineering companies, etc.), and thus their ndings have received solid acceptance industry wide. The balance of academia and industry ensures that the decision-making process is not skewed by overriding commercialism. Ultimately these will tend to be perceived as the industry standards, lling the void that has long been present. The results are applicable to all assets tension leg platform (TLP), mobile drilling unit (MODU), spar, xed, subsea, topsides, etc. provided the appropriate expertise is deployed to allow for the subtle differences across assets and systems, in other words, from both sides of the aisle: from the operator and the engineering contractor (IONIK JIP, 2008; Jukes, Singh, Garcia, & Delille; Singh et al., 2006).
As with all engineering projects, commercial aspects, project viability, return on investment (ROI), schedule, etc. are pivotal to project success. The net effect is that in many, if not most, cases the project remit becomes design to build rather than the preferred design for the life cycle. This often adversarial development is, on the one hand, good in that it stimulates solid, provocative discussion, and thus best workable t-for-purpose solutions can be attained, however if materials engineers are not strong enough to debate their corner hard and strong, weaknesses in design leading to failures down the road can be expected. The only real question being, where, and when, rather than if, as a result the competitive forces at work, namely the need for revenue as against best safe technology (BAST), is often a battle of being smart to out smart often identied as the Achilles heel in the IM process (JPKeIonik, 2005e2008; Singh et al., 2005). This is reected in the weak argument often used that the design complies with the regulations. That alone is not enough, it may be a minimum requirement, but life-cycle tness-for-purpose is really about managing all mechanical and corrosion-related degradation mechanisms, including: stress overload, embrittlement and loss of material properties, and natural wear and tear i.e. dissolution of the metal under aggressive environments.
2.1. New build versus old build Most new engineering applications (green eld) invariably involve a design code or recommended practice as a reference point. These are usually industry-accepted guidance documents that have been developed over many years, been through many cycles of peer review, and tested via experience, case history, etc. Reference to established codes gives the design and end client credence and condence in its workability. One example of that is pipeline cathodic protection (CP) and coatings, whereupon code compliance (Det Norsk Veritas (DNV), International Standards Organization (ISO), NACE International e The Corrosion Society.) is a good yardstick for successful external corrosion control. Unfortunately, that is not the case for internal corrosion, largely because the mechanisms of corrosion are complex and often multifaceted (Jepson & Research Workers, 1999e2002; Marsh, 2007; Nyborg, 2002; Nyborg &
942
Dugstad, 2007; Ramachandra, 2007; Singh, Krishnathasan, & Ahmed, 2008). It has therefore been necessary to develop methods of resolution, the most popular being that of corrosion modeling. The most common threat to pipeline integrity has been mixed CO2 or sweet corrosion. In reality even with the large amount of corrosion work done over several decades, absolute values of corrosion rate still cannot be reliably predicted without reservation using any of the 15 or so models available (IONIK JIP, 2008; JPKenny/Ionik; Nyborg, 2002). All the models can really do is give a general guidance as to the corrosivity of the media involved. Thus it can be construed that the main objective of corrosion modeling or corrosion assessment has evolved to differentiating (at build) whether or not the carbon steel will be acceptable as the main owline material, or, if not, weather the analysis justies the use of CRAs as the design basis. The impact of this decision can be crucial since the CAPEX/OPEX ratio is greatly affected and will often make or break the project. Thus, the vital need for the corrosion predictions to be pragmatic and done to the best possible reliability. In practice the greatest criticisms of the modeling approach have been the noneagreement of calculated corrosion rates to the observed eld values. For deepwater applications whether subsea at >4000 ft, at the steel catenary risers (SCR), or on the host facility (e.g. TLP/SPAR/MODU, etc.), there is little room for error, since repairs or retrot can be very costly or practically impossible. Nevertheless the deepwater campaigns continue and it is up to engineering companies to offer justiable but realistic solutions and where proven data or correlations are not available, reasonable risk-based ALARP driven decisions are considered justiable. The same arguments apply for old build (brown eld), whereupon existing assets often badly corroded need to be assessed for remaining life and ongoing corrosion. This can be a challenge as critical parameters such as existing pre-corrosion condition and/or existing inspection data are not always readily available. Nevertheless predictive modeling does serve a useful purpose in this regard, provided the caveats are dened, understood and accepted by the client (Jepson & Research Workers, 1999e2002; Marsh, 2007; Nyborg, 2002; Nyborg & Dugstad, 2007). 2.2. Rules, regulations and inherently safe design Ultimately the integration of ISD into mainstream engineering practice will almost certainly happen, though as alluded to earlier the combined efforts of academia and regulatory authorities will be the most likely catalyst. Whilst external sea water corrosion control is regulatory driven, the case for internal corrosion is only heavily implied though not specically regulatory or code compliance driven, however that will probably change and regulations in most regions will likely refer to best practice modeling or corrosion analyses to ensure that corrosion integrity is accounted for within the integrity management process (Singh et al., 2006). That change was expected to be imminent and may still happen within the Federal Rules though there is a powerful lobby against the changes such that the rule change approval may be delayed (Singh & Krishnathasan, 2008; Wood Group HSE Matters, 2008). The onus is, therefore, on diligent designers to ensure that best safe technologies and techniques are utilized to understand and predict corrosion mechanisms and corrosion rates, such that failures can be eliminated or arrested to tolerable values. As far as the GOM region is concerned a mixture of prescriptive and performance related criteria are applicable. In particular the Government Mineral Management Services (MMS) now slated to be the Bureau of Ocean Energy (BOE) have dened potential incidents of non-compliance (PINCs), and these may be interpreted as a corner stone boundary condition for predictive corrosion control to help focus the designers attention and attitude towards safety (Singh, 2007; US DOI-MMS, 2007). Similarly
the Federal Register may be used to support the requirement for diligent corrosion assessment and management thereof (JPKeIonik, 2005e2008; US DOI-MMS Federal Register, 2007). It is recommended that these be used on a case-by-case basis, though specic differences (usually more onerous may be relevant if North Sea rules and the Safety Case are applied). In practice, for steel that means the development of a pragmatic corrosion allowance. It has been found that the best way to do this in a convincing and reasonable manner is to utilize interpretation of the relevant and available rules and codes of practice, suitable modeling calculations, industry experience and best judgment. The US federal regulations have stirred debate in the US, and there are some criticisms as well as positives. Overall, the industry seems to have embraced the impending rules (DOT Regulations; JP Kenny, 2008; US DOI-MMS Federal Register, 2007). The main advancement is likely to be a greater specicity regarding internal corrosion, perhaps more akin to the UK goal-setting requirements. The modeling we do should anticipate that and hopefully these guidelines presented will provide a framework for that. The rules are US-specic but should serve as a template for defensible corrosion prediction, which is all the more important in an evermore litigatious society (IONIK JIP, 2008; NACE, 2007). As alluded to previously there are many models available, (likely> 15) e.g. Norsok M506, Cassandra 93/95, ECE, Hydrocorr, Lipucor, Multicorp v4 (Ohio JIP), OLGA (corrosion module inclusive), Predict/Socrates, Tulsa SPPS (Tulsa JIP), ULL model and others, and whilst most have individual strengths and weaknesses, the common critique is invariably unreliable correlation to the laboratory and more importantly eld experience (IONIK JIP, 2008; Nyborg, 2002). As a rule almost all have little proven consistency of condence to eld observed corrosion rates. This is mainly due to the fact that the designs attend essentially only to the base CO2 corrosion case, and exclude a truly meaningful localized component, though some claim, and more and more are trying to include, this and other inuencing parameters. The problem seems to be that the localized component is rarely addressed in a transparent manner, with no reference to localized criteria or parameters such as crevice/deposit size, stagnation uid chemistry, crevice pH, differential aeration, etc. Nevertheless, the use of a suitable modeling or JIP study would no doubt be accepted as a supporting reference to the regulations. Generally most models have a black box critical analysis, though the JIPs appear to be more transparent at least to the member companies. The research is still closely guarded though it has evolved to be more pragmatic and project risk-orientated (deterministic/theoretical). It is expected to have solid calibration capabilities with ultimately, a ow assurance-linked corrosion modeling package seemingly viable, perhaps, by individual member companies. The latter is difcult but would have the greatest impact if it could wrap up ow assurance, corrosion, and safety inextricably to production and, therefore, revenue. This is a controversial argument but one that would help eliminate the pressures on project managers, offshore installation managers (OIM), and other decision makers to continue with producing, often under fault conditions. That was seen to be quite possibly the ultimate snafu in offshore history, when adjoining platforms continued to fuel the res on the hapless Piper Alpha (BP Booklet, 2004; Coastal Training Technology Corporation, 2007; Lord Cullen Report, 1990; Singh et al., 2006). 3. Offshore corrosion failure case histories Even post Piper Alpha there have been many integrity and corrosion-related failures, and some of the more important types are presented for illustrative purposes only. It is clear that most are
943
solvable by better using existing knowledge and widely available techniques, including more recently, existing modeling predictive techniques, such as those offered by the JIPs, many of which are now expanding beyond the closely knit operators to the engineering design houses and consulting groups. This should be of much advantage to the industry as a whole by infusing an alternative layer of checks and balances to drive the research for better understandings and ergo better solutions. A number of examples (Case Histories # 1e5) illustrate the role of corrosion in the integrity management process. The rst is, perhaps, the rst US equivalent of Piper Alpha, in that it led to strident changes in regulatory requirements via the Dept of Transportation (DOT) (NTSB; DOT Regulations). The remaining examples are chosen to represent the types of failure most commonly witnessed; there are many others available in the literature and industry project les (JP Kenny, 2005e2008; Singh et al., 2003; WGIM Internal Training Modules, 2000e2008). 3.1. Case history # 1 Top plate aftermath of the Carlsbad, NM, pipeline failure, Aug 2000. Tragically 12 outdoor campers were deceased. Root cause determined a combined corrosion mechanism dominated by chloride/CO2/microbial as exemplied in the micro image below. Noting that the corrosion was concentrated at the girth and seam welds at the bottom position, with 72% wall loss, adapted (Kletz, 1998).
Age 10 years, no on-line monitoring, produced water system sensitive to poor protective lming, adapted (Singh et al., 2003).
3.3. Case history #3 Catastrophic failure of choke sleeve on offshore facility. Failure mechanism analysed to be combined erosion/cavitation and impingement. Impinging cavitation forces can far exceed the proof stresses of most alloys adapted (Singh et al., 2003).
3.4. Case history #4 Sweet (CO2) corrosion is probably the most insidious type of localized corrosion observed in pipelines and topsides pipework. The many worldwide applied R&D projects are geared around this dangerous mechanism. Adapted (Singh et al., 2003).
3.2. Case history # 2 Depicting failed manifold on a xed platform due to isolated erosion defect of the steel upstream of an inhibitor injection point.
944
3.5. Case history #5 The left hand side (LHS) showing over-active deep-sea anodes, possibly due to inadequate alloy chemistry, and/or high quantity presence of uncoated steel or local CRA components. The right hand side (RHS) showing excessive aking of Thermal Spray Aluminum (TSA) coating accelerated by uncoated steel or possibly CRAs in the immediate vicinity. Both thought to be within one year, observed at rst ROV inspection (Deepwater Corrosion Services Inc, 2008).
a three or six month basis at rst year for new facility depending on production water cut realized in practice and thereafter on an annual basis, with sign off by appropriate technical authorities. It is considered that within the modern offshore industry, the major corrosion-related threats are: Sweet/sour (CO2/H2S) corrosion (under close attention of JIPs) Under-deposit corrosion (particulates or sand) Dead leg corrosion (mini or maxi stagnation uid sites) Sand erosion high-velocity impacts at bends, tees, etc., but also at straights Microbial episodic biolms in particular TOL corrosion, mainly per gas lines Loss of passivity at the CRA surfaces must be assessed for all (i.e. oil and gas lines) All the above threats should be quantiable with diligent integrated on-line corrosion monitoring (coupons/probes/uid analyses/ ultrasonic (U/T), etc). The target corrosion rate for steel should be set at 0.1 mm/y and all chemical, PTV adjustments focused around that threshold number. As guidance deviations to 0.15 mm/y may be tolerated for short periods (<2 weeks) and maximum of 0.2 mm/y accepted for shorter periods (<3 days). Data beyond these frames would raise a red ag, to be immediately attended to by the chemical inhibition vendor. In contrast target corrosion rates for passivating surfaces can be <0.05 mm/y. Data beyond that should be re-examined and other methods deployed to investigate. As a result of recent dialogue between various company CAPEX and OPEX groups it seems there is a moving away from target corrosion rates, and a closer acceptance of best corrosion data within corrosion management strategies (API 1 7D). Threats perceived for passivation, must be examined via accelerated corrosion tests, using real uid samples for best representation. Risk-based matrices are often used to balance accepted risk (high-H, medium-M, low-L) against consequences and condence levels (refer to Fig. 5 as a simplied example). The pertinent interpretation and argument is that if corrosion were to be more formally recognized as a hazard risk, then the formal techniques of hazard analysis will be better applied. Thus the better use of hazards and operability (HAZOP) studies and failure modes and effects analysis (FMEA) as discussed later. 4.1. Engineering integrity, corrosion and ow aspects Essentially, the guidelines are based on second principles (applied) rather than the rst principles (fundamental) as presented in the early text. This step change is often necessary in practice to allow t-for-purpose solutions to be identied. The data can quite often then be revised as the more fundamental and experimental data and equations are veried by subsequent testing, eld extrapolations and project experience. The volume of work being done by JIPs and the oil industry majors is prodigious, and as such this review can only be an insight, though an attempt has been made to focus on relatively recent developments and practices evolving mainly over the past several years, post 2000 (Ohio University, 2007; University of Tulsa, 2007). This draws, where possible, on a variety of standards, recommended practices and technical papers as well as actual relatively recent industry experiences via projects (API 1 7D; API 14E RP; API 2RD RP; API 580, 2002; Baker, 2007; BBC web pages; BP Report, 2004; Coastal Training Technology Corporation, 2007; Dalziell, 2004; Deepwater Corrosion Services Inc, 2008; DNV, 2000, 2002; DOT Regulations; EEMUA, 2004; Fontana, 1984; JP Kenny, 2005e2008, 2008; JPKenny/Ionik; JPKenny/University of Houston, 2008; JPKeIonik, 2005e2008; Massey, 1970; Mueller, 2006;
3.6. Case histories footnote It is quite common for a precedent to be found in most failure case examples, so that industry wide cross asset lessons learned are a powerful tool. However not all case histories are reported (company condential), and so analysts often end up re-inventing the wheel in terms of solutions, although every now and then a unique new mechanism or mode of failure is unveiled (API 580, 2002). The most challenging corrosion failures are seen to be instigated during transient or excursionary physical or chemical conditions, often at start up, commissioning or unplanned shutdowns. The corrosion defect propagation is often during steady state operations, but must usually be addressed at initiation if corrosion control is to be effective. That invariably requires very close monitoring, recording and analysis of critical pressure, temperature, velocity (PTV) data as well as close scrutiny and time periodicity of inhibitor dosing losses, etc. That is more viable now with the new generation of multiphase ow meters out on the market. As a rule, loss of corrosion inhibitor for more than approximately two to three days in a row is not tolerable, and a total of 18 days per annum is the equivalent to a 95% availability factor. The guaranteed performance of corrosion inhibitors under cocktailed (mixed ow assurance chemicals) is a vital requirement in many solution options (JPKeIonik, 2005e2008; Marsh, 2007; Singh et al., 2008).
4. Hierarchy and rules Once the main corrosion threats are identied, it is usual to formulate a corrosion management strategy (CMS) plan of action. The hierarchy or order of such events is best expressed as follows: CMS > Inspection > Corrosion Monitoring > Pigging > Mitigation/ Control Once the sequence has been applied on a component-bycomponent or segment-by-segment basis, an appropriate written continued-tness-for-purpose statement should be made, on
945
Fig. 5. Showing a 5 5 risk matrix based on high-, medium-, and low-risk corrosion events. The interpreted risk of failure is usually depicted as the product of probability and consequence of the failure. Many matrices are used ranging from 3 3 to 10 10. The key is to quantify within the context of pre-agreed needs and ensure all parties understand the implications (JPKeIonik, 2005e2008; Singh & Krishnathasan, 2008).
NORSOK Standard M001, 2004; Ohio University, 2007; Poblete, Singh, & Dalzell, 2007; Private Correspondences with Messrs Ben Poblete (LR/Cameron), 2000e2008; SCOTA/UKOOA, 1995; Shreir, 1994; Singh, 2007; Singh et al., 2003, 2005; 2006, 2007; Singh & Krishnathasan, 2008; Smart, 1990; UK HSE, 2001; UK HSE/TUVNEL, 2003; UMIST/University of Manchester Corrosion Center, 1983e1995; University of Tulsa, 2007; US DOI-MMS, 2007; US DOIMMS Federal Register, 2007; Vars Operator Standardization; WGIM Internal Training Modules, 2000e2008; Wood Group HSE Matters, 2008) and as such may be used as a preliminary guidance document. Erosion corrosion is still a major threat to offshore and subsea assets, with related failures being thought to account for more than 30% of all internal degradation-related hydrocarbon releases, or loss of containment (Private Correspondences with Messrs Ben Poblete (LR/Cameron), 2000e2008; JPKeIonik, 2005e2008; SCOTA/ UKOOA, 1995). Since the mechanisms of corrosion and erosion acting together can be very intricate and multifaceted, in practice help to address corrosion and erosion issues, engineers often resort to a rst pass methodology of establishing corrosion rates and derived corrosion allowance (CA), and thereafter using an additive assessment for the erosion parameter. Useful guidance on the concept of CA can be obtained from many sources (Kletz, 1998; Lees, 1980; Lord Cullen Report, 1990; Mueller, 2006; Neal, 2007; NTSB). And if the corrosion rate can be worked out from historical data or from modeling studies (i.e. the commercially available models or the publicly available freeware such as Norsok M506 or Cassandra 93/95) then an adjudged allowance (usually consensus agreed with the client) for erosion can be made (JPKeIonik, 2005e2008). It should be remembered that the models only give general or uniform corrosion rates, and that the real value in corrosion modeling is not so much the absolute values but the trends and changes. Also using more than one model allows a cross-checking device (use any three of the freewares available e Norsok, Cassandra 93 and Cassandra 95 at minimum, and use commercial models if available). In cases of major conict or disagreement it is always recommended to use the worst-case corrosion/thinning values for best conservatism. There are many corrosion and erosion models commercially available (>15) and if access to these is available these should be explored, however, if not there are options outside that approach, since many similar software packages are often available as in-house spreadsheets or issued by certain companies for
project-specic analyses. Either way, the real value of corrosion and indeed erosion modeling is mostly in helping the decision-making process per materials selection and the differentiation between the use of carbon steel or the alternate CRAs (JP Kenny, 2008; Singh & Krishnathasan, 2008). 4.2. Guidance and caveats For carbon steel, typically for low-risk erosion rate scenarios this might be quantied at KPI values of 0.05 or 0.1 mm/y (JPKeIonik, 2005e2008). If medium or high risks of erosion are present then more advanced analyses available from independent testing or the various JIPs already in place, such as at Ohio and Tulsa universities must be performed to assess this parameter (Ohio University, 2007; University of Tulsa, 2007). In practice such values could be up to and well in excess of 10 mm/y. Therein sits the predicament for the corrosionist, namely what data to use to support ones design rationale. The subject is ever complex and such decision making often has to rely on the planned design economics and the project costs entailed capital expenditure (CAPEX) versus operating expenditure (OPEX) (Singh et al., 2005, 2006). In any event the solutions must be t for the life-cycle targeted, and typically may either use thicker steel (greater corrosion allowances) or stipulate the use of a more corrosion-resistant alloy (CRA). The latter may be solid pipe or steel pipe lined or clad with CRA, typically at 3e4 mm thickness. Less than 3 mm is not recommended due to possible mechanical wrinkling effects that would impact the integrity of the liner (JPKeIonik, 2005e2008). Table 1 shows typical best practice CRAs considered for the offshore industry. Regarding the ongoing evolution of inherently safe design it is interesting to note that even after so many years since the Piper Alpha there is still signicant project resistance to the formulation of safer designs, and better more inherently safer materials selection, even though on balance total costs and economics are favorable over the complete life cycle. 5. Inherently safe design The technical challenge from an engineering perspective is to accept that corrosion initiation often occurs under non-steady conditions whilst propagation thereof is often under steady state operation. In practice such problems at excursionary conditions,
946
Table 1 CRA localized corrosion tendencies, as risk exemplied by pitting resistance equivalent (PREN), critical crevice temperature (CCT) and critical pitting temperature (CPT), interpretation oileld only. Alloy 304 Stainless steel (SS) 316SS Alloy 825 22 Cr duplex (DSS) 25 Cr super duplex (SD) Alloy 625 PREN 19 25 33 37 47 51 CCT ( C) <0 <0 <5 20 35 57 CPT ( C) Localized corrosion risk 15 20 30 30 60 77 High risk Medium risk Mediumelow risk Mediumelow risk Low risk Low risk
emphasis on reliability, and the use of CRAs, with attention to all corrosion threats under all service or non-service conditions. ALARP and ISD e In future may likely be accepted legal terms in a court of law. Both are strict but actually enforce better dialogue, greater accountability, more lateral thinking, and ultimately promote safer life cycle, transparent, solutions. If applied diligently, they can offset CAPEX with reduced OPEX (Dalziell, 2004; JPKeIonik, 2005e2008; Singh et al., 2005). The values given are based on empirical formulae, composition, and testing and are sensitive to contact electrochemistry. The alloy elemental compositions and mechanical properties are available in suppliers literature. The order of corrosion resistance is interpreted as: Alloy 625 > SD > DSS z Alloy 825 > 316LSS > 304LSS. The values are thought to be more applicable to static conditions and not sensitive to ow, though in principle if the ow regime can alter the pitting potential then some sensitivity could be recognized. Hence in principle standard laboratory assessments should always be supported by non-standard and fully representative testing and eld observations. To that effect authoritative suggestions for nonstandard, pressureetemperatureevelocity (PTV), upset, or chemical excursion corrosion testing, within the JIP test rigs, etc., can be made. Hitherto these would be considered strictly steady state only. From a predictive erosion perspective it is important to allow for total wall thinning due to corrosion and erosion type degradation mechanisms. Generally if this calculation shows a total corrosion allowance (CA) value of CA > 10 mm then intervention via a suitably selected CRA material either as a solid material or as a lining or cladding option is often considered. Some operators put this threshold at 8 mm (or even 6 mm depending on the level of conservatism supported). Either way the nal decision is based on the economics of the project and the cost implications both at capital expenditure (CAPEX) and operating expenditure (OPEX) stages of the project. Another major factor is the length of the pipeline, generally speaking pipelines beyond 15 km length will tend to look more closely at carbon steel with highly diligent and aggressive rst-in-class chemical inhibition typically with >95% efciency and >95% availability. Internal coating options are also feasible but would likely still need parallel inhibition schemes to cover for the protection of damaged coating sites. The inhibitors in that case would need to be highly procient at addressing such sites under crevice corrosion conditions. Designers should engage the services of experienced chemical vendors in this subject matter. Where required, the most frequently used alternative CRA material choices tend to be the nickel alloys, alloy 625 and alloy 825, with the martensitic and austenitic stainless steels also commonly being used, typically 13% Cr and 316SS respectively. Most projects these days are often schedule driven, meaning that fast but detailed advice is sought through guidelines from many sources, societies (NACE, API, ISO, etc.), and the various JIPs, industrial and academic sources now available (JPKeIonik, 2005e2008; Ohio University, 2007; University of Tulsa, 2007). 6. Corrosion, ISD, integrity, and KPIs As part of any inherently safe design or study, any corrosion management strategy (CMS) used must be a fully auditable with a unied approach to retaining integrity of the production facilities, and to meet all goals for safe operation, environmental protection, owline availability, and revenue management. One proven method for that is the quantiable key performance indicator route.
can lead to conict between the codes, inaccurate prediction of erosion/corrosion, accelerated damage of chokes, bends, jumpers, and discontinuities, etc. Some of these difcult but denable trends can be addressed via interrogation of commercially available computational uid dynamic modeling (CFD) such as the various ow assurance type modeling, as well as specic operator experiences as for susceptible connecting jumpers in particular. And there are promising solution options with internal coatings/clad/liners, but care should be taken to alleviate changes in local surface polarization at undercut sites, localized eddies and temperature gradients, etc. Nevertheless the intensive use of reliable corrosion and erosion monitoring such as intrusive (probes and coupons), and non-intrusive (acoustic transducers), eld signature methods (FSM), ring pair corrosion monitoring (RPCM) spools (or equivalents), guided wave ultrasonics, wall thickness mapping, thermal imaging, etc., are proving to be very good early warning systems for high-risk components (JPKeIonik, 2005e2008). The close synergy between ow assurance and corrosion integrity is now more apparent and many companies are now quite successfully, and to signicant technical advantage amalgamating such groups (JPKeIonik, 2005e2008; Singh & Krishnathasan, 2008; Singh et al., 2008). From a mechanical integrity perspective it is very important for engineers to think carefully beyond the immediate design codes of practice, since corrosion and degradation can kick in fairly soon after start up, often with major degradation issues and problems with continued operability or tness for service. To that effect engineers should consider utilizing the principles of inherently safe design (ISD) to build in sufcient conservatism and safety (Dalziell, 2004; JP Kenny, 2008; JPKeIonik, 2005e2008; Singh, 2007). Some important denitions as part of broad ISD and integrity management programs can be described as follows: HAZARDS e Materials degradation, loss of mechanical properties or corrosion must be considered a hazard, thus better legitimizing the risk-based approach, dening: corrosion risk w probability corrosion failure consequences. By dening corrosion as a bone de hazard, in this way allows the more formal use of powerful advanced techniques such as HAZOP, FMEA (failure modes and effects analysis), FTA (fault tree analysis), ETA (event tree analysis), ISD (inherently safe design), etc. ALARP e Keeping material and corrosion failures As Low as Reasonably Practicable. This provides the defensible risk criteria basis for public and environmental concerns, subsequently reducing the critical gaming of nancial incentives to a less dominant and overriding parameter. ISD e Inherently safe design e designing such that material and corrosion failures are avoided or reduced to acceptable levels, design to ALARP can mean fail safe or safe life depending on objectives. In practice, used concurrently to save time and money usually means less moving parts, greater
947
The integrity management and (thus corrosion management i.e. CMS) document will result in a campaign-driven prioritized inspection, chemical treatment, and monitoring of safety-critical and economically critical elements within the facilities. This will be best dened at the CAPEX i.e. design stage. Some studies have previously examined these aspects, trying to take the best of Safety Case interpretations for applicability to the GOM region in particular, and many such approaches have been successfully introduced, the process is ongoing however, and, as with all advanced offshore/ subsea projects, is a continuing learning and improving process (IONIK JIP, 2008; JPKeIonik, 2005e2008). The CMS will therefore form a vehicle to ensure continued operability minimizing and controlling corrosion to acceptable levels. This can be done by using relatively simple but meaningful goal-setting targets, the key performance indicators (KPIs) (Singh, 2007; Singh et al., 2006; Singh & Krishnathasan, 2008). The focus of which is usually corrosion risk, but also other associated integrity threats within qualitative and quantitative ISD boundaries as shown below: Internal corrosion, external corrosion, corrosion under insulation (CUI), erosion; Noting that CUI can be realized as a major threat if piping/vessel insulation gets sodden e.g. via re water deluge testing. Environmental cracking e stress corrosion cracking (SCC), sulde stress cracking (SSC), hydrogen embrittlement, corrosion fatigue/vibration/fretting damage, etc.; Embrittlement phenomena (clamps, anges, premature fasteners/nuts/bolts failure due to intermetallic phases, seizing, galling, etc.); Time dependent failure effects per localized corrosion, mechanical fatigue and thermal creep, and conversely cold temperature loss of properties, toughness, etc.; Damage resulting from accidental impact or structural overload, of particular interest to live owline segments, manifolds, vessels, members, etc., linked to or carrying production uids; Damage from welding stray currents during installation and commissioning operations on/offshore; Malfunction of protective safety devices, and loss of reliability to include corrosion scale build up, overheat for critical electrical cabinets, control units, electrostatic discharges, etc.; Design, material, fabrication and construction defects, problems counteracted by specialty treatments such as ow assurance additives, corrosion, and scaling inhibitors, etc.
All inhibitors (including cocktail mixtures used) to be efcient at >95%; All inhibitors (including cocktail mixtures) to be available at 100% (minimum ideally >95%, accept >90%); Inhibitor dosing pumps to have >97% availability with redundancy as necessary; Topsides leak rates minimized e appropriate settings per offshore asset MODU, TLP, etc.; Key physical and chemical variables monitored for operational envelopes, and to be within 10% of steady state values, to eliminate corrosion driving upset conditions; Ratio ow assurance steady states/unsteady states (excursions) to be dened, and monitored. More than 18 days p.a. total red agged as corrosion stimulators and no more than three days consecutively proposed be allowed; P, T, V, water cut, CO2, H2S, chlorides, iron counts, sulde/sulfur, sulfate reducing bacteria (SRB) counts, sand levels, etc., to be dened and agreed with red ag alarms set. With regard to this for accepted clean systems consider the following rationale: Dene HML risk criteria in context of failure modes and probability, consequences thereof, and a quantied condence level. The latter is a powerful new concept, relating HML, risk levels to a condence rating, ergo a better informed inspection interval, and thus more defensible monitoring philosophies and monitoring detail. 6.2. Water chemistry and microbial KPIs Reservoir and condensing uids/waters cannot be easily controlled, however these all should remain within the design envelope, arbitrarily we can select guiding KPIs as follows: pH 5.5e6.5, in absence of data use a pessimistic pH 4.5e5; Dissolved oxygen < 20 ppb; H2S < 5 ppm; Sand < 10 ppm; Microbial activity planktonic (in-stream) < 1 colony/ml (>10 colonies/ml e red ag); Microbial activity sessile (at wall) < 10 cells/cm2 (>100 colonies/ cm2 e red ag); Total iron deposits < 1000 ppm (often arbitrary threshold, verify per chemical vendor); Organic acids prefer <100 ppm (observe excursions >200 ppm, red ag > 500 ppm); Residual inhibitors to be dened and maintained e.g. >125 ppm (or per vendor). Cleaning pig runs and sampling residues targeted at one per month minimum, or better as data dictates. Integrated pigging and corrosion monitoring to adjust inhibitor dosing rates. Intelligent pig runs to be considered every 5 years.
6.1. Primary KPIs dened (corrosion) Individual corrosion rates interpreted from the coupon and ER data are time dependent, and can be dened via corrosion loops (i.e. parts of the infrastructure or systems that are expected to yield similar corrosion activity). For example, horizontal owline segments, vertical segments (SCR), hull piping, etc., or indeed such loops may be dened to cover for a specic high-risk mechanism, such as Corrosion under Insulation (CUI) across all systems. These KPIs are guideline examples only and would be ne tuned on a case-by-case basis. Bearing that in mind we can dene the primary corrosion KPIs as follows: All corrosion rates to be <0.1 mm/y, (though this is often challenged as the threshold may be too restrictive); All CRAs to maintain passivity and exhibit corrosion rates <0.05 mm/y;
6.3. Other valuable KPIs Specic KPIs for external CP and external corrosion under insulation (CUI) usually need to be specically developed, for example the SCR/owline CP potentials (versus Ag/AgCl cell) are now reasonably well established at: 900 to 1000 mV dened as well protected <800 V dened as compliant-CP protected according to code. 800 to 850 mV dened as marginal protection >800 mV dened as out of compliance (typically observed 700 to 800 mV)
948
KPI denitions for CUI are very project specic and temperature related and are omitted herein for reasons of brevity and commercial sensitivity. 6.4. Secondary KPIs dened (reliability) KPIs pertinent to reliability are described below for owline segments, pressure systems, and critical components. Most will be data-base driven and using the TLP existing maintenance work books as benchmarks: Overall system production time availability e a commercial target (e.g. >95%); Minimum system production availability e commercial decision; Ensure 100% inventory and spares for all critical items; Maintenance free operating period e MFOP w minimum failure free operating period, repair time e compare equivalent items on similar assets Overall run time e compare equivalent items similar assets Failures rates (rotating items e.g. # failures per 100,000 h); Failures severity (HML equivalent to: dangerous, degraded, incipient); Failure severity mitigation (HML equivalent to: urgent, deferred, minor); Failures rates per type of equipment e compare equivalent items similar assets Damage rates per vibration/fretting issues e compare equivalent items similar assets. Other decisions not covered directly may be addressed as ALARP linked KPI issues.
Operating P, T, V, values and chemistry are maintained at steady state values (e.g. 10%). Excursions beyond that should be <2 days at a time unless reactive procedures (e.g. increased dosing) can be accommodated. Souring H2S levels remain negligible, <5 ppm (max 10 ppm). If in the 50e120 ppm zone the combination of H2S and CO2 may be acceptable pending testing, however it appears that beyond 120 ppm the scenarios must be closely looked at, especially if the ratio approaches or exceeds 20. Recent research has shed some interesting light on this combination and the impact on surface passivity (Hahn, 2008; Lee, 2004; Thamala, 2008). The inhibitor cocktails must work at 90e95% efciency with a high availability not to fall below 95% unless specied circumstances are agreed. The greatest threat to inhibitor performance seems to be sand erosion at highly turbulent cases and sand under-deposit corrosion within laminar ow regimes (IONIK JIP, 2008; JPKeIonik, 2005e2008). There may be other dening caveats such as design envelope constraints, and they would need to be identied by materials engineers on a project-specic basis
6.6. Monitoring tools It is recommended that the use of advanced U/T, inspection, and pigging must also be aligned to corrosion modeling predictions, as well as more appropriate methods of corrosion monitoring such as FSM or RPCM (instrumented spool techniques) (JPKeIonik, 2005e2008; WGIM Internal Training Modules, 2000e2008) MIC analyses, thermal imaging, real time radiography, guided wave, potential versus time (via platinum stud reference), best representative uid sampling, etc. (IONIK JIP, 2008; JPKeIonik, 2005e2008). Corrosion management is an ongoing discipline often required way past the available fundamental R&D; this time lag enforces risk-based solutions to progress important energy projects. To that effect the use of pre-determined risk factors for localized corrosion has been explored and recommended as an acceptable way forward, and usefully utilized, via ne tuning of project experience and JIP data as accrued. It is therefore reasoned that pragmatic, advanced engineering is key to safe and efcient operations, competitive advantage, and sustainability in solving some of the most complex technical and political challenges that are facing the industry. Such engineering must involve the development of non-standard corrosion testing (eld and laboratory) often under accelerating conditions. Clearly to quantify KPIs requires data, ideally live eld data, and to that effect there are many corrosion monitoring techniques available. The most appropriate to offshore industry are commonly described and vetted for their advantages and disadvantages as they pertain to a successful project-specic corrosion and integrity management regime (JPKeIonik, 2005e2008). Typically, the most efcient are the removable coupons, electrical resistance (ER) probes, linear polarization resistance (LPR) probes, biostuds, uid/ residue sampling, acoustic techniques, area U/T and various in situ spool mapping methods (JPKenny/Ionik; JPKeIonik, 2005e2008; SCOTA/UKOOA, 1995). Other advanced techniques such as a.c. impedance, electrochemical noise, hydrogen patch probes, etc., are available but are rarely used beyond the laboratory. Scale measurement devices with advanced monitoring and pigging are also under review (JPKeIonik, 2005e2008). 6.7. Mechanical aspects and inherent safety Materials, corrosion, and the chemistry of the environment are rarely applied without the encompassing discipline of mechanical
6.5. Predictive modeling The use of predictive corrosion modeling has been focused on the high-risk CO2/sweet corrosion areas pertinent to offshore applications. This has been the case for core predictive tool for pipeline, owline and piping corrosion integrity design. Unfortunately the agreement between actual eld practice and these predictions has tended to be poor; this is due to a number of factors, typically: Models assume uniform wastage (in reality hardly ever the case); Models do not allow for localized corrosion, though some claims are made; Models do not include other mechanisms (erosion, pitting, microbial, etc.); Outputs can be erroneous because inputs are often non representative; Key parameters such as uid shear stress at the wall are not well dened. Flow assurance aspects are not fully attended. It is reasoned that the main materials selection and corrosion assessment output or deliverable should be accepted as being the corrosion allowance, but with emphasis that this is but step one in the corrosion management exercise (JPKeIonik, 2005e2008). Nevertheless, this is the key variable that can quite literally decide the viability of a major subsea project. Therefore for a typical project we can focus on the pipeline corrosion integrity, and conrm optimum CA values for effective life-cycle operations. Invariably this will depend on the steady state design envelopes described and maintained, via compatible inhibitors diligently applied. To deliver this, it is suggested a denition of projectspecic KPIs are made, and some examples are given below:
949
engineering. To that effect it is vital for offshore teams to be multidisciplined, and typically that would require expertise in the areas of pipeline, topsides, metallurgy, corrosion, cathodic protection/ coatings, process chemists, etc. These disciplines must cohesively t into an advanced offshore pipeline project, especially if new (greeneld) designs are to be inserted into older (browneld) infrastructure. Thus strong technical leadership, and core competency are crucial to making the new challenging designs workable, and to a degree inherently safe, and to that effect qualied and experienced people are vital, with the will and motivation to engage in contentious often adversarial debate. Much of which is found to be best achieved at the interface between academia and industry via the operator-sponsored JIPs. The role of academia taking the lead in this process cannot be overemphasized as the best placed tempering organization. For deepwater assets (>3000e10,000 ft) the arguments for asset integrity become more critical since inspection, retrot, repair, etc., become extremely costly, dangerous and often impractical, thus forcing materials engineering to be highly predictive in nature. There are many parameters, most of which are interrelated, and should therefore not be considered in complete isolation. Invariably the key driver is the revenue and savings combination. If these targets cannot be met, the project may be blocked. Thus material selection, corrosion, assessment, welding, CP/coatings must be inherently safe and optimized to be cost effective. These are real engineering challenges on top of basic mechanical design to resist stress, hydrostatic collapse, ow assurance, riser systems, installation techniques, component operational performance, etc. Typically wall thicknesses have to be relatively thick, making a heavy pipe string, and thus have signicant impact on installation lay barges and existing equipment capabilities. Once in place there is little room for error, or remedial action, thus designs have to take cognizance of best workable solutions, which are often exercises in knowledge management across assets and indeed regions (Singh et al., 2006). There are a number of engineering challenges regarding the ow assurance and related scaling issues within pipelines. Hydrate formation, wax behavior, erosion, and multiphase ow (JPKeIonik, 2005e2008). These are matters that need to be addressed. Inadequate design in this area can lead to unwanted blockages, down time of pipelines, and therefore loss of valuable productivity. 6.8. Design code application and limitations There is a considerable grey area of uncertainty regarding the interface between mechanical design codes and corrosion. Often this needs to be plugged in by corrosion and integrity engineering using best risk-based judgments. There are a number of pipeline design codes, and each one is different. In the long term, uniformity in codes for pipeline design would be benecial. Stress based design is not applicable for high temperatures, and could possibly lead to excessively thick pipelines. The use of strain based design codes, and limit state based design seems more applicable for complex high temperature designs. The integration of analysis tools with design codes is a key challenge; bringing in the effects of irregular corrosion thinning complicates further. The use of JIP orientated corrosion modeling acting as de facto inherently safe promoting standards will have enormous benets in this regard (IONIK JIP, 2008; Ohio University, 2007; University of Tulsa, 2007). 6.9. Pipe-in-pipe options The new pipe-in-pipe (PIP) options (Fig. 6) rapidly are becoming the design conguration of choice for deepwater and extremely
Fig. 6. A typical pipe-in-pipe (PIP) system.
cold Arctic applications. The PIP systems allow a range of advanced and highly efcient insulation materials to be used to achieve the requisite heat transfer properties required, and assures greater degree of mechanical integrity, and is therefore an inherently safer design (JPKeIonik, 2005e2008; Jukes et al.). These systems are important components of subsea developments where untreated well uids may have to be transported large distances and wax and hydrate problems have to be effectively managed. In addition for extreme cases such as LNG transportation, pipe-in-pipe-in-pipe (PIPIP) congurations (three concentric pipes, with typically a NiFe inner pipe high nickel (36%) steels being selected for extra inherently safer/integrity characteristics (Singh et al., 2005)). However monitoring the life-cycle integrity of such systems can be a challenge but creative options are continually being looked at (McLaury, Rybicki, & Shirazi, 1997; Singh et al., 2005). 6.10. Flow assurance solutions Hydrate formation, wax behavior, erosion, and multiphase ows can be more critical design issues, especially for multiphase uids transitioning from deepwater to shallow water. The ow assurance strategy comprises a combined design and management philosophy for all of the following depending upon the uid properties and operating conditions such as: hydrate formation, wax/asphaltenes, scale, forming, emulsion, slugging, and damaging erosion/corrosion (JPKenny/University of Houston, 2008). Hydrate management: To prevent and manage hydrate formation, combination of either chemical treatment and/or thermal insulation may be used. Wax/asphaltene management: To prevent and manage parafn deposition, a combination of thermal insulation, chemical treatment and pigging may be used. A cost/benet analysis of these solutions should be conducted before nal selection of a parafn management strategy is made. Liquid slugging: Transient, dynamic analysis of the owline and risers must be conducted to evaluate the potential severity of liquid slugging. Based on this type of analysis, an appropriate strategy to control slugging can be developed. Erosion: Various types of sand and erosion monitors are available for installation within/on subsea tree and manifold piping. These devices (ER e intrusive or acoustic non-intrusive) can be used to monitor erosion and optimize well ow rates, often well above the API-recommended limits (API 14E RP). Corrosion: The recommended material solution may be the use of carbon steel owlines combined with near continuous
950
inhibitor injection or the use of corrosion-resistant alloys (CRAs). The decision is usually made via corrosion modeling prediction techniques. The main threat to integrity is wetting of the annulus insulation by breeched inner wall, and the lack of inspectability thereof. Much work is currently in progress in that regard (Jukes et al.; Singh et al., 2008). The typical strategy is best adopted early in the conceptual and planning phase of the project prior to specifying and ordering the main components of the system, such as downhole equipment, trees, owlines, control system and topsides equipment. Flow assurance strategy should also be applied during detailed system design, developing operating procedures as well as offshore production operations to maximise protability of the eld development. Based on the ow assurance analysis results, a design philosophy and functional specications can be developed for the following elements: Sizing of well tubing and completion design; Sizing of all owlines, risers and export system, including subsea manifolds; Thermal management (insulation or heating); Chemical injection, including the subsea chemical distribution, umbilical, topsides chemical delivery system; Pigging strategy (subsea or surface launching). One such solution is to make the pipeline more buoyant, to reduce the span stress. To ensure that the pipeline does not get over stressed at the touch down point with the seabed, bend restrictors can be used to limit the bending curvature. 6.11. Standardization of designs One major way forward still under development, is to generate the standardization of designs, if the developments are similar in nature (water depths, pressure, temperature, corrosivity, etc.). The main advantages from standardization are driving down costs, and reducing schedule time. If this approach can be suitably linked to ISD there would be substantial benet to the cause of CISD, The fear seems to be that over exposure to materials selection and corrosion analysis is cost prohibitive. In reality the benets to be exploited are: Common health and safety culture down the supply chain; Support in the context of inherently safer designs; Long-term supply chain relationships; Focused front end engineering design (FEED); Detail design, commonality of IM issues; Lessons learned (must be a continual process); Signicant potential for integration within CMS programs;
in a very awkward position, trying to justify non-sour materials selection, when all predictions point to a sour service development over the life cycle, albeit often in the distant future. Similar arguments and predicaments exist for advanced engineering criticality assessment (ECA), and tness for service (FFS) whereupon new aw sizing criteria need to be appraised at design and during service accordingly. The combination of ISD, concurrent design, and standardization is a powerful tooling for challenging deepwater campaigns, and if taught (included) within future engineering curricula a big step forward for the engineering community as a whole. 6.12. Materials and welding For both equipment and owlines, a critical component of successful design for high pressure/high temperature (HP/HT) is a thorough understanding of the materials and welding issues. Management of detailed materials testing and quality procedures is crucial, and the verication of drawing board detail to as received and built components is vital especially in the global market place. Also rigorous equipment specication is required, paying particular attention to material selection for components, such as seals. In addition, increased use of exotic materials, such as corrosionresistant alloys (CRAs), either solid or as liners, throughout the system offers alternative solutions, though care must be taken at interfaces, to minimize or eliminate junction galvanic effects. Loadings that must be reviewed are: Axial, Lateral Movement; Effective Axial Force; Axial and Hoop Stress; Von Mises Stress; Bending Moment; Plastic Strain, Buckling Curvature;
7. HSE perspective Following review of the MMS (future BOE) and UK HSE step changes in safety alerts, many recent insights have been identied with respect to the potential for similar causes or similarities due to incidents that have happened since the Piper Alpha disaster. This was done with a view to aid plausible corrective actions. The results pointed to two main types of actions: those related to design safety and those related to work permits and lockout/tagout. Thus, the use of meaningful corrosion and integrity management can also play a valuable role in such accident prevention. The review shows some uncanny parallels to the Piper Alpha case, such as initiating causes, with potentially similar outcomes. Prevention of these through diligent integrity management would clearly play a signicant role in prevention by design, predictive and proactive measures. There have been many recent safety alert examples, and other relevant post accident studies, over the period (2000e2008), and details are readily available in the public domain (via CBS (Baker, 2007), MMS and HSE web pages (JPKeIonik, 2005e2008)). It is more appropriate in the context of this paper, to identify the best actions derived from the alerts as exemplied below. 7.1. Actions from the alerts Compile and issue a shutdown specic isolation protocol, based on review of practices elsewhere in the company and in other worldwide afliates. The document should cover vent/isolation tagging standards and documentation required for large-scale shutdowns; Lessees and operators should repair malfunctioning equipment in lieu of using alternative methods such as opening a manual
Used properly, standardization has the ability to collate, and rationalize existing design methodologies, sift through best practices applicable to each region, and can therefore be expected to deliver signicant improvements pertaining to; cost, schedule, quality, operability, and predictability. Major program standardizations are presently being undertaken on projects in the GOM and overseas for major clients (JPKeIonik, 2005e2008; Smart, 1990; University of Tulsa, 2007). The results are attractive and promising in terms of scheduling, manpower resources, and, therefore, budgets. However when unexpected variables enter the decision-making process, such as the possibility of sour service being incurred post water injection scenarios, then difculties can prove to be hard to surmount, especially if expensive equipment has already been purchased or allocated. Under these circumstances materials and corrosion engineers can nd themselves
951

liquid dump valve when the automatic liquid dump valve fails or blind anging off a pressure relief line when a safety device ruptures. Lessees and operators shall review piping to ensure that deck drains have adequate trap mechanisms to prevent gases (corrosion leaks) from migrating through, that deck drains are not piped to a pressure line before entering a sump tank, and that piping for produced water does not tie into the piping for the wastewater from the living quarters. Lessees and operators should review are boom lines to ensure that they are designed of proper length, height, and oriented in the proper position according to prevailing winds to minimize the migration of gas back to the living quarters. Barrier and tag off for access under strict permit to work only. Supervisors must provide adequate job instructions and planning prior to the work, without jeopardizing the scope intention of the work (applies particularly to contractors/inspectors who can nd themselves under pressure to complete and go). Hazards must be identied as work proceeds, and a stop work policy in place as the job scope changes. Fire protection/deluge systems must not be compromised and as a rule be fail safe with 100% availability or redundancy. Personnel must be familiar with and utilize lockout and tagout procedures to isolate equipment and process piping during work programs. Simultaneous operations must be clearly communicated to all appropriate parties, and made fail safe, detailing all sitespecic procedures prior to work being implemented. Lessees and designated operators should be able to trace the history of ring gaskets in the eld regardless of previous ownership, and/or determine the condition of the ring gaskets prior to the performance of future operations (gasket failure and ensuing corrosion-related leaks are very common offshore). The Government requires lessees and operators to perform strict maintenance and inspections, monitor the environmental conditions, and maintain records of these activities (API 14E RP; Singh & Krishnathasan, 2008). Since a failure on a dynamic riser could pose a signicant impact to safety, the environment, and energy supply. Thus it is essential to perform
necessary actions to ensure the safety and reliability of these critical components. The national consensus standard for dynamic risers, APIRecommended Practices are currently under revision (Baker, 2007). The revised version is expected to include guidance on integrity management for dynamic risers. The MMS will consider adopting this standard into its regulations for outer continental shelf pipelines. A discussion of the ndings shows three main types of recommendations that parallel the ndings of Piper Alpha: (a) There must be an effective work permit system including the use of lockout/tagout, and (b) There must be design review that is comprehensive enough to think ahead to the probable scenarios and consequences of the design. (c) Asset holders must have a formalized culture of safety which is implemented and acted upon. Promoting life-cycle integrity and parallel safety procedures, then not acting on them should be considered a zero option (Private Correspondences with Messrs Ben Poblete (LR/Cameron), 2000e2008). Noting that a very high proportion of equipment maintenance work is corrosion, ageing or wear related, the clear evaluation is that potentially dangerous incidents continue from time to time at offshore facilities. Corrosion prevention and detection and in the larger view the use of integrity management systems are essential to proactively prevent these from occurring. In addition, safety in design is vital to building in prevention long before problems occur. The MMS potential incidents of non-compliance (PINCs) were also created to address that matter (US DOI-MMS, 2007). Finally, operating best practices of work permit systems and lockout/tagout remain a key to accident prevention generally. 8. Corrosion risk management practice In reality the current corrosion business practices for most oil and gas operations is a balance of three risk management methodologies. These methodologies are interrelated and must
Fig. 7. Schematic depicting the crucial relationships between reactive, proactive, and active corrosion analyses.
952
be balanced and reviewed on a continuous basis. The methodologies are: Reactive Corrosion Monitoring; Proactive Corrosion Monitoring; Active Corrosion Monitoring. The decision on how to manage the corrosion business risk is highly dependent on the corporate senior management policy of handling their operational or capital expenditures. It is emphasized that these methodologies are equally important during the conceptual to detailed design of an integrity management system. The inter-relations of the three methodologies are shown below in Fig. 7. The importance of understanding the root cause (s) of any corrosion issue is critical in providing pragmatic cost-effective corrosion risk management solutions. It is considered that these corrosion risk management methodologies will always be the underlying factors in the business decisions of all oil and gas operators. Management of change (MOC) of the order required for meaningful ISD will in practice always be difcult, however the volume of literature now more openly available in the industry will supply the required leverage needed. In particular operating company group standards and international associations are clearly making the case quite forcefully (International Association of Oil & Gas Producers (OGP), 2008; Vars Operator Standardization). 9. Concluding remarks The Piper Alpha review has been a work in progress, with many derived ndings, conclusions and specically KPI-based recommendations most of which are capable of being tailored to new and existing projects. The most valuable observation is the need for continued life-cycle vigilance, most likely through diligent but limited regulatory control, since the North Sea experience has shown that over regulation can impose major nancial burdens often to the detriment of the project, and sometimes to the creativity of solutions. It is concluded that by applying the principles of concurrent and inherently safe design, in tandem with best industry practices, to aggressive corrosion and erosion conditions, safer offshore assets can be achieved. By using effective and simplied designs, creative inspection, less maintenance, and less direct manpower, can help better meet the life-cycle objectives, life-cycle integrity and tness for service. Indeed if the combination of ISD, concurrent design, and standardization, is correctly deployed it can give a powerful impetus for challenging deepwater projects, and if taught within future university engineering curricula give a major leadership role for the engineering discipline and community as a whole. Setting the goals is paramount, and identifying the hazards, and designing out the problem areas, is best done by multidisciplined project groups in small step sequences. A clear advantage would be for industry to accept corrosion as a hazard thereby opening it up to more formal written schemes of corrosion integrity risk analyses. The use of commonly accepted high, medium, low, risk denitions and simplied go/hold/no go trafc signal type decision gates is a signicant evolution in the design and operational integrity management process. The methodology and KPI techniques advised require difcult changes and lateral thinking, but serious traction, and a positive paradigm shift has been noted when applied. The main advantage being that it eliminates the erroneous premise that to comply with codes and standards is all that is needed. Additionally the use of new quantiable condence grading is a powerful new concept, relating HML risk levels to a repeatable condence level, thus
inspection interval, ergo monitoring philosophies and monitoring detail. The use of continually refreshed multidisciplinary teams is paramount to enhancing creativity; the blend of experienced and newly qualied engineers can help to minimize negative often dysfunctional group think, which can be a barrier to innovative solutions (Edison, 2008; JPKeIonik, 2005e2008). Corrosion, erosion, and MIC phenomena are major areas of weakness within failure mode and effects, understanding, and control. However predictive modeling and JIP driven corrosion management programs are pushing for pragmatic solutions into the right direction. The unique JIP blend of highly motivated and qualied researchers combined with experienced oileld personnel has led to many breakthroughs in offshore and subsea corrosion integrity issues (API 2RD RP; Singh & Krishnathasan, 2008). It is therefore important for the engineering companies to stay abreast of safety-critical ndings as they are unraveled and to participate in such leading edge activities, with the offshore operators. Of the ndings to date it is recommended to act on the Piper Alpha ndings and look beyond at the secondary issues pertinent to offshore design integrity; such as materials performance, and corrosion, focusing on critical combinations such as corrosion plus erosion, microbial activity, and corrosion plus souring activity, as matters of priority. It is also expedient to examine and better quantify the relationships between excursionary or nonsteady corrosion phenomena, with the physical parameters, PTV, and to nd methods to enforce near continual chemical injection when warranted, and assure that safe inspectability is always practical. The use of an annual corrosion integrity statement by the asset operators is strongly recommended to ensure tness-for-purpose is continually maintained. And since most offshore failures are the result of multiple parameters or events precipitating to a break point, it is logical that resolution of same must involve multidisciplined engineering teams, with a strong materials engineering content. It is important for the future deepwater and arctic offshore community to look more closely at new designs and new solutions from both a materials fabrication and the materials performance basis, especially for safety-critical elements such as steel catenary risers (SCR), and pressure containment plant, and potential leak sources at interfaces. Companies must continually re-educate staff so that lessons learned are not forgotten, and be prepared to look at alternative approaches to design/operational issues even if they emanate from unconventional sources. History has shown that major step change progress is usually made after major disasters and often through non-conventional means. The new solution sets, and developments will it is believed come from a closer liaison between industry and academia as exemplied by the JIPs already in place. The powerful role of Academia whether through JIPs or self driven changes in university curricula will be instrumental in the paradigm shift required and perhaps expected. We owe it to the memory of Piper Alpha, and indeed other preventable disasters. Acknowledgements The authors acknowledge the support of WGIM, J P Kenny, MCS Kenny, Wood Group, and Cameron. Educational material from Coastal Training Technology Corporation, and case history examples from Deepwater Corrosion Services, is gratefully acknowledged. Permission of the OTC Committee in Houston to use the OTC paper as template is appreciated. Thanks are due to Miss Sonia Singh for assistance with the re-write and formatting. Finally the ndings, interpretation and opinions expressed are those of the authors, and not necessarily those of the companies.
953
References
API 1 7D. Specication for Subsea Wellhead and Christmas tree equipment. API 14E RP. Offshore piping design section 2.5, version 1991. API 2RD RP. Design of risers for oating production systems, and tension leg platforms. API 580. (May 2002). Risk based inspection (1st ed). Baker, J. A. (January 2007). Report e the BP US Reneries Independent Safety Review Panel. BBC web pages. Various articles regarding the Piper Alpha disaster. BP Booklet. (2004). Integrity management e learning from past major industrial incidents booklet 14. Sunbury, UK. BP report no. S/EPT/096/04 e erosion guidelines (rev 3). (2004). Coastal Training Technology Corporation. (2007). DVD Piper Alpha spiral to disaster. Dalziell, G. (2004). Inherently safe design. Paper # 86598. SPE. Deepwater Corrosion Services Inc. Houston, web pages www.stoprust.com. (2008/9). DNV. (Jan 2000). Offshore standard. Submarine pipeline systems OS-F 101. DNV RP 0501. (2002). Erosive wear in piping systems 1999. DOT Regulations. CFR 49 parts 192/195 per gas and liquid pipelines. Edison, E. (MayeJune 2008). The team development life cycle e a new look. Defense AT&L. EEMUA. (2004). 194 Guidelines for materials selection & corrosion control for subsea oil/gas production equipment. Fontana, M. G. (ca. 1984). Corrosion engineering. Van Wylen Press. Hahn. J. (ca 2008). Ph.D. thesis, Ohio University, Athens, OH (advance ndings). Hibbert, L. (June 2008). Averting disaster, professional engineering. IMechE Journal, 21(11). International Association of Oil & Gas Producers (OGP). (Dec 2008). Asset integrity e the key to managing major incident risks. Report #415. IONIK JIP. (Nov 2008). Business case report (77447.03), rev B. Jepson, P., & Research Workers (1999e2002). The effects of multiphase ow on sweet corrosion in oil and gas pipelines-vars early work presentations from Ohio University. JP Kenny. HSE alerts and safety notices 2005e2008. JP Kenny. (Dec. 2008). T4B series e arctic pipelines, materials, FFS, and corrosion studies. C-In-C. JPKenny/Ionik. Internal experience basis, corrosion reports, in-house spreadsheets & toolboxes. JPKenny/University of Houston. (2008/9). Pipeline engineering course modules, by AEG/IONIK. JPKeIonik. Corrosion and integrity management literature, experience basis e various projects 2005e2008. Jukes, P., Singh, B., Garcia, J., & Delille, F. Critical thermal, corrosion, & material issues related to owline pipe-in-pipe (PIP) systems. Paper # ISOPE-2008-TPC-297. Kletz, T. (1998). What went wrong e Case histories of process plant disasters (4th ed.). Butterworth Heinemann. Lee, J. (ca 2004/5). Ph.D. thesis, Ohio University, Athens, OH (research data). Lees, F. P. (1980). Loss prevention in the process industries. Butterworths. Lord Cullen Report. (1990)Public inquiry into the Piper Alpha disaster, Vols. 1 and 2. HMSO. (Reprinted 1993). Marsh, J. (2007). T.Teh, conicting views CO2 corrosion. SPE paper #109209. Massey, B. S. (1970). Mechanics of uids. Van Nostrand Reinhold Co. McLaury, B., Rybicki, E., Shirazi, S. (1997). Tulsa Univ. SPE # 38842 SPE Tech. Conf, San Antonio, TX. Mueller, R. A. (March 2006). Corrosion allowance e not always a simple concept, materials performance.
NACE. (2007). Nashville plenary lecture. Corrosion, crime, and punishment (panel session e Garrity, K., et al.). Nashville. Neal, M. (January 2007). JIMECHE Publication. The Causes of Accidents. ISSN 175118471. NORSOK Standard M001. (August 2004). Materials selection, rev 4. NTSB Carlsbad pipeline failure report # PAR 03/01. Nyborg, R. (2002). Overview CO2 corrosion models. Paper 02233. NACE. Nyborg, R. N., & Dugstad, A. (2007). TOL corrosion NACE paper #07555. NACE. Ohio University. (2007/8). Corrosion modeling JIP. Chair: professor S. Nesjic. Poblete, B. R., Singh, B., & Dalzell, G. The inherent safe design of an offshore installation. In Texas A&M process safety conference, MKOPS, 23e24 Oct 2007. Private correspondences with Messrs Ben Poblete (LR/Cameron), Graeme Dalzell (TBS3), Trevor Kletz (Author), Chris Robbins (UK HSE). (2000e2008). Prodger, M. (Dec 1997). LR private correspondences 1997e1999, & LRIM corrosion management ppt. Ramachandra, S. (2007/8). Baker Petrolite, private communications. SCOTA/UKOOA. (ca 1995). Materials and corrosion course modules, by Singh/ Bradley, Aberdeen, UK. Shreir, L. L. (1994). Corrosion control handbook (3rd ed.). Butterworth Heinemann. Singh, B. (Feb 2007). Materials selection and inherently safe design. ASM presentation, Houston. Singh, B., Britton, J. N., & Flannery, D. (2003). Offshore corrosion failure analyses: series of case histories, # 03114. NACE. Singh, B., Britton, J. N., Poblete, B. R., & Smith, G. (2005). The 3 Rs e risk, rust and reliability. Paper # 05553 NACE. Singh, B., Folk, T., Jukes, P., Garcia, J., & Perich, W. (2006). From the North Sea to the Gulf of Mexico e making the link between corrosion research and best practice. RIP # 06R206, NACE. Singh, B., Folk, T., Jukes, P., Garcia, J., Perich, W., & Van Oostendorp, D. (2007). Engineering pragmatic solutions for CO2 corrosion problems. NACE Corrosion. Singh, B., Jukes, P., Wittkower, R., & Poblete, B. R. Annual OTC, offshore integrity management e 20 years on: overview of lessons learnt post Piper Alpha. Paper # OTC 20051-PP, Houston, TX, 4e7th May 2009. Singh, B., & Krishnathasan, K. Pipeline pigging & integrity management conference: Making the link between inherently safe design, integrity management and pigging, Houston, 12e15th Feb 2008. Singh, B., Krishnathasan, K., & Ahmed, T. (Oct 2008). Predicting pipeline corrosion. Pipeline and Gas Technology Journal. Smart, J. (1990). A review of erosion corrosion in oil and gas production. In Flow induced corrosion symposium: Fundamental studies and industry experience. NACE Corrosion. Thamala, K. (ca 2008). M.S. thesis, Tulsa University (advance ndings). UK HSE. (2001). Contract research report 363/2001, best practices for risk based inspection (TWI/Sun Alliance). UK HSE/TUV-NEL. (2003). Erosion research report #115. UMIST/University of Manchester Corrosion Center (J. L. Dawson/G. E. Thompson, W. Cox, et al.). (1983e1995).. University of Tulsa. (2007/8). Erosion and corrosion JIP. Chair: professor E. Rybicki. US DOI-MMS. (Feb 2007). Offshore & pipeline regulations e PINC listings. US DOI-MMS Federal Register, Vol. 72, No. 191 Oct 3 2007/Proposed Rules 30CFR parts 250,253,254,256. Vars operator standardization documents for subsea materials 2006e2008. WGIM internal training modules. (2000e2008). A. Denny/G. Strong et al. Includes support literature from Alberta Energy & Utilities Board (Canada), Roxar (USA), Cormon (USA). Wood Group HSE Matters. Company report 2008 e article, the lessons of Piper Alpha.

20 Years On Lessons Learned From Piper Alpha. The Evolution of Concurrent and Inherently Safe Design

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

20 Years On Lessons Learned From Piper Alpha. The Evolution of Concurrent and Inherently Safe Design

Uploaded by

Copyright:

Available Formats

Journal of Loss Prevention in the Process Industries 23 (2010) 936e953

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

Fig. 3. The Swiss Cheese Analogy as applied to materials engineering.

2. Corrosion mechanisms per upstream and subsea

Fig. 6. A typical pipe-in-pipe (PIP) system.

You might also like