68.3.1 Fitness for Corrosion Service

Fitness for purpose or fitness for service (FFS) are commonly used phrases to define overall engineering performance. It seems logical to adjust the definition for corrosion concerns to something akin to fitness for corrosion service thus putting emphasis on the need to acquire the most suitable corrosion solution under the circumstances met, through the life cycle. Once the predictive risk judgments are made, the problem of convincing the asset holder (client) for a logical way forward is made easier and more formally documented; furthermore, the project controllers will find that accountability and responsibility are better served when risk allocations are made in a consistent and repeatable way.

68.3.2 Conventional and Performance-Based Corrosion Management

There are currently two types of corrosion hazard management plans that are practiced, namely, conventional- and performance-based processes. The conventional entails the authorities’ domain (governing or certifying body) to provide the prescriptive requirements that the engineering domain (owner, designer, or operator) must comply with in the design of a facility. This depends on industry-wide accidents and experience to provide data for maintaining the regulations. Compliance in this case is the response that meets a prescriptive solution, and this is the practice of many operators today. A more recent trend is a risk- or performance-based approach to encompass the following:

• Demonstrate continuous improvement.
  
• Readily gain approvals for modifications, new designs, and novel procedures.
  
• Accurately provide a successful and critical corrosion hazard identification.
  
• Provide involvement and consultation by all employees.
  
• Provide a systematic thinking and documentation of the corrosion risk.
  
• Provide a method of focusing effort proportionately on critical areas.
  
• Promote better fit with latest formal safety assessment (FSA) or safety case.

The process places the responsibility for the corrosion risk management (CRM) plan firmly on the hands of the owners. The approval or certifying authority is responsible only for the approval and monitoring of the process. The owner or lessee must address the most serious corrosion threats to the pipeline in question. For subsea oil and gas pipelines, that threat is mainly sweet CO₂ and sour H₂S corrosion along with cracking, as exemplified in Figure 68.7.

68.3.3 Corrosion Risk-Based Performance Goals

Conventional is gradually being phased out, and the performance basis is now preferred. More specifically, methods have been developed by the retrospective analysis of corrosion and failure reports particularly over the past several years and are better used in solo or conjunction with other risk-based tools. In the context of better corrosion management, risk-based performance goals are achievable in relatively short periods provided effective corrosion risk quantifiable tools are used. The corrosion risk techniques described are dynamic in that they are live and subject to continuous updating, thus the chances of responding to problems are far higher than for existing nonrisk or prescriptive approaches, which tend to be relatively static between inspections or analyses. Thus, we anticipate better control in the following areas:

• Monitoring the unit efficiency and general condition;
  
• Reduction in general and localized corrosion rates;
  
• Better knowledge transfer, reduced downtime, and increased productivity;
  
• Better understanding and reduction of failures and frequencies;
  
• Reduction in perceived and calculated risk evaluations;
  
• Resolution of conflicts between marine and petrochemical practices;
  
• Greater confidence in plant operability, revenue, and HSE concerns;
  
• Better attention to regulatory, verification, and compliance issues.

Using an overall risk ranking method will provide for more satisfactory risk-based inspection (RBI). Using overall risk rank assures that the most critical components (high consequence, higher likelihood) are easily distinguishable and are assured to be prioritized accordingly. The parts ranked as medium risk may then be prioritized in a manner that places a greater emphasis on the consequence, a judgment issue.

68.3.4 Inherent Safe Design (ISD) and Project Phases of a Production Development

Inherent safe design (ISD) is an important concept that was initiated by the Flixborough chemical plant accident in the United Kingdom (1974), whereupon a critical chain of cascading events, including unverified design changes, in tandem with weak materials compatibility under an extreme excursion following a fire were identified as the root cause. The post-Piper Alpha period in the North Sea (>1988) also augmented this and prompted the “goal setting” schemes by the government [1, 2]. It was concluded that better permit to work and independent verification procedures regarding both plant modifications and ongoing inspection would aid the elimination of such dangers. The main emphasis coming out of the inherently safe philosophy was to avoid the hazards rather than keeping them under control.

From a corrosion hazard perspective, it is imperative that we avoid the concerns early in the design of the facility (FEED) rather than trying to control or take protective measures later during operations. This means entry should be before the start of detailed engineering and certainly before the initiation of any hazard identification studies. It has been proven that this action will result in a cheaper design from a life-cycle perspective due to less intense efforts to be added later to address the corrosion hazards. If the design of a facility follows the line:

The first aim is to eliminate the corrosion hazard by substituting vulnerable alloys with more suitable materials, such as CRAs, and also considering nonmetallic materials.

As the design phases progress toward commissioning, it becomes more difficult to incorporate cost-effective corrosion control solutions, largely due to the loss of design flexibility, and cost and schedule constraints. Hence, there is a need to engage experienced corrosion risk specialists early in the design development. In practice, since most installations require the construction materials to be steel, the CRM process will likely be an important factor for the foreseeable future.

There are various levels of CRM programs, the four main ones being: compliance based, experience based, data based, model based, or indeed, a fifth option that is any combination of the aforementioned. Criteria for each can be defended on a case-by-case basis and are often driven by cost and schedule.

68.3.5 Link Between ISD and Corrosion Management

ISD and corrosion management combined reflect the ideal approach to the elimination or mitigation of corrosion hazards. The identification and understanding of the corrosion hazard mechanism is a critical aspect in the decision-making process to address this operational concern. Overall, the practical quantifiable risk-based methods are useful to promote that ideal approach.

The CRM strategies and plans are meant to be live auditable documents that are updated (feedback) during the life cycle of the facility as more experience is gained. The documents could also be used as tools to verify and communicate the corrosion hazard that may affect the facility to all affected employees. This increase in understanding by the working population usually results in a more effective and successful implementation. The CRM provides a means to step back and visualize the full multitude of corrosion concerns, per life-cycle perspective, rather than a single corrosion issue.

This approach also provides opportunities to discover benefits to overall design, rather than being singularly focused on corrosion risks, giving opportunities to significantly save on cost, weight, or schedules at start-up and during operation.

Table 68.2 illustrates an example of risk-based assessments pertaining to localized corrosion. Here, the SME would allocate risk levels based on theory and practice. An aggregate or average value can be enumerated to help utilize a correction factor rather than generalized corrosion rates as calculated from modeling.

68.3.6 Risk-Based Inspection and Monitoring

The goal for offshore operators is to assure that the producing asset continues to deliver its desired performance (availability) in the safest and most practical cost-effective manner. In support of this goal, an IM scheme should be devised and implemented. Strategically, the tools available to support integrity are primarily maintenance and inspection. By inspection, an understanding of condition and an assessment of continued fitness for the purpose of equipment and structure can be achieved. For most regions of the globe, the requirement to have in place an appropriate in-service inspection scheme is both mandatory and regulated.

The process of performing inspections is one of the most risky work activities that is performed on a facility (especially entry into enclosed spaces). Justification of inspection requires judgment on the risks to which the inspection resources may be exposed balanced against the value/benefits to be gained from the inspection. For regulated schemes (such as those required by class societies or government bodies), the roots of best practice inspection programs are primarily experience driven. In this case, the in-service inspection requirements (written as company specifications, classification rules, recommended practices, codes, or standards) typically embody the decades of collective experiences gained by these bodies, although with many of these bodies, this experience has been culled from across industries, disciplines, or assets.

68.3.7 Life Extension

The culmination of life preservation is often the development of an effective RBI plan. In order to develop and implement the RBI scheme, many factors and work activities are usually required, including

• Performing a full risk assessment for the pipe structure, identifying the consequences and likelihood of failure for major and minor parts.
  
• Identifying which specific connections or components provide the greatest threat to failure.
  
• Identifying the degradation mechanisms that are most prevalent and the impact each may bring to bear.
  
• Using engineering critical assessment (ECA) and FFS reliability techniques to identify the most appropriate frequencies, extent of inspection and to provide a method through which the resultant findings of the inspections would positively influence the overall program.
  
• Identifying inadequacies or shortfalls within the existing dataset for gauged thickness values of pipe wall, vessel, or plate within the asset that is careful knowledge management.
  
• Predicting the rates of the deterioration mechanisms.
  
• Development of a site-specific corrosion model to encompass the locations and critical connections, determining how this factor affected both local and global strength of the asset.
  
• Using the developed corrosion model, fine-tuned with historical inspection results and previous repairs, to predict areas where further thickness values would give greater understanding of condition or to identify areas that require repair prior to full implementation of the RBI program.
  
• Evaluating the influences or relationships of differing failure modes, such as localized grooving, that can potentially propagate by fatigue.
  
• Additional corrosion monitoring requirements identified and installed (corrosion coupons, probes, etc. as part of the preservation program against inspection target reference points).

In this way the representation can be used to predict corrosion for components over the life cycle. Where components fail, the new projected repairs can be rescheduled in advance of implementation of the RBI. The output is therefore central to the development of the final (evergreen) product. And best practice productivity can thus be more confidently delivered.

68.4.1 Fit-for-Purpose Solutions

Fitness for purpose is usually associated with a design premise; however, the definition must also apply to the concluding solutions and recommendations made, hence the term fit-for-purpose solution. The objective is to give the best safe/economic and appropriate solution for the life cycle envisioned. The decision-making is mostly judgment based, and multiple codes of practice and standards are used as reference points. Aside from certain aspects of CP, anodic protection and threshold water treatments, where definitive boundary conditions exist, there are no performance standards per se. The relevant risk principles are as follows:

ALARP: The risk of failure must be ALARP or effectively at an agreed acceptable level. Solutions must be rationalized to an agreed semiquantifiable level. Regulation, certification, and classification have been used to endorse fit-for-purpose designs and solutions. Ultimate responsibility remains with the asset or duty holder. Typically, it has been found that the solution to a corrosion problem is often driven by the core background and discipline of the investigating group; for example,

• A metallurgist may instinctively focus on materials’ reselection, frequently recommending an alternative substitute alloy as the first option
  
• The mechanical, civil, architects, and structural engineers*^* tend to rely and look to the Codes of Practice for guidance alone
  
• A CP or coatings specialist may focus on introducing anodes and or coatings as the most viable solution.
  
• The chemical engineer or applied scientist may look to process reaction changes or inhibition as a viable resolution.The above group tendencies are valuable but can also be counter-productive; hence, the need for an independent peer review to maintain sensibility.

All of these approaches are correct in their own way, but the objective of a fit-for-purpose resolution must be clearly and rigorously targeted. The analyst must examine the facts and let the data drive the solution direction, or in certain instances, it is legitimate to generally deduce a likely mechanism and/or root cause and then generate the analytical data to fit the curve. Being knowledge based and if used judiciously, the latter can give a more cost-effective approach saving much in direct costs and effort expended.

Once solutions are defined, at minimum, the asset holder should ensure that any changes or design modifications implemented are “signed off” by the relevant authority (engineering/inspection/certification/verification). Design for construction and design for performance while having overlap are quite distinct, with corrosion appraisal coming into the equation more during service. The latter point is considered important for both preventative and reactive options, and, in most if not all cases, it would be prudent to keep the original designers and design reviewers in the loop. Thus, there is a clear need for asset managers and field operators to interface closely. Ideally, this should be driven by best practice requirements but will most probably need regulatory encouragement. And we may expect similar guidance and a natural convergence to be forthcoming for pipelines in the Gulf of Mexico in due course.

Traditionally, it has always been very challenging to engage proper corrosion control and decision-making since C-Suite/Senior Management are usually the most difficult to persuade (return on investment—ROI is just too dominant). However, the attendance of such leaders to an appropriate corrosion workshop has been known to help (!)

68.4.2 Methods and Techniques of Failure Analysis

No two failures are exactly the same, and this element of the unknown makes for an exciting challenge for the investigators; however, most failures do follow a pattern with a near precedent often found in most cases.

The creative use of existing and established techniques such as close visual (optical stereo microscopy—longitudinal and transverse sectioning), scanning electron microscopy (SEM), energy dispersive spectroscopy (EDS), X-ray diffraction (XRD) and novel “dry” corrosion potential profiling, and signature polarization “fingerprinting” can be very useful. The SEM provides a powerful tool to examine the morphology and topography of critical as-received and ultrasonically cleaned surfaces. And we find that by comparing surfaces at bold surfaces to those at localized corrosion zones (pre/post clean), one can discover powerful clues to the dominant mechanisms at work. The data so acquired can complement EDS (semi-quantitative elemental analyses) and XRD (quantitative compound analyses) of scales at critical wall surfaces. Once confidence in the techniques has been established, the most important aspect is ensuring that the surface scale analyses are done at the most relevant sites with adequate controls for comparison. Physical and chemical process stream data can also be very usefully correlated with other data.

In complex case histories, cyclic polarization diagrams allowing the “fingerprinting” of alloys in the actual process fluid of interest may be used to establish pertinent electrochemical parameters, such as pitting potential, crevice/protection/re-passivation potentials, and so on. The generation of such data to support the failure analysis is a unique means of particular interest if the need to reproduce the failure is warranted. Although there is frequently a link between the root cause and the failure mechanism itself, this should not be assumed, because a relevant solution can often be provided from options outside the corrosion discipline. The best source of guidance on this link is often the field staff, who can help keep the potential solutions in perspective.

68.4.3 Failure Mechanisms and Excursions Outside the Design Envelope

All known corrosion mechanisms occur in the Gulf of Mexico. A great preponderance of corrosion failures can be traced to mechanisms that initiated (also propagated) during out-of-service conditions or excursions outside the expected design envelope. It is important to identify general service conditions and to capture relevant preservice, temporary shut-in, nonsteady state, and excursionary data.

Typically, poor preservation procedures (often complete lack thereof) allow preservice corrosion during storage, before/after commissioning, during refit or plant modifications. These conditions, which are frequently overlooked by designers and operators alike, often promote severe deposit related crevice, pitting or MIC, and differentiation can often be a challenge, but careful scrutiny and multitasking the evidence can prove to be a powerful aid to the diagnosis; see Table 68.3. The differentiation between artificial, raw, and contaminated (dirty) seawaters has continued and much useful work has been done; a recent study has identified interesting characteristics of the scales/biofilms formed, relating the predominance of FeS (Mackinawite) and FeS₂ (pyrite) for biogenic and abiotic films, respectively, and this type of applied result can prove very useful to the analyst.

In addition, in-service erosion/cavitation/impingement and other flow-assisted phenomena are also often underestimated, but temporary changes in differential pressure, spikes in flow velocity, increased sand content, and temperature transients often provide the impetus for such activity, leading to failures of newly installed riser/piping/valve, often within months, rather than years.

Physical parameters can be particularly insidious as the forces involved can well exceed local material/filming properties and corrosion resistance. Comparing data across different systems can be difficult, but nondimensional analyses engaging Reynolds and Froude type analogies can prove invaluable in the determination of safe ceilings for such interpretation. Other more traditional mechanisms, such as dissimilar metal/galvanic corrosion, wear/fretting/vibration, intergranular/selective phase corrosion, corrosion under insulation (CUI), and uniform thinning under normal operating profiles are also documented and tend to be well managed with diligent materials’ selection, inspection, inhibition, and so on. The insidious cracking failure modes, such as stress corrosion cracking (SCC), hydrogen damage (HE/HIC), and corrosion fatigue, are less common and appear to be tackled and arrested ahead of time perhaps because more attention has been devoted to these issues at the detail design stage.

68.4.4 Corrosion and Integrity Risk

Risk studies encompass a vast scale of work, and there are many methodologies and techniques to address risk. The authors believe a simplified 5 × 5 matrix logic makes the most sense, namely, having five accepted risk categories defined as very high, high, medium, low, and very low. Risk can be described further as follows:

• Failure Risk
  
• Very high risk: An event having >75% probability. High risk: An event with 30–50% probability.
  
• Medium risk: An event with 15–30% probability.
  
• Low risk: An event with 5–15% probability (ALARP condition).
  
• Very low risk: An event with <5% probability.
  
• These are semiquantitative criteria and are generally agreed by most SMEs. The consequences side of the equation is more likely company specific, but a good basis might be construed as listed as follows, again the VH, H, M, L, VL criteria are used for consistency.
  
• Consequences Risk
  
• Very high risk: An event having >$500m business impact.
  
• High risk: An event with $100–500m business impact. Medium risk: An event with $5–100m business impact.
  
• Low risk: An event with $1–5m business impact (ALARP condition).
  
• Very low risk: An event with <$1m business impact.
  
• Update: The economic impact costs is a moving number and may be doubled every few years. The reader is encouraged to check with latest published figures.
  
• Note: These are interpretations pertinent to offshore pipelines. Other industry tolerances, such as for onshore and power plant values, can be quite different.

Bearing the aforementioned criteria in mind, overall project corrosion or mechanical integrity risk can also be illustrated by using the red, amber, and low traffic light color analogy, with notation for extreme situations at both ends of the spectrum (see Figure 68.8).

While the HML type matrix has received most attention in the risk management field, an alternative or supplementary approach to the analogy is also very useful, namely, the concept of layers of protection analysis (LOPA). This concept can be effectively used to protect and preserve the asset and have redundancy of action so that there are always realistic barriers to prevent or control the worst case or top event scenarios.

68.4.5 Corrosion Failures

Many interpretations may be drawn from individual corrosion failure case histories. The following presents some conclusions and recommendations.

• A high proportion of corrosion failures are related to poor preservice preservation procedures, which must be developed and implemented, particularly for susceptible and hidden surfaces, such as internal piping/vessels/valves, and so on. The methods could utilize system flushes and temporary inhibition.
  
• Designers and operators should ensure that loading and process excursions outside the originally expected design envelope must be quantified and evaluated in terms of impact on corrosion performance and failure. Nondimensional analyses and intensive online monitoring are useful in this regard.
  
• The codes of practice pertinent to design for construction should be individually interpreted and extended to include design for corrosion performance. This may engage risk-based methods and should take into account safe access, online monitoring, and inspectability as protection against unexpected failure.
  
• Any critical design modifications or changes resulting from failure investigations specifically impacting the mechanical integrity of the component, part or member, must go through an approval or verification process as part of the asset corrosion management system.
  
• Stainless steels (AISI 300 series) continue to be used with untreated seawaters, although these are not compatible combinations and must be avoided, especially under low flowing or stagnating conditions. Similarly, bare carbon steel piping systems must only be used with moving seawater under suitably inhibited and biocidal treatments.
  
• The root cause and the corrosion failure mechanisms are not always linked, and this linkage must not be assumed. This also means that fit-for-purpose solutions may engage noncorrosion discipline options.
  
• All fit-for-purpose solutions developed and implemented must utilize online monitoring to validate life cycle performance. If this is not feasible, then parallel field simulated scaled down versions allowing retrieval and disassembly/inspection should be contemplated.

The failure investigation aspect of IM is a vital discipline and it is important to recognize where in the life cycle the failure has occurred; see Figure 68.9, which reflects the type of corrosion or mechanical degradation threats that might be in play. Here, we may surmise in general terms that storage and preservation issues are prevalent in the early stages of the design life; localized cracking and corrosion is dominant in the early to midlife periods, and general corrosion thinning tends to be concentrated in the last quarter of the life cycle. Of course, any mechanism can begin at any time, especially if design operational envelopes are exceeded via upsets, or process excursions occur, which may stimulate corrosion initiation and development mechanisms.

In the context of Figure 68.9 for subsea and offshore assets, design lives are typically 25–30 years with life extension studies often pushing the limits beyond 40 years depending on productivity of the facilities. In that regard, modern plays with new alloys and new geometries have pushed the envelope of design but have also led to some unusual failures. With the advent of modern computer programs, errors due to bad calculations are greatly minimized since software programs are exhaustively validated, and engineers utilize cross checking of critical calculations using alternative programs, and independent review and verification to ensure meaningful, pragmatic, and schedule/cost acceptable results. However, since technology is always pushing the envelope, with deeper drilling, higher pressures and temperatures, higher applied stresses, and so on, the risk of failure is always a major consideration, and typically the investigator will utilize a materials or corrosion laboratory to carry out the failure analysis.

68.4.6 Localized Corrosion Mechanisms in the Offshore Oil and Gas Industry

In Table 68.3, a list is presented of the main corrosion-related failure mechanisms applicable to the offshore oil and gas industry. Those that are the most serious and important in offshore pipeline and related facilities are indicated with an asterisk.

Some of the localized damage mechanisms are expanded on further in the following paragraphs, starting with some guidance notes on the more serious cracking phenomena and closing with the more localized metal wastage mechanisms. The main difference is time, in that cracking mechanisms or modes of failure often lead to catastrophic bursting type failure; whereas metal loss tends to require more time, although the bursting analogy still applies especially at high pressures when metal will crack and burst once the allowable pressure retention is reached. Note: All examples are applicable to pipelines, flowlines, or risers pertinent to offshore assets.

68.4.7 Pictorial Gallery of Localized Corrosion and Cracking

Illustrations of corrosion failures are very effective in communicating the message. Most of the illustrations shown are taken from actual pipeline or related failures worked on by the authors, and the intent is for educational purposes of benefit to the oil and gas community as well as new students to this subject matter. Having said that, most are available through the public domain, various papers, and presentations made by the authors, and where feasible references to the original sources are provided at the end of the chapter.

68.4.7.1 Mechanical and Environmental Cracking

Identifying the root cause can be a challenge, and the best guidance is to deliberate on the major and minor events that would have prevented failure. For example, the Piper Alpha disaster would have benefitted from a more serious approach to corrosion control (since it was ostensibly plagued with corrosion issues), a better permit-to-work system, and better “lockout-tagout” procedures. The root cause can therefore be argued, but one should focus on which root cause should be the attention of detailed changes to safety systems and better work industry-wide practices. Better corrosion management procedures and applications are certainly preferred actions. There are many examples in the materials and corrosion disciplines whereupon such cases have led to major commercial losses as well as engineering “snafus” and disasters alike. In virtually all cases, having the right blend of multidisciplinary expertise would have been the correct course of action, but time, cost, and/or schedules often led to cutting corners, and thus inevitable failure. Here are some common mistakes in that regard (these are all real-world examples):

• Risk taken when design changes are made without a legitimate stress analysis, often by a nonprofessionally trained engineer.
  
• Risk taken when incompatible replacement materials used to facilitate speedy repairs.
  
• Risk taken when poor unverified corrosion control procedures used.
  
• Independent corrosion circuits require independent corrosion control.
  
• Risks taken when outdated or even obsolete standards, modeling, and software used—a common mistake due to professionals not staying abreast of their subject area.
  
• Not using ITP reviews or services of experienced classification societies, unless mandated.

Failure analysts must appreciate and recognize the main types of corrosion cracking and failure; that is, ductile, brittle, and their morphologies both in a macrosense and in the microsense.

In Figure 68.10, localized pitting corrosion that led to branched SCC is illustrated. Such failures can be initiated at any surface where a corrosive environment meets the steel, or even CRA, under the right circumstances.

The SEM images shown in Figures 68.11–68.13 may be taken as representative in a very general sense. The fracture surface characteristics and morphologies observed can be interpreted and applied to pipeline and subsea structures.

Typical brittle fracture morphologies are represented in Figure 68.12, and in comparison, a representation of hydrogen embrittlement fracture is shown in Figure 68.13. The use of such recognition can be a powerful tool in the failure investigation discipline.

Localized corrosion invariably leads to metal failure due to stress overload, or fatigue type mechanisms, and the structure of the alloy will be an important factor determining the type of fracture observed. The subjects of fracture analysis and fracture mechanics are very important for subsea flowlines, and corrosion and metallurgical engineers have resolved many mechanical integrity issues with a collaborative approach, often in cooperation with flow assurance engineers. This triangle of SME expertise is a powerful team whenever mobilized. Good exchange of critical information between operators is a good sign of the benefit to the industry as a whole.

Once the root cause(s) of a failure or problem are determined and verified, then a fit-for-purpose solution can be formulated. The best corrosion control principles and practices can be most usefully utilized by influential offshore and subsea designers.

The other area of much concern is that of corrosion fatigue, since there is still a tendency in the offshore industry to assume that atmospheric fatigue data can be correctly deployed for marine air or subsea environments. That is evidently a dangerous assumption as shown in Figure 68.14 by the comparative S–N curves depicting the differences in cycles to failure for inert air and marine/seawater exposures.

Microbial activity can vary in terms of corrosion thinning from 1 to 7 mm/year, varying as the dissolution process typically evolves from initiation (micro) to easily measurable development and propagation, ultimately ending in perforation (macro). It is vital to take action at initiation where possible so that effective control (inhibition) can be instigated. After that, during development or propagation, in particular, such interventions tend to be less efficient and often of little real use in the IM process.

Erosion is highly dependent on the flow velocity as often reflected by the flow pattern and location of the damage. Since erosion is predominantly a physical phenomenon, chemical inhibition tends to be of little benefit unless the corrosion component is dominant.

Cavitation (Figure 68.15) can exert stresses in excess of 140 ksi, beyond the yield stress of most alloys. The role of high-velocity degradation mechanisms can be difficult to discern during the degradation event unless sensors are in place and flow regimes are being monitored and compared to the design characteristics specified. The example given is a subsea choke that was forced outside its design envelope by episodic sand bursts over a short period of time (days) with catastrophic results. The enormity of the damage is reflected in the gouging damage to the hard tungsten carbide sleeve at inset on the right-hand side.

Crevices form at occluded surfaces created at crevice geometries, such as lap joints, fasteners, and so on, and lead to a localized form of corrosion, crevice corrosion. The same conditions of low pH, low oxygen, and high chloride are often found under pipeline sand deposits or dead legs and weld/parent metal interfaces with similar results, as shown in Figure 68.16.

As with all corrosion phenomena, it is vital to establish the existence and persistence of an electrolyte, such as a free water phase. Regarding multiphase production flows, the term oil or water wetting has been coined to assist in this derivation; see Figure 68.17.

The problems of flowline CUI in marine atmospheres and at, for example, topside supporting members can also be sources of failure. The problem is usually real-time monitoring and the lack of effective inspection, although the latter seems to be well addressed by advanced thermal imaging; however, such risks can now be greatly reduced by using the best practice of the latest field experiences utilizing strong coatings, such as TSA coatings and thermoplastic supports such as I-Rods. These methods are gaining recognition in oil field applications.

The issues shown in Figure 68.18 are commonly witnessed in tropical or subtropical offshore installations as the pipelines transition from subsea to topside pressure plant. Such corrosion is often discovered during the annual topsides inspection “walk-round.” Note: Very careful inspection and corrosion product cleaning are required to minimize the possibility of premature perforation.

68.4.8 Failure Analysis Check Sheet Listing

The following is checklisting of the main requirements for a successful failure analysis. Here, the emphasis is on the use of practical and well-established techniques rather than newer more experimental techniques.

• Operating Conditions
  
• Design certified/verified
  
• Design reappraisal per corrosion
  
• Original design life service/age at failure
  
• History of problems; previous test data used, any precedent
  
• Material, including mixed metals, galvanic effects, crevicing against nonmetallics.
  
• Environments, including climate, relative humidity, wet high velocity winds, etc.
  
• Conditioning/inhibition pressure, including precorrosion.
  
• Temperature, with a focus on corrosion potential trending.
  
• Flow velocity per flow regimes
  
• Geometry and residual stresses
  
• Any previous changes/retrofit, online monitoring
  
• Corrosion rates determined; failure site—internal/external
  
• Failure description
  
• Taking cognizance of physical and chemical changes due to souring, soil/seawater conditions, pollution, atmospherics, etc. Some standards have started to assess such.
  
• Analyses
  
• Physical modeling (commercial/in-house); tend to be overconservative. Note: Can prove up either way via well placed component radiography or X-ray.
  
• Nondimensional analyses (Reynolds, Froude, type analogies) materials compatibility review Stereo microscopic SEM–EDS
  
• Focused XRD
  
• Corrosion products, metallography
  
• Microbial sampling/tests (usually important to maintain sterile handling and analyses within 24 h of sample extraction)
  
• Corrosion mechanism(s) determination
  
• Root cause failure diagnosis
  
• Fit-for-purpose resolution
  
• Additional tests to validate can usefully link to test racks and bypass loops on site
  
• Solution implementation/online monitoring/field verification.

68.6.1 Risk and Reliability in the Corrosion Context

In the development of oil and gas projects, IM issues are minimally addressed through the design development, but, in 2010, the US Bureau of Safety and Environmental Enforcement (BSEE) promulgated the rule on Safety Environment Management Systems (SEMS), API RP 75, which now formally recognizes mechanical integrity during design life cycle.

“CFR 268.1916 What criteria for mechanical integrity must my SEMS program meet?

You must develop and implement written procedures that provide instructions to ensure the mechanical integrity and safe operation of equipment through inspection, testing, and quality assurance. The purpose of mechanical integrity is to ensure that equipment is fit for service. Your mechanical integrity program must encompass all equipment and systems used to prevent or mitigate uncontrolled releases of hydrocarbons, toxic substances, or other materials that may cause environmental or safety consequence.”

Similar to occupational safety and risk assessment, corrosion risk is the set of requirements that the engineering designer must address just like any specifications. The guidance in [5] provides the template on how corrosion risk has to be included into the engineering design. What is missing is how to integrate corrosion risk into the life cycle engineering design process. To accomplish this, we have to go back to the basic principles of what we are trying to achieve with a facility design. There are three focal points when dealing with the importance of addressing corrosion risk in projects and operations: Production availability, incident realization, and life cycle perspective.

The confusion between risk/hazard analysis and assessment was addressed by the Royal Society [6]. The process sequence of risk management is

1. Identification of undesirable events;
   
2. Analysis of the mechanisms of the undesirable events;
   
3. Consideration of the extent of the any harmful events;
   
4. Consideration of the likelihood of the undesirable events and specific consequences (probability/frequency);
   
5. Judgment about the significance of the identified hazards and estimated risks;
   
6. Developing and implementing decisions on the courses of action.

The terms are grouped in this manner:

• Hazard identification: Steps (a) and (b)
  
• Risk estimation: Steps (a)–(d)
  
• Risk evaluation: Step (e)
  
• Risk management: Step (f)
  
• Risk (hazard) analysis: Steps (a)–(d)
  
• Risk (hazard) assessment: Steps (a)–(e)

The use of “hazard” and “risk” terms are usually used as synonyms. “Risk” should be used only to describe a study or assessment where an estimate of likelihood is involved. The two most critical steps are (a) and (b); the accuracy of these two items will determine the cost effectiveness of the risk management actions.

The prescriptive or conventional hazard management process (Figure 68.20) is the basis of most of the regulations around the world. The legislative requirements prescribed by the authorities are based on many years of experience from failures in the oil and gas industry. The authorities are responsible for developing and updating the prescriptive legislations. Engineering and field development teams are required to meet the legislation to ensure the safety of their facility or pipeline design.

Goal- or performance-based legislation is based on the demonstration by the engineering and field development teams of the integrity of their design. The authorities provide only goals and objectives, and the rest of the risk management work and demonstration must be presented for the approval of the engineering authority. This approach, culturally, is more amenable to the progressive and technologically changing challenges of the offshore oil and gas industry. Software (management systems) and hardware innovations can easily be incorporated as long as demonstration of ALARP can be provided. This also means that the engineering teams or operators must have a very culturally advanced HSE management system to ensure that the updates or monitoring on any of the performance-based solutions are addressed. This change, especially in the North Sea and Australian oil and gas region, gave more cultural control to the operators that provided them with opportunities and flexibility to mold their organization to meet the goals and intent of both the design and the organization. The authorities and engineering domains change as illustrated in Figure 68.21.

Prescriptive regulations will force most organizations to be complacent and work toward the minimum operational and capital cost; they have to meet the regulations and nothing more. By having to declare the organization’s own goals and objectives in a performance-based management process, the creativity of the organization is opened to find the means of eliminating or reducing hazards to ALARP and at the same time to create more flexibility on the operating and capital costs of a production development. The operator, now being responsible for risk treatment, will be more focused on the auditing and verification process in the management system.

It is this understanding of the role of regulation where organizations started to have control in managing their future. It must be noted that organizations have now embedded this performance-based hazard management process into their organizations with the development of their IM framework. They establish the scope and intent, and then provide the elements or business areas. In each business area, specific activities must occur for the organization to attain the desired vision. Each element will describe the intent or high level objectives and then a list of expectations or specific behaviors/actions/deliverables must be met. In the performance-based process in Figure 68.21, if the authorities’ domain (left column) is renamed senior management, and the engineering domain (right column) is renamed operations/design, it will reflect the current format of most IM processes existing today.

68.6.1.1 Focal Point 1: Production Availability

The intention of any new project and facility engineering design is to produce accepted revenue from the investment. The revenue and return on investment is dependent on the capacity of the facility and its planned or desired availability. The availability is dependent on both the operations reliability and maintainability of the designed equipment. Both these parameters are dependent on both the equipment (fixed or rotating equipment) and human performance (operator or maintenance staff). The equipment performance is divided into reliability centered maintenance (RCM) for rotating equipment and IM for fixed equipment (vessels and piping). It must be noted that RCM and IM are still very dependent on the performance of the material chosen to be fit for service. Any unplanned degradation of the containment system of the hazard source will result in unintended facility shutdown and a potential increase in the likelihood of loss of containment accidental events. The key is reducing unplanned maintenance of rotating equipment or unplanned replacement of containment systems, such as pipelines, vessels, and piping.

Understanding of the operating conditions and corrosion risk is critical in minimizing the potential for unplanned design excursions that would affect the availability and safety of the production operations. The two main drivers of increased production are reliability and maintainability. Achieving the desired performance levels will be the result of managing these two factors. Plant and process reliability contributes toward a sustainable improvement in production availability.

The production availability depends significantly on the integrity of the hazardous containment system (pipeline) providing the high reliability and maintainability of the pipeline system. To improve the efficiency of a system, especially during the design and operational phase, consideration of corrosion risk is crucial. Designing with the understanding of corrosion risk can increase the performance of the pipeline operations. Increasing the performance of the pipeline operations, by understanding the corrosion risks, improves the profitability of the business unit and reduces the likelihood of an accidental, unintended release of hydrocarbons. The availability is illustrated in Figure 68.22 Any unplanned downtime of the pipeline operations affects the revenue.

Availability = Uptime/(Downtime + Uptime)

• Availability (A) = MTBF/(MTBF + MTTR) where
  
• MTBF = Mean time between failures
  
• MTTR = Mean time to repair or replace.

From an operational perspective, the same equation aforementioned can be described as follows:

• Availability (A) = MTBM/(MTBM + MDT), where
  
• MTBM = Mean time between maintenance
  
• MDT = Mean downtime.

The key in all these equations is the reduction of the mean downtime (MDT) or mean time to repair or replace (MTTR) to a point where the availability is almost 100%. With the rotating equipment, the RCM program has provided the means in the contribution to the availability of an operating facility. Normally forgotten with rotating equipment are the materials chosen for the service to be provided. Since the focus is not to lose containment, the RCM program must also include the potential loss of containment from the failure of the equipment enclosures or rotating parts. From a corrosion risk perspective, the implementation of an IM process helps to ensure that all the fixed equipment will last the whole life cycle of the facility. Because rotating or fixed equipment does not last the life of the facility, downtime to maintain the equipment will always be required.

It is critical to understand that a facility is safe when it is operating at its designed parameter. When a facility system has a change that is not managed, then we have a high likelihood for a release of containment that will put the facility at risk from an accidental fire or explosion event. The incident realization model (Section 68.6.1.2) explains how a hazardous event (equipment malfunction, human act, or external force) can cascade into a hazardous situation resulting in personnel at risk. The loss of containment also results in a delay or loss of production for the facility. A typical large offshore platform producing 100,000 barrels/day has a potential to gross $10 million/day or $116/s. This means that any delay during maintenance or operations that can affect the required throughput will be at a delay or loss of $116/s or $7000/min. Those revenue numbers*^* can motivate a design team to look differently on a delay involving either human factors or engineering causes. For instance, providing an extra CA at the design phase is insignificant compared with the cost of an unplanned maintenance or loss of containment scenario in a pipeline; the pipeline is meant to transport hydrocarbons from location to location, and any interruption of the availability will cost the deferred revenue and will demonstrate that there is not a full understanding or control of the business risks in an operating pipeline.

68.6.1.2 Focal Point 2: Incident Realization

The other focus that has to be emphasized is the understanding of the mechanisms of an incident and how equipment malfunctions, such as mechanical failure due to corrosion, can be the immediate cause of a hazardous situation. A hazardous event or cause can be realized into a hazardous situation from a hazard source. The model shown in Figure 68.23 illustrates that the most effective prevention of an accident arises from the understanding of the mechanism that can cause a release of a hazardous source. Corrosion risk leading to equipment failure (akin to human or external factors) is a direct cause of release of hazardous energy, and it is these controllable causes that must be well understood during the engineering design of a pipeline system.

This understanding of accident mechanism is an essential part of the hazard identification process required by most global pipeline HSE regulations. This model provides an approach to manage and control the corrosion risk sources of hazards, and it also provides an approach to controls that can be put in place. This is also the recommended approach to address corrosion risk in the design of systems. The approach coincides with the incident realization model shown in Figure 68.23 and includes the following steps, in order of preference of effectiveness:

• Design to minimize the likelihood or consequences of errors and exposure to hazards.
  
• Design to mitigate the consequences of error or other acts.
  
• Provide the user with a warning of potential error or hazard.
  
• Train the user to prevent error or exposure to hazards.
  
• Write procedures to prevent error or exposure to hazards from occurring.

There are many factors that may contribute to equipment failure due to CRM issues. Some of those factors are illustrated in the diagram shown in Figure 68.24, which illustrates the six categories of key issues that contribute to corrosion risk or defects leading to equipment failure: measurements, materials, personnel, environment, methods, and machines. This approach can be effective in recognizing, identifying, and managing the risks.

68.6.1.3 Focal Point 3: Life-cycle Perspective

When dealing with a new pipeline system design, it is critical not only to understand the availability and the mechanism of an accidental event, but a project team must also appreciate the project design process. The most effective phase in affecting the design is at the earliest phases of a project. Even with the lack of detailed engineering information, the project team can maximize the attainable safety performance by utilizing an inherently safe approach to influence the design process. The influence on the magnitude of the contained hazards that can potentially be released is the first approach, and then the focus is on the mechanical or human error causes that would lead to a release of the hazard. The diagram in Figure 68.25 shows schematically the project and operational costs that are involved in attaining the maximum safety performance for an offshore facility. Influences on the design, at the concept phase, greatly improve the tendency to attain maximum safety performance. It is also apparent that any changes in design will cost more as the project progresses from concept to commissioning.

From a life-cycle perspective, it can be clearly seen how implementing corrosion risk controls at the appropriate (CAPEX) stage can save many later financial- and safety-related challenges, which affect the engineering contractor and the operator. The life-cycle perspective is a good, long-term, business approach that gives shareholders confidence in the costs and expenses of a company and its projects. The early identification and understanding of corrosion concerns and mechanisms result in the reduction of the long-term operational costs of a pipeline because of the predictability of the operating costs (inspection and maintenance) and the confidence of shareholders that the company executives have full control and predictability of expenditures. Shareholders do not like variation in expenses and income, because it demonstrates poor understanding of the business accounting. The long-term, life-cycle perspective for CRM is good for business.

68.6.2 Safety Management Systems and Corrosion Risk

A SEMS requires a compilation of safety and environmental information. Some of the key elements of a SEMS where corrosion risk adds value and has a required input are detailed as follows:

• Management of change: changes to operating conditions and facilities during modifications or decommissioning can increase corrosion risks. For example, an undocumented change or deviation in the incoming fluids in a pipeline (more H₂S or CO₂) or modifications in pressures and temperatures may increase the rate of corrosion in a pipeline project; operators and asset owners can benefit from corrosion expertise to identify and manage these risks.
  
• Operating procedures: corrosion inspection and management procedures are a critical portion of the operations and maintenance procedures. These procedures are the result of the design decisions (metallurgical selection) made in the detailed engineering phase of a pipeline project. It is critical that the operating procedure addresses the threat of corrosion on the process and support system.
  
• Training: the training of operators on the recognition and inspection of corrosion issues on an operating platform is very useful as another pair of eyes on the field. The same could be said about ROV operators with subsea pipeline systems; early recognition of corrosion concerns is critical to the success of a corrosion or IM plan. The skill and competency of corrosion inspectors are also invaluable since their findings and recommendations determine the forthcoming program to reduce the potential for a loss of integrity scenario in future operations.
  
• Hazards analysis: corrosion risk is one issue that is mentioned, but seldom addressed adequately during the hazard analysis process of a pipeline design and operation. Corrosion, as a cause of integrity failure, can result in significant environmental and safety effects on offshore or onshore pipelines, especially on environmentally critical landscapes and sea beds, high consequence areas. Corrosion risk inputs into hazard analysis are discussed more in the next section.
  
• Incident investigation: finding the underlying (or latent, root) causes is critical to prevent similar accidents; this is a critical assumption with a metal-based containment system dependency. Corrosion risk should be an integral question of an incident investigation process.
  
• Emergency management: this is crucial for high consequence areas where a loss of containment scenario has occurred. The physical design of the emergency systems is dependent on the understanding of the identified potential corrosion risk and predicted consequence. How an organization responds to the resultant incident is dependent on the planning for these accidental events after the prediction of the potential environmental or safety consequences.
  
• Assurance of quality and mechanical integrity of equipment: mechanical integrity addresses the activities to minimize the potential for the loss of containment, whether it is the containment of fluids in rotating equipment or a fixed containment system like a pipeline. The quality assurance of a CRM program, from inspection to audits, ensures the most cost-effective means of ensuring system integrity and minimizing the potential for loss of containment.

68.6.3 Formal or Structured Hazard or Risk Assessment

The formal or structured hazard assessment techniques form the basis of the most effective methodology for ensuring that all the corrosion hazards and risks have been identified, assessed, and managed. In the offshore industries, the three most utilized guidelines, other than internal oil company standards, are as follows:

1. API RP 14J: Recommended Practice for Design and Hazards Analysis for Offshore Production Facilities;
   
2. ISO 17776:2000(E): Petroleum and natural gas industries—Offshore production installations—Guidelines on tools and techniques for hazard identification and risk assessment;
   
3. NORSOK STANDARD Z-013: Risk and emergency preparedness assessment.

As always, utilizing the latest editions is recommended; noting this also applies to any modeling or simulations.

Typical hazard and risk assessments are divided into the following three steps (Figure 68.26):

1. Hazard identification;
   
2. Hazard analysis/assessment;
   
3. Hazard management.

During each step, there is a significant opportunity for corrosion risk input. Step 1—Hazard identification—provides the most cost-effective scenario.

68.6.3.1 Step 1: Hazard Identification

The main objective in hazard identification is to

1. Identify the undesirable events; and
   
2. Analyze the mechanism that results in an undesirable event.

An undesirable event can range from a production shutdown to a major accident; the different techniques are methods to systematically brainstorm undesirable events. The incident realization model (Figure 68.23) shows the required elements needed to describe the identified undesirable event. During a hazard identification brainstorming session, such as in a HAZID/HAZOP/What-If workshop, human factors could be found in the hazardous event or cause (Why?) or in the unintended exposure of personnel in:

• The hazardous zone (where?);
  
• The execution of the controls (how?); or
  
• In the resultant hazardous situation (who?).

The most important aspect here is first to identify the critical tasks involved in the potential release of a hazard source or unintended shutdown of critical equipment or production; these are the undesirable events. The key here is to identify, during the workshops, where corrosion management is required to maintain integrity of the process system. This means an understanding of the characteristics and internal/external environment of the contained fluids that can contribute to corrosion risks in the system. Second, it is important to establish an understanding of the potential corrosion mechanisms that will provide the guidance on how to mitigate the damaging effect. The life cycle approach should be taken during the thought process of identifying the corrosion hazard and postulating the potential mitigation solutions. This can vary from complete replacement of the containment system to modifications in operating or maintenance procedures to monitoring the decay process before any form of intervention occurs. These and other hazards should not be forgotten during hazard identification workshops.

The most important aspect during the hazard identification steps is to ensure that the facility maintains operation at its design intent. When in the operating mode, there is minimal likelihood of loss of containment because the system is maintaining and containing its operating pressure. It is only when a change in operating design intent is not properly managed that the likelihood of a loss of containment exists, e.g., due to the cooling of lines releasing all the contained hydrocarbons during a shutdown of units and production. The maintenance of the process system and design intent also includes the human operations. Any deviations from the human factors design intent, for operations and maintenance, could also result in potential undesirable events that could result in a potential production shutdown. The human factors aspects include, but are not restricted to, the inspection regime or methodology (how easy it is to inspect the area of concern), up to providing guidance on why there is a corrosion risk in the system (organization awareness). It must be reemphasized that a loss of containment scenario does result in a production shutdown of an offshore facility; it is an inclusive scenario.

The hazard identification step is the most critical step in any hazard analysis process. The typical hazard identification tools used in the oil and gas industries are

• HAZID
  
  
  
  • Are corrosion risks included as the “causes” of potential loss of containment consequences (mechanical damage)?
    
  • Is feedback provided to personnel during a process upset or change?
    
  • What situational corrosion awareness do personnel have over the process?
    
  • What are the manning levels during the process?
    
  • What are the training/competency levels of personnel (inspectors) and how have these been verified? This will include corrosion risk SMEs as well.
    
  • Explain and define the roles and responsibilities of personnel?
    
  • What are the consequences of tasks omitted (inspections) or performed incorrectly?
  
  
• HAZOP
  
  
  
  • What type of personnel feedback is given during a process upset or change?
    
  • What situational corrosion awareness do personnel have over the process?
    
  • Are there more or no corrosion guide words in the workshop?
    
  • How do you ensure that personnel can inspect for corrosion easily?
    
  • How do you provide warnings or indications to the users?
  
  
• FMEA/FMECA
  
  
  
  • How do you capture the failure causes due to corrosion damage?
    
  • How do you capture the failure-detection methods involving corrosion damage?
    
  • How do you verify the decision-making times?
    
  • What are training/competency levels of personnel and how have these been verified? This will include corrosion risk subject matters experts?
  
  
• Bowtie assessments
  
  
  
  • Which are the defined barriers involving human interaction to prevent hazardous events and have they been defined to the right level?
    
  • What are the defined barriers involving human interaction to control consequences and have they been defined to the right level?
    
  • What are the training/competency levels of personnel and means of verification?
  
  
• What-if analysis
  
  
  
  • How do you capture occurrences of corrosion risks?
  
  
• Fault/event tree analysis (FTA/ETA)
  
  
  
  • How do you capture the corrosion-related tasks with the right level of detail?
    
  • How do you capture failure causes due to corrosion mechanical failure?
    
  • How do you capture failure-detection methods involving human interaction?
    
  • How do you verify decision-making times?
    
  • What are the training/competency levels of personnel and means of verification?
  
  
• Other LL during the hazard identification step of major projects are
  
  
  
  • Inclusion of corrosion risk in the product availability leads to increased efficiency and less down time.
    
  • Early identification of corrosion hazards leads to less time and economical use of resources for a more appropriate design for operation and maintenance.
    
  • Focusing on the corrosion risks early in the conceptual and detailed design process and life cycle will increase the availability of the pipeline system and thus improve the profitability of the operations.

To conclude, the hazard identification step is the most critical step in any hazard analysis process because any mistakes in this process will propagate into the hazard analysis portion of the hazard management process.

68.6.3.3 Step 3: Hazard/Risk Management

At this step, a significant amount of iteration and sensitivity work provides value-added risk reduction measures from the analysis and assessments. The functional requirements are established based on the risk reduction measures that have been developed or progressed. At this portion of the design life cycle, any changes in the design would be cost prohibitive. Operational controls are the focus during this phase of the life cycle with the most effective solution and effort focused on meeting the original design intent. It must also be emphasized that all these assessments should be reinvestigated once more relevant data with statistical confidence from experience have been collected. Studies and decision tools utilized include but are not restricted to

1. Risk matrix
   
2. Cost-benefit analysis (CBA)
   
   
   
   • How has redesign cost of equipment, due to human factors deficiencies, been addressed?
   
   
3. Safety integrity level (SIL) assessmentHave you captured all failure causes due to human error?
   
4. RAM (reliability, availability, maintainability) analysis
   
   
   
   • How do you maintain the equipment?
     
   • How do you access equipment that has been maintained?
     
   • How do you monitor equipment upsets?
     
   • What are the key hazards when the equipment requires maintenance?
     
   • What feedback have operations personnel given for improving the safety and efficiency of the maintenance activities?
     
   • What working at heights is involved?
     
   • What manual and material handling activities are involved?
   
   
5. RCM
   
6. Asset integrity management (AIM) with focus on all disciplines.

The aspects of organization or management system design, procedural development, and training/skills/competency requirements include the human factors focus. At this stage, if the hazard identification scenario is incorrect, then the management of risks is significantly flawed. In addition, inadequate testing for operability, after a completed design change, can seriously affect hazard management. Ineffective indications for deviations occurring in the process for operations and maintenance personnel can result in ineffective hazard management. Inadequate procedures for logging LL can result in design issues that remain unresolved. These unresolved hazards may lead to near-miss incidents or MAEs depending on the extent of impact on a system. The balance of corrosion business risks in the oil and gas industry can be simply explained using Figure 68.27 describing the business flow schematic for pipeline corrosion and IM. The balance of the reactive and active corrosion monitoring and the proactive corrosion risk assessment is based on controlled and uncontrolled cost/budget. Reactive corrosion monitoring is mostly based on an unanticipated cost of a potential or a realized loss of containment scenario. This would also include the resulting implementation of LL from actual or similar field consequences and effects. This is not the ideal part of the business model due to uncontrolled costs. The proactive portion of the business model is the active monitoring and proactive risk assessment work. These are budgeted costs or expenditures that are controlled and anticipated. The management of corrosion business risk should be focused on the controlled costs rather than the effects of the uncontrolled and unmanageable costs with a reactive method of execution. The key is to minimize the reactive corrosion monitoring process to a level that is as low as possible.

68.7.1 Lessons Learned—Update and Discussion

Key lessons learned (LL) sometimes less onerously referred to as key takeaways can be company confidential but have certainly evolved; nevertheless, a generalization is in order, and these are so framed in precis form with no particular emphasis.

Since in the modern day, we are constantly under the aegis of climate change and sustainability, it is prudent to offer some constructive approaches gleaned in this area. Apart from better education and skills training, the immediate LL is that all engineering, science, and technology reports and decisions would benefit from third-party verification (TPV) especially those pertaining to safety critical assets and items. Alternative words and acronyms have also been used; meaning much the same, i.e., third-party review or reappraisal (TPR), third-party review (3PR), and independent peer review (IPR). The objectives are essentially the same, the main new finding is that a mixed group of appropriate SMEs will nearly always prevail.

All life cycle design and operability details should be latest ALARP*^* assessed by a multidisciplined group of SME’s at minimum to include, mechanical, structural, metallurgical, chemical inhibition, corrosion, welding, nonmetallics, etc. Both criteria verification and ALARP are linked and seem to have taken somewhat legal ramifications (especially in the United States) and perhaps more readily accepted in the ROW which is unfortunate as they present powerful criteria for rigorous judgement (qualitative and quantitative) per; design, construction, commissioning, operation, and even decommissioning. In time, it is hoped that both terms will be seen more favorably in the overall context of health, safety, security, sustainability, environment, quality, and revenue; as reflected in the acronym HSSSEQ$, an offshoot of the successful oilfield approach called project health, safety, security, environment, risk (PHSSER).

In addition, at a deeper dive proper goal setting inspection, monitoring, and repair are vital in the new era. This will accentuate a multitude of cross validating techniques to corroborate actual condition of the pipeline. Ultimately, we aim for fail-safe safe-life (FSSL) design and operations. Such approaches are indeed filtering into engineering practices, but might be better served in the classroom at degree level for new engineers, and via skills training via professional development or continuing education for working engineers and technicians.

Meeting the minimum requirements of Standards or the Regulations was in the past a target, but is now no longer fully sufficient. Companies must go the extra yard as internal fluids and external atmospheres get more aggressive fomenting more pipeline and infrastructure failures. And very vital is the act of including relevant controls and calibrations at appropriate steps in the life cycle.

Similarly, partial documentation is no longer acceptable, and collaborative knowledge exchange within corrosion and IM is to be encouraged. This includes design reports with a full suite of drawings for new (CAPEX) designs, and management of change (MoC) as the assets proceed through the life cycle. The interaction between change management (CM) and MoC is also a vital hitherto unaddressed parameter. This is a complex LL and often best fielded via deep dive into case histories.

New parameters such as situational risk, new mechanisms such as corrosion under excursions (CUE), high pressure, high velocity shearing fluids (incl. wet winds), high temperature effects on corrosion potential (e.g., Ecorr and passivity/polarity shifts), impact of lower pH (acidic seas/soils, etc.) all need do to be more closely examined.

The global infrastructure (including pipelines, buildings, bridges, etc.) is failing badly, and action is required. Engineers need to carefully study, approximate and join the dots, and create truly fit-for-purpose solutions. AI-ML will have a role. Strong opinions presented regularly by the ASCE and NACE (now AMPP) must be heeded.

Better planned HSSSEQ$ is required to ensure FSSL can be achieved. This is often best reflected by the increased use of ISD and the CRAs, new plastics, composites such as CFC, FRP, and many others; and when appropriate, utilizing temporary solutions to effectively buy time until permanent solutions are generated. Ultimately, one needs to triangulate good data with accepted theory, new findings, and field observations, wherever possible weeding out bad data and even bad modeling when discovered.

While we strive for inherently more reliable designs, virtually all materials have a de facto Achilles heel. Engineers should therefore strive to identify that and reconcile accordingly and, in that regard, be more wary about human factors psychology within the leverage of change management (CM) versus management of change (MoC).

Finally, be very wary of models and simulations, ensure that latest versions are being used, and ensure models used are calibrated for the specific project in play. And very importantly, ensure sustainability criteria LL are considered, and that claims and results that do not seem logical are investigated and corrected if need be.

68.7.2 Recommendations and Future Strategies

The following general predictive recommendations are postulated for pipelines, risers, and related, pressure plant:

Expect stricter offshore regulations in line with originally mandated onshore pipelines, and clearly applicable to the full life cycle. Typically, BSEE and PHMSA have led the way, with SEMS2 and the so-called pipeline MAGA Rule [8]. Practitioners must stay abreast of such developments. Bear in mind also the traditional MOU’s between the DOT, DOI, PHMSA, etc.; and likewise collaborative understandings between the premier Class Societies such as LR/DNV/ABS/BV/GL.

Further develop and introduce the best combination of prescriptive and goal setting or risk-based corrosion control programs.

Anticipate the principles of the safety case to be applicable for all matters related to corrosion and IM. In particular, changes in KPIs such as dangerous reverse polarity for unusual internal and external pipe changing conditions.

Expect better use of inherently safer design and reliability and likewise better use of existing techniques, and a close observance of how new research techniques evolve, with a fair opportunity to use them when appropriate. This is particularly applicable pertaining to coatings.

Encourage the use of design reappraisals for safety and environmental context, if the industry does not oblige, mandates to that effect can be expected, spurred by public opinion.

Eliminate the tendency for minimal engineering compliance and encourage reasonable risk-based conservatism and contingency to facilitate safe operations.

Encourage TPVs for safety critical and high-risk pipelines and risers.

If relevant SME teams are chosen, then cost prohibition can be avoided.

Despite the history and guidance, it is evident that the LL during the application of corrosion risk in design continue to evolve with more engineering design. This chapter has discussed relevant corrosion and IM guidance within human factors, and hazard analyses along with pragmatic LL and challenges from the authors’ experiences on major projects.

The reader is strongly advised to stay abreast of all relevant regulatory changes imposed. The most important to North America may, for example, be the DOT, DOI, PHMSA, CSB, and the equivalent Canadian authorities.

The challenge continues to integrate more corrosion risk during hazard and risk management activities in all engineering design activities. The pace of development is fast as the pipeline, offshore and subsea industries tackle the more aggressive chemistries, high pressures, high temperatures, and high velocities expected by deeper exploration and reservoirs. Hopefully, this chapter has provided the impetus, guidance, and momentum to address these issues. However, the reader should note that to quote Ben Poblete this is just the “tip of the spear.”