Ait

Article history:Received 28 May 2010Received in revised form15 July 2010Accepted 30 July 2010

Keywords:Integrity managementSafety

disaster occurred on the Piper Alpha platform in the UK sector ofthe North Sea. The loss of life was staggering: 167 dead, with 62survivors, and dozens badly injured. Much has been written anddebated on the incident. This paper examines a new angle on the

mechanisms in the root cause analyses of most signicant failuresand virtually all loss of performance issues. The interpretations aremade with the support of solid observations and new under-standings in the direct context of integrity and corrosion manage-ment. The authors come from a mixed blend of offshore disciplines,with over 80 years of combined experience, predominantly fromthe North Sea and Gulf of Mexico. The objectives are aimed to beeducational and not controversial, but the opinions are strong, andconsidered very worthy of continued debate and development.

* Corresponding author. Tel.: 1 281 675 1020.E-mail address: binder.singh@wgim.com (B. Singh).

1

Contents lists availab

Journal of Loss Prevention

w.

Journal of Loss Prevention in the Process Industries 23 (2010) 936e953IONIK now rebranded to: Wood Group Integrity Management.1. Introduction

After the recent 20th anniversary of the Piper Alpha offshoredisaster a paper was prepared and delivered to the OTC conferencein Houston Texas, in May 2009 and a upon invitation the exercisewas repeated for the Offshore Brazil conference in Macae, Brazil inJune 2009. This paper is based on an adaptation of the OTC paper(Singh, Jukes, Wittkower, & Poblete, 2009).

On the 6th of July 1988, the worlds worst offshore oil industry

subject matter, in the context of inherently safe design, and theallied second tier items of interest. These are the corrosion-relateditems that have been accepted as pertinent over the years, but oftenerroneously perceived with less priority. This is largely because thesubject matter is considered too specialistic, or complex and oftenrequiring costly subject matter expertise. As a result, corrosionintegrity is sometimes dangerously taken off the agenda by non-subject-appreciative project or even industry leaders. This paperdelves into this contentious area, examines the role of corrosionCorrosionALARPKey performance indicatorsLessons learned0950-4230/$ e see front matter 2010 Elsevier Ltd.doi:10.1016/j.jlp.2010.07.011It has now been well over 20 years since the North Sea Piper Alpha disaster in 1988. There have beenmany lessons learned; some documented others just etched in memory. The event chronicled manysignicant changes in the offshore industry. The emanating point for most sweeping changes has beenthe Cullen Report and the UK North Sea industry. This paper reviews some of the critical lessons andidenties many secondary ner points that constitute important learnings. The paper looks at majorchanges instigated by step changes in safety criticality. It is argued that the second tier modes of failuresuch as corrosion, materials degradation, environmental cracking, erosion, plant ergonomics, etc. need tobe better examined. These mechanisms are dangerous threats to the integrity of deep subsea assets, andit is noted that such root causes of failure as witnessed or predicted have yet to be fully appraised. Theauthors use wide experiences and case histories to highlight such concerns, offering rational t-for-purpose solutions. The industry disconnections between, urgency to build, knowledge transfer, andmanagement of change, are refocused. Powerful advances in risk-based mechanical, process, materials,and corrosion engineering are emphasized and the use of key performance indicators (KPIs) are reasonedfor best life-cycle integrity. To keep up with the pace of growth in the deepwater sector, methods ofconcurrent and inherently safe design have evolved in a world where the practicalities and costs ofmodication, repair and retrot are extremely difcult. Hence getting it right at the outset is paramount.Thus the drive for purposeful investment, at design is more justiable, than the traditional practice ofpostponing costs (and problems) to operations. In this way the ominous gray zone between the two costcenters is better bridged for reasons of safety and commercial advantage.

2010 Elsevier Ltd. All rights reserved.a r t i c l e i n f o a b s t r a c t20 Years on lessons learned from Piperconcurrent and inherently safe design

Binder Singh a,*, Paul Jukes a, Ben Poblete a,b, Bob Wa IONIK1 ConsultingeJP Kenny Inc., 15115 Park Row, 3rd Floor, Houston, TX 77084, USAbCameron, Houston, TX, USA

journal homepage: wwAll rights reserved.lpha. The evolution of

tkower a

le at ScienceDirect

in the Process Industries

elsevier .com/locate/ j lp

Fig. 1. Piper Alpha before accident e Courtesy Wood Group (Wood Group HSE Matters,2008).

B. Singh et al. / Journal of Loss Prevention in tThe Piper Alpha accident was a monumental event, see Figs. 1and 2. It is, perhaps, in terms of impact a top-ve engineeringdisaster on the global scale, considered to be in the same leagueas Chernobyl, Challenger, Three Mile Island, Flixborough, etc.(BP Booklet, 2004; Kletz, 1998; Lees, 1980; Lord Cullen Report,1990; Neal, 2007; NTSB). And in many ways it is historicallycomparable to other high-impact human events such as theKennedy assassination, New York 9/11, London 7/7, and Mumbai11/27, in that people (certainly in the British Isles and the NorthSea community) often remember where they were on the day. Inthat way the Piper Alpha seems to have uniqueness about it,which may be due to the fact that it was offshore and involveda heavily manned producing platform. The major differential has,with the benet of hindsight, been that the disaster was de factoman made, though not a deliberate act in any way, but humanand engineering errors were seen to hideously come into play.Many studies have looked at that aspect, the center piece of mostif not all being the ensuing public inquiry and the Cullen Reportwhich was published in 1990 (Lord Cullen Report, 1990). This wasthe culmination of a thorough two year inquiry involving manyinterviews with survivors, families, and subject-matter experts ofthe day, with many others on the outside offering immediateopinions on the many public affairs programs of the day, asseems to be the norm under such events. It was also commonlynoted for truck loads of documents being delivered to the

courthouses of London and Aberdeen, and that was a reection ofthe non-electronic transfer of documentation, as might be

Fig. 2. Piper Alpha explosion e adapted (Coastal Training Technology Corporation,2007; BBC web pages).expected in todays computer driven age. The Cullen report hastended to be the main stay reference source for all new offshoredesign and operational guidelines the world over. Some regionshave used the ndings rigorously whereas others have used themless in depth. Overall the report led to the effective dissolution ofthe prescriptive regulations sanctioned up to that point, andreplaced same with the evolution of the goal-setting integrityregulations in the UK and with derivatives thereof. On the plusside the major outcome of the disaster has been far better, safer,and more efcient engineering practices for the oil industry. Andindirectly has supported strongly the need for inherently safedesigns and procedures. These have been realized by better, morefocused research, better applied knowledge management, anda greater sense of public and industry responsibility by the newgeneration of engineers and scientists. Many more offshore,subsea and integrity-related courses have evolved worldwide,largely at postgraduate level, much to the advantage andbetterment of the industry. This has been promulgated by thebetter realization by professionals in the industry that designingto build the asset, structure, pipeline, and pressure plant can nolonger be based on projected revenues alone. Yes, the ultimatedecision maker or breaker can and often is the commercialsensibility, but a greater sense of responsibility to the public, andthe environment, has fallen into place. This is largely regulatorydriven, but one can still discern a good dose of professionalism,merit and worthiness in the arena.

1.1. Root causes

Regarding the accident there was, perhaps, no single root causeevent that was to blame. Rather, it was a conuence of many criticalfactors that were almost the perfect storm often described as thejigsaw or Swiss Cheese effect, whereupon critical events occurringat a certain juncture in time, and as a consequence the failure jigsawfell into place, with tragic results. In reality integrity management(IM) is far more complex than maintenance (a commonmisnomer),the parameters affecting IM are non-linear and inuential during IMpre-planning, post planning, action and reaction, etc., and indeedthe alignment of bad sequences, events or circumstances areinvariably all time dependent and thusmulti-dimensional in nature.This has traditionallymade IM a difcult subject to grasp, especiallysince it transcends both the capital expenditure (CAPEX) andoperating expenditure (OPEX) cost centers.

The Piper Alphawas commissioned in 1976, but was modied toact as a major gas processing and gathering hub. This meant it washandling large amounts of high-pressure gas, with a dispersed plantlayout, making inspection, maintenance and repair difcult. Therapid technology advances of the day, coupled with powerfulcommercial pressures, clearly had a lot to dowith the event, and thispaper looks at some of these important issues, with the benet ofhindsight but also with strong opinions forged over time (BBC webpages; Coastal Training Technology Corporation, 2007; Fontana,1984; JP Kenny, 2005e2008, 2008; Private Correspondences withMessrs Ben Poblete (LR/Cameron), 2000e2008; Singh, Britton, &Flannery, 2003; Singh, Britton, Poblete, & Smith, 2005; Singh, Folk,Jukes, Garcia, & Perich, 2006; Wood Group HSE Matters, 2008).Regarding the best way forward it is important to identify allintegrity-related threats, some of which may be discerned as ata secondary level, albeit with the potential to give similar disastrousresults if not taken fully into account. The majority of these arematerials performance and corrosion related. The latter is animportant point, and the paper takes a critical view of the changesthat have been instigated since Piper Alpha, not so much from thelarge structural engineering angle, but more from the viewpoint of

he Process Industries 23 (2010) 936e953 937these second tier issues, which usually arise within lower prole

in tdesign parameters, for example pressure (leak) containment,corrosion analysis, erosion, wear and tear, inspection, monitoring,pigging, and maintenance, etc.

Due to the media frenzy of the day, the causes were variouslyreported over the rst year as: metal fatigue, poor maintenance,inadequate operating procedures, bad work practices, human error,etc. The full report is a public document, and much educationalmaterial, video s/DVDs, etc. are readily available for the interestedreader (BBC web pages; Coastal Training Technology Corporation,2007; JP Kenny, 2005e2008). Essentially in the context of thispaper the Cullen report, and other studies have highlighted manyreasons for the disaster, the most damning of which were:

Poor plant design (including with regard to modications andchanges)

Breakdown of the permit-to-work system Bad maintenance management Inadequate safety auditing, and training procedures Poor communications (all levels) Poor emergency management (including with regard tosurrounding platforms)

The Cullen report (Lord Cullen Report, 1990) made over 106recommendations, which included in summary:

The transfer of government responsibility for offshore healthand safety to the Health and Safety Executive (HSE) wasgenerally received well. (Note: the public observed this asgovernment taking some responsibility, too.)

The establishment of a Safety Case regime (This was to entailindependent verication).

Overall review of legislation, denition of best practices, andbetter use of loss prevention studies.

Better work force involvement (crucial but sensitive). Verication and intervention when necessary. Permit-to-work systems (ideally fail safe and tamper proof). Systematic approach to safety, responsibility of everyone(senior management and down the line).

Emergency response and incident reporting (effectively bytraining and changes in attitude and culture).

It has to be said that most of the activities listed above still fall inthe grey area of judgment, and in that case best practices musttherefore be interpreted and applied through the identication ofsafety-critical systems and components, proactive risk analysis, riskreduction, and therefore risk management (Singh et al., 2005). Thereare many other important derivations from the Cullen report, butwithout unnecessarily goingoutside the scope of this paper, it is quiteclear thatmanagementof change (MOC) is andwill continue to be thebest tool available in the ever-improving area of knowledgemanagement (Deepwater Corrosion Services Inc, 2008; DOTRegulations; JP Kenny, 2008; JPKenny/University of Houston, 2008;JPKeIonik, 2005e2008; Mueller, 2006; SCOTA/UKOOA, 1995; Singh,2007; Singh et al., 2007; UK HSE, 2001; UMIST/University ofManchester Corrosion Center, 1983e1995). The electronic age ofsoftware and modeling analyses has made documentation prepara-tion and transfer so much easier that we are only limited by ourability to assimilate and interpret the information across multidis-cipline areas (API 14E RP; Ramachandra, 2007). This is where corepersonnel competencies come into play. For a better, safer, and moreefcient work force andmanagement, suitably trained and educatedoffshore engineers and scientists must be provided by our educa-tional institutes. To that effect rst-rate universities across the NorthAmerican, European, and Australian regions in particular are churn-

B. Singh et al. / Journal of Loss Prevention938ing out scores of postgraduates annually in the key disciplines ofmaterials, corrosion and integrity engineering (Ohio University,2007; UMIST/University of Manchester Corrosion Center,1983e1995; University of Tulsa, 2007; WGIM Internal TrainingModules, 2000e2008). As these people pick up practical experi-ence and supplement the traditional engineering and sciences, thiscan only be a boon to the integrity management discipline, andtherefore better engineering practices for the offshore and energyindustries generally. The concept of better work force involvement isa sensitive issue since it is still commonlyexpressed byworkers in theeld that anoverexuberancewithoffshore safetyat themetaphoricalcoal face can lead to the not required back (NRB) factor, which stillhas a tempering effect on employee involvement (Hibbert, 2008;Private Correspondences with Messrs Ben Poblete (LR/Cameron),2000e2008).

1.2. Industry changes

The many ensuing industry changes identied since the disasterhave, in fact, taken many years to come to fruition. Overall mostoffshore regions, in particular the North Sea, Gulf of Mexico (GOM),and Australia have embraced the new culture of safety. Althoughthere is sometimes a dangerous disconnect between theory and theactual practice of implementation. The rest of the world (ROW) hasresponded in a slower manner, but with positive results, especiallythe SE Asia regions and offshore India. The very heartening imple-mentation of best practices (by choice, not necessarily regulation)has given greater condence for the new, challenging deepwaterexplorations and subsea tie backs in the GOM and the new frontierArctic regions (JP Kenny, 2008; Singh et al., 2006). The most notablechanges again in the context of this paper are interpreted as follows:

Changes to offshore asset design, requirements for designreview, more latitude for concept creativity, better rationale forengineering conservatism and pragmatic safety.

New goal-setting legislation, i.e. the Safety Case. The goal-setting idea replaces the prescriptive method. Thishas proved to be a step change in offshore safety and engi-neering performance.

For the important GOM region it has been stated that theregulations conferred by the governing Mineral ManagementServices (MMS) are t-for-purpose. This suggests the designs aresuitable at construction, but the gradual drift of this meaning hasevolved to life-cycle tness-for-purpose and this appears to beadopted and embraced by the more recent generation of engineers(typically 5e10 years experience) as they enter the fray. The subtledebate now ongoing is at thematerial selection stage. There are twoschools of thought, namely the distinction being made, whether toselect carbon steel and then carefully manage the operationalcorrosion, or to select the corrosion-resistant alloy (CRA) optionwith minimal corrosion management. The contrary arguments areusually cost-center based, with strong opinions tested for CAPEXand OPEX scenarios. In other words, do we pick materials forimmediate tness for service at fabrication (just build it) or tnessfor materials life-cycle performance? The answer is now emergingas a requirement for both, and to that effect the materials engi-neering specialist is having an ever-more assertive role to playwithin the large multidiscipline teams usually engaged on highcapital projects (JPKeIonik, 2005e2008; Singh et al., 2006; Singh &Krishnathasan, 2008).

1.3. Implementation

The implementation of the Cullen report recommendations

he Process Industries 23 (2010) 936e953has, it is believed, shown through various studies that reportable

incidents that impact safety issues in the UK sector have beensignicantly reduced by some 75%; a major achievement (PrivateCorrespondences with Messrs Ben Poblete (LR/Cameron),2000e2008; SCOTA/UKOOA, 1995; UK HSE, 2001). This clearlymeans the industry is on the right track, but there are stillproblems and issues. It is argued that more attention should andmust be made to the secondary tier items such as root causecorrosion mechanisms, advanced monitoring and inspectiontechniques, etc. This aspect is best illustrated by an adaption ofthe Swiss Cheese effect as shown in Fig. 3. It is to this effect thatthis paper is targeted, with the intent that by paying morefocused attention to these parameters and ndings that theintegrity management discipline will be more substantivelyimproved. The Cullen report also identied two areas of underemphasis that may be appropriately reasoned, rstly the industrytendency to avoid the acceptance of external consultants adviceif the recommendations are not supported by more experiencedpersonnel, often even if the consultation seems logical and safetysensible. The case of the central riser argument for the Piper

These and other related points of view are made in the paper,hopefully to reinforce some of the many lessons learned over thepast 20 years or so. In almost all major comparable disaster casesthe commonality has been the conuence of many variablescoming into a tragic alignment, sometimes referred as the jigsawor Swiss Cheese effect. It is argued in this paper that in almostall cases the loss of materials performance as stimulated bycorrosion is the root cause effect. A close examination of themodes of failure reveals the uncanny role of corrosion dissolutionat either the macro or micro level (whether it be by alloy,embrittlement, crevice corrosion, mixed metal galvanic, etc.) theoutcome is the same: severe loss of material properties and/orload carrying capabilities (Fontana, 1984; UK HSE, 2001). Theresolution of the corrosion aspect will, therefore, in virtually allcases eliminate the closure of the jigsaw effect, thereby pre-venting the failure. On a positive note, the concepts of knowledgemanagement, advanced inspection techniques, implementationof MOC, and the more newly dened roles and responsibilities forpertinent decision makers, etc., have all been very instrumental

B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 939Alpha is cited; here evidently the dangerous proximity of therisers to the control and radio room areas was, in fact, identied,but no action taken (design change, relocation, blast walling,etc.). Nowadays virtually all new designs insist on the risers beingon the outside perimeter of the offshore asset. The second pointof observation is the concept of addressing root cause effects. ThePiper Alpha condensate pump problems that initiated the wholetragic sequence of events were plagued with corrosion problemsthe attendance to which was seemingly consistently delayed aslower priority. Apparently some platform corrosion issues wereleft for over four years (JPKeIonik, 2005e2008). If corrosionmanagement as a recognized discipline had been in place, ratherthan an ad hoc to-do item, then again, with the benet of hind-sight, the tragedy could have been avoided. That, unfortunately,is how the learning and knowledge management process works.And it has to be said that companies today often have veryvaluable lessons-learned meetings after major projects areconcluded. There is a strong case, and new initiatives, underwayfor such formal lesson learnings on an ongoing basis (BP Report,2004; JPKenny/Ionik; SCOTA/UKOOA, 1995; Singh, 2007).

The use of modern-day corrosion risk assessment techniquesare under development and application. It is hoped that ulti-mately these will be implemented by the weight of motivation,though in reality some degree of mandatory regulation may beultimately required (IONIK JIP, 2008; JPKeIonik, 2005e2008).Fig. 3. The Swiss Cheese Analogy asin making this industry safer and better equipped to tackle thechallenges faced ahead. It is strongly argued that one newrecommendation that would be instrumental in helping improvethis aspect an order of magnitude would be the mandatoryrequirement for each asset to submit a clear annual corrosionintegrity statement on the facility, and pertinent (safety-criticalparts) thereof (JPKeIonik, 2005e2008). The burden for doing thisis not high, but the results would be extremely positive.

1.4. Threats to asset integrity

It is very important for society to progress positively and look atlessons learned in all disciplines from time to time. However, in theengineering eld the need is most pressing. The world is changingfast, with unprecedented population growth, and competition forsustaining resources such as water, food, and energy. The oil andgas industry is pivotal to such growth, and must, therefore, takenote of demand for production, and demands for best safe, efcient,and environmentally friendly solutions. The structures, pipelines,pressure plant, and parts thereof must be designed and operated atoptimum conditions, whilst retaining mechanical integrity over thelife cycle. One of the greatest threats to any asset integrity is thedegradation of the asset with respect to time, i.e. the design life or,more appropriately, the life cycle. In that context the most domi-nant degradation phenomena per se is corrosion. And in that regardapplied to materials engineering.

in tthere are many mechanisms of corrosion, all of which come intoplay at varying levels of intensity. The early work by Fontana et al.(Fontana, 1984) suggested eight clearly dened corrosion mecha-nisms, though more recent work is pointing to more than ten(JPKeIonik, 2005e2008; SCOTA/UKOOA, 1995; Singh et al., 2003;WGIM Internal Training Modules, 2000e2008). For the upstreamoil and gas industry, it is common to delineate these into the majordamage threats, whereupon many studies (Canadian/Russian inparticular) over the past 10 years or so have shown that internalcorrosion is the dominant cause of failure, typically by over 50% inpractice (JPKenny/Ionik; WGIM Internal Training Modules,2000e2008).

Whether the corrosion failure is on pipeline, riser or topsidesequipment there is in practice nearly always a precedent, thusworking applied design life solutions can normally be formulated.At the same time it is however, important to continue withfundamental or near fundamental research to help understandfailure mechanisms better so more permanent solutions can beimplemented as timemarches on. The concept and consolidation ofthe corrosion and erosion JIPs have helped to bridge the linkbetween industry and academia, with valuable results (OhioUniversity, 2007; University of Tulsa, 2007). The trick however, isto ensure that the results are interpreted and applied by skilled andexperienced personnel, preferably staffers who are very cognizantof the JIP data being generated, and have had a role in the devel-opment of the laboratory and eld testing programs. As an examplethe threat breakdown for risers, though quite similar, will haveparticular nuances to be taken account of, such as the translation ofhorizontal pipeline ow regimes to vertical regimes with a poten-tially high-risk corrosion activity at the base transition. Similarly,topsides pressure equipment will be safety critical, and perhapswarranting greater latitude on the monitoring side, such as areaultrasonic testing (UT) mapping and thermal imaging in the high-risk underside (six oclock positions). There should also be a greateremphasis on the external corrosion aspect, especially at supportswhereupon several major failures have been observed due tocrevice corrosion being accelerated where wet marine air hascondensed out high chloride pockets in susceptible areas(Deepwater Corrosion Services Inc, 2008; Singh et al., 2003, 2005).This is a signicant problem in the GOMwherewarm temperatures(>21 C) and regional humidity levels are routinely >80%, prettymuch year round.

On the plus side there are many t-for-purpose solutions, suchas the use of inert I-Rod type inserts, which if used correctly canvirtually eliminate crevicing geometries (Deepwater CorrosionServices Inc, 2008; JPKeIonik, 2005e2008). The use of thermalspray aluminum (TSA) coatings is also a very viable solution for alltopsides equipment external and internal surfaces. This isa reection of onshore technologies being carefully transferable tooffshore applications, provided subject-matter expertise is wiselyused and safety is not impaired (JPKeIonik, 2005e2008; Singh &Krishnathasan, 2008).

1.5. The aftermath

Post Piper Alpha, studies (late 80s and 90s) revealed theimportant need for corrosion management. That concept was likelyrst coined by researchers at UMIST/Manchester when that grouprealized that corrosion control really defaulted to corrosionmanagement as the discipline was a ne balance of integrity andnance management (UMIST/University of Manchester CorrosionCenter, 1983e1995). Thereafter, the term seemed to be broadenedto cover for monitoring, chemicals, pigging and inspection, thusleading to the term inspection management. It was, however, very

B. Singh et al. / Journal of Loss Prevention940important to include the pressure vessel and piping communityand it is believed that lobby led to the evolution of mechanicalintegrity management. In time, mid-late 90s the terminologyseemed to reach a consensus at integrity management (IM). Interms of proportion, IM is still effectively a corrosion managementexercise and that was argued in early pioneering studies by Prodgeret al. (Prodger, 1997)., leading to the conclusion that IM waseffectively 80% corrosion related, covering all assets (marine/offshore/industry). The concept of a corrosion managementstrategy (CMS) has therefore evolved, this supplies the high-levelapproach to IM, and is usually a system FEED-type study, quicklyconverting to a tactical (nuts and bolts detail) type corrosioncontrol manual, which forms the basis of the life-cycle IM plan. Theplan is a live, ongoing document modied or revised as new data orndings become apparent and usually encompass detailed, risk,reliability, inspection, intrusive probes and coupons, pigging, uidsampling, chemical injection, and mitigation procedures, andstudies. As with all good science and engineering it is vital toquantify critical parameters, and to that effect the concept of keyperformance indicator (KPI), has been modied and applied to IMstudies (Singh, 2007; Singh et al., 2006; Singh & Krishnathasan,2008). Thus, the qualitative nature of risk-based judgments ishoned to a more easily repeatable and consensus-based decisiongate system. Some examples of recent KPI studies and their appli-cation are presented later. These must always be considered andapplied and agreed on a project-specic basis, with the appropriatesign-off from subject-matter experts in materials, corrosion,CP/coatings, etc. Most career offshore engineers do in fact observenear misses on a regular basis, with incidents related to re, leaks,mechanical integrity, topsides equipment, poor inspection, etc.,being responded to with duly diligent team actions. However thepotential for mishaps is always there, especially where corners arecut to meet production and cost issues. This Achilles heel willalways be there but hopefully minimized as leadership and theindustry progress.

1.6. ALARP, corrosion hazard, and inherently safe design

The commonly accepted approach to safety assurance orALARP is now to ensure on the basis of suitable and sufcientevidence that risk is as low as reasonably practicable (ALARP).The concept of ALARP is often interwoven into the risk analysisand/or safety management from the very beginning (JP Kenny,2008; JPKeIonik, 2005e2008; Singh et al., 2006; Singh &Krishnathasan, 2008) Corrosion must be considered a func-tional hazard for this approach to be applicable. Fig. 4 depicts theALARP triangle with the processes and descriptions for eachsegment. Further, since there is a lack of code guidance perinternal corrosion, one way forward is to use the concept ofALARP to dene the limitations or boundaries of the corrosionparameter, and therefore aid (technical and legal) argumentdefensibility. Since inherently safe design (ISD) is often perceivedas a costly CAPEX discipline, there is a forceful argument thatsuggests that by strongly utilizing ISD in the Integrity Manage-ment basis (typically by best materials selection, geometries,chemicals, etc.) then coupled with concurrent changes, revisions,MOCs, etc. in the same vein, a truly best practices regime can beset up. The cost factors are easily justied by reduced OPEX costsover the life cycle. However the pay now or pay more latertheory has never fully made the grade, and in reality it usuallytakes an event like the Piper Alpha or Carlsbad (New Mexico,USA) before signicant paradigm shifts in attitudes are made,even then only with the force of regulation. Alternatively theJoint Industry Projects (JIP) might be seen as the conduit for besttechnology advancement and best knowledge interpretation and

he Process Industries 23 (2010) 936e953management in this regard. Once concurrent design and ISD

Note 1: perceptions asterisked (*) are best given as localized, encompassingmultiple mechanisms. Also all high-risk phenomena can be mitigated down to low

in tmove closer towards amalgamation then the case for concurrentand inherently safe design (CISD) may become a universitytaught and thus industry practiced discipline.

There are actually more than 10 recognized mechanisms ofcorrosion, viz: 1) uniform corrosion, 2) pitting, 3) crevice, 4)erosion (including impingement/cavitation), 5) galvanic, 6)selective leaching, 7) intergranular, 8) fretting/wear, 9) stresscorrosion cracking (SCC), corrosion fatigue, hydrogen damage,embrittlement, etc., 10) Other creep/embrittling, etc. (JPKenny/University of Houston, 2008). For offshore and subsea condi-tions the critical mechanisms are a function of reservoircomposition; and the most dangerous threats are therefore CO2(sweet) corrosion, H2S (sour corrosion and cracking), bottom ofline (BOL), top of line (TOL), and microbially inuenced corrosion(MIC). Once at the tactical stage it is found that corrosion undermultiphase hydrocarbon ows presents the most challenging and

Fig. 4. The ALARP triangle depicting the importance of corrosion risk assessment inthe risk management and loss prevention exercise. Having the right blend of multi-disciplined engineers is key to success if multi-facetted failure mechanisms and rootcauses are to be properly addressed.

B. Singh et al. / Journal of Loss Preventionintegrity-threatening condition. This problem area has plaguedthe industry for many decades. In the USA the challenge is beingmet by the continued growth of two major JIPs, at Ohio Univer-sity under the auspices of Nesic et al. (Ohio University, 2007), andat Tulsa University under the guidance of Rybicki et al.(University of Tulsa, 2007). Both JIPs effectively tackle and modelcorrosion and erosion and MIC modes of failure through anexhaustive combination of theoretical modeling, empiricaltesting, and eld trials. This work seems to be leading the wayglobally and in the absence of bone de codes of practice andstandards, the JIPs are commonly used as a reference point. Therecommendations coming out of the JIPs are membership sup-ported (largely operator companies and key consultants, engi-neering companies, etc.), and thus their ndings have receivedsolid acceptance industry wide. The balance of academia andindustry ensures that the decision-making process is not skewedby overriding commercialism. Ultimately these will tend to beperceived as the industry standards, lling the void that has longbeen present. The results are applicable to all assets tension legplatform (TLP), mobile drilling unit (MODU), spar, xed, subsea,topsides, etc. provided the appropriate expertise is deployed toallow for the subtle differences across assets and systems, inother words, from both sides of the aisle: from the operator andthe engineering contractor (IONIK JIP, 2008; Jukes, Singh, Garcia,& Delille; Singh et al., 2006).

2005e2008; Singh et al., 2005). This is reected in the weakargument often used that the design complies with the regulations.That alone is not enough, it may be a minimum requirement, butlife-cycle tness-for-purpose is really about managing allmechanical and corrosion-related degradation mechanisms,including: stress overload, embrittlement and loss of materialproperties, and natural wear and tear i.e. dissolution of the metalunder aggressive environments.

2.1. New build versus old build

Most new engineering applications (green eld) invariablyinvolve a design code or recommended practice as a reference point.These are usually industry-accepted guidance documents that havebeen developed over many years, been through many cycles of peerreview, and tested via experience, case history, etc. Reference toestablished codes gives the design and end client credence andcondence in itsworkability. One example of that is pipeline cathodicprotection (CP) and coatings, whereupon code compliance (DetNorsk Veritas (DNV), International Standards Organization (ISO),NACE International e The Corrosion Society.) is a good yardstick forsuccessful external corrosion control. Unfortunately, that is not the

fcase for internal corrosion, largely because the mechanisms ocorrosion are complex and often multifaceted (Jepson & ResearchAs with all engineering projects, commercial aspects, projectviability, return on investment (ROI), schedule, etc. are pivotal toproject success. The net effect is that in many, if not most, cases theproject remit becomes design to build rather than the preferreddesign for the life cycle. This often adversarial development is, onthe one hand, good in that it stimulates solid, provocative discus-sion, and thus best workable t-for-purpose solutions can beattained, however if materials engineers are not strong enough todebate their corner hard and strong, weaknesses in design leadingto failures down the road can be expected. The only real questionbeing, where, and when, rather than if, as a result the competitiveforces at work, namely the need for revenue as against best safetechnology (BAST), is often a battle of being smart to out smartoften identied as the Achilles heel in the IM process (JPKeIonik,

risk with diligent, motivated, surveillance and corrosion management proceduresprovided they are, in fact, fully implemented.Note 2: the assessment of risk can be qualitative, or semi quantitative. The high-,medium-, and low-risk (HML) nomenclature has been adopted for simplicity andconsistency. HML must always be assigned by materials/corrosion specialists and,where possible, have justiable and defensible arguments as support.Note 3: the use of industry-accepted HML risk designations and simplied go/hold/no go (green, amber, red) trafc signal type decision gates is a really good evolutionin the design and operational integrity management process.2. Corrosion mechanisms per upstream and subsea

Uniform corrosion Well addressed via theory, monitoring good-viablePitting corrosion Modeling difcult but R&D done, relevance high risk*Crevice corrosion Relevant modeling used, relevance medium riskGalvanic corrosion Modeling hard (danger mesa scale related attack),

medium riskStress corrosion Empirical/experience, medium risk and reliability

in practiceErosion corrosion Modeling used-relevance high risk*Corrosion fatigue Interpretative used-relevance high riskMIC Very subjective, separate JIPs underway at

Ohio/Tulsa Univ. e risk high*CO2 corrosion Modeling underway used-relevance very high*H2S corrosion Modeling underway used-relevance highTOL Now better quantied e as part of separate

JIP study at Ohio University.

he Process Industries 23 (2010) 936e953 941Workers, 1999e2002; Marsh, 2007; Nyborg, 2002; Nyborg &

in tDugstad, 2007; Ramachandra, 2007; Singh, Krishnathasan, & Ahmed,2008). It has therefore been necessary to develop methods of reso-lution, the most popular being that of corrosion modeling. The mostcommon threat to pipeline integrity has been mixed CO2 or sweetcorrosion. In reality even with the large amount of corrosion workdone over several decades, absolute values of corrosion rate stillcannot be reliably predicted without reservation using any of the 15or so models available (IONIK JIP, 2008; JPKenny/Ionik; Nyborg,2002). All the models can really do is give a general guidance as tothe corrosivity of the media involved. Thus it can be construed thatthe main objective of corrosion modeling or corrosion assessmenthas evolved to differentiating (at build) whether or not the carbonsteel will be acceptable as the main owline material, or, if not,weather the analysis justies the use of CRAs as the design basis. Theimpact of this decision can be crucial since the CAPEX/OPEX ratio isgreatly affected and will often make or break the project. Thus, thevital need for the corrosion predictions to be pragmatic and done tothe best possible reliability. In practice the greatest criticisms of themodeling approach have been the noneagreement of calculatedcorrosion rates to the observed eld values. For deepwater applica-tionswhether subsea at>4000 ft, at the steel catenary risers (SCR), oron the host facility (e.g. TLP/SPAR/MODU, etc.), there is little room forerror, since repairs or retrot can be very costly or practicallyimpossible. Nevertheless the deepwater campaigns continue and it isup to engineering companies to offer justiable but realistic solutionsand where proven data or correlations are not available, reasonablerisk-based ALARP driven decisions are considered justiable. Thesame arguments apply for old build (brown eld), whereuponexisting assets often badly corroded need to be assessed forremaining life and ongoing corrosion. This can be a challenge ascritical parameters such as existing pre-corrosion condition and/orexisting inspectiondata arenot always readilyavailable. Neverthelesspredictive modeling does serve a useful purpose in this regard,provided the caveats are dened, understood and accepted by theclient (Jepson & Research Workers, 1999e2002; Marsh, 2007;Nyborg, 2002; Nyborg & Dugstad, 2007).

2.2. Rules, regulations and inherently safe design

Ultimately the integration of ISD into mainstream engineeringpractice will almost certainly happen, though as alluded to earlierthe combined efforts of academia and regulatory authorities willbe the most likely catalyst. Whilst external sea water corrosioncontrol is regulatory driven, the case for internal corrosion is onlyheavily implied though not specically regulatory or codecompliance driven, however that will probably change and regu-lations in most regions will likely refer to best practice modelingor corrosion analyses to ensure that corrosion integrity isaccounted for within the integrity management process (Singhet al., 2006). That change was expected to be imminent and maystill happen within the Federal Rules though there is a powerfullobby against the changes such that the rule change approval maybe delayed (Singh & Krishnathasan, 2008; Wood Group HSEMatters, 2008). The onus is, therefore, on diligent designers toensure that best safe technologies and techniques are utilized tounderstand and predict corrosion mechanisms and corrosionrates, such that failures can be eliminated or arrested to tolerablevalues. As far as the GOM region is concerned a mixture ofprescriptive and performance related criteria are applicable. Inparticular the Government Mineral Management Services (MMS)now slated to be the Bureau of Ocean Energy (BOE) have denedpotential incidents of non-compliance (PINCs), and these may beinterpreted as a corner stone boundary condition for predictivecorrosion control to help focus the designers attention and atti-

B. Singh et al. / Journal of Loss Prevention942tude towards safety (Singh, 2007; US DOI-MMS, 2007). Similarlythe Federal Register may be used to support the requirement fordiligent corrosion assessment and management thereof(JPKeIonik, 2005e2008; US DOI-MMS Federal Register, 2007). It isrecommended that these be used on a case-by-case basis, thoughspecic differences (usually more onerous may be relevant ifNorth Sea rules and the Safety Case are applied). In practice, forsteel that means the development of a pragmatic corrosionallowance. It has been found that the best way to do this ina convincing and reasonable manner is to utilize interpretation ofthe relevant and available rules and codes of practice, suitablemodeling calculations, industry experience and best judgment.The US federal regulations have stirred debate in the US, and thereare some criticisms as well as positives. Overall, the industryseems to have embraced the impending rules (DOT Regulations; JPKenny, 2008; US DOI-MMS Federal Register, 2007). The mainadvancement is likely to be a greater specicity regarding internalcorrosion, perhaps more akin to the UK goal-setting requirements.The modeling we do should anticipate that and hopefully theseguidelines presented will provide a framework for that. The rulesare US-specic but should serve as a template for defensiblecorrosion prediction, which is all the more important in an ever-more litigatious society (IONIK JIP, 2008; NACE, 2007).

As alluded to previously there are many models available,(likely> 15) e.g. Norsok M506, Cassandra 93/95, ECE, Hydrocorr,Lipucor, Multicorp v4 (Ohio JIP), OLGA (corrosion moduleinclusive), Predict/Socrates, Tulsa SPPS (Tulsa JIP), ULL model andothers, and whilst most have individual strengths and weak-nesses, the common critique is invariably unreliable correlationto the laboratory and more importantly eld experience (IONIKJIP, 2008; Nyborg, 2002). As a rule almost all have little provenconsistency of condence to eld observed corrosion rates. Thisis mainly due to the fact that the designs attend essentially onlyto the base CO2 corrosion case, and exclude a truly meaningfullocalized component, though some claim, and more and more aretrying to include, this and other inuencing parameters. Theproblem seems to be that the localized component is rarelyaddressed in a transparent manner, with no reference to local-ized criteria or parameters such as crevice/deposit size, stagna-tion uid chemistry, crevice pH, differential aeration, etc.Nevertheless, the use of a suitable modeling or JIP study wouldno doubt be accepted as a supporting reference to the regula-tions. Generally most models have a black box critical analysis,though the JIPs appear to be more transparent at least to themember companies. The research is still closely guarded thoughit has evolved to be more pragmatic and project risk-orientated(deterministic/theoretical). It is expected to have solid calibrationcapabilities with ultimately, a ow assurance-linked corrosionmodeling package seemingly viable, perhaps, by individualmember companies. The latter is difcult but would have thegreatest impact if it could wrap up ow assurance, corrosion, andsafety inextricably to production and, therefore, revenue. This isa controversial argument but one that would help eliminate thepressures on project managers, offshore installation managers(OIM), and other decision makers to continue with producing,often under fault conditions. That was seen to be quite possiblythe ultimate snafu in offshore history, when adjoining platformscontinued to fuel the res on the hapless Piper Alpha (BP Booklet,2004; Coastal Training Technology Corporation, 2007; LordCullen Report, 1990; Singh et al., 2006).

3. Offshore corrosion failure case histories

Even post Piper Alpha there have been many integrity andcorrosion-related failures, and some of the more important types

he Process Industries 23 (2010) 936e953are presented for illustrative purposes only. It is clear that most are

now expanding beyond the closely knit operators to the engi-neering design houses and consulting groups. This should be ofmuch advantage to the industry as a whole by infusing an alter-native layer of checks and balances to drive the research for betterunderstandings and ergo better solutions. A number of examples(Case Histories # 1e5) illustrate the role of corrosion in the integ-rity management process. The rst is, perhaps, the rst US equiv-alent of Piper Alpha, in that it led to strident changes in regulatoryrequirements via the Dept of Transportation (DOT) (NTSB; DOTRegulations). The remaining examples are chosen to representthe types of failure most commonly witnessed; there are manyothers available in the literature and industry project les (JPKenny, 2005e2008; Singh et al., 2003; WGIM Internal TrainingModules, 2000e2008).

3.1. Case history # 1

Top plate aftermath of the Carlsbad, NM, pipeline failure, Aug2000. Tragically 12 outdoor campers were deceased. Root causedetermined a combined corrosion mechanism dominated bychloride/CO2/microbial as exemplied in the micro image below.Noting that the corrosion was concentrated at the girth and seamwelds at the bottom position, with 72% wall loss, adapted (Kletz,1998).

Age 10 years, no on-line monitoring, produced water systemsensitive to poor protective lming, adapted (Singh et al., 2003).

3.3. Case history #3

Catastrophic failure of choke sleeve on offshore facility. Failuremechanism analysed to be combined erosion/cavitation andimpingement. Impinging cavitation forces can far exceed the proofstresses of most alloys adapted (Singh et al., 2003).

3.4. Case history #4

Sweet (CO2) corrosion is probably the most insidious type oflocalized corrosion observed in pipelines and topsides pipework.The many worldwide applied R&D projects are geared around thisdangerous mechanism. Adapted (Singh et al., 2003).

in the Process Industries 23 (2010) 936e953 9433.2. Case history # 2

Depicting failed manifold on a xed platform due to isolatedsolvable by better using existing knowledge and widely availabletechniques, including more recently, existing modeling predictivetechniques, such as those offered by the JIPs, many of which are

B. Singh et al. / Journal of Loss Preventionerosion defect of the steel upstream of an inhibitor injection point.

downs. The corrosion defect propagation is often during steadystate operations, but must usually be addressed at initiation ifcorrosion control is to be effective. That invariably requires veryclose monitoring, recording and analysis of critical pressure,temperature, velocity (PTV) data as well as close scrutiny and timeperiodicity of inhibitor dosing losses, etc. That is more viable nowwith the new generation of multiphase ow meters out on themarket. As a rule, loss of corrosion inhibitor for more thanapproximately two to three days in a row is not tolerable, anda total of 18 days per annum is the equivalent to a 95% availabilityfactor. The guaranteed performance of corrosion inhibitors undercocktailed (mixed ow assurance chemicals) is a vital requirementin many solution options (JPKeIonik, 2005e2008; Marsh, 2007;Singh et al., 2008).

4. Hierarchy and rules

in tOnce the main corrosion threats are identied, it is usual toformulate a corrosion management strategy (CMS) plan of action.The hierarchy or order of such events is best expressed as follows:

CMS> Inspection >Corrosion Monitoring >Pigging >Mitigation/Control

Once the sequence has been applied on a component-by-component or segment-by-segment basis, an appropriate written3.6. Case histories footnote

It is quite common for a precedent to be found in most failurecase examples, so that industry wide cross asset lessons learned area powerful tool. However not all case histories are reported(company condential), and so analysts often end up re-inventingthe wheel in terms of solutions, although every now and thena unique new mechanism or mode of failure is unveiled (API 580,2002). The most challenging corrosion failures are seen to beinstigated during transient or excursionary physical or chemicalconditions, often at start up, commissioning or unplanned shut-3.5. Case history #5

The left hand side (LHS) showing over-active deep-sea anodes,possibly due to inadequate alloy chemistry, and/or high quantitypresence of uncoated steel or local CRA components. The right handside (RHS) showing excessive aking of Thermal Spray Aluminum(TSA) coating accelerated by uncoated steel or possibly CRAs in theimmediate vicinity. Both thought to be within one year, observed atrst ROV inspection (Deepwater Corrosion Services Inc, 2008).

B. Singh et al. / Journal of Loss Prevention944continued-tness-for-purpose statement should be made, ona three or six month basis at rst year for new facility depending onproduction water cut realized in practice and thereafter on anannual basis, with sign off by appropriate technical authorities. It isconsidered that within the modern offshore industry, the majorcorrosion-related threats are:

Sweet/sour (CO2/H2S) corrosion (under close attention of JIPs) Under-deposit corrosion (particulates or sand) Dead leg corrosion (mini or maxi stagnation uid sites) Sand erosion high-velocity impacts at bends, tees, etc., but alsoat straights

Microbial episodic biolms in particular TOL corrosion, mainly per gas lines Loss of passivity at the CRA surfaces must be assessed for all(i.e. oil and gas lines)

All the above threats should be quantiable with diligent inte-grated on-line corrosionmonitoring (coupons/probes/uid analyses/ultrasonic (U/T), etc).

The target corrosion rate for steel should be set at 0.1 mm/y andall chemical, PTV adjustments focused around that thresholdnumber. As guidance deviations to 0.15 mm/y may be tolerated forshort periods (

veney i

in tNORSOK Standard M001, 2004; Ohio University, 2007; Poblete,Singh, & Dalzell, 2007; Private Correspondences with Messrs BenPoblete (LR/Cameron), 2000e2008; SCOTA/UKOOA, 1995; Shreir,1994; Singh, 2007; Singh et al., 2003, 2005; 2006, 2007; Singh &Krishnathasan, 2008; Smart, 1990; UK HSE, 2001; UK HSE/TUV-NEL, 2003; UMIST/University of Manchester Corrosion Center,1983e1995; University of Tulsa, 2007; US DOI-MMS, 2007; US DOI-MMS Federal Register, 2007; Vars Operator Standardization; WGIMInternal Training Modules, 2000e2008; Wood Group HSE Matters,2008) and as such may be used as a preliminary guidance docu-ment. Erosion corrosion is still a major threat to offshore and subseaassets, with related failures being thought to account for more than30% of all internal degradation-related hydrocarbon releases, or lossof containment (Private Correspondences with Messrs Ben Poblete(LR/Cameron), 2000e2008; JPKeIonik, 2005e2008; SCOTA/UKOOA, 1995).

Since the mechanisms of corrosion and erosion acting together

Fig. 5. Showing a 5 5 risk matrix based on high-, medium-, and low-risk corrosion econsequence of the failure. Many matrices are used ranging from 3 3 to 10 10. The kthe implications (JPKeIonik, 2005e2008; Singh & Krishnathasan, 2008).

B. Singh et al. / Journal of Loss Preventioncan be very intricate and multifaceted, in practice help to addresscorrosion and erosion issues, engineers often resort to a rst passmethodology of establishing corrosion rates and derived corrosionallowance (CA), and thereafter using an additive assessment for theerosion parameter. Useful guidance on the concept of CA can beobtained from many sources (Kletz, 1998; Lees, 1980; Lord CullenReport, 1990; Mueller, 2006; Neal, 2007; NTSB). And if the corro-sion rate can be worked out from historical data or from modelingstudies (i.e. the commercially available models or the publiclyavailable freeware such as Norsok M506 or Cassandra 93/95) thenan adjudged allowance (usually consensus agreed with the client)for erosion can be made (JPKeIonik, 2005e2008).

It should be remembered that the models only give general oruniform corrosion rates, and that the real value in corrosionmodeling is not so much the absolute values but the trends andchanges. Also using more than one model allows a cross-checkingdevice (use any three of the freewares availableeNorsok, Cassandra93 and Cassandra 95 at minimum, and use commercial models ifavailable). In cases of major conict or disagreement it is alwaysrecommended to use the worst-case corrosion/thinning values forbest conservatism. There are many corrosion and erosion modelscommercially available (>15) and if access to these is available theseshould be explored, however, if not there are options outside thatapproach, since many similar software packages are often availableas in-house spreadsheets or issued by certain companies forproject-specic analyses. Either way, the real value of corrosion andindeed erosion modeling is mostly in helping the decision-makingprocess per materials selection and the differentiation between theuse of carbon steel or the alternate CRAs (JP Kenny, 2008; Singh &Krishnathasan, 2008).

4.2. Guidance and caveats

For carbon steel, typically for low-risk erosion rate scenarios thismight be quantied at KPI values of 0.05 or 0.1 mm/y (JPKeIonik,2005e2008). If medium or high risks of erosion are present thenmore advanced analyses available from independent testing or thevarious JIPs already in place, such as at Ohio and Tulsa universitiesmust be performed to assess this parameter (Ohio University, 2007;University of Tulsa, 2007).

In practice such values could be up to and well in excess of10 mm/y. Therein sits the predicament for the corrosionist, namely

ts. The interpreted risk of failure is usually depicted as the product of probability ands to quantify within the context of pre-agreed needs and ensure all parties understand

he Process Industries 23 (2010) 936e953 945what data to use to support ones design rationale. The subject isever complex and such decision making often has to rely on theplanned design economics and the project costs entailed capitalexpenditure (CAPEX) versus operating expenditure (OPEX) (Singhet al., 2005, 2006). In any event the solutions must be t for thelife-cycle targeted, and typically may either use thicker steel(greater corrosion allowances) or stipulate the use of a morecorrosion-resistant alloy (CRA). The latter may be solid pipe or steelpipe lined or clad with CRA, typically at 3e4 mm thickness. Lessthan 3 mm is not recommended due to possible mechanicalwrinkling effects that would impact the integrity of the liner(JPKeIonik, 2005e2008). Table 1 shows typical best practice CRAsconsidered for the offshore industry. Regarding the ongoingevolution of inherently safe design it is interesting to note that evenafter so many years since the Piper Alpha there is still signicantproject resistance to the formulation of safer designs, and bettermore inherently safer materials selection, even though on balancetotal costs and economics are favorable over the complete life cycle.

5. Inherently safe design

The technical challenge from an engineering perspective is toaccept that corrosion initiation often occurs under non-steadyconditions whilst propagation thereof is often under steady stateoperation. In practice such problems at excursionary conditions,

in tcan lead to conict between the codes, inaccurate prediction oferosion/corrosion, accelerated damage of chokes, bends, jumpers,and discontinuities, etc. Some of these difcult but denable trendscan be addressed via interrogation of commercially availablecomputational uid dynamic modeling (CFD) such as the variousow assurance type modeling, as well as specic operator experi-ences as for susceptible connecting jumpers in particular. And thereare promising solution options with internal coatings/clad/liners,but care should be taken to alleviate changes in local surfacepolarization at undercut sites, localized eddies and temperaturegradients, etc. Nevertheless the intensive use of reliable corrosionand erosion monitoring such as intrusive (probes and coupons),and non-intrusive (acoustic transducers), eld signature methods(FSM), ring pair corrosion monitoring (RPCM) spools (orequivalents), guided wave ultrasonics, wall thickness mapping,thermal imaging, etc., are proving to be very good early warningsystems for high-risk components (JPKeIonik, 2005e2008). Theclose synergy between ow assurance and corrosion integrity isnow more apparent and many companies are now quite success-fully, and to signicant technical advantage amalgamating suchgroups (JPKeIonik, 2005e2008; Singh & Krishnathasan, 2008;Singh et al., 2008).

From a mechanical integrity perspective it is very important forengineers to think carefully beyond the immediate design codes ofpractice, since corrosion and degradation can kick in fairly soonafter start up, often with major degradation issues and problemswith continued operability or tness for service. To that effectengineers should consider utilizing the principles of inherently safedesign (ISD) to build in sufcient conservatism and safety (Dalziell,2004; JP Kenny, 2008; JPKeIonik, 2005e2008; Singh, 2007). Someimportant denitions as part of broad ISD and integrity manage-ment programs can be described as follows:

HAZARDS e Materials degradation, loss of mechanical prop-erties or corrosion must be considered a hazard, thus betterlegitimizing the risk-based approach, dening: corrosionriskw probability corrosion failure consequences. Bydening corrosion as a bone de hazard, in this way allows the

Table 1CRA localized corrosion tendencies, as risk exemplied by pitting resistanceequivalent (PREN), critical crevice temperature (CCT) and critical pitting tempera-ture (CPT), interpretation oileld only.

Alloy PREN CCT (C) CPT (C) Localizedcorrosion risk

304 Stainless steel (SS) 19 316LSS > 304LSS.

The values are thought to bemore applicable to static conditionsand not sensitive to ow, though in principle if the ow regime canalter the pitting potential then some sensitivity could be recognized.Hence in principle standard laboratory assessments should alwaysbe supported by non-standard and fully representative testing andeld observations. To that effect authoritative suggestions for non-standard, pressureetemperatureevelocity (PTV), upset, or chemicalexcursion corrosion testing, within the JIP test rigs, etc., can bemade. Hitherto thesewould be considered strictly steady state only.

From a predictive erosion perspective it is important to allow fortotal wall thinning due to corrosion and erosion type degradationmechanisms. Generally if this calculation shows a total corrosionallowance (CA) value of CA> 10 mm then intervention via a suit-ably selected CRAmaterial either as a solid material or as a lining orcladding option is often considered. Some operators put thisthreshold at 8 mm (or even 6 mm depending on the level ofconservatism supported). Either way the nal decision is based onthe economics of the project and the cost implications both atcapital expenditure (CAPEX) and operating expenditure (OPEX)stages of the project. Another major factor is the length of thepipeline, generally speaking pipelines beyond 15 km length willtend to look more closely at carbon steel with highly diligent andaggressive rst-in-class chemical inhibition typically with >95%efciency and >95% availability. Internal coating options are alsofeasible but would likely still need parallel inhibition schemes tocover for the protection of damaged coating sites. The inhibitors inthat case would need to be highly procient at addressing suchsites under crevice corrosion conditions. Designers should engagethe services of experienced chemical vendors in this subject matter.Where required, the most frequently used alternative CRA materialchoices tend to be the nickel alloys, alloy 625 and alloy 825, withthe martensitic and austenitic stainless steels also commonly beingused, typically 13% Cr and 316SS respectively. Most projects thesedays are often schedule driven, meaning that fast but detailedadvice is sought through guidelines from many sources, societies(NACE, API, ISO, etc.), and the various JIPs, industrial and academicsources now available (JPKeIonik, 2005e2008; Ohio University,2007; University of Tulsa, 2007).

6. Corrosion, ISD, integrity, and KPIs

As part of any inherently safe design or study, any corrosionmanagement strategy (CMS) used must be a fully auditable witha unied approach to retaining integrity of the production facilities,and to meet all goals for safe operation, environmental protection,owline availability, and revenuemanagement. One provenmethod

he Process Industries 23 (2010) 936e953for that is the quantiable key performance indicator route.

of which is usually corrosion risk, but also other associated integrity

Ratio ow assurance steady states/unsteady states (excursions)

in tthreats within qualitative and quantitative ISD boundaries asshown below:

Internal corrosion, external corrosion, corrosion under insu-lation (CUI), erosion; Noting that CUI can be realized as a majorthreat if piping/vessel insulation gets sodden e.g. via re waterdeluge testing.

Environmental cracking e stress corrosion cracking (SCC),sulde stress cracking (SSC), hydrogen embrittlement, corro-sion fatigue/vibration/fretting damage, etc.;

Embrittlement phenomena (clamps, anges, prematurefasteners/nuts/bolts failure due to intermetallic phases, seizing,galling, etc.);

Time dependent failure effects per localized corrosion, mechan-ical fatigue and thermal creep, and conversely cold temperature lossof properties, toughness, etc.;

Damage resulting from accidental impact or structural over-load, of particular interest to liveowline segments,manifolds,vessels, members, etc., linked to or carrying production uids;

Damage from welding stray currents during installation andcommissioning operations on/offshore;

Malfunction of protective safety devices, and loss of reliabilityto include corrosion scale build up, overheat for critical elec-trical cabinets, control units, electrostatic discharges, etc.;

Design, material, fabrication and construction defects, prob-lems counteracted by specialty treatments such as owassurance additives, corrosion, and scaling inhibitors, etc.

6.1. Primary KPIs dened (corrosion)

Individual corrosion rates interpreted from the coupon and ERdata are time dependent, and can be dened via corrosion loops(i.e. parts of the infrastructure or systems that are expected to yieldsimilar corrosion activity). For example, horizontal owlinesegments, vertical segments (SCR), hull piping, etc., or indeed suchloops may be dened to cover for a specic high-risk mechanism,such as Corrosion under Insulation (CUI) across all systems. TheseKPIs are guideline examples only and would be ne tuned ona case-by-case basis. Bearing that in mind we can dene theprimary corrosion KPIs as follows:

All corrosion rates to be 100 colonies/cm2 e red ag);

Total iron deposits< 1000 ppm (often arbitrary threshold,verify per chemical vendor);

Organic acids prefer 200 ppm, red ag> 500 ppm);

Residual inhibitors to be dened and maintained e.g.>125 ppm (or per vendor).

Cleaning pig runs and sampling residues targeted at one permonth minimum, or better as data dictates. Integrated piggingand corrosion monitoring to adjust inhibitor dosing rates.Intelligent pig runs to be considered every 5 years.

6.3. Other valuable KPIs

Specic KPIs for external CP and external corrosion underinsulation (CUI) usually need to be specically developed, forexample the SCR/owline CP potentials (versus Ag/AgCl cell) arenow reasonably well established at:

900 to 1000 mV dened as well protected 800 mV dened as out of compliance (typically observed All inhibitors (including cocktail mixtures used) to be efcientat >95%;

All inhibitors (including cocktail mixtures) to be available at100% (minimum ideally >95%, accept >90%);

Inhibitor dosing pumps to have >97% availability with redun-dancy as necessary;

Topsides leak rates minimized e appropriate settings peroffshore asset MODU, TLP, etc.;

Key physical and chemical variables monitored for operationalenvelopes, and to be within 10% of steady state values, toeliminate corrosion driving upset conditions;

he Process Industries 23 (2010) 936e953 947700 to 800 mV)

political challenges that are facing the industry. Such engineering

in t6.5. Predictive modeling

The use of predictive corrosionmodeling has been focused on thehigh-risk CO2/sweet corrosion areas pertinent to offshore applica-tions. This has been the case for core predictive tool for pipeline,owline and piping corrosion integrity design. Unfortunately theagreement between actual eld practice and these predictions hastended to be poor; this is due to a number of factors, typically:

Models assumeuniformwastage (in reality hardly ever the case); Models do not allow for localized corrosion, though someclaims are made;

Models do not include other mechanisms (erosion, pitting,microbial, etc.);

Outputs can be erroneous because inputs are often nonrepresentative;

Key parameters such as uid shear stress at the wall are notwell dened.

Flow assurance aspects are not fully attended.

It is reasoned that the main materials selection and corrosionassessment output or deliverable should be accepted as being thecorrosion allowance, but with emphasis that this is but step one inthe corrosion management exercise (JPKeIonik, 2005e2008).Nevertheless, this is the key variable that can quite literally decidethe viability of a major subsea project. Therefore for a typicalproject we can focus on the pipeline corrosion integrity, andconrm optimum CA values for effective life-cycle operations.Invariably this will depend on the steady state design envelopesdescribed and maintained, via compatible inhibitors diligentlyapplied. To deliver this, it is suggested a denition of project-KPI denitions for CUI are very project specic and temperaturerelated and are omitted herein for reasons of brevity andcommercial sensitivity.

6.4. Secondary KPIs dened (reliability)

KPIs pertinent to reliability are described below for owlinesegments, pressure systems, and critical components. Most will bedata-base driven and using the TLP existing maintenance workbooks as benchmarks:

Overall system production time availability e a commercialtarget (e.g. >95%);

Minimum system production availability e commercialdecision;

Ensure 100% inventory and spares for all critical items; Maintenance free operating period e MFOPwminimumfailure free operating period, repair time e compare equivalentitems on similar assets

Overall run time e compare equivalent items similar assets Failures rates (rotating items e.g. # failures per 100,000 h); Failures severity (HML equivalent to: dangerous, degraded,incipient);

Failure severity mitigation (HML equivalent to: urgent,deferred, minor);

Failures rates per type of equipment e compare equivalentitems similar assets

Damage rates per vibration/fretting issues e compare equiva-lent items similar assets.

Other decisions not covered directly may be addressed asALARP linked KPI issues.

B. Singh et al. / Journal of Loss Prevention948specic KPIs are made, and some examples are given below:must involve the development of non-standard corrosion testing(eld and laboratory) often under accelerating conditions.

Clearly to quantify KPIs requires data, ideally live eld data, andto that effect there are many corrosion monitoring techniquesavailable. The most appropriate to offshore industry are commonlydescribed and vetted for their advantages and disadvantages asthey pertain to a successful project-specic corrosion and integritymanagement regime (JPKeIonik, 2005e2008). Typically, the mostefcient are the removable coupons, electrical resistance (ER)probes, linear polarization resistance (LPR) probes, biostuds, uid/residue sampling, acoustic techniques, area U/T and various in situspool mapping methods (JPKenny/Ionik; JPKeIonik, 2005e2008;SCOTA/UKOOA, 1995). Other advanced techniques such as a.c.impedance, electrochemical noise, hydrogen patch probes, etc., areavailable but are rarely used beyond the laboratory. Scalemeasurement devices with advanced monitoring and pigging arealso under review (JPKeIonik, 2005e2008).

6.7. Mechanical aspects and inherent safety

Materials, corrosion, and the chemistry of the environment are Operating P, T, V, values and chemistry are maintained atsteady state values (e.g. 10%). Excursions beyond that shouldbe

Hydrate management: To prevent and manage hydrateformation, combination of either chemical treatment and/orthermal insulation may be used.

Wax/asphaltene management: To prevent and manageparafn deposition, a combination of thermal insulation,chemical treatment and pigging may be used. A cost/benetanalysis of these solutions should be conducted before nalselection of a parafn management strategy is made.

Liquid slugging: Transient, dynamic analysis of the owlineand risers must be conducted to evaluate the potential severityof liquid slugging. Based on this type of analysis, an appropriatestrategy to control slugging can be developed.

Erosion: Various types of sand and erosion monitors areavailable for installation within/on subsea tree and manifoldpiping. These devices (ERe intrusive or acoustic non-intrusive)can be used to monitor erosion and optimize well ow rates,often well above the API-recommended limits (API 14E RP).

Corrosion: The recommended material solution may be the

in tengineering. To that effect it is vital for offshore teams to be mul-tidisciplined, and typically that would require expertise in the areasof pipeline, topsides, metallurgy, corrosion, cathodic protection/coatings, process chemists, etc. These disciplines must cohesivelyt into an advanced offshore pipeline project, especially if new(greeneld) designs are to be inserted into older (browneld)infrastructure. Thus strong technical leadership, and core compe-tency are crucial to making the new challenging designs workable,and to a degree inherently safe, and to that effect qualied andexperienced people are vital, with the will and motivation toengage in contentious often adversarial debate. Much of which isfound to be best achieved at the interface between academia andindustry via the operator-sponsored JIPs. The role of academiataking the lead in this process cannot be overemphasized as thebest placed tempering organization.

For deepwater assets (>3000e10,000 ft) the arguments for assetintegrity become more critical since inspection, retrot, repair, etc.,become extremely costly, dangerous and often impractical, thusforcing materials engineering to be highly predictive in nature.There are many parameters, most of which are interrelated, andshould therefore not be considered in complete isolation. Invariablythe key driver is the revenue and savings combination. If thesetargets cannot be met, the project may be blocked. Thus materialselection, corrosion, assessment, welding, CP/coatings must beinherently safe and optimized to be cost effective.

These are real engineering challenges on top of basic mechanicaldesign to resist stress, hydrostatic collapse, ow assurance, risersystems, installation techniques, component operational perfor-mance, etc. Typically wall thicknesses have to be relatively thick,making a heavy pipe string, and thus have signicant impact oninstallation lay barges and existing equipment capabilities. Once inplace there is little room for error, or remedial action, thus designshave to take cognizance of best workable solutions, which are oftenexercises in knowledge management across assets and indeedregions (Singh et al., 2006).

There are a number of engineering challenges regarding theow assurance and related scaling issues within pipelines. Hydrateformation, wax behavior, erosion, and multiphase ow (JPKeIonik,2005e2008). These are matters that need to be addressed. Inade-quate design in this area can lead to unwanted blockages, downtime of pipelines, and therefore loss of valuable productivity.

6.8. Design code application and limitations

There is a considerable grey area of uncertainty regarding theinterface between mechanical design codes and corrosion. Oftenthis needs to be plugged in by corrosion and integrity engineeringusing best risk-based judgments.

There are a number of pipeline design codes, and each one isdifferent. In the long term, uniformity in codes for pipeline designwould be benecial. Stress based design is not applicable for hightemperatures, and could possibly lead to excessively thick pipe-lines. The use of strain based design codes, and limit state baseddesign seems more applicable for complex high temperaturedesigns. The integration of analysis tools with design codes is a keychallenge; bringing in the effects of irregular corrosion thinningcomplicates further. The use of JIP orientated corrosion modelingacting as de facto inherently safe promoting standards will haveenormous benets in this regard (IONIK JIP, 2008; Ohio University,2007; University of Tulsa, 2007).

6.9. Pipe-in-pipe options

The new pipe-in-pipe (PIP) options (Fig. 6) rapidly are becoming

B. Singh et al. / Journal of Loss Preventionthe design conguration of choice for deepwater and extremelycold Arctic applications. The PIP systems allow a range of advancedand highly efcient insulation materials to be used to achieve therequisite heat transfer properties required, and assures greaterdegree of mechanical integrity, and is therefore an inherently saferdesign (JPKeIonik, 2005e2008; Jukes et al.).

These systems are important components of subsea develop-mentswhere untreatedwell uidsmay have to be transported largedistances and wax and hydrate problems have to be effectivelymanaged. In addition for extreme cases such as LNG transportation,pipe-in-pipe-in-pipe (PIPIP) congurations (three concentric pipes,with typically a NiFe inner pipe high nickel (36%) steels beingselected for extra inherently safer/integrity characteristics (Singhet al., 2005)). However monitoring the life-cycle integrity of suchsystemscanbe a challengebut creativeoptions are continually beinglooked at (McLaury, Rybicki, & Shirazi, 1997; Singh et al., 2005).

6.10. Flow assurance solutions

Hydrate formation, wax behavior, erosion, andmultiphase owscan be more critical design issues, especially for multiphase uidstransitioning from deepwater to shallow water. The ow assurancestrategycomprises a combined design andmanagement philosophyfor all of the following depending upon the uid properties andoperating conditions such as: hydrate formation, wax/asphaltenes,scale, forming, emulsion, slugging, and damaging erosion/corrosion(JPKenny/University of Houston, 2008).

Fig. 6. A typical pipe-in-pipe (PIP) system.

he Process Industries 23 (2010) 936e953 949use of carbon steel owlines combined with near continuous

in tinhibitor injection or the use of corrosion-resistant alloys(CRAs). The decision is usually made via corrosion modelingprediction techniques. Themain threat to integrity is wetting ofthe annulus insulation by breeched inner wall, and the lack ofinspectability thereof. Much work is currently in progress inthat regard (Jukes et al.; Singh et al., 2008).

The typical strategy is best adopted early in the conceptual andplanning phase of the project prior to specifying and ordering themain components of the system, such as downhole equipment,trees, owlines, control system and topsides equipment.

Flow assurance strategy should also be applied during detailedsystem design, developing operating procedures as well as offshoreproduction operations to maximise protability of the eld devel-opment. Based on the ow assurance analysis results, a designphilosophy and functional specications can be developed for thefollowing elements:

Sizing of well tubing and completion design; Sizing of all owlines, risers and export system, includingsubsea manifolds;

Thermal management (insulation or heating); Chemical injection, including the subsea chemical distribution,umbilical, topsides chemical delivery system;

Pigging strategy (subsea or surface launching).

One such solution is to make the pipeline more buoyant, toreduce the span stress. To ensure that the pipeline does not get overstressed at the touch down point with the seabed, bend restrictorscan be used to limit the bending curvature.

6.11. Standardization of designs

One major way forward still under development, is to generatethe standardization of designs, if the developments are similar innature (water depths, pressure, temperature, corrosivity, etc.). Themain advantages from standardization are driving down costs, andreducing schedule time. If this approach can be suitably linked toISD there would be substantial benet to the cause of CISD, The fearseems to be that over exposure to materials selection and corrosionanalysis is cost prohibitive. In reality the benets to be exploited are:

Common health and safety culture down the supply chain; Support in the context of inherently safer designs; Long-term supply chain relationships; Focused front end engineering design (FEED); Detail design, commonality of IM issues; Lessons learned (must be a continual process); Signicant potential for integration within CMS programs;

Used properly, standardization has the ability to collate, andrationalize existing design methodologies, sift through best prac-tices applicable to each region, and can therefore be expected todeliver signicant improvements pertaining to; cost, schedule,quality, operability, and predictability.

Major program standardizations are presently being undertakenon projects in the GOM and overseas for major clients (JPKeIonik,2005e2008; Smart, 1990; University of Tulsa, 2007). The results areattractive and promising in terms of scheduling, manpowerresources, and, therefore, budgets. However when unexpected vari-ables enter the decision-making process, such as the possibility ofsour service being incurred post water injection scenarios, thendifculties can prove to be hard to surmount, especially if expensiveequipment has already been purchased or allocated. Under these

B. Singh et al. / Journal of Loss Prevention950circumstancesmaterials and corrosion engineers cannd themselvesin a very awkward position, trying to justify non-sour materialsselection, when all predictions point to a sour service developmentover the life cycle, albeit often in thedistant future. Similar argumentsand predicaments exist for advanced engineering criticality assess-ment (ECA), and tness for service (FFS) whereupon new aw sizingcriteria need to beappraised atdesignandduring service accordingly.The combination of ISD, concurrent design, and standardization isa powerful tooling for challenging deepwater campaigns, and iftaught (included) within future engineering curricula a big stepforward for the engineering community as a whole.

6.12. Materials and welding

For both equipment and owlines, a critical component ofsuccessful design for high pressure/high temperature (HP/HT) isa thorough understanding of the materials and welding issues.Management of detailed materials testing and quality procedures iscrucial, and the verication of drawing board detail to as receivedand built components is vital especially in the global market place.Also rigorous equipment specication is required, paying particularattention to material selection for components, such as seals. Inaddition, increased use of exotic materials, such as corrosion-resistant alloys (CRAs), either solid or as liners, throughout thesystem offers alternative solutions, though care must be taken atinterfaces, to minimize or eliminate junction galvanic effects.Loadings that must be reviewed are:

Axial, Lateral Movement; Effective Axial Force; Axial and Hoop Stress; Von Mises Stress; Bending Moment; Plastic Strain, Buckling Curvature;

7. HSE perspective

Following review of the MMS (future BOE) and UK HSE stepchanges in safety alerts, many recent insights have been identiedwith respect to the potential for similar causes or similarities due toincidents that have happened since the Piper Alpha disaster. Thiswas donewith a view to aid plausible corrective actions. The resultspointed to two main types of actions: those related to design safetyand those related towork permits and lockout/tagout. Thus, the useof meaningful corrosion and integrity management can also playa valuable role in such accident prevention. The review shows someuncanny parallels to the Piper Alpha case, such as initiating causes,with potentially similar outcomes. Prevention of these throughdiligent integrity management would clearly play a signicant rolein prevention by design, predictive and proactive measures.

There have been many recent safety alert examples, and otherrelevant post accident studies, over the period (2000e2008), anddetails are readily available in the public domain (via CBS (Baker,2007), MMS and HSE web pages (JPKeIonik, 2005e2008)). It ismore appropriate in the context of this paper, to identify the bestactions derived from the alerts as exemplied below.

7.1. Actions from the alerts

Compile and issue a shutdown specic isolation protocol, basedon review of practices elsewhere in the company and in otherworldwide afliates. The document should cover vent/isolationtagging standards and documentation required for large-scaleshutdowns;

Lessees and operators should repair malfunctioning equipment

he Process Industries 23 (2010) 936e953in lieu of using alternative methods such as opening a manual

liquid dump valve when the automatic liquid dump valve failsor blind anging off a pressure relief line when a safety deviceruptures.

Lessees and operators shall review piping to ensure that deckdrains have adequate trap mechanisms to prevent gases(corrosion leaks) from migrating through, that deck drains arenot piped to a pressure line before entering a sump tank, andthat piping for produced water does not tie into the piping forthe wastewater from the living quarters.

Lessees and operators should review are boom lines to ensurethat they are designed of proper length, height, and oriented inthe proper position according to prevailing winds to minimizethe migration of gas back to the living quarters. Barrier and tagoff for access under strict permit to work only.

Supervisors must provide adequate job instructions and plan-ning prior to the work, without jeopardizing the scope inten-tion of the work (applies particularly to contractors/inspectorswho can nd themselves under pressure to complete and go).

Hazards must be identied as work proceeds, and a stop workpolicy in place as the job scope changes.

Fire protection/deluge systems must not be compromised andas a rule be fail safe with 100% availability or redundancy.

Personnel must be familiar with and utilize lockout and tagout

necessary actions to ensure the safety and reliability of thesecritical components.

The national consensus standard for dynamic risers, API-Recommended Practices are currently under revision (Baker,2007). The revised version is expected to include guidanceon integrity management for dynamic risers. The MMS willconsider adopting this standard into its regulations for outercontinental shelf pipelines.

A discussion of the ndings shows three main types of recom-mendations that parallel the ndings of Piper Alpha:

(a) There must be an effective work permit system including theuse of lockout/tagout, and

(b) There must be design review that is comprehensive enough tothink ahead to the probable scenarios and consequences of thedesign.

(c) Asset holders must have a formalized culture of safety which isimplemented and acted upon. Promoting life-cycle integrityand parallel safety procedures, then not acting on them shouldbe considered a zero option (Private Correspondences withMessrs Ben Poblete (LR/Cameron), 2000e2008).

B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 951procedures to isolate equipment and process piping duringwork programs.

Simultaneous operations must be clearly communicated to allappropriate parties, and made fail safe, detailing all site-specic procedures prior to work being implemented.

Lessees and designated operators should be able to trace thehistory of ring gaskets in the eld regardless of previousownership, and/or determine the condition of the ring gasketsprior to the performance of future operations (gasket failureand ensuing corrosion-related leaks are very commonoffshore).

The Government requires lessees and operators to performstrict maintenance and inspections, monitor the environ-mental conditions, andmaintain records of these activities (API14E RP; Singh & Krishnathasan, 2008). Since a failure ona dynamic riser could pose a signicant impact to safety, theenvironment, and energy supply. Thus it is essential to performFig. 7. Schematic depicting the crucial relationships betweNoting that a very high proportion of equipment maintenancework is corrosion, ageing or wear related, the clear evaluation isthat potentially dangerous incidents continue from time to time atoffshore facilities. Corrosion prevention and detection and in thelarger view the use of integrity management systems are essentialto proactively prevent these from occurring. In addition, safety indesign is vital to building in prevention long before problems occur.The MMS potential incidents of non-compliance (PINCs) were alsocreated to address that matter (US DOI-MMS, 2007). Finally, oper-ating best practices of work permit systems and lockout/tagoutremain a key to accident prevention generally.

8. Corrosion risk management practice

In reality the current corrosion business practices for most oiland gas operations is a balance of three risk managementmethodologies. These methodologies are interrelated and musten reactive, proactive, and active corrosion analyses.

in tbe balanced and reviewed on a continuous basis. The method-ologies are:

Reactive Corrosion Monitoring; Proactive Corrosion Monitoring; Active Corrosion Monitoring.

The decision on how to manage the corrosion business risk ishighly dependent on the corporate senior management policy ofhandling their operational or capital expenditures. It is emphasizedthat these methodologies are equally important during theconceptual to detailed design of an integrity management system.The inter-relations of the three methodologies are shown below inFig. 7. The importance of understanding the root cause (s) of anycorrosion issue is critical in providing pragmatic cost-effectivecorrosion risk management solutions.

It is considered that these corrosion risk manage