NACE 2001 HOUSTON TEXAS MARCH 11-16, 2001

SYMPOSIUM T1-MATERIALS & CORROSION CHALLENGES FOR DEEPWATER DEVELOPMENTS

PAPER # 01008

OFFSHORE RISK BASED CORROSION INTEGRITY MANAGEMENT

A NEW METHODOLOGY

Binder Singh, and Jim N. Britton,

Deepwater Corrosion Services Inc.,
6830 N. Eldridge Parkway, Suite # 211
Houston, Texas 77041, USA
 OFFSHORE RISK BASED CORROSION INTEGRITY MANAGEMENT
A NEW METHODOLOGY

Binder Singh, and Jim N. Britton,

Deepwater Corrosion Services Inc.,
6830 N. Eldridge Parkway, Suite # 211
Houston, Texas 77041, USA

ABSTRACT
The management of corrosion and integrity for offshore applications has become more critical as
deepwater exploration and production continues. There are many challenges ahead, the most
important being that the scope for error is greatly reduced. Repair, retrofit or replacement all
become that much more difficult and costly due to logistics. The importance of correct execution
first time is therefore vital, and one of the most important areas is that of suitable materials selection
and corrosion management. This paper presents a new Risk Based Corrosion Integrity Management
(RB-CIM) methodology comprising 10 discrete steps which when used diligently can provide the
means to resolve the many threats encountered. In particular focusing on pertinent through life
fitness-for-purpose, and important regulatory issues. The principles engage a multidisciplinary
approach with a radical emphasis on design reappraisal, failure investigation, prioritized inspection
and extended verification to address the demanding safety, environmental, and performance
objectives. The scheme invokes a paradigm shift in thinking and is considered very relevant for both
existing and new offshore deepwater developments.

Keywords: risk, corrosion, integrity, design reappraisal, fit for purpose, extended verification,
offshore systems, deepwater applications, failure mechanisms
 INTRODUCTION

The subject of integrity management has received much attention over the past ten years or so, a
cross section of pertinent papers shows typical developments in this field.1-9 The urgency has now
reached a more pressing level as deepwater exploration and production continues, and new
challenges present themselves, some of these have been predictable, others are not. The
traditionalist viewpoint of the design meeting the minimum requirements of the relevant code has to
be questioned, and confronted thus enforcing the modernist standpoint that designs must be fit for
purpose through life. This means from conception to retirement i.e. from drawing board, fabrication,
installation, and commissioning through to service (in/out) operations and onto decommissioning.
The integrity function must therefore expand to accommodate all operating conditions including,
steady state, shutdown cycles, excursions and transients. Hitherto designers can meet the code
requirements for the structure, pressure/piping systems, nozzle reinforcements, geometry, external
loadings etc, and the fabrication/assembly validated against design drawings by third party review
and test witnessing. However as challenging deepwater remits beckon, comfort zones will need to
be stretched, and greater emphasis placed on risk based judgmental engineering. It is the intention of
the RBCIM to minimize the subjective content by maximizing the objective content, through a
sequence of transparent checks and procedures enforcing better, revisable, auto-improving
quantification.
Mechanical Design, Operations and Corrosion.
It is clear that the gray area between design and operations is often skipped, though it is noted that
more operators are voluntarily requesting second opinion type reviews. Often with beneficial (albeit
sometimes controversial) results. And this is without doubt a good trend; the new approach we
believe provides the necessary vehicle for safety/critical area isolation, with best practice regarding
knowledge application, roles, and responsibilities. When the structure/system is installed, and meets
the environment addressing both steady and non-steady service, the onus for through life operations
is supposedly transferred to the operations/maintenance departments. There is at this stage little
recourse to the designer who may now be more interested in the next project, and so there is rarely
any follow through. Any sensible suggestions at this stage will be frowned upon and often
inadmissible. The best time for constructive design comment is clearly at concept or front end
engineering design (FEED), even up to detailed drawings stage. However materials/corrosion input
is rarely permitted at this stage, usually because of project costings, mainly as it is often excluded at
contract write-up stage. It is strongly contended that such review is vital, and that bid preparers,
project managers/ coordinators, and ultimately regulators should be made fully aware of the possible
consequences. Design modifications, retrofit, rehabilitation, investigations etc at later stages can
become very expensive and negatively received.
The whole ideal, regarding asset integrity management has now become much more pronounced
as deepwater ventures consolidate. Facility managers need therefore to make the case for such
input sooner rather than later, and this is already happening with considerable success. Major
industrial projects are utilizing advanced asset management techniques as business initiatives 7,8
and this will no doubt continue. However it will probably be the economic forces of deepwater oil
and gas, which will provide the prime moving catalyst for, accelerated growth in this area. In the
Gulf of Mexico region this has already become more important as the MMS/USCG regulations
evolve. The introduction of the MMS defined Potential Incidents of Non-Compliance’s (PINC)
listings is a powerful example of such impact. 9 The listings are actually for inspector guidance
but should serve as warning flags to the operator. And of particular note are the PINC series
G #‘s 110-113, which focus on the need for safe workmanlike operations regarding the lease,
equipment and associated facilities; G-111 in particular addresses corrosion and inspection detail,
including interpreted links to design. Needless to say policing of these criteria will be more
pronounced as we venture into deeper fields, with greater manning levels, and more public
sensitivity. And as with safety cases elsewhere, the statutory body interests are directed to the
achievement of performance setting goals or end objectives, and not so much the means. The
rationales described by the MMS 7,9, 10 and the market place11,13 may therefore be construed as
directives to assert integrity management.

METHODOLOGY
The starting point for the RB-CIM 10 step methodology is the adapted bathtub failure curve, Figure
1 which attempts to correlate failure frequency, fitness for purpose and investment. Specific curves
are case dependent and not generally repeated across facilities. However it is the precursor to the
new methodology offered, Figure 2, by virtue of its ability to focus attention when and where
needed. The 10 steps follow a logical plan, which is tailored to counter known weak points in the
overall life cycle. This is also demonstrated per examples submitted later. The principles are based
on the evolution of North Sea and GOM trends by history and experience, as illustrated by the
annotation of the failure distribution with some typically expected milestones through plant life
Primarily the discovery of new or more potent forms of existing mechanisms of failure may be
interpreted when new realms of environments or operations are entered, and deepwater campaigns
certainly qualify for this. A sizeable percentage of existing facilities world wide are now in this
arena, and of particular note, may be the more domineering localized, microbial, wear/fretting,
CRA-hydrogen damage under CP, stagnant pocket, and complex flow related corrosion
mechanisms. The major problems are usually perceived as being external but the harsher reservoir
conditions in deepwater fields, and aging pipeline infrastructure, provoke a greater inclusion for
internal corrosion.
Technology Drivers.
Also as technology has advanced over the years, pushing design envelopes to greater stressing
loads, pressures, temperatures and flow velocities, a new silent parameter the litigation function has
also arrived. Leading even to legal fund allocations within budgets to reserve a protection caveat.
Most company warranties for equipment are active for the early running-in period or commissioning
phase, however some are now omitting liability for any corrosion related failure, others limit their
liability to the value of the project consultation fee, even though the consequences of a mishap may
be horrendous. Some seek global protection in limiting liability to a single country or jurisdiction,
and others more recently will overtly disclaim responsibility for their findings. In other words the
ground rules are shifting as risks particularly within deep waters are increasing and it is now almost
a question of being smart to outsmart. Not ideal but perhaps understandable; still technology presses
on and important fitness for purpose criteria, though highly subjective, need to be quantified.
One such method may be via banding profiles see Figure 3, and an awareness of the (often
unwritten) tolerable level of failures or planned shutdowns. It is likely that not all problem areas or
threshold values will be identifiable or foreseen but it should be the intention to have them mostly
manageable, using where appropriate risk based techniques, with iterative process revisions on an
ongoing basis. Under difficult conditions where there is a shortage of experience or data, perhaps
with a relatively new alloy under unique exposure conditions, the loop assists the use of derivations
from across systems, or risk based estimates via focused efforts, and good documentation. In this
way parallel testing/trials and knowledge accumulation will give the best opportunity for a positive
merging of all findings. The approach should also discourage the passing-on of anticipated problem
areas to other divisions, future operations, next years budget etc, since technical assessments and
program adjustments will be better visualized within the bigger picture.
Timing and Hindsight.
The point at which such a risk based strategy should be introduced is debatable, in reality anytime
from start to finish is acceptable, but it seems most valuable to engage parallel to design. If not then
for new facilities at or soon after start-up in order to maximize added value and productivity. 7,11,12
For older systems, it may come into effect soon after a problem recognition area or site failure,
whereupon the desire to continue production unabated invokes an organized (or often unorganized)
risk based decision process. 12 The discrete ten risk oriented steps proposed, refer Figure 2, have
been formulated to be logical, and give quantifiable improvements within a cost-effective action
plan. The procedures once in place can self-drive the key steps viz., failure history assessment,
design re-appraisal, risk assessment, inspection matrix prioritization, NDE implementation, survey
data interpretation, predictive trending, corrosion/integrity statement, practical fit-for-purpose
solutions, extended verification, validation and continuous positive feedback. In all cases the output
must be improved reliability, ongoing plant operational and future design improvements. In
principle the loop is considered near equivalent to hindsight in action. The following paragraphs
attempt to expand on some of the important matters within this methodology.

Fitness for Purpose

Engineering performance management frequently involves not necessarily the best or correct
solution, but more frequently the most suitable under the circumstances. The prime aim being to
keep the facility working, and at most times this defines the optimum solution of the day.
Corrosion engineers must take full cognizance of this within the bounds of their suggestions.
Fitness for purpose whilst a complex concept to quantify, is however the critical cornerstone of all
advanced offshore projects. Figure 3 shows how this may be schematically represented for one
engineering case. Essentially this is an attempt to set an envelope of safe operation covering all
known parameters, with monitored/recorded plots being used to track operability. The curves are
“open” in that new parameter thresholds could be suitably added as the envelope expands or new
data become available. The use of internal on-line corrosion potential (Ecorr) values is singled out
as one powerful but underutilized parameter. Here theoretical or laboratory data should be used
with caveat, and perhaps an initiative taken to regard the on-line parameter as a bona fide material
performance property akin to Ys, maximum fluid velocity etc.
It can be stated that a very high percentage of degradation/corrosion /cracking phenomena in
practice tend to be directly linked to an initiation mechanism at service outages or excursions,
such as post hydrotest lay-up, commissioning transients, operations outside design envelope,
shutdown, malfunction, human error etc. These must be properly addressed; however such
consideration does exert unfavored pressure on designers to select materials and geometry‘s
which will tolerate “all through life conditions” a responsibility often outwith their experience
basis. Thus the vital need to take account of this via specialist materials/corrosion input, pushing
the use of more creative methods such as engineering similarity (non-dimensional analyses), and
independent design reappraisal techniques ( including alternative risk based solution paths) etc to
redefine suitability per the critical transient/shutdown and excursion profiles envisaged.
Plainly in due course it will become more important for structural/equipment designers to engage
more closely with corrosion aspects, and the opportunity with deepwater developments may be the
catalyst.12 The opposite or corollary is also true, in that corrosion specialists need to understand and
engage more freely with the mechanical and structural design techniques. At present the most
frequent point of cooperation is often correctly enforced at the discretion of the asset
holder/lessee/operator who is ultimately responsible. And the end result invariably justifies the
means, since in virtually all cases examined a considerable improvement in design and fitness
performance is realized, albeit sometimes with painful retrofit/revisions being recommended. In
time an independent materials selection /corrosion engineering overview will no doubt become an
accepted part of the engineering design process, perhaps at least under the auspices of an extended
verification process as related in the loop. For the present, however necessity has intervened by
virtue of the challenging and sometimes uncertain remits of deepwater development, and we have
already seen such influences enter the fray.2, 7.

Role of Judgment and Risk

It is commonly understood that the greatest single non-catastrophic threat to the integrity of an
offshore structure or pressure plant is its natural degradation during through life exposure. The most
frequent causes of degradation are corrosion related (up to 10 major and over 20 delineated
mechanisms), mechanical overload, and human error- including a preponderance of poor initial
design with possibly the majority of integrity breeches being attributed to the latter. Corrosion is
thought to account for up to 80% of all process failures, and it has been adjudged that over 70% of
plant problems are not reported back to the designer for one reason or another. 12. Perhaps this is
because the designer inadvertently loses some interest as the remit is over and done, and who wants
to hear that their design is not performing as intended? In-situ design modifications are also of
major concern, often being implemented without authorized overview, a dangerous practice noted in
many case histories 16. The new approach offered, with a formal reappraisal function will
diplomatically stimulate and maintain direct interest, with the specialist opinion bridging the gap
between design and operations. As with all new challenges engineering the science becomes more
and more judgment and therefore risk oriented.
CP and Other 3rd Party Reviews. Hitherto engineering third party reviews are not common,
and if used have tended to pay attention almost entirely on new builds, and are very limiting on the
corrosion side. The situation is rapidly changing for deepwater offshore structures (new and old)
whereupon external corrosion is seen as a major threat and effective cathodic protection must
therefore be reassured. This is largely because new deepwater criteria have arisen, such as deep
seawater flow disturbances, high/variable resistivity, low temperatures, reduced or cyclically
replenished oxygen levels, increased microbial activity, lower pH values, etc 7. These challenges are
being met by CP specialists, but mainstream engineers still tend to use shallow water criteria in the
design process, often with alarming impact on design life. 12 There will no doubt be further
implications adjudged, as more deepwater data emerge or are interpolated, particularly regarding CP
monitoring, design conservatism, and retrofit. It is reasonable therefore to deduce that life cycle
integrity management can be successfully met by rational knowledge and corrosion management via
effective design reappraisal.
Other existing programs such as classification, and certification also have a positive role to play,
and can form a pivotal subset of the integrity management practice. However to assure a good
likelihood of success the venture has to be corrosion led, and not corrosion followed. This will
become a major consideration as deepwater structures such as TLP, DDC, Subsea Completions and
future FPSO‘s etc are contemplated for the GOM region 2,6,7,13 and indeed as more of the shallow
water existing infrastructure ages beyond the 30 year threshold. The situation will be exacerbated
further if “used” floaters are relocated from one zone to another deepwater jurisdiction, and we
create a situation where the vessel is say both elderly and placed within new more aggressive and
regulation demanding deepwater environments. In that case the failure frequency curve may skew
quite drastically. This challenge may not be that far away if FPSO‘s in the GOM become a reality. 2,
7,11
The main concerns would then be invariably failure management and environmental worries
under the hostile conditions created. No doubt the economics of the energy industry will be the final
arbiter. We believe the discrete 10-step approach should go a long way to addressing such matters.

Regulatory Issues
Generally over the past few years, there has been an underlying trend of the oil companies; focusing
on core business and moving away from corrosion studies largely for economic reasons. However
the main Regulatory bodies such as, MMS/USCG and UK-HSE seem to be moving towards greater
emphasis in this area, largely due to statistically corroborated concerns regarding levels and types of
failures observed. 2,6,7, 13,14 Hopefully at some stage soon there will be a natural convergence of
trends. In order to assist with resolution protocols it seems that the leading authorities have accepted
that best, safe, economically balanced practices per corrosion management /control in the industry
may be risk related. 10, 15 Though there are some inherent concerns regarding possible compromise
of plant integrity 7,16 and these will ostensibly only be allayed with focused R&D, and the
accumulation of more experience with risk based systems. Presently it is also noted that most such
developments are in fact land based, this means that access, response and escape can be pursued
relatively easily. This is not the case for deepwater projects, whereupon optimum checks and
balances cannot always be taken for granted. Thus the urgent need for greater cognizance of up-
front and operational means to fill this void, hence the new methodology.
Inevitably high volume risk analyses have in the past often engaged complex/expensive databases or
models, much to the chagrin of operators, who do not always see value for money. Frequently these
tie the client into an unhealthy “marriage of convenience” with the software supplier. Needless to
say this over reliance on packages/ expert systems can tend to, encourage belief in the numbers, and
inhibit probing inquisition, and may have the longer-term effect of restricting lateral thought and
innovative engineering.
The loop presents a closely considered course of action, and a new more radical, cost effective
approach, the guidance is practical and risk based to restrain any burgeoning effects. It has been said
that nothing focuses the mind more than a signature and the sequence, revert to Figure 2, formalizes
recognized best practices, validation, and clear auditable decision making processes, all within a
team based approach. Greatest multidisciplinary group motivation is realized when all parties can
reap the potential rewards, and this case is no exception. As a corollary needless to say when things
do go astray the same parties must share in the negative aspects too, the logic being that all critical
decisions must be consensus based.
Sound information exchange at all levels is of paramount importance, but with the advent of e-mail,
presents no logistical problems. The loop provokes a live system re-evaluation status, and
knowledge updating ethic, and enforces due diligence. Where appropriate, solutions should be
ALARP-Risk based, with good documented feedback control. This approach should encourage a
natural tendency to meet set performance goals and regulations, and may in reality offer a viable
option against liability concerns, since all parties are empowered, in fact obliged to have input.

Engineering Suitability
The operating environment is a moving variable, often changing erratically as the reservoir/well
dynamics alter and service continues. Thus engineering suitability and fitness for purpose will also
see a moving target. These must cover non-service conditions such as transients/ shut-ins/
excursions etc, (hence the term purpose is actually preferred to service) as an all encompassing
through life stipulation. To address this matter, the internal and external environments must be
considered per best information sourced; review of the design basis criteria is also useful but
remains a constant and thus often not updated for completeness. Any onerous changes which may
catch the attention of operators, third party reviewers, or certification authorities are often received
with consternation, with everyone wanting to go forward without penalty since critical items are
already installed.
The above scenario is a recurring dilemma, probably most effectively managed using an RB-CIM
type philosophy, since this would allow a vehicle for all interested parties to have input from the
beginning but at the same time take responsibility via consensus and traceability. The service data
accrued will examine at minimum all vital concerns regarding internal and external modes
(continuous or intermittent), normal or steady operating conditions, identification of abnormal
operating- temperatures, pressures, velocities, pH, chemical injection etc, presence of insulation,
subjection to temporary contaminants, and the periodicity’s of each. The first pass analyses may be
performed using the standard operating temperatures and pressures entered against each item of
equipment listed, and this usually approximates to the design basis, Figure 4. The loop also provides
valuable focus to the application of ALARP to material selection leak path criteria as well as
component leak or failure path criteria. And perhaps challenge other hitherto unaddressed areas
such as impending ultra long term ( >40 year) life cycle –age effects such as plausible
effects/variances per critical material properties.
Appropriate theoretical and process simulations may also be used, and subsequent iterations would
lead to improving value analyses. Where no such detail is forthcoming, suitable best risk based
estimates may be agreed, quantified, or if appropriate modeled. The feedback within the loop will
ensure continual improvement at subsequent passes/cycles of the methodology. Alarm flags may be
raised to define threshold values. The approach if applied correctly and in good faith will ensure
best-latest-safe-knowledge usage, without dominance by any single group.

Failure Mechanisms
At first project contact the question of failure status and frequency must be addressed, see Figure 2.
This is key to success, failure modes the end result of inadequate design, engineering performance,
or low efficiency are defined by considering the combined effects of the operating environment, and
circumstances upon each item, and the total integrated system. This is not easy, the corrosion
related failure modes must include all possible mechanisms, 12 such as pitting, crevice, stress
related - SCC/HIC/HE, corrosion fatigue, FAC/erosion, impingement/cavitation, CUI, dissimilar
metal /galvanic attack, COMP-other compatibility issues, MIC, scaling/deposit cells,
fretting/vibration, intergranular/selective phase, mechanical dominated (Hs, Rs, Ts, τ, etc) surface
condition related (Ff, Rx, Cw, etc.) and uniform thinning and so on. A more complete listing of
mechanisms and pertinent parameters characterized in the program are shown in Table 1. Modern
applied techniques are now practically forensic in detail, and carefully characterizing such high risk
parameters is often do-able within reasonable budget 12.
The working loop resources would thus identify the most likely root cause of failure or damage,
and assist suitable counter measures beyond basic corrosion allowances offered by design. This is
a major challenge of persuasion, since the tendency is for designers to assume the corrosion
allowance is the panacea. In reality this only solves the problem of general or uniform corrosion.
The project managers, engineers and field inspectors must have full recognition of all likely
corrosion phenomena through briefings or teach-in, thus ensuring appreciation, accuracy and
reliability of actions. The loop will also help address any unique vulnerability identified, such as
liquid metal embrittlement /caustic /sweet /sour cracking which may come into play at later
stages. This would be done in accordance with pertinent standards, company specifications, and
proprietary techniques per latest industrial experience accrued. Thus whilst zero failures may not
strictly be possible, the approach can help eliminate the corrosion surprises, which are always a
daunting prospect.
In many instances the failure mechanism is unknown/uncertain, or of a mixed nature, and not
easily recognized. In such cases provided the source and site can be located
(a formidable task itself) it is feasible for the strategy to specify a tactical anomaly management.
Thus allowing very close monitoring of the feature perhaps using computer driven ultrasonic C-
scan type mapping in order to pre-empt actual failure- the so called “just in time” approach. 14
Other modern techniques such as B-scan, advanced thermal imaging and creative sidestream or
bypass/removable spool technologies may also be appropriate, often as screening tools used
alongside daring rope access methods. The tie-in between predictive goal setting corrosion
management, within reappraisal and extended verification stimulates innovation, maximizes data
accuracy/repeatability/auditability, and ensures credit and approval where due, and that
recognition and responsibility, are not lost in the human equation.

Consequences, Hazards and Operability

The consequences of a corrosion related event causing failure are linked to hazards to personnel,
environment, as well as the ability to operate the plant, i.e. reliability. This depends on the
characteristics of the fluids released and the time-cost factors required to resolve and bring plant
back on-stream. Numerical techniques rationalizing number, frequency and mean times before
failure can also be successfully used to quantify such performance. The attention to the consequence
detail is a powerful means of creating awareness, and much work is already in place regarding these
parameters. 7, 11, 12, 15. The hazard that results from fluid release can be quantified per human
proximity, duty, fluid inventory, flammability, presence of safety valves/firewalls, and the location
or impact of the failure on the production process or adjacent areas.
Following any breach of pressure containment the ability to continue safe plant workings may be
affected, and limitations imposed can be quantified per extent of shutdown and time for repair. This
parameter must by necessity be developed with close client cooperation, and is largely operator
experience based. The essential risk parameters in the loop Figure 2, therefore comprise: Risk
Analyses (steps1-3), Risk Based Inspection (steps 4&5), Risk Management (6-10), with the latter
encompassing the subsets; risk based solutions and control (steps 9&10).
Envelope of operability As a result, we can rationalize the fitness for purpose, by the bands of
operability for identified critical parameters within the agreed risk driven interpretation. This may
be defined on a system-by-system or component-by-component basis. In practice as plant ages
these bands will be revised as new data come to light, again invoking close co-operation between
RB-CIM exponents. In most cases some sort of extra condition monitoring including critical
parameters such as pressure, temperature, velocity, corrosion potential, surface roughness/friction
factor, pH, chlorides, sulfates, H2S, CO2 etc, will be necessitated. Thus quantifying the closeness of
the operation to the design basis. Recall that the strategic aim is to maintain ongoing fitness for
purpose, beyond basic code compliance. Hence the creation of an enabling methodology, which
must use best available safe technology (BAST) 10 under focused knowledge management.
The risk based angle allows loop tweaking to keep costs manageable, however with the proviso of
accepted downtime frequency. Otherwise the tendency to inspect all may take costly control. Thus
the loop has evolved as a multi-disciplined engineering practice taking the best of marine/offshore
experiences per corrosion against mechanical/metallurgical /risk/inspection and structural aspects.
With knock- on effect of close synergy with appropriate NDE and accelerated laboratory tests etc.
The essential steps per the loop will allow variations on a case by case basis, including overlay onto
an existing system, but the core must retain design reappraisal, failure investigation, extended
verification, and risk appreciation. For the RB-CIM to work however it must really be supported at
the highest management level. Thereafter it can be looked upon to be self-driving, self improving,
self policing, and self funding (the latter by way of enhancing production revenues).

APPLICATION
The 10 step loop is practical, experience, and risk driven; with emphasis on safety and tendency
towards being fail safe. Upon application the system enforces a stop and verify status at any time if
safety were compromised in any way. Theoretical and probabilistic modeling may be referred but is
not accepted as overriding. The heart of the assessment will be the plant walk round/ close visual
and this will invoke updating drawings and inspection isometrics. All critical decisions will require
checklist make up, review, and competent person sign off. This is sometimes avoided under the
unsupported guise of additional time-cost burdens; the loop process can and has, demonstrably
made this a compelling overview rather than unnecessary detail which may hinder project
schedules.
The program is an aiding dynamic, offering a live condition of plant at any instance, forming the
backbone of the integrity decision making process. The approach allows the lessee full
management capability if so desired, thus avoiding the hassles of software tie-in/upgrades/service
agreements etc. The key is impartial, efficient, transparent, free flow of data to allow critical
assessments, revisions, feedback, etc. However the use of an impartial third party project
management would give solid edge and have advantages.
The team based group could be internal with external input or any combination thereof, however
deemed appropriate. Ultimately if the plant runs at high reliability with few unscheduled shut
downs, no surprise leaks, and no regulatory/safety /environmental issues, all players in the loop are
into win-win. In principle the know-how generated by the process can be applied to any project
whether Offshore, Marine, Pipeline or Industrial. The strategic level logic is essentially the same.
The specific methods at tactical level will vary, depending on specific undertakings to assure
integrity against corrosion threats. The aim always being to resolve production and shutdown
conflicts within the framework of predefined performance objectives, with practical fit for purpose
actions.
Performance Goals.
General guidelines will be performance goal setting, and based on agreed safety critical items,
however there may be instances where RB-CIM will gravitate towards a knowledge based
prescriptive ruling; such as for example the selection of highly specific anodes for retrofit CP or
structure survey locations. The actual level of success would be measured by any combination of
predetermined objectives such as:
• Monitoring facility/unit efficiency and general condition
• Reduced downtime/increased productivity
• Reduced failures and frequencies
• Reduction in general and localized corrosion rates
• Reduction in perceived and calculated risk evaluations

Design Reappraisal and Extended Verification

The original and mainstay aspects of the RBCIM are the design reappraisal and extended
verification, and the modern day prompt for this has been the critical need to maintain integrity
under applications whereupon the margins for error are constrained. Up until recently most
corrosionists would accept the given design landing on their desk without question, this barrier
needs to be broken. If the majority of engineering problems can usually be related back to the
drawing board, then it stands to reason that the first and most powerful tool in the process is the
design reappraisal discipline for both new build and old build. Essentially third party verification
type reviews have been ongoing for certification, classification, and good workmanship purposes
for many years, but with limited predictive content in the context of corrosion/degradation
phenomena. Such checking nearly always being against identified standards or codes alone.
Extended verification is therefore pushing the envelope to the next level.
The loop logic is to focus the reasoning taking full cognizance of predictive through-life factors.
The concept examines performance goals and prognoses, beyond minimum code including
management of excursions beyond design envelope, and would draw solidly from historical risk
oriented experience, and knowledge based extrapolations. Thus covering alert for known but often
difficult to quantify problem areas such as waxing/hydration, sand content, stagnance,
embrittlement etc often invoking consideration of the formerly secondary parameters such as Rx,
Rs, τ, Ts, etc, which often play part in root cause failures at extreme design boundaries and beyond.
And since the scope of design is often based on uncorroborated reservoir conditions, a means to
give allowance for operations outwith the design envelope must therefore be included for deepwater
applications.
Timing and methods guidance. Design Reappraisal at the beginning and Extended
Verification towards the end of the loop when latest corrosion and excursion profiling data are
describable seems logical. But it is accepted that case specificity can override, and so the loop is
flexible, and some re-arrangement regarding where and when to do these critical steps is possible.
The extent of defining excursions is difficult and may be quite subjective, however a good basis can
be found from previous in-house or cross operator experiences. The caveat being that the loop
insists on all such profiles to be operator defined and agreed. The important point is not to ignore
them, reappraisal as defined will ensure that the necessary attention albeit demanding, is given.
Close adherence to the loop is expected to ensure that such decisions are ordered and self improving
upon iteration. The asset-holder or lessee will recognize the advantages for maintaining integrity
and performance. And as such since design documentation must exist by law in most jurisdictions,
the intent is to review selective/available plans and not necessarily detailed P&ID‘s etc, for the risk
based inspection monitoring. The added value is in the objectives to minimize or eliminate
corrosion problems and not to censure or reprove the design, which seems on occasion to be a
design house concern. The end result will invariably increase stature of the design, and help
maintain critical integrity for production continuity. The campaign should be directed where
possible at existing client procedures and specifications, and may thus be developed as a powerful
superimposing rather than replacing predictive tool, aimed at giving all parties greater peace of
mind for continued life cycle operation.
Where insufficient information exists records should be examined and system walk through used to
generate “ as-installed/existing drawings”, at the same time an NDE orientated baseline survey must
be carried out to augment the data available, and to facilitate comparative data. Specific regulatory
requirements and commercial standards must in all cases be unambiguously defined with client
participation in the review. It can be argued that most materials and corrosion related problems
could be addressed using published data alone. However the advantages of reviewing company
specific design/operations data via independent route, and engaging the company field engineers
can be an order of magnitude greater; often giving the opportunity to identify events in a chain of
actions which could be precursors to failure. Thus if we accept this then the only real hindrance to
resolution is access and motivation. This is true knowledge management, and the application of RB-
CIM can provide the meaningful purveyor.
Personnel and Resources
All RB-CIM plays must buy into the defined scheme objectives. To effect this, some team cross
training will be necessitated and the immediate challenge is to select either engineers for corrosion
training or to pick corrosion specialists for suitable structures/mechanical/ process training. The
answer may be critical since the results at the end of the day must guarantee true multi-disciplinary
objectivity. This is an important issue since experience has shown time and again that resolution to
problem areas is often governed by the specialism of the incumbent. Not always a healthy sign. It
would seem logical that since corrosion is by far the largest component of integrity management
then it stands to reason that the project would be best fielded by trained corrosion personnel.
Generally each discrete step in the process will where appropriate be backed up with staff cognizant
with company reports and relevant practices such as: API, ASME, NACE, BSI, etc. The findings
issued can be used by the client to enhance any compliance requirements, verification, productivity,
and indeed the commercial decision making process. This added value aspect also provides a
tangible means to preserve people worth, promote innovation, and engage the better use of existing
technology, the last of which is often cited as being a major weakness.
Typically the prioritization, inspection, monitoring, and control criteria defined within the strategy
are implemented through the development of an acceptable schedule as work planning.12, 15, 17, 18.
These should be prepared via a written scheme of detailed corrosion/ inspection, and reflect
inasmuch possible per existing company protocols to minimize costs. The inspection workscopes
(reporting templates and equipment) having been compiled using the risk based corrosion threats
identified, should also provide checklists and foreseeable apparatus requirements.12 A good
inspection baseline will ensure sound and meaningful subsequent surveys, and so effort/resources
expended at this stage will be made worthwhile. Additionally modern communication paths such as
the internet offer opportunities to efficiently enhance data review almost instantaneously. Thus
previously identified problems with time lag should be virtually eliminated.

DISCUSSION
Numerous attempts at inspection priority rankings have been successfully made over the years for
structures, pressure plant, and pipelines each with merit.7, 12, 15, 17 The method under discussion
herein may use similar means to quantify integrity, the option would be left to the duty
holder/lessee, and tend to evolve on a project specific basis. In this case at first pass, Figure 4, there
will be outputs from each of the 10 steps, however we would expect more critical outputs after
failure analyses, re-appraisal, and inspection prioritization (urgent, high, medium, low, inert -
UHMLI) risk categorization, with subset risk codings also being feasible. The relative proportions
of likely efforts are best exemplified in schematic form by Figure 5. Documenting this will provide
invaluable company specific data for subsequent passes, and indeed future projects targeting both
better predictive prevention, and less reactive cures.
At second pass client – drawings, inventory/line lists, operating max/min temperatures, pressures,
flow velocities, piping and material specifications, etc will be more closely scrutinized, as will
service appropriation -sweet/sour, process stream chemistry target and actual, pH, chloride, sulfate,
carbonate content etc. And in some instances therefore unquantified data may be requested, and this
could engage additional specific zone monitoring of local profiles, e.g. pressure, temperature, or
velocity as suggested by Figure 6 by way of example. The follow-on characterization of multiphase
fluids, and predicted zones of wettability, and stagnation are likely to provide better appreciation for
critical excursions and aggressive profiles thus leading to greater confidence levels per the selection
of inspection sites and therefore localized corrosion control. Thus the pivotal importance of the
second pass now becomes more apparent, and at this stage advanced NDE may also become more
justifiable. Similar curves may be generated for all major failure or damage scenarios.

At third pass, we would expect very meaningful improvements, and major returning trends on
investment, perhaps up to ~30% reduction of inspection/maintenance schedules being achievable
over ~ 2-5 years. The continually improved risk based, overlaying inspection matrix Figure 7, will
be the main deliverable, hopefully yielding the performance, failure and damage control required for
high risk deepwater ventures. As with all new approaches the results will be highly dependent on
the teams which execute the loop. A near full time expertise covering corrosion /mechanical/
process/risk and structural disciplines is vital to drive the working loop. The capital investment is
not high (maintainable within a small percentage of the pre-determined running budget), and it is
argued that since the methodology will be an overlay onto existing company procedures (and staff)
the cost/time/resource burdens should not be restrictive.
Case Examples.
A range of illustrative offshore, deepwater examples are listed below. Almost wholly, the urgency
of each project has been stimulated by virtue of the deepwater perspective, usually leading to the
generation of an integrated investigation and survey report.
• Pipeline/Umbilical Excursions - quantifying damage control
• Water Injection System Heat Exchanger failures –design anomalies
• Ballast Tank Integrity Issues-spalled coatings and waterline corrosion attack
• Corrosion control/CP design reviews-selection of representative parameters for deepwater
applications.
• Produced Water System Failures-confirm the mechanisms and address
• Cooling System Failures-under designed treatment regimes
• Sea Water Systems – incompatible alloys and the under-specified selection of materials
• Presently working with GOM client with a five year plan- covering various systems.

CONCLUSIONS
The key features of the RB-CIM program are the detailed failure history, design reappraisal,
practically balanced risk prioritization, focused inspection and extended verification. The
methodology could if used as intended, provide the concerted effort to make a major difference in
supporting deepwater developments, in particular where hazop, safety, environmental and financial
margins are tight.
The methodology will ensure that corrosion prevention and control is well addressed, and that
practical fit for purpose solutions are planned, and less reactive further down the line. The 10-step
loop can be constructively applied to structures, pipelines, subsea developments, topsides facilities,
specific equipment or can be directed at selective failure investigations or mechanisms.

The principles apply to new and existing facilities, the strategy and matrix generation should focus
attention to urgent and high risk areas of safety critical items only, thus streamlining effort. Close
adherence to the loop will ensure that practical, theoretical and empirical judgements tend to
converge with re-iteration. Ultimately sanctioning the target of zero corrosion surprises.
 REFERENCES
1. D.E. Milliams K. V. Gelder, Corrosion Management NACE- MP, November1996
2. G.R. Edwards, W. Hanzalek, S. Liu, D.L. Olsen, C. Smith (Eds)- International Workshop
Advanced Materials for Marine Construction, New Orleans Feb 1997
3. B. Singh, S. Donaldson, J. McKechnie, Corrosion Engineering in Offshore Applications,
NACE/NFK Industrial Conference Sandefjord, Norway, June 1993.
4. H.P.E.Helle, Constraints for Low Cost Reliability in Plants, NACE-MP, March 1993
5. B. Singh Corrosion Management-Strategy and Control, Second NACE Asia Conference,
Singapore Sept 1994
6. R.J. Horvath, The role of the Corrosion Engineer in the Development and Application of Risk
Based Inspection for Plant Inspection NACE-MP, July 1998.
7. MMS/CSM Workshop Corrosion Control Marine Structures & Pipelines, Galveston, Texas,
February 1999
8. J. F. Rau Prioritizing Maintenance by Integrity Analysis NACE-MP, January 1996
9. MMS National Potential Incident of Non-Compliance Guidelines Dec 1998 &Revision
Sept2000
10. MMS Dept of the Interior- Title 30 Code of Federal Regulations, Part 250
11. Press and Journal-Offshore Journal, Aberdeen UK Aug 24th 2000
12. Deepwater Corrosion Services-In House RBI Projects 1995-2000
13. M. Mustafa, MS Thesis, Asset Management, Robert Gordons University, UK, October 1998
14. R.F. Herning, Integrated Management of Offshore Oil & Gas Fields in Real Time, OTC paper#
10738/Houston, Texas, May 1999.
15. J.T. Reynolds, Risk Based Inspection-Where Are We Today, NACE Corrosion 2000
Orlando/Fla. Paper# 00690
16. M.T. Trainer, Major Hazards and Emergency planning, HSE Laboratory, UK, March 1998.
17. J. Kallaby, P.E. O‘Connor, OTC paper# 7487, Houston, Texas, May 1994.
18. JD Garber, A. Alverado, R.H. Winters, Study Tracks Internal-Corrosion Trends in Aging
Pipelines Oil & Gas Journal, Vol 98, #13 March 2000.
LIST OF TABLES AND FIGURES CAPTIONS

Table 1 Abbreviation and Symbol Glossary

Figure 1 Typical Failure and Cash flow schematic
Figure 2 Risk Based Corrosion Integrity Management
Showing the methodology of the 10 step working loop
Figure 3 Typical Engineering Fitness for Purpose-Bands of Operability Criteria
Figure 4 First Pass Failure/Risk analysis flow/work sheet. The criteria may follow available
quantitative probability data or qualitative judgement based experience. A consistent
weighting protocol would be suggested.
Figure 5 Schematic showing the likely roles and efforts of multidisciplined groups within a
typical project. Individual project dynamics will shift the balances pending specific
requirements.
Figure 6 Example illustrating likely corrosion rate trends as pipe flow conditions change from
stagnance through erosion to cavitation, emphasizing need to quantify flow regime,
whether steady state, variable shutdown, transient/excursions etc (adapted from Ref. 3)
Figure 7 Typical Corrosion/Integrity, Hazard, Operability, flow sheet after 2nd and 3rd pass
iterations of the RBCIM loop. End result is the live condition prioritized inspection
matrix, suitable for both equipment items as well as systems.
 Table 1 Abbreviation and Symbol Glossary

ABBREVIATIONS

ALARP-As Low As Reasonably CAV-Cavitation CBDN-Coating Breakdown

Practicable
CREE-Creep CREV-Crevice Corrosion DeCMS-De-Commissioning

COMP-Compatibility Issue CW-Cold Work CUI-Corrosion Under Insulation

DEAL-DeAlloying ERO-Erosion FAC-Flow Assisted Corrosion
FILI-Filiform Corrosion FRET- Fretting GALV-Galvanic Corrosion
HE/HIC-Hydrogen HSE- Hazops, Safety, & LME-Liquid Metal
Embrittlement /Induced Cracking Environment Embrittlement
MARF-Marine Fouling MIC-Microbially Influenced NPSH-Net Positive Suction
Corrosion Head
PIT-Pitting SCAL-Scaling SCC-Stress Corrosion Cracking
SND-Sand STAG-Stagnant Pocket UNF-Uniform Corrosion
Corrosion
VIB-Vibration WAX/HYD- Wax/Hydrates WEAR-Wear Corrosion

SYMBOLS
Ecorr- Ff-Friction Factor htc-Heat Transfer Coefficient
Corrosion Potential Hs-Hoop Stress
Nu-Nusselt # P-Pressure Re-Reynolds#
Rx-Surface Roughness Rs-Residual Stress T-Temperature
Ts-Torsion Stress τ-Shear Stress V-Volume
v-Velocity Ws-Working stress Ys-Yield Stress
 Step 1. Step 2. Step 3.
Historical Review Design Reappraisal Develop Strategy
Failures, Damage, against Service Walk Systems
Inspection & Excursions Assess Practices

Step 5. Step 4.
Perform Inspection Develop RBI
& NDT Matrices
U,H,M,L,I
RE-ITERATE &
FEEDBACK
LESSONS
LEARNED Step 6. Step 7.
Data Interpretation Reporting
Data Basing Produce Prioritized
Action Lists

Step 10. Step 9. Step 8.

ExtendedVerification Define Issue Corrosion
Validate Actions Fit for Purpose Condition & Integrity
Satisfy Regulations Solutions Statement

Legend Steps 1-3 Risk Assessment Activity

Steps 4-5 Risk Based Inspection Activity

Steps 6-10 Risk Management Activity

FIGURE 2 RISK BASED CORROSION INTEGRITY MANAGEMENT

METHODOLOGY 10 STEP WORKING LOOP

Note: The loop can be applied to a structure, pipeline, topsides, item

of equipment, specific survey, or discrete failure mechanism.