Journal of Loss Prevention in the Process Industries 23 (2010) 936e953

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

20 Years on lessons learned from Piper Alpha. The evolution of

concurrent and inherently safe design
Binder Singh a, *, Paul Jukes a, Ben Poblete a, b, Bob Wittkower a
a
IONIK1 ConsultingeJP Kenny Inc., 15115 Park Row, 3rd Floor, Houston, TX 77084, USA
b
Cameron, Houston, TX, USA

a r t i c l e i n f o a b s t r a c t

Article history: It has now been well over 20 years since the North Sea Piper Alpha disaster in 1988. There have been
Received 28 May 2010 many lessons learned; some documented others just etched in memory. The event chronicled many
Received in revised form significant changes in the offshore industry. The emanating point for most sweeping changes has been
15 July 2010
the Cullen Report and the UK North Sea industry. This paper reviews some of the critical lessons and
Accepted 30 July 2010
identifies many ‘secondary’ finer points that constitute important learnings. The paper looks at major
changes instigated by step changes in safety criticality. It is argued that the ‘second tier’ modes of failure
Keywords:
such as corrosion, materials degradation, environmental cracking, erosion, plant ergonomics, etc. need to
Integrity management
Safety
be better examined. These mechanisms are dangerous threats to the integrity of deep subsea assets, and
Corrosion it is noted that such root causes of failure as witnessed or predicted have yet to be fully appraised. The
ALARP authors’ use wide experiences and case histories to highlight such concerns, offering rational fit-for-
Key performance indicators purpose solutions. The industry disconnections between, urgency to build, knowledge transfer, and
Lessons learned management of change, are refocused. Powerful advances in risk-based mechanical, process, materials,
and corrosion engineering are emphasized and the use of key performance indicators (KPIs) are reasoned
for best life-cycle integrity. To keep up with the pace of growth in the deepwater sector, methods of
concurrent and inherently safe design have evolved in a world where the practicalities and costs of
modification, repair and retrofit are extremely difficult. Hence getting it right at the outset is paramount.
Thus the drive for purposeful investment, at design is more justifiable, than the traditional practice of
postponing costs (and problems) to operations. In this way the ominous ‘gray’ zone between the two cost
centers is better bridged for reasons of safety and commercial advantage.
Ó 2010 Elsevier Ltd. All rights reserved.

1. Introduction
After the recent 20th anniversary of the Piper Alpha offshore
disaster a paper was prepared and delivered to the OTC conference
in Houston Texas, in May 2009 and a upon invitation the exercise
was repeated for the Offshore Brazil conference in Macae, Brazil in
June 2009. This paper is based on an adaptation of the OTC paper
(Singh, Jukes, Wittkower, & Poblete, 2009).
On the 6th of July 1988, the world’s worst offshore oil industry
disaster occurred on the Piper Alpha platform in the UK sector of
the North Sea. The loss of life was staggering: 167 dead, with 62
survivors, and dozens badly injured. Much has been written and
debated on the incident. This paper examines a new angle on the
* Corresponding author. Tel.: þ1 281 675 1020.
E-mail address: binder.singh@wgim.com (B. Singh).
1
IONIK now rebranded to: Wood Group Integrity Management.
subject matter, in the context of inherently safe design, and the
allied second tier items of interest. These are the corrosion-related
items that have been accepted as pertinent over the years, but often
erroneously perceived with less priority. This is largely because the
subject matter is considered too specialistic, or complex and often
requiring costly subject matter expertise. As a result, corrosion
integrity is sometimes dangerously taken off the agenda by non-
subject-appreciative project or even industry leaders. This paper
delves into this contentious area, examines the role of corrosion
mechanisms in the root cause analyses of most significant failures
and virtually all loss of performance issues. The interpretations are
made with the support of solid observations and new under-
standings in the direct context of integrity and corrosion manage-
ment. The authors come from a mixed blend of offshore disciplines,
with over 80 years of combined experience, predominantly from
the North Sea and Gulf of Mexico. The objectives are aimed to be
educational and not controversial, but the opinions are strong, and
considered very worthy of continued debate and development.

0950-4230/$ e see front matter Ó 2010 Elsevier Ltd. All rights reserved.
doi:10.1016/j.jlp.2010.07.011
 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
Fig. 1. Piper Alpha before accident e Courtesy Wood Group (Wood Group HSE Matters,
2008).
The Piper Alpha accident was a monumental event, see Figs. 1
and 2. It is, perhaps, in terms of impact a top-five engineering
disaster on the global scale, considered to be in the same league
as Chernobyl, Challenger, Three Mile Island, Flixborough, etc.
(BP Booklet, 2004; Kletz, 1998; Lees, 1980; Lord Cullen Report,
1990; Neal, 2007; NTSB). And in many ways it is historically
comparable to other high-impact human events such as the
Kennedy assassination, New York 9/11, London 7/7, and Mumbai
11/27, in that people (certainly in the British Isles and the North
Sea community) often remember where they were on the day. In
that way the Piper Alpha seems to have uniqueness about it,
which may be due to the fact that it was offshore and involved
a heavily manned producing platform. The major differential has,
with the benefit of hindsight, been that the disaster was de facto
man made, though not a deliberate act in any way, but human
and engineering errors were seen to hideously come into play.
Many studies have looked at that aspect, the center piece of most
if not all being the ensuing public inquiry and the Cullen Report
which was published in 1990 (Lord Cullen Report, 1990). This was
the culmination of a thorough two year inquiry involving many
interviews with survivors, families, and subject-matter experts of
the day, with many others on the outside offering immediate
opinions on the many public affairs programs of the day, as
seems to be the norm under such events. It was also commonly
noted for truck loads of documents being delivered to the
courthouses of London and Aberdeen, and that was a reflection of
the non-electronic transfer of documentation, as might be
Fig. 2. Piper Alpha explosion e adapted (Coastal Training Technology Corporation,
2007; BBC web pages).
937
expected in today’s computer driven age. The Cullen report has
tended to be the main stay reference source for all new offshore
design and operational guidelines the world over. Some regions
have used the findings rigorously whereas others have used them
less in depth. Overall the report led to the effective dissolution of
the prescriptive regulations sanctioned up to that point, and
replaced same with the evolution of the goal-setting integrity
regulations in the UK and with derivatives thereof. On the plus
side the major outcome of the disaster has been far better, safer,
and more efficient engineering practices for the oil industry. And
indirectly has supported strongly the need for inherently safe
designs and procedures. These have been realized by better, more
focused research, better applied knowledge management, and
a greater sense of public and industry responsibility by the new
generation of engineers and scientists. Many more offshore,
subsea and integrity-related courses have evolved worldwide,
largely at postgraduate level, much to the advantage and
betterment of the industry. This has been promulgated by the
better realization by professionals in the industry that designing
to build the asset, structure, pipeline, and pressure plant can no
longer be based on projected revenues alone. Yes, the ultimate
decision maker or breaker can and often is the commercial
sensibility, but a greater sense of responsibility to the public, and
the environment, has fallen into place. This is largely regulatory
driven, but one can still discern a good dose of professionalism,
merit and worthiness in the arena.
1.1. Root causes
Regarding the accident there was, perhaps, no single root cause
event that was to blame. Rather, it was a confluence of many critical
factors that were almost the ‘perfect storm’ often described as the
jigsaw or ‘Swiss Cheese’ effect, whereupon critical events occurring
at a certain juncture in time, and as a consequence the failure jigsaw
fell into place, with tragic results. In reality integrity management
(IM) is far more complex than maintenance (a common misnomer),
the parameters affecting IM are non-linear and influential during IM
pre-planning, post planning, action and reaction, etc., and indeed
the alignment of bad sequences, events or circumstances are
invariably all time dependent and thus multi-dimensional in nature.
This has traditionally made IM a difficult subject to grasp, especially
since it transcends both the capital expenditure (CAPEX) and
operating expenditure (OPEX) cost centers.
The Piper Alpha was commissioned in 1976, but was modified to
act as a major gas processing and gathering hub. This meant it was
handling large amounts of high-pressure gas, with a dispersed plant
layout, making inspection, maintenance and repair difficult. The
rapid technology advances of the day, coupled with powerful
commercial pressures, clearly had a lot to do with the event, and this
paper looks at some of these important issues, with the benefit of
hindsight but also with strong opinions forged over time (BBC web
pages; Coastal Training Technology Corporation, 2007; Fontana,
1984; JP Kenny, 2005e2008, 2008; Private Correspondences with
Messrs Ben Poblete (LR/Cameron), 2000e2008; Singh, Britton, &
Flannery, 2003; Singh, Britton, Poblete, & Smith, 2005; Singh, Folk,
Jukes, Garcia, & Perich, 2006; Wood Group HSE Matters, 2008).
Regarding the best way forward it is important to identify all
integrity-related threats, some of which may be discerned as at
a secondary level, albeit with the potential to give similar disastrous
results if not taken fully into account. The majority of these are
materials performance and corrosion related. The latter is an
important point, and the paper takes a critical view of the changes
that have been instigated since Piper Alpha, not so much from the
large structural engineering angle, but more from the viewpoint of
these second tier issues, which usually arise within lower profile
938 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
design parameters, for example pressure (leak) containment,
corrosion analysis, erosion, wear and tear, inspection, monitoring,
pigging, and maintenance, etc.
Due to the media frenzy of the day, the causes were variously
reported over the first year as: metal fatigue, poor maintenance,
inadequate operating procedures, bad work practices, human error,
etc. The full report is a public document, and much educational
material, video s/DVDs, etc. are readily available for the interested
reader (BBC web pages; Coastal Training Technology Corporation,
2007; JP Kenny, 2005e2008). Essentially in the context of this
paper the Cullen report, and other studies have highlighted many
reasons for the disaster, the most damning of which were:
 Poor plant design (including with regard to modifications and
changes)
 Breakdown of the permit-to-work system
 Bad maintenance management
 Inadequate safety auditing, and training procedures
 Poor communications (all levels)
 Poor emergency management (including with regard to
surrounding platforms)
The Cullen report (Lord Cullen Report, 1990) made over 106
recommendations, which included in summary:
 The transfer of government responsibility for offshore health
and safety to the Health and Safety Executive (HSE) was
generally received well. (Note: the public observed this as
government taking some responsibility, too.)
 The establishment of a Safety Case regime (This was to entail
independent verification).
 Overall review of legislation, definition of best practices, and
better use of loss prevention studies.
 Better work force involvement (crucial but sensitive).
 Verification and intervention when necessary.
 Permit-to-work systems (ideally fail safe and tamper proof).
 Systematic approach to safety, responsibility of everyone
(senior management and down the line).
 Emergency response and incident reporting (effectively by
training and changes in attitude and culture).
It has to be said that most of the activities listed above still fall in
the grey area of judgment, and in that case best practices must
therefore be interpreted and applied through the identification of
safety-critical systems and components, proactive risk analysis, risk
reduction, and therefore risk management (Singh et al., 2005). There
are many other important derivations from the Cullen report, but
without unnecessarily going outside the scope of this paper, it is quite
clear that management of change (MOC) is and will continue to be the
best tool available in the ever-improving area of knowledge
management (Deepwater Corrosion Services Inc, 2008; DOT
Regulations; JP Kenny, 2008; JPKenny/University of Houston, 2008;
JPKeIonik, 2005e2008; Mueller, 2006; SCOTA/UKOOA, 1995; Singh,
2007; Singh et al., 2007; UK HSE, 2001; UMIST/University of
Manchester Corrosion Center, 1983e1995). The electronic age of
software and modeling analyses has made documentation prepara-
tion and transfer so much easier that we are only limited by our
ability to assimilate and interpret the information across multidis-
cipline areas (API 14E RP; Ramachandra, 2007). This is where core
personnel competencies come into play. For a better, safer, and more
efficient work force and management, suitably trained and educated
offshore engineers and scientists must be provided by our educa-
tional institutes. To that effect first-rate universities across the North
American, European, and Australian regions in particular are churn-
ing out scores of postgraduates annually in the key disciplines of
materials, corrosion and integrity engineering (Ohio University,
2007; UMIST/University of Manchester Corrosion Center,
1983e1995; University of Tulsa, 2007; WGIM Internal Training
Modules, 2000e2008). As these people pick up practical experi-
ence and supplement the traditional engineering and sciences, this
can only be a boon to the integrity management discipline, and
therefore better engineering practices for the offshore and energy
industries generally. The concept of better work force involvement is
a sensitive issue since it is still commonly expressed by workers in the
field that an over exuberance with offshore safety at the metaphorical
‘coal face’ can lead to the ‘not required back’ (NRB) factor, which still
has a tempering effect on employee involvement (Hibbert, 2008;
Private Correspondences with Messrs Ben Poblete (LR/Cameron),
2000e2008).
1.2. Industry changes
The many ensuing industry changes identified since the disaster
have, in fact, taken many years to come to fruition. Overall most
offshore regions, in particular the North Sea, Gulf of Mexico (GOM),
and Australia have embraced the new culture of safety. Although
there is sometimes a dangerous disconnect between theory and the
actual practice of implementation. The rest of the world (ROW) has
responded in a slower manner, but with positive results, especially
the SE Asia regions and offshore India. The very heartening imple-
mentation of best practices (by choice, not necessarily regulation)
has given greater confidence for the new, challenging deepwater
explorations and subsea tie backs in the GOM and the new frontier
Arctic regions (JP Kenny, 2008; Singh et al., 2006). The most notable
changes again in the context of this paper are interpreted as follows:
 Changes to offshore asset design, requirements for design
review, more latitude for concept creativity, better rationale for
engineering conservatism and pragmatic safety.
 New goal-setting legislation, i.e. the Safety Case.
 The goal-setting idea replaces the prescriptive method. This
has proved to be a step change in offshore safety and engi-
neering performance.
For the important GOM region it has been stated that the
regulations conferred by the governing Mineral Management
Services (MMS) are ‘fit-for-purpose.’ This suggests the designs are
suitable at construction, but the gradual drift of this meaning has
evolved to ‘life-cycle fitness-for-purpose’ and this appears to be
adopted and embraced by the more recent generation of engineers
(typically 5e10 years experience) as they enter the fray. The subtle
debate now ongoing is at the material selection stage. There are two
schools of thought, namely the distinction being made, whether to
select carbon steel and then carefully manage the operational
corrosion, or to select the corrosion-resistant alloy (CRA) option
with minimal corrosion management. The contrary arguments are
usually cost-center based, with strong opinions tested for CAPEX
and OPEX scenarios. In other words, do we pick materials for
immediate fitness for service at fabrication (‘just build it’) or fitness
for materials life-cycle performance? The answer is now emerging
as a requirement for both, and to that effect the materials engi-
neering specialist is having an ever-more assertive role to play
within the large multidiscipline teams usually engaged on high
capital projects (JPKeIonik, 2005e2008; Singh et al., 2006; Singh &
Krishnathasan, 2008).
1.3. Implementation
The implementation of the Cullen report recommendations
has, it is believed, shown through various studies that reportable
 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
incidents that impact safety issues in the UK sector have been
significantly reduced by some 75%; a major achievement (Private
Correspondences with Messrs Ben Poblete (LR/Cameron),
2000e2008; SCOTA/UKOOA, 1995; UK HSE, 2001). This clearly
means the industry is on the right track, but there are still
problems and issues. It is argued that more attention should and
must be made to the secondary tier items such as root cause
corrosion mechanisms, advanced monitoring and inspection
techniques, etc. This aspect is best illustrated by an adaption of
the ‘Swiss Cheese’ effect as shown in Fig. 3. It is to this effect that
this paper is targeted, with the intent that by paying more
focused attention to these parameters and findings that the
integrity management discipline will be more substantively
improved. The Cullen report also identified two areas of under
emphasis that may be appropriately reasoned, firstly the industry
tendency to avoid the acceptance of external consultants’ advice
if the recommendations are not supported by more experienced
personnel, often even if the consultation seems logical and safety
sensible. The case of the central riser argument for the Piper
Alpha is cited; here evidently the dangerous proximity of the
risers to the control and radio room areas was, in fact, identified,
but no action taken (design change, relocation, blast walling,
etc.). Nowadays virtually all new designs insist on the risers being
on the outside perimeter of the offshore asset. The second point
of observation is the concept of addressing root cause effects. The
Piper Alpha condensate pump problems that initiated the whole
tragic sequence of events were plagued with corrosion problems
the attendance to which was seemingly consistently delayed as
lower priority. Apparently some platform corrosion issues were
left for over four years (JPKeIonik, 2005e2008). If corrosion
management as a recognized discipline had been in place, rather
than an ad hoc to-do item, then again, with the benefit of hind-
sight, the tragedy could have been avoided. That, unfortunately,
is how the learning and knowledge management process works.
And it has to be said that companies today often have very
valuable lessons-learned meetings after major projects are
concluded. There is a strong case, and new initiatives, underway
for such formal lesson learnings on an ongoing basis (BP Report,
2004; JPKenny/Ionik; SCOTA/UKOOA, 1995; Singh, 2007).
The use of modern-day corrosion risk assessment techniques
are under development and application. It is hoped that ulti-
mately these will be implemented by the weight of motivation,
though in reality some degree of mandatory regulation may be
ultimately required (IONIK JIP, 2008; JPKeIonik, 2005e2008).
Fig. 3. The ‘Swiss Cheese’ Analogy as applied to materials engineering.
939
These and other related points of view are made in the paper,
hopefully to reinforce some of the many lessons learned over the
past 20 years or so. In almost all major comparable disaster cases
the commonality has been the confluence of many variables
coming into a tragic alignment, sometimes referred as the jigsaw
or ‘Swiss Cheese’ effect. It is argued in this paper that in almost
all cases the loss of materials performance as stimulated by
corrosion is the root cause effect. A close examination of the
modes of failure reveals the uncanny role of corrosion dissolution
at either the macro or micro level (whether it be by alloy,
embrittlement, crevice corrosion, mixed metal galvanic, etc.) the
outcome is the same: severe loss of material properties and/or
load carrying capabilities (Fontana, 1984; UK HSE, 2001). The
resolution of the corrosion aspect will, therefore, in virtually all
cases eliminate the closure of the jigsaw effect, thereby pre-
venting the failure. On a positive note, the concepts of knowledge
management, advanced inspection techniques, implementation
of MOC, and the more newly defined roles and responsibilities for
pertinent decision makers, etc., have all been very instrumental
in making this industry safer and better equipped to tackle the
challenges faced ahead. It is strongly argued that one new
recommendation that would be instrumental in helping improve
this aspect an order of magnitude would be the ‘mandatory’
requirement for each asset to submit a clear annual corrosion
integrity statement on the facility, and pertinent (safety-critical
parts) thereof (JPKeIonik, 2005e2008). The burden for doing this
is not high, but the results would be extremely positive.
1.4. Threats to asset integrity
It is very important for society to progress positively and look at
lessons learned in all disciplines from time to time. However, in the
engineering field the need is most pressing. The world is changing
fast, with unprecedented population growth, and competition for
sustaining resources such as water, food, and energy. The oil and
gas industry is pivotal to such growth, and must, therefore, take
note of demand for production, and demands for best safe, efficient,
and environmentally friendly solutions. The structures, pipelines,
pressure plant, and parts thereof must be designed and operated at
optimum conditions, whilst retaining mechanical integrity over the
life cycle. One of the greatest threats to any asset integrity is the
degradation of the asset with respect to time, i.e. the design life or,
more appropriately, the life cycle. In that context the most domi-
nant degradation phenomena per se is corrosion. And in that regard
940 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
there are many mechanisms of corrosion, all of which come into
play at varying levels of intensity. The early work by Fontana et al.
(Fontana, 1984) suggested eight clearly defined corrosion mecha-
nisms, though more recent work is pointing to more than ten
(JPKeIonik, 2005e2008; SCOTA/UKOOA, 1995; Singh et al., 2003;
WGIM Internal Training Modules, 2000e2008). For the upstream
oil and gas industry, it is common to delineate these into the major
damage threats, whereupon many studies (Canadian/Russian in
particular) over the past 10 years or so have shown that internal
corrosion is the dominant cause of failure, typically by over 50% in
practice (JPKenny/Ionik; WGIM Internal Training Modules,
2000e2008).
Whether the corrosion failure is on pipeline, riser or topsides
equipment there is in practice nearly always a precedent, thus
working applied design life solutions can normally be formulated.
At the same time it is however, important to continue with
fundamental or near fundamental research to help understand
failure mechanisms better so more permanent solutions can be
implemented as time marches on. The concept and consolidation of
the corrosion and erosion JIPs have helped to bridge the link
between industry and academia, with valuable results (Ohio
University, 2007; University of Tulsa, 2007). The trick however, is
to ensure that the results are interpreted and applied by skilled and
experienced personnel, preferably staffers who are very cognizant
of the JIP data being generated, and have had a role in the devel-
opment of the laboratory and field testing programs. As an example
the threat breakdown for risers, though quite similar, will have
particular nuances to be taken account of, such as the translation of
horizontal pipeline flow regimes to vertical regimes with a poten-
tially high-risk corrosion activity at the base transition. Similarly,
topsides pressure equipment will be safety critical, and perhaps
warranting greater latitude on the monitoring side, such as area
ultrasonic testing (UT) mapping and thermal imaging in the high-
risk underside (six o’clock positions). There should also be a greater
emphasis on the external corrosion aspect, especially at supports
whereupon several major failures have been observed due to
crevice corrosion being accelerated where wet marine air has
condensed out high chloride pockets in susceptible areas
(Deepwater Corrosion Services Inc, 2008; Singh et al., 2003, 2005).
This is a significant problem in the GOM where warm temperatures
(>21  C) and regional humidity levels are routinely >80%, pretty
much year round.
On the plus side there are many fit-for-purpose solutions, such
as the use of inert I-Rod type inserts, which if used correctly can
virtually eliminate crevicing geometries (Deepwater Corrosion
Services Inc, 2008; JPKeIonik, 2005e2008). The use of thermal
spray aluminum (TSA) coatings is also a very viable solution for all
topsides equipment external and internal surfaces. This is
a reflection of onshore technologies being carefully transferable to
offshore applications, provided subject-matter expertise is wisely
used and safety is not impaired (JPKeIonik, 2005e2008; Singh &
Krishnathasan, 2008).
1.5. The aftermath
Post Piper Alpha, studies (late 80s and 90s) revealed the
important need for corrosion management. That concept was likely
first coined by researchers at UMIST/Manchester when that group
realized that corrosion control really defaulted to corrosion
management as the discipline was a fine balance of integrity and
finance management (UMIST/University of Manchester Corrosion
Center, 1983e1995). Thereafter, the term seemed to be broadened
to cover for monitoring, chemicals, pigging and inspection, thus
leading to the term inspection management. It was, however, very
important to include the pressure vessel and piping community
and it is believed that lobby led to the evolution of mechanical
integrity management. In time, mid-late 90s the terminology
seemed to reach a consensus at integrity management (IM). In
terms of proportion, IM is still effectively a corrosion management
exercise and that was argued in early pioneering studies by Prodger
et al. (Prodger, 1997)., leading to the conclusion that IM was
effectively 80% corrosion related, covering all assets (marine/
offshore/industry). The concept of a corrosion management
strategy (CMS) has therefore evolved, this supplies the high-level
approach to IM, and is usually a system FEED-type study, quickly
converting to a tactical (nuts and bolts detail) type corrosion
control manual, which forms the basis of the life-cycle IM plan. The
plan is a live, ongoing document modified or revised as new data or
findings become apparent and usually encompass detailed, risk,
reliability, inspection, intrusive probes and coupons, pigging, fluid
sampling, chemical injection, and mitigation procedures, and
studies. As with all good science and engineering it is vital to
quantify critical parameters, and to that effect the concept of key
performance indicator (KPI), has been modified and applied to IM
studies (Singh, 2007; Singh et al., 2006; Singh & Krishnathasan,
2008). Thus, the qualitative nature of risk-based judgments is
honed to a more easily repeatable and consensus-based decision
gate system. Some examples of recent KPI studies and their appli-
cation are presented later. These must always be considered and
applied and agreed on a project-specific basis, with the appropriate
sign-off from subject-matter experts in materials, corrosion,
CP/coatings, etc. Most career offshore engineers do in fact observe
near misses on a regular basis, with incidents related to fire, leaks,
mechanical integrity, topsides equipment, poor inspection, etc.,
being responded to with duly diligent team actions. However the
potential for mishaps is always there, especially where corners are
cut to meet production and cost issues. This ‘Achilles heel’ will
always be there but hopefully minimized as leadership and the
industry progress.
1.6. ALARP, corrosion hazard, and inherently safe design
The commonly accepted approach to safety assurance or
ALARP is now to ensure on the basis of suitable and sufficient
evidence that risk is as low as reasonably practicable (ALARP).
The concept of ALARP is often interwoven into the risk analysis
and/or safety management from the very beginning (JP Kenny,
2008; JPKeIonik, 2005e2008; Singh et al., 2006; Singh &
Krishnathasan, 2008) Corrosion must be considered a func-
tional hazard for this approach to be applicable. Fig. 4 depicts the
ALARP triangle with the processes and descriptions for each
segment. Further, since there is a lack of code guidance per
internal corrosion, one way forward is to use the concept of
ALARP to define the limitations or boundaries of the corrosion
parameter, and therefore aid (technical and legal) argument
defensibility. Since inherently safe design (ISD) is often perceived
as a costly CAPEX discipline, there is a forceful argument that
suggests that by strongly utilizing ISD in the Integrity Manage-
ment basis (typically by best materials selection, geometries,
chemicals, etc.) then coupled with concurrent changes, revisions,
MOCs, etc. in the same vein, a truly best practices regime can be
set up. The cost factors are easily justified by reduced OPEX costs
over the life cycle. However the ‘pay now or pay more’ later
theory has never fully made the grade, and in reality it usually
takes an event like the Piper Alpha or Carlsbad (New Mexico,
USA) before significant paradigm shifts in attitudes are made,
even then only with the force of regulation. Alternatively the
Joint Industry Projects (JIP) might be seen as the conduit for best
technology advancement and best knowledge interpretation and
management in this regard. Once concurrent design and ISD
 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
Fig. 4. The ALARP triangle depicting the importance of corrosion risk assessment in
the risk management and loss prevention exercise. Having the right blend of multi-
disciplined engineers is key to success if multi-facetted failure mechanisms and root
causes are to be properly addressed.
move closer towards amalgamation then the case for concurrent
and inherently safe design (CISD) may become a university
taught and thus industry practiced discipline.
There are actually more than 10 recognized mechanisms of
corrosion, viz: 1) uniform corrosion, 2) pitting, 3) crevice, 4)
erosion (including impingement/cavitation), 5) galvanic, 6)
selective leaching, 7) intergranular, 8) fretting/wear, 9) stress
corrosion cracking (SCC), corrosion fatigue, hydrogen damage,
embrittlement, etc., 10) Other creep/embrittling, etc. (JPKenny/
University of Houston, 2008). For offshore and subsea condi-
tions the critical mechanisms are a function of reservoir
composition; and the most dangerous threats are therefore CO2
(sweet) corrosion, H2S (sour corrosion and cracking), bottom of
line (BOL), top of line (TOL), and microbially influenced corrosion
(MIC). Once at the tactical stage it is found that corrosion under
multiphase hydrocarbon flows presents the most challenging and
integrity-threatening condition. This problem area has plagued
the industry for many decades. In the USA the challenge is being
met by the continued growth of two major JIPs, at Ohio Univer-
sity under the auspices of Nesic et al. (Ohio University, 2007), and
at Tulsa University under the guidance of Rybicki et al.
(University of Tulsa, 2007). Both JIPs effectively tackle and model
corrosion and erosion and MIC modes of failure through an
exhaustive combination of theoretical modeling, empirical
testing, and field trials. This work seems to be leading the way
globally and in the absence of bone fide codes of practice and
standards, the JIPs are commonly used as a reference point. The
recommendations coming out of the JIPs are membership sup-
ported (largely operator companies and key consultants, engi-
neering companies, etc.), and thus their findings have received
solid acceptance industry wide. The balance of academia and
industry ensures that the decision-making process is not skewed
by overriding commercialism. Ultimately these will tend to be
perceived as the industry standards, filling the void that has long
been present. The results are applicable to all assets tension leg
platform (TLP), mobile drilling unit (MODU), spar, fixed, subsea,
topsides, etc. provided the appropriate expertise is deployed to
allow for the subtle differences across assets and systems, in
other words, from both sides of the aisle: from the operator and
the engineering contractor (IONIK JIP, 2008; Jukes, Singh, Garcia,
& Delille; Singh et al., 2006).
941
2. Corrosion mechanisms per upstream and subsea
Uniform corrosion Well addressed via theory, monitoring good-viable
Pitting corrosion Modeling difficult but R&D done, relevance high risk*
Crevice corrosion Relevant modeling used, relevance medium risk
Galvanic corrosion Modeling hard (danger ‘mesa’ scale related attack),
medium risk
Stress corrosion Empirical/experience, medium risk and reliability
in practice
Erosion corrosion Modeling used-relevance high risk*
Corrosion fatigue Interpretative used-relevance high risk
MIC Very subjective, separate JIPs underway at
Ohio/Tulsa Univ. e risk high*
CO2 corrosion Modeling underway used-relevance very high*
H2S corrosion Modeling underway used-relevance high
TOL Now better quantified e as part of separate
JIP study at Ohio University.
Note 1: perceptions asterisked (*) are best given as ‘localized,’ encompassing
multiple mechanisms. Also all high-risk phenomena can be mitigated down to low
risk with diligent, motivated, surveillance and corrosion management procedures
provided they are, in fact, fully implemented.
Note 2: the assessment of risk can be qualitative, or semi quantitative. The high-,
medium-, and low-risk (HML) nomenclature has been adopted for simplicity and
consistency. HML must always be assigned by materials/corrosion specialists and,
where possible, have justifiable and defensible arguments as support.
Note 3: the use of industry-accepted HML risk designations and simplified go/hold/
no go (green, amber, red) traffic signal type decision gates is a really good evolution
in the design and operational integrity management process.
As with all engineering projects, commercial aspects, project
viability, return on investment (ROI), schedule, etc. are pivotal to
project success. The net effect is that in many, if not most, cases the
project remit becomes ‘design to build’ rather than the preferred
‘design for the life cycle’. This often adversarial development is, on
the one hand, good in that it stimulates solid, provocative discus-
sion, and thus best workable fit-for-purpose solutions can be
attained, however if materials engineers are not strong enough to
debate their corner hard and strong, weaknesses in design leading
to failures down the road can be expected. The only real question
being, where, and when, rather than if, as a result the competitive
forces at work, namely the need for revenue as against best safe
technology (BAST), is often a battle of being ‘smart to out smart’
often identified as the Achilles heel in the IM process (JPKeIonik,
2005e2008; Singh et al., 2005). This is reflected in the weak
argument often used that the design complies with the regulations.
That alone is not enough, it may be a minimum requirement, but
life-cycle fitness-for-purpose is really about managing all
mechanical and corrosion-related degradation mechanisms,
including: stress overload, embrittlement and loss of material
properties, and natural wear and tear i.e. dissolution of the metal
under aggressive environments.
2.1. New build versus old build
Most new engineering applications (green field) invariably
involve a design code or recommended practice as a reference point.
These are usually industry-accepted guidance documents that have
been developed over many years, been through many cycles of peer
review, and tested via experience, case history, etc. Reference to
established codes gives the design and end client credence and
confidence in its workability. One example of that is pipeline cathodic
protection (CP) and coatings, whereupon code compliance (Det
Norsk Veritas (DNV), International Standards Organization (ISO),
NACE International e The Corrosion Society.) is a good yardstick for
successful external corrosion control. Unfortunately, that is not the
case for internal corrosion, largely because the mechanisms of
corrosion are complex and often multifaceted (Jepson & Research
Workers, 1999e2002; Marsh, 2007; Nyborg, 2002; Nyborg &
942 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
Dugstad, 2007; Ramachandra, 2007; Singh, Krishnathasan, & Ahmed,
2008). It has therefore been necessary to develop methods of reso-
lution, the most popular being that of corrosion modeling. The most
common threat to pipeline integrity has been mixed CO2 or sweet
corrosion. In reality even with the large amount of corrosion work
done over several decades, absolute values of corrosion rate still
cannot be reliably predicted without reservation using any of the 15
or so models available (IONIK JIP, 2008; JPKenny/Ionik; Nyborg,
2002). All the models can really do is give a general guidance as to
the corrosivity of the media involved. Thus it can be construed that
the main objective of corrosion modeling or corrosion assessment
has evolved to differentiating (at build) whether or not the carbon
steel will be acceptable as the main flowline material, or, if not,
weather the analysis justifies the use of CRAs as the design basis. The
impact of this decision can be crucial since the CAPEX/OPEX ratio is
greatly affected and will often make or break the project. Thus, the
vital need for the corrosion predictions to be pragmatic and done to
the best possible reliability. In practice the greatest criticisms of the
modeling approach have been the noneagreement of calculated
corrosion rates to the observed field values. For deepwater applica-
tions whether subsea at >4000 ft, at the steel catenary risers (SCR), or
on the host facility (e.g. TLP/SPAR/MODU, etc.), there is little room for
error, since repairs or retrofit can be very costly or practically
impossible. Nevertheless the deepwater campaigns continue and it is
up to engineering companies to offer justifiable but realistic solutions
and where proven data or correlations are not available, reasonable
risk-based ALARP driven decisions are considered justifiable. The
same arguments apply for old build (brown field), whereupon
existing assets often badly corroded need to be assessed for
remaining life and ongoing corrosion. This can be a challenge as
critical parameters such as existing pre-corrosion condition and/or
existing inspection data are not always readily available. Nevertheless
predictive modeling does serve a useful purpose in this regard,
provided the caveats are defined, understood and accepted by the
client (Jepson & Research Workers, 1999e2002; Marsh, 2007;
Nyborg, 2002; Nyborg & Dugstad, 2007).
2.2. Rules, regulations and inherently safe design
Ultimately the integration of ISD into mainstream engineering
practice will almost certainly happen, though as alluded to earlier
the combined efforts of academia and regulatory authorities will
be the most likely catalyst. Whilst external sea water corrosion
control is regulatory driven, the case for internal corrosion is only
heavily implied though not specifically regulatory or code
compliance driven, however that will probably change and regu-
lations in most regions will likely refer to best practice modeling
or corrosion analyses to ensure that corrosion integrity is
accounted for within the integrity management process (Singh
et al., 2006). That change was expected to be imminent and may
still happen within the Federal Rules though there is a powerful
lobby against the changes such that the rule change approval may
be delayed (Singh & Krishnathasan, 2008; Wood Group HSE
Matters, 2008). The onus is, therefore, on diligent designers to
ensure that best safe technologies and techniques are utilized to
understand and predict corrosion mechanisms and corrosion
rates, such that failures can be eliminated or arrested to tolerable
values. As far as the GOM region is concerned a mixture of
prescriptive and performance related criteria are applicable. In
particular the Government Mineral Management Services (MMS)
now slated to be the Bureau of Ocean Energy (BOE) have defined
potential incidents of non-compliance (PINCs), and these may be
interpreted as a corner stone boundary condition for predictive
corrosion control to help focus the designer’s attention and atti-
tude towards safety (Singh, 2007; US DOI-MMS, 2007). Similarly
the Federal Register may be used to support the requirement for
diligent corrosion assessment and management thereof
(JPKeIonik, 2005e2008; US DOI-MMS Federal Register, 2007). It is
recommended that these be used on a case-by-case basis, though
specific differences (usually more onerous may be relevant if
North Sea rules and the Safety Case are applied). In practice, for
steel that means the development of a pragmatic corrosion
allowance. It has been found that the best way to do this in
a convincing and reasonable manner is to utilize interpretation of
the relevant and available rules and codes of practice, suitable
modeling calculations, industry experience and best judgment.
The US federal regulations have stirred debate in the US, and there
are some criticisms as well as positives. Overall, the industry
seems to have embraced the impending rules (DOT Regulations; JP
Kenny, 2008; US DOI-MMS Federal Register, 2007). The main
advancement is likely to be a greater specificity regarding internal
corrosion, perhaps more akin to the UK goal-setting requirements.
The modeling we do should anticipate that and hopefully these
guidelines presented will provide a framework for that. The rules
are US-specific but should serve as a template for defensible
corrosion prediction, which is all the more important in an ever-
more litigatious society (IONIK JIP, 2008; NACE, 2007).
As alluded to previously there are many models available,
(likely> 15) e.g. Norsok M506, Cassandra 93/95, ECE, Hydrocorr,
Lipucor, Multicorp v4 (Ohio JIP), OLGAÒ (corrosion module
inclusive), Predict/Socrates, Tulsa SPPS (Tulsa JIP), ULL model and
others, and whilst most have individual strengths and weak-
nesses, the common critique is invariably unreliable correlation
to the laboratory and more importantly field experience (IONIK
JIP, 2008; Nyborg, 2002). As a rule almost all have little proven
consistency of confidence to field observed corrosion rates. This
is mainly due to the fact that the designs attend essentially only
to the base CO2 corrosion case, and exclude a truly meaningful
localized component, though some claim, and more and more are
trying to include, this and other influencing parameters. The
problem seems to be that the localized component is rarely
addressed in a transparent manner, with no reference to local-
ized criteria or parameters such as crevice/deposit size, stagna-
tion fluid chemistry, crevice pH, differential aeration, etc.
Nevertheless, the use of a suitable modeling or JIP study would
no doubt be accepted as a supporting reference to the regula-
tions. Generally most models have a ‘black box’ critical analysis,
though the JIPs appear to be more transparent at least to the
member companies. The research is still closely guarded though
it has evolved to be more pragmatic and project risk-orientated
(deterministic/theoretical). It is expected to have solid calibration
capabilities with ultimately, a flow assurance-linked corrosion
modeling package seemingly viable, perhaps, by individual
member companies. The latter is difficult but would have the
greatest impact if it could wrap up flow assurance, corrosion, and
safety inextricably to production and, therefore, revenue. This is
a controversial argument but one that would help eliminate the
pressures on project managers, offshore installation managers
(OIM), and other decision makers to continue with producing,
often under fault conditions. That was seen to be quite possibly
the ultimate snafu in offshore history, when adjoining platforms
continued to fuel the fires on the hapless Piper Alpha (BP Booklet,
2004; Coastal Training Technology Corporation, 2007; Lord
Cullen Report, 1990; Singh et al., 2006).
3. Offshore corrosion failure case histories
Even post Piper Alpha there have been many integrity and
corrosion-related failures, and some of the more important types
are presented for illustrative purposes only. It is clear that most are
 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 943

solvable by better using existing knowledge and widely available Age 10 years, no on-line monitoring, produced water system
techniques, including more recently, existing modeling predictive sensitive to poor protective filming, adapted (Singh et al., 2003).
techniques, such as those offered by the JIPs, many of which are
now expanding beyond the closely knit operators to the engi-
neering design houses and consulting groups. This should be of
much advantage to the industry as a whole by infusing an alter-
native layer of checks and balances to drive the research for better
understandings and ergo better solutions. A number of examples
(Case Histories # 1e5) illustrate the role of corrosion in the integ-
rity management process. The first is, perhaps, the first US equiv-
alent of Piper Alpha, in that it led to strident changes in regulatory
requirements via the Dept of Transportation (DOT) (NTSB; DOT
Regulations). The remaining examples are chosen to represent
the types of failure most commonly witnessed; there are many
others available in the literature and industry project files (JP
Kenny, 2005e2008; Singh et al., 2003; WGIM Internal Training
Modules, 2000e2008).

3.1. Case history # 1

Top plate aftermath of the Carlsbad, NM, pipeline failure, Aug
2000. Tragically 12 outdoor campers were deceased. Root cause
determined a combined corrosion mechanism dominated by
chloride/CO2/microbial as exemplified in the micro image below.
Noting that the corrosion was concentrated at the girth and seam
welds at the bottom position, with 72% wall loss, adapted (Kletz,
1998).
3.3. Case history #3
Catastrophic failure of choke sleeve on offshore facility. Failure
mechanism analysed to be combined erosion/cavitation and
impingement. Impinging cavitation forces can far exceed the proof
stresses of most alloys adapted (Singh et al., 2003).

3.4. Case history #4

Sweet (CO2) corrosion is probably the most insidious type of

localized corrosion observed in pipelines and topsides pipework.
The many worldwide applied R&D projects are geared around this
dangerous mechanism. Adapted (Singh et al., 2003).

3.2. Case history # 2

Depicting failed manifold on a fixed platform due to isolated

erosion defect of the steel upstream of an inhibitor injection point.
944 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
3.5. Case history #5
The left hand side (LHS) showing over-active deep-sea anodes,
possibly due to inadequate alloy chemistry, and/or high quantity
presence of uncoated steel or local CRA components. The right hand
side (RHS) showing excessive flaking of Thermal Spray Aluminum
(TSA) coating accelerated by uncoated steel or possibly CRAs in the
immediate vicinity. Both thought to be within one year, observed at
first ROV inspection (Deepwater Corrosion Services Inc, 2008).
3.6. Case histories’ footnote
It is quite common for a precedent to be found in most failure
case examples, so that industry wide cross asset lessons learned are
a powerful tool. However not all case histories are reported
(company confidential), and so analysts often end up re-inventing
the wheel in terms of solutions, although every now and then
a unique new mechanism or mode of failure is unveiled (API 580,
2002). The most challenging corrosion failures are seen to be
instigated during transient or excursionary physical or chemical
conditions, often at start up, commissioning or unplanned shut-
downs. The corrosion defect propagation is often during steady
state operations, but must usually be addressed at initiation if
corrosion control is to be effective. That invariably requires very
close monitoring, recording and analysis of critical pressure,
temperature, velocity (PTV) data as well as close scrutiny and time
periodicity of inhibitor dosing losses, etc. That is more viable now
with the new generation of multiphase flow meters out on the
market. As a rule, loss of corrosion inhibitor for more than
approximately two to three days in a row is not tolerable, and
a total of 18 days per annum is the equivalent to a 95% availability
factor. The ‘guaranteed’ performance of corrosion inhibitors under
cocktailed (mixed flow assurance chemicals) is a vital requirement
in many solution options (JPKeIonik, 2005e2008; Marsh, 2007;
Singh et al., 2008).
4. Hierarchy and rules
Once the main corrosion threats are identified, it is usual to
formulate a corrosion management strategy (CMS) plan of action.
The hierarchy or order of such events is best expressed as follows:
CMS > Inspection > Corrosion Monitoring > Pigging > Mitigation/
Control
Once the sequence has been applied on a component-by-
component or segment-by-segment basis, an appropriate written
continued-fitness-for-purpose statement should be made, on
a three or six month basis at first year for new facility depending on
production water cut realized in practice and thereafter on an
annual basis, with ‘sign off’ by appropriate technical authorities. It is
considered that within the modern offshore industry, the major
corrosion-related threats are:
 Sweet/sour (CO2/H2S) corrosion (under close attention of JIPs)
 Under-deposit corrosion (particulates or sand)
 Dead leg corrosion (mini or maxi stagnation fluid sites)
 Sand erosion high-velocity impacts at bends, tees, etc., but also
at straights
 Microbial episodic biofilms in particular
 TOL corrosion, mainly per gas lines
 Loss of passivity at the CRA surfaces must be assessed for all
(i.e. oil and gas lines)
All the above threats should be quantifiable with diligent inte-
grated on-line corrosion monitoring (coupons/probes/fluid analyses/
ultrasonic (U/T), etc).
The target corrosion rate for steel should be set at 0.1 mm/y and
all chemical, PTV adjustments focused around that threshold
number. As guidance deviations to 0.15 mm/y may be tolerated for
short periods (<2 weeks) and maximum of 0.2 mm/y accepted for
shorter periods (<3 days). Data beyond these frames would raise
a red flag, to be immediately attended to by the chemical inhibition
vendor. In contrast target corrosion rates for passivating surfaces
can be <0.05 mm/y. Data beyond that should be re-examined and
other methods deployed to investigate. As a result of recent dia-
logue between various company CAPEX and OPEX groups it seems
there is a moving away from target corrosion rates, and a closer
acceptance of best corrosion data within corrosion management
strategies (API 1 7D). Threats perceived for passivation, must be
examined via accelerated corrosion tests, using real fluid samples
for best representation. Risk-based matrices are often used to
balance accepted risk (high-H, medium-M, low-L) against conse-
quences and confidence levels (refer to Fig. 5 as a simplified
example).
The pertinent interpretation and argument is that if corrosion
were to be more formally recognized as a hazard risk, then the
formal techniques of hazard analysis will be better applied. Thus
the better use of hazards and operability (HAZOP) studies and
failure modes and effects analysis (FMEA) as discussed later.
4.1. Engineering integrity, corrosion and flow aspects
Essentially, the guidelines are based on second principles
(applied) rather than the first principles (fundamental) as presented
in the early text. This step change is often necessary in practice to
allow fit-for-purpose solutions to be identified. The data can quite
often then be revised as the more fundamental and experimental
data and equations are verified by subsequent testing, field extrap-
olations and project experience. The volume of work being done by
JIPs and the oil industry majors is prodigious, and as such this review
can only be an insight, though an attempt has been made to focus on
relatively recent developments and practices evolving mainly over
the past several years, post 2000 (Ohio University, 2007; University of
Tulsa, 2007). This draws, where possible, on a variety of standards,
recommended practices and technical papers as well as actual rela-
tively recent industry experiences via projects (API 1 7D; API 14E RP;
API 2RD RP; API 580, 2002; Baker, 2007; BBC web pages; BP Report,
2004; Coastal Training Technology Corporation, 2007; Dalziell,
2004; Deepwater Corrosion Services Inc, 2008; DNV, 2000, 2002;
DOT Regulations; EEMUA, 2004; Fontana, 1984; JP Kenny,
2005e2008, 2008; JPKenny/Ionik; JPKenny/University of Houston,
2008; JPKeIonik, 2005e2008; Massey, 1970; Mueller, 2006;
 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
Fig. 5. Showing a 5  5 risk matrix based on high-, medium-, and low-risk corrosion events. The interpreted risk of failure is usually depicted as the product of probability and
consequence of the failure. Many matrices are used ranging from 3  3 to 10  10. The key is to quantify within the context of pre-agreed needs and ensure all parties understand
the implications (JPKeIonik, 2005e2008; Singh & Krishnathasan, 2008).
NORSOK Standard M001, 2004; Ohio University, 2007; Poblete,
Singh, & Dalzell, 2007; Private Correspondences with Messrs Ben
Poblete (LR/Cameron), 2000e2008; SCOTA/UKOOA, 1995; Shreir,
1994; Singh, 2007; Singh et al., 2003, 2005; 2006, 2007; Singh &
Krishnathasan, 2008; Smart, 1990; UK HSE, 2001; UK HSE/TUV-
NEL, 2003; UMIST/University of Manchester Corrosion Center,
1983e1995; University of Tulsa, 2007; US DOI-MMS, 2007; US DOI-
MMS Federal Register, 2007; Vars Operator Standardization; WGIM
Internal Training Modules, 2000e2008; Wood Group HSE Matters,
2008) and as such may be used as a preliminary guidance docu-
ment. Erosion corrosion is still a major threat to offshore and subsea
assets, with related failures being thought to account for more than
30% of all internal degradation-related hydrocarbon releases, or loss
of containment (Private Correspondences with Messrs Ben Poblete
(LR/Cameron), 2000e2008; JPKeIonik, 2005e2008; SCOTA/
UKOOA, 1995).
Since the mechanisms of corrosion and erosion acting together
can be very intricate and multifaceted, in practice help to address
corrosion and erosion issues, engineers often resort to a ‘first pass’
methodology of establishing corrosion rates and derived corrosion
allowance (CA), and thereafter using an additive assessment for the
erosion parameter. Useful guidance on the concept of CA can be
obtained from many sources (Kletz, 1998; Lees, 1980; Lord Cullen
Report, 1990; Mueller, 2006; Neal, 2007; NTSB). And if the corro-
sion rate can be worked out from historical data or from modeling
studies (i.e. the commercially available models or the publicly
available freeware such as Norsok M506 or Cassandra 93/95) then
an adjudged allowance (usually consensus agreed with the client)
for erosion can be made (JPKeIonik, 2005e2008).
It should be remembered that the models only give general or
uniform corrosion rates, and that the real value in corrosion
modeling is not so much the absolute values but the trends and
changes. Also using more than one model allows a cross-checking
device (use any three of the freewares available e Norsok, Cassandra
93 and Cassandra 95 at minimum, and use commercial models if
available). In cases of major conflict or disagreement it is always
recommended to use the worst-case corrosion/thinning values for
best conservatism. There are many corrosion and erosion models
commercially available (>15) and if access to these is available these
should be explored, however, if not there are options outside that
approach, since many similar software packages are often available
as in-house spreadsheets or issued by certain companies for
945
project-specific analyses. Either way, the real value of corrosion and
indeed erosion modeling is mostly in helping the decision-making
process per materials selection and the differentiation between the
use of carbon steel or the alternate CRAs (JP Kenny, 2008; Singh &
Krishnathasan, 2008).
4.2. Guidance and caveats
For carbon steel, typically for low-risk erosion rate scenarios this
might be quantified at KPI values of 0.05 or 0.1 mm/y (JPKeIonik,
2005e2008). If medium or high risks of erosion are present then
more advanced analyses available from independent testing or the
various JIPs already in place, such as at Ohio and Tulsa universities
must be performed to assess this parameter (Ohio University, 2007;
University of Tulsa, 2007).
In practice such values could be up to and well in excess of
10 mm/y. Therein sits the predicament for the corrosionist, namely
what data to use to support one’s design rationale. The subject is
ever complex and such decision making often has to rely on the
planned design economics and the project costs entailed capital
expenditure (CAPEX) versus operating expenditure (OPEX) (Singh
et al., 2005, 2006). In any event the solutions must be fit for the
life-cycle targeted, and typically may either use thicker steel
(greater corrosion allowances) or stipulate the use of a more
corrosion-resistant alloy (CRA). The latter may be solid pipe or steel
pipe lined or clad with CRA, typically at 3e4 mm thickness. Less
than 3 mm is not recommended due to possible mechanical
wrinkling effects that would impact the integrity of the liner
(JPKeIonik, 2005e2008). Table 1 shows typical best practice CRAs
considered for the offshore industry. Regarding the ongoing
evolution of inherently safe design it is interesting to note that even
after so many years since the Piper Alpha there is still significant
project resistance to the formulation of safer designs, and better
more inherently safer materials selection, even though on balance
total costs and economics are favorable over the complete life cycle.
5. Inherently safe design
The technical challenge from an engineering perspective is to
accept that corrosion initiation often occurs under non-steady
conditions whilst propagation thereof is often under steady state
operation. In practice such problems at excursionary conditions,
946 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
Table 1
CRA localized corrosion tendencies, as risk exemplified by pitting resistance
equivalent (PREN), critical crevice temperature (CCT) and critical pitting tempera-
ture (CPT), interpretation oilfield only.
Alloy PREN CCT ( C) CPT ( C) Localized
corrosion risk
304 Stainless steel (SS) 19 <0 15 High risk
316SS 25 <0 20 Medium risk
Alloy 825 33 <5 30 Mediumelow risk
22 Cr duplex (DSS) 37 20 30 Mediumelow risk
25 Cr super duplex (SD) 47 35 60 Low risk
Alloy 625 51 57 77 Low risk
can lead to conflict between the codes, inaccurate prediction of
erosion/corrosion, accelerated damage of chokes, bends, jumpers,
and discontinuities, etc. Some of these difficult but definable trends
can be addressed via interrogation of commercially available
computational fluid dynamic modeling (CFD) such as the various
flow assurance type modeling, as well as specific operator experi-
ences as for susceptible connecting jumpers in particular. And there
are promising solution options with internal coatings/clad/liners,
but care should be taken to alleviate changes in local surface
polarization at undercut sites, localized eddies and temperature
gradients, etc. Nevertheless the intensive use of reliable corrosion
and erosion monitoring such as intrusive (probes and coupons),
and non-intrusive (acoustic transducers), field signature methods
(FSMÔ), ring pair corrosion monitoring (RPCMÔ) spools (or
equivalents), guided wave ultrasonics, wall thickness mapping,
thermal imaging, etc., are proving to be very good early warning
systems for high-risk components (JPKeIonik, 2005e2008). The
close synergy between flow assurance and corrosion integrity is
now more apparent and many companies are now quite success-
fully, and to significant technical advantage amalgamating such
groups (JPKeIonik, 2005e2008; Singh & Krishnathasan, 2008;
Singh et al., 2008).
From a mechanical integrity perspective it is very important for
engineers to think carefully beyond the immediate design codes of
practice, since corrosion and degradation can kick in fairly soon
after start up, often with major degradation issues and problems
with continued operability or fitness for service. To that effect
engineers should consider utilizing the principles of inherently safe
design (ISD) to build in sufficient conservatism and safety (Dalziell,
2004; JP Kenny, 2008; JPKeIonik, 2005e2008; Singh, 2007). Some
important definitions as part of broad ISD and integrity manage-
ment programs can be described as follows:
 HAZARDS e Materials degradation, loss of mechanical prop-
erties or corrosion must be considered a hazard, thus better
legitimizing the risk-based approach, defining: corrosion
risk w probability corrosion failure  consequences. By
defining corrosion as a bone fide hazard, in this way allows the
more formal use of powerful advanced techniques such as
HAZOP, FMEA (failure modes and effects analysis), FTA (fault
tree analysis), ETA (event tree analysis), ISD (inherently safe
design), etc.
 ALARP e Keeping material and corrosion failures ‘As Low as
Reasonably Practicable’. This provides the defensible risk
criteria basis for public and environmental concerns, subse-
quently reducing the critical gaming of financial incentives to
a less dominant and overriding parameter.
 ISD e Inherently safe design e designing such that material
and corrosion failures are avoided or reduced to acceptable
levels, design to ALARP can mean ‘fail safe’ or ‘safe life’
depending on objectives. In practice, used concurrently to save
time and money usually means less moving parts, greater
emphasis on reliability, and the use of CRAs, with attention to
all corrosion threats under all service or non-service
conditions.
 ALARP and ISD e In future may likely be accepted legal terms
in a court of law. Both are strict but actually enforce better
dialogue, greater accountability, more lateral thinking, and
ultimately promote safer life cycle, transparent, solutions. If
applied diligently, they can offset CAPEX with reduced OPEX
(Dalziell, 2004; JPKeIonik, 2005e2008; Singh et al., 2005).
The values given are based on empirical formulae, composi-
tion, and testing and are sensitive to contact electrochemistry.
The alloy elemental compositions and mechanical properties are
available in supplier’s literature. The order of corrosion resistance
is interpreted as:
Alloy 625 > SD > DSS z Alloy 825 > 316LSS > 304LSS.
The values are thought to be more applicable to static conditions
and not sensitive to flow, though in principle if the flow regime can
alter the pitting potential then some sensitivity could be recognized.
Hence in principle standard laboratory assessments should always
be supported by non-standard and fully representative testing and
field observations. To that effect authoritative suggestions for non-
standard, pressureetemperatureevelocity (PTV), upset, or chemical
excursion corrosion testing, within the JIP test rigs, etc., can be
made. Hitherto these would be considered strictly steady state only.
From a predictive erosion perspective it is important to allow for
total wall thinning due to corrosion and erosion type degradation
mechanisms. Generally if this calculation shows a total corrosion
allowance (CA) value of CA > 10 mm then intervention via a suit-
ably selected CRA material either as a solid material or as a lining or
cladding option is often considered. Some operators put this
threshold at 8 mm (or even 6 mm depending on the level of
conservatism supported). Either way the final decision is based on
the economics of the project and the cost implications both at
capital expenditure (CAPEX) and operating expenditure (OPEX)
stages of the project. Another major factor is the length of the
pipeline, generally speaking pipelines beyond 15 km length will
tend to look more closely at carbon steel with highly diligent and
aggressive first-in-class chemical inhibition typically with >95%
efficiency and >95% availability. Internal coating options are also
feasible but would likely still need parallel inhibition schemes to
cover for the protection of damaged coating sites. The inhibitors in
that case would need to be highly proficient at addressing such
sites under crevice corrosion conditions. Designers should engage
the services of experienced chemical vendors in this subject matter.
Where required, the most frequently used alternative CRA material
choices tend to be the nickel alloys, alloy 625 and alloy 825, with
the martensitic and austenitic stainless steels also commonly being
used, typically 13% Cr and 316SS respectively. Most projects these
days are often schedule driven, meaning that fast but detailed
advice is sought through guidelines from many sources, societies
(NACE, API, ISO, etc.), and the various JIPs, industrial and academic
sources now available (JPKeIonik, 2005e2008; Ohio University,
2007; University of Tulsa, 2007).
6. Corrosion, ISD, integrity, and KPIs
As part of any inherently safe design or study, any corrosion
management strategy (CMS) used must be a fully auditable with
a unified approach to retaining integrity of the production facilities,
and to meet all goals for safe operation, environmental protection,
flowline availability, and revenue management. One proven method
for that is the quantifiable key performance indicator route.
 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
The integrity management and (thus corrosion management i.e.
CMS) document will result in a campaign-driven prioritized
inspection, chemical treatment, and monitoring of safety-critical
and economically critical elements within the facilities. This will be
best defined at the CAPEX i.e. design stage. Some studies have
previously examined these aspects, trying to take the best of Safety
Case interpretations for applicability to the GOM region in partic-
ular, and many such approaches have been successfully introduced,
the process is ongoing however, and, as with all advanced offshore/
subsea projects, is a continuing learning and improving process
(IONIK JIP, 2008; JPKeIonik, 2005e2008).
The CMS will therefore form a vehicle to ensure continued
operability minimizing and controlling corrosion to acceptable
levels. This can be done by using relatively simple but meaningful
goal-setting targets, the key performance indicators (KPIs) (Singh,
2007; Singh et al., 2006; Singh & Krishnathasan, 2008). The focus
of which is usually corrosion risk, but also other associated integrity
threats within qualitative and quantitative ISD boundaries as
shown below:
 Internal corrosion, external corrosion, corrosion under insu-
lation (CUI), erosion; Noting that CUI can be realized as a major
threat if piping/vessel insulation gets sodden e.g. via fire water
deluge testing.
 Environmental cracking e stress corrosion cracking (SCC),
sulfide stress cracking (SSC), hydrogen embrittlement, corro-
sion fatigue/vibration/fretting damage, etc.;
 Embrittlement phenomena (clamps, flanges, premature
fasteners/nuts/bolts failure due to intermetallic phases, seizing,
galling, etc.);
Time dependent failure effects per localized corrosion, mechan-
ical fatigue and thermal creep, and conversely cold temperature loss
of properties, toughness, etc.;
 Damage resulting from accidental impact or structural over-
load, of particular interest to ‘live’ flowline segments, manifolds,
vessels, members, etc., linked to or carrying production fluids;
 Damage from welding stray currents during installation and
commissioning operations on/offshore;
 Malfunction of protective safety devices, and loss of reliability
to include corrosion scale build up, overheat for critical elec-
trical cabinets, control units, electrostatic discharges, etc.;
 Design, material, fabrication and construction defects, prob-
lems counteracted by specialty treatments such as flow
assurance additives, corrosion, and scaling inhibitors, etc.
6.1. Primary KPIs defined (corrosion)
Individual corrosion rates interpreted from the coupon and ER
data are time dependent, and can be defined via corrosion loops
(i.e. parts of the infrastructure or systems that are expected to yield
similar corrosion activity). For example, horizontal flowline
segments, vertical segments (SCR), hull piping, etc., or indeed such
loops may be defined to cover for a specific high-risk mechanism,
such as Corrosion under Insulation (CUI) across all systems. These
KPIs are guideline examples only and would be fine tuned on
a case-by-case basis. Bearing that in mind we can define the
primary corrosion KPIs as follows:
 All corrosion rates to be <0.1 mm/y, (though this is often
challenged as the threshold may be too restrictive);
 All CRAs to maintain passivity and exhibit corrosion rates
<0.05 mm/y;
947
 All inhibitors (including cocktail mixtures used) to be efficient
at >95%;
 All inhibitors (including cocktail mixtures) to be available at
100% (minimum ideally >95%, accept >90%);
 Inhibitor dosing pumps to have >97% availability with redun-
dancy as necessary;
 Topsides leak rates minimized e appropriate settings per
offshore asset MODU, TLP, etc.;
 Key physical and chemical variables monitored for operational
envelopes, and to be within 10% of steady state values, to
eliminate corrosion driving upset conditions;
 Ratio flow assurance steady states/unsteady states (excursions)
to be defined, and monitored. More than 18 days p.a. total red
flagged as corrosion stimulators and no more than three days
consecutively proposed be allowed;
 P, T, V, water cut, CO2, H2S, chlorides, iron counts, sulfide/sulfur,
sulfate reducing bacteria (SRB) counts, sand levels, etc., to be
defined and agreed with red flag alarms set. With regard to this
for accepted ‘clean’ systems consider the following rationale:
Define HML risk criteria in context of failure modes and prob-
ability, consequences thereof, and a quantified confidence level.
The latter is a powerful new concept, relating HML, risk levels to
a confidence rating, ergo a better informed inspection interval, and
thus more defensible monitoring philosophies and monitoring
detail.
6.2. Water chemistry and microbial KPIs
Reservoir and condensing fluids/waters cannot be easily
controlled, however these all should remain within the design
envelope, arbitrarily we can select guiding KPIs as follows:
 pH 5.5e6.5, in absence of data use a pessimistic pH 4.5e5;
 Dissolved oxygen < 20 ppb;
 H2S < 5 ppm;
 Sand < 10 ppm;
 Microbial activity planktonic (in-stream) < 1 colony/ml
(>10 colonies/ml e red flag);
 Microbial activity sessile (at wall) < 10 cells/cm2 (>100 colonies/
cm2 e red flag);
 Total iron deposits < 1000 ppm (often arbitrary threshold,
verify per chemical vendor);
 Organic acids prefer <100 ppm (observe excursions
>200 ppm, red flag > 500 ppm);
 Residual inhibitors to be defined and maintained e.g.
>125 ppm (or per vendor).
 Cleaning pig runs and sampling residues targeted at one per
month minimum, or better as data dictates. Integrated pigging
and corrosion monitoring to adjust inhibitor dosing rates.
Intelligent pig runs to be considered every 5 years.
6.3. Other valuable KPIs
Specific KPIs for external CP and external corrosion under
insulation (CUI) usually need to be specifically developed, for
example the SCR/flowline CP potentials (versus Ag/AgCl cell) are
now reasonably well established at:
 900 to 1000 mV defined as well protected
 <800 V defined as compliant-CP protected according to code.
 800 to 850 mV defined as marginal protection
 >800 mV defined as out of compliance (typically observed
700 to 800 mV)
948 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
KPI definitions for CUI are very project specific and temperature
related and are omitted herein for reasons of brevity and
commercial sensitivity.
6.4. Secondary KPIs defined (reliability)
KPIs pertinent to reliability are described below for flowline
segments, pressure systems, and critical components. Most will be
data-base driven and using the TLP existing maintenance work
books as benchmarks:
 Overall system production time availability e a commercial
target (e.g. >95%);
 Minimum system production availability e commercial
decision;
 Ensure 100% inventory and spares for all critical items;
 Maintenance free operating period e MFOP w minimum
failure free operating period, repair time e compare equivalent
items on similar assets
 Overall run time e compare equivalent items similar assets
 Failures rates (rotating items e.g. # failures per 100,000 h);
 Failures severity (HML equivalent to: dangerous, degraded,
incipient);
 Failure severity mitigation (HML equivalent to: urgent,
deferred, minor);
 Failures rates per type of equipment e compare equivalent
items similar assets
 Damage rates per vibration/fretting issues e compare equiva-
lent items similar assets.
 Other decisions not covered directly may be addressed as
ALARP linked KPI issues.
6.5. Predictive modeling
The use of predictive corrosion modeling has been focused on the
high-risk CO2/sweet corrosion areas pertinent to offshore applica-
tions. This has been the case for core predictive tool for pipeline,
flowline and piping corrosion integrity design. Unfortunately the
agreement between actual field practice and these predictions has
tended to be poor; this is due to a number of factors, typically:
 Models assume uniform wastage (in reality hardly ever the case);
 Models do not allow for localized corrosion, though some
claims are made;
 Models do not include other mechanisms (erosion, pitting,
microbial, etc.);
 Outputs can be erroneous because inputs are often non
representative;
 Key parameters such as fluid shear stress at the wall are not
well defined.
 Flow assurance aspects are not fully attended.
It is reasoned that the main materials selection and corrosion
assessment output or deliverable should be accepted as being the
corrosion allowance, but with emphasis that this is but step one in
the corrosion management exercise (JPKeIonik, 2005e2008).
Nevertheless, this is the key variable that can quite literally decide
the viability of a major subsea project. Therefore for a typical
project we can focus on the pipeline corrosion integrity, and
confirm optimum CA values for effective life-cycle operations.
Invariably this will depend on the steady state design envelopes
described and maintained, via compatible inhibitors diligently
applied. To deliver this, it is suggested a definition of project-
specific KPIs are made, and some examples are given below:
 Operating P, T, V, values and chemistry are maintained at
steady state values (e.g. 10%). Excursions beyond that should
be <2 days at a time unless reactive procedures (e.g. increased
dosing) can be accommodated.
 Souring H2S levels remain negligible, <5 ppm (max 10 ppm). If
in the 50e120 ppm zone the combination of H2S and CO2 may
be acceptable pending testing, however it appears that beyond
120 ppm the scenarios must be closely looked at, especially if
the ratio approaches or exceeds 20. Recent research has shed
some interesting light on this combination and the impact on
surface passivity (Hahn, 2008; Lee, 2004; Thamala, 2008).
 The inhibitor cocktails must work at 90e95% efficiency with
a high availability not to fall below 95% unless specified
circumstances are agreed. The greatest threat to inhibitor
performance seems to be sand erosion at highly turbulent
cases and sand under-deposit corrosion within laminar flow
regimes (IONIK JIP, 2008; JPKeIonik, 2005e2008).
 There may be other defining caveats such as design envelope
constraints, and they would need to be identified by materials
engineers on a project-specific basis
6.6. Monitoring tools
It is recommended that the use of advanced U/T, inspection, and
pigging must also be aligned to corrosion modeling predictions, as
well as more appropriate methods of corrosion monitoring such as
FSM or RPCM (instrumented spool techniques) (JPKeIonik,
2005e2008; WGIM Internal Training Modules, 2000e2008) MIC
analyses, thermal imaging, real time radiography, guided wave,
potential versus time (via platinum stud reference), best represen-
tative fluid sampling, etc. (IONIK JIP, 2008; JPKeIonik, 2005e2008).
Corrosion management is an ongoing discipline often required
way past the available fundamental R&D; this time lag enforces
risk-based solutions to progress important energy projects. To that
effect the use of pre-determined risk factors for localized corrosion
has been explored and recommended as an acceptable way
forward, and usefully utilized, via fine tuning of project experience
and JIP data as accrued.
It is therefore reasoned that pragmatic, advanced engineering is
key to safe and efficient operations, competitive advantage, and
sustainability in solving some of the most complex technical and
political challenges that are facing the industry. Such engineering
must involve the development of non-standard corrosion testing
(field and laboratory) often under accelerating conditions.
Clearly to quantify KPIs requires data, ideally live field data, and
to that effect there are many corrosion monitoring techniques
available. The most appropriate to offshore industry are commonly
described and vetted for their advantages and disadvantages as
they pertain to a successful project-specific corrosion and integrity
management regime (JPKeIonik, 2005e2008). Typically, the most
efficient are the removable coupons, electrical resistance (ER)
probes, linear polarization resistance (LPR) probes, biostuds, fluid/
residue sampling, acoustic techniques, area U/T and various in situ
spool mapping methods (JPKenny/Ionik; JPKeIonik, 2005e2008;
SCOTA/UKOOA, 1995). Other advanced techniques such as a.c.
impedance, electrochemical noise, hydrogen patch probes, etc., are
available but are rarely used beyond the laboratory. Scale
measurement devices with advanced monitoring and pigging are
also under review (JPKeIonik, 2005e2008).
6.7. Mechanical aspects and inherent safety
Materials, corrosion, and the chemistry of the environment are
rarely applied without the encompassing discipline of mechanical
 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
engineering. To that effect it is vital for offshore teams to be mul-
tidisciplined, and typically that would require expertise in the areas
of pipeline, topsides, metallurgy, corrosion, cathodic protection/
coatings, process chemists, etc. These disciplines must cohesively
fit into an advanced offshore pipeline project, especially if new
(greenfield) designs are to be inserted into older (brownfield)
infrastructure. Thus strong technical leadership, and core compe-
tency are crucial to making the new challenging designs workable,
and to a degree inherently safe, and to that effect qualified and
experienced people are vital, with the will and motivation to
engage in contentious often adversarial debate. Much of which is
found to be best achieved at the interface between academia and
industry via the operator-sponsored JIPs. The role of academia
taking the lead in this process cannot be overemphasized as the
best placed ‘tempering’ organization.
For deepwater assets (>3000e10,000 ft) the arguments for asset
integrity become more critical since inspection, retrofit, repair, etc.,
become extremely costly, dangerous and often impractical, thus
forcing materials engineering to be highly predictive in nature.
There are many parameters, most of which are interrelated, and
should therefore not be considered in complete isolation. Invariably
the key driver is the revenue and savings combination. If these
targets cannot be met, the project may be blocked. Thus material
selection, corrosion, assessment, welding, CP/coatings must be
inherently safe and optimized to be cost effective.
These are real engineering challenges on top of basic mechanical
design to resist stress, hydrostatic collapse, flow assurance, riser
systems, installation techniques, component operational perfor-
mance, etc. Typically wall thicknesses have to be relatively thick,
making a heavy pipe string, and thus have significant impact on
installation lay barges and existing equipment capabilities. Once in
place there is little room for error, or remedial action, thus designs
have to take cognizance of best workable solutions, which are often
exercises in knowledge management across assets and indeed
regions (Singh et al., 2006).
There are a number of engineering challenges regarding the
flow assurance and related scaling issues within pipelines. Hydrate
formation, wax behavior, erosion, and multiphase flow (JPKeIonik,
2005e2008). These are matters that need to be addressed. Inade-
quate design in this area can lead to unwanted blockages, down
time of pipelines, and therefore loss of valuable productivity.
6.8. Design code application and limitations
There is a considerable grey area of uncertainty regarding the
interface between mechanical design codes and corrosion. Often
this needs to be plugged in by corrosion and integrity engineering
using best risk-based judgments.
There are a number of pipeline design codes, and each one is
different. In the long term, uniformity in codes for pipeline design
would be beneficial. Stress based design is not applicable for high
temperatures, and could possibly lead to excessively thick pipe-
lines. The use of strain based design codes, and limit state based
design seems more applicable for complex high temperature
designs. The integration of analysis tools with design codes is a key
challenge; bringing in the effects of irregular corrosion thinning
complicates further. The use of JIP orientated corrosion modeling
acting as de facto inherently safe promoting standards will have
enormous benefits in this regard (IONIK JIP, 2008; Ohio University,
2007; University of Tulsa, 2007).
6.9. Pipe-in-pipe options
The new pipe-in-pipe (PIP) options (Fig. 6) rapidly are becoming
the design configuration of choice for deepwater and extremely
949
Fig. 6. A typical pipe-in-pipe (PIP) system.
cold Arctic applications. The PIP systems allow a range of advanced
and highly efficient insulation materials to be used to achieve the
requisite heat transfer properties required, and assures greater
degree of mechanical integrity, and is therefore an inherently safer
design (JPKeIonik, 2005e2008; Jukes et al.).
These systems are important components of subsea develop-
ments where untreated well fluids may have to be transported large
distances and wax and hydrate problems have to be effectively
managed. In addition for extreme cases such as LNG transportation,
pipe-in-pipe-in-pipe (PIPIP) configurations (three concentric pipes,
with typically a NiFe inner pipe high nickel (36%) steels being
selected for extra inherently safer/integrity characteristics (Singh
et al., 2005)). However monitoring the life-cycle integrity of such
systems can be a challenge but creative options are continually being
looked at (McLaury, Rybicki, & Shirazi, 1997; Singh et al., 2005).
6.10. Flow assurance solutions
Hydrate formation, wax behavior, erosion, and multiphase flows
can be more critical design issues, especially for multiphase fluids
transitioning from deepwater to shallow water. The flow assurance
strategy comprises a combined design and management philosophy
for all of the following depending upon the fluid properties and
operating conditions such as: hydrate formation, wax/asphaltenes,
scale, forming, emulsion, slugging, and damaging erosion/corrosion
(JPKenny/University of Houston, 2008).
 Hydrate management: To prevent and manage hydrate
formation, combination of either chemical treatment and/or
thermal insulation may be used.
 Wax/asphaltene management: To prevent and manage
paraffin deposition, a combination of thermal insulation,
chemical treatment and pigging may be used. A cost/benefit
analysis of these solutions should be conducted before final
selection of a paraffin management strategy is made.
 Liquid slugging: Transient, dynamic analysis of the flowline
and risers must be conducted to evaluate the potential severity
of liquid slugging. Based on this type of analysis, an appropriate
strategy to control slugging can be developed.
 Erosion: Various types of sand and erosion monitors are
available for installation within/on subsea tree and manifold
piping. These devices (ER e intrusive or acoustic non-intrusive)
can be used to monitor erosion and optimize well flow rates,
often well above the API-recommended limits (API 14E RP).
 Corrosion: The recommended material solution may be the
use of carbon steel flowlines combined with near continuous
950 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
inhibitor injection or the use of corrosion-resistant alloys
(CRAs). The decision is usually made via corrosion modeling
prediction techniques. The main threat to integrity is wetting of
the annulus insulation by breeched inner wall, and the lack of
inspectability thereof. Much work is currently in progress in
that regard (Jukes et al.; Singh et al., 2008).
The typical strategy is best adopted early in the conceptual and
planning phase of the project prior to specifying and ordering the
main components of the system, such as downhole equipment,
trees, flowlines, control system and topsides equipment.
Flow assurance strategy should also be applied during detailed
system design, developing operating procedures as well as offshore
production operations to maximise profitability of the field devel-
opment. Based on the flow assurance analysis results, a design
philosophy and functional specifications can be developed for the
following elements:
 Sizing of well tubing and completion design;
 Sizing of all flowlines, risers and export system, including
subsea manifolds;
 Thermal management (insulation or heating);
 Chemical injection, including the subsea chemical distribution,
umbilical, topsides chemical delivery system;
 Pigging strategy (subsea or surface launching).
One such solution is to make the pipeline more buoyant, to
reduce the span stress. To ensure that the pipeline does not get over
stressed at the touch down point with the seabed, bend restrictors
can be used to limit the bending curvature.
6.11. Standardization of designs
One major way forward still under development, is to generate
the standardization of designs, if the developments are similar in
nature (water depths, pressure, temperature, corrosivity, etc.). The
main advantages from standardization are driving down costs, and
reducing schedule time. If this approach can be suitably linked to
ISD there would be substantial benefit to the cause of CISD, The fear
seems to be that over exposure to materials selection and corrosion
analysis is cost prohibitive. In reality the benefits to be exploited are:
 Common health and safety culture down the supply chain;
 Support in the context of inherently safer designs;
 Long-term supply chain relationships;
 Focused front end engineering design (FEED);
 Detail design, commonality of IM issues;
 Lessons learned (must be a continual process);
 Significant potential for integration within CMS programs;
Used properly, standardization has the ability to collate, and
rationalize existing design methodologies, sift through best prac-
tices applicable to each region, and can therefore be expected to
deliver significant improvements pertaining to; cost, schedule,
quality, operability, and predictability.
Major program standardizations are presently being undertaken
on projects in the GOM and overseas for major clients (JPKeIonik,
2005e2008; Smart, 1990; University of Tulsa, 2007). The results are
attractive and promising in terms of scheduling, manpower
resources, and, therefore, budgets. However when unexpected vari-
ables enter the decision-making process, such as the possibility of
sour service being incurred post water injection scenarios, then
difficulties can prove to be hard to surmount, especially if expensive
equipment has already been purchased or allocated. Under these
circumstances materials and corrosion engineers can find themselves
in a very awkward position, trying to justify non-sour materials
selection, when all predictions point to a sour service development
over the life cycle, albeit often in the distant future. Similar arguments
and predicaments exist for advanced engineering criticality assess-
ment (ECA), and fitness for service (FFS) whereupon new flaw sizing
criteria need to be appraised at design and during service accordingly.
The combination of ISD, concurrent design, and standardization is
a powerful tooling for challenging deepwater campaigns, and if
taught (included) within future engineering curricula a big step
forward for the engineering community as a whole.
6.12. Materials and welding
For both equipment and flowlines, a critical component of
successful design for high pressure/high temperature (HP/HT) is
a thorough understanding of the materials and welding issues.
Management of detailed materials testing and quality procedures is
crucial, and the verification of drawing board detail to as received
and built components is vital especially in the global market place.
Also rigorous equipment specification is required, paying particular
attention to material selection for components, such as seals. In
addition, increased use of exotic materials, such as corrosion-
resistant alloys (CRAs), either solid or as liners, throughout the
system offers alternative solutions, though care must be taken at
interfaces, to minimize or eliminate junction galvanic effects.
Loadings that must be reviewed are:
 Axial, Lateral Movement;
 Effective Axial Force;
 Axial and Hoop Stress;
 Von Mises Stress;
 Bending Moment;
 Plastic Strain, Buckling Curvature;
7. HSE perspective
Following review of the MMS (future BOE) and UK HSE step
changes in safety alerts, many recent insights have been identified
with respect to the potential for similar causes or similarities due to
incidents that have happened since the Piper Alpha disaster. This
was done with a view to aid plausible corrective actions. The results
pointed to two main types of actions: those related to design safety
and those related to work permits and lockout/tagout. Thus, the use
of meaningful corrosion and integrity management can also play
a valuable role in such accident prevention. The review shows some
uncanny parallels to the Piper Alpha case, such as initiating causes,
with potentially similar outcomes. Prevention of these through
diligent integrity management would clearly play a significant role
in prevention by design, predictive and proactive measures.
There have been many recent safety alert examples, and other
relevant post accident studies, over the period (2000e2008), and
details are readily available in the public domain (via CBS (Baker,
2007), MMS and HSE web pages (JPKeIonik, 2005e2008)). It is
more appropriate in the context of this paper, to identify the best
actions derived from the alerts as exemplified below.
7.1. Actions from the alerts
 Compile and issue a shutdown specific isolation protocol, based
on review of practices elsewhere in the company and in other
worldwide affiliates. The document should cover vent/isolation
tagging standards and documentation required for large-scale
shutdowns;
 Lessees and operators should repair malfunctioning equipment
in lieu of using alternative methods such as opening a manual
 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
liquid dump valve when the automatic liquid dump valve fails
or blind flanging off a pressure relief line when a safety device
ruptures.
 Lessees and operators shall review piping to ensure that deck
drains have adequate trap mechanisms to prevent gases
(corrosion leaks) from migrating through, that deck drains are
not piped to a pressure line before entering a sump tank, and
that piping for produced water does not tie into the piping for
the wastewater from the living quarters.
 Lessees and operators should review flare boom lines to ensure
that they are designed of proper length, height, and oriented in
the proper position according to prevailing winds to minimize
the migration of gas back to the living quarters. Barrier and tag
off for access under strict permit to work only.
 Supervisors must provide adequate job instructions and plan-
ning prior to the work, without jeopardizing the scope inten-
tion of the work (applies particularly to contractors/inspectors
who can find themselves under pressure to complete and go).
 Hazards must be identified as work proceeds, and a ‘stop work
policy’ in place as the job scope changes.
 Fire protection/deluge systems must not be compromised and
as a rule be ‘fail safe’ with 100% availability or redundancy.
 Personnel must be familiar with and utilize lockout and tagout
procedures to isolate equipment and process piping during
work programs.
 Simultaneous operations must be clearly communicated to all
appropriate parties, and made fail safe, detailing all site-
specific procedures prior to work being implemented.
 Lessees and designated operators should be able to trace the
history of ring gaskets in the field regardless of previous
ownership, and/or determine the condition of the ring gaskets
prior to the performance of future operations (gasket failure
and ensuing corrosion-related leaks are very common
offshore).
 The Government requires lessees and operators to perform
strict maintenance and inspections, monitor the environ-
mental conditions, and maintain records of these activities (API
14E RP; Singh & Krishnathasan, 2008). Since a failure on
a dynamic riser could pose a significant impact to safety, the
environment, and energy supply. Thus it is essential to perform
Fig. 7. Schematic depicting the crucial relationships between reactive, proactive, and active corrosion analyses.
951
necessary actions to ensure the safety and reliability of these
critical components.
 The national consensus standard for dynamic risers, API-
Recommended Practices are currently under revision (Baker,
2007). The revised version is expected to include guidance
on integrity management for dynamic risers. The MMS will
consider adopting this standard into its regulations for outer
continental shelf pipelines.
A discussion of the findings shows three main types of recom-
mendations that parallel the findings of Piper Alpha:
(a) There must be an effective work permit system including the
use of lockout/tagout, and
(b) There must be design review that is comprehensive enough to
think ahead to the probable scenarios and consequences of the
design.
(c) Asset holders must have a formalized culture of safety which is
implemented and acted upon. Promoting life-cycle integrity
and parallel safety procedures, then not acting on them should
be considered a zero option (Private Correspondences with
Messrs Ben Poblete (LR/Cameron), 2000e2008).
Noting that a very high proportion of equipment maintenance
work is corrosion, ageing or wear related, the clear evaluation is
that potentially dangerous incidents continue from time to time at
offshore facilities. Corrosion prevention and detection and in the
larger view the use of integrity management systems are essential
to proactively prevent these from occurring. In addition, safety in
design is vital to building in prevention long before problems occur.
The MMS potential incidents of non-compliance (PINCs) were also
created to address that matter (US DOI-MMS, 2007). Finally, oper-
ating best practices of work permit systems and lockout/tagout
remain a key to accident prevention generally.
8. Corrosion risk management practice
In reality the current corrosion business practices for most oil
and gas operations is a balance of three risk management
methodologies. These methodologies are interrelated and must
952 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953
be balanced and reviewed on a continuous basis. The method-
ologies are:
 Reactive Corrosion Monitoring;
 Proactive Corrosion Monitoring;
 Active Corrosion Monitoring.
The decision on how to manage the corrosion business risk is
highly dependent on the corporate senior management policy of
handling their operational or capital expenditures. It is emphasized
that these methodologies are equally important during the
conceptual to detailed design of an integrity management system.
The inter-relations of the three methodologies are shown below in
Fig. 7. The importance of understanding the root cause (s) of any
corrosion issue is critical in providing pragmatic cost-effective
corrosion risk management solutions.
It is considered that these corrosion risk management meth-
odologies will always be the underlying factors in the business
decisions of all oil and gas operators. Management of change (MOC)
of the order required for meaningful ISD will in practice always be
difficult, however the volume of literature now more openly
available in the industry will supply the required leverage needed.
In particular operating company group standards and international
associations are clearly making the case quite forcefully
(International Association of Oil & Gas Producers (OGP), 2008; Vars
Operator Standardization).
9. Concluding remarks
The Piper Alpha review has been a work in progress, with many
derived findings, conclusions and specifically KPI-based recom-
mendations most of which are capable of being tailored to new and
existing projects. The most valuable observation is the need for
continued life-cycle vigilance, most likely through diligent but
limited regulatory control, since the North Sea experience has
shown that ‘over regulation’ can impose major financial burdens
often to the detriment of the project, and sometimes to the crea-
tivity of solutions.
It is concluded that by applying the principles of concurrent and
inherently safe design, in tandem with best industry practices, to
aggressive corrosion and erosion conditions, safer offshore assets
can be achieved. By using effective and simplified designs, creative
inspection, less maintenance, and less direct manpower, can help
better meet the life-cycle objectives, life-cycle integrity and fitness
for service. Indeed if the combination of ISD, concurrent design, and
standardization, is correctly deployed it can give a powerful
impetus for challenging deepwater projects, and if taught within
future university engineering curricula give a major leadership role
for the engineering discipline and community as a whole.
Setting the goals is paramount, and identifying the hazards, and
designing out the problem areas, is best done by multidisciplined
project groups in small step sequences. A clear advantage would be
for industry to accept corrosion as a hazard thereby opening it up to
more formal written schemes of corrosion integrity risk analyses.
The use of commonly accepted high, medium, low, risk definitions
and simplified go/hold/no go traffic signal type decision gates is
a significant evolution in the design and operational integrity
management process.
The methodology and KPI techniques advised require difficult
changes and lateral thinking, but serious traction, and a positive
paradigm shift has been noted when applied. The main advantage
being that it eliminates the erroneous premise that to comply with
codes and standards is all that is needed. Additionally the use of
new quantifiable confidence grading is a powerful new concept,
relating HML risk levels to a repeatable confidence level, thus
inspection interval, ergo monitoring philosophies and monitoring
detail. The use of continually refreshed multidisciplinary teams is
paramount to enhancing creativity; the blend of experienced and
newly qualified engineers can help to minimize negative often
dysfunctional ‘group think,’ which can be a barrier to innovative
solutions (Edison, 2008; JPKeIonik, 2005e2008).
Corrosion, erosion, and MIC phenomena are major areas of
weakness within failure mode and effects, understanding, and
control. However predictive modeling and JIP driven corrosion
management programs are pushing for pragmatic solutions into
the right direction. The unique JIP blend of highly motivated and
qualified researchers combined with experienced oilfield personnel
has led to many breakthroughs in offshore and subsea corrosion
integrity issues (API 2RD RP; Singh & Krishnathasan, 2008). It is
therefore important for the engineering companies to stay abreast
of safety-critical findings as they are unraveled and to participate in
such leading edge activities, with the offshore operators.
Of the findings to date it is recommended to act on the Piper
Alpha findings and look beyond at the secondary issues pertinent
to offshore design integrity; such as materials performance, and
corrosion, focusing on critical combinations such as corrosion
plus erosion, microbial activity, and corrosion plus souring
activity, as matters of priority. It is also expedient to examine and
better quantify the relationships between excursionary or non-
steady corrosion phenomena, with the physical parameters, PTV,
and to find methods to enforce near continual chemical injection
when warranted, and assure that safe inspectability is always
practical.
The use of an annual corrosion integrity statement by the asset
operators is strongly recommended to ensure fitness-for-purpose is
continually maintained. And since most offshore failures are the
result of multiple parameters or events precipitating to a break
point, it is logical that resolution of same must involve multi-
disciplined engineering teams, with a strong materials engineering
content.
It is important for the future deepwater and arctic offshore
community to look more closely at new designs and new solutions
from both a materials fabrication and the materials performance
basis, especially for safety-critical elements such as steel catenary
risers (SCR), and pressure containment plant, and potential leak
sources at interfaces. Companies must continually re-educate staff
so that lessons learned are not forgotten, and be prepared to look at
alternative approaches to design/operational issues even if they
emanate from unconventional sources.
History has shown that major step change progress is usually
made after major disasters and often through non-conventional
means. The new solution sets, and developments will it is believed
come from a closer liaison between industry and academia as
exemplified by the JIPs already in place. The powerful role of
Academia whether through JIPs or self driven changes in university
curricula will be instrumental in the paradigm shift required and
perhaps expected. We owe it to the memory of Piper Alpha, and
indeed other preventable disasters.
Acknowledgements
The authors acknowledge the support of WGIM, J P Kenny, MCS
Kenny, Wood Group, and Cameron. Educational material from
Coastal Training Technology Corporation, and case history exam-
ples from Deepwater Corrosion Services, is gratefully acknowl-
edged. Permission of the OTC Committee in Houston to use the OTC
paper as template is appreciated. Thanks are due to Miss Sonia
Singh for assistance with the re-write and formatting. Finally the
findings, interpretation and opinions expressed are those of the
authors, and not necessarily those of the companies.
 B. Singh et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 936e953 953

References NACE. (2007). Nashville plenary lecture. Corrosion, crime, and punishment (panel
session e Garrity, K., et al.). Nashville.
Neal, M. (January 2007). JIMECHE Publication. The Causes of Accidents. ISSN 1751-
API 1 7D. Specification for Subsea Wellhead and Christmas tree equipment.
18471.
API 14E RP. Offshore piping design section 2.5, version 1991.
NORSOK Standard M001. (August 2004). Materials selection, rev 4.
API 2RD RP. Design of risers for floating production systems, and tension leg
NTSB Carlsbad pipeline failure report # PAR 03/01.
platforms.
Nyborg, R. (2002). Overview CO2 corrosion models. Paper 02233. NACE.
API 580. (May 2002). Risk based inspection (1st ed).
Nyborg, R. N., & Dugstad, A. (2007). TOL corrosion NACE paper #07555. NACE.
Baker, J. A. (January 2007). Report e the BP US Refineries Independent Safety
Ohio University. (2007/8). Corrosion modeling JIP. Chair: professor S. Nesjic.
Review Panel.
Poblete, B. R., Singh, B., & Dalzell, G. The inherent safe design of an offshore
BBC web pages. Various articles regarding the Piper Alpha disaster.
installation. In Texas A&M process safety conference, MKOPS, 23e24 Oct 2007.
BP Booklet. (2004). Integrity management e learning from past major industrial
Private correspondences with Messrs Ben Poblete (LR/Cameron), Graeme Dalzell
incidents booklet 14. Sunbury, UK.
(TBS3), Trevor Kletz (Author), Chris Robbins (UK HSE). (2000e2008).
BP report no. S/EPT/096/04 e erosion guidelines (rev 3). (2004).
Prodger, M. (Dec 1997). LR private correspondences 1997e1999, & LRIM corrosion
Coastal Training Technology Corporation. (2007). DVD Piper Alpha spiral to disaster.
management ppt.
Dalziell, G. (2004). Inherently safe design. Paper # 86598. SPE.
Ramachandra, S. (2007/8). Baker Petrolite, private communications.
Deepwater Corrosion Services Inc. Houston, web pages www.stoprust.com. (2008/9).
SCOTA/UKOOA. (ca 1995). Materials and corrosion course modules, by Singh/
DNV. (Jan 2000). Offshore standard. Submarine pipeline systems OS-F 101.
Bradley, Aberdeen, UK.
DNV RP 0501. (2002). Erosive wear in piping systems 1999.
Shreir, L. L. (1994). Corrosion control handbook (3rd ed.). Butterworth Heinemann.
DOT Regulations. CFR 49 parts 192/195 per gas and liquid pipelines.
Singh, B. (Feb 2007). Materials selection and inherently safe design. ASM presen-
Edison, E. (MayeJune 2008). The team development life cycle e a new look. Defense
tation, Houston.
AT&L.
Singh, B., Britton, J. N., & Flannery, D. (2003). Offshore corrosion failure analyses:
EEMUA. (2004). 194 Guidelines for materials selection & corrosion control for
series of case histories, # 03114. NACE.
subsea oil/gas production equipment.
Singh, B., Britton, J. N., Poblete, B. R., & Smith, G. (2005). The 3 R’s e risk, rust and
Fontana, M. G. (ca. 1984). Corrosion engineering. Van Wylen Press.
reliability. Paper # 05553 NACE.
Hahn. J. (ca 2008). Ph.D. thesis, Ohio University, Athens, OH (advance findings).
Singh, B., Folk, T., Jukes, P., Garcia, J., & Perich, W. (2006). From the North Sea to the
Hibbert, L. (June 2008). Averting disaster, professional engineering. IMechE Journal,
Gulf of Mexico e making the link between corrosion research and best practice.
21(11).
RIP # 06R206, NACE.
International Association of Oil & Gas Producers (OGP). (Dec 2008). Asset integrity
Singh, B., Folk, T., Jukes, P., Garcia, J., Perich, W., & Van Oostendorp, D. (2007).
e the key to managing major incident risks. Report #415.
Engineering pragmatic solutions for CO2 corrosion problems. NACE Corrosion.
IONIK JIP. (Nov 2008). Business case report (77447.03), rev B.
Singh, B., Jukes, P., Wittkower, R., & Poblete, B. R. Annual OTC, offshore integrity
Jepson, P., & Research Workers (1999e2002). The effects of multiphase flow on
management e 20 years on: overview of lessons learnt post Piper Alpha. Paper
sweet corrosion in oil and gas pipelines-vars early work presentations from
# OTC 20051-PP, Houston, TX, 4e7th May 2009.
Ohio University.
Singh, B., & Krishnathasan, K. Pipeline pigging & integrity management conference:
JP Kenny. HSE alerts and safety notices 2005e2008.
Making the link between inherently safe design, integrity management and
JP Kenny. (Dec. 2008). T4B series e arctic pipelines, materials, FFS, and corrosion
pigging, Houston, 12e15th Feb 2008.
studies. C-In-C.
Singh, B., Krishnathasan, K., & Ahmed, T. (Oct 2008). Predicting pipeline corrosion.
JPKenny/Ionik. Internal experience basis, corrosion reports, in-house spreadsheets
Pipeline and Gas Technology Journal.
& toolboxes.
Smart, J. (1990). A review of erosion corrosion in oil and gas production. In Flow
JPKenny/University of Houston. (2008/9). Pipeline engineering course modules, by
induced corrosion symposium: Fundamental studies and industry experience.
AEG/IONIK.
NACE Corrosion.
JPKeIonik. Corrosion and integrity management literature, experience basis e
Thamala, K. (ca 2008). M.S. thesis, Tulsa University (advance findings).
various projects 2005e2008.
UK HSE. (2001). Contract research report 363/2001, best practices for risk based
Jukes, P., Singh, B., Garcia, J., & Delille, F. Critical thermal, corrosion, & material issues
inspection (TWI/Sun Alliance).
related to flowline pipe-in-pipe (PIP) systems. Paper # ISOPE-2008-TPC-297.
UK HSE/TUV-NEL. (2003). Erosion research report #115.
Kletz, T. (1998). What went wrong e Case histories of process plant disasters (4th ed.).
UMIST/University of Manchester Corrosion Center (J. L. Dawson/G. E. Thompson, W.
Butterworth Heinemann.
Cox, et al.). (1983e1995)..
Lee, J. (ca 2004/5). Ph.D. thesis, Ohio University, Athens, OH (research data).
University of Tulsa. (2007/8). Erosion and corrosion JIP. Chair: professor E. Rybicki.
Lees, F. P. (1980). Loss prevention in the process industries. Butterworths.
US DOI-MMS. (Feb 2007). Offshore & pipeline regulations e PINC listings.
Lord Cullen Report. (1990)Public inquiry into the Piper Alpha disaster, Vols. 1 and 2.
US DOI-MMS Federal Register, Vol. 72, No. 191 Oct 3 2007/Proposed Rules 30CFR
HMSO. (Reprinted 1993).
parts 250,253,254,256.
Marsh, J. (2007). T.Teh, conflicting views CO2 corrosion. SPE paper #109209.
Vars operator standardization documents for subsea materials 2006e2008.
Massey, B. S. (1970). Mechanics of fluids. Van Nostrand Reinhold Co.
WGIM internal training modules. (2000e2008). A. Denny/G. Strong et al. Includes
McLaury, B., Rybicki, E., Shirazi, S. (1997). Tulsa Univ. SPE # 38842 SPE Tech. Conf,
support literature from Alberta Energy & Utilities Board (Canada), Roxar (USA),
San Antonio, TX.
Cormon (USA).
Mueller, R. A. (March 2006). Corrosion allowance e not always a simple concept,
Wood Group HSE Matters. Company report 2008 e article, the lessons of Piper Alpha.
materials performance.