EI Corrosion Management

Guidance for corrosion management in
oil and gas production and processing
Second edition
This document is issued with a single user licence to the EI registered subscriber: bob.conder@neptuneenergy.com. It has been issued as part of the [TECH PARTNER] Technical Partner membership of the Energy Institute.
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDANCE FOR CORROSION MANAGEMENT IN OIL
AND GAS PRODUCTION AND PROCESSING
Second edition
March 2019
Published by
Energy Institute, London
The Energy Institute is a professional membership body incorporated by Royal Charter 2003
Registered charity number 1097899
+44 (0)207 467 7100
The Energy Institute (EI) is the chartered professional membership body for the energy industry, supporting over 20 000 individuals
working in or studying energy and 250 energy companies worldwide. The EI provides learning and networking opportunities to support
professional development, as well as professional recognition and technical and scientific knowledge resources on energy in all its forms
and applications.
The EI’s purpose is to develop and disseminate knowledge, skills and good practice towards a safe, secure and sustainable energy system.
In fulfilling this mission, the EI addresses the depth and breadth of the energy sector, from fuels and fuels distribution to health and safety,
sustainability and the environment. It also informs policy by providing a platform for debate and scientifically-sound information on energy
issues.
The EI is licensed by:

−− the Engineering Council to award Chartered, Incorporated and Engineering Technician status, and
−− the Society for the Environment to award Chartered Environmentalist status.
It also offers its own Chartered Energy Engineer, Chartered Petroleum Engineer, and Chartered Energy Manager titles.
A registered charity, the EI serves society with independence, professionalism and a wealth of expertise in all energy matters.
This publication has been produced as a result of work carried out within the Technical Team of the EI, funded by the EI’s Technical Partners.
The EI’s Technical Work Programme provides industry with cost-effective, value-adding knowledge on key current and future issues
affecting those operating in the energy sector, both in the UK and internationally.
For further information, please visit http://www.energyinst.org
The EI gratefully acknowledges the financial contributions towards the scientific and technical programme
from the following companies
Andeavor Phillips 66
BP Exploration Operating Co Ltd Qatar Petroleum
BP Oil UK Ltd Repsol Sinopec
Centrica RWE npower
Chevron North Sea Ltd Saudi Aramco
Chevron Products Company Scottish Power
Chrysaor SGS
CLH Shell UK Oil Products Limited
ConocoPhillips Ltd Shell U.K. Exploration and Production Ltd
DCC Energy SSE
EDF Energy TAQA Bratani
ENI Total E&P UK Limited
E. ON UK Total UK Limited
Equinor Tullow Oil
ExxonMobil International Ltd Uniper
Innogy Valero
Kuwait Petroleum International Ltd Vattenfall
Nexen CNOOC Vitol Energy
Ørsted Woodside
Perenco World Fuel Services

However, it should be noted that the above organisations have not all been directly involved in the development of this publication, nor
do they necessarily endorse its content.
Copyright © 2019 by the Energy Institute, London.

The Energy Institute is a professional membership body incorporated by Royal Charter 2003.
Registered charity number 1097899, England
All rights reserved
No part of this book may be reproduced by any means, or transmitted or translated into a machine language without the written
permission of the publisher.
ISBN 978 1 78725 064 2
Published by the Energy Institute
The information contained in this publication is provided for general information purposes only. Whilst the Energy Institute and the
contributors have applied reasonable care in developing this publication, no representations or warranties, express or implied, are made
by the Energy Institute or any of the contributors concerning the applicability, suitability, accuracy or completeness of the information
contained herein and the Energy Institute and the contributors accept no responsibility whatsoever for the use of this information. Neither
the Energy Institute nor any of the contributors shall be liable in any way for any liability, loss, cost or damage incurred as a result of the
receipt or use of the information contained herein.
Hard copy and electronic access to EI and IP publications is available via our website, https://publishing.energyinst.org.
Documents can be purchased online as downloadable pdfs or on an annual subscription for single users and companies.
For more information, contact the EI Publications Team.
e: pubs@energyinst.org
+44 (0)207 467 7100
GUIDANCE FOR CORROSION MANAGEMENT IN OIL AND GAS PRODUCTION AND PROCESSING
CONTENTS
Page
Foreword �� 16
Acknowledgements�� 18
Steering group chair's foreword�� 19
Executive summary�� 20
1 Introduction�� 25
1.1 Purpose �� 25
1.2 Scope of application�� 25
1.2.1 Management system scope�� 25
1.2.2 Production facilities scope�� 25
1.2.3 Deterioration processes scope�� 26
1.2.4 Structured framework for corrosion management support function�� 26
2 Reason for document layout �� 28

2.1 PLAN �� 31
2.1.1 Purpose�� 31
2.1.2 Legal framework�� 32
2.1.3 Worldwide legal basis for corrosion management�� 32
2.1.4 High level integrity management policy�� 33
2.1.5 Policy �� 33
2.1.6 Detailed corrosion management policy �� 34
2.1.7 Cross reference to international standards�� 34
2.1.8 Ageing and life extension considerations�� 34
2.1.9 Integration with safety management systems �� 35
2.1.10 Strategy �� 36
2.2 DO�� 37
2.2.1 Purpose�� 37
2.2.2 General assessment of risk �� 38
2.2.3 Corrosion risk assessment�� 38
2.2.4 Organising �� 40
2.2.5 Implementing the plan �� 45
2.3 CHECK�� 49
2.3.1 Purpose�� 49
2.3.2 Monitoring performance�� 49
2.3.3 Performance measurement�� 50
2.3.4 Responsibility �� 50
2.3.5 Frequency�� 51
2.3.6 Reporting and corrective actions�� 51
2.3.8 Investigating accidents and incidents�� 51
2.4 ACT�� 53
2.4.1 Purpose�� 53
2.4.2 Reviewing performance�� 53
2.4.3 Reviewing/auditing the corrosion management programme �� 55
2.4.4 Scope and frequency�� 56
+44 (0)207 467 7100
Contents continued
Page
3 Human factors�� 58
3.1 Introduction�� 58
3.2 PLAN �� 61
3.2.1 Policy �� 61
3.2.2 Planning�� 62
3.3 DO�� 62
3.3.1 Risk profiling�� 62
3.3.2 Organisation�� 63
3.3.3 Implementing the plan �� 63
3.4 CHECK�� 63
3.4.1 Measuring performance �� 63
3.4.2 Investigating accidents/incidents/near misses�� 64
3.5 ACT�� 64
3.5.1 Reviewing performance�� 64
3.5.2 Learning lessons�� 64
Annexes
Annex A Structured framework for corrosion management �� 65
Annex B
Legal basis for corrosion management�� 68
B.1 List of UK and EU Regulatory requirements relating to
corrosion management�� 68
B.2 UK statutory compliance�� 70
B.3 Risk assessment and management �� 73
B.3.1 MHSWR�� 73
B.3.2 SCR15 2015�� 73
B.3.3 COMAH 2015�� 74
B.3.4 PSR 1996�� 75
B.4 Integrity management�� 75
B.4.1 PUWER �� 75
B.4.2 DCR 1996 �� 75
B.4.3 PFEER 1995�� 75
B.4.4 PSSR 2000�� 75
B.4.5 PSR 1996�� 75
B.5 European union legislation �� 76
B.6 Sections from the regulations relevant to corrosion
management �� 76
B.6.1 Health and safety at work etc act 1974 �� 76
B.6.2 Management of health and safety at work
regulations 1999�� 77
B.6.3 Provision and use of work equipment regulations 1998�� 78
B.6.4 The dangerous substances and explosive atmospheres
regulations 2002�� 80
B.6.5 Offshore installations (offshore safety directive)
(safety case) regs 2015�� 82
B.6.6 The offshore installations (Prevention of Fire, Explosion,
and Emergency Response) regulations (PFEER) �� 84
B.6.7 Offshore installations and wells (design and construction
etc) regulations 1996�� 84
+44 (0)207 467 7100
Contents continued
Page
B.6.8 The pipelines safety regulations 1996�� 85
B.6.9 The pressure safety systems safety regulations 2000�� 86
B.6.10 The Control Of Major Accident Hazards (COMAH)
regulations�� 89
Annex C Ageing and life extension �� 93

C.1 Overview of ageing and life extension�� 93
C.2 Corrosion related ageing and life extension management�� 94
C.3 Data trending and ageing and life extension�� 95
Annex D
Approaches to good practice�� 97
D.1 Introduction �� 97
D.2 Why manage corrosion?�� 97
D.3 PLAN�� 99
D.3.1 Policy�� 99
D.3.2 Purpose�� 99
D.3.3 Policy format�� 100
D.3.4 Planning�� 101
D.3.5 New builds�� 102
D.4 Existing Infrastructure�� 104
D.5 DO�� 106
D.5.1 Risk profiling �� 106
D.5.2 Organisation �� 106
D.5.3 Implementing the plan�� 106
D.6 CHECK�� 106
D.6.1 Measuring performance�� 106
D.6.2 Investigating accidents/incidents/near misses �� 107
D.7 ACT �� 107
D.7.1 Reviewing performance�� 107
Annex E
Organisation �� 108
E.1 Introduction �� 108
E.2 PLAN�� 108
E.2.1 Policy�� 108
E.2.2 Planning�� 108
E.2.3 Contracted services �� 111
E.3 DO�� 112
E.3.1 Risk profiling �� 112
E.3.2 Organisation �� 112
E.3.3 Implementing the plan�� 114
E.3.4 Competence system�� 114
E.3.5 Competency guidelines �� 115
E.3.6 Technical authority and the integrity team leader
competencies�� 115
E.3.7 Corrosion engineer competencies�� 115
E.3.8 Inspection engineering and NDT technician
competencies�� 116
E.3.9 Operator and management competencies for corrosion
related responsibilities �� 116
E.3.10 Competence in contract services �� 117
+44 (0)207 467 7100
Contents continued
Page
E.3.11 Communication in contract services�� 117
E.4 CHECK�� 118
E.4.1 Measuring performance�� 118
E.4.2 Investigating accidents/incidents/near misses �� 119
E.5 ACT �� 119
E.5.1 Reviewing performance�� 119
E.5.2 Learning lessons�� 120
Annex F
Corrosion risk assessment and planning�� 121
F.1 Introduction �� 121
F.2 PLAN�� 121
F.2.1 Policy�� 121
F.2.2 Planning�� 122
F.2.3 Work planning�� 123
F.2.4 Resource planning�� 124
F.3 DO�� 125
F.3.1 Risk profiling �� 125
F.3.2 Organisation �� 127
F.3.3 Implementing the plan�� 128
F.4 CHECK�� 129
F.4.1 Measuring performance�� 129
F.4.2 Investigating accidents/incidents/near misses �� 129
F.5 ACT �� 129
F.5.1 Reviewing performance�� 129
F.5.2 Minimise high risk �� 130
F.5.3 Learning lessons�� 130
Annex G
Implementation and analysis�� 131
G.1 Introduction �� 131
G.2 PLAN�� 131
G.2.1 Policy�� 131
G.2.2 Planning�� 131
G.2.3 Barriers and mitigation�� 133
G.2.4 Monitoring�� 133
G.2.5 Unplanned activities�� 135
G.2.6 Opportunity based visual inspection�� 135
G.2.7 Material and corrosion damage reporting�� 135
G.2.8 Data gathering and storage�� 135
G.3 DO�� 136
G.3.1 Risk profiling �� 136
G.3.2 Organisation �� 136
G.3.3 Implementing the plan�� 136
G.3.4 Data gathering�� 137
G.3.5 Inspection data covering �� 137
G.4 CHECK�� 137
G.4.1 Measuring performance�� 137
G.4.2 Data storage �� 138
G.4.3 Data analysis �� 138
G.4.4 Anomaly reporting�� 139
G.4.5 Investigating accidents/incidents/near misses �� 140
+44 (0)207 467 7100
Contents continued
Page
G.5 ACT �� 142
G.5.1 Reviewing performance�� 142
G.5.2 Facility status review�� 142
G.5.3 Routine tactical review�� 142
G.5.4 Annual review �� 143
G.5.5 Corrective action �� 147
G.5.6 Learning lessons�� 147
Annex H
Audits�� 148
H.1 Introduction �� 148
H.2 PLAN�� 148
H.2.1 Policy�� 148
H.2.2 Planning�� 148
H.3 DO�� 149
H.3.1 Risk profiling �� 149
H.3.2 Organisation �� 149
H.3.3 Implementing the plan�� 149
H.4 CHECK�� 149
H.4.1 Measuring performance�� 149
H.4.2 Investigating accidents/incidents/near misses . . . . . . . . . . . . . 150
H.5 ACT �� 150
H.5.1 Reviewing performance�� 150
H.5.2 Learning lessons�� 150
Annex I Oil and gas production and processing corrosion threats

and mitigation�� 151
I.1 Carbon dioxide corrosion �� 152
I.1.1 Description�� 152
I.1.2 PLAN�� 157
I.1.3 DO�� 158
I.1.4 CHECK�� 159
I.1.5 ACT�� 160
I.2 H2S corrosion and cracking�� 160
I.2.1 Introduction�� 160
I.2.2 SSC�� 161
I.2.3 SCC�� 162
I.2.4 HIC �� 162
I.2.5 PLAN�� 164
I.2.6 DO�� 164
I.2.7 CHECK�� 165
I.2.8 ACT�� 165
I.3 Amine corrosion�� 166
I.3.2 PLAN�� 167
I.3.3 DO�� 168
I.3.4 CHECK�� 169
I.3.5 ACT�� 170
I.4 Oxygen corrosion of seawater and water injection systems�� 171
I.4.2 PLAN�� 173
+44 (0)207 467 7100
Contents continued
Page
I.4.3 DO�� 173
I.4.4 CHECK�� 176
I.4.5 ACT�� 176
I.5 Microbially influenced corrosion �� 177
I.5.2 Carbon and low alloy steel�� 179
I.5.3 Stainless steels and other active/passive alloys �� 179
I.5.4 Copper and nickel alloys �� 180
I.5.5 Non-metallic materials�� 181
I.5.6 PLAN�� 181
I.5.7 DO�� 182
I.5.8 CHECK�� 185
I.5.9 ACT�� 186
I.6 Dead leg corrosion �� 186
I.6.2 PLAN�� 188
I.6.3 DO�� 189
I.6.4 CHECK�� 192
I.6.5 ACT�� 193
I.7 Galvanic corrosion�� 194
I.7.2 PLAN�� 197
I.7.3 DO�� 198
I.7.4 CHECK�� 200
I.7.5 ACT�� 200
I.8 Weldment corrosion�� 201
I.8.2 PLAN�� 204
I.8.3 DO�� 206
I.8.4 CHECK�� 207
I.8.5 ACT�� 208
I.9 Grooving corrosion of pipelines�� 208
I.9.2 PLAN�� 211
I.9.3 DO�� 212
I.9.4 CHECK�� 213
I.9.5 ACT�� 213
I.10 Flange face corrosion �� 214
I.10.2 PLAN�� 216
I.10.3 DO�� 217
I.10.4 CHECK�� 219
I.10.5 ACT�� 219
I.11 Atmospheric external corrosion�� 219
I.11.2 PLAN�� 222
I.11.3 DO�� 223
I.11.4 CHECK�� 226
I.11.5 ACT�� 227
I.11.6 External corrosion of specific plant and structure
item types �� 227
+44 (0)207 467 7100
Contents continued
Page
I.12 Corrosion under insulation �� 248
I.12.2 Challenging the need for insulation – PLAN/CHECK�� 249
I.12.3 Corrosion probability assessment – PLAN/CHECK�� 249
I.12.4 Consequence or criticality �� 255
I.12.5 Risk-based prioritisation – DO�� 255
I.12.6 Other considerations for inspection �� 257
I.12.7 Monitoring and measuring performance – CHECK�� 259
I.12.8 Audit – ACT�� 260
I.12.9 PLAN�� 261
I.12.10 DO�� 262
I.13 Stress corrosion cracking and localised corrosion of stainless
steels in chloride environments�� 263
I.13.2 Environments�� 265
I.13.3 Factors affecting corrosivity and tendency for degradation�� 265
I.13.4 Degradation mechanisms�� 268
I.13.5 Mitigation �� 272
I.13.6 PLAN�� 273
I.13.7 DO�� 273
I.13.8 CHECK�� 274
I.13.9 ACT�� 274
I.14 Erosion/corrosion�� 275
I.14.1 Erosion mechanisms�� 275
I.14.2 PLAN�� 276
I.14.3 DO�� 279
I.14.4 CHECK�� 282
I.14.5 ACT�� 282
I.15 Black dust in gas pipelines�� 284
I.15.2 Black powder formation and sources�� 286
I.15.3 PLAN�� 288
I.15.4 DO�� 288
I.15.5 CHECK�� 289
I.15.6 ACT�� 289
I.16 Mercury cracking�� 290
I.16.2 PLAN�� 293
I.16.3 DO�� 294
I.16.4 CHECK�� 296
I.16.5 ACT�� 297
I.17 Caisson corrosion �� 297
I.17.2 Caisson types and specific corrosion threats�� 299
I.17.3 PLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
I.17.4 DO�� 308
I.17.5 CHECK�� 309
I.17.6 ACT�� 310
+44 (0)207 467 7100
Contents continued
Page
I.18 Hydrogen failure mechanisms�� 310
I.18.2 PLAN�� 313
I.18.3 DO�� 314
I.18.4 CHECK�� 314
I.18.5 ACT�� 315
Annex J
Mitigation of oil and gas production and processing corrosion threats�� 316
J.1 Corrosion mitigation by chemical treatments�� 316
J.1.1 Continuous �� 316
J.1.2 Intermittent�� 317
J.1.3 Delivery systems�� 317
J.1.4 Corrosion control and integrity management chemicals�� 318
J.1.5 Oilfield flow assurance chemicals�� 321
J.1.6 Oilfield process chemicals�� 324
J.2 Mitigation by organic coatings and linings�� 325
J.2.1 Introduction�� 325
J.2.2 PLAN�� 327
J.2.3 DO�� 328
J.2.4 CHECK�� 330
J.2.5 ACT�� 330
J.2.6 Additional information coating deterioration guidelines�� 331
J.3 Corrosion mitigation by corrosion resistant alloys �� 331
J.3.2 PLAN�� 335
J.3.3 DO�� 335
J.3.4 CHECK�� 336
J.3.5 ACT�� 336
J.4 Mitigation by cathodic protection�� 336
J.4.2 PLAN�� 338
J.4.3 DO�� 338
J.4.4 CHECK�� 340
J.4.5 ACT�� 342
J.5 Corrosion mitigation by process control and environmental
modification�� 343
J.5.2 Water removal/dehydration �� 344
J.5.3 Deaeration�� 344
J.5.4 pH control�� 345
J.6 Corrosion mitigation of hydrotest waters�� 346
J.6.1 Hydrotesting �� 346
J.6.2 Hydrotest mediums �� 346
J.6.3 Microbial corrosion�� 347
J.6.4 Mitigation measures�� 347
J.6.5 Drainage and drying�� 348
J.6.6 Wet storage�� 349
J.6.7 Preservation�� 349
10
+44 (0)207 467 7100
Contents continued
Page
Annex K
Performing failure investigations �� 351
K.1 Level of investigation required�� 351
K.2 Who leads the investigation? �� 352
K.3 The investigation team �� 352
K.4 Starting the investigation �� 353
K.4.1 The plan�� 353
K.4.2 Securing and collecting the evidence�� 353
K.5 Who conducts the laboratory investigation�� 354
K.6 Scopes of work�� 355
K.7 Causation study �� 355
K.8 Terms of reference for failure investigation �� 355
K.9 Reporting�� 356
Annex L Checklist for assessment of corrosion management in oil and

gas production and processing facilities�� 360
L.1 Introduction �� 360
Annex M International standards and guides relating to corrosion

management�� 366
Annex N Bibliography �� 368
Annex O Document references �� 374
Annex P Glossary of terms �� 377

P.1 Terms �� 377
P.2 Abbreviations �� 378
11
+44 (0)207 467 7100
LIST OF FIGURES AND TABLES

Page
Figures
Figure 1 HSG65 PLAN-DO-CHECK-ACT�� 29

Figure 2 HSG65 PLAN �� 32
Figure 3 Contributors to the corrosion management strategy�� 36
Figure 4 HSG65 DO�� 37
Figure 5 HSG65 CHECK�� 49
Figure 6 HSG65 ACT�� 53
Figure A.1 Framework for successful corrosion management�� 66
Figure B.1 Management of health and safety �� 69
Figure B.2 The ALARP principle�� 71
Figure B.3 Schematic of the UK's offshore installations legislative framework �� 72
Figure C.1 Ageing and life extension and decommissioning�� 95
Figure D.1 Mitigation methods used as barriers to corrosion failure�� 98
Figure D.2 Relationships between duty holder/operator's policies, strategies and
procedures�� 100
Figure E.1 Example of organisational relationships �� 112
Figure E.2 Detailed roles and responsibilities of the integrity team�� 113
Figure F.1 Basis of corrosion risk assessment�� 126
Figure G.1 Example of bow tie view of corrosion barriers to failure �� 141
Figure G.2 Example traffic light summary of process facility�� 145
Figure I.1 Preferential weld corrosion�� 154
Figure I.2 Preferential weld and HAZ corrosion�� 154
Figure I.3 Uniformly distributed pitting corrosion�� 155
Figure I.4 Flow influenced corrosion�� 155
Figure I.8 Isolated pit�� 156
Figure I.9 Example of microblisters on internal surface of a flow line �� 163
Figure I.10 Example of pitting corrosion on internal surface of flow line due to
hydrogen sulfide corrosion producing stress raising features and resultant
lateral cracking from the pits �� 163
Figure I.11 Example of SSC in a susceptible steel matrix showing both intergranular
and trans-granular crack propagation features�� 163
Figure I.12 Pitting corrosion at 6 o'clock position that resulted in a leak in a spool-piece
on an outlet of a flotation unit upstream a water injection pipeline. Pit < 1 cm
diameter. Also corrosion is noted on the flange face�� 172
Figure I.13 Pitting corrosion of stainless steel SS316 in seawater �� 172
Figure I.14 Severe MIC in carbon steel, mediated by SRB (SRP)�� 177
Figure I.15 Microbiologically-assisted, chloride induced pitting attack of an active/passive
alloy pipework�� 178
Figure I.16 Gunmetal impellor from seawater pump �� 178
Figure I.17 Serial Dilution Tests for SRB (SRP) Enumeration�� 185
Figure I.18 Examples of typical dead legs�� 187
Figure I.19 Galvanic corrosion between a copper and carbon steel galvanised pipe
connected by a dielectric union �� 196
Figure I.20 Simplified Galvanic series in seawater (Guides to Good Practice in
Corrosion Control – Bimetallic Corrosion; The National Physical Laboratory,
DTI Publication, 1982) �� 196
12
+44 (0)207 467 7100
Figure I.21 Severe corrosion at the weldment (deep groove along the weld) indicating
that weld metal preferentially corrodes in CO2 environment�� 201
Figure I.22 Severe weldment corrosion in contact with hydrocarbon condensate
containing only a small amount of water and saturated with CO2�� 201
Figure I.23 The four steps in the formation of groove corrosion: (1) the formation of
films/scales; (2) erosion of film/scale at/near the 6 o' clock position; (3) formation
of a galvanic couple and (4) corrosion attack forming a groove38 �� 210
Figure I.24 Flange face corrosion�� 215
Figure I.25 Flange face corrosion revealed following breaking of the flange joint and
surface cleaning�� 215
Figure I.26 External corrosion of a pipe at a pipe support. Both the pipe and the support
are corroding at the crevice formed between the two. The coating is also
breaking back as it under-rusts in the crevice at the edge�� 221
Figure I.27 Heavy under-rusting of the paint film on a flange�� 221
Figure I.28 Handrail corroded by leak of firefighting foam concentrated chemical �� 221
Figure I.29 Top coat breakdown, enhanced corrosion under pipe support (clamp) �� 228
Figure I.30 Gross corrosion on module cladding�� 229
Figure I.31 Structural corrosion concentrated along edges, welds etc. �� 229
Figure I.32 Corrosion on cupronickel pipe �� 229
Figure I.33 Damaged grating requiring replacement�� 232
Figure I.34 Decking in need of recoating�� 232
Figure I.35 Unacceptable corrosion on rails �� 233
Figure I.36 Corroded mesh in need of replacement �� 233
Figure I.37 Quantitative assessment example: grating assessment �� 235
Figure I.38 Handrail assessment�� 239
Figure I.39 Grating assessment �� 240
Figure I.40 Inspection and prioritisation of handrail repairs�� 241
Figure I.41 Inspection and prioritisation of handrail repairs�� 241
Figure I.42 Localised bolt corrosion �� 243
Figure I.43 Significantly corroded bolts requiring replacement �� 243
Figure I.44 Major bolt corrosion�� 244
Figure I.45 Reinstated piping system �� 244
Figure I.46 Corroded cable tray�� 246
Figure I.47 Corroded cable ladders�� 246
Figure I.48 Corroded hand wheel�� 247
Figure I.49 Valve body corrosion �� 248
Figure I.50 CUI examples�� 261
Figure I.51 Annular SCC of duplex production tubing attributed to oxygenated
calcium bromide brine �� 265
Figure I.52 Internal SCC of 22Cr duplex resulting from chloride concentration effects �� 266
Figure I.53 SCC experienced on a cold worked dome end section of a previously
insulated vessel�� 267
Figure I.54 Evidence of corrosion taking place beneath label on 316L line �� 267
Figure I.55 Localised oxidation at stainless steel weld�� 268
Figure I.56 Pitting corrosion on 316L hydraulic piping �� 269
Figure I.57 Crevice corrosion at clamp location on 316 tubing�� 270
Figure I.58 Stress corrosion cracking on 316 fitting �� 271
Figure I.59 Examples of erosion mechanisms�� 275
Figure I.60 Basis of an erosion and erosion corrosion control scheme/management�� 278
Figure I.61 Parts of the production system that typically suffer from erosion62�� 280
Figure I.62 Black powder particles�� 285
Figure I.63 Damaged trim cage of a PCV-710�� 285
13
+44 (0)207 467 7100
Figure I.64 BP accumulations in a metering station�� 287

Figure I.65 BP accumulation in a cyclo-filter�� 287
Figure I.66 BP sludge observed when scrapping gas line pipe�� 287
Figure I.67 Mercury (symbol – Hg, atomic number – 80, atomic mass – 200.59)�� 290
Figure I.68 Mercury emerging from crack on aluminium heat exchanger (cold box) �� 292
Figure I.69 Close-up of crack on storage tank floor plate showing mercury droplet
(centre)�� 292
Figure I.70 Example of probability assessment for mercury attack�� 295
Figure I.71 Example image of offshore caissons in the atmospheric zone�� 298
Figure I.72 Example of cracking propagating from a localised internal corrosion defect �� 298
Figure I.73 Schematic diagram of a separator caisson, depicting the complex nature
of the internals�� 301
Figure I.74 Example of caisson perforation at the waterline/produced water interface �� 302
Figure I.75 Example of caisson perforation initiating at internal contact point�� 302
Figure I.76 Schematic diagram of example seawater lift pump caisson, showing key
components�� 303
Figure I.77 Finite element CP analysis showing ineffective protection at the
pump/motor restriction67 �� 305
Figure I.78 Riser cooling caisson example�� 307
Figure I.79 Hydrogen-induced stress corrosion cracking in a low-alloy (1 %Cr)
steel bolt �� 312
Figure I.80 Hydrogen embrittlement fracture surface of an oven bolt due to
hydrogen pick-up during plating�� 313
Figure J.81 Spray painting a vessel externally (Photo: International paint)�� 325
Figure J.82 Airless spray unit coating pipe internally with solventless epoxy coating �� 326
Figure J.83 Multilayer pipeline coating – fusion bonded epoxy, copolymer adhesive
and polypropylene�� 326
Figure K.1 Common steps in undertaking failure investigations . . . . . . . . . . . . . . . . . . . . . . . 351
Figure K.2 Persons who may be involved in an investigation �� 353
Figure K.3 Example fishbone diagram for the causes leading to a leaking flange�� 357
Tables
Table 1 Difficult to identify and quantify corrosion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Table 2 Comparison of HSG65 to conventional health and safety and to
process safety�� 28
Table 3 Criteria of non conformance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Table 4 Example risk matrix�� 42
Table 5 Prevalent human factors issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Table B.1 UK Regulations relating to asset integrity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Table F.1 Example of procedures for an offshore platform . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Table G.1 Example of barriers, performance limits and monitoring . . . . . . . . . . . . . . . . . . . . 134
Table G.2 Example condition overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Table I.1 Guidance for assessment of probability for dead leg corrosion to occur . . . . . . . . 189
Table I.2 An example probability assessment for dead legs in oil-water systems . . . . . . . . . 190
Table I.3 Uniformly distributed load (kN/m2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
Table I.4 Concentrated load (kN) applied over area of 300 mm × 300 mm . . . . . . . . . . . . . 236
Table I.5 Maximum lateral load (kN/m) for 48,3 mm diameter post
(material grade 43A, Fy = 275 N/mm2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Table I.6 Maximum lateral load (kN/m) for 1,5-inch NB schedule 40 post
(48,3 OD × 3,7 WT, Fy = 240 N/mm2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Table I.7 Maximum lateral load (kN/m) for 60,3 mm diameter socket
(material grade 43A, Fy = 275 N/mm2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
14
+44 (0)207 467 7100
List of figures and tables continued

Page
Table I.8 Maximum lateral load (kN/m) for 2-inch NB schedule 40 socket
(60,3 OD × 3,9 WT, Fy = 240 N/mm2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Table I.9 Fluid service and criticality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
Table I.10 Applications of stainless steels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Table I.11 Threshold temperatures for stainless steels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
Table I.12 Temperature ranges for stainless steels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Table I.13 Examples of design velocity limits to prevent erosion-corrosion . . . . . . . . . . . . . . . 281
Table I.14 Example report format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
Table I.15 Black powder corrosion compounds and their potential sources
constituent sources formation reaction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
Table J.1 Degree of rusting�� 331
Table J.2 Applications of corrosion resistant alloys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332
Table K.1 Common Non-Destructive Examination techniques (NDE) . . . . . . . . . . . . . . . . . . . 358
Table L.1 Corrosion management audit check list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360
15
+44 (0)207 467 7100
FOREWORD
Corrosion is first and foremost a safety risk which has to be understood and managed. Once the
safety risks associated with corrosion are managed control of the associated economic risks will
generally follow.
Corrosion has the potential to cost between 2 and 4 % of a company's turnover. The NACE
International report on the costs of corrosion suggests that approximately 25 % of this cost could
be saved by application of effective corrosion management, which presents an opportunity to make
significant savings and hence improve profitability for Operators.
Definitions of corrosion:
NACE/ASTM G193: ‘Corrosion is the deterioration of a material, usually a metal, that results from a
chemical or electrochemical reaction with its environment.’
ISO 8044: ‘Physicochemical interaction between a metal and its environment that results in changes
in the properties of the metal, and which may lead to significant impairment of the function of the
metal, the environment or the technical system, of which these form part.’
NASA: ‘Corrosion can be defined as the degradation of a material due to a reaction with its
environment. Degradation implies deterioration of physical properties of the material. This can be a
weakening of the material due to a loss of cross-sectional area, it can be the shattering of a metal due
to hydrogen embrittlement, or it can be the cracking of a polymer due to sunlight exposure. Materials
can be metals, polymers (plastics, rubbers, etc.), ceramics (concrete, brick, etc.) or composites-
mechanical mixtures of two or more materials with different properties.’
After the success of previous editions, this second edition of the Energy Institute (EI)'s Guidance on
corrosion management in oil and gas production and processing has been updated to:
(a) align with the Health and Safety Executive (HSE)'s revised guidance on Managing for Health
and Safety1 HSG65 2013;
(b) update the corrosion mechanisms;
(c) incorporate the lessons learned from the HSE's Ageing and Life Extension Programme KP42;
(d) highlight the applicability of this document to onshore oil and gas processing plant;
(e) consider Human Factors.
This guidance document was revised in conjunction with specialists from UK Offshore Operators and
Materials and Corrosion Engineering Consultants competent in corrosion control in the offshore oil
and gas industry.
Input to this revision was gained through working group meetings and individual contributions. The
information gathered has been collated and reviewed to identify commonalities in the approaches
taken to corrosion management across the industry.
The guidance is laid out such that the initial sections 1, 2 and 3 provide the overview of corrosion
management, whilst the details are contained in a series of Appendices. This approach is designed to
assist the reader to dip in and out of the document to obtain the information they need. For example,
Annex A provides details in the Structured Framework for Corrosion Management.
16
+44 (0)207 467 7100
This guidance offers good practices for the management of corrosion for:
−− offshore hydrocarbon production installations, and
−− onshore hydrocarbon processing plant.
By following these guidelines operators of hydrocarbon production and processing facilities should
improve:
−− safety;
−− regulatory compliance;
−− reliability;
−− availability;
−− longevity, and
−− profitability.
This guidance is useful to:

−− Duty Holders/Operators;
−− Operations Managers;
−− safety related personnel;
−− engineers;
−− fabric maintenance personnel, and
−− as an introduction for those wishing to learn more about corrosion management.
Whilst this guidance was produced by members of the UK's offshore hydrocarbon production
industry, it has widespread applicability to onshore oil and gas production, oil and gas processing
terminals, and potentially to similar process industries across the world.
This publication has been compiled for guidance only and whilst every reasonable care has been taken
to ensure the accuracy and relevance of its contents, the Energy Institute, its sponsoring companies,
the document writer and the Working Group members listed in the Acknowledgements who have
contributed to its preparation, cannot accept any responsibility for any action taken, or not taken,
on the basis of this information. The Energy Institute shall not be liable to any person or company
for any loss or damage which may arise from the use of any of the information contained in any of
its publications.
This guidance may be reviewed from time to time and it would be of considerable assistance for any
future revision if users would send comments or suggestions for improvements to:
The Technical Department,

Energy Institute,
61 New Cavendish Street,
London
W1G 7AR
E: technical@energyinst.org.uk
17
+44 (0)207 467 7100
ACKNOWLEDGEMENTS
The EI wishes to record its appreciation of the work carried out by the following individuals over the
project duration:
Corrosion Management Committee (CMC) Members

Dave Hillis* (CMC Chair) Total
Bruce Cowe Total
Jack Fraser BP
Henrik Anderson* Shell
Richard Carroll Shell
John MacDonald* Chevron
Phil Ligertwood Chevron
Sohail Saeed Chevron
Konstantinos Vatopoulos* Aramco Overseas
Ismenia Alvarez* Apache
Edgar Rodrigues* Taqa
Laura Scott Taqa
Fraser Selfridge Taqa
Zeinab Marsh Taqa
Emmanuel Alenkhe* ConocoPhillips
Elspeth Allen* Repsol Sinopec UK
Mekki Abdelkader Repsol Sinopec UK
Sandy Donaldson Nexen CNOOC
Kirk Henderson Nexen CNOOC
Fran Chalmers Centrica
Amanda Murray Centrica
Observer and Guest Members

Alistair Crichton* Marathon
Richard Waud* Independent Consultant
Clare Watt* KW Consulting
Stephen Plant PIM
Jim McGhee Xodus
Louise Atkin* HSE
Chris Scales HSE
Raman Patel HSE
Helen Pitts* HSL
*Special thanks to those who took on roles as lead drafters and reviewers for the various specialist
Annexes.
Technical drafting and editing: Andy Duncan, Intertek (with additional input by Dr Rachel Barson,
Steve Hodges, Dr Gareth John, Dr Steve Turgoose, Dr Mick Schofield, Dr Jim Stott, Kevin Waterton).
This second edition guidance was coordinated and managed by Dr Cameron Stewart, Energy Institute,
Upstream Technical Manager.
18
+44 (0)207 467 7100
STEERING GROUP CHAIR'S FOREWORD
Since its introduction, this EI corrosion management guidance document has become established as
a key reference for good practice in the management of corrosion. The guidelines have been utilised
worldwide with the principal aim of improving both safety and productivity by reducing incidents
related to corrosion.
The document has its origins in the UK HSE’s Offshore Technology Report 044 Review of corrosion
management for offshore oil and gas processing, published in 2001 as part of a drive by the
Regulator for improvement in corrosion management practices to help reduce loss of containment
frequencies. The document, authored by CAPCIS, relied on the participation of a wide range of
industry stakeholders for input and contributions of good practice examples based on practical
experience.
In 2006, the EI’s Corrosion Management Working Group was formed as an initiative identified by UK
Oil and Gas and the HSE Key Programme 3 findings. The primary remit was to update and enhance
OTR 2001/044, again drawing upon the experience and participation of industry stakeholders to
identify commonalities in approaches to corrosion management and agreed good practice. The
update was compiled by the late Mike Pursell, published in 2008 by the EI and has gained widespread
industry acceptance.
In addition to the corrosion management guidance document, the Corrosion Management Working
Group (Corrosion Management Committee (CMC) since 2012) has gone on to produce numerous
publications on specific topics of significance to the industry, including external corrosion, fabric
maintenance, microbiologically influenced corrosion, downhole corrosion management and erosion.
The CMC continues to operate an extensive portfolio of working groups to address gaps in industry
guidance, with current activity ranging from ageing of non-metallic materials to valve integrity in
both upstream and downstream applications.
In 2015, the CMC identified a need to revise the 2008 edition of the corrosion management
guidance document in order to recognise the update of HSE publication HSG65, Managing
for Health and Safety. Although this revision was originally envisaged to be a minor update,
as discussion progressed this became a more extensive revision of the document in the HSG65
format, which also included many new sections deserving of particular treatment. Specifically, the
legislative framework and pertinent regulations have been clarified and new coverage of aspects
such as human factors and competency added. On the technical side, new guidance on degradation
threats such as mercury and hydrogen embrittlement/cracking have been added as well as new
sections on mitigation techniques.
Thanks are extended to the members of the CMC and their organisations for their participation,
contributions and critical review. In particular, the CMC would like to thank the technical author,
Andrew Duncan of Intertek for his expertise and diligence in the process of developing the publication.
It is hoped that this new revision of the document will prove as successful as previous versions in
providing an invaluable resource for those involved in the corrosion management process, from junior
engineer level up to senior management.
The safety of personnel remains of paramount importance in the prevention of incidents through
effective corrosion management. However, it should be stressed that control of corrosion is a key
factor in minimising the potential for unplanned production outages, the financial implications of
which can vastly outweigh the cost of implementation.
19
+44 (0)207 467 7100
EXECUTIVE SUMMARY
This second edition of the EI's Guidance on corrosion management in oil and gas production
and processing provides general principles, engineering guidance and requirements for improving
corrosion management practices in oil and gas production and processing. It has been produced
by an experienced oil and gas industry work group with the objectives of:
−− Reducing the number of corrosion related hydrocarbon releases and other safety related and
environmentally damaging outcomes.
−− Identifying good practices for setting up an optimal corrosion management scheme.
−− Providing an overview of the top corrosion threats to production and processing facilities
downstream of wellheads.
−− Improving the safety profile of hydrocarbon installations.
−− Improving equipment reliability.
−− Improving equipment availability.
−− Improving profitability.
The pragmatic application of the Corrosion Management Plan (CMP) requires Duty Holder/Operator
senior management to be engaged and to actively participate in supporting members of the Corrosion
Management Team, to achieve their goals.
In this document corrosion management (CM) is defined as 'the part of the overall management
system that develops, implements, reviews and maintains the corrosion management policy and
strategy'.
The Duty Holder/Operator of the hydrocarbon producing/processing asset should have a high level
Integrity Management Policy which sets the scene for the CMP to operate within and to comply with.
This guidance document includes CM strategy requirements which should be considered normal
practice.
Persons leading the Corrosion and Integrity teams responsible for managing corrosion should have
extensive experience in the subject, and where the Team Manager does not have the requisite
technical experience they must have suitably competent staff to support them.
The HSE states that competence can be described as ‘the combination of training, skills, experience
and knowledge that a person has and their ability to apply them to perform a task safely. Other
factors, such as attitude and physical ability, can also affect someone's competence.’
The layout of this second edition is based on the elements of the UK HSE's HSG65 Managing for
health and safety model which describes the PLAN-DO-CHECK-ACT approach which was published
in 2013:
20
+44 (0)207 467 7100
Risk
Planning profiling
Organising
Policy
PLAN DO
Implementing
your
plan
ACT CHECK
Learning Measuring
lessons performance
Investigating
Reviewing accidents/
performance incidents/
near misses
This document contains references to compliance with UK and European law. Where this document
is used outwith these geographical areas local laws shall apply as the minimum requirement.
Annex A provides information on the framework for corrosion management within the approach of
PLAN-DO-CHECK-ACT.
Annex B provides information for the legal basis for corrosion management, including initial
reference to UK and EU Regulations.
Annex C is a new section containing information relating to the management of Ageing and Life
Extension (ALE) of hydrocarbon producing and processing assets.
Annex D offers guidance on normal good practice for corrosion management.
Annex E contains information on organisational requirements for corrosion management.
21
+44 (0)207 467 7100
Annex F provides overview advice on corrosion risk assessment and planning.
Annex G gives advice on implementation and analysis of corrosion management systems (CMSs).
Annex H gives information on audits.
Annex I contains information on most of the corrosion threats experienced in the oil and gas
production and processing industry.
Annex J contains information on mitigation methods for the corrosion threats.
Annex K contains information on how to conduct failure investigations.
Annex L offers a checklist for ensuring corrosion management is being handled effectively.
Annex M contains a list of standards and guidance relating to corrosion management.
Annex N contains the bibliography.
The complexity of a CMS will depend on the known and potential threats, the size of the operation,
and the anticipated productive longevity of the asset. These factors will affect the number of
personnel required to be involved to manage integrity of the asset. Further factors such as the extent
of outsourcing of the technical functions will also have an impact.
An effective CMS should have risk assessments for all safety critical and safety related elements,
which should have effective management processes in place to ensure both the availability and
effectiveness of barriers to failure due to corrosion, so far as is reasonably practicable (SFAIRP).
Practical experience from the United Kingdom Continental Shelf (UKCS) has shown
that an effective CMS, coupled with the commitment of the Duty Holder/Operator and
their service providers, can lead to major improvements in safety, environmental protection, reliability
and profitability in oil and gas production operations. These findings are transferable to onshore oil
and gas processing facilities.
Corrosion is first and foremost a safety risk which has to be understood and managed. Once the
safety risks associated with corrosion are managed, control of the associated economic risks will
generally follow.
In the UK's 1971 Hoar report3, and more recently in the 2002 USA Cost of Corrosion Study4
undertaken by NACE International, it is identified that corrosion costs between 3 % and 4 % (3,1 %
for the recent USA study) of a nation's Gross Domestic Product (GDP), which for an individual
business company is equivalent to 3 to 4 % of turnover. These percentages can add significant
costs to a Duty Holder/Operator's operations.
The Cost of Corrosion reports estimate that some 25 % of the cost relating to corrosion damage
could be saved by the judicious application of corrosion management techniques. This indicates a
significant opportunity to improve safety and profitability.
Corrosion in the oil and gas production and processing industries can occur on both the internal and
external surfaces of equipment. Because this equipment handles potentially hazardous fluids such
as hydrocarbon liquids and gases, they are usually referred to as Safety Critical Elements (SCEs). In
22
+44 (0)207 467 7100
the context of the 2015 Offshore Safety Case Regulations, Environmentally Critical Elements (ECEs)
should also be considered. It is likely that all SCEs will be ECEs. SCR2015 now refers to SECEs.
In the oil and gas production and processing industries most SECEs are fabricated from carbon steels;
however, where the corrosion and environmental degradation threats may be intolerable for safety
or economic reasons corrosion resistant alloys (CRA) such as duplex stainless steels, and high nickel
alloys may be required. Alloys may also be used to manage potential high temperature and low
temperature materials threats.
Corrosion in the oil and gas production and processing industry is managed in a number of ways,
with the choice of technique(s) being selected on their ability to work effectively over the forecasted
asset life cycle, combined with the cost of applying and maintaining the technique(s):
−− Corrosion inhibitor (CI) chemicals are used to manage internal corrosion in carbon steel
pipelines.
−− Biocides are used to control sulfate reducing bacteria (SRB).
−− Scale inhibitor chemicals are used to control scaling precipitates.
−− Wax inhibitors are used to control wax deposition.
−− Metallurgical solutions may be used to control sulfide stress corrosion cracking (SSCC) and
hydrogen induced cracking (HIC) by controlling the hardness of the steel and by using steel
with low levels of inclusions.
−− Corrosion resistant alloys (CRAs) may be used to manage intolerable corrosion threats and
extremes of temperatures.
−− Cathodic protection (CP) can be used to protect the external surfaces of buried or submerged
pipelines and structures and also of the internal surfaces of vessels.
−− Coatings can be used to protect the external surfaces of buried or submerged pipelines
and structures and also of the internal surfaces of vessels. Coatings are also used on above
ground/surface steel work which is exposed to marine environment corrosion.
−− Design may be used to minimise corrosion, for example by using swept bends to reduce
erosion, and by avoiding dead legs in process piping.
In conjunction with the selected CM techniques it is essential to deploy corrosion monitoring methods
which measure the corrosivity of the fluids, and non-destructive testing (NDT) techniques which
measure the wall thickness of the SECE. The data from the monitoring should be trended to forecast
the future criteria of non-conformance (CONC) so that early corrective action can be taken to avoid
loss of integrity.
This EI Corrosion Management guidance document sets out systems which are required to be put into
place to achieve safe and effective CM processes for oil and gas production and processing facilities.
These systems are aligned with the UK HSE's third edition of HSG65, which describes the PLAN-DO-
CHECK-ACT approach. The HSE guidance document says that the revised HSG65 shows how it can
help achieve a balance between the 'systems' and 'behavioural' aspects of management. It also treats
health and safety management as an integral part of good management generally, rather than as a
stand-alone system. It is within this same context that the CMS falls within the company's integrity
policy, and is designed to enable the Company's integrity policy to be delivered effectively.
The guidance contained in this document is not meant to be exhaustive, and new
approaches to CM and corrosion monitoring are continuously being developed. It is
recommended that companies involved with hydrocarbon production and processing, and the
service providers, should generate additional guidance and tools to ensure their CMSs are effective
at ensuring risks are as low as reasonably practicable (ALARP).
23
+44 (0)207 467 7100
The influence of leadership in ensuring the CM strategy is effective in keeping risks ALARP is essential.
Since the publication of the 2008 Guidelines the following corrosion mechanisms have been
identified as those which are the most difficult to accurately find and quantitatively inspect for.
These are shown in Table 1.
Table 1: Difficult to identify and quantify corrosion
Corrosion threat Reason for difficulty Requires more industry

input to resolve
Corrosion under NDT techniques insufficiently Financial support for NDT R&D
insulation accurate through insulation Removal remains the best
Removal very expensive option
Corrosion under pipe NDT techniques insufficiently Financial support for NDT R&D
supports (aka touch accurate through supports Methods to safely lift pipes for
point corrosion) Amount of rust showing is not close visual inspection
indicative of the metal lost
Corrosion of unpiggable It is not possible to run an A partial solution is to perform
subsea pipelines intelligent pig through an corrosion risk analyses and
unpiggable line determine a P90 probability of
determining condition. This is
not a substitute for NDT
Stress corrosion NDT techniques cannot Financial support for NDT R&D
cracking reliably identify remaining wall
thickness
Bolting corrosion NDT techniques insufficiently Financial support for NDT R&D
accurate to quantify metal loss
from the bolt head
24
+44 (0)207 467 7100
1 INTRODUCTION
1.1 PURPOSE
It is recognised within the oil and gas production industry that effective CM significantly
contributes to better asset integrity and achieves:
−− Compliance with:
– statutory health, safety and environment requirements, and
– corporate health, safety and environment requirements.
−− Improved safety management.
−− Reduced environmental risks.
−− Improved process plant and structural integrity.
−− Improved plant availability and hence profitability.
−− Reduced unplanned maintenance and hence costs.
−− Reduced deferment costs.
−− Optimisation of mitigation, monitoring and inspection costs.
−− Improved working environment.
This document has been written to provide CM guidance to individuals and organisations
active within offshore and onshore oil and gas production and processing facilities. In addition
to corrosion management guidance there are practical examples of good industry practice.
1.2 SCOPE OF APPLICATION
1.2.1 Management system scope
In this document CM is defined as 'that part of the overall management system that develops,
implements, reviews and maintains the corrosion management policy and strategy'.
The corrosion policy provides a framework for the identification of corrosion threats and
potential consequences, and for the development and implementation of risk control
measures.
1.2.2 Production facilities scope
The guidance applies to the following facilities:

−− process plant and utilities;
−− primary and supporting structures of offshore hydrocarbon production installations;
−− wells are not specifically addressed in this document as they will be covered in the EI
publication on downhole corrosion management5;
−− hydrocarbon subsea gathering lines, main pipelines, manifolds and processing systems,
and
−− onshore plant for the reception, separation and stabilisation of hydrocarbons.
25
+44 (0)207 467 7100
This guidance is written to address CM within the UK and EU Regulatory frameworks for offshore
hydrocarbon production installations (Annex B). However, it is applicable to similar facilities
anywhere in the world provided local laws are complied with as a minimum.
The approaches described in this guidance can successfully be applied to most aspects of
onshore hydrocarbon production and processing.
This guidance does not specifically cover:

−− wells and well control equipment;
−− the transportation of oil and natural gas by sea;
−− any facilities after separation and stabilisation onshore;
−− oil refineries, and
−− gas liquefaction plants.
However, the principles identified in this document are likely to be applicable to these areas
provided they are applied by a competent Technical Specialist.
1.2.3 Deterioration processes scope
CM considers those threats to process plant integrity arising from deterioration and failure
mechanisms arising from, but not limited to:
−− corrosion related mechanisms;
−− corrosion: general, localised, pitting
– CO2, H2S, amine, soils, water, et al.
−− flow influenced corrosion;
−− corrosion fatigue;6
−− microbially influenced and assisted corrosion;
−− stress corrosion cracking;
−− hydrogen induced cracking;
−− galvanic corrosion;
−− preferential weld corrosion;
−− metallurgy and microstructural influenced corrosion;
−− defective microstructure, and
−− liquid metal embrittlement.
1.2.4 Structured framework for corrosion management support function
For efficient CM of an asset the usual approach would be for the Duty Holder/Operator to
have a well-defined corrosion support function. This may consist of:
−− a centralised corrosion group supporting all assets;
−− corrosion groups supporting specific asset(s), or
−− a combination of both.
26
+44 (0)207 467 7100
The corrosion support function may consist of a combination of:

−− staff directly employed by the Duty Holder/Operator;
−− in-house consultants/contractors, and
−− external consultants/contractors.
Whichever way the function is fulfilled it is preferred that the Duty Holder/Operator has
available in-house competent persons who are capable of interacting with other engineering
and science functions within the company and also service providers.
Because CM activities may be undertaken by several persons there should be a clear structured
framework with defined roles and responsibilities.
This guidance focuses on CM during production operations. However, it is essential to get the
basis of design correct because this is the first opportunity to manage the corrosion related
risks at an early and cost-effective stage, with the preferred option being to design them out.
Many hydrocarbon producing installations are mature and likely to experience corrosion
problems which have not been designed out; these guidelines have particular applicability to
these assets.
Hydrotesting and mothballing are included in this document to address the corrosion threats
these pose to the longevity of assets. Experience has shown that a number of in-service
failures may have their origins traced back to the hydrotesting process undertaken during
commissioning.
27
+44 (0)207 467 7100
2 REASON FOR DOCUMENT LAYOUT
Previous editions of this guidance have been based upon the framework of the HSE's HSG65
Managing for health and safety which until 2013 followed the POPMAR model of Policy,
Organising, Planning, Measuring Performance, Auditing and Review.
In 2013 HSG657 was revised to create the PLAN-DO-CHECK-ACT approach, which

is designed to balance the 'systems' and 'behavioural' aspects of management; it is this
modified approach which this second edition follows.
The new HSG65 describes the relationship between the revised PLAN-DO-CHECK-ACT
approach and conventional health and safety management and also process safety, which is
contained in HSG65's Table 2 and reproduced here.
Table 2: Comparison of HSG65 to conventional health and safety and to process

safety
PLAN-DO- Conventional health and safety Process safety

CHECK- management
ACT
PLAN Determine your policy/plan for Define and communicate
implementation acceptable performance and
resources needed
DO Profile risks/organise for health Identify and assess risks/identify
and safety/implement your plan controls/record and maintain
process safety knowledge
CHECK Measure performance (monitor Implement and manage control

before events, investigate after measures
events)
ACT Review performance/act on Measure and review performance/
lessons learned learn from measurements and
findings of investigations
28
+44 (0)207 467 7100
HSG65 describes a circular relationship between PLAN-DO-CHECK-ACT which is reproduced

from the document here:
Risk
Planning profiling
Organising
Policy
PLAN DO Implementing
your
plan
ACT CHECK
Learning Measuring
lessons performance
Investigating
near misses
Figure 1: HSG65 PLAN-DO-CHECK-ACT
The purpose of HSG65 is to help provide a framework for organisations to comply with their
legal duties to put into place suitable arrangements to manage health and safety.
This guidance is an intrinsic part of assisting companies operating in the oil and gas production
industry not only to fulfil their health and safety obligations, but also to improve operational
reliability and hence profitability.
The form of HSG65 is such that it is likely to be able to be followed within almost all National
legal frameworks, thereby enabling Duty Holders/Operators to comply with local laws and
Regulations.
In relation to this guidance, the PLAN section of HSG65 requires Duty

Holder/Operators to consider:
−− current and future integrity status of the asset:
−− future aims of CM;
−− how to achieve the CM aims;
29
+44 (0)207 467 7100
−− who is responsible for achieving the CM aims;

−− measurement of performance of the CMS, to include leading and lagging indicators;
−− future changes to the process conditions, and
−− legal framework within which the asset operates.
Note: in accordance with The Offshore Installations (Safety Case etc.) Regulations 2015 'Duty
Holder' means:
−− in relation to a production installation, the operator, and
−− in relation to a non-production installation, the owner.
Note: in accordance with the guidance of the Control of Major Accident Hazards Regulations
2015, an 'operator' means:
'the person who is in control of the operation of an establishment, or in relation to an

establishment which is to be constructed or operated the person who proposes to control
its operation, or if that person is not known, the person who in the course of a trade,
business or other undertaking carried on by that person has commissioned its design and
construction'
In essence, a Duty Holder/Operator is in overall control of the asset/installation, and must

coordinate the health and safety activities of all the companies and personnel present on
the installation. A widely used alternative term to 'Duty Holder' is 'Operator'.
In common parlance the terms 'Duty Holder' and 'Operator' are interchangeable.
In relation to this guidance, the DO section of HSG65 requires Duty

Holder/Operators to consider:
−− The risk profile:
– Corrosion Threats Assessment (CTA;)
– consequences of corrosion, and
– hence the overall risk of corrosion.
−− The organisation to deliver the plan:
– resources within the Duty Holder/Operator;
– resources available from consultants and contractors;
– competency of staff, consultants and contractors, and
– communication of the plan.
−− Implementation of the plan:
– identify the corrosion control measures needed to manage the threats;
– implement the corrosion control measures;
– ensure the correct corrosion control equipment is available and maintained;
– ensure personnel are competent to carry out the work, and
– supervise activities to ensure the corrosion control measures are followed.
In relation to this second edition guidance, the CHECK section of HSG65 requires Duty
Holders/Operators to consider:
−− Measurement of performance:
– to ensure the plan has been implemented;
– assess effectiveness of the corrosion threats are being managed;
– whether the CM aims are being achieved;
30
+44 (0)207 467 7100
– undertake CM audits, and

– investigate the causes of corrosion and degradation related incidents and
accidents.
In relation to this guidance, the ACT section of HSG65 requires Duty

Holders/Operators to consider:
−− Review performance:
– learn from loss of control of CM occurrences and associated consequences from
within their operations and from other Duty Holders/Operators;
– review and revise CMPs and policies if required;
– take action on lessons learned, including from audit and inspection reports, and
– Annex B contains specific references and text related to relevant UK Regulations
and EU Directives.
2.1 PLAN
2.1.1 Purpose
The company policy(s) sets the direction for the management of corrosion and degradation
risks to ensure they are ALARP in order to improve the assets' safety profile and improve
operational reliability.
A plan is essential to delivering the company's corrosion management policy, which itself
must also comply with the Company's Health And Safety Policy.
31
+44 (0)207 467 7100
Risk
Planning profiling
Organising
Policy
your
plan
ACT CHECK
Learning Measuring
lessons performance
Investigating
near misses
Figure 2: HSG65 PLAN
2.1.2 Legal framework
The UK's Health and Safety laws and supporting Regulations make a number of references
to integrity management. In addition, there is a requirement for hydrocarbon operations
within UK waters to comply with the European Union's Offshore Safety Directive 2013/30/
EU.
Compliance with UK law and EU Directives is covered in more detail in Annex B of this
guidance document.
2.1.3 Worldwide legal basis for corrosion management
It is beyond the scope of this document to address the wider geographical legal
requirements for CM of potentially hazardous installations, other than to state that Duty
Holders/Operators and their service providers must comply with local laws as a minimum.
Where local laws fall below the normal standards required and expected by international
companies it is recommended the higher standards be followed.
32
+44 (0)207 467 7100
2.1.4 High level integrity management policy
2.1.4.1 General
Company policies are a stated course of action which should reflect the vision of the
organisation and a genuine commitment to action. This view is reflected in HSE's Energy
Division Offshore oil and gas sector strategy8, that requires that the offshore industry
demonstrates effective leadership in managing major hazard risks and which also encourages
industry cooperation and leadership in health and safety. The Company Policy is typically a
short document, possibly just one page, which sets out the company's high level intentions.
Company strategies are the action plans which provide the means by which the policy is
implemented. There are likely to be several strategies to address a number of actions which
need to be undertaken to ensure that the Policy is delivered in a timely manner.
This section identifies key aspects that contribute toward an effective policy and strategy for
the management of corrosion.
Because of the central nature of the Company Policy and Strategy to delivering effective and
safe CM they should be widely communicated. An effective method for communication of
the Policy and Strategy is to undertake corrosion awareness activities which usually involve
offshore poster campaigns and presentations to platform personnel.
2.1.5 Policy
Companies and their organisations should have in place Policies to manage the hazards9
(anything that may cause harm to people and/or the environment) and risks8 (the chances
of being harmed) associated with safety, health and environmental protection. This
combination which includes the environment has acquired greater importance since the
introduction of the EU's Offshore Safety Directive 2013/30/EU.
The company's policy should address the hazards and risks associated with ageing and
life extension (ALE), and to demonstrate they are taking a long-term view of integrity and
safety management. Further information and good practice guidance is available, such
as the EI Guidelines on the corrosion management of offshore oil and gas production
facilities: addressing asset ageing and life extension (ALE), and HSE's KP4 Report and
recommendations.
Whilst the company's policy may consider threats to its profitability and business interruption,
these must not override or conflict with those that seek to manage the hazards and risks
associated with safety, health and environmental protection.
It is reasonable for the company's Policy to either be specific to CM, or for it to form a part
of its wider Integrity Management Policy.
To encourage compliance with the CM it should be signed and issued by the most senior
Manager of the facilities to which it relates.
The corrosion management policy should clearly state:

−− Who within in the organisation will deliver the objectives.
−− What the expectations and objectives are by which compliance with the policy may
be measured.
−− Where the Policy relates to (assets and installations).
−− Why the Policy is relevant to the company's activities.
−− How the arrangements for carrying out the policy will be performed.
33
+44 (0)207 467 7100
2.1.6 Detailed corrosion management policy
At Departmental level, and sitting below the company's overall CM/Integrity Policy, there
should be a detailed Corrosion Management Policy which considers:
−− Who should be considering the corrosion threats:
– corrosion engineers;
– production chemists;
– integrity engineers, and
– inspection engineers, et al.
−− What general corrosion threats should be considered.
−− Where the corrosion threats are being considered:
– specific assets/installations;
– piping;
– vessels;
– flowlines, and
– pipelines, etc.
−− Why the corrosion threats need to be managed:
– regulatory compliance;
– safety;
– longevity;
– availability;
– reliability, and
– profitability.
−− How the threats may be managed:
– chemical treatments;
– materials selection;
– coatings;
– CP, and
– environmental modification, etc.
2.1.7 Cross-reference to international standards
There are no international references providing an overview of CM; however, there are
several which address the details of corrosion control, which will be covered elsewhere in
this document.
2.1.8 Ageing and life extension considerations
ALE management is a continuum of CM/asset integrity management and should be

considered within the same policies, plans and strategies.
In HSE's Plant ageing study research report RR50910 and Plant ageing study research report
RR82311, ageing and ageing plant are defined as:
'Ageing is not about how old your equipment is; it is about its condition, and how that is
changing over time. Ageing is the effect whereby a component suffers some form of material
deterioration and damage (usually, but not necessarily, associated with time in service) with
an increasing likelihood of failure over the lifetime
34
+44 (0)207 467 7100
Ageing equipment is equipment for which there is evidence or likelihood of significant

deterioration and damage taking place since new, or for which there is insufficient
information and knowledge available to know the extent to which this possibility exists. The
significance of deterioration and damage relates to the potential effect on the equipment's
functionality, availability, reliability and safety. Just because an item of equipment is old does
not necessarily mean that it is significantly deteriorating and damaged. All types of equipment
can be susceptible to ageing mechanisms.'
Work published by Professor Vinnem12 of the Norwegian University of Science and Technology
(NTNU) in 2010 states that:
'It is not possible to demonstrate a correlation between leak frequency and the age of an
installation'.
These significant works on ageing reinforce the importance of considering corrosion/integrity

management and ageing management within the same policies.
2.1.9 Integration with safety management systems
A safety management system (SMS) is a formalised approach to managing the hazards and
risks associated with hydrocarbon production and processing.
For the offshore industry, an SMS is a requirement placed upon the Duty Holder/Operator
by the Offshore Installations (Offshore Safety Directive) (Safety Case etc.) Regulations 2015,
Regulation 813, to have a document for its safety and environment management system. This
document should include:
−− the organisational structure;
−− responsibilities;
−− practices;
−− procedures;
−− processes;
−− resources for determining and implementing the corporate major accident prevention
policy, and
−− must include a description of the organisational arrangements for the control of
major accidents
For onshore hazardous industries, the requirement to have a major accident prevention
policy (MAPP) is placed upon Duty Holder/Operators in Regulation 7 of the Control of Major
Accident Hazards (COMAH) Regulations 201514:
−− '(2) A major accident prevention policy must—
(a) be designed to ensure a high level of protection of human health and the
environment;
(b) be proportionate to the major accident hazards;
(c) set out the operator's overall aims and principles of action, and
(d) set out the role and responsibility of management, and its commitment towards
continuously improving the control of major accident hazards'.
Because the corrosion/integrity management policy is aimed at preventing loss of integrity

and the uncontrolled release of hydrocarbons, and hence the consequences of such a release,
it is an important document within the corporate SMS for the control of corrosion related
risks and their consequences.
35
+44 (0)207 467 7100
2.1.10 Strategy
A CM strategy document should exist which describes the methods by which the policy is to
be implemented.
The CM strategy should be clearly derived from the policy.
The strategy should describe the links between the participants responsible for delivering
the CM policy. This is particularly important where there are partnerships between the Duty
Holder/Operator, consultants and contractors.
Duty
Duty Holder/ Duty Holder/
Holder/
Operator’s Operator’s Integrity
Operator
Health and Safety Policy
Policy
CTA, RBI, WSE

NDT from Service CORROSION from Duty Holder/
Provider MANAGEMENT Operator or
STRATEGY Service Provider
Offshore Safety Onshore

Case Competent
Authority
Onshore Safety
Offshore Verification/
Report
Competent Person
Figure 3: Contributors to the corrosion management strategy
The strategy should undergo review whenever there are forecast or known significant
changes in operations or company policy and, otherwise, at set intervals. When appropriate
the strategy should be updated on the basis of the findings of such reviews.
The strategy should address the forecast asset life and/or life extension.
The strategy should align with any separate plans that conform to statutory legal
requirements.
36
+44 (0)207 467 7100
2.2 DO
Risk
Planning profiling
Organising
Policy
your
plan
ACT CHECK
Learning Measuring
lessons performance
Investigating
near misses
Figure 4: HSG65 DO
2.2.1 Purpose
Within the DO section of HSG65 it requires the Duty Holder/Operator to consider:

−− risk profiling;
−− organisation, and
−− implementing the plan.
For the purposes of CM this requires implementation of the policy by:

−− identifying the corrosion threats/hazards by performing a formal CTA;
−− identifying the probability/likelihood of failure by corrosion;
−− identifying the potential consequences of failure;
−− determining the risk of failure, where
Risk = Likelihood × Consequence.
−− ranking the risks by determining the consequences of leak or break;
−− having an organisation in place to identify the threats and manage the risks, and
−− having a plan to identify the threats and implement the corrosion mitigation methods.
37
+44 (0)207 467 7100
2.2.2 General assessment of risk
According to the HSE15 the definition of a risk is:
'A risk is the likelihood that a hazard will actually cause its adverse effects, together with a
measure of the effect. It is a two-part concept and you have to have both parts to make sense
of it. Likelihoods can be expressed as probabilities (e.g. 'one in a thousand'), frequencies (e.g.
'1000 cases per year') or in a qualitative way (e.g. 'negligible', 'significant', etc.)'.
In the field of CM the focus is on identifying the corrosion related threat, the rate at which
it has been propagating, the rate at which it is likely to propagate in the future, and hence
when it is likely to manifest itself as a risk to: people, environment and business.
Risk = hazard (corrosion threat) × probability (likelihood) of failure
A Corrosion Risk Assessment System (CRAS) allows threats and their potential consequences
to be identified and the risks they present to be ranked. As a result plans can be made to
apply resources to combat the significant risks and to mimimise effort being wasted on
insignificant risks.
At the design stage the CRAS can be based on theoretical considerations combined with
personal and industry experience.
Throughout the life of the facility the CRAS should be refocused and refined as a consequence
of operational experience and inspection history.
At the design stage the task is to plan activities in both design and construction and in initial
operations. At this stage there are opportunities to eliminate some risks completely and
achieve inherent safety through process design and the use of resistant materials.
Planning is made both at the strategic level, which outlines the key choice of barriers to
the threats, and at the tactical level where the activities to implement, and to monitor the
effectiveness of, those barriers are identified and written down.
2.2.3 Corrosion risk assessment
A CRAS may be undertaken in accordance with one or more of the following methodologies:
−− API RP 580 Risk based inspection;
−− DNV RP G101 Risk based inspection of offshore topsides static mechanical equipment;
−− NACE 10367 High level corrosion risk assessment methodology for oil and gas
production systems, or
−− equivalent recognised CRAS guidance.
In accordance with the EU Offshore Safety Directive, all Safety and Environmentally Critical
Elements (SECE) must be identified and logged in a suitable database.
According to the SCR2015 Regulation 2:
'safety and environmental-critical elements' means such parts of an installation and

such of its plant (including computer programmes), or any part of those—
(a) the failure of which could cause or contribute substantially to a major accident; or
(b) a purpose of which is to prevent, or limit the effect of, a major accident;
38
+44 (0)207 467 7100
'specified plant' means the plant for an installation which is provided—

(a) in compliance with regulations 11(1)(a), 13, 15 and 16 of the PFEER Regulations;
(b) as required to be provided by regulation 10 of the PFEER Regulations as means—
(i) for detecting fire; or
(ii) for detecting and recording accumulations of flammable gases, and
(c) pursuant to the measures required by regulation 12 of the PFEER Regulations to
combat fire and explosion,
except for—
(a) plant which is part of the safety and environmental-critical elements for that
installation, and
(b) aircraft or equipment to which regulation 18 of the PFEER Regulations applies.
For the purposes of clarity, in the majority of cases SCEs and ECEs will be the same, hence
from hereon only SECEs will be referred to.
The Duty Holder/Operator will usually identify and record Business Critical Elements, but in
terms of risk management these are subservient to SECEs.
The corrosion threats to the integrity of SECEs and the likelihood they will fail must be defined.
Where possible the rate of deterioration of SECEs should be determined by extrapolation
of verified inspection data and/or theoretical calculation using process data. Examples of
theoretical calculations include:
−− CO2 corrosivity models;
−− oxygen corrosivity models, and
−− microbially influenced corrosivity models.
The consequences of a corrosion related failure which may occur in the event of an unplanned
release of hazardous material from the process is a separate calculation to that for the
corrosion risk. The consequences relate to the potential for:
−− persons who may be harmed or killed (potential for loss of life, PLL);
−− environmental damage, and
−− business interruption.
In accordance with the EU Directive the potential for personnel and environmental harm
must be determined; however, note that for the purposes of a CRAS study this may be done
on a semi-quantitative basis and there is no requirement to perform a full Quantitative Risk
Assessment (QRA). A QRA is usually the responsibility of the Process Safety Department.
The probability of a corrosion related failure of each SECE and its consequences on people
and the environment should be calculated to determine a Risk Rank which should be used
to prioritise the allocation of resources to manage the risks using inspection and corrosion
mitigation techniques.
The CRAS method followed must be documented and should be verified by a third party to
ensure validity.
The internal and external environment of SECEs subject to CRAS must be recorded.
39
+44 (0)207 467 7100
The CRAS should be reviewed at a frequency commensurate with the risk and when operating
conditions are, or are forecasted to be, subject to a significant change. A significant change
may include:
−− increased water cuts;
−− increased H2S levels;
−− increased CO2 levels;
−− new process streams entering the system, and
−− appearance of a widespread unmanaged risk requiring urgent action.
2.2.4 Organising
2.2.4.1 Purpose
Effective management and practices are required to deliver the CM policy and strategy.
Senior management leadership is necessary to establish a culture wherein CM is intrinsic

to the company's SMSs and its integrity management culture, and is a requirement for
improving the safety profile of hazardous installations.
This section provides a framework and examples of how a CMS helps in the allocation of roles
and responsibilities both within the Duty Holder/Operator's organisation and contractor/sub-
contractor organisations.
2.2.4.2 General
The management of corrosion and its consequences usually crosses a number of departments
and will frequently extend beyond the Duty Holder/Operator to consultants and contractors.
The proportion of the CM work to be undertaken 'in-house' or by service providers is not

defined; there is merely a requirement under UK health and safety regulations to:
'make and give effect to such arrangements as are appropriate, having regard to the nature
of his activities and the size of his undertaking, for the effective planning, organisation,
control, monitoring and review of the preventive and protective measures16'.
Because of the common practice of using both Duty Holder/Operator staff and also service
providers, it is important to ensure the CM culture extends to all those involved.
The key contributors for the effective organisation of CM should be identified:

−− A technical and administrative support structure suitable for the size and complexity
of the hazardous installation(s), which should consider:
– defining the roles responsibilities and accountabilities of technical persons, and
– defining the competence of technical persons.
Competency should be achieved through the combination of17: training, skills, and experience
to ensure that corrosion and integrity personnel have the ability to perform their tasks
effectively.
There should be a corporate environment which encourages and enables:

−− cooperation between individuals and groups
−− communication across the organisation
40
+44 (0)207 467 7100
A CM and Integrity team should exist with responsibilities for coordination, cooperation and
communication, to ensure the highest reasonably practicable levels of safety across assets,
and to ensure responsibility and accountability for CM. For very small organisations this is
likely to rely substantially on service providers.
Where technically appropriate corrosion management specialists should be involved in the

corporate management of change processes to ensure risks to SECEs are managed to ALARP.
A method of ensuring management awareness of the current condition of assets

is to create a CM 'dashboard' wherein the highest risk equipment is traffic-lighted
and its remaining life to the criteria of non-conformance (CONC) is identified.
See Table 3 for an example.
41
+44 (0)207 467 7100
+44 (0)207 467 7100
Table 3: Criteria of non-conformance
Dashboard date: xx/xx/xxxx
System What is the risk?
Equipment
Risk level
Potential
consequences
Priority
Reason
Mitigating actions
Estimated date to fail
criteria of
non-conformance
Operational risk
assessment required?
Internal Inspect weekly.

Gas Wet gas Fire, explosion, Remaining wall thickness yy/yy/
High P1 CO2 Injecting corrosion Yes
compression lines lost production = MAWT + 1 mm yyyy
corrosion inhibitor
Internal Inspect weekly.
Stabilised Fire, pollution, Remaining wall thickness yy/yy/
pipe Medium P2 CO2 Injecting corrosion Yes
crude lost production = MAWT + 1 mm yyyy
corrosion inhibitor
Seawater
LP water Remaining wall thickness oxygen in Planned yy/yy/
42
pipe Low leak, deferred P3 No
injection = MAWT + 1 mm seawater replacement yyyy
production
Planned yy/yy/
Turbine fuel piping High Fire, power loss P1 Fatigue crack in SBT vibration Yes
replacement yyyy
The criteria for allocating the risk level should be based upon the Corporate risk matrix, an example of which is provided in Table 4.
Table 4: Example risk matrix
Consequence of Safety Env Ops Likelihood of occurrence
Occurrence
A B C D E
> 20 yrs 10 to 5 to 2 to < 2 years
20 yrs 10 yrs 5 years
5 Catastrophic Multiple fatalities Extreme impact > $10 M Extreme
4 Severe Fatality Severe impact $1 M to $10 M
3 Critical Major injury Major impact $100 K to $1 M High
2 Marginal Minor injury Minor impact $10 K to 100 K Medium
1 Negligible No injury No impact < $10 K Low
2.2.4.3 Roles, responsibilities and accountability

CM roles should be clearly defined and documented.
The roles and responsibilities of managerial and technical personnel should be clearly
defined within the organisation and ideally on a functional organogram. More information
is contained within Annex E.
Where service providers deliver significant technical support they should share their
organograms with the Duty Holder/Operator.
Particular areas of concern which may require specialist expertise should be identified;
examples may include:
−− sour service;
−− marginal corrosion inhibitor (CI) performance of high corrosivity high flow rate gas
streams, and
−− CRAs operating close to their safety margins, et al.
To encourage effective implementation of CMPs the interfaces between production

operations and engineering support should be identified with respect to responsibility,
authority, accountability and reporting.
Personnel involved with CM should have the time and resources needed to fulfil their
responsibilities.
The interfaces and their responsibilities between Duty Holder/Operators and service providers
should be clear to avoid the potential for contradictory instructions.
2.2.4.4 Competence
The HSE states that competence18: can be described as the:
'combination of training, skills, experience and knowledge that a person has and their ability
to apply them to perform a task safely'.
Other factors, such as attitude and physical ability, can also affect someone's competence.
The HSE website19 contains numerous sources of information on competence. It should

be noted that the HSE definitions and descriptions of competence do not mention specific
qualification requirements; it is for the employer to define the levels of competence required
for each job role.
The UK Engineering Council20 has published the UK Standard for Professional

Engineering Competence21 (UK-SPEC) which sets out the competence and commitment
required for registration as an Engineering Technician (EngTech), Incorporated Engineer
(IEng) or Chartered Engineer (CEng). It also includes examples of activities that demonstrate
the required competence and commitment. UK-SPEC identifies five generic areas of
competence and commitment for all registrants, which broadly cover:
−− knowledge and understanding;
−− design and development of processes, systems, services and products;
−− responsibility, management or leadership;
−− communication and interpersonal skills, and
−− professional commitment.
43
+44 (0)207 467 7100
For persons working at the level of professional Senior Corrosion Engineer in the oil and
gas industry there is a reasonable expectation they will have a degree (or equivalent) in a
relevant22 numerate scientific subject (Bachelor of Science, BSc, Bachelor of Engineering,
BEng) with associated training and experience and preferably be a Chartered Engineer (or
equivalent).
However, there are successful examples of Technician grade personnel becoming competent
by training and experience. It is for each employing organisation to define and document
the competency expectations for each level of Corrosion, Materials and Integrity Engineer,
from the recruitment stage to Technical Authority level. Any competency gaps should be
managed by supervision, training and development.
Differences in expectations of competence between Duty Holder/Operators and service

providers will need to be managed and agreed.
For those working in deep specialist subsets of corrosion engineering, specific qualifications
and experience are usually required. For example a specialist in Microbially Induced Corrosion
(MIC) would be expected to have qualifications in biology and/or microbiology.
Training should be planned and implemented as part of the corporate policy and procedures
for ensuring competency for defined roles.
Employing organisations should consider offering training in non-core disciplines to develop

a more rounded engineer/scientist in order to develop behavioural skills and a wider
understanding of their role in assuring safety and business continuity.
Performance should be routinely assessed and additional training and experience provided
to assure competence.
For highly specialised matters which extend beyond core materials and corrosion
engineering, the advice of experienced engineers/scientists should be sought. Examples of
this may include:
−− Microbiologists, Production Chemists and Reservoir Engineers for reservoir souring
studies.
−− Corrosion Engineers and Process Engineers for complex pipeline corrosion studies.
−− Specialised Metallurgists for CRAs.
Personnel involved with CM should understand their roles, the risks, processes and procedures.
They should understand the technical limitations of themselves and those for whom they are
responsible.
Contractors providing such services as non-destructive testing (NDT), weldment inspection

and coatings inspection should also demonstrate competence with corporate and personnel
accreditation and certification.
2.2.4.5 Communication
Relevant information relating to CM and in particular known risks must be disseminated to
those persons identified on the roles and responsibilities organogram.
In accordance with the statutory Regulations and associated guidance, documented

information on hazards, risks and preventative measures must be provided.
Written procedures, work instructions and guidelines should be developed and shared with
relevant personnel.
44
+44 (0)207 467 7100
To improve safety and business continuity 'Corrosion Awareness' information should

be circulated, in particular to installation personnel, including on notice boards. Raising
awareness of installation personnel can provide useful sources of additional information.
Presentations to installation staff should be undertaken.
Key roles in Duty Holder/Operators and service providers contributing to the CMT should be
identified and circulated with relevant corrosion and integrity related data.
The CMT should identify meeting frequencies to review the status of: actions; planning and
budgets. Minutes of the meetings should be taken, approved and circulated.
2.2.4.6 Cooperation
The 2014 Wood Report23 on Maximising Recovery From The UKCS identifies the need to
encourage and facilitate greater industry collaboration; this applies within companies,
between companies and external organisations. It is important to avoid 'knowledge silos'.
The purpose of cooperation is to improve safety, reliability and business continuity.
Personnel responsible for managing corrosion risks should consult and seek information from:
−− managers;
−− designers;
−− operations and maintenance engineers;
−− inspection departments;
−− corrosion engineers, and
−− service providers where necessary.
Duty Holder/Operator's management of change procedures should require Materials and

Corrosion Specialists to be involved with reviewing the consequences of engineering and
operating changes on the corrosion risks.
Relevant staff should be consulted for technical opinions and involved in planning and
reviewing performance.
Coordination with service providers should be achieved with clear documented guidance.
Cooperation should be maintained with external bodies to share information which can
improve the wider levels of safety and business continuity in the industry. This may be
achieved through technical fora and trade bodies.
2.2.5 Implementing the plan
2.2.5.1 Purpose
To ensure effective implementation of the CMPs to ensure risks are ALARP.
Leading and lagging Key Performance Indicators (KPIs) should be used to ensure corrective
actions are taken in a timely manner.
2.2.5.2 General
Implementing the CMPs should be consistent with the corporate strategic and tactical plans
for safety and integrity management.
Training and corrosion awareness activities should be undertaken in accordance with the
CMP timetable, to ensure that installation personnel in particular understand and can work
45
+44 (0)207 467 7100
effectively to the procedures and instructions. Where personnel are required to work to new
procedures and written schemes of examination (WSoEs) they should have suitable training
and toolbox talks prior to being deployed for the first time.
This section identifies important aspects which contribute towards effectively implementing
the CMP and is focused on corrosion management in the operational phase of an installation's
life.
It should be noted that CMPs should be initiated at the design phase and during the design
and construction phases to enhance the opportunities to improve inherent safety.
To ensure that the risks to the asset/installation are controlled SFAIRP, implementing the plan
includes both:
−− Implementing the mitigation activities which provide barriers to the corrosion risk.
−− The monitoring and inspection activities which ensure the mitigation activities remain
effective. This includes:
– corrosion rate monitoring;
– process monitoring;
– non-destructive inspection;
– data collection;
– data analysis;
– reporting, and
– corrective actions.
2.2.5.3 Implementation
The CMP should be translated into written practical instructions, with allocated responsibilities,
to enable it to be carried out, such as:
−− planned maintenance routines;
−− operating instructions;
−− WSoE;
−− work packs, and
−− reporting lines.
It is the responsibility of the Duty Holder/Operator or nominated Service Provider to ensure

that adequate staffing, materials and equipment are allocated to enable the plan to be
delivered in accordance with the KPIs.
Physical locations for corrosion and inspection monitoring should be identified on Piping
and Instrumentation Diagrams (P&ID), isometrics or Process Flow Diagrams (PFD) as
appropriate.
The reporting routes should be defined. This is particularly important for critical defect
findings which may need a rapid response.
There should be written procedures and instructions which identify the CoNC for SECEs,
which for piping and vessel wall thicknesses is normally the calculated Minimum Allowable
Wall Thickness (MAWT). It is normal practice to identify warning levels before attaining CoNC.
Anomaly reports, which relate to an agreed Performance Standard, are required to capture
those corrosion and inspection activities which have identified defects.
46
+44 (0)207 467 7100
In order to ensure that defects are made safe in a timely manner there should be a
documented procedure which enables prioritisation of defects and hence repair and
maintenance action.
There should be a procedure for Opportunistic Based Visual Inspections (OBVI) which fall
outwith the normal corrosion and integrity management plans.
2.2.5.4 Reporting, analysis and corrective action

Corrosion mitigation, monitoring and inspection data should be reported in clear formats
enabling engineering assessments to be readily undertaken.
Reporting procedures should identify where planned activities have not been performed and
identify what should be done to manage the shortfall.
CM, corrosion monitoring and inspection data should typically be stored in electronic format
in a common location to enable sharing with those involved. Password protection may be
necessary to prevent unintentional data changes.
To obtain full value from the data they should be trended using graphical and statistical
means to forecast future risks to enable corrective action to be taken in a timely manner.
Where monitored values fall outwith the allowable performance limits (e.g. pipe or vessel
wall thickness, or underdosing/overdosing of a production chemical) they must be recorded
and sent through the correct reporting routes in accordance with the prioritisation
and escalation procedures so that assessments can be made and corrective measures
implemented.
In accordance with the Duty Holder/Operator's prioritisation procedures data analysis

should be completed within the specified time scales to ensure mitigation is put into place
to avoid unnecessary risk.
CM, corrosion monitoring and inspection data should be reviewed and validated by
a competent person other than the data collector. Consideration should be given to
measurement uncertainties when performing data analyses, for example, different types of
ultrasonic testing devices may have intrinsic different accuracies.
Where appropriate, a review of CM, corrosion monitoring and inspection data should be
undertaken by competent person(s) and a clear statement made regarding the current
condition and continuing suitability of the work equipment. It is appropriate to do this when
the data indicate the equipment:
−− is at or near its retiral criterion/CONC;
−− is likely to reach the retiral criterion/CONC before the next measurement date, or
−− if it is likely to reach the retiral criterion/CONC before the cessation of field life.
Data reviews must be carried out immediately where there is found to be imminent risk to
personnel and equipment.
Non-urgent data reviews should be undertaken on completion of NDT inspection

campaigns and at periodic intervals for continuing activities. Material Corrosion Damage
Report (MCDR) and OBVI results should be included in the review. The review frequency
should be in keeping with the length of the activity and the associated potential risks.
47
+44 (0)207 467 7100
The findings of the installation verification scheme (SCR15 Regulations 19, 20,
21) should be included in the CM review, particularly where a non-conformance
has been identified by letter ('note of reservation') from the Verification Body.
The results of the data reviews should be used to update the CRAS and determine if the risk
profile has changed. Any changes to the corrosion risk profile should be input into the CM
programme and used to revise the RBI programme.
Corrective actions arising from the data review and completion time scales should be captured
in an information system that allows implementation and action close-out to be tracked.
Where corrective actions are a temporary arrangement, periodic reviews are required to
consider both their effectiveness and monitor implementation of a permanent solution.
Note that temporary actions may be required to be subject to a formal Operational Risk
Assessment (ORA) logged in the installation's ORA system.
Unexpected failures and near misses are learning opportunities; there should be a system in
place to review these events, undertake a Root Cause Analysis (RCA) and feed the results into
both the CMS and the SMS to prevent recurrence.
There should be procedures in place to govern: reporting, analyses and corrective actions.
Functional responsibilities for data analyses, determination of corrective actions and their
implementation should be identified. The technical functions responsible for determining the
suitability, investigation and corrective actions should be defined.
The opportunity should be taken to update the CRAS.
A key finding of HSE's KP4 report on A&LE of offshore installations is the need to trend data
to determine when the future CONC is likely to be reached. This requirement is emphasised
here because a combination of data extrapolation and statistical analysis can be used to
estimate when the CONC will be reached.
48
+44 (0)207 467 7100
2.3 CHECK
Risk
Planning profiling
Organising
Policy
your
plan
ACT CHECK
Learning Measuring
lessons performance
Investigating
near misses
Figure 5: HSG65 CHECK
2.3.1 Purpose
Within the CHECK section of HSG65 it requires the Duty Holder/Operator to:
−− monitor performance
−− investigate accidents and incidents
For the purposes of CM this requires implementation of the policy by measurement against
agreed standards to identify where, when and why improvement is needed.
2.3.2 Monitoring performance
This section considers key aspects which contribute towards the effective monitoring and
measurement of performance of the CMS, and also implementation of the plan.
49
+44 (0)207 467 7100
Measuring performance is key to establishing whether the CMP is fit-for-purpose, and it also
forms the basis for continuous improvement to keep risks ALARP.
For each asset/installation Duty Holder/Operators should undertake regular proactive and
reactive monitoring to measure the extent to which:
−− the CMP is being met;
−− the effectiveness of the CMP in controlling corrosion related risks to ALARP, and
−− the extent to which the CMP meets the corporate integrity policy objectives.
Measurements fall within two categories:

−− The effectiveness of the CMS to identify suitable barriers to corrosion failure, and
also to organise, plan and implement those barriers. This category considers the
effectiveness of the management system.
−− The success of the barriers for preventing corrosion failures. This category considers
the technical factors and is used to review the fitness-for-purpose of the facility,
which, if it is found to have problems, will indicate the management system is failing.
In some cases the same measurement may serve both.
2.3.3 Performance measurement
KPIs should be selected that are meaningful, relevant and practicable, to measure the
performance of the corrosion management strategy, its implementation and its place within
the facility's SMS.
KPIs should be quantifiable to avoid subjective judgements.
KPIs should contain target values for the performance limits of barriers to corrosion, which
must be relevant to the engineered design of the installation including the nominal design
life or revised forecasted cessation of production data. Where a new cessation of production
date is identified these targets should be subject to engineering review.
KPIs should enable the demonstration of the degree of success of the CMP, as well as
identifying trends that enable corrective action in a timely manner.
KPIs should indicate how well the CMP is being implemented (execution of the plan):
−− leading indicators (proactive).
KPIs should identify trends to achieving the effectiveness of the CMP:

−− lagging indicators (reactive).
2.3.4 Responsibility
Responsibilities should be combined with ownership to motivate delivery.
KPIs should be set by those persons accountable for meeting them.
Approval of the KPIs should be reviewed by the functional management of those accountable
for meeting them and agreement sought for the measures and the targets.
50
+44 (0)207 467 7100
Those responsible for carrying out the measured activities should report results at the required
frequency to the accountable supervisor to agree an interpretation and present them to
management.
The results from all teams involved with delivering the CMP should be collated by the CMT
(see also Annex E Organisation), which should recommend corrective action where necessary.
2.3.5 Frequency
The frequency of measuring the performance of the CMP should be set so that any corrective
actions can be effected in a timely manner before risks become unacceptable.
The frequency of measuring the performance of the CMP should be such that it is possible to
get a meaningful assessment of change, taking into account potential errors of measurement.
The frequency of measuring the performance of the CMP should increase where the rate of
non-conformances is observed to increase.
Where measured deviations from the CMP are observed to be consistently decreasing in
number there may be an opportunity to reduce the monitoring frequency.
2.3.6 Reporting and corrective actions
The results of measuring the performance of the CMP should be collated and assessed
to identify both unique and common failings. This analysis should be presented to Duty
Holder/Operator decision makers at frequencies which enable them to manage risks in a
timely manner.
Corrective actions should be recorded on a maintenance management database, or similar,

to enable corrective plans and actions to be put into place, tracked and closed-out. The
system should allow clear visibility of actions which may, or have, become overdue.
Where there is evidence of persistent failure to meet the KPIs, particularly where the
consequence is to increase the risk profile, it should be investigated to determine the root
cause and put in place a permanent solution.
It is common for the productive operating life of oil and gas fields to exceed the original
nominal design life and go into the life extension phase. This likelihood should be anticipated
and the KPIs used or adapted to ensure barriers for safety will be effective beyond the design
life.
Personnel responsible for implementing the CMP should maintain contact with those
responsible for determining the date of cessation of production so that the CMP can be
updated to address any concerns over reduced barriers to failure.
2.3.8 Investigating accidents and incidents
Failure investigation is a complex subject which may involve the collaboration of a number
of specialists. All investigations should adopt a thorough and systematic approach, but each
investigation should be scoped on its own merits.
51
+44 (0)207 467 7100
Failures of plant and equipment are often a result of an uncontrolled incident or occurrence,
so an essential part of any investigation is ensuring the safety of those undertaking the site
investigation.
Definition of failure: Failure means Loss Of Primary Containment (LOPC) as a result of

corrosion and/or mechanical damage, where LOPC means an escape of fluid to the external
environment. These include:
−− general corrosion;
−− pitting corrosion;
−− stress corrosion cracking;
−− overload;
−− fatigue;
−− erosion, and
−− erosion-corrosion, etc.
It also encompasses loss of containment due to:

−− poor design;
−− use of inappropriate components, and
−− poor assembly/fitting practices, etc.
A failure investigation should be aimed at not only identifying the mechanism of failure but
more importantly the circumstances which led to the failure, i.e. the cause, so corrective
actions can be implemented to prevent a recurrence of the failure. Establishing the mechanism
and cause of any failure are essential parts of any RCA.
Failure investigation does not lend itself to a tick box approach. Each failure investigation
should be approached with an open mind. In many instances the investigation is a process
of elimination where possible failure mechanisms are considered then discounted as results
become available, allowing the investigator to focus on the real issues leading to the failure
of the component/item.
It is important before starting any investigation to get a basic understanding of the problem
so individuals with the correct skill set and experience can be engaged or consulted.
Having this background information allows the investigator to devise an overall plan for
the investigation which improves efficiency and can save costs in the long term. An outline
of what may need to be asked to allow an investigation plan to be developed is presented
in Annex K.
52
+44 (0)207 467 7100
2.4 ACT
Risk
Planning profiling
Organising
Policy
your
plan
ACT CHECK
Learning Measuring
lessons performance
Investigating
near misses
Figure 6: HSG65 ACT
2.4.1 Purpose
Duty Holder/Operators should learn from past experience to achieve continuous

improvements in CM and future safety performance. Achieving this involves measuring the
performance of the system and independently auditing the system.
2.4.2 Reviewing performance
Duty Holder/Operators should ensure that systematic reviews of the performance of the CMP
are undertaken. These should be based on:
−− data from the monitoring of system performance, and
−− independent audits by third parties not directly associated with implementing the
CMP.
53
+44 (0)207 467 7100
The findings from the review process should enable organisations to feed back into the CM
policy and strategy to:
−− achieve continuous improvement of safety and integrity performance;
−− keep up to date with the changing production requirements;
−− ensure compliance with statutory requirements, and
−− contribute to business plans.
The audit should provide an independent and objective comparison between the CMP and
the maintenance management system which implements corrective actions.
The purpose of an audit is to ensure that the CMP is working effectively to keep risks ALARP,
and that the associated procedures are being followed.
The results of audits should be used to improve the CMP and the strategy.
Review of the CMP and its implementation should include:

−− the processes and procedures;
−− any increased risks associated with the installation;
−− any degradation in the fitness-for-purpose of work equipment;
−− achieving KPIs;
−− audit results, and
−− service provider performance.
Reviews of the CMP and its implementation should include key relevant technical persons
from the Duty Holder/Operator and service providers. These persons/technical functions may
include:
−− Corrosion TA;
−− Integrity TA;
−− Production Chemistry TA;
−− NDT service provider liaison Engineer, and
−− Production Chemicals service provider liaison.
The CMP review process should be endorsed by a level of management with the authority to
implement recommendations for necessary changes.
The CMP review should consider relevant findings from:

−− the independent competent person(s) (ICP), also known as the verification bodies;
−− the installation operations management;
−− learnings from other assets and installations, and
−− learned bodies and Institutes.24
Reviews should consider leading and lagging KPIs and assess the effectiveness of the
processes and procedures in meeting the KPIs.
The review frequencies should be in keeping with the risk profile so that safety and integrity
improvements are made in a timely manner.
54
+44 (0)207 467 7100
Corrective actions from the reviews should feed back into the CMP strategy and where
necessary into the installation's SMS.
The potential for new techniques and technologies to improve the risk profile should be
considered.
Required corrective actions must be recorded in a register which is available to relevant

personnel in the Duty Holder/Operator and service providers. The register should be used to:
−− identify problems;
−− identify required actions;
−− identify persons responsible for closing-out actions;
−− state of completion of actions;
−− overdue actions, and
−− action close-out.
Action progress reports should be issued to:

−− functional management;
−− CMT, and
−− persons responsible for actions.
The reports should include a summary for senior management and include graphs showing
extent of compliance with KPIs. An effective approach to providing overview information to
management in a readily accessible format is to use a dashboard.
Good performance and promotion of good practice should be identified in the reviews.
The review reports should be provided to relevant persons involved in CM activities,

from engineer to management level. Senior management with responsibilities
for the safety, integrity and operational performance of the installation should be sent the
review report.
2.4.3 Reviewing/auditing the corrosion management programme
The audit should review the performance of the CMS and is normally carried out by an
independent party (either an external contractor or an independent technical authority not
directly involved with the running of the facility in question).
The purpose of reviewing the performance of the CMS is to ensure there is an active process
for ensuring it is working effectively.
The lessons learned from the review of the performance and audit should be linked back
to the original Policy which set the scene for the corporate CMP.
The audit should cover review of the management processes that are being employed to
ensure continuing integrity of the facility. The audit can cover all aspects of:
−− implementation of procedures and processes;
−− competencies;
−− checks in place, and
−− compliance with the process and procedures.
55
+44 (0)207 467 7100
The audit will draw on input from reviews of the facility corrosion status and management
against KPIs etc, but it is not a detailed technical review of mitigation, monitoring and
inspection data. Rather, it aims to determine whether the procedures in place are fit-for-
purpose and are being properly implemented to ensure the relevant performance targets
are able to be achieved.
The checklist contained in Annex L may be used to assess the effectiveness of the CMS.
Not all specific items on the checklists can be covered or tested during each review, but a
selection of aspects should be reviewed in detail. It should be noted that not all identified
findings will arise purely from the checklists and that Engineers should exercise judgement.
Evidence for those aspects that are examined or tested should be based on:
−− documentation, and/or
−− personnel interviews.
Both the internal staff and consultant/contractor staff activities should be subject to review
and audit.
The overall audit/review should be summarised in a report for review by appropriate Senior
Management to allow comparison during future reviews. Improvement actions raised should
be recorded, responsibilities allocated, given target completion dates and tracked until
complete.
A desktop review of the asset-specific CMS documents should be conducted to confirm:

−− that they conform to company requirements;
−− that they meet the requirements for the asset/installation;
−− that there is a clear policy which is being followed;
−− that there are clear procedures to be followed for all relevant activities;
−− that roles and responsibilities are assigned and clear;
−− that asset-specific risk assessments have been conducted;
−− that asset-specific mitigation measures have been assigned and are in place, and
−− that asset-specific targets are assigned for KPIs for health, safety and environment.
2.4.4 Scope and frequency
The outcome of the audit should provide:

−− Independent assurance that the CMP includes the essential requirements of this
document.
−− Assurance that the CMP preventative and corrective activities are suitable barriers
to the corrosion threats and are effectively measuring the performance of the
system.
−− Assurance that the CM activities are implemented in accordance with procedures.
−− Input into reviews of performance.
Audits should be carried out objectively and in accordance with an established checklist.
The audit should cover the activities of the Duty Holder/Operator and service providers.
56
+44 (0)207 467 7100
The person(s) carrying out the audits should be competent in CM practices and in performing
audits.
The auditor(s) should be independent of both the operational and functional teams that
are directly involved in implementing the installation's CMS.
The independent audit may be undertaken either by a service provider or by a recognised

specialist from another part of the Duty Holder/Operator's organisation. Audits should be
carried out to a planned schedule.
If there is evidence of serious non-compliance that threatens the effectiveness of the

CMS the audit should be brought forward.
Where non-compliance is identified, corrective action and time to implement the actions
should be agreed with the auditee.
Audit reports should be made available to the installation management and the CMT.
Corrective actions must be recorded in a register available to relevant persons to enable

the implementation, tracking and close-out of actions. The installation management, CMT
and those responsible for implementing actions should receive regular reports on progress
towards achieving close-out. Where there is a persistent failure to achieve the target dates
there should be a defined mechanism for escalating the 'action' to more senior management.
Where an installation's operating life has been, or is likely to be, extended, the audit should
establish whether the CMP remains fit-for-purpose for the new cessation of production date.
The audit should determine whether the CMP addresses the issue of managing the ALE
process.
The audit should establish whether the implementation of the CMP is managing the ALE
risks.
57
+44 (0)207 467 7100
3 HUMAN FACTORS
3.1 INTRODUCTION
Whilst this is a corrosion technical document, it should be recognised that the development
and implementation of any CMS is undertaken by people and because of this, there is the
possibility of error.
The HSE identifies the importance of competence and organisation to minimising risks,
wherein it defines human factors:
'Human factors refer to environmental, organisational and job factors, and human and
individual characteristics, which influence behaviour at work in a way which can affect health
and safety'25
This definition includes three interrelated aspects26 which must be considered:

1. The job: including areas such as the nature of the task, workload, the working
environment, the design of displays and controls, and the role of procedures. Tasks
should be designed in accordance with ergonomic principles to take account of
both human limitations and strengths. This includes matching the job to the physical
and the mental strengths and limitations of people. Mental aspects would include
perceptual, attentional and decision making requirements.
2. The individual: including his/her competence, skills, personality, attitude, and risk
perception. Individual characteristics influence behaviour in complex ways. Some
characteristics such as personality are fixed; others such as skills and attitudes may
be changed or enhanced.
3. The organisation: including work patterns, the culture of the workplace, resources,
communications, leadership and so on. Such factors are often overlooked during the
design of jobs but have a significant influence on individual and group behaviour.
To summarise, human factors is concerned with what people are being asked to do (the task
and its characteristics), who is doing it (the individual and their competence) and where they
are working (the organisation and its attributes), all of which are influenced by the wider
concerns of society, both local and national.
The most prevalent human factors issues27 are listed in Table 5.
58
+44 (0)207 467 7100
Table 5: Prevalent Human Factors issues
Human factor Definition Consequences

Organisational Any change to the structure, Can include a reduction in
change and transition population or distribution of resources, competence or
management roles and responsibilities of an motivation to deal with:
organisation that may impact −− upsets and crises;
safety. This can include one or −− emergencies;
a combination of: −− maintenance and,
−− business re-engineering; −− Safety Management
−− downsizing; Systems.
−− delayering;
−− empowerment;
−− multiskilling;
−− outsourcing/use of
contractors, and
−− mergers, de-mergers and
acquisitions.
Staffing arrangements Any change to the structure, Can include reduction in
and workload population or distribution of resources such that there
tasks, roles and responsibilities are insufficient people or the
of an organisation that may capability to deal with:
impact safety. This can stem −− upsets and crises;
from organisational change −− emergencies;
or be part of an ongoing −− maintenance and,
safety management assurance −− Safety Management
process, e.g. review, (re) Systems.
assessment, demonstration or
continuous improvement of
staffing levels and workloads
to meet the full range of
foreseeable events, such as
emergencies or process upsets
Training and competence The continuing ability Failure to perform to required
and supervision of individuals and teams level in delivery of safety-
to perform reliably the related or safety critical tasks,
safety-related elements of roles or responsibilities
their roles, responsibilities
and tasks, and for this to be
demonstrable
Fatigue from shift work Impaired human reliability Symptoms include loss of
and overtime from fatigue alertness, drowsiness, loss of
patience
Errors include absent minded
slips, memory lapses, 'losing
the picture', etc.
The root cause of the Exxon
Valdez disaster included
fatigued staff
59
+44 (0)207 467 7100
Table 5: Prevalent Human Factors issues (continued)
Human Factor Definition Consequences

Human General Integration of Human Factors Failure to incorporate Human
factors in at various stages of design Factors considerations leading
design such that design is not just an to human error in operations
engineering hardware issue or maintenance
Alarm Designing alarm systems to Failure to identify a need
handling ensure prompt reliable and to act or failure to select an
effective operator response effective course of action
Control Layout of control rooms and Failure to incorporate human
rooms process control stations factors considerations leading
to human failure in operation
or maintenance
Ergonomics: Design of systems, displays, Human error in operation or
design of controls and hardware to aid maintenance
interfaces human reliability
Ergonomics: Design of healthier, safer and Work systems that lead to
health more productive work systems accidents, ill health and job
ergonomics that benefit individuals, dissatisfaction
organisations and society
Procedures (especially Selecting, designing and Unreliable or dangerous
safety critical procedures) managing procedures in performance of tasks
a way that assists human
reliability
Organisational culture The product of individual Safety culture is widely
(and development) and group values, attitudes, believed to be directly related
perceptions, competencies, to safety performance (i.e. the
and patterns of behaviour, frequency and/or probability
whether just for safety or of accidents)
the wider organisation,
that determine the
commitment to, and the
style and proficiency of,
an organisation's safety
management
Communications and Reliable and accurate Risks from lack of, or
interfaces communication of safety-critical inaccurate, information
or safety-related information, e.g. Piper Alpha
for example between control
room and field operators,
between operators within a
shift and at shift hand-over
60
+44 (0)207 467 7100
Table 5: Prevalent Human Factors issues (continued)
Human Factor Definition Consequences

Integration of Positioning Human Factors Higher operational costs, poor
human factors into at the core of design, usability and a higher cost of
risk assessment and development, operation and adding Human Factors later
investigations (including investigation so that Human
Safety Management Factors is embedded in the
Systems) activity throughout the life
cycle
Managing human failure Human failures that lead to Can include loss of
(including maintenance immediate or latent unsafe containment, process
error) conditions, for example in integrity, or failure in service
maintenance or on demand of plant and
equipment
In 2006 a RAF Nimrod MR2 reconnaissance aircraft XV230 exploded over Afghanistan, killing
all on board. The subsequent independent Nimrod Review28 led by Lord Haddon-Cave QC
identified several Human Factors failings which contributed to the loss of the aircraft and
consequent loss of life.
A Human Factors issue Lord Haddon-Cave refers to in the Nimrod Review findings is
'normalisation of deviance' wherein frequently observed failings in performance and safety
become the norm.
The acceptance of events that are not supposed to happen was originally described by
sociologist Diane Vaughan29 as the 'normalisation of deviance'.
Personnel working in such environments become conditioned over time to regard this
condition as normal and hence acceptable, giving rise to the phenomenon of 'normalisation
of deviance'. This human condition was also attributed to have contributed to the loss of the
NASA Challenger spacecraft in 1986 (seven deaths) and the King's Cross Underground fire
in 1987 (80 deaths).
Examples of normalisation of deviance in the oil and gas industry may include acceptance of:
−− degraded paintwork and corroded piping;
−− corroded handrails and walkways;
−− leaking valve stems;
−− high MCDR backlogs;
−− incomplete lists of SECEs, and
−− incomplete plant drawings.
3.2 PLAN
3.2.1 Policy
Minimising the potential for failures resulting from Human Factors requires consideration of:
−− competency of individuals working in all aspects of the corrosion and integrity
management activities;
61
+44 (0)207 467 7100
−− the organisation being suitable for the size of the enterprise being undertaken, and
−− verification activities and peer review to ensure activities are being performed
satisfactorily.
Human Factors interventions will not be effective if they consider these aspects in isolation.
The scope of Human Factors includes organisational systems and is considerably broader
than traditional views of human factors/ergonomics. Human Factors can, and should, be
included within a good Safety Management System so it can be examined in a similar way to
any other risk control system.
3.2.2 Planning
Activities to be conducted during initial planning include identifying the key Human Factors
issues within the organisation or project by:
−− obtaining input from staff;
−− studying accident reports;
−− performing risk assessments, and
−− shadowing end-users to observe tasks in progress.
The other issues to consider include:

−− legal compliance, and
−− staff competence.
The following Management activities can then be conducted:

−− document and prioritise issues;
−− define the objectives;
−− develop solutions and action plans;
−− recommend any staff training requirements;
−− allocate resources to handle the issues raised; using internal staff or external
contractors as necessary, and
−− encourage staff and other stakeholders to participate in planning and solution
development.
3.3 DO
3.3.1 Risk profiling
Human Factors issues should be incorporated into risk assessments for all safety critical
procedures.
Actions and measures that will help prevent accidents/failures should be identified. Feedback
from performance reviews and investigations into accidents/incidents/near misses will
provide information on the progress and the current status of risk control arrangements
and highlight gaps that require remedial action.
62
+44 (0)207 467 7100
3.3.2 Organisation
A clearly defined management structure and series of processes are required to achieve the
agreed outcomes.
The roles include the operations manager, supervisors, operations staff, contractors and any
external staff and will include consideration of the following components:
−− roles, responsibilities and accountabilities;
−− competence;
−− communication of critical information, and
−− cooperation between all parties.
Responsibilities should be written into job descriptions and should have the necessary
authority and resources and should be channelled through clear reporting lines.
3.3.3 Implementing the plan
Clear leadership is required to raise awareness of the issues relating to Human Factors and
gain acceptance for any changes required. Other specific tasks include:
−− designing and overseeing the implementation of solutions to Human Factors issues;
−− involving staff and their representatives in the implementation process, and
−− auditing, routine monitoring and status reviews.
3.4 CHECK
3.4.1 Measuring performance
Performance measurement involves qualitative and quantitative indicators which use a

combination of leading indicators (such as number of inspections) and lagging indicators
(such as accident frequency).
Actions should include:

−− monitoring the effectiveness of actions by asking for the opinions of end-users and
stakeholders;
−− studying key indicators for evidence of change, such as performance reports and
incident logs, and
−− directly observing the tasks impacted by changes, to assess the benefits.
Performance measurement involves addressing a series of questions:

−− Is management of Human Factors effective and reliable?
−− Is it proportionate to the perceived hazards and risks?
−− Is it cost-efficient?
−− Is it consistent across the organisation?
−− Is the culture of the organisation still supportive of managing Human Factors?
−− Current status relative to original aims and objectives?
63
+44 (0)207 467 7100
−− How successfully are hazards and risks being controlled?

−− How does performance compare to other operators?
−− What are the reasons for the current status?
−− Is performance improving or worsening?
3.4.2 Investigating accidents/incidents/near misses
Investigations should identify whether human factors lie at the root cause or are a contributing
factor. The reasons for unsatisfactory performance by staff and any underlying failures in the
management system should be identified.
3.5 ACT
3.5.1 Reviewing performance
Periodic status reviews should assess the overall performance of the system, the performance
of individual elements, audit findings and factors, such as changes in organisational structure,
production, technology or new legislation, It should be based on monitoring data and be
an ongoing process, enhanced by establishing responsibilities and accountabilities for the
implementation of remedial actions.
Additionally, reviews should be conducted by the management team and based on audit
results and performance measurement reports. It should identify any gaps, what, if any,
changes are needed and findings should be circulated to all stakeholders. Objectives
for continual improvement should be defined through the development of plans and
nominated individuals from the management team should be responsible for overseeing any
recommended changes, and corrective actions.
3.5.2 Learning lessons
The conclusions drawn from performance reviews will be communicated to all stakeholders
and staff as appropriate. The management should be responsible for seeing through any
recommended changes with the aim of continuous improvement.
64
+44 (0)207 467 7100
ANNEX A
STRUCTURED FRAMEWORK FOR CORROSION MANAGEMENT
The CMS should provide a framework compatible with the requirements of the Operator's
safety and environmental management policies and procedures for ensuring the integrity of
the installation and its processing equipment. One way of achieving this is to follow the HSE's
framework HSG65, which has the approach of:
−− PLAN
−− DO
−− CHECK
−− ACT
From a materials corrosion degradation perspective this means:

−− PLAN:
– Identify what needs to be achieved to manage corrosion to ensure safe, economic
operations throughout production.
– Allocate responsibilities for developing and implementing the plan.
– Identify what would be a successful outcome of an effective CMP.
– Identify KPIs to measure the performance of the CMP.
– Consider future corrosion threats.
−− DO:
– Identify and prioritise the potential corrosion threats, in the near- and long- term
future.
– Develop a resource of competent engineers and technicians who can implement
the plan, where necessary provide training.
– Identify the necessary CMS and ensure implementation.
– Maintain the installation and plant to ensure it is safe and economic to operate.
– Supervise the activities to ensure the plan is implemented.
−− CHECK:
– Measure the performance of the CMS against the KPIs.
– Measure the performance of the CMS with NDT.
– Trend the performance of the CMS to ensure the asset and plant will be safe and
fit-for-purpose throughout production.
−− ACT:
– Review the performance of the CMS to ensure it is achieving the Policy
requirements.
Where deficiencies are identified the revised plans should be implemented in a timely manner
to achieve safe and economic operations.
65
+44 (0)207 467 7100
Risk
Planning profiling
Organising
Policy
your
plan
ACT CHECK
Learning Measuring
lessons performance
Investigating
near misses
Figure A.1: Framework for successful corrosion management
Operating a successful CMP requires cooperative working of Management and Technical

staff. Where the Management and Technical staff are in different parts of the organisation,
or employed by different companies, there should be a focus on regular exchange of
information, updating the CMP and its implementation.
The size of the team(s) involved with developing and implementing the CMP will be
dependent upon the size and complexity of the hydrocarbon production system. A single
well platform will require significantly fewer integrity management resources than a multi-
well platform which also has subsea completions. It is incumbent upon the Duty Holder/
Operator to have suitable and sufficient resource arrangements relative to the size of the
undertaking to ensure safe operations.
The CMS requires a high level of technical input. Competent persons should be used to
undertake the corrosion risk assessments for safety critical andsafety related equipment and
also for the planning and implementation of CM and corrosion monitoring activities. The
persons performing the CRAS and developing the CM strategies should understand the
66
+44 (0)207 467 7100
consequences (benefits and potential threats) associated with the materials of construction
(CRA versus carbon-steel), the process fluid corrosivity, water cuts, age of the production
system and the maintenance strategies adopted.
With respect to the maintenance strategies, these should be designed to ensure that the
equipment is suitable for the conditions under which it operates and remains safe to operate
to cessation of production (CoP) SFAIRP. Within this context it should be noted that where the
Duty Holder/Operator knows and has documented the CoP date, it is reasonable to operate
a reduced frequency of maintenance, provided the condition of the equipment is known, its
rate of degradation is known and it is forecasted to be operating within its CONC to CoP.
To achieve this requires the Duty Holder/Operator to have an effective physical monitoring
programme in place (e.g. NDT) and the data trended to enable a demonstration that the
equipment will be fit-for-purpose to CoP.
Experience from the oil and gas production and processing industry shows that the
development and implementation of CRASs, RBIs and CMSs, coupled with commitment from
the Duty Holder/Operator and service providers, leads to significant improvements in integrity
management and hence safety. There are also consequential financial and environmental
benefits accrued by reducing the risk of unplanned downtime and leak frequency.
Experience shows that the CMS will only work effectively if it is a live documented system,
which is used, reviewed, audited and improved on a regular basis. The continuous loop
of the PLAN-DO-CHECK-ACT process described in HSG65 demonstrates this requirement.
The frequency of review and audit is a function of the rate of change of conditions and
functionality.
67
+44 (0)207 467 7100
ANNEX B
LEGAL BASIS FOR CORROSION MANAGEMENT
It is anticipated that all countries will have a legal basis for ensuring the safety and integrity of
potentially hazardous plant and equipment. This guidance will help Duty Holders/Operators
to comply with their legal duties in the countries within which they operate.
Because this document was drawn up in the UK and the contributors are familiar with UK
law, there is a greater reference to UK law; however, there is reference to European Union
Law and Directives and international law.
It is for the Duty Holder/Operator to ensure they comply with local laws and to ensure they
have competent persons able to work within the local legislative framework. Where local
laws fall below the normal standards required by international companies it is recommended
that the higher standards should be followed.
B.1 LIST OF UK AND EU REGULATORY REQUIREMENTS RELATING TO CORROSION

MANAGEMENT
UK laws and regulations:

−− Health and Safety At Work etc Act 1974: Sections 2, 3, 7
−− Management of Health and Safety At Work Regs, 1999: Regulations 3, 4, 5
−− Provision and Use of Work Equipment Regs, 1998: Regulations 4, 5, 6, 12
−− Dangerous Substances And Explosive Atmospheres Regulations, 2002: Regulations
5, 6 (exc. Regs: 5 (2) (f)(g)(h)(i), 5 (4) (c), 6 (4) (d), 6 (5) (b)(e) (Explosive Atmospheres
Directive: ATEX 137)
−− Prevention of Fire and Explosion, and Emergency Response Regulations, 2009:
Regulations 5, 9
−− Offshore Installations and Wells (Design and Construction etc) Regulations, 1996:
Regulations 5, 8
−− Offshore Installations (Safety Case) Regulations 2015: Regulations 7, 12
−− Pipeline Safety Regulations 2006: Regulations 5, 7, 8, 9, 13
−− Pressure Safety Systems Regulations 2000: Regulations 4, 6, 8, 9, 10, 14
−− Control of Major Accident Hazard Regulations 2015: 5, 7, 8
EU Directive:
Safety of offshore oil and gas operations and amending Directive 2013/30EU: Articles 2, 3,
11, 19
68
+44 (0)207 467 7100
United Kingdom
In the UK, Duty Holders/Operators have a legal duty to put in place suitable arrangements
to manage health and safety as an integral part of the organisation. HSG65 identifies the
essentials of managing health and safety as:
−− leadership and management;
−− a trained/skilled workforce, and
−− the involvement of people.
HSG65 links the need for having suitable arrangements to the wider risk management issues
as described in Figure B.1.
Managing business risks
Managing Health and Safety risks
Leadership
Assessing the Complying with the

Worker involvement Competencies
risks regulations
Figure B.1: Management of health and safety
The basis for the UK's health and safety regime is the Health And Safety At Work etc. Act
1974 (HSWA) which identifies the responsibilities of employers to those in their employ and
those not in their employ.
HSWA30 identifies the requirements for:
… 'maintenance of plant and systems of work that are, so far as is reasonably practicable,
safe and without risks to health', and
…'so far as is reasonably practicable as regards any place of work under the employer's
control, the maintenance of it in a condition that is safe and without risks to health and
the provision and maintenance of means of access to and egress from it that are safe and
without such risks', and
…'to use the best practicable means for preventing the emission into the atmosphere from
the premises of noxious or offensive substances and for rendering harmless and inoffensive
such substances as may be so emitted'.
These legal requirements have clear applicability to hydrocarbon production and processing
facilities and introduce the idea of the need to maintain equipment and manage risks, of
which CM is a part.
69
+44 (0)207 467 7100
The term 'So Far As Is Reasonably Practicable' (SFAIRP) is interchangeable with another
term 'As Low As Reasonably Practicable' (ALARP), which is simply described as weighing a
risk against the trouble, time and money needed to control the risk.
According to the HSE31 'Deciding whether a risk is ALARP can be challenging because it
requires duty-holders and us to exercise judgement. In the great majority of cases, it can be
decided by referring to existing 'good practice' that has been established by a process
of discussion with stakeholders to achieve a consensus about what is ALARP. For
high hazards, complex or novel situations, we build on good practice, using more
formal decision making techniques, including cost-benefit analysis, to inform our
judgement'. One of the purposes of this second edition is to present the good practice
required to keep risks ALARP.
Supporting the HSWA is a range of Regulations which Duty Holders/Operators are required
to consider to keep risks ALARP, some of which are specific to offshore installations, some are
specific to onshore installations and others cover both:
Table B.1: UK Regulations relating to asset integrity
Regulation Title Acronym Application

Onshore Offshore
Management of Health and Safety at Work MHSWR ü ü
Regulations
The Offshore Installations (Offshore Safety Directive) SCR15 ü
(Safety Case etc.) Regulations
Provision and Use of Work Equipment Regulations PUWER ü ü
Prevention of Fire, Explosion and Emergency PFEER ü
Response Regulations
Pressure Systems Safety Regulations PSSR ü
Control of Major Accident Regulations COMAH ü
Control of Substances Harmful to Health Regulations COSHH ü ü
Dangerous Substances and Explosive Atmospheres DSEAR ü ü
Regulations
Pipelines Safety Regulations PSR ü ü
These Regulations form the legal basis of many of the activities relating to CM, including the
requirements to undertake corrosion risk assessments and to have mitigation methods in
place to manage the consequences of corrosion.
B.2 UK STATUTORY COMPLIANCE
This document is written to provide examples of good practice for the development of CM
systems, and against which an existing scheme can be assessed.
The document generally refers to the requirements included in the UK's goal setting legislative
regime, which allows the Duty Holder/Operator or service provider to develop a suitable
70
+44 (0)207 467 7100
system to achieve the aims and with which to demonstrate compliance. This approach is
likely to be applicable to all but the most prescriptive of legislative jurisdictions, for which
consideration must be made to ensure compliance.
The Regulatory regime applicable to the UK's offshore installations places a requirement on
the Duty Holder/Operator to ensure, SFAIRP, that work equipment (SCEs) 'is maintained in an
efficient state, in efficient working order and in good repair'. This requires the integrity of the
process plant and associated structures to be maintained to keep risks ALARP to ensure that
equipment can be operated safely and a safe working environment maintained.
This Regulatory regime requires the creator of the risk (the Duty Holder/Operator) to provide
a system of work such that the risks to health and safety are reduced to ALARP, i.e. where
to do more would suffer a grossly disproportionate increase in cost to the reduction in risk.
This requires the operator to assess the risks and plan for appropriate risk control measures,
including the elements of a CM scheme. Figure 9 demonstrates the ALARP principle from
the HSE website.
Risk reduction Intolerable

regardless of cost
1 × 10–3 (workers)
1 × 10–4 (public)
Relevant good
practice
plus Tolerable if
Risk reduction ALARP
measures
plus
Gross
disproportion
1 × 10–6 (all)
Relevant
good
practice Broadly
acceptable
Figure B.2: The ALARP principle (http://www.hse.gov.uk/foi/internalops/hid_circs/

permissioning/spc_perm_37/)
UK offshore legislation consists of a hierarchical framework (see Figure B.3) where each level
provides further detail on how to achieve the fundamental requirement set by the HSWA for
a safe system of work. The Regulations provide a risk based lifecycle approach and prescribe
goal-setting requirements i.e. the Regulations define outcomes but not how these are to
be achieved. The management of corrosion is therefore not specifically identified within
legislation. However, the law implicitly requires corrosion, as a foreseeable hazard, to be
managed such that the risk to health and safety arising from corrosion is ALARP.
71
+44 (0)207 467 7100
+44 (0)207 467 7100
Health and Safety at Work, Etc. Act 1974 Primary
Legislation
Management of Health and Safety at Work Regulations Statutory

Instrument
The Offshore PFEER PUWER PSR PSSR COMAH CDM MAR

Installations Prevention of Provision of Pipeline Safety Pressure Control of Offshore The Offshore
(Offshore Fire & Explosion Work Regulations Systems Safety Major Hazard Installations and Installations &
Safety Emergency Equipment SI 1996/825 Regulations Regulations Wells (Design & Pipeline Works Statutory
Directive) Response Regulations 2000 2015 Construction, etc) (Management Instrument
(Safety Case, Regulations, SI 1998 Regulations & Administration)
Etc.) 1995/745 SI 1998/2306 1996 Regulations
72
Regulations 1995
2015
Approved codes of practice ACOPs
Guides to the regulations Guides
Figure B.3: Schematic of the UK's offshore installations legislative framework
Those parts of a hydrocarbon pipeline which are on an offshore installation or within the
500 metre safety zone of the installation are subject to the same Regulations as offshore
installations.
PSR define the interaction with PSSR. HSWA provides the dominant requirement to provide a
safe system of work for both offshore and onshore.
Beneath the Regulations are Approved Codes of Practice (ACOP) (Figure B.3) which describe
preferred or recommended methods that can be used (or standards to be met) to comply
with Regulations and the duties imposed by the HSWA etc. Act. ACOPs are issued by the
Health and Safety Executive and are not compulsory unless otherwise stated; however
following the guidance will normally be enough to comply with the law.
Beneath the ACOPs the HSE also issues guidance to the Regulations which is not compulsory
and Duty Holder/Operators are free to take other action; however, following the guidance
will normally be enough to comply with the law.
Each of the supporting Regulations contains requirements which will impact on CM, which
can be separated into Risk Assessment and Integrity:
B.3 RISK ASSESSMENT AND MANAGEMENT
B.3.1 MHSWR
Identify the duties placed upon employers which require that risk assessments (Reg. 3) shall
be undertaken (e.g. Corrosion Risk Assessment). MHSWR also identify that a risk prevention
hierarchy shall be followed (Reg. 4 and Schedule 1) as follows:
(a) avoiding risks;
(b) evaluating the risks which cannot be avoided;
(c) combating the risks at source;
(d) adapting the work to the individual, especially with regard to the design of
workplaces, the choice of work equipment and the choice of working and production
methods, with a view, in particular, to alleviating monotonous work and work at a
predetermined work-rate and to reducing their effect on health;
(e) adapting to technical progress;
(f) replacing the dangerous by the non-dangerous or the less dangerous;
(g) developing a coherent overall prevention policy which covers technology, organisation
of work, working conditions, social relationships and the influence of factors relating
to the working environment;
(h) giving collective protective measures priority over individual protective measures, and
(i) giving appropriate instructions to employees.
In this list, CRASs are primarily associated with (a), (b), (c), (e), and (g).
B.3.2 SCR15 2015
Require the Duty Holder/Operator to prepare a document setting out its safety and
environmental management system known as the Corporate Major Accident Prevention
Policy (MAPP), which 'establishes the overall aims and arrangements for controlling the risk
of a major accident and how those aims are to be achieved and those arrangements put into
effect by the officers of the duty holder'.
73
+44 (0)207 467 7100
Schedule 2 of SCR15 identifies:

−− The need to take appropriate measures to ensure as far as reasonably practicable that
there is no unplanned escape of hazardous substances from pipelines, vessels
and systems intended for their safe confinement. In addition, the need to ensure that
no single failure of a containment barrier can lead to a major accident.
−− The need to pay particular attention to evaluation of the reliability and integrity
requirements of all safety- and environmental-critical systems and base inspection
and maintenance systems on achieving the required level of safety and environmental
integrity.
For onshore hazardous plant the onshore COMAH Regulations 2015 require that businesses
'Take all necessary measures to prevent major accidents involving dangerous substances.
Limit the consequences to people and the environment of any major accidents which do
occur'. This is the onshore equivalent of the new offshore SCR15 2015 Regulations in that
it combines responsibilities for the prevention of major accident hazards and also the effects
on the environment.
Because both COMAH and SCR15 are supportive Regulations to HSWA they both operate to
the ALARP principle and are similar in many ways.
B.3.3 COMAH 2015
Requires onshore Operators to develop a Safety Report that provides information to

demonstrate to the competent authority (HSE for most facilities) that all measures necessary
for the prevention and mitigation of major accidents have been taken. The purposes and
contents of a safety report are set out in Schedule 4 to the Regulations ('Information to be
included in internal and external emergency plans').
Regulation 8 of COMAH requires that 'Every operator of an upper tier establishment must
prepare a safety report for the purposes of –
(a) Demonstrating that a major accident prevention policy and a safety management
system for implementing it have been put into effect in accordance with the
information set out in Schedule 3.
(b) Demonstrating that the major accident hazards and possible major accident
scenarios in relation to the establishment have been identified and that the
necessary measures have been taken to prevent such accidents and to limit their
consequences for human health and the environment.
(c) Demonstrating that adequate safety and reliability have been taken into account
in the design, construction, operation and maintenance of any installation, storage
facility, equipment and infrastructure connected with the establishment's operation
which are linked to major accident hazards inside the establishment.
(d) Demonstrating that an internal emergency plan has been prepared in accordance
with regulation 12, which includes sufficient information to enable an external
emergency plan to be prepared.
(e) Providing sufficient information to the competent authority to enable decisions to be
made regarding the siting of new activities or developments around establishments.’
The COMAH Safety Report is equivalent to the Offshore Safety Case document.
74
+44 (0)207 467 7100
B.3.4 PSR 1996
Require a Major Accident Prevention Document (MAPD) to be produced for each major
accident hazard pipeline. The MAPD is the pipeline equivalent of the Offshore Safety Case
document and the onshore Safety Report and is required to demonstrate that risks have been
evaluated and an adequate safety management plan is in place. This will include provisions
for corrosion management. The MAPD is documented evidence which describes how the
Operator has assessed the risks from Major Accidents Hazards and has an appropriate safety
management system to control those risks.
B.4 INTEGRITY MANAGEMENT
B.4.1 PUWER
1998 applies onshore and offshore and places duties on persons and companies who own,
operate or have control over work equipment to ensure they are suitable, safe for use and are
maintained. PUWER defines work equipment as any machinery, appliance, apparatus, tool or
installation for use at work. The term 'installation' does not refer to an offshore installation,
but to a piece of work equipment installed for use.
B.4.2 DCR 1996
Apply to onshore and offshore hydrocarbon installations and their associated wells. Onshore
wells also have to comply with the Borehole Sites and Operations Regulations 1995. DCR
1995 require the installation and its associated wells to be designed, constructed and
maintained to ensure its integrity is ensured.
B.4.3 PFEER 1995
Apply to offshore installation and identify the goals for the preventive and protective measures
which are necessary for managing fire and explosion hazards, and for emergency response of
offshore installations. The Regulations require that persons are protected from the effects of
fire and explosion, and that there are provisions in place for evacuation, escape and rescue
from the installation.
B.4.4 PSSR 2000
Apply to onshore pressure systems and cover the safe design and use of pressure
systems. 'The aim of PSSR is to prevent serious injury from the hazard of stored energy
(pressure) as a result of the failure of a pressure system or one of its component parts'. A
significant feature of PSSR is a requirement to have a written scheme of examination (WSE)
certified or drawn up by a competent person (CP) setting out the nature and frequency of
examinations in accordance with the degree of risk.
B.4.5 PSR 1996
Require a pipeline to be able to withstand the forces arising from its operation, the fluids
carried, and the external forces and chemical processes it may experience, so that persons
are protected from risk to their health or safety. Similar to other Regulations, PSR require
pipelines to be examined and maintained safely.
75
+44 (0)207 467 7100
B.5 EUROPEAN UNION LEGISLATION
After the Deepwater Horizon incident in the Gulf of Mexico in 2010, the European
Commission (EC) initiated a review of the safety of offshore oil and gas operations from
which was generated Offshore Directive in June 2013; 2013/30/EU32. The objective of the
Directive is to reduce as far as possible the occurrence of major accidents related to offshore
oil and gas operations and to limit their consequences. The Directive contains requirements
relating to licensing, environmental protection, emergency response and liability, in addition
to safety.
The Directive states:
'The objective of this Directive is to reduce as far as possible the occurrence of major
accidents relating to offshore oil and gas operations and to limit their consequences,
thus increasing the protection of the marine environment and coastal economies against
pollution, establishing minimum conditions for safe offshore exploration and exploitation
of oil and gas and limiting possible disruptions to Union indigenous energy production,and
to improve the response mechanisms in case of an accident'.
The intentions of the Directive are to bring greater control of both the offshore safety
risks and the environment consequences of those risks. One of the consequences of this is
that the HSE and the Department of Business, Energy and Industrial Strategy (BEIS)/Offshore
Petroleum Regulator for Environment and Decommissioning (OPRED) have now established
the Offshore Safety Directive Regulator (OSDR).
Whilst the EU Directive is broadly based upon the UK's OSCR, there are some modifications
which the HSE has implemented in the Offshore Installations (Offshore Safety Directive)
(Safety Case etc.) Regulations 2015. DECC has also introduced new Regulations to implement
environmental and licensing requirements.
B.6 SECTIONS FROM THE REGULATIONS RELEVANT TO CORROSION MANAGEMENT
B.6.1 Health and safety at work etc act 1974
HSWA Section 2: General duties of employers to their employees.

1) It shall be the duty of every employer to ensure, so far as is reasonably practicable,
the health, safety and welfare at work of all his employees.
2) Without prejudice to the generality of an employer's duty under the preceding
subsection, the matters to which that duty extends include in particular—
a) the provision and maintenance of plant and systems of work that are, so far
as is reasonably practicable, safe and without risks to health;
b) arrangements for ensuring, so far as is reasonably practicable, safety and
absence of risks to health in connection with the use, handling, storage and
transport of articles and substances;
c) the provision of such information, instruction, training and supervision as is
necessary to ensure, so far as is reasonably practicable, the health and safety
at work of his employees;
d) so far as is reasonably practicable as regards any place of work under the
employer's control, the maintenance of it in a condition that is safe and
without risks to health and the provision and maintenance of means of
access to and egress from it that are safe and without such risks;
76
+44 (0)207 467 7100
e) the provision and maintenance of a working environment for his employees

that is, so far as is reasonably practicable, safe, without risks to health, and
adequate as regards facilities and arrangements for their welfare at work.
HSWA Section 3: General duties of employers and self-employed to persons other

than their employees
(1) It shall be the duty of every employer to conduct his undertaking in such a way as to
ensure, so far as is reasonably practicable, that persons not in his employment who
may be affected thereby are not thereby exposed to risks to their health or safety.
(2) It shall be the duty of every self-employed person [who conducts an undertaking of
a prescribed description] to conduct [the undertaking]in such a way as to ensure, so
far as is reasonably practicable, that he and other persons (not being his employees)
who may be affected thereby are not thereby exposed to risks to their health or
safety.
[(2A) A description of undertaking included in regulations under subsection (2) may be
framed by reference to—
(a) the type of activities carried out by the undertaking, where those activities
are carried out or any other feature of the undertaking;
(b) whether persons who may be affected by the conduct of the undertaking,
other than the self-employed person (or his employees), may thereby be
exposed to risks to their health or safety.]
(3) In such cases as may be prescribed, it shall be the duty of every employer and every
self-employed person, in the prescribed circumstances and in the prescribed manner,
to give to persons (not being his employees) who may be affected by the way in
which he conducts his undertaking the prescribed information about such aspects of
the way in which he conducts his undertaking as might affect their health or safety.
HSWA Section 7: General duties of employees at work.
It shall be the duty of every employee while at work—

(a) to take reasonable care for the health and safety of himself and of other persons
who may be affected by his acts or omissions at work, and
(b) as regards any duty or requirement imposed on his employer or any other person by
or under any of the relevant statutory provisions, to co-operate with him so far as is
necessary to enable that duty or requirement to be performed or complied with.
B.6.2 Management of health and safety at work regulations 1999
Regulation 3: Risk assessment

(1) Every employer shall make a suitable and sufficient assessment of:
(a) the risks to the health and safety of his employees to which they are exposed
whilst they are at work, and
(b) the risks to the health and safety of persons not in his employment arising
out of or in connection with the conduct by him of his undertaking.
for the purpose of identifying the measures he needs to take to comply with the requirements
and prohibitions imposed upon him by or under the relevant statutory provisions and by Part
II of the Fire Precautions (Workplace) Regulations 1997.
(2) Every self-employed person shall make a suitable and sufficient assessment of:
(a) the risks to his own health and safety to which he is exposed whilst he is at
work, and
(b) the risks to the health and safety of persons not in his employment arising
out of or in connection with the conduct by him of his undertaking.
77
+44 (0)207 467 7100
for the purpose of identifying the measures he needs to take to comply with the requirements
and prohibitions imposed upon him by or under the relevant statutory provisions.
(3) Any assessment such as is referred to in paragraph (1) or (2) shall be reviewed by the
employer or self-employed person who made it if:
(a) there is reason to suspect that it is no longer valid; or
(b) there has been a significant change in the matters to which it relates, and
where as a result of any such review changes to an assessment are required,
the employer or self-employed person concerned shall make them.
(4) An employer shall not employ a young person unless he has, in relation to risks to the
health and safety of young persons, made or reviewed an assessment in accordance
with paragraphs (1) and (5).
(5) In making or reviewing the assessment, an employer who employs or is to employ a
young person shall take particular account of:
(a) the inexperience, lack of awareness of risks and immaturity of young persons;
(b) the fitting-out and layout of the workplace and the workstation;
(c) the nature, degree and duration of exposure to physical, biological and
chemical agents;
(d) the form, range, and use of work equipment and the way in which it is
handled;
(e) the organisation of processes and activities;
(f) the extent of the health and safety training provided or to be provided to
young persons, and
(g) risks from agents, processes and work listed in the Annex to Council Directive
94/33/EC(1) on the protection of young people at work.
(6) Where the employer employs five or more employees, he shall record—
(a) the significant findings of the assessment, and
(b) any group of his employees identified by it as being especially at risk.
Regulation 4: Principles of prevention to be applied
Where an employer implements any preventive and protective measures he shall do so on

the basis of the principles specified in Schedule 1 to these Regulations.
Regulation 5: Health and safety arrangements

(1) Every employer shall make and give effect to such arrangements as are appropriate,
having regard to the nature of his activities and the size of his undertaking, for the
effective planning, organisation, control, monitoring and review of the preventive
and protective measures.
(2) Where the employer employs five or more employees, he shall record the arrangements
referred to in paragraph (1).
B.6.3 Provision and use of work equipment regulations 1998
Regulation 4: Suitability of work equipment

(1) Every employer shall ensure that work equipment is so constructed or adapted as to
be suitable for the purpose for which it is used or provided.
(2) In selecting work equipment, every employer shall have regard to the working
conditions and to the risks to the health and safety of persons which exist in the
premises or undertaking in which that work equipment is to be used and any
additional risk posed by the use of that work equipment.
(3) Every employer shall ensure that work equipment is used only for operations for
which, and under conditions for which, it is suitable.
78
+44 (0)207 467 7100
(4) In this regulation 'suitable' means suitable in any respect which it is reasonably
foreseeable will affect the health or safety of any person.
Regulation 5: Maintenance
(1) Every employer shall ensure that work equipment is maintained in an efficient state,
in efficient working order and in good repair.
(2) Every employer shall ensure that where any machinery has a maintenance log, the
log is kept up to date.
Regulation 6: Inspection
(1) Every employer shall ensure that, where the safety of work equipment depends on
the installation conditions, it is inspected:
(a) after installation and before being put into service for the first time; or
(b) after assembly at a new site or in a new location,
to ensure that it has been installed correctly and is safe to operate.

(2) Every employer shall ensure that work equipment exposed to conditions causing
deterioration which is liable to result in dangerous situations is inspected:
(a) at suitable intervals, and
(b) each time that exceptional circumstances which are liable to jeopardise the
safety of the work equipment have occurred,
to ensure that health and safety conditions are maintained and that any deterioration can be
detected and remedied in good time.
(3) Every employer shall ensure that the result of an inspection made under this regulation
is recorded and kept until the next inspection under this regulation is recorded.
(4) Every employer shall ensure that no work equipment—
(a) leaves his undertaking; or
(b) if obtained from the undertaking of another person, is used in his undertaking,
unless it is accompanied by physical evidence that the last inspection required
to be carried out under this regulation has been carried out.
(5) This regulation does not apply to—
(a) a power press to which regulations 32 to 35 apply;
(b) a guard or protection device for the tools of such power press;
(c) work equipment for lifting loads including persons;
(d) winding apparatus to which the Mines (Shafts and Winding) Regulations
1993(1) apply;
(e) work equipment required to be inspected by regulation 29 of the Construction
(Health, Safety and Welfare) Regulations 1996(2).
Regulation 12: Protection against specified hazards

(1) Every employer shall take measures to ensure that the exposure of a person using
work equipment to any risk to his health or safety from any hazard specified in
paragraph (3) is either prevented, or, where that is not reasonably practicable,
adequately controlled.
(2) The measures required by paragraph (1) shall:
(a) be measures other than the provision of personal protective equipment or
of information, instruction, training and supervision, so far as is reasonably
practicable, and
(b) include, where appropriate, measures to minimise the effects of the hazard
as well as to reduce the likelihood of the hazard occurring.
79
+44 (0)207 467 7100
(3) The hazards referred to in paragraph (1) are—

(a) any article or substance falling or being ejected from work equipment;
(b) rupture or disintegration of parts of work equipment;
(c) work equipment catching fire or overheating;
(d) the unintended or premature discharge of any article or of any gas, dust,
liquid, vapour or other substance which, in each case, is produced, used or
stored in the work equipment;
(e) the unintended or premature explosion of the work equipment or any article
or substance produced, used or stored in it.
(4) For the purposes of this regulation 'adequately' means adequately having regard
only to the nature of the hazard and the nature and degree of exposure to the risk.
(5) This regulation shall not apply where any of the following Regulations apply in
respect of any risk to a person's health or safety for which such Regulations require
measures to be taken to prevent or control such risk, namely:
(a) the Ionising Radiations Regulations 1985(1);
(b) the Control of Asbestos at Work Regulations 1987(2);
(c) the Control of Substances Hazardous to Health Regulations 1994(3);
(d) the Noise at Work Regulations 1989(4);
(e) the Construction (Head Protection) Regulations 1989(5);
(f) the Control of Lead at Work Regulations 1998(6).
B.6.4 The dangerous substances and explosive atmospheres regulations 2002
Regulation 5: Risk assessment

5.—(1) Where a dangerous substance is or is liable to be present at the workplace, the
employer shall make a suitable and sufficient assessment of the risks to his employees
which arise from that substance.
(2) The risk assessment shall include consideration of:
(a) the hazardous properties of the substance;
(b) information on safety provided by the supplier, including information
contained in any relevant safety data sheet;
(c) the circumstances of the work including:
(i) the work processes and substances used and their possible
interactions;
(ii) the amount of the substance involved;
(iii) where the work will involve more than one dangerous substance,
the risk presented by such substances in combination, and
(iv) the arrangements for the safe handling, storage and transport
of dangerous substances and of waste containing dangerous
substances;
(d) activities, such as maintenance, where there is the potential for a high level
of risk;
(e) the effect of measures which have been or will be taken pursuant to these
Regulations;
(f) the likelihood that an explosive atmosphere will occur and its persistence;
(g) the likelihood that ignition sources, including electrostatic discharges, will be
present and become active and effective;
(h) the scale of the anticipated effects of a fire or an explosion;
(i) any places which are or can be connected via openings to places in which
explosive atmospheres may occur, and
(j) such additional safety information as the employer may need in order to
complete the risk assessment.
80
+44 (0)207 467 7100
(3) The risk assessment shall be reviewed by the employer regularly so as to keep it up
to date and particularly if:
(a) there is reason to suspect that the risk assessment is no longer valid; or
(b) there has been a significant change in the matters to which the risk
assessment relates including when the workplace, work processes, or
organisation of the work undergoes significant changes, extensions or
conversions;
and where, as a result of the review, changes to the risk assessment are required, those
changes shall be made.
(4) Where the employer employs five or more employees, the employer shall record
the significant findings of the risk assessment as soon as is practicable after that
assessment is made, including in particular:
(a) the measures which have been or will be taken by him pursuant to these
Regulations;
(b) sufficient information to show that the workplace and work processes are
designed, operated and maintained with due regard for safety and that,
in accordance with the Provision and Use of Work Equipment Regulations
1998(1), adequate arrangements have been made for the safe use of work
equipment, and
(c) where an explosive atmosphere may occur at the workplace and subject to
the transitional provisions in regulation 17(1) to (3), sufficient information to
show:
(i) those places which have been classified into zones pursuant to
regulation 7(1);
(ii) equipment which is required for, or helps to ensure, the safe
operation of equipment located in places classified as hazardous
pursuant to regulation 7(1);
(iii) that any verification of overall explosion safety required by regulation
7(4) has been carried out, and
(iv) the aim of any co-ordination required by regulation 11 and the
measures and procedures for implementing it.
(5) No new work activity involving a dangerous substance shall commence unless:
(a) an assessment has been made, and
(b) the measures required by these Regulations have been implemented.
Regulation 5: Elimination or reduction of risks from dangerous substances

6.—(1) Every employer shall ensure that risk is either eliminated or reduced so far as is
reasonably practicable.
(2) In complying with his duty under paragraph (1), substitution shall by preference be
undertaken, whereby the employer shall avoid, so far as is reasonably practicable,
the presence or use of a dangerous substance at the workplace by replacing it with
a substance or process which either eliminates or reduces the risk.
(3) Where it is not reasonably practicable to eliminate risk pursuant to paragraphs (1) and
(2), the employer shall, so far as is reasonably practicable, apply measures, consistent
with the risk assessment and appropriate to the nature of the activity or operation:
(a) to control risks, including the measures specified in paragraph (4), and
(b) to mitigate the detrimental effects of a fire or explosion or the other harmful
physical effects arising from dangerous substances, including the measures
specified in paragraph (5).
81
+44 (0)207 467 7100
(4) The following measures are, in order of priority, those specified for the purposes of
paragraph (3)(a):
(a) the reduction of the quantity of dangerous substances to a minimum;
(b) the avoidance or minimising of the release of a dangerous substance;
(c) the control of the release of a dangerous substance at source;
(d) the prevention of the formation of an explosive atmosphere, including the
application of appropriate ventilation;
(e) ensuring that any release of a dangerous substance which may give rise
to risk is suitably collected, safely contained, removed to a safe place, or
otherwise rendered safe, as appropriate;
(f) the avoidance of:
(i) ignition sources including electrostatic discharges, and
(ii) adverse conditions which could cause dangerous substances to give
rise to harmful physical effects, and
(g) the segregation of incompatible dangerous substances.
(5) The following measures are those specified for the purposes of paragraph (3)(b):
(a) the reduction to a minimum of the number of employees exposed;
(b) the avoidance of the propagation of fires or explosions;
(c) the provision of explosion pressure relief arrangements;
(d) the provision of explosion suppression equipment;
(e) the provision of plant which is constructed so as to withstand the pressure
likely to be produced by an explosion, and
(f) the provision of suitable personal protective equipment.
(6) The employer shall arrange for the safe handling, storage and transport of dangerous
substances and waste containing dangerous substances.
(7) The employer shall ensure that any conditions necessary pursuant to these Regulations
for ensuring the elimination or reduction of risk are maintained.
(8) The employer shall, so far as is reasonably practicable, take the general safety
measures specified in Schedule 1, subject to those measures being consistent with
the risk assessment and appropriate to the nature of the activity or operation.
B.6.5 Offshore installations (offshore safety directive) (safety case) regs 2015
Regulation 7 Corporate major accident prevention policy

7.—(1) This regulation applies only to a duty holder which is a body corporate or
unincorporate.
(2) The duty holder must prepare in writing a policy (referred to in these Regulations as
the 'corporate major accident prevention policy') which—
(a) establishes the overall aims and arrangements for controlling the risk
of a major accident and how those aims are to be achieved and those
arrangements put into effect by the officers of the duty holder;
(b) covers the duty holder's installations—
(i) in external waters, and
(ii) outside the European Union.
(3) The corporate major accident prevention policy must address at least the particulars
set out in Schedule 1 and must be prepared in accordance with the matters set out
Schedule 2.
(4) The corporate major accident prevention policy may in addition outline the
commitment of the duty holder to mechanisms for effective tripartite consultation.
(5) An operator, in preparing a corporate major accident prevention policy, must take
account of the operator's primary responsibility for, among other things, the control
82
+44 (0)207 467 7100
of risks of a major accident that are a result of the operator's operations and for
continuously improving control of those risks so as to ensure a high level of protection
at all times.
(6) A duty holder must:
(a) implement the corporate major accident prevention policy throughout its
offshore oil and gas operations, and
(b) set up appropriate monitoring arrangements to assure effectiveness of the
policy.
(7) In this regulation and Schedule 1, 'officer of the duty holder' in relation to:
(a) a body corporate, other than a limited liability partnership, means a director
or secretary;
(b) a limited liability partnership, means a member;
(c) a partnership or a limited partnership, means a partner of that partnership or
limited partnership, and
(d) a body unincorporate (other than a partnership or limited partnership),
means a member of the body.
(8) In paragraph (7)(a) 'director' has the meaning given in section 250 of the Companies
Act 2006(1).
(9) In this regulation (but not this paragraph) a reference to a duty holder or operator
includes a reference to a well operator.
(10) Paragraph (2)(b) does not apply to a well operator.
Regulation 8 Safety and environmental management system

8.—(1) The duty holder must prepare a document setting out its safety and environmental
management system.
(2) In the case of a body corporate or unincorporate, the safety and environmental
management system must include the organisational structure, responsibilities,
practices, procedures, processes and resources for determining and implementing
the corporate major accident prevention policy.
(3) The safety and environmental management system is to be integrated with the
overall management system of the duty holder.
(4) The safety and environmental management system must address the particulars
in Schedule 3 and must be prepared in accordance with the matters set out in
Schedule 2.
(5) The document setting out the safety and environmental management system must
include a description of:
(a) the organisational arrangements for the control of major hazards;
(b) the arrangements for preparing and submitting documents under the
relevant statutory provisions, and
(c) the verification scheme (which description must comply with regulation 13(1)).
(6) This regulation applies to a well operator—
(a) as if the reference to the duty holder in paragraph (1) were a reference to a
well operator, and
(b) as if the reference to the description of the verification scheme in paragraph
(5)(c) were a reference to the description of the well examination scheme
(which description must comply with regulation 13(2)).
83
+44 (0)207 467 7100
B.6.6 The offshore installations (Prevention of Fire, Explosion, and Emergency Response)
regulations (PFEER)
Regulation 5: Assessment
5.—(1) The duty holder shall perform, and thereafter repeat as often as may be appropriate
a process (in this regulation called 'an assessment') described in paragraph (2) in
relation to the installation.
(2) An assessment shall consist of:
(a) the identification of the various events which could give rise to:
(i) a major accident involving fire or explosion; or
(ii) the need (whether or not by reason of fire or explosion) for
evacuation, escape or rescue to avoid or minimise a major accident;
(b) the evaluation of the likelihood and consequences of such events;
(c) the establishment of appropriate standards of performance to be attained by
anything provided by measures for:
(i) ensuring effective evacuation, escape, recovery and rescue to avoid
or minimise a major accident, and
(ii) otherwise protecting persons from a major accident involving fire or
explosion, and
(d) the selection of appropriate measures.
(3) The duty holder shall:
(a) record the assessment (including each repetition of it);
(b) keep the record at an address in Great Britain, and
(c) notify the Executive of such address.
Regulation 9: Prevention of fire and explosion

9.—(1) The duty holder shall take appropriate measures with a view to preventing fire and
explosion, including such measures to:
(a) ensure the safe production, processing, use, storage, handling, treatment,
movement and other dealings with flammable and explosive substances;
(b) prevent the uncontrolled release of flammable or explosive substances;
(c) prevent the unwanted or unnecessary accumulation of combustible,
flammable or explosive substances and atmospheres, and
(d) prevent the ignition of such substances and atmospheres.
(2) The measures to prevent ignition referred to in paragraph (1) shall include:
(a) identifying and designating areas in which there is a risk of a flammable or
explosive atmosphere occurring;
(b) controlling the carrying on of hazardous activities in such areas;
(c) ensuring that, save under procedures pursuant to sub–paragraph (b) above,
no plant is used in such areas unless suitable for use within them, and
(d) controlling the placing or use in such areas of electrical fixtures or other
sources of ignition.
B.6.7 Offshore installations and wells (design and construction etc) regulations 1996
Regulation 5: Design of an installation

5.—(1) The duty holder shall ensure that the designs to which an installation is to be or in
the event is constructed are such that, so far as is reasonably practicable:
(a) it can withstand such forces acting on it as are reasonably foreseeable;
(b) its layout and configuration, including those of its plant, will not prejudice its
integrity;
84
+44 (0)207 467 7100
(c) fabrication, transportation, construction, commissioning, operation,

modification, maintenance and repair of the installation may proceed
without prejudicing its integrity;
(d) it may be decommissioned and dismantled safely, and
(e) in the event of reasonably foreseeable damage to the installation it will retain
sufficient integrity to enable action to be taken to safeguard the health and
safety of persons on or near it.
(2) The duty holder shall ensure that an installation is composed of materials which are:
(a) suitable, having regard to the requirement in regulation 4, and
(b) so far as is reasonably practicable, sufficiently proof against or protected
from anything liable to prejudice its integrity.
Regulation 8: Maintenance of integrity

8.—(1) The duty holder shall ensure that suitable arrangements are in place for maintaining
the integrity of the installation, including suitable arrangements for:
(a) periodic assessment of its integrity, and
(b) the carrying out of remedial work in the event of damage or deterioration
which may prejudice its integrity.
(2) Paragraph (1) shall not apply:
(a) to a fixed installation while its structure is not yet established at the location
at which it is to be operated; or
(b) to a mobile installation under construction which is not yet able to be moved.
B.6.8 The pipelines safety regulations 1996
Regulation 5: Design of a pipeline

5. The operator shall ensure that no fluid is conveyed in a pipeline unless it has been so
designed that, so far as is reasonably practicable, it can withstand:
(a) forces arising from its operation;
(b) the fluids that may be conveyed in it, and
(c) the external forces and the chemical processes to which it may be subjected.
Regulation 7: Access for examination and maintenance

7. The operator shall ensure that no fluid is conveyed in a pipeline unless it has been so
designed that, so far as is reasonably practicable, it may be examined and work of
maintenance may be carried out safely.
Regulation 8: Materials
8. The operator shall ensure that no fluid is conveyed in a pipeline unless it is composed
of materials which are suitable.
Regulation 9: Construction and installation

9. The operator shall ensure that no fluid is conveyed in a pipeline (save for the purpose
of testing it) unless it has been so constructed and installed that, so far as is reasonably
practicable, it is sound and fit for the purpose for which it has been designed.
Regulation 13: Maintenance

13. The operator shall ensure that a pipeline is maintained in an efficient state, in efficient
working order and in good repair.
85
+44 (0)207 467 7100
B.6.9 The pressure safety systems safety regulations 2000
Regulation 4: Design and construction

4.—(1) Any person who designs, manufactures, imports or supplies any pressure system or
any article which is intended to be a component part of any pressure system shall
ensure that paragraphs (2) to (5) are complied with.
(2) The pressure system or article, as the case may be, shall be properly designed and
properly constructed from suitable material, so as to prevent danger.
(3) The pressure system or article, as the case may be, shall be so designed and constructed
that all necessary examinations for preventing danger can be carried out.
(4) Where the pressure system has any means of access to its interior, it shall be so
designed and constructed as to ensure, so far as practicable, that access can be
gained without danger.
(5) The pressure system shall be provided with such protective devices as may be
necessary for preventing danger, and any such device designed to release contents
shall do so safely, so far as is practicable.
Regulation 6: Installation
6. The employer of a person who installs a pressure system at work shall ensure that
nothing about the way in which it is installed gives rise to danger or otherwise impairs
the operation of any protective device or inspection facility.
Regulation 8: Written scheme of examination

8.—(1) The user of an installed system and owner of a mobile system shall not operate the
system or allow it to be operated unless he has a written scheme for the periodic
examination, by a competent person, of the following parts of the system, that is
to say:
(a) all protective devices;
(b) every pressure vessel and every pipeline in which (in either case) a defect may
give rise to danger, and
(c) those parts of the pipework in which a defect may give rise to danger,
and such parts of the system shall be identified in the scheme.
(2) The said user or owner shall:
(a) ensure that the scheme has been drawn up, or certified as being suitable, by
a competent person;
(b) ensure that:
(i) the content of the scheme is reviewed at appropriate intervals by
a competent person for the purpose of determining whether it is
suitable in current conditions of use of the system, and
(ii) the content of the scheme is modified in accordance with any
recommendations made by that competent person arising out of
that review.
(3) No person shall draw up or certify a scheme of examination under paragraph (2)(a)
unless the scheme is suitable and:
(a) specifies the nature and frequency of examination;
(b) specifies any measures necessary to prepare the pressure system for safe
examination other than those it would be reasonable to expect the user (in
the case of an installed system) or owner (in the case of a mobile system) to
take without specialist advice, and
(c) where appropriate, provides for an examination to be carried out before the
pressure system is used for the first time.
86
+44 (0)207 467 7100
(4) References in paragraphs (2) and (3) to the suitability of the scheme are references to
its suitability for the purposes of preventing danger from those parts of the pressure
system included in the scheme.
Regulation 9: Examination in accordance with the written scheme

9.—(1) Subject to paragraph (7), the user of an installed system and the owner of a mobile
system shall:
(a) ensure that those parts of the pressure system included in the scheme
of examination are examined by a competent person within the intervals
specified in the scheme and, where the scheme so provides, before the
system is used for the first time, and
(b) before each examination take all appropriate safety measures to prepare the
system for examination, including any such measures as are specified in the
scheme of examination pursuant to regulation 8(3)(b).
(2) Where a competent person undertakes an examination for the purposes of
paragraph (1) he shall carry out that examination properly and in accordance with
the scheme of examination.
(3) Where a competent person has carried out an examination for the purposes of
paragraph (1) he shall, subject to paragraph (4) and regulation 14(4), make a written
report of the examination, sign it or add his name to it, date it and send it to the user
(in the case of an installed system) or owner (in the case of a mobile system), and the
said report shall be so sent as soon as is practicable after completing the examination
(or, in the case of integrated installed systems where the examination is part of a
series, as soon as is practicable after completing the last examination in that series),
and in any event to arrive:
(a) within 28 days of the completion of the examination (or, in the case of
integrated installed systems where the examination is part of a series, within
28 days of the completion of the last examination in that series); or
(b) before the date specified in the report under paragraph (5)(b),
whichever is sooner.
(4) Where the competent person referred to in paragraph (3) is the user (in the case of
an installed system) or owner (in the case of a mobile system) the requirement in
that paragraph to send the report to the user or owner shall not apply, but he shall
make the report by the time it would have been required to have been sent to him
under that paragraph if he had not been the competent person.
(5) The report required by paragraph (3) shall:
(a) state which parts of the pressure system have been examined, the condition
of those parts and the results of the examination;
(b) specify any repairs or modifications to, or changes in the established safe
operating limits of, the parts examined which, in the opinion of the competent
person, are necessary to prevent danger or to ensure the continued effective
working of the protective devices, and specify the date by which any such
repairs or modifications must be completed or any such changes to the safe
operating limits must be made;
(c) specify the date within the limits set by the scheme of examination
after which the pressure system may not be operated without a further
examination under the scheme of examination, and
(d) state whether in the opinion of the competent person the scheme of
examination is suitable (for the purpose of preventing danger from those
parts of the pressure system included in it) or should be modified, and if the
latter state the reasons.
87
+44 (0)207 467 7100
(6) The user of an installed system and the owner of a mobile system which has been
examined under this regulation shall ensure that the system is not operated, and no
person shall supply such a mobile system for operation, after (in each case):
(a) the date specified under paragraph (5)(b), unless the repairs or modifications
specified under that paragraph have been completed, and the changes in
the established safe operating limits so specified have been made; or
(b) the date specified under paragraph (5)(c) (or, if that date has been postponed
under paragraph (7), the postponed date) unless a further examination has
been carried out under the scheme of examination.
(7) The date specified in a report under paragraph (5)(c) may be postponed to a later
date by agreement in writing between the competent person who made the report
and the user (in the case of an installed system) or owner (in the case of a mobile
system) if:
(a) such postponement does not give rise to danger;
(b) only one such postponement is made for any one examination, and
(c) such postponement is notified by the user or owner in writing to the enforcing
authority for the premises at which the pressure system is situated, before
the date specified in the report under paragraph (5)(c).
an installed system) or owner (in the case of a mobile system) the reference in that
paragraph to an agreement in writing shall not apply, but there shall be included in
the notification under sub-paragraph (c) of that paragraph a declaration that the
postponement will not give rise to danger.
(9) The owner of a mobile system shall ensure that the date specified under paragraph
(5)(c) is legibly and durably marked on the mobile system and that the mark is clearly
visible.
Regulation 10: Action in case of imminent danger

10.—(1) If the competent person carrying out an examination under the scheme of
examination is of the opinion that the pressure system or part of the pressure
system will give rise to imminent danger unless certain repairs or modifications
have been carried out or unless suitable changes to the operating conditions have
been made, then without prejudice to the requirements of regulation 9, he shall
forthwith make a written report to that effect identifying the system and specifying
the repairs, modifications or changes concerned and give it:
(a) in the case of an installed system, to the user; or
(b) in the case of a mobile system, to the owner and to the user, if any,
and the competent person shall within 14 days of the completion of the examination
send a written report containing the same particulars to the enforcing authority for
the premises at which the pressure system is situated.
(2) Where a report is given in accordance with paragraph (1) to:
(a) the user of a pressure system, he shall ensure that the system (or, if the report
only affects a discrete part of the system, that part) is not operated;
(b) the owner of a mobile system, he shall take all reasonably practicable steps
to ensure that the system (or, if the report only affects a discrete part of the
system, that part) is not operated,
until the repairs, modifications or changes, as the case may be, have been carried out
or made.
an installed system) or owner (in the case of a mobile system) the requirement in that
paragraph to give the report to the user or owner shall not apply, and the reference
in paragraph (2) to the giving of the report to the user or owner shall be construed
as a reference to the making of the report by him.
88
+44 (0)207 467 7100
Regulation 13: Modification and repair

13. The employer of a person who modifies or repairs a pressure system at work shall
ensure that nothing about the way in which it is modified or repaired gives rise to
danger or otherwise impairs the operation of any protective device or inspection
facility.
Regulation 14: Keeping of records, etc.

14.—(1) The user of an installed system and the owner of a mobile system shall keep:
(a) the last report relating to the system made by the competent person pursuant
to regulation 9(3);
(b) any such previous reports if they contain information which will materially
assist in assessing whether:
(i) the system is safe to operate, or
(ii) any repairs or modifications to the system can be carried out safely;
(c) any:
(i) information provided pursuant to regulation 5 of these Regulations; or
(ii) instructions specified in section 3.4 of Annex I to Directive
97/23/EC of the European Parliament and of the Council on the
approximation of the laws of the Member States concerning
pressure equipment(1), which Annex is set out in Schedule 2 to the
Pressure Equipment Regulations 1999(2), and provided pursuant to
regulation 7(1) and (3) or 8(1) and (3)(b)(i) of those Regulations,
which relate to those parts of the pressure system included in the scheme of
examination, and
(d) any agreement made pursuant to regulation 9(7), and, in a case to which
regulation 9(8) applies, a copy of the notification referred to in regulation
9(7)(c), until a further examination has been carried out since that agreement
or notification under the scheme of examination.
(2) Anything required to be kept by this regulation shall be kept:
(a) in the case of an installed system, at the premises where the system is installed,
or at other premises approved for the purposes of this sub-paragraph by
the enforcing authority responsible for enforcing these Regulations at the
premises where the system is installed;
(b) in the case of a mobile system, at the premises in Great Britain from which
the deployment of the system is controlled;
(c) in a case to which regulation 2(2) applies, by means whereby it is capable of
being reproduced as required by regulation 2(2)(a) at the premises referred
to in sub-paragraph (a) or (b) as appropriate.
(3) Where the user or owner of a pressure system or part thereof changes, the previous
user or owner shall as soon as is practicable give to the new user or owner in writing
anything (relating to the system or part thereof, as the case may be) kept by him
under this regulation.
B.6.10 The Control Of Major Accident Hazards (COMAH) regulations
Regulation 5: General duties of operators

5.—(1) Every operator must take all measures necessary to prevent major accidents and to
limit their consequences for human health and the environment.
(2) Every operator must demonstrate to the competent authority that it has taken all
measures necessary as specified in these Regulations.
(3) Every operator must provide the competent authority with such assistance as is
necessary to enable the competent authority to perform its functions under these
Regulations.
89
+44 (0)207 467 7100
(4) Without prejudice to the generality of paragraph (3), every operator must in particular
provide such assistance as is necessary to the competent authority to enable it to:
(a) carry out inspections and investigations, and
(b) gather any necessary information, in connection with the performance of its
functions under these Regulations.
Regulation 7: Major accident prevention policies

7.—(1) Subject to paragraph (4), every operator must prepare and retain a written major
accident prevention policy.
(2) A major accident prevention policy must:
(a) be designed to ensure a high level of protection of human health and the
environment;
(b) be proportionate to the major accident hazards;
(c) set out the operator's overall aims and principles of action, and
(d) set out the role and responsibility of management, and its commitment
towards continuously improving the control of major accident hazards.
(3) A major accident prevention policy must be prepared by the operator:
(a) of a new establishment, within:
(i) a reasonable period of time prior to construction or operation of the
establishment; or
(ii) a reasonable period of time prior to modifications leading to a change
in the inventory of dangerous substances at the establishment;
(b) of an existing establishment, by 1st June 2016;
(c) of an other establishment, within one year beginning on the date on which
the establishment, or site of operation, first becomes an other establishment.
(4) Where:
(a) the operator of an existing establishment had, immediately before 1st June
2015, prepared and retained a major accident prevention policy under
regulation 5 of the 1999 Regulations;
(b) the information contained within that policy remains materially unchanged,
and
(c) that policy complies with the requirements of these Regulations,
the operator is not required to prepare a further major accident prevention policy
under paragraph (1).
(5) Where an operator of an existing establishment is not required to prepare a major
accident prevention policy by virtue of paragraph (4):
(a) the major accident prevention policy prepared by that operator under
regulation 5 of the 1999 Regulations is to be treated as a major accident
prevention policy prepared under this regulation, and
(b) the policy must be retained by the operator in accordance with this regulation.
(6) An operator must review its major accident prevention policy:
(a) in the event of:
(i) a significant increase or decrease in the quantity of dangerous
substances notified under regulation 6; or
(ii) a significant change in—
(aa) the nature or physical form of the dangerous substances
notified under regulation 6; or
(bb) the processes employing them,
which could have significant consequences in terms of major accident
hazards, and
(b) in any event no later than five years after the date on which the policy was
last reviewed, and where necessary it must revise and retain the revised
policy.
90
+44 (0)207 467 7100
(7) An operator must implement its major accident prevention policy by a safety
management system.
(8) A safety management system must:
(a) satisfy the requirements in paragraph 1 of Schedule 2, and
(b) address the matters specified in paragraph 2 of that Schedule.
Regulation 8: Purposes of safety reports

8. Every operator of an upper tier establishment must prepare a safety report for the
purposes of:
(a) demonstrating that a major accident prevention policy and a safety
management system for implementing it have been put into effect in
accordance with the information set out in Schedule 3;
(b) demonstrating that the major accident hazards and possible major accident
scenarios in relation to the establishment have been identified and that the
necessary measures have been taken to prevent such accidents and to limit
their consequences for human health and the environment;
(c) demonstrating that adequate safety and reliability have been taken into
account in the design, construction, operation and maintenance of any
installation, storage facility, equipment and infrastructure connected with
the establishment's operation which are linked to major accident hazards
inside the establishment;
(d) demonstrating that an internal emergency plan has been prepared in
accordance with regulation 12, which includes sufficient information to
enable an external emergency plan to be prepared;
(e) providing sufficient information to the competent authority to enable
decisions to be made regarding the siting of new activities or developments
around establishments.
Schedule 2: Requirements and matters to be addressed by safety management

systems
1. A safety management system must:
(a) be proportionate to the hazards, industrial activities and complexity of the
organisation in the establishment;
(b) be based on assessment of the risks;
(c) include within its scope the general management system, including the
organisational structure, responsibilities, practices, procedures, processes and
resources for determining and implementing the major accident prevention
policy.
2. The following matters must be addressed by the safety management system:
(a) in relation to the organisation and personnel:
(i) the roles and responsibilities of personnel involved in the management
of major hazards at all levels in the organisation, together with the
measures taken to raise awareness of the need for continuous
improvement;
(ii) the identification of the training needs of such personnel and the
provision of the training;
(iii) the involvement of employees and of subcontracted personnel
working in the establishment, who are important from the point of
view of safety;
(b) the identification and evaluation of major hazards: the adoption and
implementation of procedures for systematically identifying major hazards
91
+44 (0)207 467 7100
arising from normal and abnormal operation, including subcontracted

activities where applicable, and the assessment of their likelihood and
severity;
(c) in relation to operational control:
(i) the adoption and implementation of procedures and instructions
for safe operation, including maintenance, of plant, processes and
equipment, and for alarm management and temporary stoppages;
(ii) the taking into account of available information on best practices for
monitoring and control, with a view to reducing the risk of system
failure;
(iii) the management and control of the risks associated with ageing
equipment installed in the establishment and its corrosion;
(iv) the inventory of the establishment's equipment, and the strategy
and methodology for the monitoring and control of the condition of
the equipment;
(v) appropriate follow up actions and any necessary counter-measures;
(d) the management of change: the adoption and implementation of procedures
for planning modifications to, or the design of new installations, processes or
storage facilities;
(e) in relation to planning for emergencies:
(i) the adoption and implementation of procedures to identify
foreseeable emergencies by systematic analysis;
(ii) the preparation, testing and review of emergency plans to respond
to emergencies and the provision of specific training for staff, such
training to be given to all personnel working in the establishment,
including relevant subcontracted personnel;
(f) in relation to monitoring performance:
(i) the adoption and implementation of procedures for the ongoing
assessment of compliance with the objectives set by the operator's
major accident prevention policy and safety management system,
and the mechanisms for investigation and taking corrective action in
case of non-compliance;
(ii) the procedures must cover the operator's system for reporting major
accidents or 'near misses', particularly those involving failure of
protective measures, and their investigation and follow-up on the
basis of lessons learned;
(iii) the procedures could also include performance indicators such as
safety performance indicators (SPIs) and/or other relevant indicators;
(g) in relation to audit and review:
(i) the adoption and implementation of procedures for periodic
systematic assessment of the major accident prevention policy and
the effectiveness and suitability of the safety management system;
(ii) the documented review of performance of the policy and safety
management system and its updating by senior management,
including consideration and incorporation of necessary changes
indicated by the audit and review.
92
+44 (0)207 467 7100
ANNEX C
AGEING AND LIFE EXTENSION
C.1 OVERVIEW OF AGEING AND LIFE EXTENSION
Particular reference should be made to these publications:

−− Report by the Energy Division of HSE's Hazardous Installations Directorate; Key
Programme 4 (KP4) Ageing and life extension programme.
−− EI Guidelines on the corrosion management of offshore oil and gas production
facilities: Addressing asset ageing and life extension (ALE).
−− SINTEF Report for the Petroleum Safety Authority, Norway, Ageing and life extension
for offshore facilities in general and for specific systems.
Management of ALE falls within the same category as Corrosion and Integrity Management,
with the significant difference that ALE should be more forward looking and requires Duty
Holders/Operators to anticipate future corrosion and degradation risks SFAIRP.
ALE management is not clearly addressed in UK law in that the law requires Duty
Holders/Operators to consider reasonably foreseeable risks, but does not define the time
frame. The law requires Duty Holders/Operators to undertake risk assessments to ensure risks
are ALARP, but similarly, the time frame is not defined.
Reasonable foreseeability may be described as that which a reasonable person would be able
to predict or anticipate what the harmful consequences of their actions or inactions will be.
For example:
−− A 6 inch schedule 80 carbon steel crude oil flowline has a measured corrosion rate
of 2 mm per year and a wall thickness of 11 mm. It is reasonably foreseeable that,
unless mitigating methods are put into place, perforation and hence a leak is likely to
occur within five and a half years, and that, because the pipe requires wall thickness
for structural integrity as well as pressure containment, failure will occur earlier.
−− A reservoir into which untreated seawater has been injected for a number of years
is likely to become contaminated with SRB (depending on the pressure, temperature
and salinity). It is therefore reasonably foreseeable that the SRB will generate hydrogen
sulfide (H2S) which, in turn, will cause the reservoir to sour, resulting in H2S being
produced and increasing the risk of SSCC of susceptible materials of construction.
Perhaps the nearest the legislation gets to identifying a time frame is in the Offshore Safety
Case Regulations, Regulation 13, wherein it states a duty holder shall thoroughly review a
current safety case within five years of:
−− the date on which the executive accepted that current safety case, and
−− the date of the previous review.
The key requirements for understanding and managing the corrosion related effects of ALE
of production and processing facilities are:
−− To engage with Reservoir Engineers to use future reservoir predictions to forecast
changes to the corrosion and degradation risk profile.
93
+44 (0)207 467 7100
−− To engage with Project, Production and Pipeline Engineers to forecast the corrosion
and degradation effects of new production streams from other fields onto a hub
platform.
−− To trend inspection data to forecast the CoNC and hence the retiral date of SCEs.
−− To improve safety by sharing knowledge with others also working in the field of CM.
−− Be aware of, and understand the correlations between, corrosion related degradation
mechanisms and frequency of failures and to undertake mitigating actions in a timely
manner.
−− The Duty Holder/Operator should have ultimate responsibility for corrosion and
degradation management even where the work is being performed by service
providers.
−− Ensure there are complete SCE lists so that the corrosion risk assessment study is
carried out on all relevant equipment.
−− Ensure all drawings; P&IDs, isometrics and PFDs, are up-to-date to ensure RBIs relate
to known SCEs.
−− Ensure that Original Equipment Manufactured (OEM) skids and their piping and
vessels are logged in the SCE list to ensure corrosion risk assessment and RBIs are
carried out on them.
−− Continue development of NDT techniques to allow accurate identification and
quantification of defects, especially occluded defects.
C.2 CORROSION RELATED AGEING AND LIFE EXTENSION MANAGEMENT
As a hydrocarbon reservoir matures, several changes typically occur:

−− water cut increases;
−− water injection commences;
−− the risk of MIC, and of H2S production increases due to contamination;
−− the scaling risk increases;
−− new fields are tied back to the hub platform, thereby introducing possible changes
to the corrosion threats;
−− the separators may be less efficient at removing produced water, increasing the
water content in the export lines;
−− 'slow burn' corrosion threats become problematic (corrosion under pipe supports
and touch point corrosion), and
−− the cumulative effects of corrosion become problematic.
CRASs drive both the RBI programme and also the CM activities (chemical treatment,
corrosion monitoring, sampling, etc). The HSE's KP4 report indicated that CRASs and RBIs
were well developed in the North Sea. However, there was evidence to suggest that not all
SCEs were in the requisite databases, meaning they were not subject to CRAS or RBI and
hence at risk of undetected corrosion.
As an installation approaches its nominal design life it would be good practice to review the
CRASs and RBIs as soon as possible to ensure they remain fit-for-purpose for the new period
until the CoP. The time in advance of the installation's nominal design life for this review
should reflect the size and complexity of the asset.
94
+44 (0)207 467 7100
C.3 DATA TRENDING AND AGEING AND LIFE EXTENSION
It is essential to trend and extrapolate inspection data so they can be used to forecast when
the CONC will be met.
To support and verify the extrapolation process, future possible failure and deterioration
risks should be considered. This process requires collaboration with Reservoir Engineers and
Project Engineers to understand what changes may occur in the future. This requirement
enhances the need for the corrosion engineering function to be a part of management of
change procedures and reviews.
Where a future change to the corrosion and degradation risk profile is determined, the
barriers to failure should be reviewed to ensure they remain suitable. Potential changes
could include introduction of new process fluids from other reservoirs and pipelines, reservoir
souring, and extension of the installation life beyond the original nominal design life. Where
the existing CM strategies are considered to be no longer effective following the changes,
new management strategies should be put into place as soon as reasonably practicable.
Figure C.1 shows the importance of data trending to forecast the future CoNC date so that
early CM programmes can be implemented to ensure the asset is fit-for-purpose to the
revised CoP date.
Piping Thickness vs Cessation of
Production
NWT
Ide
ali
sed
Need improved corrosion
Wall thickness (mm)
WT
tre management to achieve new
nd
los COP date
s
Need improved
corrosion management
to achieve nominal
design life
MAWT/ASME B31.3
MAWT/ASME B31.4
Design Life LE Decom
Operating Life/Years
Figure C.1: Ageing and life extension and decommissioning
Early planning for CoP followed by decommissioning is essential.
If there is excessive expenditure in ensuring the asset remains in pristine condition to CoP
this leads to reduced economic viability and profitability. However, an asset which is in good
condition at the end of its operating life has the potential for redeployment of some of its
equipment, thereby providing some additional return on the initial investment.
If there is insufficient expenditure on ensuring the asset remains fit-for-purpose and safe to
operate, SFAIRP, it is much more likely to suffer corrosion and consequent loss of integrity. The
95
+44 (0)207 467 7100
consequences of unplanned shutdowns and hydrocarbon leaks can lead to unsafe situations
and be costly when taking into account the lost production, repairs and clean-up operations.
There is a balance to be achieved between over- and under-investing on the maintenance

and integrity of an installation. This is a dynamic balance requiring regular review of the
degradation of the asset and its CoP date. In general, it is better to invest in CM as early
and for as long as possible so that the asset remains fit-for-purpose for its nominal design
life and to provide potential for life extension. There are financial imperatives for early CM
because more funds are available at high hydrocarbon production rates in the first few years
of production than in later years when the field is depleted.
For Floating Production and Storage Offload assets (FPSOs) the economic need to ensure
the installation and its plant are maintained to remain in good condition is more important
because the entire facility can be moved from one field to another.
96
+44 (0)207 467 7100
ANNEX D
APPROACHES TO GOOD PRACTICE
D.1 INTRODUCTION
This section provides general guidance for the implementation of the management steps
described in the main section of the document and also examples of good practice in
implementing those steps.
The primary objective of CM is minimising the risk of harm to individuals and to the
environment arising from leaks and structural failures caused by corrosion. Taking action to
eliminate these risks and therefore the costs that arise both directly and indirectly from them
will also avoid concurrent loss of plant availability and the cost of repair. It will also avoid the
loss of reputation and investor confidence that can be damaging to a company's business
ambitions.
D.2 WHY MANAGE CORROSION?
Loss of hydrocarbon containment or structural failure of oil and gas processing facilities due
to corrosion can result in severe consequences on:
−− safety;
−− the environment;
−− business interruption;
−− economic viability;
−− asset value, and
−− company reputation
Analysis of data on reported offshore hydrocarbon releases ranks corrosion as the second
most frequent initiating factor leading to a loss of containment, with failures of joints and
flanges the most frequent.
Predicting the rate of degradation of SCEs due to corrosion carries some uncertainties because
corrosion is inherently a stochastic process. The amount of uncertainty is reduced by having
effective CMSs in place which combine proactive and reactive measures. For example, the
use of corrosivity modelling algorithms can be used to forecast the likely rates of corrosion in
the system; the use of flow modelling software can be used to identify areas of high shear
stresses which are likely to increase intrinsic corrosion rates and diminish the effectiveness of
CIs.
CM activity therefore has a commercial pay-off as well as providing vital support to safety and
environmental objectives.
CM is the systematic use of a wide range of mitigation methods as barriers to corrosion

threats, including those presented in Figure D.1.
97
+44 (0)207 467 7100
+44 (0)207 467 7100
SUITABLE MATERIALS OF CHEMICAL COATINGS &
CONSTRUCTION TREATMENT n LININGS
sio r
r ro ito
Co hib
in
Options Options
Options O
H B Sc O Li M
k 2S 2 s al rg n
ls s or sc ca ioc an ing eta
A lic w av ve ide e in ic lli
ee pe ng hi c
st CR tal Pi
en bi co co
n e Locations
ge er to Locations
at at
M -m r r in in
C- on
gs gs
N Sh V Ta
Ve
e s g
u r i n
ea alv
e
nk ssel
s s c t i p
rs s ru p
tr st &
es
s a e ls
e s s
bs
Method Su Ve W
g g ge es Inspection w he
sin sin ka lin A r e he r e
Selection do do ac i pe ta pr as o n an
u s p P ac n d
ch l Locations
pp
lic tic ab
n uo Bat ica ab ly
ig r n tin e m at
io le
es p ai Ve Tan Pip
n
td Co ch ss ks ew
A Re of el or
n s k
ig
es
D
CORROSION MITIGATION OF
THREATS RISK
A
ci
d
ga
se Options
98
Options s
Water cut Identify threats s t
t es en
d es en a cc m
rr e ry es e
no r e ist im of ac
la cu a tu sur m g se pl
ia d r es e re re
ic se pe Pr ch Ea of
rif es m er ow
ac pr Te at Fl se
S Im W Ea
Locations Locations Locations
, s
Potential es
s k ls es s es s
or ic eg ct
lin ure na e lin sel ev dl fe
Measurement Verification pe ct pew ter ip ve s cr a ef
pi tru
pi n lp & e de ic
t li at g an
bs
ea & s Actions r na rk Whole System in in lv
en s nd esse
im t a
m V te o s ea
Su old rou n ss El lg
ce i f g i on io ity In pew ic cr
la t t oc ss pi re m tia
p an ow ra re st na id en
re y d duc vel st o f y vo t
M Bel
h r e e r d A po
de de e id a es id
no ur lu he us id
A as ss lf ls ca flu vo
G e o r o e A
Pr r ce ov
nt nt du pr
Co Co R e I m
CATHODIC PROCESS DESIGN

PROTECTION CONTROL
Figure D.1: Mitigation methods used as barriers to corrosion failure
D.3 PLAN
D.3.1 Policy
Policies and guidance on strategies relating to integrity requirements and CM practices

should be put in place. The CM policy and strategy should be derived from, and be aligned
with, the corporate policies.
The CM policy provides a key element in the corporate asset integrity management plan, in
giving direction to systems of control and documentation that ensure that the integrity of
asset/installation components is maintained and that the safety of personnel is assured.
The aim of the policy is to ensure that the organisation and individuals involved with the
management of materials degradation deliver a sound and robust system to provide safe
operations.
D.3.2 Purpose
The CM policy provides a key element in the corporate asset Integrity Management Plan, in
giving direction to systems of control and documentation that ensure that the integrity of
field components is maintained and that the safety of personnel is assured.
The aim of the policy is to ensure that the organisation and individuals involved with the
management of materials degradation deliver a sound and robust system to provide safe
operations.
The expectations for compliance with the CMS are to:

−− Prevent the release of hazardous fluids caused by loss of primary containment due
to materials degradation by employing use of inherently safe design, proactive
monitoring and corrosion mitigation measures.
−− All unacceptable failures must be investigated to determine the root cause, with
appropriate remedial measures being implemented, both within the asset/installation
and to other assets/installations where applicable, to enact change where required.
−− An auditable system that clearly defines mitigation/assurance activities for all pressure
system tags identified in the Maintenance Management System.
−− A basis for risks from materials degradation to be clearly and openly communicated to
the Asset/Installation Management on a regular basis to ensure the correct emphasis
is placed on CM activities, including the provision of sufficient competent workforce
to implement the policy across all facilities.
A basis for a common approach to setting the corrosion policy and the objectives for ensuring
integrity of a potentially hazardous system is outlined as follows.
A policy is permanent, carrying the authority of the most senior manager of the
asset/installation to which it applies. It is a directive which specifies the aims and objectives of
how major operational issues should be handled over the anticipated life cycle of an asset. It
forms the basis for the preparation of:
−− strategies;
−− organisation structures;
−− performance standards;
99
+44 (0)207 467 7100
−− procedures, and
−− other managerial processes.
The CM policy documents the principles for achieving its long term aims and objectives,
which are principally no leaks and no risks.
The CM policy will usually take its lead from the company policy to ensure high levels of
safety and environmental protection.
Below the CM policy will be a number of procedures which identify the methods by which
the policies are delivered. Figure D.2 shows the relationships between the Duty Holder/
Operator's Policy, Strategy and Procedures.
The CM strategy is a statement of the methods by which the overall policy is implemented.
Regulatory compliance
Policy for ensuring safety, health and environmental compliance
Strategies for
ensuring safety, Policy for ensuring
health and asset integrity
environmental
Procedures for
Strategies for
ensuring safety,
corrosion
health and
management
environmental
Plant operating & Procedures for

emergency corrosion
procedures management
Maintenance Procedures for

procedures plant inspection
Figure D.2: Relationships between duty holder/operator's policies, strategies and

procedures
D.3.3 Policy format
Corporate policies must have clear, high-level objectives for managing safety, health and the
environment which are in keeping with the regulatory regime in which the asset operates.
100
+44 (0)207 467 7100
Whilst the majority of Duty Holders/Operators incorporate their CMP within the asset's
integrity policy, some have separate and specific CMPs.
Examples of aims and objectives that may be included in a typical CMP could include one or
more of the following:
−− To be consistent with the requirements of the corporate safety requirements,
environmental considerations, regulatory requirements and the long-term business
objectives of the company.
−− To comply with the asset integrity management policy.
−− No leaks or emissions, or pursue reduction of emissions and, where reasonably
practicable, eliminate them.
−− To eliminate or minimise the effects of materials, deterioration on the safety, integrity
and availability of operated assets.
−− Minimum 20 % reduction of corrosion related failures year on year.
−− Trend inspection data to be forecasted to identify when the CoNC will occur.
−− All corrosion mitigation methods to be >95 % effective.
Some organisations further break down their policy statements into more specific
expectations or objectives for each major activity.
There are broadly four routes to establishing the policy, for which Duty Holder/Operators
may use:
−− Conduct all CM/asset integrity activities in-house using staff Specialists, who develop
the corrosion policy and strategy.
−− Appoint specialist consultants to set up the corrosion policy and corrosion strategy
for ratification by the operators.
−− Appoint a single specialist consultant to cover all activities.
−− Appoint different specialists (internal/external) for specific activities such as setting up
the system and procedures, operating the system and verifying/auditing the system.
The Policies and associated Strategies and Procedures form the basis for the management of
the asset to measure and audit the effectiveness of the CM organisation.
Duty holders/operators should develop KPIs to measure the extent to which the policy
objectives are met and enable timely corrective measures to be taken.
D.3.4 Planning
The details of a CMS depend on the installation's process design, the process fluids being
handled, and the operator's safety and integrity management policies.
The CMP should be considered a 'live' document which is subject to continuous review and
kept up-to-date as the asset ages and process streams change, to ensure the asset remains
safe and fit to operate. For assets which have been operating for a number of years the
practicability of CM options depends on the effectiveness of the maintenance regime and
the economics of the asset to CoP.
101
+44 (0)207 467 7100
The CMPs and strategies may differ significantly between new build facilities and existing/
ageing assets. Preparing the CMS at the project design stage enables current good practices
to be implemented which will have a positive influence on the asset life. Options for existing
facilities will be constrained by features of the original design, such as the choice of materials.
Highly corrosive environments may need CRAs, or for where carbon steels (CSs) are specified,
the deployment of highly efficient CIs with high availability.
For an asset where the produced fluids are sour, or have become sour during the field
life, the materials of containment must either be specified to NACE MR 0175 (ISO 15156)
requirements, or have properties which are demonstrably equivalent.
D.3.5 New builds
D.3.5.1 Design and forward planning

The development plan for a new asset should include a policy regarding its nominal design
life.
Both the materials selection strategy and CM strategy should ensure that, as a minimum,
the nominal design life is achieved with minimal unnecessary maintenance which would be
associated with premature degradation. From the experience of ageing structures and assets
in the North Sea it is recommended that at least an additional five years is added to the
nominal design life to provide a cushion for decommissioning.
Due to the vagaries of the oil and gas market it is extremely difficult to forecast what
additional life should be added to the nominal design life to account for the potential for
life extension due to enhanced oil recovery or increased oil prices. The potential for life
extension of the asset should be considered regularly, and the integrity data associated with
the asset should be regularly trended to determine when the CONC will occur to ensure that
the CONC date exceeds the cessation of production date. Where data trending indicates
the CONC date will occur before the CoP date early action should be to taken rectify the
potential risks.
The asset development plan, and hence the corrosion management plan, should identify
the SCEs that are built into the asset's design and also the performance limits on which they
are based, so that corrective actions can be made in a timely manner to operate within the
design limits.
Where corrosion modelling indicates potentially high degradation rates, designers should
perform life cycle costings to determine the options of investing in the relatively high capital
costs of CRAs and their lower maintenance and inspection costs, against the lower capital
costs of CS but with the likelihood of higher inspection, maintenance and CI costs.
The process plant design should include:

−− corrosion monitoring equipment (coupons and probes);
−− the ability to gather and trend process and corrosion monitoring data, and
−− the ability to ensure inspection is possible. For pipelines this may include pig launchers
and receivers to accommodate In Line Inspection (ILI) devices.
102
+44 (0)207 467 7100
D.3.5.2 Inherent safety

Inherent safety follows the principles of hazard control33 wherein 'Major accident hazards
should be avoided or reduced at source through the application of principles of inherent
safety. Where risks remain, then recognised risk approaches such as ALARP for health
and safety matters, or BATNEEC (Best Available Technology Not Entailing Excessive Costs)
for environmental matters, should be used to determine the extent of the preventive and
mitigation measures required'.
Further HSE guidance34 on inherent safety says that:
'The following principles should be adopted, where possible:

−− Substitution: use of less hazardous materials.
−− Simplification: use of simpler process system.
−− Intensification: reduction of inventory of hazardous materials.
−− Attenuation: reduction of temperature and/or pressure of hazardous materials, or
use of inert diluents'.
Secondary to inherent safety is the requirement to rely on additional engineered safety

systems and procedures which may fail.
In addition to meeting specific legislative requirements, the strategy may be to encourage

control of risks using the concept of inherent safety. The principles of inherent safety are
more effective at the concept stage and detailed design stages. However, the same approach
should be applied during operations when modifications and repairs are considered.
D.3.5.3 Consideration for 'new build' facilities

Explicit treatment at the earliest stages of concept design to eliminate, where possible,
hazards associated with corrosion damage that combine with operational loads to produce
failures; design assessments should look for sites of probable corrosion and consider the use
of corrosion resistant materials or another effective method of corrosion control:
−− Design to minimise corrosion damage to safety critical items and systems.
−− Ensure that key support structures for equipment have a high reliability and resistance
to failure; this is important in areas exposed to marine environments and subject to
wash-down or regular deluge from tests of firewater mains.
−− Selection of locations, configurations and orientations that minimise threats to the
integrity of equipment, viz. design detailing of impingement/wear plates, drainage,
and removal of dead legs where corrosive conditions develop/chemical treatments
are ineffective.
−− Design to survive local/component failure by maximising redundancy, viz, back-up
injection pumps for inhibitor injection systems.
−− Design to allow more reliable and effective inspection, ensure adequate access for
inspection/monitoring equipment.
−− Design for maintainability – easy removal of pumps, motors, valves.
Inherent safety requires a barrier to corrosion that is permanent and requires no further
supporting activity. However, in some cases the introduction of an inherently safe barrier to
one threat may introduce another threat; an example is described in D.3.5.4.
103
+44 (0)207 467 7100
D.3.5.4 Safeguarding integrity

Whether or not the design is based on the concept of inherent safety there will be a need to
safeguard the barriers included in the design. Mitigation measures should be incorporated
into the operation to provide the barriers required by the design strategy.
Example: subsea pipeline. Threat: internal corrosion
Corrosion barrier option 1: inherent resistance by construction in duplex stainless

steel
−− Additional threat: brittle fracture from external cathodic overprotection combined
with excessive stress.
−− Additional operational barrier: operational control of temperature to avoid overstress
from thermal expansion.
−− Monitoring against performance target: temperature.
Corrosion barrier option 2: corrosion allowance of low alloy steel pipe

−− Additional barriers: corrosion inhibition to limit the corrosion rate to achieve the
desired design life.
−− Routine maintenance pigging to remove water accumulation, deposits and bacterial
contamination.
−− Monitoring against performance target: wall thickness measurement by on-line
inspection.
−− Corrosion rate monitoring. Inhibitor injection rate and up-time monitoring. Pigging
frequency.
Option 1 requires (i) additional capital finance to install duplex stainless steel pipe, (ii) a subsea
temperature monitoring and alarm system, (iii) subsea CP monitoring and alarm system.
Option 2 requires an operational CMP to monitor CI injection and injection rate and to
implement scheduled inspection and pigging. This will incur additional costs for:
−− CI;
−− pigging;
−− periodic intelligent pig inspection;
−− pigging facilities;
−− on-line corrosion monitoring, and
−− non-destructive inspection.
D.4 EXISTING INFRASTRUCTURE
One major factor that will impact on the CMS is the planned asset life. The CMS should be
based on the long-term corporate strategies and objectives for the asset/installation, and
therefore the corrosion risks need to be appraised against these objectives when planning
and implementing the corrosion control activities to meet the required asset life.
104
+44 (0)207 467 7100
Example: Impact of planned asset life
A platform has been in operation for over four years and has a fixed CoP date based on the
known recoverable reserves. During the period leading up to the expected abandonment
limited inspection and maintenance were carried out – consistent with the requirements
based on the planned abandonment date.
About a year before the platform is due to be abandoned the decision is taken to bring on
a new marginal field using extended reach drilling. This, together with other changes in the
production process, means the platform has a new economically viable life extension of an
additional six years.
However, the financial benefits of the extended asset life may be reduced due to the
additional costs of maintenance/repair/replacement of components that, because of the
previous operating regime, may be unviable for the remaining life.
If the options for the future of the asset had been made known to the relevant teams
at an early stage, a different operating and maintenance regime would likely have been
incorporated leading up to the introduction of the new field, with potential savings in the
overall operational cost over the remaining life.
With advancing technology, asset life expectancy is frequently extended beyond the original
nominal design life. It is therefore important when extending field life beyond design limits to
be able to accurately understand the remaining integrity of SECEs and also the effectiveness
of the CMSs.
Life extension is likely to require reappraisal of corrosion risks and the introduction of changes
to the CMS.
The CMS should match with the forecast asset life, and because of this the future business
and operational requirements for an asset should, where practicable, be made known to
those responsible for setting and implementing the CMS. For example:
Example 1: Considerations for operational requirements of existing facilities

−− A typical range of operational requirements for existing facilities:
−− Assets may be deliberately managed with a limited operational life in mind.
−− Limited life assets may be operated with reduced maintenance activity to improve
asset economics and avoid unnecessary expense.
−− After operational or financial reviews the asset may have its operational life extended
by a number of years.
−− Operational changes include incorporation of new/marginal fields, acting as a hub
for other fields, or enhanced oil recovery.
−− In the event of asset life extension the asset may only be viable after additional work
in order to meet the corrosion policy.
Example 2: Strategy for internal protection of new and existing separator vessels
Because of the combination of volume and pressure, some of the most safety critical
components in offshore oil and gas production are the vessels used to separate gas, oil and
water. In many cases the corrosion conditions are such that CSs alone may not be sufficient
to ensure adequate operational life.
105
+44 (0)207 467 7100
Various options are available to provide an acceptable life, which include application of
internal coatings and linings, usually combined with internal CP, or using CRAs as a weld
overlay or liner. The selection of the most appropriate technique will be dependent on
whether the corrosion problem is identified before fabrication or in service. In the latter
case, internal CP can be used successfully to provide the necessary corrosion control for
carbon steel vessels.
D.5 DO
D.5.1 Risk profiling
In order to fulfil the requirements to ensure that risks are identified in a timely manner and
that preventative measures are put into place the Corrosion Risk Assessment Study should be
prepared before the production facility is commissioned.
Duty Holders/Operators should have in place policies and strategies for managing those
hazards and risks which may adversely affect safety, health and the environment.
D.5.2 Organisation
To ensure the installation and its plant are safe from corrosion related degradation, SFAIRP,
the operator should engage competent specialist advice. It is preferred that the operator has
at least one competent Corrosion and/or Integrity Engineer from their own organisation in-
house, but where this is not feasible for cost or availability reasons they should use competent
specialist consultants and contractors to act on their behalf.
D.5.3 Implementing the plan
The outcome of the CRAS will be to develop a corrosion management system which will
ensure the corrosion related threats are identified and that the consequential risks are
managed to be ALARP.
D.6 CHECK
D.6.1 Measuring performance
The successful management of corrosion requires that cost-effective combinations of

corrosion mitigation procedures are employed to minimise the threats. The strategic choice
of corrosion control methods depends on factors such as:
−− physical and atmospheric environment;
−− process fluid compositions;
−− pressures and temperatures;
−− corrosivity of the aqueous fluids;
−− facility age;
−− time to known CoP;
−− technical capabilities available to the organisation, and
−− geographical location.
106
+44 (0)207 467 7100
D.6.2 Investigating accidents/incidents/near misses
CM is also concerned with safeguarding the facilities and the avoidance of business
interruption, therefore the policies should also address these issues, as not all corrosion
related failures will also have an impact on safety or the environment.
D.7 ACT
D.7.1 Reviewing performance
The CMS should be regularly reviewed at a frequency in keeping with the rate of the risks
changing and also when there is a significant change such as:
−− significant changes in process fluids such as water cut, H2S, scaling tendency;
−− a new source of hydrocarbons coming onto the installation;
−− change of ownership;
−− approaching nominal design life;
−− life extension, and
−− when considering CoP.
Although there are examples of gas production facilities where the process conditions have
not changed for many years, thereby not requiring substantive changes to the CRAS, it is still
necessary to perform a formal review and log the findings to demonstrate that this remains
the case. This formalises the process and the findings and provides evidence the process has
been completed in a suitable and sufficient manner. There have been instances of offshore
gas producing installations with many years of benign production suffering corrosion under
insulation (CUI) which has become the primary safety risk.
Learning lessons and taking action to eliminate corrosion threats provides benefits of
promoting safer operation and avoiding:
−− environmental damage;
−− direct and indirect costs;
−− loss of plant availability;
−− repair costs, and
−− loss of reputation.
107
+44 (0)207 467 7100
ANNEX E
ORGANISATION
E.1 INTRODUCTION
This section provides a framework for, and examples of how, a corrosion strategy helps in the
allocation of roles and responsibilities both within the Duty Holder/Operator's organisation
and consultant/contractor/sub-contractor organisations.
The effectiveness of any policy depends on the leadership, commitment and involvement of
managers and senior staff. Safety and environmental protection are of concern to everyone:
employer, employee and contractor. Cost containment is a common focus. Corrosion should
also be of similar concern. A positive safety, health and environment culture and a 'corrosion
culture' results in fewer threats to individuals and less damage to the integrity of a facility.
For organising CM the four key themes are:

−− roles, responsibilities and accountabilities;
−− competence;
−− communication, and
−− cooperation.
Consideration of all these is vital, particularly for management of complex multi-disciplinary

areas, like CM, which may well involve non-specialist engineers. There are many different ways
operators can organise and address CM. However, a common theme will be the involvement
of both specialists, e.g. corrosion, chemical treatment, inspection, etc., and non-specialists
such as those in plant operations and maintenance. In addition, most operators contract out
at least part of their CM activity, whereby many different scopes are defined and contractual
relationships agreed.
E.2 PLAN
E.2.1 Policy
The approach to organisation is related to the Company Integrity policy and Strategy with the
aim of keeping threats ALARP.
E.2.2 Planning
The following key roles should be addressed. Note that these are role titles. Companies’ CM
strategies may use different post titles for these roles and may combine two or more of these
roles into one post. They may also allocate other roles to similar post titles.
−− The Operations Manager often has overall responsibility for the integrity of the
installation, and as such, must ensure that suitable effective arrangements are put in
place to manage corrosion and undertake monitoring and inspection. The role has
responsibility for:
– resourcing operational activities and leading operations management;
108
+44 (0)207 467 7100
– maintaining operating and emergency procedures, and

– ensuring sufficient budget is available to meet the requirements of the CMS and
associated corrosion/inspection management strategies.
−− The Engineering and Maintenance Team Leader is usually responsible for
maintenance activity on the facility, including providing the necessary support (access,
entry, cleaning, etc.), onshore and offshore to ensure that corrosion monitoring/
inspection activities can be carried out in accordance with the plan and that the
necessary remedial work is carried out. The Integrity Manager/Team Leader
is usually responsible for managing the work programme of a team of integrity
engineers and technical specialists for larger assets or group of assets. The Manager/
Team Leader will have overall responsibility for:
– the delivery of the integrity management programme, and
– the maintenance of integrity management standards and effectiveness.
−− The Integrity Engineer is usually responsible for the approval and ownership of
risk-based assessments and inspections, including changes made and the associated
inspection intervals:
– approves work packs and inspection recommendations;
– is responsible for the management of the inspection contract;
– interfaces with support services required to implement inspection;
– reviews corrosion and inspection reports and disseminates information to the
onshore/offshore engineering team, as necessary;
– raises Repair Orders resulting from inspection;
– manages the inspection budget;
– maintains integrity documentation and databases, and
– commissions audits and reviews of the inspection management contract.
−− The Inspection Engineer is usually responsible for:
– the preparation of inspection work packs;
– the thorough examination of equipment;
– the supervision of NDT, survey and testing;
– reporting on inspections, and
– analysis of inspection results.
Depending on competence, Inspection Engineers may also take responsibility for
contributions to RBI planning and the development of non-intrusive inspection
schemes. The Inspection Engineer will be responsible for ensuring that the RBI
results are transferred into the planned maintenance system along with appropriate
inspection specification text for the routine.
−− The Technical Authority (TA) for Materials and Corrosion usually evaluates the
effectiveness of the strategy primarily in terms of corrosion prevention and safety
issues but also including cost and field life implications:
– attends tactical and strategic review meetings and peer reviews;
– acts as a key source of technical advice on corrosion issues to the asset
management on the material degradation aspects of plant, processes, structures
and pipelines;
– promotes a consistent approach to management of corrosion across all assets;
– facilitates shared learning sessions;
– acts as technical custodian of the relevant SMS documents;
– facilitates the key requirements of the engineering technical practices to ensure
compliance, and
– approves deviations from corporate standards.
109
+44 (0)207 467 7100
−− The Corrosion/Materials Engineer is usually responsible for corrosion data

management and associated databases:
– reviews corrosion related monitoring/inspection findings;
– conducts investigations and prepares reports as required;
– generates annual corrosion monitoring programmes;
– reviews and updates pipework RBI as necessary;
– populates requirements from RBI into the inspection database to allow work
pack preparation;
– reviews changes in the operating conditions and proposed plant modifications
and assesses their impact upon fluid corrosivity;
– recommends and manages specialist services as necessary, (e.g. microbiological
surveys, failure investigations);
– produces annual and quarterly integrity reviews, and
– is responsible for performance monitoring of inhibitor deployment and status of
probes and coupons.
−− The Production Chemist/Chemical Treatment Specialist is usually responsible
for the selection and dosage rates of the chemicals required to treat the production
systems offshore:
– arranges testing and trials for selection of the appropriate chemicals;
– conducts, or arranges, tests with all production chemicals to determine whether
there are any compatibility issues;
– monitors chemical usage, and
– establishes effectiveness of chemical treatment from production report data.
−− The Microbiologist is usually responsible for setting up treatment, sampling and
analysis schemes and for the interpretation of analysis results, etc.
−− The Production Engineer is usually responsible for the overall management of
production:
– defines targets for well performance;
– advises regarding choke settings;
– manages well workovers and downhole treatment, and
– manages sand production.
−− The Operations Engineer/Process Engineer is usually responsible for process and
utility plant performance:
– defines targets for plant performance and advises on settings;
– monitors plant performance, and
– advises on temporary operating schemes, isolations, etc.
The Process Engineer also advises regarding process design improvement for
troubleshooting, removing bottlenecks and on process safety requirements.
−− Technicians and Technical Assistants are usually responsible for implementing
skilled technical activities including:
– NDE;
– servicing corrosion monitoring equipment;
– onshore and offshore cathodic protection surveys;
– coating condition surveys;
– chemical and bacterial sampling and analysis, etc.
Technical Assistants also assist Engineers with data entry and data management,
document management and compilation, etc.
Personnel should always be aware of their own competencies and should not engage in
making decisions and judgements in areas where they do not have adequate knowledge.
Management must always look to engage suitably competent personnel.
110
+44 (0)207 467 7100
The key competence requirements for the following key roles should be addressed:
−− Technical Authority:
– Comprehensive knowledge of CM standards and practices and their application
within the organisation. Appropriate professional qualification, education, and
training.
−− Integrity team leader/manager:
– has knowledge and understanding of the roles, responsibilities and CM structure
operated by the organisation;
– is experienced in successful review of processes and procedures;
– has experience of CRA and CMTs used offshore, and has the ability to apply
them;
– has knowledge of inspection methods, their application and limitations, and
– has appropriate professional qualification, education, and training.
−− Corrosion/materials engineer:
– familiarity with relevant standards and specifications;
– has knowledge of materials selection;
– can identify, justify and apply measures required to minimise risks from corrosion;
– has experience of corrosion risk assessments, and
– appropriate professional qualifications, education, and training.
E.2.3 Contracted services
Most operators contract out at least part of their corrosion management activity and there
are many different scopes defined and contractual relationships agreed. Examples that have
been implemented include:
−− Full corrosion and inspection management services with the operator having just a
small number of Integrity Engineers to provide the customer interface and in-house
corrosion consultants to provide specialist support.
−− Integrated corrosion and inspection management team under the management
control of the client.
−− Chemical treatment programme management covering the use of both the supplier's
and competitor's chemicals and including specialist advice and provision of database
facilities.
All four of the key themes have relevance to the success of the operator/contractor relationship
in producing an effective CM outcome.
With respect to roles, responsibility and accountability, it is important that the respective
roles, responsibilities and authorities of the operator and contractor are defined. Where both
parties have a management system in place, the agreement should define which is to be used
and whether, for instance, documentation is issued in operator or contractor format and
whose databases and record systems are to be used.
111
+44 (0)207 467 7100
E.3 DO
E.3.1 Risk profiling
A risk assessment will be performed for the activities performed by each role as required by
the Company Health, Safety and Environment Policy, which will be supported by the Integrity
Policy.
E.3.2 Organisation
A CMS helps to define and allocate the roles and responsibilities both within the Duty Holder/
Operator's organisation and contractor/sub-contractor organisations.
The mandatory and preferred qualifications and experience should be clearly specified in job
descriptions so that the accountability and scope of responsibility of each team member are
unambiguous.
An organogram should be prepared to clearly identify the lines of accountability.
Ideally, organograms should show lines of accountability and cooperation associated with
any contract posts.
Design
information
Integrity Operations
manager information
Maintenance
information
Integrity Inspection Materials/ Corrosion Production Production Operations

engineer engineer corrosion engineer engineer chemist engineer
authority
Inspection
information On-line Fluid Process
monitoring sampling monitoring
information information information
Figure E.1: Example of organisational relationships
112
+44 (0)207 467 7100
+44 (0)207 467 7100
Engineering
manager
Analyse inspection
results CTA
Inspection Inspection
work packs reports Investigations RBI
Inspection engineer
Corrosion Health
monitoring Corrosion engineer reports
Supervise Do NDT
NDT
Corrosion inhibition Corrosion
Integrity manager management
performance
Microbiology
113
Scale management
management Documentation
Corrosion inhibition Initial audits
Scale
management
management
Demulsif ier
Production chemistry
management Raise paper work
Integrity engineer orders
Chemical
usage Approve
Asphaltene work packs
management Chemical Review Corrosion &
effetiveness Manage inspection Inspection reports
contract
Figure E.2: Detailed roles and responsibilities of the integrity team
E.3.3 Implementing the plan
The purpose of implementing the plan is to ensure risks are ALARP and that it is undertaken
in a cost-effective manner.
The roles and responsibilities of the corrosion team members in the planning and
implementation of CM activities should be clearly defined. The following aspects should be
considered:
−− the operational responsibility for implementation;
−− the functional responsibility and technical authority for specification, analysis and
recommendation, and
−− the responsibility and authority that is to be exercised by contracted bodies.
Responsibility should be allocated in all key areas, for example:

−− CI: the Production Chemist/Chemical Treatment Specialist specifies the dosing and
the Operations Engineer manages the dosing.
−− Use of CRAs: the Corrosion/Materials Engineer will specify the materials.
−− Corrosion modelling and prediction: Corrosion Engineer.
−− CP: Corrosion Engineer specifies monitoring scheme.
−− On land: maintenance perform weekly checks.
−− Surveys are conducted by Contractors.
−− Subsea: the Pipeline Engineer contracts third parties to conduct surveys.
−− Microbiologically influenced corrosion problems, etc; the Chemical Treatment
Specialist contracts third parties to perform testing.
In different organisations different post holders will carry out similar roles. The important
thing is to ensure that all responsibilities are unambiguously allocated.
A TA for corrosion should be identified and the strategy that is adopted should describe
the links between the parties involved with the CM. This is particularly important where
relationships between the Owner, Contractor, Specialist Subcontractors and Consultants
exist.
E.3.4 Competence system
The competence system should:

−− be verifiable by audit of training, the recruitment process, personnel development
and formal performance assessment;
−− provide demonstrable capability of staff within their pre-defined and agreed job
descriptions;
−− define agreed levels of competence to be achieved;
−− be based upon, equivalent to or better than a nationally or industry-recognised
technical standard;
−− be current with respect to the physical plant and management systems in operation,
and
−− provide for and include third-party contractors.
114
+44 (0)207 467 7100
E.3.5 Competency guidelines
A good example for determining the level of competence required for a particular activity,
as well as the degree of competence provided by individuals, has been developed by the
HSE, Institution of Engineering Technology and the British Computer Society which may be
adapted for use in the offshore oil and gas industry to apply to CM issues.
The competence system should retain records of assessment and supporting documents,
accessible for the purposes of audit and/or review.
The availability of standards for the competence of personnel in the roles across the CM
structure is also important. There is considerable variation in availability and formality:
E.3.6 Technical authority and the integrity team leader competencies
The TA and the Integrity Team Leader should have appropriate professional standing through
education and experience, as discussed. Professional qualifications should be in an appropriate
discipline, preferably at the UK Chartered Engineer level[4] as well as in the corrosion discipline,
if this level is not available. A minimum of five years' experience is normally required to
achieve the necessary level of competence; however, the experience must be appropriate to
the area of TA.
E.3.7 Corrosion Engineer competencies
In Europe, there are no institutions offering degree level academic qualifications in corrosion
technology. It is therefore appropriate to develop competence through:
−− a relevant first degree;
−− education in general corrosion science and technology at a post graduate level, and
−− experience in oil and gas corrosion technology.
The first degree should be a science or engineering qualification with significant

relevant corrosion related content (i.e. corrosion itself, corrosion resistance of materials,
electrochemistry). The most appropriate subjects are materials, chemical engineering and
chemistry.
A number of UK postgraduate courses provide education in general corrosion science and

technology over a year ful-time for an MSc (by examination and dissertation) or post graduate
diploma (by examination only). Courses may be available on a distance learning and/or part-
time basis, albeit over an extended study period. NACE International operates internationally
recognised senior corrosion technologist and corrosion specialist qualifications, based on a
process of examinations and peer review, following specialist courses and self study.
It is possible to gain knowledge of general corrosion science and technology over a period of
time through work experience and/or in association with MSc and PhD degrees by research
and thesis. Training courses extending from a few days to two weeks are available from a
number of sources that cover a basic introduction to corrosion science and engineering and
can, therefore, provide an entrance to the subject. Classroom-based training can be acquired
using university courses on a modular basis where available.
Experience in oil and gas corrosion technology is normally gained through work experience.
Some of the specialist short courses on offer provide an introduction to oil and gas corrosion.
115
+44 (0)207 467 7100
Where general and oil and gas corrosion knowledge is obtained through experience, rather
than through formal postgraduate study, competence needs to be assessed in a structured
manner, normally by a corrosion TA. It is estimated that two years structured experience is
required to gain adequate general corrosion knowledge plus a further two years for oil and
gas corrosion knowledge. However, these timescales are only indicative and it should be
confirmed that fully appropriate competence has been attained though assessment.
Where qualifications are held and experience has been gained then the relevancy of the
specific corrosion knowledge has to be taken into consideration e.g. an authority in internal
corrosion, may not necessarily be competent in some aspects of CP of subsea facilities.
Professional qualifications for corrosion specialists are provided in the UK by the Institute
of Corrosion[6], in their Professional Member grades (MICorr or FICorr). Whilst these
demonstrate the possession of a level of knowledge in corrosion technology they do not
guarantee that the holder possesses a broad general understanding of corrosion or oil- and
gas-specific knowledge.
E.3.8 Inspection engineering and NDT technician competencies
The HSE in its guidance for the Pressure System Safety Regulations[7], and the United
Kingdom Accreditation Service[8] both give requirements for the qualification and experience
of inspection engineers engaged in developing inspection schemes for pressure systems,
conducting inspections and interpreting the results. These are expanded upon by EEMUA[9]
in their guidance document. Generally they can be taken as the minimum for inspection
engineering personnel working within the oil and gas production industry.
The requirements for NDT vocational technician qualifications are well developed in some
areas and are well described by various national and international standards and codes of
practice, for ASNT[10], CSWIP[11], PCN[12] qualifications. However these NDT qualifications
together with their associated training and tests have all been developed for application to
fabrication. Therefore, not all practitioners are competent to apply their skills to the detection
and quantification of in-service corrosion defects. Therefore, technician competence should
be verified by tests and/or a review of work in the in-service context.
E.3.9 Operator and management competencies for corrosion related responsibilities
Some roles do not require specific corrosion and inspection related skill, for instance the
operations team members and supervisors who are responsible for chemical injection, gas
drying operation, etc. Similarly nor do some managers who are accountable for some of
the specialist activity but do not undertake it themselves. In these instances a corrosion
awareness programme can be used to provide staff with background knowledge and foster
an understanding of the criticality of their roles to CM. Also short courses on specialist topics
and oil and gas corrosion can be used. It is important, however, in both cases that the
content is targeted to provide the right messages.
In addition to the need for personnel to have technical skills appropriate to their role, and
knowledge and understanding of the area for which they are responsible, it is necessary that
they possess appropriate behavioural skills relating to, for example, appropriate attention to
detail, interpersonal skills and problem solving abilities.
116
+44 (0)207 467 7100
E.3.10 Competence in contract services
Competence has relevance to both the contractor's organisation and the contractor's
personnel.
Corporate competence can be demonstrated in some respects by holding a Quality

Management System certification to ISO 9001, and in respect of inspection body competence
by UKAS accreditation[14]. The First Point Assessment organisation (FPAL)[15] manages a
database of supplier capability, conducts assessments and provides facilities for ongoing
assessment through client feedback. All these can provide valuable information on the
contractor's corporate competence but, as with personnel, the scope of the competence has
to be relevant to the scope of intended responsibility.
However, there is no standard demonstration of corporate competence in corrosion related

skills. Operators intending to employ a contractor to provide CM or corrosion consultancy
services should give due regard to the following:
−− Are the personnel to be employed servicing the contract competent in terms of
education and experience?
−− Is there back-up support from a wider scope of skills and there coaching and support
from more experienced personnel when necessary?
−− Is there a training programme in place and do personnel receive individual training
and development plans that are relevant to the contract requirements?
−− Is there a certified quality management system in place and has the contractor
developed procedures conforming to that quality system that will be applied on the
contract?
The requirements for contractor's staff are the same as for operator's staff and the operator
should ensure that the contractor either has a sound competence assurance system or they
should assess the competence of contractor's staff themselves.
The impact of the contract terms on the contractor's team competence should be carefully
considered. The ability to employ personnel at a given level of competence may be influenced
significantly by the remuneration on offer. In a contract situation this in turn will depend
on the rates in the contract and the margin that the contractor is seeking to obtain. In one
example, the operator would agree the remuneration of personnel with the contractor and
provide an agreed margin for burdens and profit and thus have control over these factors.
E.3.11 Communication in contract services
Communication may require particular effort especially if the operator and contractor are
physically separated in different offices. A decision has to be made whether to co-locate
the contractor's and operator's personnel and if not, how to overcome communication
issues. Many operators have benefited from hosting contractor personnel in the office-based
management team where they can directly interact and share access to intranet, file server
and database resources. In other cases it has been possible to use remote access methods to
share these resources and also use video links and conference call techniques to engage the
contractor.
Whatever the methods involved, it is important that the contractor's personnel can perform
effectively in their roles. In particular, appropriate contractor personnel must be part of the
corrosion management team.
117
+44 (0)207 467 7100
E.4 CHECK
E.4.1 Measuring performance
The purpose of measuring performance is to ensure the work is being carried out in
accordance with the plan and in an efficient manner and to identify any gaps present in the
organisational structure.
Once the necessary skills, expertise and experience for each role have been defined, the
development of individual training plans and ongoing assessment of personnel are essential.
This ensures that the competence of individuals is appropriate for their current role. It also
enables the requirements for further training to be identified, not just for the current role
but also for personal development into future roles and for professional and technical
development.
The CMT is a key concept for the development of cooperation. In an operation of any
size many parts of the organisation will play an important part in CM. For that reason it is
appropriate to form a CMT to mutually own the corrosion management process and foster
cooperation in making it work effectively. The CMT will meet routinely, usually with the
responsible Integrity Manager in the chair and the Corrosion Engineer providing the technical
and administrative support. The rest of the team may include:
−− a production representative, to provide information on well performance and well
operations;
−− an operations or maintenance representative, to provide information on plant
operation and performance issues;
−− an inspection representative, to provide a summary of inspection results and
information on anomalies;
−− the chemical treatment specialist, to provide information on the treatment
programme, and
−− Subsea and pipeline engineers, to provide information on subsea inspection results
and anomalies.
Some of these players may be operator's staff and some may be from service contractors or
specialist suppliers.
A team may be set up for one asset or field or alternatively for a group of assets. It depends
largely on how the individual assets and asset groups are supported organisationally, internally
and by service contractors and suppliers. In organisations that have central or group level
support for corrosion, the central/group specialist can be represented on the local team to
bring in wider knowledge and learning from other assets and areas.
In achieving cooperation, regard should be given to aligning the aims of the contractor and
the operator. Most contractors will find it in their interest to share the operator's aims with
regard to safety and mechanical integrity, as one successful contract in this respect will help
secure others. It is this win-win outcome that facilitates effective cooperation.
Cooperation is important in CM particularly as it is cross-functional and,

with the common use of service contractors and specialist suppliers, it is also
cross-organisational.
Relationships that are key for cooperation should be shown on the organogram.
118
+44 (0)207 467 7100
E.4.2 Investigating accidents/incidents/near misses
Investigation of failures in the organisational structure can generate information that may
reduce the likelihood of recurrence.
A real example of what can go wrong with process modifications occurred on an ageing
production system where, due to increasing water cut, it was decided to change the system
from a three-phase separator (i.e. oil, water and gas) to a two-phase separator (i.e. oil-water
emulsion and gas) process. Consequently, the oil-water emulsion passed through pipework
that had been originally manufactured in carbon steel, on the basis that essentially only dry
oil would be present.
The change in process had been made without reference to corrosion/materials engineers
and without reference to the original design assumptions used in the material selection.
Significant corrosion was subsequently found in the pipework downstream of the separators
and upstream of the CI injection point.
The solution adopted was to move the inhibitor injection point to immediately downstream
of the separators and to increase the inhibitor dosage significantly.
In addition to others being aware of the need to involve the corrosion specialists, the
Corrosion and Integrity role holders must also know how the operator's change management
process works and must be able to use it effectively when proposing improvement changes
in corrosion mitigation.
E.5 ACT
E.5.1 Reviewing performance
It is important to learn from past experience to improve CM and safety performance. Experience
and knowledge gained should be incorporated into future organisational structures.
The CMT (see E.4.1) is a key vehicle for communication between the key players. All
appropriate team members should be involved in sharing of information from analysis of
corrosion incidents:
−− root cause analysis;
−− process metallurgical reviews, and
−− implications for other areas on the plant.
Communication within the operator's organisation as a whole, and with its relevant
contractors, is also highly important to achieve understanding and obtain support in meeting
objectives. CM depends not only on those that have direct responsibility for CM activities
but also other engineering and operations personnel, on procurement, finance and human
resource functions and on management at large. An ongoing corrosion awareness initiative
can be used by the technical specialists and the CMT to communicate with the organisation
as a whole.
Corrosion Awareness training programmes, aimed at the non-specialist, have been found to
improve overall levels of CM performance. An inspection technician, maintenance operator
or process chemist, who has a better understanding of corrosion and material degradation,
119
+44 (0)207 467 7100
including how it manifests itself, what causes it and the different options for control, ensures
that:
−− Signs of corrosion/damage are recognised at an early stage – allowing remedial
measures to be put in place before damage requires major work.
−− The reasons for the detailed requirements for inspection and monitoring are better
understood – improving efficiency and cooperation.
−− The effects of corrosion control measures are better understood – again improving
efficiency and cooperation.
The workforce should also be involved. The workforce are the eyes and ears around the
installation. Their involvement is important particularly for external corrosion. There are many
ways to communicate to the workforce:
−− safety meetings;
−− poster campaigns, notice boards and leaflets, and
−− videos, newsletters and presentations.
Corrosion awareness training for the workforce should concentrate on the recognition of
corrosion problems and guidance on significance. There should also be guidance on the
effective reporting of problems.
E.5.2 Learning lessons
Lessons should be learned from experience with regard to organisation. Any failures related
to the organisation structure or any gaps identified should be addressed accordingly.
120
+44 (0)207 467 7100
ANNEX F
CORROSION RISK ASSESSMENT AND PLANNING
F.1 INTRODUCTION
Identification of hazards, the assessment of threats and agreement on the planned activities
to mitigate those threats and monitor for effective implementation are a fundamental
requirement of the management process. CMPs must relate to the policy and any strategy
already determined.
Planning and implementation are the largest single part of any CMP. Planning is the basis
of an ordered and purposeful CM programme and CRA is used to identify and prioritise the
elements of the plan.
Readers may find benefit in reading this document in conjunction with:

−− API 570 Piping Inspection Code, in service inspection, rating, repair and alteration of
piping systems.
−− API 580 Risk based inspection.
−− API 581 Risk based inspection technology.
F.2 PLAN
F.2.1 Policy
Planning and implementation are the largest single part of any CM process.
Planning is the foundation of an ordered and purposeful CM programme and corrosion risk
assessment is used to identify and prioritise the elements of the plan.
Identification of hazards, the assessment of threats and agreement on the planned activities
to mitigate those threats and monitor for effective implementation are a fundamental
requirement of the management process. Plans must relate to the policy and any strategy
already determined.
Planning and implementation often make use of company guidelines, industry codes and
international standards. Checks are needed to determine whether they are appropriate and
effective for each particular asset.
The ownership of actions and responsibilities relating to the CMP are vital to successful
operation. As part of this process the operator should keep appropriate records of planning
and implementation to allow full transparency of the process.
In some instances this information may be incorporated into an offshore UK production

facility's safety case and verification scheme, which normally forms the basis for all integrity
management requirements and specifications. No CMP for an offshore installation should
be developed without reference to the verification scheme to ensure that the two are in
alignment.
121
+44 (0)207 467 7100
Similarly, the plan for a UK onshore terminal should be aligned to relevant provisions of its
COMAH MAPP and Safety Report, and plans for UK pipelines should align to the Major
Accident Prevention document required by the Pipeline Safety Regulations.
Planning and Implementation constantly and rapidly influence each other through the
internal flow of information. This constant 'self-regulation' works within the overall framework.
F.2.2 Planning
Planning should commence with a formal process to identify the components on a facility
that have a threat of degradation due to corrosion. The most common approach to this is to
conduct a corrosion risk assessment.
Corrosion management planning should be based on the corporate, long-term strategies

and objectives for the production facility and the results of the corrosion risk assessment.
If a corrosion threat cannot be removed (usually achieved by a design change), then it has to
be mitigated by a barrier. Mitigation is achieved through the use of:
−− materials of construction changes;
−− coatings;
−− CP, and
−− chemical inhibition.
Management of corrosion threats is achieved through the introduction of:

−− corrosion mitigation;
−− corrosion monitoring, and
−− inspection programme.
Planning in the CM process occurs on two levels:

−− Strategic planning involves the identification of the necessary operational activities
that provide barriers to mitigate against corrosion failure, together with the activities
that measure the success of those barriers.
This planning process produces the strategic mitigation, monitoring and inspection
plan. It can be published as a set of matrices that account for:
– the identity of the SCE;
– the identity of the safety related item;
– the corrosion threat;
– the consequences of the corrosion mitigation failure;
– the location of the threat, barrier and monitoring activity;
– the barrier/mitigation activity;
– the measurement method for the effectiveness of the barrier;
– the performance limit for that measurement;
– the monitoring activity;
– the frequency of monitoring, or the basis on which frequency should be determined;
– responsibility for mitigation and monitoring;
– the action on non-conformity to the performance standard, and
– responsibility for action on nonconformity.
Also, document references (to the engineering design, the basis of design, corporate
and national standards that have been adopted, etc,) must be added for the
122
+44 (0)207 467 7100
performance limit, the monitoring method and frequency and the immediate action
procedure following nonconformity.
Performance limits should define acceptance/rejection criteria for the system or
component. The standard should be sufficiently quantitative such that it can be
measured consistently.
In practice, elements of the plan will have been determined during the design phase
and the plan should derive from the materials and corrosion strategies developed as
the basis for design.
The strategic plan may be part of a larger plan that considers other types of integrity
threat. In the UK, offshore operations must be aligned with the verification scheme;
onshore, to the COMAH safety plan and, for pipelines, to the major accident
prevention document.
Often a QRA or a safety assessment is developed and used as a basis for design,
or for integrity assurance in operation. In such cases the strategic plan should be
aligned not only to the threats identified in the QRA or safety assessment, but also
to assumptions regarding barriers/mitigation that have been used as the basis for
the QRA or safety assessment. This should be done at the design stage initially, but
because both documents may be revised due to changes in operation, the alignment
of the two should be maintained.
−− Tactical planning and scheduling is the second part of the process of detailed and
specific monitoring and inspection activities and events. For example, one item of
the strategic plan may require all pipework and vessel metal loss not to exceed the
design corrosion allowance. RBI planning will then assess the individual vessels and
pipework corrosion loops/circuits to determine the required inspection interval for
each circuit.
Offshore verification activities and planned inspection should be scheduled together
where joint witnessing is required.
F.2.3 Work planning
Work planning requires the scheduling and integrating of the mitigation, inspection and
monitoring activities within the overall asset strategy, and identifying the preferred deployment
of mitigation inspection and monitoring resources and technology.
Planned and scheduled activities are best triggered as part of the organisation's normal work
management processes. For instance:
−− Process plant inspection activities, CP monitoring activities and monitoring equipment
servicing often reside as routines and events in planned maintenance databases.
−− Instrument output such as temperatures and gas dew point, are programmed into
the Digital Control System (DCS).
−− Manually managed inhibitor injection is included in operation instructions.
As a result, CM is not a standalone process and the scheduling of activities is integrated with
the operations and maintenance plans for any particular facility.
Work planning leads on to the development of work scopes and work packs for campaign
activities in the implementation process.
123
+44 (0)207 467 7100
F.2.4 Resource planning
The work plans identify or imply both the personnel and physical resources needed for
implementation.
Elements of the plan determined during the design phase should lead to the design and
construction of physical resources, e.g. inhibitor injection, gas drying and measurement
instrumentation.
Resources needed to execute the plan in the operational phase must be put in place and
include:
−− The operator's organisation and personnel. This will need to be integrated with the
resources needed by plans for technical support to other assets and plans for other
operational and maintenance activities.
−− Contracts for support personnel and specialist services, e.g. inspection, CP survey,
fabric maintenance, scaffolding, cleaning, etc.
−− Equipment and spares needed for the operator's own servicing activities.
Suitable planning processes need to be in place to manage the supply of personnel and
equipment to meet demands. Where inspection tasks require shutdown, or work at height
or over the side and subsea, offshore, long-term planning and commitment are essential
to secure the required resource so that inspection and fabric maintenance activities are not
delayed. Plans in the oil and gas industry can change with little notice, e.g. an unplanned
shutdown may bring forward the opportunity to carry out an inspection. Planning must
include a process to accommodate this.
F.2.4.1 Risk based inspection

RBI schemes are a planning tool used to develop the optimum plan for the execution of
inspection activities. RBI uses the findings from a formal risk analysis, such as a corrosion risk
assessment, to guide the direction and emphasis of the inspection planning and the physical
inspection procedures.
A risk based approach to inspection planning is used to:

−− ensure risk is reduced to a level ALARP;
−− optimise the inspection schedule;
−− focus inspection effort onto the most critical areas, and
−− identify and use the most appropriate methods of inspection.
The RBI methodology takes the criticality ranking (i.e. the risk of corrosion) and a grade,
which is a rating of confidence in the knowledge of the equipment item condition and of
the corrosion process, and combines them to produce an inspection interval. The interval is
therefore restricted if little is known so it increases the assurance that inspection is carried out
before deterioration is excessive.
The key features of RBI are contained in:

−− HSE CRR 363/2001 Best practice for risk based inspection as a part of plant integrity
management.
−− DNV-RP-G101 Risk based inspection of offshore topsides static mechanical equipment.
−− API 581 Risk based technology.
124
+44 (0)207 467 7100
F.3 DO
F.3.1 Risk profiling
A CRAS is a formal review that identifies the probability of a corrosion-related failure and its
consequences relating to the loss of containment and the consequential hazards should a
failure occur (see Figure F.1).
The purpose of the corrosion risk assessment is to rank the static equipment in relation to its
corrosion threats and make it possible to identify options to remove, mitigate or manage the
threats. It is a necessary precursor to strategic planning.
In the operational phase of the asset life cycle, the primary intent of the corrosion risk
assessment is to guide the inspection and corrosion monitoring activities in order to track
planned or known deterioration and to detect and measure unplanned corrosion problems.
The corrosion risk assessment is also used as the initial step for RBI systems.
Corrosion risk is normally expressed as the product of the probability of corrosion related
failure and the consequences of such a failure, where:
−− Probability of failure is estimated based upon the types of corrosion damage expected
to occur on a component.
−− Consequence of failure is measured against the impact of such a failure evaluated
against a number of criteria, which as a minimum would include safety, environmental
and operational impacts, resulting from a loss of containment.
Corrosion risk assessments can be carried out at two levels:

−− A high-level 'system' assessment which groups together components which are
constructed from the same materials and are subjected to the same process and
operating conditions.
−− A more detailed assessment, which looks at the vulnerability of specific components.
125
+44 (0)207 467 7100
RISK
To the Environment
Repair Costs
Loss of Production
Shutdown Time
To Company Reputation
Mobilisation Costs
OPERATIONS
HAZARDS
To People
el
nn o
rs
Pe
l
ne
n-
n
No
o
rs
Pe
pH2S
re
tu
ra
pe
Process Conditions
m
Te
Environmental Conditions
t
s er
De
ine
ar
M
il
So
Material of Construction
Figure F.1: Basis of corrosion risk assessment

Current Condition
EXTERNAL THREATS
Material of Construction
INTERNAL
THREATS
Consequence
Probability
X
126
+44 (0)207 467 7100
In each case the process facilities should be assessed for risks on the basis of:
−− internal corrosion threat;
−− external corrosion threat;
−− safety/hazard consequence;
−− environmental consequence, and
−− operability consequence.
Ideally the corrosion risk assessment identifies the corrosion/degradation threats to each
item of process equipment, assesses the remaining life, and feeds the information back into
the overall risk assessment and control system. The CRAS may also be used to assign priorities
for corrosion monitoring and CM procedures, including input into RBI planning.
As part of any CRAS, the sensitivity of the predicted corrosion rate to changes in the different
parameters (e.g. CO2, H2S, temperature, pressure, flow rate, water cut, etc.) should be
assessed. This will allow identification of the more critical parameters, where changes (in
some cases even small changes) over the facility’s operational life may be required.
Increasingly, Monte Carlo analysis methods are being applied to the predicted conditions, to
identify the likely range and distribution of corrosion over the range of operating conditions.
This allows a more reasonable approach to assessing risk, rather than relying on worst-case
scenarios.
F.3.2 Organisation
The Duty Holder responsible should ensure that the information inputs are correct but will
also improve the operation's buy-in to the risk assessment and also the RBI programme that
will normally follow from it.
In relation to the facility, the CRAS requires the input of current knowledge of:
−− operating parameters;
−− operating mode;
−− current design and original design;
−− history of failure;
−− metal loss, and
−− a current understanding of consequences of failure.
Up-to-date design and operating information, and inspection and monitoring history will be
required to conduct the corrosion risk assessment.
The Corrosion Engineer will normally collate and conduct an initial assessment of the data
and generate the corrosion rate predictions. The corrosion threat ranking and consideration
of the consequences of failure should involve a team consisting of, as a minimum:
−− the Corrosion Engineer;
−− an Inspection Engineer, with knowledge of inspection history, and
−− operations representative(s) with knowledge of current facility operation and
consequences of failure.
127
+44 (0)207 467 7100
F.3.3 Implementing the plan
in a cost-effective manner. The CMS document should describe the particular policies,
strategies, organisation, plans, implementation processes, review and audit which are to be
adopted for the facility's operation.
The detailed techniques and procedures to be used and followed during the implementation
phase should be clearly identified and developed. Written procedures are required for all
aspects of implementation of the CMPs in order to ensure consistency in the data collection,
definition of CONC and specification of clear lines of authority and reporting.
Table F.1: Example of procedures for an offshore platform
Procedure Notes
Preparation of a Specifying and implementing cleaning, access, etc. techniques
pressure system for to be used to identify the extent of the corrosion risk
inspection
Vessels, tanks and Specifying and implementing cleaning, access, etc. techniques
heat exchanger to be used to identify the extent of the corrosion risk
inspection
Pipework inspection Specifying and implementing cleaning, access, etc. techniques
to be used to identify the extent of the corrosion risk
Pipework corrosion Specifying and implementing cleaning, access, etc. techniques
monitoring surveys to be used to identify the extent of the corrosion risk
Topsides deck, riser Specifying and implementing cleaning, access, etc. techniques
and caisson inspection to be used to identify the extent of the corrosion risk
Underwater structural Specifying and implementing cleaning, access, etc. techniques
inspection to be used to identify the extent of the corrosion risk
Fabric maintenance Survey of coating condition
survey
Corrosion under Specifying and implementing cleaning, access, etc. techniques
insulation assessments to be used to identify the extent of the corrosion risk
Erosion monitoring Specifying and implementing cleaning, access, etc. techniques
to be used to identify the extent of the corrosion risk
Corrosion monitoring Removing and processing coupons, replacing probes,
servicing downloading data from local storage, etc.
Collection and Checking injection rates, tank levels
interpretation of
chemical analysis data
Cathodic protection Measuring potentials, on-off potentials
surveys
Inspection reporting Recording and reporting findings
Urgent reporting of Reporting of anomalies requiring immediate action
non-conforming plant
128
+44 (0)207 467 7100
Table F.1: Example of procedures for an offshore platform (continued)
Procedure Notes
Corrosion and Severity, frequency, time to repair
materials damage
reporting
Identification and Checking injection rates, tank levels
implementation of
corrosion inhibition
Root cause analysis of Process for preserving failed items and to undertake the
corrosion failures investigation
Annual corrosion Team required to undertake the review
status review and
follow-up
Records Organising paper records
administration
Corrosion monitoring Use of databases
databases
F.4 CHECK
F.4.1 Measuring performance
The corrosion risk assessment model should be maintained as a live database throughout the
asset life, requiring regular review of the data utilised and the assumptions used.
The results of the corrosion monitoring and inspection activities should be fed back into the
corrosion risk assessment model to validate its assumptions, or modify them accordingly.
A review during a period of changing conditions will ensure the risk ranking remains valid. A
review during a period of stable conditions will allow refinement of the model's assumptions
and can be used to justify a reduction in conservatism and reduce the risk rating of items.
F.4.2 Investigating accidents/incidents/near misses
The results of an investigation of in-service failures can be used in the corrosion risk assessment
to help reduce the likelihood of recurrence.
F.5 ACT
F.5.1 Reviewing performance
It is important to learn from past experience to improve CM and safety performance.
For non-stable process conditions detailed reassessment would normally be required at least
annually.
129
+44 (0)207 467 7100
For stable process conditions, with good historical trend data, the regular review could consist
of simply validating the process conditions and that confirming the assumptions used in the
corrosion risk assessment are still valid, rather than running the entire risk assessment every
time.
F.5.2 Minimise high risk
Case examples exist where, by running the corrosion risk assessment several times during
the first few years' operation of an asset (based on a better understanding of the actual, as
opposed to theoretical, conditions) has resulted in progressively fewer items being considered
as 'high-risk', thus reducing the requirements for inspection.
F.5.3 Learning lessons
An important element in CRASs and planning is learning lessons from problems and failures,
but also from successes.
130
+44 (0)207 467 7100
ANNEX G
IMPLEMENTATION AND ANALYSIS
G.1 INTRODUCTION
Planning and implementation forms the largest single part of any CM process.
Implementation is the means of executing the CMP.
Successful implementation of the strategic and tactical plans depends on bringing the
required resources (e.g. equipment and competent personnel) together with suitable
instructions for the implementation task and the reporting requirement. It is heavily
dependent on the performance of personnel and all of the organisational elements come
into play.
Planning and Implementation continuously and rapidly influence each other through
the internal flow of information. This constant 'self-regulation' works within the overall
framework.
G.2 PLAN
G.2.1 Policy
The approach to implementation and analysis is related to the company integrity policy and
strategy with the aim of keeping threats ALARP.
G.2.2 Planning
The CM Strategy will define the approach to Plan implementation and the analysis of
collected data.
These are the details of activities that are scheduled in the Planned Maintenance (PM)
database. The routine should either contain all the instructions required to define the activity
to the technician who carries it out or it should refer to appropriate procedures and work
instructions. If the routine stands alone it is important that it contains the performance limit
and instructions on the immediate action to be taken if the limit is exceeded.
PM Routines (PMR) are used for a wide variety of CM activities and use of the PM
system is preferred because the database will usually automatically issue a work order
to trigger the activity just prior to being due. So routines are used, for instance, to
trigger inspections, monitoring equipment servicing and CP surveys in order that
they are implemented at the required intervals. PM work orders can be issued to the
in-house operations, maintenance and inspection teams and to external contractors and
service companies.
Usually activities can be linked so that, for instance, an order can be issued for preparatory
cleaning and access provision as well as the order for inspection. Activities can be tagged
as dependent on shutdowns and other events so that their execution can be appropriately
managed.
131
+44 (0)207 467 7100
Operating instructions and measurements programmed into the plant control system:
−− Operating instructions should be provided to the operations technicians to specify
when tasks are to be undertaken.
−− Schedules should be provided to specify chemical treatment rates. Calculation
methods or ready reckoners should be provided to calculate the rates where they
derive from other parameters such as combinations of flow rate and water cut.
−− The instructions should specify the action to be taken if performance limits are
exceeded either relating to manual measurements by the technician (e.g. oxygen
content of water samples) or plant control system alarms (e.g. a gas stream water
dew point moving out of specification).
−− The facility's Distributed Control System (DCS) can in some cases be programmed to
react directly to parameters that exceed their limits. In other cases an alarm can be
initiated for operator action (e.g. if an inhibitor pump stops running).
−− The data collected by the DCS will normally be held in a database (or 'historian')
for a given length of time. Arrangements should be made to download records to
corrosion monitoring databases or for direct incorporation into analysis and into
status reports.
Work packs can be produced and issued with the work order. They are used where sufficient
information cannot be fully included in the PM routine. Work packs can include:
−− work pack completion form/punch list form;
−− responsibilities and coordination requirements;
−− work scope;
−− procedures/work instructions (copies or references);
−− work orders;
−− drawing index and key drawings;
−− report forms;
−− change control forms and change records;
−− daily report forms;
−− previous anomaly history, and
−− correspondence, e.g. queries and responses.
The work packs should include the performance limits of where measurements or
observations are being made. These can be included against items in a scope list or may
be included in procedures. The procedures should include instructions regarding the
immediate action to be taken if performance limits are exceeded.
Management of the corrosion risks is achieved through a combination of proactive and

reactive mitigation barriers and monitoring and inspection measures:
−− Proactive measures are where the requirements and implementation of the mitigation
barrier or monitoring/inspection system are identified and put in place before any
corrosion or deterioration has been observed. This is normally the case where the
corrosion risk assessment and strategic plan have identified performance standards
relating to mitigation success or allowable deterioration.
−− Reactive measures are implemented after a problem has been identified (either as a
consequence of proactive monitoring or because of an incident or observation of a
problem).
132
+44 (0)207 467 7100
G.2.3 Barriers and mitigation
Mitigation is inherently proactive and includes those barriers to corrosion failure that are
put in place as a result of initial threat assessments for design. This includes measures
like the use of CRAs, fluids processing such as gas drying and facilities and plans for
chemical inhibition. It also includes those things that can be planned to occur, such as
fabric maintenance.
Nevertheless, mitigation can be reactive and new measures can be taken when proactive
measures fail or unexpected corrosion mechanisms appear. This is essentially a type of
corrective action, which is discussed as follows.
G.2.4 Monitoring
Each barrier will have a performance indicator and its allowable limit that should not be
exceeded. It is necessary, therefore, to monitor the appropriate parameter and ensure that
the performance limit is not exceeded.
Proactive monitoring comprises:

−− In-line and on-line systems that involve the collection of data, which enhances
knowledge of the rate of corrosion degradation or effectiveness of inhibition and
process treatment and allows steps to be taken which will prevent failure.
−− Off-line systems are techniques that retrospectively identify corrosion degradation
and quantify the causes/onset, extent and degree to which it has occurred.
Reactive monitoring/inspection will normally be limited to off-line systems, and are also
normally aimed at quantifying the extent/distribution of any deterioration that has occurred.
Corrosion inspection and monitoring are key activities in ensuring asset integrity and control
of corrosion.
Field data and the results of laboratory evaluations should be trended to obtain up-to-date
corrosion information. Management decisions on equipment condition, prediction of
remnant life and requirements for chemical treating are only as good as the information
input provided from field experience.
Table G.1 gives examples of inspection and monitoring related to the performance limits for
various threats.
Consideration should also be given to the following points during the design of monitoring
programmes and analysis/interpretation of data:
−− Use of inspection data obtained during fabrication and pre-service testing can provide
baseline information.
−− Comparison of regular/continuous in-line/on-line monitoring data with less frequent
off-line inspections is needed to calibrate monitoring and establish acceptable
correlation for a particular production system.
−− Measurements from single points ('key point' UT and insert probes) should be
treated as suspect for the quantification of metal loss unless confirmed by back-up
information from other sources. Successive measurements can, however, be used to
infer trends in corrosivity.
−− Procedures should ensure that appropriate process data/information on water
cuts/CO2 / H2S contents is input into the corrosion data bank for later comparison
with corrosion trends.
133
+44 (0)207 467 7100
Table G.1: Example of barriers, performance limits and monitoring
Threat Barrier Performance Monitoring Monitoring Comment

limit (PL) method frequency
Internal Corrosion Meta loss > CA Wall thickness Determined NDT
corrosion allowance measurement by RBI measurement.
(CA) Ultrasonic
or profile
radiography
Cumulative Electrical Monthly 0,7 Factor of
loss > 0,7CA resistance safety. Measure
probe wall thickness if PL
exceeded
Corrosion Dose rate < DCS signals Continuous Dose rate = pump
inhibitor x ppm rate/treated Fluid
rate
Residual < Analysis of Weekly
y ppm sample
Erosion Corrosion Metal loss > CA Wall thickness Determined
allowance measurement by RBI
(CA) Solids rate > Erosion Continuous
z g/m3 monitor
Micro- Biocide Dose frequency Logged Monthly
biological dosage > monthly
corrosion Bacterial activity Analysis of Quarterly No contamination
< 102/cm2 sample is desirable
External Corrosion Metal loss > CA Wall thickness Determined NDT
corrosion allowance (Pipe, pipeline measurement by RBI measurement. Pit
(CA) and vessel) depth, ultrasonic
Metal Loss > or profile
0,1 t (Primary radiography. MFL
structure) or UT OLIV for
pipeline
Coating Degree of Visual Determined Ri4 is a visual
rusting > Ri4 assessment by RBI standard
(pipe, vessel
and structure)
No bare metal
(pipeline)
In-line systems cover installation of devices directly into the process, but which need to be
extracted for analysis, e.g. corrosion coupons, bio-studs, etc.
On-line monitoring techniques include deployment of corrosion monitoring devices either

directly into the process or fixed permanently to the equipment, such as:
−− electrical resistance (ER) probes;
−− linear polarisation resistance (LPR) probes;
134
+44 (0)207 467 7100
−− fixed ultrasonic testing (UT) probes;

−− acoustic emission;
−− monitoring of process conditions;
−− magnetic flux leakage in-line inspection of pipelines, and
−− field signature method monitoring spools.
Off-line monitoring/inspection is mainly achieved through the use of inspection and NDT
techniques, which include:
−− visual;
−− manual ultrasonic;
−− radiography;
−− pulsed eddy current;
−− magnetic flux leakage, and
−− time of flight diffraction (ToFD).
The use of alternative methods of detection should be considered in the light of any new
findings recorded. New inspection and monitoring technologies should also be evaluated
and considered as part of an ongoing system improvement process.
G.2.5 Unplanned activities
All activity should be planned at the strategic level. However, important events lie outside the
framework of the tactical plans that are delineated by RBI, etc. Procedures need to be in place
to capture the data presented by unplanned events.
G.2.6 Opportunity based visual inspection
OBVIs occur when an opportunity is presented to perform a condition assessment of

equipment as a result of production or maintenance outage or through production watch
keeping and planned maintenance activities. The data from the opportunistic inspections
should be fed into the inspection and corrosion databases to supplement the information
gained during planned inspections.
G.2.7 Material and corrosion damage reporting
Procedures should be in place to capture and report on corrosion and materials failures or
near misses. The MCDR procedure should be set up to facilitate rapid reporting of events and
the determination of corrective action by, or endorsed by, the appropriate TA.
The procedure relies on the workforce at the facility identifying and reporting corrosion
damage. To make this effective the MCDR process should a subject in the corrosion awareness
programme.
G.2.8 Data gathering and storage
Information from corrosion mitigation, monitoring and inspection activities should be

collated and to enable data assessment. This information should also include relevant process
conditions and chemical inhibition data.
135
+44 (0)207 467 7100
Examples of different sources of data:

−− data automatically captured by the plant distributed control system (DCS), e.g.
treated gas dew point;
−− data logged manually in operations, e.g. chemical tank dips;
−− data logged manually in formatted reports, e.g. NDT reports;
−− data logged automatically and transmitted to contractors for processing, e.g. certain
types of corrosion monitoring;
−− data logged by contractor's equipment and reported after processing, e.g. intelligent
pig data, and
−− data from corrosion and materials damage reports.
It is important that, irrespective of the reporting route, certain features are facilitated:
−− Measured values that exceed allowable performance limits (PLs) must be highlighted
and reported as a matter of urgency to the function responsible for immediate action
in the case of non-conformance. For instance, data collected by the DCS should be
monitored by an alarm function and data collected by NDT should be compared to
acceptance criteria by the technician.
−− Special reporting routes should be identified for data that require urgent attention
to prevent failure.
G.3 DO
G.3.1 Risk profiling
A risk assessment will be performed for each activity as required by the Company Health
Safety and Environment Policy and Integrity Policy.
G.3.2 Organisation
The duty holder is responsible for the implementation of the Plan and ensuring that all
required data are collected and analysed appropriately.
Successful implementation of the plan depends on bringing the required resources, e.g.
equipment and competent personnel, together with suitable instructions for implementation
of the task and the reporting requirement. It is heavily dependent on the performance of
personnel and all of the organisational elements that come into play.
G.3.3 Implementing the plan
Planned tasks should be implemented through instructions written into, for instance:
−− planned maintenance routines;
−− measurements programmed into the plant control system;
136
+44 (0)207 467 7100
−− work packs and procedures for inspection activities, and

−− instructions and work packs for the execution of service activities.
G.3.4 Data gathering
Typically the data gathered, and their typical sources, will include:
−− process conditions, highlighting any changes (from the DCS data historian);
−− chemical analysis (from plant logs or service company reports);
−− inhibitor quantities (from plant logs);
−− inhibitor Injection up time (from DCS historian or plant log);
−− inhibitor residual (from chemical supplier's analysis report);
−− bacterial analysis (from service company reports);
−− visual observations (from operator or inspector's report);
−− corrosion monitoring data;
−− weight loss coupons, (from service company reports);
−− ER probes (from DCS historian or service company reports);
−− LPR probes (from DCS historian or service company reports);
−− field signature method (FSM) (from service company reports);
−− fixed ultrasonic measurement systems (from inspector or service company reports);
−− galvanic probes (from DCS historian or service company reports);
−− erosion/sand probes (from DCS historian or service company reports), and
−− CP survey data (from service company reports).
G.3.5 Inspection data covering
−− ultrasonic inspection data (from NDT technician's report);

−− radiographic (gamma- and x-ray) inspection data (from NDT technician's report);
−− pulse eddy current (PEC) inspection data (from service company reports);
−− known process escapes/leak statistics (from plant logs);
−− corrosion damage reports (from inspection, maintenance or operations personnel),
and
−− data from on-line inspection of pipelines (from service company reports).
Not all inspection and monitoring systems are required or applicable for all assets/installations
and their use will be dependent on the type of corrosion process and material damage that
is expected.
G.4 CHECK
G.4.1 Measuring performance
The purpose of measuring performance is to ensure the implementation and analysis is being
conducted in accordance with the plan in an efficient manner.
137
+44 (0)207 467 7100
G.4.2 Data storage
During the planning and implementation stage, careful consideration of data storage,
data management and data analysis is required. Electronic data storage is considered
beneficial by many operators for ease of data management. However, manual paper-based
systems are also used successfully, especially for smaller or mature assets. In either case,
careful consideration should be given to the upkeep of data, where and how they are stored,
and who requires access to them. The latter point is particularly important where several
different organisations are engaged in the corrosion management process.
Main points for consideration include:

−− Data traceability and auditability.
−− The asset operator should take overall responsibility for data and data storage and
will always have ownership of the data; however, this does not necessarily mean a
requirement for them to be located on the operator's facility.
−− Computerised databases are not mandatory, although a formal, readily searched
database of some recognised format is recommended.
−− Common format computerised databases that will handle all the different types of
corrosion, inspection and process data are recommended, and can greatly assist data
analysis.
−− The ease of transferring data from contractor-to-operator and from contractor-
to-contractor should be considered.
G.4.3 Data analysis
The person responsibility for data collation and data analysis should be clearly identified, and
the reporting structure evident. The reporting period of corrosion data should be in keeping
with the potential safety impact of the data assessed, and should be delivered on time.
Key features of the analysis of corrosion data are:

−− comparison of measurement with the PL to identify non-conformity;
−− the prediction of remnant life;
−− the correlation of trends from different monitoring/inspection techniques;
−− the correlation of trends with operational parameters and operating events, and
−− application of relevant statistical analysis to allow correct extrapolation of data to the
whole structure/facility.
Presenting the data in graphical displays/spread sheets assists the data interpretation.
Databases are available that allow measurements from different sources to be displayed on a
common time base. This enables changes in corrosion rate to be correlated with mitigation
measures and changes in operating parameters.
There are many uncertainties associated with corrosion monitoring and inspection data,
resulting from limitations of techniques, variability of corrosion, human performance
variables, etc. In using data to develop trends rates, remnant lives, etc., consideration should
be given to the reliability of the data.
It is important to question any data value that is uncharacteristic. It may signal a step change,
but on the other hand it may have simply been incorrectly recorded or be in some other way
in error. All data should be validated to avoid erroneous data being used.
138
+44 (0)207 467 7100
All valid data will, nevertheless, have an inherent unreliability; therefore, it is important to
consider the precision of the results when comparing a result to a particular performance
standard, or calculating a rate of change, etc.
Statistical analysis of data can allow data variables to be considered.
Some operators and consultants use statistical analysis based on extreme value statistics
(EVS) to optimise the results of inspection programmes. For corrosion inspection, EVS provides
a method for reliably extrapolating limited information, and can, for example, identify the
most probable largest pit in a system.
In other cases, for instance, a simple comparison of the mean of two sets of readings can
reveal the order of difference between them.
Where wall thickness measurements are not taken at exactly the same sample point on each
successive inspection a simple analysis is not possible. However, meaningful data analysis can
still be obtained by using basic statistics.
Theoretical example: two separate inspections were carried out 18 months apart on a
production header by two different inspection companies who obtained 21 readings in the
first survey and 26 readings in the second.
Whilst some of the readings may have been taken at nominally the same point, it was not
possible to carry out a 'like-for-like' comparison, and originally it was concluded that the data
therefore had no value. Simple statistical analysis based on comparison of the means showed
that the average wall thickness had reduced by 1,1 mm over the 18-month inspection period
and that this change was statistically significant, at a 1 % level of significance, where a 1 %
level of significance implies that the chance of reaching a wrong conclusion is ≤1 %.
G.4.4 Anomaly reporting
Anomaly reporting, responsibilities and procedures should be in place to ensure that, when
anomalies are identified, they are reported in a timely manner and recommendations for their
resolution are acted upon. As discussed previously, inspection reporting and corrosion and
material damage reporting procedures should provide for fast track reporting of dangerous
anomalies. The reporting structure for anomalies is particularly important where alliances are
in place between the asset owner and one or more contractors.
Anomaly data should be reviewed on a priority basis to ensure that dangerous anomalies
receive the most urgent attention.
An example of anomaly grading:

−− LEVEL 1: Wall thickness loss actually or potentially breaching design code limits for
pressure retention or structural reliability.
−− LEVEL 2: Wall thickness loss trending towards Level 1. Underperformance of CP
systems. Under-dosing of inhibitors or excessive down-time.
−− LEVEL 3: Fabric maintenance anomalies.
The reporting format should be structured to ensure the key features and problems are
clearly evident, along with actions to be achieved.
139
+44 (0)207 467 7100
G.4.5 Investigating accidents/incidents/near misses
In keeping with company policy, a record should be kept of accidents/incidents and near
misses when implementing the plan.
If a serious failure or near miss occurs, or if persistent shortcomings in performance have not
been corrected, an RCA can be performed to ensure that corrective action is directed at the
root cause or causes.
Often, corrosion incident investigations tend to be either very extensive or limited to the
metallurgical evaluation of the failure.
A corrosion or materials failure investigation should, however, address a number of questions:

−− What was the mode of failure?
−− What was/were the barrier(s) to this mode of failure and why did it/they fail?
−− What was monitoring performance of the barrier(s) and why did they not detect
impending failure?
−− If relevant, was the performance standard appropriate?
−− Which function was responsible for the barrier(s) and monitoring, and why did the
system fail to manage the risk?
Normal company incident investigation procedures may be very resource-intensive and hence
only justifiable for major incidents.
In such cases, the best results may be gained by the employment of a specialist in RCA
techniques to guide Corrosion and Management System Specialists in appropriate directions,
taking an independent view.
The Bow Tie model of barriers shown in Figure G.1 may be useful for identifying the root
cause of corrosion related failures.
During the investigation consideration should also be given to CMS elements described in
other parts of this document. Annex K may be used to identify relevant factors by working
through the list, identifying relevant questions and assessing the responses.
140
+44 (0)207 467 7100
Materials of
construction
Condition of
Chemical automatic
injection shutdown systems
Risk-based Condition of
Inspections deluge system
inspection
Corrosion risk Unplanned

assessments event
Condition of Condition of
blast walls ESDUS
Cathodic Corrosion
protection management
Coatings
Condition of
escape routes
Policy
Corrosion and integrity

Corrosion and integrity
barriers to consequence of
barriers to unplanned event
unplanned event
Figure G.1: Example of bow tie view of corrosion barriers to failure
Materials of construction:
−− Suitable for duty?
−− Appropriate design used?
−− Operated within the design envelope?
Inspections:
−− Were they conducted correctly using the appropriate technique/procedure?
−− At correct intervals?
−− Human factors?
Corrosion risk assessments:

−− Correct input data used?
Policy:
−− Were the policies appropriate for the operations?
141
+44 (0)207 467 7100
Cathodic protection:
−− Correctly designed?
−− Operated correctly?
Coatings:
−− Correct specification?
−− Correct application?
−− Correct maintenance?
Risk-based inspection:
−− Risks assessed correctly?
−− Correct input data used?
−− Risk reviewed when required?
Corrosion management:
−− Have changes in production conditions/equipment items/operational changes been
accounted for?
Chemical treatment:
−− Correct chemicals used?
−− Correctly dosed?
−− Equipment, e.g. pump, failure?
−− Chemical under/over-dosing?
G.5 ACT
G.5.1 Reviewing performance
It is important to learn from past experience in order to improve future CM and safety
performance. The knowledge gained should provide feedback to benefit future CMPs.
G.5.2 Facility status review
Reviews of all mitigation, monitoring and inspection data, should be carried out periodically
by a competent person.
Their prime objective is to provide a clear statement of condition and continued suitability for
use. This can be for an item, a section of the facility or the whole facility.
G.5.3 Routine tactical review
It is common to use CMT meetings to conduct frequent reviews of data on an ongoing basis.
These may be held at intervals of between one and three months depending on the stability
of corrosion trends and the effectiveness of barrier activity. As these reviews consider recent
results of barrier/mitigation, corrosion and process monitoring and inspection activity, they
142
+44 (0)207 467 7100
are considered to be tactical reviews and will be used to look for short-term corrective action
requirements.
MCDRs and/or OBVI information should be reviewed monthly and summarised at the CMT
meeting. They should also review the effectiveness of corrosion control matrices.
A traffic light status system should be used to present information. A summary of the status
of each section and the required actions and the concerns and issues should be formed into
a summary review for the asset/installation and delivered to the facility manager.
G.5.4 Annual review
It usual to hold a wide ranging review annually for each section of an asset/installation. The
corrosion and inspection specialists will review all the data and publish them in a suitable format.
These reports should give a statement of the suitability of the equipment for ongoing service
and identify actions that are required to ensure it is safe to operate to CoP.
High levels of detail may not be suitable for all functions and the format of traffic light summary
may be used to display an overview to summarise the overall status and issues for a total facility
for the information of senior management, Figure G.1 and Table G.2 show examples.
It is good practice to hold a peer review sessions of the data. They should consider all the
reports for the sections of the facility to identify any shortcomings and to endorse the facility
sections' statuses.
Reviews should include consideration of:

−− inspection results;
−− corrosion monitoring results;
−− mitigation performances, e.g.:
−− inhibitor injected;
−− fabric maintenance;
−− gas drying;
−− corrosion damage reports;
−− opportunity based inspection results, and
−− the findings of the offshore verification scheme.
The difference between short-term and annual reviews is the period over which the data are
collected for the review. The output of the review can include:
−− assessment of the current corrosion risks and their changes;
−− a summary of mitigation activity;
−− a summary of inspection activity and results;
−− a summary of corrosion monitoring and results;
−− an assessment of current conditions and suitability for continued operation;
−− recommendations for action required, and
−− ongoing issues and concerns.
143
+44 (0)207 467 7100
Inspection and monitoring activities require some immediate review on completion of a

campaign. This would include, for example:
−− A review of the CRAS which should take place soon after the completion of the
inspection programme. The findings should be used to update failure probability
rankings and confidence factors so that they accurately reflect the current situation.
−− Assessment of the actual execution of inspection and monitoring work against
requirements.
Relevant information (e.g. changes in corrosion trends, significant wall thickness loss, loss of
mitigation effectiveness) and lessons learned should not only be fed back into the corrosion
risk assessment but also into the strategic and tactical plans.
These facility status reviews should be considered in the process for CMS review that is part
of performance review.
144
+44 (0)207 467 7100
+44 (0)207 467 7100
A B C D E
Has occurred Happens Happens
Has occurred Has occurred
in world-wide several times several times
in other part in specific
Severity industry but per year in per year in
of the part of
not in specific same location
organisation organisation
organisation organisation or operation Consequence Likelihood
Limited safety concerns Unlikely to fail in ≤3

High Risk
and production impact years
5. Catastrophic Downhole tubing

failure Medium Localised safety
Possible failure in
Risk concerns and/or
≤3 years
(ALARP) system/train shutdown
4. Server Major accident

Probable failure in
Low Risk implications on failure
≤3 years
and/or full field shutdown
Microbially
3. Critical influenced corrosion
145
on topsides
Likelihood Reducing
No clear plan for resolution or anticipated difficult
for the corrosion team to resolve
2. Marginal
A plan has been identified for resolution and is
in progress
Coating failure on
vessel A plan is in place and is well underway or the solution
1. Negligible is being monitored prior to removal from matrix
Consequence reducing
Note: Consequence of assessment is obtained using the above

guidance. Other factors may be considered and mentioned in the details
table and could include the time to, and the cost of, repair.
Figure G.2: Example traffic light summary of process facility
Table G.2: Example condition overview
Annual topsides review – asset/installation name

LOCATION: FPSO SYSTEM (Number) Crude oil system 505
SYSTEM DESCRIPTION: Crude oil system 1 stage separator vessel st
CORROSION Internal Carbon steel separator vessel with carbon steel pipework
RISKS including bridle pipework
The biggest internal corrosion threat is considered to be dead
leg corrosion in the bridle pipework
External Atmospheric corrosion (due to marine environment) is
considered to be the biggest external threat on the vessel
INSPECTION Internal UT of vessel revealed no corrosion issues
RESULTS UT revealed up to 10 % WT loss in low points of bridle
pipework
External Previous visual inspections did not reveal any areas of
significant general/localised corrosion on vessel
CORROSION MONITORING Weight loss coupons situated at 1st stage separator indicated
low rates of general corrosion and localised corrosion
Bacteria enumeration was previously low. However, there has
been a steady increase in bacterial count over the last 5 years
CHEMICAL TREATMENT/ Corrosion inhibitor currently injected upstream of the 1st stage
MITIGATION ACTIVITIES separator
CURRENT ASSESSMENT The 1st stage separator is in a suitable condition for continued
service
Further inspection will be required for the bridle pipework for
potential dead leg corrosion
Superficial atmospheric corrosion on vessel externally. Vessel is
suitable for continued service
ACTION REQUIRED Immediately 3 months 6 months
Further NDT to Consider Conduct inspection
confirm if dead extending to determine if
leg corrosion is bacterial surveys. further mitigation
present at low Revisit vessel measures are required
points in vessel RBI to revise (i.e. removal of
bridle pipework. inspection unnecessary pipework)
Flush with biocide interval
and corrosion
inhibitor if
required
Reviewed by: Jane Doe Date: 29 Jan 2016
Peer reviewed by: BE, NH, DH, FW Date: 14 Feb 2016
Integrity Engineer Approval: Bob Smith Date: 15 Feb 2016
Status: RED Issue: Potential dead leg corrosion requires immediate
investigation
146
+44 (0)207 467 7100
G.5.5 Corrective action
Once the barrier/mitigation and corrosion monitoring and inspection data have been
collected and analysed, the necessary corrective action(s) required need to be identified
and put into place. The options available will depend upon the type of facility and the nature
and extent of the anomaly identified.
There are four potential approaches to corrective action:

−− temporary safeguarding;
−− temporary reduction in pressure or allowed load;
−− temporary repairs, such as composite wraps on pipework, or
−− temporary cessation or reduction of production where inhibition is lost or reduced.
Temporary measures should be subject to approval by a competent Technical Authority which

would normally be given for a fixed period, after which it needs to be replaced by permanent
corrective action:
−− Action to restore:
– like-for-like replacement of pipework or structure;
– restoration of inhibition levels, or
– restoration of coating or linings.
−− Action to improve. This needs to be considered if simple action to restore will result in
another early failure or if failures are already frequent. It will be one of the following:
– a change of materials;
– modification of chemical treatment;
– change of coatings and linings;
– modification of CP settings or facilities;
– permanent modification of process settings, or
– modifications of design details.
Any action to improve must be processed through an appropriate MoC procedure.
Continued operation may be allowed pending action but this should be endorsed
only by a competent technical authority and normally only permitted for a fixed
period without further review.
The practicality and economic impact of different options will depend on the life cycle stage
of the facility i.e. new build, major refurbishment or existing and ageing asset. Certain
corrective actions may be taken quickly whilst others, particularly improvement actions, may
require time to implement. It is important that corrective action requirements are registered
in a monitored list and that progress towards implementation is tracked, especially if a
dispensation is given to continue operation pending action. Various methods employing text
or spreadsheet lists and a variety of databases have been used successfully.
Positive acknowledgement of the completion of actions is required in order to guarantee

that the loop from reporting the anomaly to resolution is completed. Completion should be
verified by the TA.
Relevant information and lessons learned should be fed back into the corrosion risk
assessment document.
G.5.6 Learning lessons
Lessons learned following all reviews should not only be fed back into the corrosion risk
assessment but also into the strategic and tactical plans.
147
+44 (0)207 467 7100
ANNEX H
AUDITS
H.1 INTRODUCTION
Audits are performed to appraise the effectiveness of the CMS and to provide an independent
view of performance and identify opportunities for improvement.
Audits are an essential check on the performance of the CMS and will normally be carried
out by an independent party. In principle, the audit would cover a review of the management
processes being employed to ensure the continued integrity and maintenance of equipment.
The audits cover all aspects of:
−− implementation of procedures and processes;
−− competency;
−− checks in place, and
−− compliance.
Audits do not review the achievement of performance targets, but do review the processes
and procedures aimed at achieving those targets, and determine if the procedures for
ensuring that they are being achieved are being appropriately implemented. Where activities
are identified as not being conducted in accordance with the procedures and processes they
will be defined as non-compliant.
H.2 PLAN
H.2.1 Policy
Offshore UK, the Safety Case Regulations (SCR) require the Duty Holder/Operator to
demonstrate that adequate arrangements for audits have been put in place.
H.2.2 Planning
Audits may be planned in two ways:

−− a complete audit of all elements of the management system can be conducted in
one exercise, or
−− individual elements may be separately audited on a rolling basis.
To allow time for auditing, reporting, corrective action, close-out and stabilisation of the
improved system, the duration of the audit cycle will generally need to be two to three years.
In addition to complete CM audits, more frequent internal audits should be carried out
covering specific procedures or implementation in specific units or by specific functions.
Contractors' procedures will be audited on award of contract, if not covered by prequalification,

and then audited periodically in the same way as the operator's procedures.
148
+44 (0)207 467 7100
H.3 DO
H.3.1 Risk profiling
A risk assessment should be performed for each activity as required by the Company Integrity
Policy.
H.3.2 Organisation
Audits should be carried out by persons sufficiently independent to ensure that their
assessment is objective.
In most instances, audits are carried out by independent organisations on behalf of the
Duty Holder/Operator. The Duty Holder/Operator is usually responsible for ensuring that
appropriate remedial action is taken.
This process will ensure that the audit cannot be closed-out until all actions are cleared.
Audits may be carried out by either external third party organisations or by an in-house
independent consultancy group. In all cases, it is important that the auditors are not directly
involved in the day-to-day operation of the CMS and are trained in audit practice.
The more frequent audits relating to specific aspects of the assets or functions can be carried
out by in-house personnel, provided they are appropriately independent of production and
trained in audit practice.
H.3.3 Implementing the plan
The success of audits depends on the implementation and maintenance of a fully auditable
structured framework including clearly defined responsibilities and roles.
Audits should be carried out by trained, competent persons. Where outside organisations
are employed for independent audits, the individuals should be appropriately competent.
The audits will include review of procedures, review of records and discussions with relevant
company personnel. Audit reports should include progress results and recommendations.
Highlights from the annual audit reports and all in-house audits should be disseminated to
all relevant personnel. Details of the in-house audits and findings should be made available
to the independent auditing body prior to the annual audit.
Wherever practicable, checklists should be developed for specific processes/installations in

order to ensure consistency of audits and to ensure appropriately comprehensive cover. An
example of an audit checklist is given in Annex L.
H.4 CHECK
H.4.1 Measuring performance
Checks should be in place to ensure all activities are compliant with procedures and processes.
149
+44 (0)207 467 7100
Checks to ensure that procedures and processes are being complied with include:
−− Review of documentation and records to assess conformance.
−− Review of records of non-conformances and incidents to ensure that.
– Appropriate investigation was undertaken in accordance with the procedures.
– Any investigation was effective and that any necessary changes to procedures
and processes to prevent recurrence have been developed.
– Changes have been incorporated into the procedures and processes.
– Changes are being implemented.
– Tracking of specific procedures and processes to ensure compliance, including
competency of responsible individuals, departments and organisations including
correct implementation, reporting and reaction.
H.4.2 Investigating accidents/incidents/near misses
Audits do not include identifying the cause of incidents/accidents/near misses, but rather
ensuring that the procedures and processes are in place to respond appropriately.
H.5 ACT
H.5.1 Reviewing performance
It is important to learn from past experience in order to improve the auditing process. The
results are fed back into the planning strategy.
−− wherever non-compliances are identified; this should result in the following
programme:
−− investigation of cause(s);
−− assessment of changes to procedures/processes to prevent recurrence;
−− implementation of changes, and
−− when a non-compliance is identified, the audit should not be closed-out until the
appropriate changes have been implemented.
H.5.2 Learning lessons
Lessons learned from audit findings should be fed back into the policy and planning strategies.
The CMS audit is often carried out as part of a general audit of an organisation's operation.
However, for the most benefit to be gained, it is important that the results, in particular the
recommendations and list of improvement actions identified in the audit, are recorded within
the CMS and its improvement action tracking system.
150
+44 (0)207 467 7100
ANNEX I
OIL AND GAS PRODUCTION AND PROCESSING CORROSION
THREATS AND MITIGATION
The sections of this Annex give overviews of the top corrosion threats and main corrosion
mitigation methods encountered in oil and gas production and processing. Each section
overview describes the threat or mitigation itself and then describes how it is managed by
reference to the CM model.
The sections have been written by members of the work group and reflect one professional
view of the threat or mitigation method and its management. They may be used as an
introduction to each topic and as a stepping stone to wider sources of information and
advice. They should not be seen as a complete guidance to the topic.
The sections and their topics are as follows:

−− I.1 Carbon dioxide corrosion
−− I.2 H2S corrosion and cracking
−− I.3 Amine corrosion
−− I.4 Oxygen corrosion of seawater and water injection systems
−− I.5 Microbially influenced corrosion
−− I.6 Dead leg corrosion
−− I.7 Galvanic corrosion
−− I.8 Weldment corrosion
−− I.9 Grooving corrosion of pipelines
−− I.10 Flange face corrosion
−− I.11 Atmospheric external corrosion
−− I.12 Corrosion under insulation
−− I.13 Stress corrosion cracking and localised corrosion of stainless steels in
chloride environments
−− I.14 Erosion/corrosion
−− I.15 Black dust in gas pipelines
−− I.16 Mercury cracking. New revision
−− I.17 Caisson corrosion
−− I.18 Hydrogen failure mechanisms
151
+44 (0)207 467 7100
I.1 CARBON DIOXIDE CORROSION
I.1.1 Description
Carbon dioxide (CO2) corrosion35, 36 is usually the main corrosion mechanism for carbon steel
materials exposed to produced fluids from oil and gas reservoirs. It is also called 'sweet
corrosion' and takes place in the gas-water-hydrocarbon multiphase system.
CO2 is a naturally occurring component of reservoir fluids and is an acid gas; when dry,
CO2 is itself not corrosive at temperatures encountered within oil and gas production
systems, but is so when dissolved in the water phase (in proportion to its partial pressure)
to form carbonic acid (H2CO3). One of the mechanisms proposed and widely accepted in
the industry was postulated by de Waard et al(1) where the carbonic acid then partially
dissociates to form the bicarbonate ion, which can further dissociate to yield the carbonate
ion in both instances increasing the acidity by releasing an H+ ion:
CO2 + H2O H2CO3(1)
H2CO3 + e− H+ + HCO3(2)
It is recognised that solutions containing dissolved CO2 (and hence H2CO3) are more
corrosive to CS than solutions of strong acids, such as hydrochloric (HCl) or
sulfuric (H2SO4), at the same pH, due to the large reservoir of CO2 meaning the H2CO3 is
not depleted. The corrosion rate of CS is directly related to the concentration of the CO2
(expressed as mole % or volume % in the gas phase) and the total pressure, known as CO2
partial pressure. The corrosion rate also increases with temperature but at higher temperatures
(greater than ~60 °C) in produced waters the formation of iron carbonate (FeCO3) can reduce
the corrosion rate by increasing the pH and buffering the solution.
The solubility limit of iron carbonate salts (FeCO3) may be exceeded above certain
temperature and pH combinations causing it to precipitate. This iron carbonate precipitate
may form a protective film depending on the solution composition, pressure, temperature
and flow dynamic. Iron carbonate films/scales are prone to removal leading to both pitting
and general forms of metal loss, depending on flow conditions.
CO2 corrosion is associated with the water phase, and is therefore likely to be located where
water is consistently in contact with the metal surface. Such areas are typically around the
6 o'clock position in piping; however, CO2 corrosion may also be seen around the 12 o'clock
position where uninhibited water vapour condenses on the metal surface in ToL corrosion
(see next paragraph). CO2 corrosion is also likely in dead legs and other water traps, including
irregularities at welds. In the presence of high velocity flow, its effect on CO2 corrosion is
exacerbated by increasing the mass transfer of the corrosion products toward and away from
the metal surface.
CO2 corrosion manifests itself in many forms, general wall loss, 'mesa' type attack, and
pitting. Localised and pitting corrosion most commonly occurs in areas of turbulence and
sometimes at the root of welds. Generally, corrosion may occur in gas compression or gas
overhead systems if the steel surface is completely water wetted. Pitting generally leads
to small hole sized leaks. Mesa attack occurs by the breakdown of protective scale (above
~60 °C). Preferential weld or heat affected zone (HAZ) attack may also occur especially in
Ni-containing welds particularly in gas or condensate systems with low chloride condensed
water and low conductivity. Another mechanism associated with CO2 corrosion is top of the
line (TOL) corrosion which is due to the condensation of water containing dissolved CO2 and
152
+44 (0)207 467 7100
usually occurs in wet gas pipelines and in stratified flow regime. Weldments and HAZ can be
more severely affected by CO2 corrosion than parent material, where in the welds the filling
material tends to be slightly anodic to the parent steel, causing the weld metal to corrode at a
higher rate than the parent. HAZ can also be susceptible due to microstructure changes from
the welding process. Other susceptible areas to CO2 corrosion are regions other than HAZ
where the metal has been heated and the microstructure has changed, known as ringworm
corrosion when in the upset region of piping such as well tubulars.
CO2 corrosion is also affected by the presence of H2S and organic acids, chlorides, and
oxygen. The presence of H2S in combination with CO2 will influence the corrosion on
carbon steel. Low concentrations of H2S in the presence of CO2 can reduce the corrosion
rate due to the formation of protective FeS corrosion product scale. However, localised
pitting corrosion may result where the scale becomes disrupted or damaged. Turbulent
flow and also the presence of formation water with high chloride levels can damage the
protective scale; this is called flow influenced corrosion. Flow influenced corrosion is distinct
from erosion–corrosion and is primarily a corrosion process aided by chemical dissolution
and mass transfer.
In condensed waters, typically found in processed gas systems, corrosion may be very
aggressive due to low pH conditions as a consequence of there being no buffering effect
from the bicarbonate ions that are usually present in produced waters. The presence of
organic acids in produced fluids will also impact corrosivity.
In boiler feed water and steam condensate systems CO2 (along with carbonate ions) is
produced in the boiler by decomposition of bicarbonate ions. The CO2 dissolves in condensed
steam, and forms carbonic acid.
Various CO2 predictive models have been developed that take inputs of the main factors that
impact CO2 corrosion rate and either empirically (from historical field and laboratory datasets)
or mechanistically derive a corrosion rate. These models must be used with caution and a
knowledge of how they handle the various factors such as benefit from scaling etc.
I.1.1.1 Susceptible systems

Process oil, gas and condensate systems, produced water systems, boiler feed water and
steam condensate systems.
I.1.1.2 Susceptible materials

Carbon steel (CS) and low alloy steels.
I.1.1.3 Failure mode

Corrosion leading to through-wall hole or thinning leading to rupture.
I.1.1.4 Typical failure locations

Corrosion can occur along the bottom surface of pipework if there is a separate water phase,
at ToL, if condensation in a wet gas system occurs and in turbulent flow areas at bends, tees,
and weld locations (PWC).
I.1.1.5 Factors affecting CO2 corrosion

−− precipitation or dissolution of FeCO3;
−− presence of H2S leading to formation of FeS on the internal surface of the CS;
−− presence of organic acids (i.e. acetic acid);
153
+44 (0)207 467 7100
−− inhibition;
−− presence of Glycol, and
−− shear stress due flow hydro-dynamics.
I.1.1.6 Morphology of corrosion

−− pitting corrosion;
−− uniform corrosion;
−− honeycomb pattern;
−− ringworm corrosion;
−− heat-affected corrosion, and
−− mesa attack.
Figure I.1: Preferential weld corrosion
Figure I.2: Preferential weld and HAZ corrosion
154
+44 (0)207 467 7100
Figure I.3: Uniformly distributed pitting corrosion
Figure I.4: Flow influenced corrosion
155
+44 (0)207 467 7100
Figure I.8: Isolated pit
156
+44 (0)207 467 7100
I.1.2 PLAN
I.1.2.1 Policy
Safety, environmental and commercial policies influence the choice of strategies for mitigation
and monitoring/inspection.
Mitigation strategy options include:

−− Materials selection, which is usually determined by the life cycle cost during design
of piping systems and vessels. Options below may be a choice:
– CRA, e.g. duplex stainless;
– use of stainless steel where applicable, e.g. SAE316L, SAE904L, 6Mo;
– low allow steel with corrosion allowance;
– as above, with CI;
– low alloy steel and internal coating, and
– low alloy steel and internal SS/CRA cladding.
−− When weldments cannot be avoided, strict quality control is required, including the
appropriate filler material and control of microstructure.
−− In the design process, avoid the introduction of deadlegs and high velocity flow.
−− Use of applicable and available corrosion modelling to aid the design of the system
and support the CMS.
Monitoring/inspection strategy can include:

−− Process parameter monitoring, e.g. operating temperature and pressure, dew point,
CO2 % in the gas phase, online dew point control in dry gas pipelines.
−− Monitoring corrosion inhibition strategy, e.g. injection rate, chemical residuals,
chemical injection pump integrity.
−− Corrosivity monitoring, e.g. weight loss coupons, online ER probes.
−− Inspection regime, e.g. intrusive inspection, non-intrusive inspection, in line inspection
(ILI) and on line inspection (OLI) of pipelines.
−− UT data management, e.g. statistical analysis, fitness-for-service.
I.1.2.2 Planning
The CMS plan may be part of a wider Integrity Management Plan and CMS. For offshore
installations the strategy plan should be in line with the verification scheme. For onshore
plants, inspection schemes will be part of statutory WSE for pressure systems.
Tactical plans may jointly cover activities relating to other related internal corrosion
mechanisms, e.g. CO2 corrosion, PWC, deadleg corrosion, MIC, corrosion under deposits.
The plans should be translated into an executable plan and schedule for implementation.
The CMS needs to specify the plan with the activities to be carried out to reduce the identified
risk of CO2 corrosion ALARP. These activities can include:
−− mitigation measures;
−− monitoring methods and frequencies;
−− definition of KPIs;
−− anomaly management, and
−− organisational responsibilities for planning, execution, mitigation, monitoring and
reporting.
157
+44 (0)207 467 7100
The plan can include:

−− competency development plan;
−− WSoE at corrosion circuit level, pressure vessels, deadleg register;
−− plan instrumentation and data collection;
−− RBI elements;
−− planned maintenance routines, e.g. for inspection, corrosion monitoring services,
chemical sampling and analysis;
−− inspection and corrosion monitoring service work packs in which the responsibilities,
coordination, instruction and scope are well defined, and
−− attendance to the Corrosion and Chemical Management meetings.
I.1.3 DO
I.1.3.1 Risk profiling

Direct measurement gives the most accurate results. Corrosion modelling and rate
predictions can often give variable results; however, this can provide a relative indication on
the corrosion rate.
An element of judgement may be required to produce a useful result.
The probability of CO2 corrosion occurring can be predicted with consideration given to
following factors:
−− CO2 and H2S composition (mol %) in the gas phase;
−− water chemistry (pH, including bicarbonate and VFA, 12 ion analysis, CI residuals);
−− operating conditions (pressure and temperature);
−− microbial analysis;
−− Flow dynamics (gas/oil/water flowrates) including velocity and solids content;
−− material type;
−− on-line corrosion monitoring data (probes and weight loss coupons historical data);
−− CI testing and qualification using representative electrodes in the simulated process
environment;
−− quantitative predicted corrosion rates for the anticipated mode of corrosion,
e.g. localised, uniform, and
−− inspection observations and NDT data analysis.
I.1.3.2 Organising
All personnel involved should be made aware of the factors affecting CO2 corrosion including
preferential weldment corrosion and be vigilant to recognise the indications of, or changes
that are likely to cause or exacerbate, these.
Personnel should respond appropriately to any condition recognised to pose a threat and
rectify the situation through effective communication with the relevant organisations.
Organisational roles that can be involved include:

−− Corrosion and Materials Specialists;
−− Production Chemical Specialists and chemical suppliers;
−− facilities operations teams;
158
+44 (0)207 467 7100
−− Inspection Engineers and NDT contractors, and

−− corrosion and chemical management team.
I.1.3.3 Implementing the plan

The strategic plan shall then be implemented such that the planned activities can be carried
out at the specified frequency.
Key requirements for implementing the plan:

−− adequate allocation of resources;
−− sufficient training and corrosion awareness of personnel, and
−− well-defined reporting/communication routes, including clear reporting procedures
that address and rectify any out of specification incident.
The following shall be monitored:

−− process parameters; pH, partial pressure of CO2, temperature, water/hydrocarbon/
gas flow rates, water chemistry;
−− corrosion rates using weight loss coupons/ER probes;
−− chemical treatment and CI injection, and
−− inspections; in-line inspection, NDT.
The collected data can be plotted to identify any correlations between process conditions,
treatment changes and inspection/corrosion rate trends. Statistical analysis can be applied to
enhance the value of NDT data.
Specialist asset management databases are available to help organise this information.
Corrosion damage reports and maintenance reports should also be stored with the data so
as to be traceable.
The data gathered, with the aid of specialist database/tools, should be analysed in order to:
−− trend the uniform or localised corrosion rate;
−− assess if the mitigation implemented is able to reduce CO2 corrosion risk effectively;
−− determine root cause of any process upsets, e.g. change in operating pressure due to
hydrates, CI injection underdosing due to lack of availability, and
−− predict the likely corrosion rate and remaining life of the system or vessel.
I.1.4 CHECK
I.1.4.1 Measuring performance

Performance targets should be set in the strategic plan.
The following can be used as proactive (leading) indicators:

−− chemical injection rates (e.g. actual CI dosing versus planned);
−− occurrence and frequency of process parameters, such as CO2 and H2S, that are out
of specification;
−− effectiveness of response/corrective actions taken in the event of out of specification
process conditions;
−− completion of inspection activities against plan and schedule, and
−− peer reviews completed.
159
+44 (0)207 467 7100
The following can be used as reactive (lagging) indicators:

−− frequency of CO2 corrosion related leaks, and
−− corrosion monitoring results against target corrosion rates based on required life
and corrosion allowance.
I.1.4.2 Investigating accidents/incidents/near misses

Investigate the causes of corrosion and degradation related incidents and accidents in order
to reduce the likelihood of reoccurrence.
The investigation will be in accordance with the CM strategic plan which may be part of a
wider Integrity Management Plan.
The root cause analysis of CO2 corrosion failures or management system failures will be
investigated with the appropriate corrective action(s) recommendation.
I.1.5 ACT
I.1.5.1 Reviewing performance

The overall performance review should include consideration of a), b) and c) below together
with verification findings for offshore installations and audit results. If indicated, the strategic
plan may require correction.
The performance review should include the following:

a) Annual (and, if appropriate, quarterly) reviews of CO2 corrosion mitigation, monitoring
and inspection outcomes. Corrective action for these programmes if indicated.
b) Review of performance measures, in particular the assessment of reactive indicators
and the overall trends in proactive indicators. Corrective action in strategy, organisation
and planning, if indicated.
c) Root cause analysis of CO2 corrosion related failures or management system failures
with appropriate corrective action recommendation.
I.1.5.2 Learning lessons

Any activity relating to the management of CO2 should be included in the CMS audits.
I.2 H2S CORROSION AND CRACKING
I.2.1 Introduction
Sour service is broadly understood to mean environments (typically multiphase, wet gas or
produced water) in which more than a certain level of H2S is present. There is no universal
threshold of H2S that defines 'sour'.
Hydrogen sulfide (H2S) is an exceedingly toxic gas, which poses a very serious health and
safety threat. It is present naturally in some oil and gas reservoirs and it can be generated by
anaerobic bacterial activity during production, most commonly when sulfate-containing water
(e.g. seawater) is injected for enhanced recovery. It can also be generated in downstream
plant during production, processing and storage operations. H2S is fairly stable, though it can
be oxidised to elemental sulfur by reaction with strong oxidisers such as oxygen, Fe³+ and Cl2.
160
+44 (0)207 467 7100
H2S readily dissolves in water at the temperatures and pressures encountered in many
production situations to form an acidic aqueous electrolyte which is corrosive to some
metallic materials. Usually the acidifying effect (and hence the contribution to corrosion) of
H2S is less than that of CO2 and hence the fundamental corrosion is essentially CO2 corrosion.
The main effects brought about by the presence of H2S on the corrosion of steel are the
formation of iron sulfide corrosion products and the promotion of uptake of atomic hydrogen
(H0) formed during corrosion.
When iron sulfide forms on the steel surface (rather than precipitating away from the
surface) it creates a film that can be protective, by reducing the general (CO2) corrosion
rate. That reduction can be dramatic (a factor of 100 reduction or greater) but present
knowledge does not allow its modelling or prediction. The degree of protection depends on
several factors including temperature, water chemistry and pH. Incomplete surface coverage
allows localised attack in the form of sulfide pitting. The metal penetration rate within the
pits is considered to be of the order of (and sometimes greater than) the sulfide-free CO2
corrosion rate. Inhibition of sulfide pitting is problematic and it is likely that, once pits have
initiated and grown to a critical depth, inhibitors cannot penetrate the pits and nor can
sulfide ions to film the active site. Some CIs can increase the sulfide pit penetration rate.
The majority of the H0 generated in the cathodic reaction of the corrosion process combines
forming hydrogen molecules (H2) which diffuse away with the process fluid. (At normal
operating temperatures and pressures molecular hydrogen does not diffuse into steel.)
However some of the H0 can enter the corroding metal. The presence of an iron sulfide film
on the metal surface increases the proportion of that hydrogen that enters the metal. This
hydrogen can cause embrittlement, cracking and blistering of susceptible metals.
I.2.2 SSC
Sulfide stress cracking (SSC) affects carbon and low alloy steels and martensitic stainless
steels. Cracking is the result of application of a tensile stress to a metal embrittled by the
presence of H0. It is therefore essentially hydrogen embrittlement of a susceptible metal, with
corrosion being the source of the hydrogen. The role of sulfide is to encourage a significant
proportion of the H0 to enter the steel, by preventing the formation of molecular hydrogen
on the metal surface.
As the risk of hydrogen embrittlement (HE) reduces with increasing temperature (i.e. mobility
of the hydrogen atoms in the steel lattice) the risk of SSC also reduces in the same manner.
However, SSC is a very rapid cracking mechanism, therefore even a short time, especially at
near ambient temperature (such as when a component cools during a process interruption),
is sufficient to cause cracking. It is therefore unsafe to use a susceptible steel for use in sour
service on the basis that the process normally operates at temperature high enough that HE
would not be significant.
The dominant factor in determining a steel's resistance to SSC is its hardness. Empirically it
has been found that steels of hardness below 22 HRC rarely fail in sour service, therefore this
hardness value was adopted as the original criterion for SSC-resistant steel. More recently
it was recognised that the H0 flux into the steel is also a significant factor and currently
the risk of SSC is defined in terms of the combination of the H2S content and pH of the
aqueous phase in contact with the corroding steel. The steel's hardness is a function of its
microstructure and heat treatment condition. Guidelines for the selection of SSC resistant
steels therefore specify acceptable heat treatments as well as imposing limits on hardness
and some other parameters.
161
+44 (0)207 467 7100
SSC is a rapid cracking mechanism, therefore it is unsafe to use a susceptible steel in sour
service with the intention of using inspection as a control option. SSC frequently results in
catastrophic failure, i.e. no warning by a small leak.
I.2.3 SCC
A number of CRAs are susceptible to stress corrosion cracking (SCC) in sour service. Whereas
SSC is essentially hydrogen embrittlement, SCC is an anodic process in the same way as
classic chloride SCC of austenitic stainless steels. The role of the sulfide ion is to prevent the
natural repassivation process that occurs on CRAs (within pits and cracks); in this way sulfide
acts synergistically with chloride ions to initiate and propagate pits and cracks. The presence
of a high enough tensile stress results in SCC.
I.2.4 HIC
Carbon and low alloys steels are susceptible to hydrogen-induced cracking (HIC). Note
that the terminology of hydrogen degradation mechanisms varies across industries and
between scientists and engineers. The terminology employed in this Annex is that adopted
by NACE. In HIC, the H0 diffuses (harmlessly) through the steel until it reaches trap sites
where it combines to form hydrogen molecules. Sites where this occurs include planar
inclusions (typically MnS) and regions of anomalous microstructure (e.g. banding) produced
by segregation of impurity and alloying elements in the steel. Cracking is planar in character
(as the MnS inclusions in rolled plate are parallel to the surface) and cracks can join these
planes, resulting in step-wise cracking (SWC).
There is no clear H2S threshold for HIC. The risk of HIC increases with H2S content of the
aqueous phase and cracking can occur at very low H2S contents if the pH is low, i.e. if the
corrosion rate (and hence the flux of H0) is high.
The risk of HIC reduces with increasing service temperature as the probability of the hydrogen
atoms falling into traps reduces. Some users consider the risk of cracking is negligible
above 65 °C.
No externally applied stress is required for the formation of HIC. This form of cracking
typically occurs in lower strength steel that is rolled; this includes plate steel used for
the manufacture of vessels and seam-welded pipe. The adoption of modern steelmaking
practice has resulted in the incidence of HIC having reduced over the past 40 years.
Specifying a maximum sulfur content or calcium treatment (which creates round CaS
inclusions in place of flat MnS inclusions) reduces the risk of HIC occurring. However,
to ensure resistance to HIC it is necessary to test each heat in accordance with NACE
TM0284. Less commonly other product forms including forgings, castings and seamless
pipe can suffer HIC.
Typically HIC progresses sufficiently slowly to allow its monitoring (by inspection) so as to
prevent catastrophic failure in even a susceptible steel.
Other H2S cracking mechanisms are much less commonly encountered. These include
stress-oriented hydrogen-induced cracking (SOHIC), in which HIC cracks progress under the
influence of an applied or residual stress (usually at welds) and soft-zone cracking (SZC), which
is a form of SSC that occurs in regions of low yield strength material (typically associated with
a weld in carbon steel).
162
+44 (0)207 467 7100
Figure I.9: Example of microblisters on internal surface of a flow line
Figure I.10: Example of pitting corrosion on internal surface of flow line due to
hydrogen sulfide corrosion producing stress raising features and resultant lateral
cracking from the pits
Figure I.11: Example of SSC in a susceptible steel matrix showing both intergranular
and trans-granular crack propagation features
163
+44 (0)207 467 7100
I.2.5 PLAN
I.2.5.1 Policy
H2S-induced cracking can cause catastrophic failure of pipelines, piping, vessels and valves
resulting in the release of hydrocarbons and toxic gas. Company's Integrity Policy and Strategy
should therefore be to avoid such failures or at least to keep the risk ALARP.
I.2.5.2 Planning
The CMS for any plant operating in sour conditions will include planning for the prevention
of H2S-induced corrosion and cracking.
This involves establishing whether H2S is present in a process stream or whether it may be
present at a future date, e.g. by reservoir souring or incorporation of future tie-ins.
If H2S is present, or anticipated, appropriate mitigation measures should be planned.
I.2.6 DO

The likelihood of H2S levels exceeding threshold levels (representing sour service with respect
to the materials of construction at a facility) should be assessed.
Activities may include:

−− periodic review of well fluid composition data;
−− assessing the reliability of the measured H2S content, and
−− conducting a reservoir souring study to predict future H2S contents.
If H2S is present or anticipated a Corrosion Threats Assessment Study should be performed.
Activities may include reviewing materials of construction of the existing facility for their
resistance to H2S corrosion and cracking.
H2S corrosion (i.e. sulfide pitting) can sometimes be controlled by inhibitor treatment but this
is not always easy or even possible. Internal coating of vessels may be more cost-effective
than inhibition. It is not usually practical to internally coat piping, therefore if the corrosion
allowance is insufficient to accommodate the rate of pit penetration, piping may require to
be replaced (typically in a CRA).
SSC and SCC can only be prevented by correct material selection, therefore changes to
some materials of construction may be required. Coating and inhibition are not appropriate
corrosion control measures for SSC and SCC.
HIC can usually be monitored (it progresses slowly in all but the most aggressive conditions)
if access for an appropriate inspection technique is available. This provides advance warning
of the need for replacement.
I.2.6.2 Organising
That part of the Duty Holder which is responsible for managing corrosion risks should
arrange for the preparation of mitigation measures to control any anticipated H2S corrosion
and cracking degradation.
164
+44 (0)207 467 7100

Replacement of small quantities of material might be achieved during planned shutdowns

of short duration.
If extensive changes are required to materials of construction this will normally require a
major shutdown.
I.2.7 CHECK

The performance of inhibition in controlling H2S corrosion can be measured by corrosion
monitoring. Not all online monitoring techniques are appropriate because iron sulfide films
can be electrically conductive. The film can bridge the electrodes in LPR probes, preventing
meaningful data acquisition. ER probes tend to underestimate corrosion rates in sulfide
environments because the sulfide film carries some of the measurement current.
SSC and SCC are rapid cracking mechanisms, therefore it is not routine practice to inspect for
these forms of cracking, hence the performance of material selection as a corrosion control
method is not normally measured. Inspection for cracking could be conducted but this is not
likely to be cost-effective; cracking would be very isolated and hence difficult to find.

Any in-service failure of material in sour service should be investigated, irrespective of the
consequence of that failure.
Failure by H2S corrosion could indicate a more widespread concern such as the corrosion
rate (general or pitting) being higher than predicted, or the inability of an inhibitor to control
corrosion.
Failure by SSC or SCC generally indicates that the material of construction is susceptible to
cracking in the operating environment, but occasionally that cracking may have been caused
by unexpected localised events (such as concentration of chloride ions on a heat exchange
surface) or upset conditions (temperature spike or oxygen ingress).
Any failure should be reviewed in terms of its possible more widespread relevance to the
remainder of the facility.
I.2.8 ACT

The continued safe operation of facilities handling sour fluids depends on regular review of
the performance of materials of construction and the corrosion mitigation measures in use.
The performance of any inhibitor used to control general or localised corrosion on CS should
be reviewed in order to assess whether the inhibitor is functioning correctly and to inform
any decision as to whether dose rates might be reduced. Although this might be achieved
by study of corrosion monitoring data, more reliable data should be derived from piping and
vessel inspections (wall thickness records and visual inspection for pitting).
165
+44 (0)207 467 7100

An important element in CM is learning lessons from problems (under-performance of
materials or corrosion control measures) and failures, but also from successes.
The results of investigations into failures, particularly unusual failures and those occurring
in circumstances where the material would not be expected to fail, should be disseminated
in-house and, where possible, in the public domain.
Unexpected and unexplained H2S cracking failures have the potential for advancing the
industry's understanding of the H2S limits for the materials of construction used widely in
sour service applications.
I.3 AMINE CORROSION
I.3.1 Introduction
Amines are used to remove the acid gases H2S and CO2 from produced gas.
Commonly used amines are:

−− monoethanolamine (MEA);
−− diethanoloamine (DEA);
−− methyldiethanolamine (MDEA);
−− diisopropanolamine (DIPA), and
−− diglycolamine (DGA).
Amines are not corrosive towards the materials of construction used to fabricate amine
absorption systems. However, the acid gases (H2S and CO2) are corrosive and hence the
corrosion threat is greatest in the rich amine streams.
The corrosivity of amine streams is generally defined in terms of the acid gas loading (moles
of H2S and CO2 per mole of available amine) and operating temperature. The ratio of H2S to
CO2 and their absolute contents (partial pressures) are also factors in corrosivity. Significant
rates of general corrosion are encountered in these systems, therefore the incorporation of a
corrosion allowance into the design is a primary corrosion control method.
As-welded or cold worked carbon and low alloy steels are susceptible to SCC in amine service.
Some contaminants in amine streams are corrosive towards carbon steel and stainless steels.
Contaminants in amine systems include:
−− Amine degradation products; heat stable amine salts and organic acids (formic,
oxalic, acetic and propionic) formed by reaction with oxygen originating in the
amine storage tank or make up water or air drawn in at leaking seals on pumps and
compressors.
−− Chloride ions (originating in the make-up water) build up over time and cause
corrosion of stainless steels in amine systems.
−− Solids, in the form of particulate material, contribute to erosion corrosion and
damage to protective films.
166
+44 (0)207 467 7100
Amine corrosion is often localised in the form of pitting or grooving, with under-deposit
corrosion and galvanic corrosion also occurring. Increasing velocity or turbulence increases
corrosion rates by degassing the H2S and CO2 from solution and by removing protective iron
sulfide films. This erosion corrosion particularly affects pumps and areas of impingement in
vessels; in piping, flow rates are controlled to minimise erosion corrosion. In conditions where
the corrosion rate of CS is unacceptably high, austenitic stainless steels (principally 316/316L)
are selected although 12 % Cr grades are sometimes used.
Amine cracking is normally controlled by application of a post-fabrication stress-relieving

heat treatment (post weld heat treatment (PWHT)) but cracking can still occur in PWHT'd
steel. Cracking can occur in steam-out conditions. Other forms of cracking have been
reported in amine units including SSC, HIC, and SOHIC.
I.3.2 PLAN
I.3.2.1 Policy
Because amine cracking can cause catastrophic failure of piping, vessels and valves, resulting
in the release of hydrocarbons and toxic gas with potential catastrophic consequences a CM
policy should be generated to comply with the Company's Integrity Policy and Strategy to
manage the risks to the ALARP principle.
The CM policy for amine plant corrosion should identify:

−− the functional responsibility for generating the CMS;
−− what the objectives of the CMS are and how they can be measured;
−− a statement identifying the benefits of managing amine plant degradation and the
potential consequences of ineffective control;
−− how the CMS will be implemented, and
−− who will implement the CMS.
I.3.2.2 Planning
Because of the potential risks associated with operating an amine plant the Duty
Holder/Operator should generate a plan to manage those risks.
The functional responsibility for managing the degradation of the amine plant should
generate a time based written plan which identifies the work which needs to be undertaken
to manage the threats and consequences:
−− corrosion threats assessment;
−− RBI plan;
−− WSoE;
−− reporting lines;
−− reporting frequency for:
– overview status, and
– major condition assessments.
−− how the plan complies with the Regulatory requirements;
−− frequency of reviewing the CMS, including identifying when:
– unplanned events should trigger a review, and
– new process conditions are known to occur due to changes in feedstock.
The CMS for amine plant will include planning for the control of amine corrosion and
prevention of cracking.
167
+44 (0)207 467 7100
I.3.3 DO

As the corrosivity of the amine solution varies with acid gas content, it will vary if the CO2 or
H2S contents (or their ratio) changes over time.
The corrosivity of the amine solution increases with contaminants.
The risk of amine cracking is high for non PWHT'd fabrication.
A corrosion threats assessment must be undertaken to determine the likelihood of corrosion

and cracking of the amine plant. This assessment should be done:
−− On the basis of design for new plants.
−− Reviewed on the basis of actual operation and inspection findings for operating
plants.
−− The CTA should be regularly reviewed to ensure proactive CM. The frequency
of review is dependent upon: (i) known measured risks (wall thickness,
cracks); (ii) planned significant changes in the process (e.g. increased H2S);
(iii) retrospective significant changes in the process.
The CTA will identify the rate of corrosion degradation and the risk of cracking, which will
form the basis of managing the risks.
The CMS for amine plant will include planning for the control of amine corrosion and
prevention of cracking.

−− periodic review of acid gas content sent to the amine absorber;
−− regular monitoring of pH;
−− periodic analysis of HSAS content;
−− periodic performance monitoring of filtration, and
−− reviewing documentation to ensure critical areas were PWHT'd during original
fabrication and repair work.
I.3.3.2 Organisation
The Duty Holder/Operator is required to have a suitable and sufficient organisation for
managing the potential degradation risks associated with operating an amine plant to
manage those risks to ALARP.
The Duty Holder/Operator should identify the functional responsibilities for managing the
corrosion related degradation of their amine plant. This will include identifying the function(s)
responsible for:
−− generating and reviewing the CTA;
−− generating and reviewing the RBI;
−− generating and reviewing the WSoE;
−− inspecting the plant;
−− reporting the findings of inspections;
−− prioritising the findings according to risk;
−− acting on anomalies identified from inspections;
168
+44 (0)207 467 7100
−− prioritising the repair actions on anomalies, and

−− updating the information databases, such as:
– inspection data, and
– maintenance planning.
The competencies of the functions responsible for carrying out the tasks should be identified.
Ideally a 'dashboard' should be generated which provides management with a quick method
of understanding the plant condition and risks – a traffic light system could be used.

The amine plant CMS should be prepared into written instructions with allocated
responsibilities.
The RBI should be transferred onto P&IDs and isometrics so that the NDT Operators can enact
the WSoE onto the plant in a consistent manner.
For each inspection location the CONC should be identified in the WSE so the NDT Operator
can make an immediate assessment of the risk, which will be followed up by a more detailed
calculation by the responsible person in the office. The CONCs for each critical plant items
should be compared to an agreed Performance Standard.
Where anomalies are identified an anomaly report should be created which should be issued
in a timely manner to the persons responsible for doing more detailed assessments and
acting upon those assessments.
All inspection findings must be logged in a system which is suitable and sufficient for
the size of the operation and the associated risks. At its most basic level this may be
satisfactorily performed by using electronic spreadsheets. At a higher level there are
sophisticated databases which can be populated with all the requisite data including CONC
and Performance Standards which will automatically calculate the risk of failure and when
the inspection should take place. it is for the Duty Holder/Operator to decide the required
level of sophistication of the data management system.
I.3.4 CHECK

The Duty Holder/Operator should have in place a plan which is able to identify:
−− whether the CMS is being met;
−− the effectiveness of the CMS in keeping risks ALARP, and
−− whether the CMS is meeting the corporate expectations of integrity management.
KPIs should be generated against which the CMS and the measurement of plant condition
can be compared.
Corrosion rates in amine systems can be measured by corrosion monitoring. Not all
online monitoring techniques are appropriate because iron sulfide films can be electrically
conductive. The film can bridge the electrodes in LPR probes, preventing meaningful data
acquisition. ER probes tend to underestimate corrosion rates in sulfide environments because
the sulfide film carries some of the measurement current.
Corrosion rates increase with increasing temperature, therefore coupons and probes may
under-report corrosion rates on heat transfer surfaces.
169
+44 (0)207 467 7100
Amine cracking is a rapid mechanism, therefore it is not routine practice to inspect for
this form of cracking, hence the performance of material selection as a corrosion control
method is not normally measured. Inspection for cracking could be conducted but this is
not likely to be cost-effective; cracking would be very isolated and hence difficult to find.

Any in-service failure, or near failure, of materials of construction in amine service should
be investigated, irrespective of the consequence of that failure, to ensure that lessons are
learned.
Failure by amine corrosion could indicate a more widespread concern such as the corrosion
rate (general or pitting) being higher than predicted.
Failure by cracking generally indicates that PWHT was not undertaken, or was not performed
correctly.
Any failure should be investigated in order to derive any information that may have more
widespread relevance to the remainder of the facility. A failure investigation should be aimed
at not only identifying the mechanism of failure but more importantly the circumstances
which led to the failure, i.e. the cause, so corrective actions can be implemented to prevent
a recurrence of the failure. Typically, failure investigations involve a mechanistic study to
determine how containment was physically lost e.g. the type of corrosion (general, pitting,
under-deposit, microbiological etc.), the type of cracking/fracture (ductile, brittle, fatigue);
then a causation study tries to establish what the circumstances were that caused the
component to fail by a particular mechanism. In the case of unusual, or difficult to diagnose
failures, a full RCA may be beneficial. The RCA takes the findings of the failure investigation
further by considering all factors that may have resulted in the failure of a component and
uses techniques that are effective in exploring some of the other contributors to failures, such
as the human and economic factors. Properly performed, failure investigations and RCAs are
critical steps in the overall problem-solving process and are key ingredients for correcting and
preventing failures thereby achieving higher levels of reliability.
in-house and, where possible, in the public domain.
I.3.5 ACT

The purpose of reviewing the performance of the amine plant CMS is to ensure that it is
effective, and that where deficiencies are found they can be managed and made safe in a
timely manner.
The purpose of the review is to:

−− ensure safety of the plant;
−− achieve continuous improvement of the plan;
−− ensure regulatory compliance, and
−− cost-effectiveness of the CMS.
The continued safe operation of amine systems depends on regular review of the
performance of materials of construction and the corrosion mitigation measures in use.
170
+44 (0)207 467 7100
The CMS should be reviewed at a frequency in keeping with the inspection findings from the
plant; i.e. if rapid corrosion is being identified then the CMS is evidently ineffective and must
be changed as soon as reasonably practicable.
At its lowest level, the team responsible for the CMS and inspection of the plant should
undertake an annual review.
The next level of review would be competent persons who are not directly responsible for
the plan.
The preferred option for reviewing the effectiveness of the CMS is by competent third parties
with no direct involvement with the facility on which the amine plant is operating.

Where it is identified through experience or by formal review of the CMS, that the criteria
for the rate of degradation of the plant are not being met, these lessons should be fed back
into the CMS to ensure that the intent of the Corporate Policy and the Integrity policy are
being met.
Feeding the lessons learned back into the CMS ensures continuous improvement of safety
and of the CMS.
I.4 OXYGEN CORROSION OF SEAWATER AND WATER INJECTION SYSTEMS
I.4.1 Introduction
This guide covers oxygen corrosion for seawater lift and distribution (seawater), firewater
(FW) and seawater injection (water injection) systems. Oxygen is present in the seawater
lifted from the ocean at a level of approximately 8 ppm and reacts with carbon steel to
form various iron oxides, most of which offer little mechanical strength, thereby eventually
compromising the integrity of the corroded components (seawater).
When oxygen is present, the corrosion mechanism of iron proceeds further as ferric
hydroxide is formed as corrosion product. Once formed, ferric hydroxide is not protective
and acts as an accelerating agent to produce ferric oxide.
Oxygen corrosion is easily recognised by the large pits produced. Oxygen pitting begins
at weak points in the ferric oxide layer and continues at the same location. The type of
pit developed is influenced by the pH making them bigger at low values. When the pH
increases, a protective oxide film is more effectively maintained, resulting in pits of smaller
circumference. Active oxygen pits contain reduced black oxide along the concave surface of
the pit, while the surrounding area above the pit becomes covered with ferric oxide – as seen
in Fig X_ . Black iron oxide indicates that the pit is active, whereas the presence of red iron
oxide indicates no activity.
Beside the pH and oxygen, the presence or macro- and micro-organisms also affects the
corrosivity of the seawater by the products of their metabolism and by the degradation of
biomass, while the oxygen content provides the driving force for the corrosion reactions.
171
+44 (0)207 467 7100
The temperature also affects the corrosion process in two different ways; firstly it directly
affects the corrosion reaction exponentially as well as having an effect on the solubility of
oxygen in the seawater. The higher the temperature, the lower the solubility of oxygen in
the water.
There are other factors to consider when assessing dissolved oxygen in seawater corrosion;
one of them is the flow rate, as it has also been shown that the transport of oxygen to the
cathode surface is profoundly affected by the flow rate of the seawater making the corrosion
rate nearly linearly dependent on the flow rate. Another factor to consider is the salinity of
the seawater which also affects the dissolved oxygen content. The higher the salinity, the
lower the oxygen content. In addition to that, the salinity of the seawater also increases
the electrical conductivity of the seawater as an electrolyte compared to the fresh water
conductivity, thereby increasing the corrosion rate.
The potential threat to stainless steel equipment from oxygen corrosion is localised pitting
corrosion and/or chloride SCC, which also can be addressed with the use of duplex or super-
austenitic stainless steel and CRAs that will give resistant to crevice corrosion at certain given
temperatures and conditions.
The effective control of microbial activity reduces the potential for FeS film formation and
solid deposition, both of which accelerate oxygen-related corrosion. Copper/nickel alloys
are frequently used in low flow areas of seawater systems due to their excellent corrosion
resistance.
Figure I.12: Pitting corrosion at 6 o'clock position that resulted in a leak in a spool-
piece on an outlet of a flotation unit upstream of a water injection pipeline. Pit < 1
cm diameter. Also corrosion is noted on the flange face
Figure I.13: Pitting corrosion of stainless steel SS316 in seawater
172
+44 (0)207 467 7100
I.4.2 PLAN
I.4.2.1 Policy
The plan for managing oxygen corrosion should fit in with the corporate Policy for integrity
management, with safety, environmental and commercial policies influencing the choice of
strategies for mitigation and monitoring/inspection. The key areas of concern will include
the water injection system, the water winning system and the firewater distribution system.
Responsibilities should be allocated for monitoring corrosivity, wall thickness loss and
management of corrosion.
I.4.2.2 Planning
There should be plans in place to prioritise and manage the risks associated with the systems
subject to oxygen corrosion, with the water winning and firewater systems being allocated
the highest priority on the basis of safety. Loss of water injection is a business risk and hence
lower priority.

−− coarse and fine filtration of lifted seawater for removal of solids (sand and marine
life);
−− choice of material in accordance with material selection guidelines (e.g. Norsok
M-001 or Company guidelines);
−− Cu-Ni alloys for low flow (<3 m/s) and low pressure piping (firewater);
−− Internally–lined CS (seawater and firewater);
−− oxygen removal: mechanical scavenging (vacuum or gas-stripping deaerator tower)
and chemical scavenging to typically < 10 ppb;
−− duplex stainless steel (water injection) or super-duplex stainless steel or 6Mo stainless
steel (seawater) depending on temperature and residual chlorine;
−− low alloy steel with corrosion allowance (water injection), and
−− overboard discharge when the oxygen level is above the specified maximum.
Monitoring/Inspection strategy can include:

−− On-line or manual oxygen monitoring (typically Orbisphere and Chemets respectively)
(water injection).
−− On-line corrosion monitoring (e.g. Linear Polarisation resistance (LPR) probe and
corrosion coupons (water injection).
−− Ultrasonic wall thickness inspection of CS items (SW and water injection) and
intelligent pigging (water injection pipeline).
I.4.3 DO

The required availability and functionality of the firewater system should be defined in
the performance targets. Leaks from low pressure systems (seawater) should be avoided,
and where they do occur temporary and permanent repairs should be carefully managed;
functionality should not be compromised and wetting of adjacent equipment should be
minimised so as not to introduce CUI or general corrosion risks to SCEs.
173
+44 (0)207 467 7100
Seawater injection strongly influences production capability and repair or replacement costs
due to poor corrosion control may be substantial. Seawater injection systems operate at high
pressure and the consequences of a leak could cause harm to persons in the vicinity, which
must be avoided.
The environmental risks associated with seawater systems are low/negligible due to their
non-hazardous nature.
The maximum flow rate of seawater for effective deaerator tower operation should be
defined and not exceeded in order to minimise the risk of erosion-corrosion.
Organisational roles may include:
−− Corrosion and Materials Specialists:
– lead on risk assessment, planning and analysis
−− Production Chemical specialists and chemical suppliers:
– lead on risk assessment, planning and analysis
−− Facilities Operations teams:
– lead on mitigation implementation, for example following procedures for
water quality control
−− Inspection Engineers and NDT contractors:
– lead on metal loss measurement
−− Pipeline Engineers:
– lead on metal loss measurement
Communication activities should aim at increasing awareness of the factors that influence
oxygen corrosion to ensure the impact of operating changes are fully understood, and at
raising awareness of the safety, environmental and commercial consequences of failure.
CRAS should include oxygen corrosion metal loss rate which can be determined from a
combination of:
−− quantitative corrosion rate forecast, e.g. Oldfield, Swales and Todd models;
−− corrosion monitoring – LPR probes and coupons;
−− microbiological measurements, including planktonic levels and sessile levels from
biostuds and coupons;
−− inspection observations and measurements, and
−− leaks and failure reports.
The oxygen corrosion threat will normally be addressed in the CMPs/matrix to specify:
−− mitigation methods;
−− performance targets;
−− immediate action required on non-conformance;
−− organisational responsibilities for mitigation, monitoring and immediate action;
−− plant instrumentation and data collection via DCS;
−− elements of RBI schemes;
174
+44 (0)207 467 7100
−− planned maintenance routines, and

−− reporting requirements.
Rate measurements and predictions can often give very different results and all have
considerable uncertainty of measurement or prediction. Judgement is required to produce a
useful result. The CM Plans may be part of a wider integrity management plan. For offshore
installations the strategic plan should be in line with the verification scheme.
CMPs should be reviewed and revised to meet changing operating conditions, either at a
fundamental or tactical level.
Tactical plans may include measures to address the causes of increased oxygen levels. These
may include deanerator tower (DA Tower) antifoam injection, pump seal maintenance,
increased biocide treatment or increased oxygen scavenger injection.
Implementation should be carried out in accordance with plan. Results obtained from
maintenance activities may be useful (see notes and comments).
Data relating to oxygen corrosion are gathered through different routes:

−− Process parameters (temperature and flow rate), corrosion monitoring data (from
LPR probes and coupons), oxygen levels and chemical treatment data (residual
oxygen scavenger, biocide treatment and chlorine levels). Preferably these are mainly
obtained in real time and are collected centrally for ease of comparison and trending.
−− Inspection data are usually collected in formatted reports and entered manually
into specialist inspection databases although download from NDT wall thickness
instruments is available.
−− Data relating to oxygen CM are analysed in two stages:
−− Initial comparison with performance targets to determine need for immediate
corrective action.
−− Analysis of all the data, usually by the corrosion engineer, to ensure that the strategic
plan objectives are met and the CRASs and tactical plans are amended if necessary.
−− The results of the regular statutory firewater deluge system testing (e.g. nozzle
blockage with corrosion product or leaks) are useful in understanding corrosion.
Note that seawater testing of deluge systems may result in the blockage of nozzles with
corrosion products and hence loss of performance and ineffective containment of a fire and
control of a potential major accident.
Water injection pump maintenance: loss of seal integrity may permit oxygen ingress.
LPR probe fouling: fouling with FeS may lead to short-circuiting of the probe elements and
consequently erroneous high corrosion rate readings.
Performance indicators are likely to cover disposal of seawater overboard if oxygen level
is excessive. A controlled increase in oxygen scavenger may be necessary to temporarily
compensate for poor DA performance.
175
+44 (0)207 467 7100
I.4.4 CHECK
I.4.4.1 Monitoring and measuring performance

−− chlorination (seawater) and biocide injection (water injection) against targets;
−− residual oxygen scavenger;
−− residual chlorine;
−− oxygen levels, and
−− completion of inspection and corrosion monitoring activities to plan.

−− frequency of oxygen level excursions above target;
−− reduction of wall thickness against corrosion allowance, and
−− corrosion rate < (corrosion allowance/design life).
Comparison of oxygen corrosion rate predictions, oxygen levels, coupon results, LPR data
and carefully-selected wall thickness data will help to understand the likely degradation rates
and the reliability of each dataset.
I.4.4.2 Performance review

Performance review should include the following with appropriate corrective actions in
strategy, organisation and planning if required:
−− annual reviews of oxygen CM;
−− review of performance measures, in particular the assessment of reactive indicators
and the overall trends in proactive indicators;
−− RCA of oxygen corrosion failures, excessive corrosion or management system failures
with appropriate corrective action recommendation, and
−− overall review of a., b. and c. together with verification findings for offshore
installations and audit results. Corrective action in strategy if indicated.
Determine if existing corrosion control measures are achieving the necessarily low levels of
oxygen and/or low rates of wall loss and whether improved monitoring is required.
The root cause of excessive oxygen corrosion may be due to the primary factor, i.e. a high
oxygen level or it may be due to secondary factors such as microbial contamination, solid or
marine solid material.
I.4.5 ACT
I.4.5.1 Audit
Activity for the management of oxygen corrosion should be included in CMS audits.
The CMS should achieve the objectives of the policy by maintaining the integrity of the water
injection pipeline throughout the design life.
176
+44 (0)207 467 7100
I.5 MICROBIALLY INFLUENCED CORROSION
I.5.1 Introduction
Microbially-influenced corrosion (MIC) remains one of the biggest threats to oil and gas
installation integrity. Existing strategies tend to focus on dead legs, whereas experience has
shown the threat to be more widespread, including flowing wet oil pipelines. Water-injection
systems are at high risk, especially produced water reinjection (PWRI) and MIC can prevail
in drains systems of all installations. MIC also occurs in: plant and pipelines under wet
lay-up: following hydrotest or subject to 'mothballing'; the water bottoms of oil storage
tanks including diesel tanks; cooling water systems and firewater systems.
Inspection is notoriously unreliable at detecting MIC, given its extremely localised nature,
but sampling and subsequent chemical treatment provide the best available control strategy,
However, often the management of MIC can be unstructured due to lack of recognition of
the threat and the implementation of inappropriate mitigation measures.
Figure I.14: Severe MIC in carbon steel, mediated by SRB (SRP)
I.5.1.1 Example 1
The classic morphology of severe MIC in carbon steel, is shown in Figure I.14. MIC was
mediated by SRB (SRP) in 8 mm wall thickness CS drain system pipework, described as a
'slops line', which failed after four years of service.
Fluids were 96 % water, 4 % crude oil, low partial pressure of CO2, pH~6, ambient
temperature or just above.
There was slime formation with proliferation of SRB (SRP) under slime. Sulfides on the surface
of metal sections were detected by the lead acetate test.
The solution was to minimise stagnation, apply more frequent and consistent batch biocide
treatment and in the longer term consider material change to CRA.
177
+44 (0)207 467 7100
Figure I.15: microbiologically-assisted, chloride induced pitting attack of an active/

passive alloy pipework
I.5.1.2 Example 2
Microbiologically-assisted, chloride induced pitting attack of an active/passive alloy, AISI 316L
austenitic stainless steel is shown in Figure I.15. 5 mm wall thickness at a newly constructed
and hydrotested chemical plant. Initially, there was a futile attempt to clamp the leaks until
eventually hundreds were discovered, leading to complete write-off of pipework.
Untreated water was stagnant for three months with heating up to 50 °C locally during the
day, ambient temperature ~30 °C.
High population density of total bacteria and SRB. Massive slime formation. Proliferation of
SRB in anaerobic zone under slime. Sulfides on surface of metal sections.
The solution was to conduct future hydrotests using steam condensate or with filtered
water treated with a biocide and trisodium phosphate equal to five times the chloride
concentration. Following hydrotest, excess water to be blown out with warm, dry air to
60 °C. Heat to be applied to pipes wherever possible. Drying was assisted by flushing with
methanol where possible.
Figure I.16: Gunmetal impellor from seawater pump
I.5.1.3 Example 3
A gunmetal impellor (red brass 88 % copper with tin and zinc additions), Figure I.16 from a
seawater pump in a polluted harbour. The pump ran without problems for many years, with
178
+44 (0)207 467 7100
throughput of aerated seawater then was shut in for one year. SRB proliferated in stagnant
polluted water., The impellor severe shallow pitting merging into generalised corrosion. The
corrosion product was copper sulfide.
The solution was to avoid stagnation where possible. If the pump really must be shut in
for a prolonged period with stagnant seawater, add a biocide (minimum 1 000 ppmv
polyhexamethylene biguanide) and a specific compatible copper alloy ci(benzotriazole or
tolyltriazole).
The ways in which metabolic activities of certain microorganisms bring about or contribute
to corrosion may be broadly categorised as follows:
a) Direct chemical action of metabolic products such as organic acids or reduced sulfur
compounds, especially sulfides.
b) Generation of an electrochemical cell by deposition of cathodic and conducting
metal sulfides, often in conjunction with mechanism a).
Localised electrochemical effects due to changes in oxygen concentration, pH, etc, which
establish local differential cells, often in conjunction with mechanisms a) and b). The physical
presence of the biomass in itself contributes to this mechanism.
Removal of inhibitory substances, most notably nitrite CIs.
Direct degradation of protective coatings by utilisation of one or more of their constituents as

a source of carbon, thereby reducing the efficiency of the protective system.
I.5.2 Carbon and low alloy steel
MIC problems have been widely documented in carbon and low alloy steel piping systems,
storage tanks, cooling towers, water injection systems and pipelines. Carbon and low alloy
steels are widely used due to their low cost. Though mild steel components can be coated or
lined for internal corrosion protection, biofilms can form at flaws in the surface of coatings.
Numerous cases have also been documented where microorganisms have caused disbonding
of coatings from the underlying metal and delamination of the coatings creating an ideal
environment for further MIC.
The MIC mechanism may involve acid attack by: organic acids generated under deposits
by anaerobic bacteria; differential aeration cells due to localised bacterial consumption of
oxygen; SRB-mediated corrosion or a combination of these processes. The most widely
encountered MIC mechanism is that mediated by SRB, more correctly termed SRP, growing
in complex biofilms with other micro-organisms.
The corrosion pattern is localised, generally in the form of shallow pitting attack, with
maximum pitting rates significantly in excess of 1 mm/year in the more severe cases. It often
occurs in the absence of oxygen and at near-neutral pH i.e. conditions that standard corrosion
theories would suggest as being benign.
I.5.3 Stainless steels and other active/passive alloys
MIC of active/passive materials such as stainless steels can be regarded as a special case
of chloride-induced crevice or pitting attack, which occurs at combinations of chloride
concentrations and temperature that would normally be considered 'safe' for a particular
material. Contrary to popular belief, MIC mediated crevice corrosion is more common than
179
+44 (0)207 467 7100
MIC pitting corrosion. Microbial metabolites, especially sulfides and other reduced sulfur
compounds allow pitting which can propagate at electrochemical potentials close to the
minimum for metastable pitting, which would normally be expected to harmlessly repassivate.
Most workers believe that the presence of at least some oxygen is required to initiate the
process.
Once established by the MIC mechanism, propagation of an established pit or crevice

continues by the normal mechanism of electromigration of chlorides and hydrolysis of metal
ions within the pit. This process will continue even after a successful biocide treatment. Pitting
is sharp and highly localised, often flask-shaped and with a nearly closed metal surface,
visible mainly by staining and extrusion of corrosion products, very similar in appearance to
normal chloride-induced crevice or pitting attack. Maximum localised corrosion rates can be
as high as several mm/year, depending on the material, in the more severe cases.
Very severe crevice corrosion, of 1 to 2 mm depth in six months, has been observed on
alloys UNS S30403, UNS S31603 and lean duplex UNS S32101 exposed to severe biofilm
conditions. A lesser, but still severe, amount of crevice corrosion, to a maximum depth of
~0,5 mm has been observed on the 22 chrome duplex alloy UNS S31803 over the same
period. 25 chrome super duplex material is probably only susceptible to MIC under the most
extreme biofilm conditions and at temperatures probably ≥ 30 °C and in the presence of
high chloride concentrations.
I.5.4 Copper and nickel alloys
Copper alloys find use in seawater piping systems and heat exchangers and are susceptible
to MIC. MIC observed in copper alloys includes pitting and dealloying. Higher alloying
content in copper usually results in a lower corrosion resistance. Although MIC has been
found in both 70/30 and 90/10 Cu/Ni alloys, more problems have been documented with
70/30 than 90/10 Cu/Ni alloys. MIC has also been documented in brass (Cu-30Zn-1Sn),
aluminium brass (Cu-20Zn-2Al) and aluminium bronze (Cu-7Al-2.5Fe). High strength Cu-Ni
alloys are susceptible to SCC in the presence of ammonia which can be produced by heavy
accumulations of biofouling.
Numerous cases of mysterious 'under-deposit' or 'under-fouling' pitting corrosion of

copper-nickel heat exchanger tubes have been observed, especially in marine environments.
Many of these failures are demonstrably due to biogenic sulfide produced by SRB (SRP).
Copper-nickel alloys are most susceptible to the initiation of MIC by microbiologically-
generated sulfides during the first few weeks of exposure to the operating environment,
at which time the protective oxide film is incompletely formed. MIC of aged copper-nickel
alloys with a well formed oxide film is also known, but is much less common than for newly
exposed material and seems to require considerably more severe conditions, i.e. exposure
to a higher concentration of sulfide is required for a longer duration. The promotion of
protective oxide films and avoidance of exposure to stagnant contaminated water during
early exposure is critical in order to avoid such problems. If wet lay-up with contaminated
water is unavoidable, the use of an organic biocide treatment is highly recommended.
Nickel alloys are often used for applications subject to high velocity water environments,
including heat exchangers, pumps, turbine blades and valves, as they have a higher resistance
to erosive wear than copper alloys. However, some nickel alloys are susceptible to pitting
and crevice corrosion under stagnant water conditions and static periods can lead to MIC.
Monel 400 (66,5Ni-31,5Cu-1,25Fe) has been found to be susceptible to under-deposit MIC.
Pitting corrosion, inter-granular corrosion and dealloying of nickel have all been observed
with this alloy in the presence of SRB (SRP). Ni-Cr alloys have been found to be generally
more resistant to MIC.
180
+44 (0)207 467 7100
I.5.5 Non-metallic materials
Non-metallics, including coating and linings, that find service in the petroleum production
industry are generally highly cross-liNked, highly chemically resistant polymers such as
phenolics, epoxy-phenols, epoxy powder coatings, polyurethanes, GRE and polyethylene
liners. Many of these materials are also extensively used for water pipelines in the water
supply industries, so there is a lot of experience as to their characteristics and behaviour.
There is little or no evidence that microbiological degradation presents a concern for these
types of materials in the context of oilfield fluid handling systems. As well as the materials
being at the highly degradation-resistant end of the non-metallic materials spectrum, most
microbial degradation of polymers in general, which is often cosmetic more than structural,
is mediated by aerobic fungi, which rarely proliferate in saline waters or in deaerated
environments.
I.5.6 PLAN
I.5.6.1 Policy
and monitoring/inspection:
−− the choice of MIC resistant materials is rarely an option because of high cost, and
−− inspection is unreliable at detecting MIC, given its extremely localised nature.
Models for the prediction of MIC exist and are worthwhile but they much are less developed
and less reliable than other corrosion models, for example for CO2 or oxygen corrosion
models – MIC models tend to give worst case predictions, which may or may not actually
occur in practice.
Sampling and careful trending of microbiological data often provide the best guide to MIC
corrosion risk. Biofilm ('sessile' bacteria) data from coupon or biostud analysis are more
reliable than water testing results. Trended data are more reliable than single point analyses.
In the case of CP, international standards (International Standard ISO

15589-1:2003 (E), 2003) recommend that for pipelines 'operating in anaerobic soils and
where there are known, or suspected, significant quantities of sulfate-reducing bacteria
(SRB) and/or other bacteria having detrimental effects on pipeline steels, potentials more
negative than −950 mV referenced to copper sulfate electrode (CSE) should be used to
control external corrosion'. This compares to a CP design criterion more negative than
−850 mV referenced to CSE for non MIC corrosion protection. That is to say an extra 100 mV
of protection is recommended where active MIC is believed to be a serious threat.
I.5.6.2 Planning
The CM strategic plan may be part of a wider Integrity Management Plan. For offshore
installations the strategic plan should be in line with the verification scheme.
Chemical treatment with biocides, either continuous chlorination or batch treatment with
organic biocide, often provides the best available MIC control strategy, especially when
combined with frequent pigging, in the case of pipelines.
Minimising stagnation, especially in the presence of untreated fluids and maximising flushing
is important.
181
+44 (0)207 467 7100
Where applicable (e.g. tank bottoms), well maintained coating and/or CP systems provide
reliable protection against MIC.
I.5.7 DO

MIC risk assessment (CRASs) should include a combination of:
−− MIC predictive modelling, bearing in mind that MIC models are less reliable and less
well developed than other corrosion predictive models.
−− Microbiological information, including planktonic levels and sessile levels from
biostuds and coupons.
−− Biocide treatment records.
−− Results from corrosion coupons.
−− Inspection observations and measurements, leaks/failure reports.
−− Of the general corrosion prediction models the only one to incorporate a MIC module
is Hydrocorr, the Shell in-house model. As with most general corrosion prediction
models, it is mainly focused upon pipeline systems and the MIC module takes into
account water chemistry, flow velocity and debris in the line but does not take any
account of bacterial population densities. This was detailed in a paper by Pots et al.
(2002). The model does take account of the use of standard control measures such
as pigging frequency and the routine use of biocides.
−− The more specialised models include that developed by Maxwell et al. (2006), which
is a qualitative model for MIC in seawater injection systems and pipelines. This model
takes into account bacterial kinetics and the time required to develop a sulfide film as
well as the parameters that stimulate pit initiation. The model also takes into account
the efficacy of biocide treatments.
All personnel involved should be made aware of the factors affecting MIC and be vigilant to
recognise the indications of, or changes that are likely to cause, MIC.

a) Corrosion and Materials Specialists;
b) Production Chemists;
c) Chemical Specialists and chemical suppliers;
d) Facilities Operations teams, and
e) Inspection engineers and NDT contractors.
All personnel involved should be made aware of factors giving rise to MIC, the visual
appearance of MIC and its highly localised nature and any changes in processes that may
alter the risk of MIC e.g. changes in operation temperatures, changes in salinity of fluids,
down-time and stagnation, changes in pigging frequency or chemical injection patterns and
should effectively communicate such information to colleagues and associated organisations
involved.
182
+44 (0)207 467 7100
a) and b) lead on risk assessment, planning and analysis; b) and c) lead on mitigation
implementation, for example biocide selection and monitoring of bacterial trends, and d)
and e) lead on metal loss measurement.

The strategic plan should then be implemented such that the planned activities can be carried
The output from the risk assessment includes mitigation, monitoring and inspection activities.
These activities require discussion on a regular basis to ensure MIC management tactics are
effective.
MIC mitigation measures include:

−− removal or isolation of dead legs, wherever possible;
−− avoid stagnation with untreated water;
−− draining, flushing and biocidal treatment, and
−− inspection.
When equipment is temporarily removed from service, mothballed or decommissioned,

ensure than an effective treatment package, including a biocide, is dosed and that the
chemical treatment is implemented carefully at the correct dosage.
In the absence of a permanent engineering solution, flushing dead legs can reduce the MIC
threat. This option is particularly important for operational dead legs. Ideally, dead legs should
be flushed with fluids that contain biocide to inhibit microbial growth. Flushing dead legs
with untreated fluids can reduce the threat of corrosion by removing deposits and preventing
microbial biofilms becoming established. However, this can replenish the nutrient supply,
which can exacerbate microbial growth. This should be taken into consideration when
deciding upon a mitigation strategy.
Flushing of dead legs should be considered in any system that is subject to continuous or
regular application of batch biocide treatment. Continuous chlorination of the raw seawater
systems means that stagnant zones and operational dead legs in the seawater systems should
be flushed regularly, e.g. firewater ring mains.
In plant with seawater injection systems, consideration should be given to flushing dead legs
during the regular batch biocide treatment of the system.
Although biocide treatment of production and drains systems is less common, it can be
employed when microbial growth has become established.
Biocide treatment is generally ineffective if deposits are present, which can shield areas of
bacterial activity. Solids removal is therefore essential prior to chemical treatment.
Chemical treatment target levels and flushing requirements should be reviewed on a regular
basis and modifications made if required.
Inspections should be targeted at locations where water and deposits can collect, allowing
microbial activity to develop. This is dependent upon the orientation and configuration of
the pipework:
−− Bottom third of any horizontal piping between the 4 and 8 o'clock position.
183
+44 (0)207 467 7100
−− Off-takes originating from the lower half of horizontal lines; inspection will be
targeted at low spots, bottom of vertical sections, horizontal sections, above closed
valves, etc.
−− Unless dead legs can be removed they must be inspected at a prescribed interval
identified during the risk assessment process.
−− Sections of off-takes close to the main line which is the source of bacteria, nutrients
and heat.
−− Lowest parts of vessel bridle work, together with any associated level gauges.
−− Upstream of concentric reducers.
Locations where previous corrosion or erosion has reduced the wall thickness.
The results of periodic bacterial counts to NACE TM0194 (2014) as well as chlorine and
biocide dosing data are useful in understanding the ongoing MIC threat.
For water injection, in adequately chlorinated water, no viable bacteria should be detected.
Pipework upstream of deaerators is usually CuNi or GRP, 0,5 to 0,7 ppm free chlorine is
recommended. If it is duplex or carbon steel, 0,2 to 0,3 ppm (excess chlorination causes
pitting corrosion). Copper/chlorine dosing systems are usually poor and not recommended.
The high surface area of packing in deaerators provides an ideal environment for SRB.
Elevated numbers are often due to poor/ineffective biociding. Biocide should be dosed to
the deaerator inlet and dosing optimised.
In fast flowing water injection systems even low numbers of planktonic SRB can be associated
with elevated numbers of sessile SRB.
For production systems, even in hot systems, check dead legs and vessel bridles for
low temperature SRB (m-SRB), as m-SRB can gain access via feed from drains vessels to 2nd
stage separators. The main concern regarding SRB is in base of uncoated CS vessels and
pipework, where they proliferate under deposits. Generally state that inspection frequencies
should reflect the enhanced risk threat of MIC in these locations. If biocide is required select
a non-foaming formulation.
For drains systems the main concern is SRB in the base of uncoated CS vessels and pipework
where they proliferate under deposits. Inspection frequencies should reflect enhanced risk
of MIC in these locations. Recommend local biocide dosing if no operational/environmental
concerns.
Most fire hydrants and monitors are pressurised dead legs, receiving water from a ring main
(either from seawater system or fresh water onshore). Potential for dosing biocide is very
limited. Chemical cleaning may be allowed if biofouling is severe. Regular, planned high
speed flushing should be implemented where problems are observed.
In nitrite inhibited cooling waters systems of correct concentration (1 000 to 2 000 mg/litre)
SRB should not be detected. If SRB counts are positive, check nitrite, chloride and pH levels
regularly. The main concern with TVC (GHB) is that elevated numbers may result in poor heat
transfer across heat exchangers.
Nitrate-reducing bacteria (NRB) monitoring should be every three months. Check pH,
which should be 8,5 to 10,5. (this pH range should slow down bacterial growth). High NRB
numbers may result in rapid loss of nitrite inhibitor. Drain and clean or add suitable biocide.
184
+44 (0)207 467 7100
I.5.8 CHECK

Biocide batch dose injection, frequency duration and concentration vs. plan, where
appropriate e.g. water injection and produced fluids.
Flushing and pigging schedule vs. plan
Planktonic and sessile TVC (also called GHB) and SRB (SRP) counts vs. targets. Table 7 in
IP Document titled Guidelines for the management of microbially influenced corrosion in
oil and gas production provides MIC risk/criticality guidelines based on extinction dilution
technique for bacterial counts as per NACE TM0194 (2014) for different oilfield fluids, such
as water injection, firewater, cooling systems, produced fluids and drains.
Figure I.17: Serial dilution tests for SRB (SRP) enumeration
Other, molecular, techniques such as quantitative polymerase chain reaction (QPCR) and
Fluorescence in situ Hybridisation (FISH) may also be used.
The following are considered as proactive (leading) performance indicators:

−− biocide injection against targets;
−− flushing and pigging routines against targets;
−− fluid sampling for microbial activity against targets;
−− bioprobe, or coupon sampling for microbial activity against targets (where these
exist);
−− fluids sampling for solids content, and
In addition, any change in the operating status of oilfield water systems should be used to
help understand whether the MIC threat has increased or decreased.

−− dead leg related failures;
−− MIC damage in vessels, storage and ballast tanks;
185
+44 (0)207 467 7100
−− wall thickness loss, against corrosion allowance, and

−− corrosion rate in (corrosion allowance/design life).

The root cause of excessive MIC may be due to the primary factor, i.e. failure of treatments to
control or it may be due to secondary factors such as solids and scales, which make biocide
treatment more difficult.
I.5.9 ACT

The overall performance review should include consideration of any dead leg related failures,
MIC damage in vessels, storage and ballast tanks and wall thickness loss, against corrosion
allowance. together with verification findings for offshore installations and audit results.
If indicated, the strategic plan may require correction.
Determine if existing MIC control measures are achieving the necessarily low levels of MIC
and whether improved monitoring is required.
Performance review should include the following:

−− Annual reviews of MIC corrosion mitigation, monitoring and inspection outcomes.
Corrective action for these programmes, if indicated.
−− Review of performance measures where applicable. Corrective action in strategy,
organisation and planning if indicated.
−− RCA of suspected MIC failures or management system failures with appropriate
corrective action recommendation.
Overall review of a., b. and c. Capture and roll-out lessons learned.

Activity for the management of MIC should be included in CMS audits.
Capture and roll-out lessons learned based on the outcome of performance review.
I.6 DEAD LEG CORROSION
I.6.1 Introduction
Historically, the management of dead legs on an installation has been problematic, primarily
because of the large numbers of dead legs that usually exist. Guidance is provided here for
identifying and managing internal corrosion of dead legs in hydrocarbon production. The
objective is to outline methods, which can be used in conjunction with the RBI procedure,
primarily to:
186
+44 (0)207 467 7100
−− Assess the probability for the occurrence of dead leg corrosion which can then be
utilised within the risk matrix to establish the overall risk of dead leg corrosion.
−− Mitigate the risk of dead leg corrosion.
A dead leg is a section of pipework or vessel which contains hydrocarbon fluids and/or
water under stagnant conditions (either permanently or intermittently), or where there is no
measurable flow. More precisely, a dead leg is any segment of piping extending below the
horizontal plane of the pipe which can become a trap for water, sediment or other corrosive
materials. Furthermore, a broad definition of a dead leg includes dead ends, which refer to
piping that does not extend below the horizontal plane of the pipe yet contains stagnant
fluids.
Dead legs can be divided into three main categories:

−− Permanent or physical dead legs: these are areas subject to long-term stagnation
which have been built into the plant or have arisen from modifications over the
course of the life of the facility.
−− Operational dead legs: these are locations or sections of plant that are stagnant for
operational reasons.
−− Mothballed or equipment temporarily removed from service is particularly susceptible
to dead leg corrosion, especially in the absence of an approved treatment.
The following also need to be considered as dead legs or potential dead legs:
−− lines from vessels or piping to PSVs (normally closed), and
−− instrument tappings/connections.
Out of service vessels,

pipework, sections of plant
Bridle Process pipework associated with

Pipework a vessel, upstream of the first
closed valve
Lowest sections of pipework runs

where it is not possible to drain
completely
Drains pipework at
the base of vessels
Pipework sections used intermittently A section of pipework not in the Pipework sections upstream or
e.g. bypass lines and non-operating normal flow, but which cannot be downstream of a closed valve
sections of spaded equipment isolated from the normal flow e.g. where the intention is to keep the
obsolete lines valve closed
Figure I.18: Examples of typical dead legs
187
+44 (0)207 467 7100
Some systems are by the nature of their mode of operation (no flow/slow flow/intermittent
flow) more susceptible to dead leg corrosion and these should be considered to be 'dead leg
systems' e.g. drains, firewater, recovered oil and relief lines.
Examples of dead legs are illustrated in Figure 36. The key causes of corrosion in dead legs
are:
−− Bacteria, usually SRB, which proliferate in stagnant, oxygen-free water where appropriate
nutrients are available. They oxidise organic components in water and reduce sulfate ions
to produce hydrogen sulfide as part of their metabolism. These processes are discussed
in Annex I.5.
−− Under-deposit corrosion caused by the presence of sand or corrosion products and
where the mechanisms can vary.
In oxygenated systems, anodic areas can exist under deposits due to differential aeration. In
production systems, a number of factors can be involved, such as locally high acidity within
pits and the reduced ability of inhibitors to penetrate deposits:
−− Depletion of CIs over time leading to loss of protection.
−− In systems containing a gas phase and water, water condensation may occur in dead
legs if the temperature is lower than the process. This condensed water will contain
any corrosive species from the process, e.g. CO2 and organic acids, but will generally
not contain treatment chemicals such as CIs.
Operational dead legs frequently exhibit greater degradation rates than permanent dead legs
for the following reasons:
−− bacterial and nutrient replenishment;
−− warming, which increases bacterial activity and corrosion rates, and
−− replenishment of cathodic reactants such as oxygen and CO2.
Conversely, some operational dead legs may also have a regular supply of treatment chemicals.
I.6.2 PLAN
I.6.2.1 Policy
As a matter of policy, the Duty Holder/Operator should seek to assure the continued integrity
of all sites with the aim of minimising risk to personnel, environment and business from the
threat of dead leg corrosion.
On an installation, there may be hundreds of dead legs. Therefore, in order to manage

these large numbers, the recommended approach is to concentrate initially on those
systems where there is a significant threat of dead leg corrosion. This approach will allow
more focus on the high risk pipework. Ultimately, the highest risk systems will be inspected
at the greatest frequency, with due consideration of surface area coverage, given the
challenge of locating dead leg corrosion.
188
+44 (0)207 467 7100
I.6.2.2 Planning
The strategy by which the objectives of the policy can be achieved may be divided into a
number of discrete areas:
−− elimination/reduction of the risk through removal of any unnecessary dead legs;
−− identification of pipework/locations at risk;
−− mitigation of the threat (flushing and chemical treatment);
−− prioritisation of inspection activity: based upon consequences of failure and
probability of dead leg corrosion, and
−− definition of inspection scope: type of inspection, coverage and frequency.
I.6.3 DO

Corrosion risk assessments should be carried out in conjunction with the consequence
assessment to establish the risk.
Dead legs exist in all process systems. Some systems have demonstrated that they have a
more significant threat of dead leg corrosion than other systems. Where large numbers of
dead legs have to be managed, it is important that the appropriate resource is applied to
these high threat systems, particularly when the consequence of failure is also high.
It may therefore be useful to carry out an initial assessment at a general facilities level, to
ensure systems which are particularly susceptible to dead leg corrosion are identified. This
prioritisation should give a high weighting to the 'probability' of dead leg corrosion.
Guidance on susceptibility of systems to dead leg corrosion is provided in Table I.1. This
information is based on experience from three facilities in the North Sea sector.
Table I.1: Guidance for assessment of probability for dead leg corrosion to occur
Probability of dead System

leg corrosion
High Produced oil, recovered oil, export oil
Medium Production headers, diesel, produced water, closed, open and
sand wash drains
Low Produced gas, gas export, fuel gas, flare systems, water
injection, drilling
Potential dead legs should initially be identified using the latest revision of the P&IDs. Piping
isometrics and fabrication drawings, where available, can be used to provide an indication
of the orientation of the dead leg. In practice, it may be more efficient to establish the
orientation of the dead legs during line-walking, rather than reviewing isometrics.
It is particularly important to identify operational dead legs. Production and operations

assistance should be sought in the identification of systems that are not normally flowing
and/or are mothballed.
189
+44 (0)207 467 7100
The existence and orientation of dead legs should then be confirmed by a competent person
walking the system to check the accuracy and completeness of the listing.
Factors to be considered when assessing the probability for dead leg corrosion to occur
within a given system include:
−− fluid composition – aqueous phase/presence of sulfates/presence of nutrients/oxygen
ingress/possibility of condensation of water;
−− temperature;
−− materials of construction – e.g. CRAs are not immune, but are less prone to dead leg
corrosion than carbon steel;
−− pipe wall thickness (thinner wall pipework may have higher priority);
−− microbial status;
−− deposit potential;
−− operation – stagnant/intermittent/continuous;
−− presence of biocide;
−− presence of CI, and
−− history of corrosion.
Table I.2: An example probability assessment for dead legs in oil-water systems
High Medium Low

Horizontal or vertical sections containing stagnant fluids with water
and
Intermittently stagnant e.g. or Permanently stagnant Isolated from
intermittent fluid circulation, sections which cannot be normal flow i.e.
regular draining isolated from normal flow no refreshment
and of bacteria,
nutrients
With no biocide dosing or Effective biocide and/or and cathodic
where biocide treatment will be corrosion inhibitor treatment in reactants,
ineffective due to the presence place e.g. oxygen,
of sand/deposits CO2, and no
or warming
Pipework that is a low point or
below the mid-line of a vessel
can also fall in this category if
no biocide/corrosion inhibitor
treatment has been achieved
An accurate record of the dead legs that exist on a facility is required (commonly known
as the dead leg register). This is normally carried out as part of the CRAS for each process
system. Alternatively, it can be carried out as a separate exercise if this is considered more
appropriate.
This register should contain all physical dead legs and, as far as practicable, all operational
dead legs. Typically, this would be done by system. The record should be maintained as a live
190
+44 (0)207 467 7100
document throughout the life of an installation and updated to reflect both physical changes
in the plant and changes in the mode of operation.
Mothballed or equipment temporarily removed from service should be included.
The dead leg record should be integral with, or linked to (either electronically or by a process)
the inspection database.
Organisational roles that can be involved in the management of dead legs include:
−− Microbiological Specialists;
−− Process Engineers and plant operators;
−− Production Chemists, and
−− Inspection Engineers and NDT contractors.
Communication activities should aim at increasing awareness of the:

−− factors that can affect and mitigate dead leg corrosion;
−− why specific mitigation activities are necessary, and
−− consequences of not achieving mitigation requirements.
Process engineers and plant operators should assist in identification of dead legs and those
dead legs which are not normally flowing and/or are mothballed.

The output from the risk assessment includes mitigation, monitoring and inspection
activities. These activities require discussion on a regular basis to ensure short-term corrosion
management tactics are effective.
Dead leg corrosion mitigation measures include:

−− Removal or isolation:
Once dead legs have been prioritised for risk, they should be assessed for possible
removal or isolation.
Careful isolation is particularly important when equipment is temporarily removed
from service, mothballed or decommissioned. For example, vessels may be isolated
at their nozzles, leaving the interconnecting pipework stagnant. This is often
exacerbated by 'passing' valves.
In the majority of cases the removal or permanent isolation of dead legs is not an
option.
−− Draining, flushing, chemical treatment:
In the absence of a permanent engineering solution, flushing dead legs can reduce
the corrosion threat. This option is particularly important for operational dead legs.
Ideally, dead legs should be flushed with fluids that contain biocide to inhibit microbial
growth and CI if required. Flushing dead legs with untreated fluids can reduce the
threat of corrosion by removing deposits and preventing microbial biofilms becoming
established. However, this can replenish the nutrient supply, which can exacerbate
microbial growth, and cathodic reactants which allow corrosion. This should be taken
into consideration when deciding upon a mitigation strategy.
Flushing of dead legs should be considered in any system that is subject to continuous
191
+44 (0)207 467 7100
or regular application of batch biocide treatment. Continuous chlorination of the

raw seawater systems means that stagnant zones and operational dead legs in the
seawater systems should be flushed regularly, e.g. firewater ring mains.
In plant with seawater injection systems, consideration should be given to flushing
dead legs during the regular batch biocide treatment of the system.
Although biocide treatment of production and drains systems is less common, it can
be employed when microbial growth has become established.
If plant is isolated or mothballed, even temporarily, it is important to ensure that
it is actually mothballed and that an appropriate mothballing procedure is applied,
e.g. draining/flushing/drying or chemical treatment.
Chemical treatment is generally ineffective if deposits are present. These can shield
areas of bacterial activity, and restrict CI access to the metal; solids removal is therefore
essential prior to chemical treatment.
Chemical treatment target levels and flushing requirements should be reviewed on a
regular basis and modifications made if required.
−− Inspection of dead legs:
Unless dead legs can be removed they must be inspected at a prescribed interval
identified during the risk assessment process.
The management of dead legs should be incorporated within the routine inspection
plans of the facility. Inspection frequency must take account of the pipe wall thickness
and expected deterioration rates (e.g. thin walled pipework may need more frequent
inspection).
Inspections should be targeted at locations where water and deposits can collect
allowing microbial activity to develop. This is dependent upon the orientation and
configuration of the pipework:
These locations include:
– Bottom third of any horizontal piping between the 4 and 8 o'clock position.
– Off-takes originating from the lower half of horizontal lines; inspection will be
targeted at low spots, bottom of vertical sections, horizontal sections, above
closed valves etc.
– Sections of off-takes close to the main line which are the source of bacteria,
nutrients and heat.
– Lowest parts of vessel bridle work, together with any associated level gauges.
– Upstream of concentric reducers.
– Locations where previous corrosion or erosion has reduced the wall thickness.
– In multiphase line areas where condensation may occur.
Activity for the management of dead leg corrosion should be included in CMS audits.
I.6.4 CHECK

The following are considered as proactive (leading) performance indicators:
−− biocide injection against targets;
−− CI injection against targets;
−− flushing routines against targets;
−− fluid sampling for microbial activity against targets;
−− fluid sampling for CI levels against targets;
−− bioprobe or coupon sampling for microbial activity against targets (where these exist);
192
+44 (0)207 467 7100
−− fluids sampling for solids content, and

In addition, any change in the status of dead legs should be used to help understand whether
the MIC threat has increased or decreased.

−− dead leg related failures;
−− MIC damage in vessels, storage and ballast tanks;
−− wall thickness loss in dead legs, against corrosion allowance, and
−− corrosion rate in dead legs < (corrosion allowance/design life).
The dataset identified under leading performance indicators will provide assistance to the
corrosion engineer in understanding whether the MIC threat associated with dead legs is
under control.

Investigate the causes of dead leg corrosion-related incidents and accidents in order to reduce
the likelihood of reoccurrence.
wider integrity management plan.
The root cause of dead leg corrosion may be due to the primary factor, i.e. failure of treatments
to control or it may be due to secondary factors such as accumulation of deposits, which
make chemical treatments more difficult.
I.6.5 ACT

−− Annual reviews of dead leg corrosion mitigation, monitoring and inspection
outcomes. Corrective action for these programmes if indicated.
−− Review of performance measures where applicable, in particular the assessment of
reactive indicators and the overall trends in proactive indicators. Corrective action in
strategy, organisation and planning if indicated.
−− RCA of dead leg corrosion failures or management system failures with appropriate
−− Capture and roll-out lessons learned.

The outcome of the performance review should be considered together with verification
findings for offshore installations and audit results. Corrective action should be included in
the strategy if indicated.
193
+44 (0)207 467 7100
I.7 GALVANIC CORROSION
I.7.1 Introduction
Galvanic corrosion can occur at the junction of dissimilar metals coupled together in a suitable
electrolyte, typically an aqueous environment or a wet atmosphere where oxygen is present.
The more noble metal (cathode) is protected by sacrificial corrosion of the less noble metal
(anode). The anode corrodes at a higher rate than it would if it were not connected to the
cathode. The relative exposed surface areas of the anode and cathode also have a significant
effect – the corrosion rate of the anode can be high if there is a small anode-to-cathode ratio.
Internal galvanic corrosion is a particular concern in aerated seawater systems which are
particularly susceptible due to high levels of oxygen, chlorine and iron in the water. Production
systems exposed to a water phase may be less susceptible due to the absence of oxygen
and if the production water has lower conductivity than seawater. Dry gas systems are less
susceptible due to the lower proportion of water present and generally low conductivity of
any electrolyte present.
External corrosion is exacerbated in bimetallic couples, for example, dissimilar metals flange
connections, CS bolts in stainless steel or CRA flanges. The severity of the environment
depends upon climatic conditions; it is low in dry or low-humidity regions, moderate in
temperate and semi-arctic regions and in open rural locations, and high in regions with high
humidity such as tropical and marine locations and also in polluted industrial atmospheres.
The following conditions are required for galvanic corrosion to occur:

−− An electrolyte bridging the two metals – which may not necessarily be aggressive
towards the individual metals when they are not coupled
−− Electrical connection between the two dissimilar metals when there is physical
contact or electrical continuity exists between the two
−− A potential difference between the two metals of sufficient magnitude to provide a
significant galvanic current
−− A sustained cathodic reaction on the more noble metal in the couple by either the
reduction of dissolved oxygen, hydrogen ions or other species that may be present
in deaerated environments
In addition to the factors mentioned, others will need to be taken into account:
−− resistance to ionic current flow of the electrolyte.
−− resistance to current flow (by electron conduction) in the conducting materials and
the quality of the connection between them, and
−− the polarisation resistance of both the anode and the cathode.
The severity of galvanic corrosion when two dissimilar metals are in contact will depend upon
the following factors:
−− Electrode potential.
The potential of any alloy, even in seawater, can be changed by a variety of factors
such as temperature, velocity, chemical treatment etc. However, the relative ranking
of alloys usually remains unchanged by these factors.
−− Electrode polarisation.
Depending on the particular metals and the environment, electrode polarisation is
194
+44 (0)207 467 7100
the magnitude of the shift in the potential of the anode to a more electropositive
value and the cathode to a more electronegative value.
−− Variable potential.
The corrosion potential of an individual metal can change and, in certain circumstances,
the polarity of the galvanic couple can change. This is mainly affected by changes in
pH, temperature and whether oxygen is present.
−− Environment.
Factors relating to the electrolyte (water) such as pH, chemical composition,
conductivity and the dissolved oxygen content will affect galvanic couples.
−− Area ratio.
The corrosion rate of an anode will be higher when coupled to a cathode with a
relatively larger surface area.
−− Aeration and flow rate.
In aerobic aqueous solutions where the cathodic reaction is controlled by the
reduction of dissolved oxygen, the reaction rate will depend on the rate of diffusion
of oxygen from the bulk solution to the metal surface. Therefore, both the reactant
concentration and flow rate (transport to the surface) will affect severity and extent
of bimetallic corrosion in the same way as single metal corrosion.
−− Metallurgy.
Differences in specific mechanical properties between nominally similar coupled
metals or alloys can arise from cold working and heat treatment, for example,
resulting in galvanic behaviour.
In weldments, local changes in chemical composition at the weld bead and the heat
affected zone of the parent metal can lead to galvanic corrosion. The specific issues
relating to weldments are described further in Annex I.8.
Alloys of a common type can have differing composition; thus 90/10 cupronickel can
be anodic to 70/30 alloy and austenitic stainless steels are cathodic to the martensitic
stainless steels.
−− Exposure time.
The corrosion rate of both coupled and non-coupled metals/alloys generally decreases
with exposure time due to:
– a reduction in oxygen diffusion through both electrolyte and any corrosion
product present thus limiting the cathodic reaction;
– the corrosion product protecting anodic areas on the metal surface, and
– the development of magnesium and calcium containing calcareous deposits
on the surface of the metal may offer a degree of corrosion protection thus
decreasing the rate of galvanic corrosion.
In contrast, where corrosion products are water-permeable, the rate of galvanic
corrosion can increase because wet conditions are maintained at the surface and can
be more aggressive than the bulk environment.
The development and permeability of corrosion products on the surface of dissimilar
metals in contact can lead to a reduction in coupled corrosion rate over time.
195
+44 (0)207 467 7100
Figure I.19: Galvanic corrosion between a copper and carbon steel galvanised pipe
connected by a dielectric union
Figure I.20: Simplified Galvanic series in seawater (Guides to Good Practice in

Corrosion Control – Bimetallic Corrosion; The National Physical Laboratory, DTI
Publication, 1982)
Although the magnitude of the potential difference alone is not enough to determine
the probability of galvanic corrosion to occur, as a rule of thumb, the galvanic potential
difference between two dissimilar metals in contact, in a severe environment such as
offshore/marine, should not exceed 0,15 V. For a normal ambient environment such as a
196
+44 (0)207 467 7100
storage warehouse or an uncontrolled temperature and humidity environment, a 0,25 V

potential difference is acceptable. For a controlled environment, a 0,5 V potential difference
can be tolerated. Nonetheless, there are other factors to be considered, such as those
described here.
Most seawater resistant grades of stainless steels and Ni-Cr-Mo alloys can be considered
compatible with each other but any of them will promote galvanic corrosion on less noble
alloys such as cupro-nickel and monel; all CRAs will promote corrosion of CS.
Connection of CS to titanium alloys should also be avoided where a risk of galvanic corrosion
or hydrogen charging of the titanium alloy may occur e.g. titanium alloy heat exchangers
(tubes and tubesheets) combined with coated CS (e.g. a water box). Any holidays or defects
in coatings on CSs will result in very high penetration rates of the steel.
At galvanic connections between dissimilar metals without electrical insulation or distance

spool, it can be assumed that the local corrosion rate near the interface will be ~ three times
higher than the average corrosion rate, decreasing exponentially away from the interface
within a length of five pipe diameters. Particular systems may have higher corrosion rates
depending on area ratio and material combinations.37
I.7.2 PLAN
I.7.2.1 Policy
The mitigation strategy options include:

−− The primary mitigation for the threat of galvanic corrosion is in appropriate materials
selection. The original design should identify and eliminate any potential threats.
−− Avoiding small anode/large cathode dissimilar metal couples.
−− Electrical isolation of dissimilar metals.
−− Installation of an internal CP system e.g. resistor-controlled CP (RCP).
−− Installation of a distance spool between the dissimilar metals to separate them by a
minimum of 10–20 pipe diameters, depending on the guidance used. Distance spool
may either be a solid non-conducting material e.g. GRP, or a metal that is coated
internally with an electrically non-conducting material e.g. rubber. The coating
should be applied to the more noble metal of the bimetallic couple.
−− Application of a non-conducting internal coating on the more noble material in
the vicinity of the bimetallic contact. The coating shall extend at least 10–20 pipe
diameters into the more noble pipe material.
−− Apply corrosion allowance (at design) to the less noble metal (hydrocarbon systems).

−− Galvanic couples without any of the mitigating options identified in the previous
paragraph can result in localised corrosion rates of three times the average corrosion
rate. This should be considered when planning change-out of materials.
−− Corrosion monitoring, although possible, is not practical; change-out of material or
implementation of the strategies outlined previously should be pursued.
197
+44 (0)207 467 7100
−− Visual inspection and UT can be used to detect galvanic corrosion e.g. incorrect bolt
specification in flange.
I.7.2.2 Planning
The CMS plan may be part of a wider Integrity Management Plan and CMS Strategy. For
offshore installations the strategy plan should be in line with the verification scheme. For
onshore plants, inspection schemes will be part of statutory WSoE for pressure systems.
Tactical plans may jointly cover activities relating to other related corrosion mechanisms,
e.g. corrosion under deposit; external atmospheric corrosion.
The plans should be translated into an executable plan and schedule for implementation.
The CMS needs to specify the plan with the activities to be carried out to reduce the identified
risk of galvanic corrosion to ALARP. These activities can include:
−− current mitigation methods;
−− definition of KPIs;
−− anomaly management, and
−− organisational responsibilities for planning, execution, mitigation, monitoring and
reporting.
The plan can include:

−− WSoE at corrosion circuit level, pressure vessels, deadleg register;
−− plan instrumentation and data collection;
−− Risk Based Inspection (RBI) elements;
−− planned maintenance routines, e.g. for inspection;
−− inspection work packs in which the responsibilities, coordination, instruction and
scope are well defined, and
−− attendance of the Corrosion and Chemical Management meetings.
I.7.3 DO

Direct measurement gives the most accurate results. Corrosion modelling and rate predictions
can often give variable results; however, this can provide a relative indication on the corrosion
rate.
An assessment of corrosion threats or a CRAS should include consideration of galvanic

corrosion as a credible corrosion mechanism.
The probability of galvanic corrosion occurring can be predicted with consideration given to
following factors:
−− dissimilar metals in contact;
−− electrochemical potential difference between the two metals (see galvanic series);
198
+44 (0)207 467 7100
−− the ratio of area between the two metals (cathode versus anode surface area);
−− presence of coating or cladding;
−− fluid service (wet or dry), corrosiveness, chemical injection, volatiles (dead crude);
−− presence and the conductivity of an electrolyte;
−− temperature, and
−− inspection observations and NDT data analysis.
All personnel involved should be made aware of the factors affecting preferential weldment
corrosion and be vigilant to recognise the indications of, or changes that are likely to cause,
weld corrosion.
Personnel should respond appropriately to any condition recognised as posing a threat and

−− facilities operations teams;
−− Inspection Engineers and NDT contractors, and
−− Corrosion and Chemical Management team.

The strategic plan should be implemented such that the planned activities can be carried out
at the specified frequency.

−− sufficient training of personnel and corrosion awareness, and
−− well defined reporting/communication routes, including clear reporting procedures
The following production parameters should be monitored:

−− pH;
−− partial pressure of CO2;
−− temperature;
−− water, hydrocarbon and gas flow rates;
−− water chemistry for electrolyte conductivity when suspected dissimilar metals are in
contact, and
−− oxygen concentration, where relevant.
treatment changes and inspection/corrosion rate trends.
as to be traceable.
199
+44 (0)207 467 7100
Those data, with the aid of specialist database/tools, should be analysed in order to:
−− trend the uniform or localised corrosion rate;
−− assess if the mitigation implemented is able to reduce corrosion risk effectively, and
−− predict the likely corrosion rate and remaining life of the system or vessel.
I.7.4 CHECK


−− completion of inspection activities (for known material anomalies) against plan and
schedule;
process conditions;
−− completion of inspection activities against plan and schedule;
−− completion of peer reviews;
−− the following can be used as reactive (lagging) indicators;
−− frequency of galvanic corrosion related failures, and
−− corrosion monitoring results against target corrosion rates based on required life.
The RCA of weld corrosion failures or management system failures will be investigated with
the appropriate corrective action(s) recommendation.

I.7.5 ACT

The overall performance review should include consideration of a), b) and c) together with
verification findings for offshore installations and audit results.

a) Annual (and, if appropriate, quarterly) reviews of weld corrosion mitigation,
monitoring and inspection outcomes. Corrective action for these programmes if
indicated.
c) RCA of galvanic corrosion related failures or management system failures with
appropriate corrective action recommendations.
200
+44 (0)207 467 7100

Any activity relating to the management of galvanic corrosion should be included in the CMS
audits.
I.8 WELDMENT CORROSION
I.8.1 Introduction
One key corrosion mechanism affecting CS weldments is that of preferential weldment

corrosion (PWC). The location and morphology of PWC in carbon steel weldments is influenced
by a complex interaction of many parameters including: the parent steel composition, the
deposited weld composition; the welding procedure; the environment and any CI. Changes
in any one of these parameters can cause a significant difference in the weldment corrosion
behaviour.
PWC does not affect stainless steels although corrosion is often localised at welds for a variety
of reasons including chemical composition, microstructure, surface roughness and heat tint.
Figure I.21: Severe corrosion at the weldment (deep groove along the weld)
indicating that weld metal preferentially corrodes in CO2 environment
Figure I.22: Severe weldment corrosion in contact with hydrocarbon condensate

containing only a small amount of water and saturated with CO2
201
+44 (0)207 467 7100
I.8.1.1 Weld procedure

Minor changes to the weld metal composition and control of the microstructure are
adopted during the weld procedure ensure that mechanical properties of the weld metal
are similar to those of the wrought parent pipe.
With manual metal arc (MMA) electrodes, the weld metal is heavily deoxidised resulting in a
fine dispersion of small oxides in the molten metal which act as nucleation sites for acicular
ferrite, which produces a tough final product. These inclusions, together with possible
increases in manganese and silicon, can lead to rapid weld metal corrosion.
With tungsten inert gas (TIG) root runs, the corrosion is often increased due to the
deliberate addition of up to 1 % silicon to the welding wire to ensure adequate weld metal
fluidity. The silicon forms SiO2 inclusions in the weld root which may act as sites for corrosion
to initiate, perhaps by causing weaknesses in semi-protective corrosion product films.
The effect of microstructure on weldment corrosion is secondary to that of composition.

However, with respect to heat-affected zone (HAZ) corrosion, it is generally considered that
harder transformed structures (bainite and martensite) will give higher corrosion rates.
I.8.1.2 Differences in weld/parent material composition

It has been thought that PWC may be controlled by making the weld metal cathodic with
respect to the adjacent parent pipe and HAZ by making minor additions of more noble
elements such as: nickel; chromium; molybdenum; copper; aluminium; vanadium, etc. all
of which may assist in the formation of a more protective oxide film. Nevertheless, these
additions must be made with caution since over-alloying can result in enhanced HAZ corrosion.
I.8.1.3 1 % Nickel filler weldments

Weld consumables containing nickel are primarily designed to meet strength and toughness
criteria. Nickel is an austenite stabiliser, depressing the austenite to ferrite transformation
temperature and thereby providing a finer grain size.
An arbitrary 1 % Ni limit was set in accordance with NACE MR01-75 Materials for Sour
Service. These recommendations have also been applied to sweet systems. 1 % w Ni-
containing weld consumables should be used to minimise the risk of PWC. Although
satisfactory for the majority of applications, there have been instances where severe PWC
has occurred in sweet environments under certain conditions.
Before assessing possible causes of preferential corrosion of Ni-containing weldments,

it is worth considering the effect on corrosion of alloy element additions, including Ni, to
the parent pipe. For example, it has been reported that CSs with additions of nickel (1,4–
3,35 % wt Ni) corrode faster than steels with low Ni and similar Cr contents.
A wide variation in composition is possible within any single pipe specification. The
specifications are typically based on mechanical requirements with few compositional
restrictions and this must be considered when selecting the consumable for a particular
application.
Manufacturers of line pipe, primarily using scrap, produce steels which can have significant
levels of residuals, e.g. Ni, Cr, Cu, Mo etc.
These observations are important in interpreting the behaviour of Ni-containing weldments.
202
+44 (0)207 467 7100
I.8.1.4 Environmental considerations

All of the factors which influence CO2 corrosion (such as pH, partial pressure of CO2, flow
rate/velocities/regime, temperature, acetate content, etc.) will also have an effect on the
location and severity of PWC. Many of these parameters are interrelated and it is therefore
difficult to assess their influence in isolation. However, under high flow rate conditions, less
compact/adherent films or scales on the weld metal might be removed while films on the
parent pipe remained intact which may lead to a switch from cathodic to anodic weld metal
behaviour.
I.8.1.5 Electrolyte conductivity

Failures due to HAZ attack have been observed in thin film environments where high
electrolyte resistance limits the anodic area to a narrow band adjacent to the weld bead.
A trend emerged which suggests that the most severe preferential corrosion of Ni weld metal
occurs under wet gas operating conditions, although it has also been observed in oil lines.
It is thought that the effects of high conductivity can limit the 'throwing power' and hence
localise the attack with regard to preferential corrosion of Ni-containing weldments.
I.8.1.6 Seawater
Ni-containing weld metals have been widely used in seawater applications, without selective
attack of the weld metal or HAZ. In seawater, the corrosion rates of both weld and parent
metal are largely controlled by oxygen mass transfer, therefore the inherent corrosion rate
of the weld metal cannot be larger than that of the parent. Under these circumstances,
preferential corrosion of weldments will not occur.
I.8.1.7 Inhibitors
The severity of selective attack on 1 % Ni weldments can only be explained if there is a
large difference between the intrinsic corrosion rates of the weld and parent metals.
Therefore, it is thought that some weldment failures have been associated with under-dosing
of inhibitors.
With sub-optimum dosing and/or a long precorrosion period highly selective attack of the
weld metal can occur.
In both cases, the problem arises from the inability of the inhibitor to protect the weld metal,
while it does protect the parent. This results in the weld corrosion rate being higher than that
of the parent metal and can result in the weld becoming anodic, although galvanic currents
are a comparatively small contribution to the overall corrosion behaviour.
I.8.1.8 Stainless steel welds

Stainless steel weld metal can be less corrosion resistant than parent metal, resulting
in corrosion at the weld in service conditions that do not attack parent metal. Welding
consumables are usually selected so as to match or over-match the parent metal alloy content
and hence corrosion resistance.
The surface of welds can create conditions conducive to corrosion including:

−− residual welding flux, creating the risk of crevice corrosion;
−− microfissures, lack of sidewall fusion and over-penetration, creating the risk of crevice
corrosion;
203
+44 (0)207 467 7100
−− rough surface condition, creating sites for the attachment of biofilms and hence
increasing the risk of MIC, and
−− poor surface profile, creating a stress concentration effect at the weld toe, hence
increasing the risk of SCC.
Heat tint on and adjacent to welds made with inadequate shielding results in reduction
of corrosion resistance of affected areas. Heat tint consists of a heterogeneous oxide
composed primarily of iron and chromium above a chromium-depleted layer of base metal.
The defects, internal stresses and composition of the heat-tint oxide make it a poor barrier
to any corrosive media that might initiate localised corrosion in the chromium-depleted
layer of base metal. There are no universally agreed criteria for what degree of heat tint is
acceptable and whether it should be removed.
Metallurgical consequences of welding can include:

−− Precipitation of chromium carbides on grain boundaries in the heat affected zone
'sensitisation', for example creating the risk of chloride SCC, and in the right
conditions polythionic acid SCC of austenitic steels.
−− Formation of delta ferrite (in austenitic steels), creating the potential for preferential
phase corrosion.
−− Formation of intermetallic precipitates (chromium nitride) and third phases (sigma
etc.), creating the potential for pitting corrosion in duplex steels due to localised alloy
element depletion
−− Alteration in the phase balance (increase in ferrite content) in duplex steels
−− Microsegregation of alloy elements (particularly Mo) or coring in weld metal dendrites,
creating the risk of pitting corrosion. This issue mainly affects superaustenitic steels
I.8.2 PLAN
I.8.2.1 Policy
Safety, environmental and commercial policies influence the choice of strategies for
mitigation and monitoring/inspection. Mitigation strategy options include:
−− Appropriate choice of welding method:
– Welding should be carried out with high rather than low arc energy to give
slower cooling rates around the weld zone with correspondingly softer
microstructural constituents, thus avoiding formation of the harder transformed
structures, bainite and martensite.
– Appropriate choice of filler material, e.g. Ni/Cu containing filler1, matching
consumable or hybrid weldment.
– Avoiding weldments where possible.
– Stringent control of weldment quality, e.g. control of microstructure, weld
dimension, and low porosity.
−− Use of CI2,3.
−− Use of coating3.
−− Use of CP, this however, can lead to HE of weldments3.
204
+44 (0)207 467 7100
Notes:
−− The use of Ni containing filler materials should be used with consideration given to
the conductivity of the environment.
−− Laboratory testing of the CI with the weldment is highly recommended.
−− Should these mitigations fail or become inadequate, the corrosion of weldments can
be significant.

−− process parameter monitoring, e.g. maintaining CI dosing etc;
−− corrosivity measurement, e.g. on-line electrical resistance probes, welded weight loss
coupons, and
−− metal loss measurement; intrusive or non-intrusive inspection4.
Note 4:
−− Detection and measurement of PWC by NDT is difficult. UT, RAD and TOFD all have
limitations.
I.8.2.2 Planning
The CMS plan may be part of a wider Integrity Management Plan. For offshore installations
the strategic plan should be in line with the verification scheme.
Tactical plans may jointly cover activities relating to other corrosion threats. Onshore
inspection schemes will be part of statutory WSoE for pressure systems.
The defined strategic plan needs to be translated into a tactical plan and schedule for
implementation.
The CMS plan needs to specify the activities to be carried out to reduce the identified risk of
weldment corrosion to ALARP initially by correctly identifying the risk. Activities can include:
−− measurable performance targets;
−− immediate action required in event of non-conformance;
−− anomaly criteria and reporting requirements, and
−− organisational responsibilities for mitigation, monitoring and immediate action.
The tactical plan can include:

−− written procedures at item level;
−− plant instrumentation and data collection via DCS and data historian;
−− planned maintenance routines, e.g. for inspection tasks, corrosion monitoring
services, chemical sampling and analysis, and
−− inspection and corrosion monitoring service work packs, covering responsibilities,
coordination, procedures and scope.
205
+44 (0)207 467 7100
I.8.3 DO

Direct measurement gives the most accurate results. Corrosion rate predictions can often
give variable results; however, this can provide a relative indication of the corrosion rate.
An assessment of corrosion threats or a CRAS should include consideration of the weldment

corrosion threat, if weldments are present.
The probability of PWC occurring can be predicted with consideration given to:
−− the welding procedure used;
−− the type of weld; e.g. CS matching consumable, nominally 1 % Ni weld metal;
−− the chemical composition of the parent pipe and the weld metal;
−− the weldment environment; e.g. flow rates, pH, temperature;
−− the likelihood of scale forming on the weldment surface;
−− the electrolyte conductivity;
−− CI testing using representative segmented weldment electrodes in the simulated
process environment;
−− quantitative predicted corrosion rates for the anticipated mode of corrosion;
−− on-line corrosion monitoring data and results, and
−− inspection observations and measurements.
All personnel involved should be made aware of the factors affecting PWC and be vigilant to
recognise the indications of, or changes that are likely to cause, weld corrosion.

−− Facilities Operations teams, and

The strategic plan should then be implemented such that the planned activities can be carried

206
+44 (0)207 467 7100
The following should be monitored:

−− process parameters; pH, partial pressure of CO2, temperature, water/hydrocarbon/
gas flow rates, water chemistry;
−− corrosion rates using weight loss coupons/ER probes;
−− chemical treatment and CI injection, and
−− inspections; in-line inspection, NDT.
treatment changes and inspection/corrosion rate trends. Statistical analysis can be applied to
enhance the value of NDT data.
as to be traceable.
These data gathered, with the aid of specialist database/tools, should be analysed in order to:
−− trend the weld corrosion rate;
−− assess if the mitigation implemented is able to reduce weld corrosion risk effectively;
−− determine root cause of any process upsets, e.g. CI unavailability due to a broken
pump that resulted in increased weld corrosion rate, and
−− predict the likely corrosion rate and service life of the weldment.
I.8.4 CHECK


−− occurrence and frequency of process parameters, such as oxygen, CO2, that are out
of specification;
process conditions, and
−− completion of inspection activities against plan and schedule.

−− frequency of weld corrosion related leaks, and
−− corrosion monitoring results against target corrosion rates based on required life and
corrosion allowance.

207
+44 (0)207 467 7100
The RCA of weld corrosion failures or management system failures will be investigated with
the appropriate corrective action(s) recommendation.
I.8.5 ACT

The overall performance review should include consideration of the performance targets
together with verification findings for offshore installations and audit results.

−− Annual (and, if appropriate, quarterly) reviews of weld corrosion mitigation,
indicated.
−− Review of performance measures, in particular the assessment of reactive indicators
−− RCA of weld corrosion failures or management system failures with appropriate

Any activity relating to the management of PWC should be included in CMS audits.
I.9 GROOVING CORROSION OF PIPELINES
I.9.1 Introduction
Grooving or 'channelling' corrosion is known to occur in water injection pipelines and in

some oilfield pipelines.
In water injection systems, grooving corrosion can result from a combination of debris at the
bottom of the pipeline, a loss of microbial control and specific flow dynamics.
As well as being an issue in water injection systems, grooving corrosion has been a
significant cause of degradation in Russian and western Siberian oil pipelines, where it
typically occurs in large diameter horizontal pipelines that carry three-phase oil, gas and
water.
Grooving corrosion is distinct from preferential weld corrosion. PWC is related to metallurgy,
whereas grooving corrosion is a form of erosion-corrosion and therefore better described as
an electro-physical mechanism.
Grooving occurs at, or close to, the 6 o'clock position in pipelines, it may be many centimetres
wide and continue along the pipeline for a number of metres (~12 m) or even for several
kilometres.
In water injection lines, corrosion rates of 1–2,5 mm/y have been observed. In the Siberian
oil pipelines, experimental work determined that rates of attack were typically 4–8 mm/y but
could be as high as 18 mm/y in some instances.
208
+44 (0)207 467 7100
I.9.1.1 Initiation
The precursors for initiation of grooving corrosion in water injection lines are:
(a) Solids: If filters become blocked or damaged, sand and crustaceans may pass
through because the filter has been bypassed rather than repaired. In addition, solids
may form inside the lines due to inadequate dissolved oxygen control.
(b) Microbial proliferation: loss of microbial control results in proliferation of SRB.
Colonies are established on the internal walls of the pipeline.
(c) Flow dynamics: the flow rate is not sufficiently high to maintain the suspension of
solids in water. Solids may be transported along the bottom of the pipe depending
on the pipeline diameter and the density and size of the solids.
Factors a) and b) largely result from poor management of water injection lines.
The precursors for the development of grooving corrosion in three-phase oil pipelines are
similar:
−− stratified flow;
−− water drop-out in the line;
−− a surface scale/film or microbial film, and
−− solid particles (e.g. sand) present in the process fluids.
I.9.1.2 Mechanism
Grooving corrosion is a combination of erosion and corrosion mechanisms, typically caused
by the localised disruption of surface films/scales by particulate matter continually tumbling
along the bottom of the pipeline. The mechanism for grooving corrosion can be described as:
−− the continuous removal of the protective film and activation of the bare metal
surface, and
−− the formation of an active galvanic couple between the bare metal and the pipe
surface that is covered with the protective film.
The overall process of grooving corrosion can be described in four steps and is illustrated in
Figure I.23 below:
1. Development of Fe3O4, FeCO3, CaCO3, FeS films/scales and/or biofilm resulting from
corrosion, microbial activity or precipitated from free water present at the bottom of
a pipe.
2. Mechanical action of abrasive particulates in the fluids flowing along the bottom
of the pipe eroding the film/scales at the 6 o'clock position due to the flowing
conditions and the abrasive action of particulates at the bottom of the pipeline.
3. Continuous exposure of the bare metal around the 6 o'clock area leads to the
development of a galvanic couple between the bare metal (anode) and the remaining
pipe (cathode) with a ΔE of ~100–200 mV.
4. Accelerated corrosion continues in the grooved region of the pipe due to the effect
of a small anode (groove) coupled to a large cathode (rest of the pipe).
209
+44 (0)207 467 7100
Figure I.23: The four steps in the formation of groove corrosion: (1) the formation of
films/scales; (2) erosion of film/scale at/near the 6 o' clock position; (3) formation of
a galvanic couple and (4) corrosion attack forming a groove38
The size and depth of the groove will depend upon both flow and pipeline topography.
Higher velocity flow will produce narrow deep grooves and slower flow will produce shallow
and broad grooves. Generally the width and depth of the groove is inversely related; as one
decreases the other increases. This is thought to be due to the reaction driven by the ratio
of the anode-to-cathode area and mass transfer effects of the reactants. Grooves generally
form in horizontal spools, although grooving has been known to occur in vertical risers.
I.9.1.3 Detection methods

Monitoring methods include microbial surveys, corrosion coupons and recording and
analysing dissolved oxygen levels at the inlet. However, whilst these indicators will provide
a guide to the corrosion damage sustained at the immediate topside pipework, riser
and first few kilometres of pipeline, they will not indicate whether grooving corrosion is
occurring and they may actually give a false sense of security as to the condition of the line.
For example, poor oxygen control during previous operation can lead to the initiation of
grooving corrosion and once this is under control, the corrosion mechanism can continue
unless the cathodic reactant is completely removed which is impossible in practice.
Intelligent in-line inspection can be employed to detect grooving corrosion in pipelines.

Ultrasonic (UT), Magnetic Flux Leakage (MFL) and RSTRENG have been successful at detecting
and accurately sizing this feature.
External UT survey can be used to identify areas where grooving in a pipeline is likely to occur
based on predictive modelling.
210
+44 (0)207 467 7100
Flow Assurance can be used to determine whether grooving has occurred in a pipeline; it
cannot determine the exact location, rate or extent of attack.
The expected topside and well pressures are predicted using flow assurance modelling.
If the actual measured pressures deviate from the predicted values this can indicate the
development of grooving corrosion. Depending on the flow rate, a reduction in the expected
pressure can result from increased volume in the pipeline, indicating that a channel is present.
Conversely, increased well pressure can occur as a result of debris build-up.
I.9.1.4 Mitigation
In general, pipelines that have been managed well throughout their life, i.e. equipment
maintained in good working order, appropriate chemical treatment, frequent cleaning pig
and biocide treatments etc., tend not to succumb to grooving corrosion.
Once grooving corrosion manifests, it will continue to propagate even if effective mitigation
measures are introduced, albeit at a slower rate.
The recommended actions in order to avoid the initiation of grooving corrosion include:
−− a strategic microbial survey regime to monitor the effectiveness of the chemical
control programme;
−− maintain sessile and planktonic populations to <102 cells per cm2 to control the
threat;
−− dissolved oxygen (DO) concentrations should be limited in the range 5–10 ppb and
monitored continuously, and
−− particulate solids should be controlled by fine filtration of seawater.
I.9.2 PLAN
I.9.2.1 Policy

−− awareness of the conditions that can lead to grooving corrosion, and
−− appropriate CM of lines, oxygen control, regular biociding and maintaining filters.
The monitoring/inspection strategy can include:

−− monitoring of process conditions, including CI, and
−− metal loss measurement; intrusive or non-intrusive inspection.
I.9.2.2 Planning
The CMS plan may be part of a wider Integrity Management Plan. For offshore installations
the strategic plan should be in line with the verification scheme.
Tactical plans may jointly cover activities relating to other corrosion threats. Onshore
inspection schemes will be part of statutory WSoE for pressure systems.
The defined strategic plan needs to be translated into a tactical plan and schedule for
implementation.
211
+44 (0)207 467 7100
The CMS plan needs to specify the activities to be carried out to reduce the identified risk of
grooving corrosion to ALARP. Activities can include:
−− monitoring methods;
−− measurable performance targets, and
The tactical plan can include:

−− written procedures at item level;
−− plant instrumentation and data collection via DCS and data historian;
−− planned maintenance routines, e.g. for inspection tasks, corrosion monitoring
services, chemical sampling and analysis, and
coordination, procedures and scope.
I.9.3 DO

An assessment of corrosion threats or a CRAS should include consideration of the grooving
corrosion threat.
The probability of grooving corrosion occurring may be assessed with consideration given to
the following:
−− the flow regime;
−− the presence of a surface film/scale;
−− solid particles in the process fluids;
−− inspection observations and measurements, and
−− monitoring data.
All personnel involved should be made aware of the factors affecting grooving corrosion and
be vigilant to recognise the indications of, or changes that are likely to lead to, it.

−− Facilities Operations teams, and

The strategic plan should then be implemented such that the planned activities can be
carried out at the specified frequency.
212
+44 (0)207 467 7100

that address and rectify any out of specification incident
The following should be monitored:

−− microbial levels;
−− sessile and planktonic populations;
−− DO concentrations, and
−− levels of particulate solids
as to be traceable.
These data should be analysed in order to assess if the mitigation implemented is able to
reduce the grooving corrosion risk effectively.
I.9.4 CHECK


−− effectiveness of response/corrective actions taken in the event out of specification
−− completion of inspection activities against plan and schedule.

−− frequency of leaks resulting from grooving corrosion.

The investigation will be in accordance with the CMS plan which may be part of a wider
integrity management plan.
The RCA of grooving corrosion failures or management system failures will be investigated
with the appropriate corrective action(s) recommendation.
I.9.5 ACT

The overall performance review should include consideration of the performance targets
together with verification findings for offshore installations and audit results.
213
+44 (0)207 467 7100

−− Annual (and, if appropriate, quarterly) reviews of grooving corrosion mitigation,
indicated.
−− Review of performance measures, in particular the assessment of reactive indicators
and the overall trends in proactive indicators. Corrective action in strategy,
organisation and planning, if indicated.
−− RCA of grooving corrosion failures or management system failures with appropriate

Any activity relating to the management of grooving corrosion should be included in CMS
audits.
I.10 FLANGE FACE CORROSION
I.10.1 Introduction
The term 'flange face corrosion' (FFC) is used to describes the internal corrosion occurring
on the flange faces of pressure system components. It is conceivable that FFC could arise
from the external environment; however, this is very rarely the case and the discussion
in this management guide is restricted to FFC arising due to the internal pressure system
environment. The external corrosion of flanges and flange bolting is addressed in I.11.
The FFC mechanism is similar to crevice corrosion and tends to remain undetected until
the flange is dismantled to allow internal access to the pressure system or when corrosion
damage progresses to the point of failure and a leak occurs.
214
+44 (0)207 467 7100
Figure I.24: Flange face corrosion
Figure I.25: Flange face corrosion revealed following breaking of the flange joint
and surface cleaning
Seawater systems are particularly prone to FFC due to the corrosivity of the medium (i.e.
oxygenated seawater) in contact with the internal surfaces of the flange. CS sections of
seawater systems, such as coarse seawater filters and pipe spools, are typical locations that
are prone to FFC.
Mitigation measures used to eliminate and/or reduce the occurrence of FFC include internal
coating of rebated flanges, weld overlaying sealing areas of flange faces with high Ni-
containing CRA metal, correct selection of gasket and retaining ring types, external protection
of flanges to avoid water ingress.
215
+44 (0)207 467 7100
In recent years NDT inspection has taken great strides, amongst others in the development
of advanced Phased Array UT (PAUT) inspection technique. The development of PAUT for
flange face inspection has enabled FFC to be detected from external surfaces without the
need to split the flange; the technique has been demonstrated on piping flanges from
as small as ¾". The main restriction to the flange face coverage of the technique is the
restricted access to the flange surface due to the presence of the bolt heads and nuts; this
restriction often prevents 100 % inspection of the flange face.
I.10.2 PLAN
I.10.2.1 Policy
The Duty Holder/Operator should manage the continued integrity of all sites with the aim of
minimising risks to personnel, environment and business from the threat of FFC.
The Policy should cover all integrity risks and should provide direction in many areas of
corrosion risk management, amongst these FFC.
Including FFC in the Integrity Management Policy and therefore having a systematic approach
to managing and mitigation against the mechanism will not only improve the integrity of the
site, but also contribute to improved uptime of the facility. FFC that goes undetected until
a leak occurs, or if the mechanism is found unexpectedly in a turnaround (shutdown), may
result in extensive plant unavailability and consequently significant commercial loss.
I.10.2.2 Planning
The CMS plan may be part of a wider Integrity Management Plan. For offshore installations,
the strategic plan should be aligned with the verification scheme. For onshore processing
facilities in the UK, the inspection scheme for the pressure equipment is part of statutory
PSSR WSoE.
Tactical inspection plans for FFC may jointly cover activities relating to other corrosion threats.
The planning of the activities required to initially determine the process systems risk of FFC
and subsequently determining suitable mitigation and inspection activities is key to achieving
the requirements of the CMPy.
The activities that are required to be carried out may be divided into discrete areas:
(a) Elimination/reduction of the risk, through:
– the use of gasket/insulating material compatible with the base flange material
and the process fluids;
– regular monitoring via inspection of the flange to monitor ongoing integrity of
the flange joints, and
– and by specifying and using correct torqueing procedures.
(b) Identification of equipment at risk, through:
– screening of flanges to a predefined set of rules that identify the risk criteria, and
– creation and maintenance of a disturbed flange register.
(c) Prioritisation of inspection activity based on:
– consequences of failure, and
– system history.
(d) Definition of inspection scope, detailing:
– type of Inspection;
– frequency of inspection, and
– activities to be implemented as part of flange dismantling.
216
+44 (0)207 467 7100
Both planned and opportunistic inspections should include the inspection of flange faces
where possible, especially for systems where a significant threat of FFC has been identified.
I.10.3 DO

The risk profiling for FFC shall be carried out through a series of activities and assessments as
outlined in this section.
CRAS should consider the following threats to flanges:

−− exposed crevices (internal or external) where water can settle;
−− vertical flanges;
−− misalignment of flange faces;
−− dissimilar materials (galvanic corrosion), gaskets;
−− coating damage or insufficient coating overrun at flange face;
−− pressure rating incompatibilities, and
−− corrosive medium in contact with the internal surfaces of the flange face.
The FFC probability can be determined from a combination of:

−− inspection observations and measurements;
−− leak detection;
−− operating temperatures and flange pipe class, and
−− threats to flanges listed in the previous paragraph.
The FFC threat will normally have a number of line items in the CMS plan matrix to specify:
−− performance standards;
−− monitoring methods and frequencies, and
−− immediate action required on non-conformance.
Tactical planning activities result in:

−− coating maintenance programme, which may be risk based;
−− leak detection;
−− planned maintenance routines, e.g. for inspection tasks, coating maintenance,
replacement of corroded items, and
coordination, procedures, scope, anomaly criteria and reporting requirements.
Specific monitoring and inspection methods include:

−− Visual inspection: this can be staged. First, close visual inspection (CVI) to identify
areas of concern. Second, if encapsulated remove any encapsulation system present.
If isolated, ensure the presence of electrical insulation or bonding (if required).
217
+44 (0)207 467 7100
−− Specialised inspection: phased array, non-intrusive ultrasonic inspection of flange

faces using shear wave techniques
I.10.3.2 Organising
Organising the activities and assessments required for the management of FFC is a multi-
discipline responsibility and will need all areas of the plant organisation to work together
both in terms of making resources available and in terms of ensuring roles and responsibilities
are well understood and communicated.
Organisational roles that are normally required to be involved in the management of FFC
include:
−− Process Engineers;
−− Plant operators;
−− insulation materials suppliers and applicators;
−− Facilities Maintenance teams;
−− Inspection Engineers and NDT contractors;
−− Structural and Mechanical Engineers, and
−− Piping Engineers and piping designers.

−− factors that influence FFC, and
−− the importance of having a sound tactical approach.
Organisational responsibilities for mitigation, monitoring and immediate action should be

clearly understood by all personnel involved.

Implementation of FFC mitigation, monitoring and inspection activities should be done in
accordance with the plans that are derived from the risk assessment and based on reviews
of actual performance on the facility being considered. The tactical plans arising from these
higher-level plans include:
−− RBI plan, and
−− mechanical flange break inspection programme/regime.
It is possible that the inspections may need to be brought forward or pushed out, to fit with
other planned works; however, the implications of such delays for flange integrity must in
each case be understood and addressed.
The outcome from the application of this strategy will be a rolling programme of flange
inspections scheduled within the maintenance management system (MMS).
The implementation of a mechanical flange break inspection campaign should provide for
flange face repairs according to approved procedures, e.g. welding or coating resurfacing
undertaken according to system requirements and within the installations work permit
system requirements.
218
+44 (0)207 467 7100
I.10.4 CHECK
All Integrity Management systems set up for the facility shall include ways of measuring
performance of the activities being carried out, in this case, the FFC management.

The success or limitations of the system for the management of FFC will typically be evaluated
by consideration of the following specific activities:
−− completion of planned flange inspection activities;
−− close-out of remedial activities, and
−− completion of gasket replacements where reviews identified that improvements
were required.

In order to build actual knowledge of the performance of the facility it is important to
investigate the causes of corrosion and degradation related incidents and accidents, thereby
improving future assessments and reducing the likelihood of reoccurrence.
Integrity Management Plan.
The RCA of FFC failures or management system failures will be investigated with the
appropriate corrective action(s) recommendation.
I.10.5 ACT
I.10.5.1 Review performance

A review of the system for the management of FFC – typically annually or biennially – can be
beneficial in the following ways:
−− identifying overall trends in the performance indicators described, and
−− identifying the root causes of flange face corrosion.

There should be feedback from the performance review in terms of:
−− gasket selection;
−− internal coatings at flange faces;
−− piping joint design, and
−− non-intrusive inspection techniques.
The management of FFC should be addressed during the audit of CM.
I.11 ATMOSPHERIC EXTERNAL CORROSION
I.11.1 Introduction
Atmospheric external corrosion is a threat to structural items (including: structural steelwork;

handrails; walkways; stairs; pipe supports; fittings; brackets; unistruts and cable trays); process
219
+44 (0)207 467 7100
equipment (including pipes, valves, bolted flanges, vessels) and mechanical equipment
(including cranes, turrets etc.) on offshore installations and onshore upstream terminals.
Although the threat is important for CSs certain threats also apply to CRA and aluminium
alloy structures.
External corrosion is a form of oxygen corrosion. General corrosion will occur where surfaces
are continuously or intermittently wetted with aerated water. However, higher localised losses
occur due to differential aeration effects in which a corrosion cell is set up between corroding
(anodic) areas that are depleted in oxygen and (cathodic) areas rich in oxygen due to their
proximity to the air/water interface. Airborne salt contamination can increase corrosivity and
the tendency for pitting.
Classically differential aeration can occur between the corroding centre of a water droplet
and the edges that are in contact with the air. Various forms of crevice corrosion are
generally the most damaging. Corrosion occurs preferentially inside the crevice where there
is oxygen depletion. A crevice is formed, for instance, where pipe is held against a support,
where grating is set in an angle frame, where labels and signs are attached, where bolts
pass through bolt holes, etc. A crevice can also form at the edge of a coating where it has
broken down and this is the primary cause of rusting when coatings deteriorate. Steel with
thick and strong coatings may be more susceptible to corrosion under coating due to more
severe corrosion occurring in a deepening edge crevice between the damaged coating and
the sub-straight, under-rust, compared to areas with thinner and weaker coating where the
coating may readily break back to a new edge.
Where rust films form, such as in a water droplet or at a coating edge, the moisture-saturated
rust can form a site for further localised corrosion due to the oxygen depletion beneath it.
This leads to the formation of rust scabs.
Stainless steels, whilst generally more resistant, can still suffer localised corrosion where
oxygen is absent such as in crevices or under deposits. At temperatures over about 40 °C in
combination with salt contamination, stainless steel items under stress can fail by SCC.
Generally, marine atmospheric external corrosion rates are quite low, i.e. not more than
0,2 mm/yr; however, some conditions cause much higher rates, even up to 1,0 mm/yr. These
include:
a) Continuous exposure to salt water, e.g. from deluge systems, from overhead leaks
and in splash zones. The highest rates are found on hot risers in the splash zone, and
where salt water leaks onto hot pipes.
b) Where water is trapped particularly where the water is hot or salt laden.
c) Leaks of more corrosive fluids impacting the steel surface, e.g. dripping well treating
acids, anti-scale treatment chemicals.
Where the condition for external galvanic corrosion exists this can significantly increase the
local corrosion rate as identified in b) and described in I.7.
Examples of external corrosion are shown in Figures I.26-28.
220
+44 (0)207 467 7100
Figure I.26: External corrosion of a pipe at a pipe support. Both the pipe and the
support are corroding at the crevice formed between the two. The coating is also
breaking back as it under-rusts in the crevice at the edge
Figure I.27: Heavy under-rusting of the paint film on a flange
Figure I.28: Handrail corroded by leak of firefighting foam concentrated chemical
221
+44 (0)207 467 7100
I.11.2 PLAN
I.11.2.1 Policy
The strategy employed for managing atmospheric external corrosion will be influenced by
the company Safety, Environmental and Commercial policies. The company policies will
greatly influence the choice of strategies for mitigation and monitoring/inspection deployed
in relation to atmospheric external corrosion.
The strategy for mitigation should consider:

−− the remaining expected life required from the facility;
−− the material selection used in coupled systems;
−− the barrier placed between dissimilar materials where these would otherwise be in
contact;
−− the potential for unintended dissimilar materials in contact and the consequence and
the potential for a large cathode area relative to a small anode area, and
−− the painting and coating strategy deployed for the facility and the strategy for
maintenance of external coatings.
Strategies for monitoring and inspection as well as mitigation of atmospheric external

corrosion shall consider:
−− the overall inspection strategy for the facility, which may originate from a RBI strategy;
−− facility operating life expectancy vs the original design requirements;
−− expected future life requirements for the facility;
−− the rate of expected corrosion together with knowledge of the original coating
selection, and
−− the operating conditions for the facility.
I.11.2.2 Planning
The CMS plan may be part of a wider Integrity Management Plan. For offshore installations,
the strategic plan should be in line with the verification scheme. For onshore UK facilities, the
inspection plan shall be described in the statutory WSoE as defined in PSSR.
Mitigation strategy options for atmospheric external corrosion include:

−− low alloy steel with a corrosion allowance;
−− organic coatings;
−− metallic coatings, e.g. galvanising, thermal sprayed, electroplate;
−− more resistant materials, e.g. stainless steel, composites, aluminium, and
−− design detail, e.g. to avoid crevices.
The Strategy may be determined during design stage taking into account life cycle cost.
Organic coatings and low alloy steel, together with attention to design details, is the most
common approach (see J.2 for more information). Metallic coatings and use of resistant
materials are mainly used for situations where safety risk dictates, or the lifetime cost justifies,
the choices. Composites and aluminium are often employed for weight reduction as well as
corrosion avoidance.
Coating maintenance is a 'high ticket' item in maintenance budgets and the strategy may
attempt to find an optimum between coating maintenance cost and repair and refurbishment
cost, where safety and environmental considerations allow.
222
+44 (0)207 467 7100
Whilst the coating on a steel structure is in reasonable condition, the strategy may focus
on coating condition and on coating maintenance. Later, where the coating is allowed to
break down, or be seen to be breaking down, the strategy shall address options and risk
associated with deferring coating maintenance and allowing corrosion to occur where there
is an effective corrosion allowance (ECA). Where ECA is considered, it must be noted that
similar items in the same structure may have a variety of ECAs due to varying structural
utilisation. Pipework and vessel corrosion allowances are generally provided to allow for
internal corrosion and the ECA for external corrosion (if any) depends on the actual internal
corrosivity.
Where corrosion has already occurred due to coating degradation the strategy will need to
concentrate on the remaining substrate condition and on determining fitness-for-purpose,
followed by suitable mitigation to restore protection or implementing repair, as appropriate.
Where painting maintenance has been extensively deferred and potential corrosion damage
to the substrate is widespread, structural, piping and operational discipline experts shall be
consulted to assist with considerations of the consequences of failure as well as prioritisation
of the mitigation choice. Aim to minimise damage to grating supports as replacement/repair
requires considerable effort.

−− visual examination, and
−− metal loss measurement, e.g. NDT, pit depth measurement, specialist methods such
as PEC.
I.11.3 DO

CRAS should always include external atmospheric corrosion threats. External corrosion
likelihood and metal loss rate can be determined from a combination of:
−− corrosion rates from published exposure trial data;
−− coating performance from trial data and service experience, and
−− inspection observations and measurements.
Published exposure trials will rarely match the user's conditions closely. Coating performance
is dependent on a large range of factors. Judgement is required in adopting appropriate
values.
The atmospheric corrosion threat will normally have several line items in the CMS plan matrix
to specify:
−− KPIs;
−− immediate action required on non-conformance, and
Particular consideration shall be given to light section structures (e.g. grating, floor plating,
hand railing, enclosures) and thinner wall small bore piping, all of which may have a safety
critical function.
223
+44 (0)207 467 7100
It should be noted that UK Health and Safety legislation requires work equipment to be
'maintained in an efficient state, in efficient working order and in good repair'. If the
integrity of a structure is tolerant to the maximum amount of corrosion loss that might
occur over its life, then a strategy to omit coating maintenance may be considered, although
it should be borne in mind that such strategies may be challenged by the UK Regulator,
who may seek demonstration that all reasonably foreseeable risks arising from such an
approach have been identified and are being managed to ALARP. Furthermore, factors such
as possible alternative use, life extension, unacceptable appearance and safety threats from
falling corrosion product should be considered.
Unless a degree of metal loss is acceptable, monitoring frequencies must allow coating
deterioration to be trended so that maintenance occurs before metal loss is structurally
significant.

−− coating maintenance programmes, which may be risk based;
−− campaign programmes of survey, assessment and repair that may use risk based
prioritisation of assessment and repair;
−− planned maintenance routines, e.g. for inspection tasks, coating maintenance, and
coordination, procedures, scope, anomaly criteria and reporting requirements.
Tactical plans may jointly cover activities relating to other corrosion threats. Proprietary
database driven risk based methodologies for coating maintenance programme planning
exist and may be utilised to develop overview of a facility's coating condition and to run
maintenance and repair scenarios to optimise the fabric maintenance benefit and spend.
Onshore inspection schemes will be part of the statutory WSoE for pressure systems
under PSSR.
If risk based approaches are used the consequences of failure must include consideration of
the loss of function of structural items such as loss of escape routes, hazards from dropped
objects and loss of positive pressure capability of enclosures.
I.11.3.2 Organising
Organising the activities and assessments required for the management of external corrosion
is a multi-discipline responsibility and will need all areas of the plant organisation to work
together, both in terms of making resources available and in terms of ensuring roles and
responsibilities are well understood and communicated.
Organisational roles that are normally required to be involved in the management of flange
face corrosion include:
a) Corrosion and materials specialists.
b) Coating materials suppliers and applicators.
c) Specialist contractors for coating maintenance planning.
d) Facilities maintenance teams.
e) Inspection Engineers and NDT contractors.
f) Coating Inspection technicians.
224
+44 (0)207 467 7100
g) Structural and mechanical engineers.
a) and c) lead on risk assessment, planning and analysis; d) leads on mitigation implementation
with support from b); e) leads on metal loss measurement and visual assessment; f) leads
on coating condition survey; e) and (g) work on defect assessment.
Either specialist personnel or the inspection team may engage in coating condition evaluation
but in either case appropriate training should be provided. The coating maintenance
contractors may provide the training.
Communication and reporting of coating condition should aim at increasing awareness of

the:
−− Factors that influence atmospheric corrosion, e.g. the location and temperature
exposure of the item.
−− Correlation between visual appearance and structural severity and consistent
reporting standards for coating breakdown (see J.2.). Coating breakdown may
look bad, but may not need urgent action unless it is leading to serious corrosion
loss.
−− Importance of having a sound tactical approach.

Implementation of coating reinstatement should be carried out in accordance with a plan
based on the coating condition information. The plan may be risk based and/or based on
strategic refurbish limits to keep all coating condition at a pre-agreed level Ri (ISO 4628-
3 – Paints and varnishes – Evaluation of degradation of coatings – Designation of quantity
and size of defects, and of intensity of uniform changes in appearance – Part 3: Assessment
of degree of rusting) or Re (European scale of degree of rusting for anticorrosive paints
published by the Comité Européen des associations de fabricants de peintures et d'éncres
d'imprimerie in1964) scale.
Condition data relating to external corrosion are normally of two types:

−− Coating condition data including estimates of the extent of breakdown. There are
standard scales for quantifying estimates of coating breakdown (e.g. BS EN ISO
12944 parts 1–8).
−− Inspection data (visual, wall thickness, etc.) are usually collected in formatted reports
with manual entry into inspection databases although download from NDT wall
thickness instruments is available.
Specific monitoring and inspection methods include:

−− Visual inspection. This can be staged; i.e. initial, general visual inspection (GVI) from
normal points of vantage to identify areas of concern, followed by CVI using access
methods to obtain detailed observations and measurements.
−− Pit depth measurement using pit gauges for small pits or spreader bars. Spreader
bars are used where the corroded area is larger and pit gauges cannot reach from a
landing on uncorroded surface.
−− Caliper thickness measurement on plate and steel sections.
−− UT wall thickness measurement where adequate surface preparation is possible and
resulting surface profile allows. Wall thickness should always be measured by UT at
an adjacent uncorroded point for comparison.
225
+44 (0)207 467 7100
−− PEC where surface preparation is difficult. PEC gives an average volumetric

measurement over an area related to the resolution setting.
Data relating to external atmospheric CM are analysed in three stages:

−− Coating condition performance against target to determine the need for coating
maintenance to be scheduled to avoid metal loss.
−− Where coating condition has led to metal loss, comparison with metal loss
performance targets to determine need for immediate corrective action, (e.g. repair
of excessively corroded items).
−− Analysis of all the data, usually by the Corrosion Engineer, to ensure that the
strategic plan objectives are met and the CRAS and tactical plans are amended if
necessary. Specialist contractors will update the coating maintenance programme
based on the coating breakdown data.
External corrosion trends are usually followed on a qualitative basis although coating
breakdown data can be trended more quantitatively.
Trending coating breakdown allows the point of corrective action to be forecast allowing
coating maintenance to be planned for in advance. This prevents metal loss occurring if a
backlog of work is created.
I.11.4 CHECK

−− completion of risk assessment against plan;
−− completion of coating maintenance against plan;
−− achievement of surface preparation and coating application quality targets;
−− amount of coating breakdown in excess of deterioration limit;
−− completion of inspection activities against plan and schedule, and
−− completion of repair and replacement within allowed timescales for deferment.

−− frequency of external corrosion related leak, and
−− reduction of wall thickness against corrosion allowance.
The strategic plan should give performance targets for coating deterioration limits.
Employment of qualified paint inspection personnel will assist in the achievement of

application quality targets.

integrity management plan.
226
+44 (0)207 467 7100
The RCA of external corrosion failures or management system failures will be investigated
I.11.5 ACT
I.11.5.1 Review performance

Performance review should as a minimum include the following:
a) Annual review of external corrosion mitigation and inspection outcomes and the
achievement of performance targets. Corrective action for these programmes if
indicated.
and the overall trends in proactive indicators. Corrective action in strategy,
organisation and planning if indicated.
c) RCA of external atmospheric corrosion failures or management system failures with
appropriate corrective action recommendation.
d) Overall review of a), b) and c) together with verification findings for offshore
installations and audit results. Corrective action in strategy if indicated.
Particular attention should be paid to any shortfall in meeting performance targets or

measures and related backlogs in fabric maintenance activity. The relationship to budget and
resource constraints should be examined. Consideration may be given to obtaining input
from the ICP in relation to safety critical items.

Activity for the management of external corrosion should be included in CMS audits.
I.11.6 External corrosion of specific plant and structure item types
I.11.6.1 Corrosion on pipes, pipe supports39 and primary structural members

Where does it occur?
−− On bare steel or where the protective coating system has degraded and moisture
and water together with corrosion enhancing pollutants are in direct contact with
the metal substrate.
−− Early development of corrosion will occur around edges and welds, high traffic
areas where protective coatings are likely to be damaged and surfaces subjected to
fluctuating temperatures.
−− Under deposits such as dirt that collect and hold water or under adhesive tapes used
for marking pipes.
−− Installation surfaces exposed to bird droppings and corrosive chemicals used offshore.
−− External surfaces of stainless steel pipes and tubing exposed to salt spray and sea
water from deluge system.
−− Water drips onto hot surfaces.
−− Mating faces between pipe and pipe support saddles and clamps which are natural
moisture traps and where coatings can be damaged by fretting and pipe movement.
−− Trunnions welded to pipes using circumferential welds. The trunnion will generally
have a vent hole to facilitate the welding of the trunnion to pipe weld during
construction. This detail can, if the vent hole is not sealed, result in significant
internal corrosion within the trunnion. As the welding of the trunnion to pipe will
227
+44 (0)207 467 7100
have resulted in the coating on the pipe being removed prior to welding or burned-
off during the welding process, the pipe wall is particularly exposed.
What does it look like?

−− Extended over a large area or can be in patches.
−− A combination of flaking, cracking, and blistering of coating combined with rusting
of the substrate.
−− The corrosion can be general or in the form of localised pits.
−− Carbon and low alloy steels are usually covered in compact rust scale which under
certain circumstances can be thick.
−− Stainless steels will have light stains on the surface possibly with stained water
droplets and/or salts.
−− Corroding cupronickel surfaces would be covered in blue/green corrosion products.
−− Coating breakdown and corrosion around pipe support edges and extending along
the mating faces.
−− For trunnion corrosion, the signs may not be externally detectable and this will
therefore require internal visual inspection of the trunnion through the vent hole
using a borescope or similar. There are also NDT techniques, such as Radiographic
Testing and Guided Bulk Wave Ultrasonic Testing that can be used to detect the
presence of trunnion corrosion.
Figure I.29: Top coat breakdown, enhanced corrosion under pipe support (clamp)
228
+44 (0)207 467 7100
Figure I.30: Gross corrosion on module cladding
Figure I.31: Structural corrosion concentrated along edges, welds etc.
Figure I.32: Corrosion on cupronickel pipe
How can it be managed?

−− Maintaining the coating system is the most effective way of preventing external
corrosion.
−− Avoiding leaks on surfaces from above.
229
+44 (0)207 467 7100
−− Preventing accumulation of salts on external surfaces of stainless steel including

regular washing of the contaminated surfaces.
−− Corrosion around pipe supports should be controlled by maintaining effective seals
around pipe support edges, providing drainage holes, having pipe reinforcing plates
at the support locations, applying long-life coating systems requiring minimum
maintenance.
Inspection and monitoring:

−− Visual examination complemented with pit depth and ultrasonic thickness (UT)
measurements are the most widely used techniques for detecting and evaluating the
corrosion damage.
−− Localised corrosion damage on pressure systems should be evaluated using
radiography before attempting remedial action.
−− Use of reference areas in accordance with BS EN ISO 12944 parts 7 and 8 as agreed
between the contracting parties.
−− Inspection at pipe supports requires a combination of visual and long range UT.
Where possible, pipes should be lifted to allow closer examination of support and
pipe mating surfaces.
−− PEC can be used on rough surfaces where UT is not possible.
−− Separate detailed guidance on the integrity management of corrosion under pipe
supports has been given in EI Guidelines for the integrity management of corrosion
under pipe supports (CUPS)40.
Acceptance criteria:
Degree of rusting, Ri4 (BS EN ISO 4628 Part 3) is normally identified as the point where
action is required to plan for coating maintenance. Failure to carry out coating maintenance
at this point may lead to excessive metal loss and/or to more extensive preparation and
painting. The resulting build-up of maintenance backlog can be so great that it is not
possible to restore the facility's fabric to the required state within its remaining life.
To be more effective in avoiding corrosion loss before maintenance painting can be

implemented, it is best to trend paint breakdown in successive surveys to forecast when Ri4
might be reached and to plan for painting on that date.
Where corrosion has occurred due to coating degradation the strategy will need to
concentrate on substrate condition and on determining fitness-for-purpose and then on
restoring protection or requiring repair, as appropriate. Design codes and fitness-for-purpose
methods (e.g. API 579) can be used for piping and vessels. Structural analysis should be
used to determine the fitness of primary structure. Where painting maintenance has been
extensively deferred and potential corrosion damage to the substrate is widespread, it may
be necessary to adopt a risk based approach to survey and assessment and to prioritisation
of repair that brings considerations of the consequences of failure into play. Deferment of
repair or replacement requires a demonstration that such plant and equipment will remain in
a safe condition until the rescheduled maintenance activity is completed. As a minimum, the
demonstration should include:
−− Physical assessment of the extent of the degradation including area and depth.
−− Engineering assessment of the suitability of the corroded member for the intended
service including upset/extreme event condition. This should be in accordance with
recognised standards.
230
+44 (0)207 467 7100
−− Details of any mitigation to be implemented including enhanced monitoring.

−− Load limitation, if appropriate, and safeguarding of the item from excessive loads.
For safety critical items consideration may be given to verification by the ICP.
I.11.6.2 Corrosion of walkways, stairways41, 42, 43, 44, 45 and ladders

−− grating and stair tread bearings, transverse and binding bars;
−− supports for gratings;
−− stair tread end plates and stringers;
−− bolts holding stair treads, clips holding grating;
−− handrails, handrail stanchions, mesh infill and toe plates;
−− plated decking, and
−− ladders, ladder cages, and their safety gates.
What does it look like?

−− Grating bars covered in tightly adhering compacted corrosion products along the
sides and in extreme cases complete disintegration of the bars resulting in holes.
−− Coating degradation and general corrosion on grating supports, stringers and
endplates.
−− Bolts and nuts covered in rust, bolt no longer protruding beyond the nut, clips
missing or broken through corrosion.
−− Handrails covered in compacted layer of rust with indentations where small
sections have flaked off. Mesh wire corroded leaving holes and exposed sharp ends.
Corrosion of toe plate edges near the deck or in extreme cases holes with sharp
edges. Bottoms of stanchions corroded at the joint with the walkway structure.
Corrosion under clamps/fittings attaching signs, etc., to the rails.
−− Blisters, cracking in deck coating with compacted corrosion products under the
coating.
−− Corroded/missing grating clips.
231
+44 (0)207 467 7100
Figure I.33: Damaged grating requiring replacement
Figure I.34: Decking in need of recoating
232
+44 (0)207 467 7100
Figure I.35: Unacceptable corrosion on rails
Figure I.36: Corroded mesh in need of replacement
Care should be taken when inspecting corroded and damaged grating and handrails which
may be insecure especially if testing strength by pushing on/pulling on items.
Implement a rolling programme of inspection, repair and/or replacement. Emphasis should

be on regular inspection and replacement. However, where replacement needs to be
deferred, fitness-for-purpose evaluation will be required to justify continued use of corroded
components. CVI supplemented by UT is normally sufficient to highlight the majority of the
degradation that needs to be found.
Criteria should be objective and preferably quantitative:

−− If a quantitative approach is used, grating, handrail, stanchion and support member
corrosion loss should be measured and a check made to ensure that it will safely
233
+44 (0)207 467 7100
support the maximum expected load. Criteria can be found in various standards
(e.g. NORSOK standard C-002) and in manufacturers' documentation, as well as
developed from design principles.
−− If a qualitative approach is used, the extent of deterioration should be categorised to
a set of standard condition descriptions and corrective action taken according to a
sufficiently conservative set of rules.
In addition:
−− Handrails, stanchions and infill mesh surfaces should not have degraded to such an
extent that people could suffer punctures or lacerations, and/or lead to snagging of
clothing.
−− In addition to a. and b., for pedestrian traffic, the deflection of floor panels under the
design load shall not exceed 10 mm or 1/200th of the span, whichever is the lesser.
The difference in level between a loaded and a neighbouring unloaded flooring shall
not exceed 4 mm (BS4592-0:2006).
−− Grating tread corrosion or deformation should not be allowed to let large objects
drop through and present a hazard to those working below. A 20 mm ball can be
used to test openings.
234
+44 (0)207 467 7100
+44 (0)207 467 7100
Detailed offshore survey to confirn fitness for purpose of grating/tread system and
quantify panels/treads/support steelwork to be replaced
• Measure span, depth and spacing of load bearing

• Measure thickness of support structure at most
bars
vulnerable locations (with corrosion scale removed)
• Measure thickness of load bearing bar at several
locations (with corrosion scale removed) [Note 1] • Estimate residual thickness of support structure by date
• Estimate residual thickness of load bearing bars of replacement [Note 2]
by date of replacement [Note 2]
Determine load carrying capacity based upon Determine load carrying capacity based upon
estimated condition by replacement date [Note 3] estimated condition by replacement date [Note 5]
Is capacity greater Is capacity greater
235
than actual load than actual load
requirements for this requirements for this
area? [Note 4] area?
Yes No Yes No
Record location, size and depth of Detail remedial work

Support
Grating is OK steel grating panel or stair tread for required to ensure integrity
structure is OK
replacement of supporting steelwork
Figure I.37: Quantitative assessment example: grating assessment
Notes:
1. For corroded grating panels or treads, break off loose corrosion product and obtain
thickness measurements at the worst spots on at least two load bearing bars local
to mid-span and near the supports. Determine average indication of remaining
thickness based upon these measurements. The thickness of the load bearing bars
should be measured using Vernier calipers.
2. With loss of protective coating, default steel corrosion rates (for the UK N Sea) can
be used as follows: (a) external walkway/deck, above main deck, 0,20 mm/yr,(b)
internal naturally ventilated modules, 0,10 mm/yr, (c) internal fully enclosed modules,
0,05 mm/yr.
3. As an example, the following tables provide an indication of the safe load carrying
capacity of a typical rectangular pattern grating for various bar thicknesses and spans.
The tables are based upon a grating with 40 mm deep load bearing bar at 40 mm
centres and with a serrated top surface. The loads take into account a deflection limit
of span/200 or 10 mm, whichever is less.
4. The operator must ensure that the assessment that is used, and any safe load tables,
are appropriate for the grating actually in use and in any event approved by the
operator's engineering authority. Note: minimum acceptable thickness of a load
bearing bar is 2,0 mm, despite a panel's span and loading criteria.
5. Generally, grating used for walkways with no wheel loads is designed for a uniformly
distributed load of 5 kN/m. Concentrated loads may need to be considered for
specific areas where machinery or other items could be placed on the grating.
6. The load carrying capacity of all steel support structures should be calculated where
the metal loss exceeds 1 mm or 10 % of wall thickness, whichever is the less.
Table I.3: Uniformly distributed load (kN/m2)
Thickness Clear span (mm)

(mm) 800 1 000 1 200 1 400 1 600 1 800
5 59,4 38 26,4 16,9 11,4 8
4 47,5 30,4 21,1 13,6 9,1 6,4
3 35,7 22,8 15,9 10,1 6,8 4,8
2 23,8 15,2 10,6 6,8 4,5 3,2
Table I.4: Concentrated load (kN) applied over area of 300 mm × 300 mm
Thickness Clear span (mm)

(mm) 800 1 000 1 200 1 400 1 600 1 800
5 8,2 6,3 5,1 4,2 3,2 2,5
4 6,6 5 4,1 3,4 2,6 2
3 4,9 3,8 3 2,6 1,9 1,5
2 3,3 2,5 2 1,7 1,3 1
236
+44 (0)207 467 7100
Table I.5: Maximum lateral load (kN/m) for 48,3 mm diameter post (material
grade 43A, Fy = 275 N/mm2)
Residual Post spacing (mm)

thickness (mm) 500 50 1 000 1 250 1 500
5 2,26 1,51 1,13 0,9 0,75
4,5 2 1,34 1 0,8 0,67
4 1,75 1,17 0,88 0,7 0,58
3,5 1,51 1,01 0,75 0,6 0,5
3 1,27 0,85 0,64 0,51 0,42
2,5 1,05 0,7 0,52 0,42 0,35
2 0,82 0,55 0,41 0,33 0,27
Table I.6: Maximum lateral load (kN/m) for 1,5-inch NB schedule 40 post (48,3 OD ×
3,7 WT, Fy = 240 N/mm2)

thickness (mm) 500 750 1 000 1 250 1 500
3,7 1,59 1,06 0,79 0,63 0,53
3,5 1,49 0,99 0,75 0,6 0,5
3,25 1,37 0,92 0,69 0,55 0,46
3 1,26 0,84 0,63 0,5 0,42
2,75 1,15 0,76 0,57 0,46 0,38
2,5 1,04 0,69 0,52 0,41 0,35
2,25 0,93 0,62 0,46 0,37 0,31
Notes:
For corroded handrail panels, break off loose corrosion product at the critical locations and
obtain an estimate of the remaining wall thickness. The thickness of the handrail post, etc.
can be obtained directly using an ultrasonic thickness gauge or else indirectly using digital
calipers to measure the diameter and then estimating the thickness assuming negligible
internal corrosion.
To assist in prioritising the repair/replacement of the handrails, an estimate should also be

made of the residual (lateral) capacity by year end. With loss of protective coating, default steel
corrosion rates (mm/year) to be used are as follows: (a) external walkway/deck areas 0,20;
(b) internal naturally ventilated modules 0,10; (c) internal fully enclosed modules 0,05.
Tables I.5 to 8 provide an example of the lateral load carrying capacity of handrails based
upon a range of post spacings and various levels of corrosion at the base of posts or at the
sockets for removable types of handrails. The operator must ensure that the assessment that
is used, and any safe load tables, are appropriate for the handrailing actually in use and in
any event approved by the operator's engineering authority.
237
+44 (0)207 467 7100
Table I.7: Maximum lateral load (kN/m) for 60,3 mm diameter socket (material grade
43A, Fy = 275 N/mm2)

thickness (mm) 500 750 1 000 1 250 1 500
5 3,75 2,5 1,88 1,5 1,25
4,5 3,34 2,23 1,67 1,34 1,11
4 2,93 1,96 1,47 1,17 0,98
3,5 2,54 1,69 1,27 1,01 0,85
3 2,15 1,43 1,07 0,86 0,72
2,5 1,77 1,18 0,89 0,71 0,59
2 1,4 0,93 0,7 0,56 0,47
Table I.8: Maximum lateral load (kN/m) for 2-inch NB schedule 40 socket (60,3 OD ×
3,9 WT, Fy = 240 N/mm2)

thickness (mm) 500 750 1 000 1 250 1 500
3,9 2,7 1,8 1,35 1,08 0,9
3,75 2,59 1,73 1,29 1,04 0,86
3,5 2,4 1,6 1,2 0,96 0,8
3,25 2,22 1,48 1,11 0,89 0,74
3 2,04 1,36 1,02 0,82 0,68
2,75 1,86 1,24 0,93 0,74 0,62
2,5 1,68 1,12 0,84 0,67 0,56
238
+44 (0)207 467 7100
Detailed offshore survey to confirm fitness for purpose of

handrail system and quantify remedial work [Note2]
Coating breakdown and corrosion of handrail panel

Lack of integrity of handrail panel system
system (post, rail, socket/stiffener)
• Mesh infill panel missing or badly damaged;

• Kick plate missing or badly damaged;
• Handrail panel system badly damaged due to impact.
• Measure post spacing;

• Estimate remaining wall thickness of post local to base fixing
and/or rail(s) (with corrosion scale removed) [Note 3];
• For removable handrails, estimate remaining wall thickness
of socket (with corrosion scale removed) and spigot;
• Estimate residual thickness of post/socket by year ending
2007 [Note 4].
Measure size of replacement mesh infill panel, kick
plate and/or handrail panel depending upon extent
of damage/deterioration.
Determine lateral load carrying capacity of panel system based
upon current condition and estimated condition by year end 2007
using tables provided [Note 5]
Detail remedial work required
to reinstate integrity of handrail
panel system
Determine actual load requirements for area:
[a] heavy duty and muster areas, 1,50 kN/m; [b] escape routes,
0,74 kN/m; [c] all other areas, 0,50 kN/m
Is
capacity
greater than
actual load
requirements for
this area?
NO YES
Record location, dimension Record recoating

of panel, etc. for repair/ requirements
replacement
Figure I.38: Handrail assessment
239
+44 (0)207 467 7100
Inspection and prioritisation

of grating repairs
Assess level of support: Assess grating specification against

SWL for area:
Single load bar not supported – P3
Grating falls below spec for SWL/span combination
More then one load bar not supported – P1 – P2
Loss of average support wall thickness > 10 % – P2 Grating falls below spec for SWL/span combination
plus metal loss – P1
Loss of average support wall thickness > 20 % or
any perforation – P1
Assess level of grating corrosion/

Assess security of grating:
metal loss:
More then one grating clip missing/insecure and
loose – P2 Complete breakdown of galvanised coating and
onset of corrosion – P3
Number of clips missing/insecure plus panel
presents dropped object or trip hazard – P1 Average loss of thickness > 15 % or perforation
of one load bar – P2
Average loss of thickness > 30 % or perforation in
more than one load bar – P1
No significant loss of thickness (< 0,5 mm) is
acceptable lifeboat embarkation, laydown areas
and areas for wheeled loads.
Figure I.39: Grating assessment
Safe working load (SWL) for grating based on calculation or supplied by manufacturer.
P1 Replace panel immediately or otherwise make area safe (e.g. overlay scaffold boards,
barrier-off areas etc.).
P2 Plan to replace grating in six-month time frame. Carry out follow-up inspection of all areas
at six-month intervals to assess further deterioration.
P3 Plan to replace within twelve months. Carry out follow-up inspection of all areas at
six-month intervals to assess further deterioration.
240
+44 (0)207 467 7100

of handrail repairs
Assess movement of railings: Assess level of railing/kick plate

corrosion:
Movement of up to 100 mm and/or cuff links
missing – P2 Complete breakdown of protective coating with
onset of surface corrosion – P3
Movement of 100 mm from vertical measured One through thickness corrosion area and general
at top rail – P1 advanced corrosion (up to 2 mm wall loss)
elsewhere – P2
Numerous/wholesale through thickness corrosion
areas – P1
Assess condition of handrail panel:
Severe loss of thickness (> 2 mm) and/or more – P1
Panels with corroded and or loose panel clips – P2
Loose panels with more than one missing clip and/
or holes in mesh due to corrosin or impact
damage – P1
Figure I.40: Inspection and prioritisation of handrail repairs
P1 Replace section immediately or otherwise make safe area (e.g. scaffold pole strengthening,
barrier-off area, etc.). Where handrail cannot be immediately replaced corrective action should be
completed within three months. Repair panels and replace clips immediately or make area safe.
P2 Plan to replace handrail within six months. Carry out follow-up inspection of all areas at
six-month intervals to assess further deterioration. Carry out local repair to the corroded area.
Fit new cuff links as soon as possible.
P3 Plan to replace within twelve months. Carry out follow-up inspection at six-month intervals
to assess further deterioration.

of ladder repairs
Assess security of ladder Assess mechanical damage to

rungs and vertical rails
Single ladder fixing has become detached and/or
ladder shows any movements – P2 Ladder has bent/distorted rungs or rails – P3
More than one fixing has become detached – P1 Missing rungs – P1
Assess level of corrosion

Complete breakdown of the galvanised coating
with onset of surface corrosion – P3
Extensive corrosion and associated metal loss
across whole ladder (wall loss < 1 mm) – P2
Severe corrosion at fixings, rungs and rails (wall
loss > 1 mm) – P1
Figure I.41: Inspection and prioritisation of handrail repairs
241
+44 (0)207 467 7100
P1 Make ladder safe (e.g. barrier-off ladder, erect alternative access using scaffolding etc.).
Corrective action should be completed within three months.
P2 Corrective action should be completed within six months. Carry out follow-up inspection
of all areas at six-month intervals to assess further deterioration.
P3 Corrective action should be completed within 12 months. Carry out follow-up inspection
of all areas at six-month intervals to assess further deterioration.
I.11.6.3 Bolting
A typical oil and gas installation contains a very large number of bolted joints in the structural
members, mechanical plant and process plant. Management of joint integrity over the life of
an installation is crucial for the SCEs which includes management of bolt corrosion. Allowing
bolts and nuts to corrode leads to:
−− increased risk to personnel from working with seized bolts;
−− increased maintenance time, and
−− affects plant and structural integrity.

−− On bolted joints exposed to frequent wetting through exposure to marine spray (i.e.
outer exposed parts of the installation, wellhead areas, flare booms), to seawater
from deluge systems and/or through wash-down activities.
−− Low alloy bolts on stainless steel flanges can suffer accelerated galvanic corrosion46 if
the bolt corrosion protection coating is poor.
−− Stainless steel bolts tend to suffer pitting and/or SCC in the typical offshore
environment, particularly when exposed to thermal cycling and frequent chloride salt
spray wetting and drying conditions.
−− Blind holes where water can collect, resulting in localised attack of the bolt shank
particularly if a galvanic cell is present.
−− Crevice corrosion under bolt heads and nuts.
−− Crevice corrosion under thick but broken and disbanded coatings where water
collects, particularly at pipe flanges.
What does look like?
From light to heavy corrosion. Studs can lose thickness and thread form. Nuts can lose shape
through corrosion of the flats.
242
+44 (0)207 467 7100
Figure I.42: Localised bolt corrosion
Figure I.43: Significantly corroded bolts requiring replacement
243
+44 (0)207 467 7100
Figure I.44: Major bolt corrosion
Figure I.45: Reinstated piping system
Implement a risk based CMS based on identification of the likelihood of bolt corrosion and
the consequence of bolted joint failure. For pressure systems this should form a part of the
bolted joint integrity management system as outlined in EI Guidelines for the management
of the integrity of bolted joints for pressurised systems47.
The likelihood of bolt corrosion depends amongst other things on:

−− Degree of exposure to salt spray.
−− Flange orientation (horizontal more likely than vertical).
244
+44 (0)207 467 7100
−− Coatings (hot dip galvanised or zinc/nickel coated – best with service of up to eight
years). Structural bolting is normally covered in the same coating system as the main
structure and if maintained can have a very long life.
−− Bolt material (stainless steel is clearly better than low alloy steel although the former
is expensive and more likely to fail through SCC in appropriate conditions).
−− Flange material (in particular low alloy steel bolts in contact with stainless steel
flanges).
−− Diameter of bolts (smaller diameter bolts are likely to fail earlier through corrosion
than larger diameter bolts).
Bolt preservation systems consisting of applying two pack system of inhibited grease or
covering with plastic caps or wrapping in Denso tape have been used with varying success.
Performance of plated and galvanised bolting can also be significantly improved if coating
is also applied. Applying a multi-coat paint system has also proved successful. In order to
prevent water ingress from flange faces some Duty Holder/Operators now require the joint
to be sprayed with inhibited oil and sealed with Denso tape.
Several systems for flange and bolt encapsulation with thick resin based coatings with an
integral CI spray or brush applied systems exist and have been proven to provide very good
long-term protection.
Visual inspection is the most commonly used system for monitoring degradation,
supplemented by sample removal of bolts for closer examination. A very important
additional benefit of gathering sample bolts is that they can be used to provide actual
mechanical property data if and when required. Specialised phased array UT systems for
bolt inspection are available but not widely used.
−− Bolts with mechanical damage to the stressed plain shanks or threaded portions or
cracks in any portion should be replaced.
−− Bolts, studs and screwed fasteners suffering corrosion along the shank to such an
extent that the thread is no longer discernible or the diameter has been reduced by
10 % of the nominal value should be replaced.
−− Bolt heads and nuts corroded to such an extent that cross-flats dimension has been
reduced by 10 % should be replaced.
−− If stud shank is no longer protruding beyond the top of the nut then the stud and
nut should be replaced.
I.11.6.4 Cable trays48, cable ladders, unistruts

Cable trays, unistruts and ladders are constructed from a variety of materials but in the UK
offshore sector the majority are galvanised CS or stainless steel. Galvanised coatings are
estimated to protect the CS substrate for around 10 years in the offshore environment.
Stainless steel components on the other hand have generally performed very well with few
reported problems/incidents. Allowing these components to corrode results in the cables
and fittings not being supported as designed, raising the possibility of harming personnel by
being hit by falling corroded sections.
245
+44 (0)207 467 7100
Figure I.46: Corroded cable tray
Figure I.47: Corroded cable ladders
Prepare and implement a maintenance strategy consisting of planned inspection and

replacement.
−− The general requirement according to BS EN 61537:2007, Cable management –
Cable tray systems and cable ladder systems is that cable tray systems and cable
ladder systems shall be so designed and so constructed that in normal use, when
installed according to the manufacturer's or responsible vendor's instructions, they
246
+44 (0)207 467 7100
ensure reliable support to the cables contained therein. They shall not impose any
unreasonable hazard to the user or cables. In addition, cable tray systems and
cable ladder systems shall provide adequate mechanical strength and all system
components shall have adequate resistance against corrosion in accordance with
Table 7 of BS EN 61537:2007.
−− In order to demonstrate this the cable tray and ladder systems should be in a condition
to comply with the physical test requirements outlined in BS EN 61537:2007.
−− Cable trays over walkways must be maintained in suitable condition to ensure that
escape routes are kept clear as required by PFEER. Regulation 14.
−− Galvanised cable trays, ladders and associated fittings should be replaced once the
coating has disappeared and active corrosion has commenced as it is unlikely to
satisfy the specified standards.
I.11.6.5 Valves
External surfaces of valves49, including flanges, hand wheels, levers, supports, actuator
mechanisms and casings, stems etc., should be protected from the highly corrosive offshore
environment in order to ensure that their function is not impaired. Although corrosion
resistant materials are used to some extent, most installations still have a large number of
low alloy steel valves that require active CM.
Figure I.48: Corroded hand wheel
247
+44 (0)207 467 7100
Figure I.49: Valve body corrosion

−− Ensure that valves are purchased with adequate materials selection and coating for
the severity of exposure.
−− Avoid galvanic corrosion problems, e.g. by ensuring plug materials and bolts are
either compatible with the body material or, in the case of bolts, suitably isolated
from it.
−− Valve external CM should be included in the process plant CMS and the same
acceptance criteria as outlined above for pipework should be used to govern the
remedial measures.
−− To protect the stem and flange an approach adopted by some users with some
success is to seal them with Denso tape.
−− Hand wheels and levers, chains and chain wheels, etc., require adequate
maintenance. Pressed steel wheels and levers are more susceptible because of
their limited thickness and hence where reasonably practicable cast or forged
steel versions should be used.
−− Include valves in the pipework inspection scheme and ensure that the inspection
includes attention to the condition of hand wheels and levers, chains and chain
wheels, actuators, stem seals and seal retainers, bolting, grease nipples and plugs.
I.12 CORROSION UNDER INSULATION
I.12.1 Introduction
The term 'corrosion under insulation' (CUI) describes the external corrosion of insulated
piping and vessels that occurs beneath insulation following water ingress. Water can also
form due to condensation ('sweating') on equipment or internal cladding surfaces.
248
+44 (0)207 467 7100
Over the past decade CUI has continued to represent a major challenge for offshore and
onshore facilities and has been responsible for inventory releases leading to health, safety
and environmental incidents and lost production. Many operators, however, manage CUI
very effectively via a sound tactical approach grounded in correct understanding of how the
risk changes over asset lifetime and beyond. The updates made to this CUI Annex focus on
the following areas which can define effective integrity management:
−− key differences between CS and CRAs;
−− timing for thorough inspections typically range from 5–20 years;
−− insulation removal is still the most effective form of thorough inspection;
−− predictability and definition of prone areas;
−− suitability of Non-Intrusive Inspection (NII) techniques;
−− limitations of probability assessment – the pitfalls to avoid;
−− consideration for live equipment insulation removal;
−− permanent and partial permanent removal of insulation, and
−− increased rupture threat for under-inspected CS.
The following public domain guidance documents are available. The recent revision of EFC
No: 55 acknowledges few meaningful developments since the original 2008 edition:
−− EFC WP13 WP15 Corrosion under insulation (CUI) guidelines (revised edition) No: 55,
edited by Dr. Stefan Winnik.
−− UK HSE Semi Permanent Circular (SPC)/Tech/Gen 18 Corrosion under insulation of
plant and pipework, V3.
−− NACE SP0198 (2010) The control of corrosion of metals under thermal insulation
and fire proofing materials – a systems approach.
−− EI Guidelines for the design, installation and management of thermal insulation
systems.
I.12.2 Challenging the need for insulation – PLAN/CHECK
Typically requires process engineering assistance. Permanent removal does not eliminate
corrosion especially at elevated temperature ranges, but the advantage is that the corrosion
of uninsulated equipment is visually easier to detect and monitor by CVI. In fact, insulation
typically protects the majority of equipment from the influence of weathering and persistent
dripping onto non-insulated, higher temperature equipment can result in high corrosion
rates similar to those experienced with CUI.
There is some positive experience with partial permanent insulation removal at piping
prone areas such as vertical to horizontal bends, small bore attachment locations and pipe
supports. This reduces water ingress points and consigns CUI activities to discrete sections.
I.12.3 Corrosion probability assessment or PLAN/CHECK
Probability and consequence of failure combine to give a risk. Risk table categories can drive
priorities for inspection periods, inspection coverage/technique and coating maintenance or
coating reinstatement priorities.
There are different methods for CUI probability assessment and all can be effective providing
the limitations are acknowledged and catered for in the output risk-based schemes. It is
249
+44 (0)207 467 7100
possible to target a method to a particular asset. The following points need to be catered for
in any probability assessment:
−− General:
– CUI can be more aggressive than atmospheric corrosion because it can generate
more prolonged wetting and concentrate salts.
– The amount of wetting is an important consideration – of course full immersion
in water is more aggressive than atmospheric exposure and CUI can range
between these two extremes.
– All insulation systems will inevitably have weak points which allow water
ingress, dating from commissioning and also due to in-service damage or poor
reinsulation. Water ingress sites are not all reliably identifiable by visual inspection
of insulation.
– For external water sources (not sweating), CUI typically affects only 5–10 % of
insulated equipment. For sweating, CUI affects 100 %. Prone areas are often
predictable but for piping represent the majority of length.
– Water penetrates and degrades coatings sometimes very quickly.
– This means that 100 % prone area inspection is needed to provide full assurance
of the condition of critical equipment for external water sources but that %
inspection can be used for sweating.
– It is good practice to frequently inspect the surrounding environment for
persistent sources of water for all critical equipment i.e. by interim CVI or routine
thermography surveys. Persistent water sources impacting insulated equipment
require prompt action.
– In North Sea/temperate climates, sweating tends to drive low corrosion rates and
is typically an ageing issue for thin-walled equipment.
– Vulnerable CS is more likely to fail from CUI than vulnerable CRAs.
−− Carbon steel:
– The role of inspection is especially important or High Value compared to other
threats because there is no reliable barrier or barrier monitoring method.
– Stripping insulation to allow visual inspection is the most effective inspection
method.
– Coatings are degraded more rapidly by water and damage is more likely
compared with CRAs because of the absolute certainty of corrosion initiating
when the metal is wetted and the voluminous corrosion product accelerates
disbondment.
– CUI occurs over a wide temperature range and corrosion rates are somewhat
predictable but cumulative wetting isn't. Coating life and remaining life are
therefore unpredictable, but there ARE patterns in collected typical time-to-
failure data which support typically successful inspection periodicities.
– Probability or likelihood of failure increases with age.
– Both corrosion rate and coating life are influenced strongly by the degree of
wetting and temperature. Higher temperatures can offset wetting and cumulative
metal loss due to dry-out periods, which explains why the amount of wall loss
over time can often be quite similar in spite of the wide range of corrosion rates
(typically ~0,1 to 1 mm/yr). The presence of water and temperature can control
commonly observed coating lives (typical ranges of 30+ down to <two yrs for
(the lower bound for non-immersion grades) and 60+ down to five yrs for
Thermally Sprayed Aluminium (TSA) coating.
– Coatings can degrade by means other than water (high/cyclic temperature
and/or ageing/mechanical damage or poor application (uncontrolled field
250
+44 (0)207 467 7100
conditions) but the former may be sample inspected and the latter is typically
random/localised and less likely to coincide with wetted sites.
– Early failures of coated equipment are possible but rare, the majority manifest
after 16–20 years but this will represent wall loss well beyond corrosion
allowance.
– Early failures from five–16 yrs are associated with weathering at elevated
temperature of thin-walled equipment or unusually persistent wetting (combined
with efficient water trap geometries) of medium-walled equipment or absence
of a coating.
– There is opportunity to optimise field coating maintenance requirements
beneath insulation. Coatings only significantly extend life for equipment that
experiences mild CUI conditions that typically would not fail during operating
life had no coating been present. During operating life, quality of insulation
practice may be more important than coating reinstatement. Field-applied paint
coatings may delay replacement for a few years for significantly thinned or
SBC equipment. TSA coatings may have more of a beneficial effect on some
equipment during design life.
−− Corrosion resistant alloys:
– Crevice corrosion can affect austenitic stainless steels or, rarely, duplex grades.
– SCC is reported for austenitic and duplex grades.
– Threshold temperatures exist for crevice/pitting and SCC for different alloys.
– Vulnerable insulated CRAs do not always suffer from CUI when water and
chlorides are present. More parameters need to coincide to trigger and sustain
corrosion, both environmental and metallurgical. Though many of these
parameters cannot be measured, high vulnerability based on a laboratory
defined threshold temperatures does not necessarily translate to high probability
for uncoated CRAs.
– Originally applied coating life tends to be longer for CRAs, especially for TSA or
paint coating/aluminium foil combinations.
– Periodic inspection for pitting or cracking for uncoated alloys is of limited value
in pre-empting failure because once corrosion has initiated it can progress
rapidly to failure. Periodic inspection of coating condition may have some value
if coating breakdown is identified before water ingress triggers damage.
– Inspection to confirm the presence of a coating in the first place is important.
Once a failure has occurred inspection plays a role in identifying the extent of
the damage. If bare metal must be inspected it ought to be two–three yearly at
prone areas to be effective and of course this would require high coverage and
is not practical.
– CS bolted joints and mixed metal piping supports do require inspection
though galvanic uplift of the corrosion rate of CS bolting appears
offset by the protection offered by flange geometry.
The limited ability to mitigate failure of CRA CUI corrosion/cracking by inspection is

naturally offset by a lower inherent probability of failure for uncoated and especially coated
alloys. This has led to widely different strategies and there is insufficient shared knowledge
to compare their effectiveness:
– Risk assessment to drive coating of uncoated CRAs, TSA being a preferred field
application.
– Inspection methods ranging from no inspection (for SCC/pitting) to % insulation
removal due-diligence checks at prone areas, to periodic 100 % insulation
251
+44 (0)207 467 7100
removal for highly critical equipment, but at extended intervals compared with
CS and not <20 yrs or through inspections at end of design life.
– Note many perform % inspection to monitor ageing CS bolted joints (see later
for CRA bolt specification).
−− Influential probability or likelihood parameters – an approach based on
temperature, cyclic operation, material and presence of coating (especially for CRAs)
is powerful in early to mid-life, age and nominal thickness can optimise efforts over
different timescales (this does not apply to CRA cracking).
−− Chlorides – the presence of chlorides under insulation should be considered
ubiquitous in the North Sea and coastal onshore environment. Leachable chlorides
from the insulation material are also a source of chlorides but this is more significant
in non-marine locations. In marine environments chlorides will be present even
without the contribution from insulation, whether the water source is condensation,
rain, distilled or seawater. Chlorides are in the atmosphere and dissolve in water and
can then concentrate during insulation dry-out periods.
−− Temperature – CS equipment operating out with the range −4 °C to +175 °C
with no significant cyclic temperature component will have very low probability of
CUI within asset lifetime, but this assessment requires confidence checks on actual
temperature, cyclic operation frequency and independent assessment of dead legs.
For CS the highest probability temperature range could be considered as 30 or
50–120 °C. API 580/1 and DNV RP-G101 provide typical corrosion rates based
on temperature geographical location and a 'severity of environment' parameter
that is hard to predict.
Note for CRAs there is no maximum temperature limit (e.g. SCC cooling cycles from
temperatures in excess of 175 °C can allow wetted equipment to crack quickly,
though often extended down-time is needed based on downstream experience and
this can be factored into probability assessment accordingly). For CRAs, industry
agreed threshold temperatures should be used to assess vulnerability to crevice
corrosion and cracking respectively. For CRA SCC the highest possible operating (not
mean) operating temperature should be used.
In the absence of clearly documented MoC for aged equipment it can be difficult
to rely on the temperature having always been within a certain range. In addition,
care should be taken to avoid assigning an item that is only a few degrees over a
critical limit to a reduced probability category. Different temperature ranges should
not factor too highly in the probability assessment but can help to set timing of
thorough inspections.
If heat tracing is present then the higher of the operating temp and heat tracing set
point should be used for the assessment.
−− Age – for CS and to some extent stainless steel crevice corrosion and pitting,
probability increases with age and for thin-walled equipment, i.e. <6 mm for 300
series austenitics.
Chloride stress corrosion cracking (CSCC) is considered as a random failure
mechanism and age-independent.
For CS especially, do not let low temperature probability criteria drive sustained
minimal inspection of highly critical systems for asset life and beyond. For example,
critical ambient temperature, aged equipment may eventually drive failure but the
reduced corrosion rates will typically only affect thinner wall components.
−− CRAs – the risk assessment process needs to consider multiple components:
– crevice/pitting (temperature, alloy, thickness);
252
+44 (0)207 467 7100
– SCC (temperature, alloy), and

– carbon steel bolting (as per CS but based on flange size).
Coating presence must be confirmed in the field.
Risk assess uncoated CRAs as priority with a view to applying a coating and/or Al foil
for the highest risk equipment.
Inspection of uncoated equipment is of limited value. API 580/581 method for
example would drive two–three yearly inspection of welds for cracking to be effective.
Periodic insulation removal at water ingress prone areas may represent a 'belt and
braces' approach to mitigating prolonged water wetting.
CRAs are typically subject to longer thorough inspection intervals compared to CS.
CS bolts should be assessed as per CS for 4–8 bolt joints and at reduced probability
(low) for 12+ bolt size joints
For uncoated CRA crevice/pitting use the crevice temperature; vulnerable thin-walled
austenitics are considered to have the highest probability of failure.
For uncoated SCC vulnerable CRAs, typically above the upper bound threshold
temperature, a medium to high probability can be dictated by persistent or direct
water sources, vibration and/or metallurgy such as cold worked material.
– The RR902 2011 update (for austenitics) and RR129 (referring to duplex) provide
some information that could be used to adjust probability of CSCC failure (also
see prone areas).
Uncoated CRA probabilities may compete with CS but on a probability scale of 1–5
are typically maximum 4 compared with CS maximum 5.
TSA or Al foil is known to ensure low probability of CRAs for periods up to 20 years
and beyond.
This guidance does not address CRA bolts but note that the threshold
temperature for SCC can be significantly reduced due to, for example, cold
worked condition and high stress intensity at threads. CRA bolts should be
coated and replaced periodically for critical equipment. Uncoated austenitic
CRA flange bolting >30 °C is at risk of failure and should be replaced,
4 and 8 bolt flanges would represent a priority.
−− Insulation type – some insulation types i.e. rockwool are known for absorbing
water. Even from 6 o'clock position gaps in insulation, the water running down
the external cladding surface can be drawn in and absorbed by rockwool and
generate CUI at a location which an inspector might judge to be a non-prone area,
anticipating that water would egress through the 6 o'clock cladding gaps. Cladding
drain holes are not effective for rockwool insulation systems but could be, if applied
early enough, for closed cell insulation systems, which, though they degrade after
prolonged wetting, will allow initial run-off.
Insulation type should, however, not weigh highly in probability assessment – it
is clearly demonstrated that American CUI experience is similar to UK/Europe
experience, where in America there is extensive history of use of closed-cell insulation
at ambient to high temperatures in the same way as the UK employs rockwool and
there is similar recorded experience of number and frequency of failures.
−− Upgrades of coating/insulation systems – can provide a 'belt and braces' safety
margin to delay CUI, though there is no evidence that any system significantly reduces
lifecycle inspection/maintenance costs. For new projects or where 100 % insulation is
removed periodically, there are opportunities to be considered. However, some non-
metallic cladding systems are difficult to subsequently remove and replace for prone
area inspection regimes.
Applied correctly, TSA, is superior to paint under similar exposure conditions. For
253
+44 (0)207 467 7100
CS, in severe CUI conditions (wetted significantly, elevated temperature within CUI
range) TSA, though it may increase life by say five–seven years, does not significantly
reduce life cycle inspection costs or required inspection coverage. Early TSA coated
CS CUI failures have been observed in the field and are typically due to:
– Not meeting the specification (i.e. a paint coating rather than seal coating or not
achieving adequate film thickness).
– Severe prolonged wetting of high temperature surfaces at water traps. It is often
difficult to achieve adequate TSA thickness for small diameter pipe.
– Exposure of TSA coatings to saline crevice conditions i.e. multiple paint coatings
applied rather than one porous seal coating.
– For CRAs, long-term TSA performance is proven by downstream experience.
−− Location of equipment – take care when considering location of equipment
as an influential parameter, especially offshore. Of course experience shows that
CUI is most often severe at fully exposed and weathered locations compared with
inside an offshore partial or semi enclosed module where exposure to water is often
limited to periodic deluge. However, this is not the right way to manage critical and
ageing weather-sheltered equipment, as some serious CUI failures and damage have
occurred in internal modules.
This is because water can travel beneath insulation and be collected by attached
pipework and delivered to internal module equipment by gravity run-off. Other
sources can appear at any time in between inspections. For example, water leaks or
freeze/melt cycles of above piping. Rainwater collection paths can also be persistent.
Direct firewater deluge exposure can be sufficiently aggressive to cause SCC of CRAs
if the equipment is vulnerable.
Avoid methods which downgrade probability for sheltered items by use of an 'inside/
outside' tick box, such that the lower probability for critical equipment translates
to lower risk and minimal inspection coverage and timing over asset life. If there
is a regular history of reliable detailed engineering assessment of environment the
internal equipment CUI inspection scheme may be assigned a reduced probability or
an extended interval.
−− Inspection history – it is important not to use individual equipment history of no
failures or no significant inspection findings to reduce probability to downgrade the
next cycle of inspection requirements, even if the inspection was 100 % removal. This
is because water ingress paths and water sources can change between inspection
dates.
Some probability assessments assign two probabilities: one (constant) that drives
the probability governing inspection/maintenance, assuming water will ingress
and the other (time-dependent) demonstrating the reduction of probability for a
finite period based on the effectiveness of the inspection, providing all anomalies
are followed up. In other words, a high probability reduction is achieved in
between inspections for high inspection effectiveness and a low % inspection
would not achieve sufficient probability reduction to sufficiently reduce the risk
for high consequence equipment. The time-dependent 'mitigated' probability can
flag under-inspected equipment priorities. Credit for inspection can be assigned
for CRAs and CS by using inspection effectiveness tables to define high to low
inspection coverage/technique combinations and these can be linked to probability
reduction.
Inspection history for each system needs to be reviewed and considered. For example,
the dates of the last full strip to bare pipe of the systems needs to be ascertained.
254
+44 (0)207 467 7100
−− Wetting – it is considered good practice to assume the presence of water can occur
between inspection cycles. However, interim CVI or regular thermography can reveal
a known or observed persistent source of water with an unknown timescale or
duration and this should always trigger priority investigation.
I.12.4 Consequence or criticality
This is best addressed by an approach based on pressure and inventory type, where the
priority is gas-containing or volatile NGL systems with high pressure. Table I.9 is included as
guidance on a criticality ranking of lines based on fluid service.
Table I.9: Fluid service and criticality
Fluid service Criticality

Hydrocarbon gas High
Condensate High
Hydrocarbon multiphase fluids Medium
Production multiphase fluids Medium
Flammable utilities Low
Non-hydrocarbons Case-by-case
However, within all the hydrocarbon categories there could be high and low consequence
examples (i.e. fuel gas <4 barg and methanol system at 400 barg or compression gas at
180 barg or multiphase low and high Gas Oil Ratio (GOR) at 10 or 150 barg) – it is best to
agree safety related consequence of failure rule sets with the technical safety discipline.
Rupture failure can occur if areas of deep uniform metal loss are left undetected for many
years, especially for thicker walled, high pressure equipment and the safety and financial
consequence of failure is much more significant than for the typical corrosion hole release.
Ageing CS equipment not proven to have been subject to suitable 100 % prone area
inspection and operating in the CUI temperature range and containing high energy inventory
can present a serious risk.
I.12.5 Risk-based prioritisation – DO
If the probability assessment is based on broad criteria then typically risk will be already
biased towards consequence of failure or criticality.
Some operators assign priority colour-coded regions in the risk table used for corrosion risk
assessment, which may have numbers further prioritising within colour-coded regions.
Inspection schemes can be assigned to various risk table regions. Some further bias towards
consequence by assigning more rigorous inspection schemes to the higher consequence
equipment.
Risk is generally more powerful if it is expressed in the same language as the corporate risk
table. If this is attempted then the differences between risk of a leak and operational safety
risk should be clearly set out – they are not the same, though they are typically the same for
financial risk.
255
+44 (0)207 467 7100
I.12.5.1 Inspection scope

Different levels of inspection effectiveness should be defined for CS and CRAs according to
risk. Examples of inspection effectiveness tables are illustrated in DNV GP101. They often
define coverage and technique and prone areas for different materials degradation modes.
The risk assessment method needs to be designed to deliver consistent application of the
strategy, not the other way around. Some methods set fixed inspection intervals but define
increasingly effective inspections over time, i.e. to acknowledge that probability and risk
increase with age or time since the last 100 % inspection.
For CRAs 4 and 8 CS bolted joints may drive inspection. For CS enough joints will be covered
by the parent material requirements.
I.12.5.2 NII vs insulation removal

For CS, NII must be selected and employed and data interpreted carefully if to
be used in conjunction with insulation removal. Screening inspection to identify areas
where CUI may be already active to direct % insulation removal may be effective for certain
geometries. EFC No: 55 lists promising techniques for CS and although used with some
limited success the results obtained from such techniques can be inconsistent for geometries
prone to CUI. In general, NII should only be used to supplement thorough inspection by
insulation removal where there is high confidence of reliability. Another useful document is
the HOIS Guidance for in-situ inspection of corrosion under insulation (CUI) HOIS(16)R2 Issue
1 published Nov 2016.
It is not considered good practice to prove NII techniques in the field without removal of
insulation.
It is not considered good practice to use NII to wholly substitute any thorough inspection for
critical equipment which is considered significantly overdue for a thorough inspection.
In practical terms it may be useful to compare NII costs with insulation removal costs as, if the
latter is well organised, it can be competitive.
Other uses for NII are to screen to help direct priorities for backlog inspections, or for
certain vessel geometries or as a pre-screening tool for live insulation removal for equipment
considered overdue for inspection, or for lower risk equipment.
The key components of a CUI RBI scheme are inspection interval, inspection technique/s and
coverage. Typically, the intervals and strategies listed as follows have proven successful to
date for CS:
−− High risk – a two–five yearly CVI (with insulation removal at damaged areas and
a low typically 10–20 % of prone areas and in addition areas which show visible
signs of water egress, insulation damage or staining) combined with a 7–10 yrly
full inspection (with 100 % insulation removal or combined with NII only in locations
where NII is judged effective).
−− Medium/high or medium risk – as with high risk, but five-yearly and 10–20 yearly
respectively for the 100 % inspection, depending on criticality, which can be
staggered by inspecting 50 % across two inspections but still addressing all visibly
identifiable prone areas. For medium risks dealing with very low pressure or non-gas/
NGL inventories then 30–50 % insulation removal or prone area approach combined
with NII may be employed.
256
+44 (0)207 467 7100
−− Low risk – five–10 yearly GVI or alternative low resource strategy, depending on risk
matrix, potentially with insulation removal at damaged areas. Operators applying
such strategies as may result in an increased risk of failure, should be prepared to
demonstrate under scrutiny by the regulator, that all reasonably foreseeable risks
arising have been identified and managed to ALARP.
Ambient temperature CS may increase from low risk to high risk after 20 years of age and so
the strategy changes in late life.
There are optimisation advantages in employing a nominal thickness-based approach for the
timing of thorough inspection; it may be time-consuming to plan especially for piping but it
can reward in field activity savings.
CRAs, with a few exceptions, could be treated as medium and low risk.
I.12.5.3 Prone areas

Water sources, water ingress points, prone areas, corrosion rates and coating life are not
always obvious. Areas predictably vulnerable to water ingress and settle-out points are
vertical to horizontal bends, pipe supports, SBC or piping connections, vessel nozzles and
vessel insulation support or stiffening rings, top and bottom horizontal surfaces for vessels
and long horizontal stretches of piping. 100 % prone area inspection often translates into
100 % insulation removal for piping and is often a practical necessity for smaller vessels. For
CS, prone areas include where 316L cladding terminates and contacts the piping without
galvanic protection; these contact points can accelerate the onset of CUI though are less
influential on rates. The majority of prone areas typically do not suffer from CUI and 90 % of
the time the few significant CUI locations will occur at a prone area. Do not underestimate
the power of supports to draw in water and dam up water.
For CRAs, the typical prone areas listed (for water ingress) must coincide with smaller sized
bolted (CS) joints, welds (if SCC is possible, including top of line water ingress locations) and
pitting/crevice corrosion of austenitics or duplexes is possible at crevices, under stickers or
heat tracing tape.
For any material, cladding can cause fretting of vibrating equipment (CRA or CS) as can
personal protection cages, supporting late life 100 % inspection.
Non-steam heat tracing itself does not appear to be a prone area for water ingress but could
cause elevated corrosion if water is present in terms of elevated temperature.
I.12.5.4 Damaged or ineffective cladding and sealing arrangements

Can be used to target inspection. However, these visual defects do not count as the only
prone areas – if a % prone area regime is followed then prone areas need to encompass
locations where insulation is in visibly good condition but which are known as common
water entry and hold up points.
I.12.6 Other considerations for inspection
I.12.6.1 Increasing inspection coverage based on findings

Where sample inspection yields evidence of coating breakdown and/or corrosion is found
then the sample size should be increased to ascertain whether there is further deterioration.
257
+44 (0)207 467 7100
Any areas found with such deterioration should be evaluated for refurbishment and the
insulation reinstated where required to correct specifications.
I.12.6.2 In-service coating maintenance

Some companies opt for coating maintenance for visibly corroded areas of CS within one–
two years and some will choose not to coat thicker walled larger diameter mildly corroded
equipment; others use a risk table to optimise activities. FM is often not cheaper than
replacement of small bore piping where equipment is significantly corroded. Insulation can
be reinstated without coating maintenance and areas of mild corrosion damage or coating
breakdown may be monitored at the interim or next inspection as prone areas. It should be
noted, however, that decisions not to carry out maintenance should only be made whilst also
considering:
−− Any claims made based upon FM mitigation in any associated inspection scheme,
with the scheme itself or levels of maintenance being adjusted to ensure consistency.
−− All reasonably foreseeable risks arising from the potential failure of the systems in
question, and managing those risks to ALARP. The operator may be challenged to
demonstrate the determination and assessment of those risks, together with any
control measures in place.
For CRAs coating maintenance is a primary management strategy but again focusing on the
higher risk equipment and assessed coating condition. Some duty holders have used Re 2
paint condition as a trigger for recoating. Re 2 is in accordance with the criterion in ISO 4628.
TSA can be applied in the field but aluminium wrap is also very effective.
I.12.6.3 Deferral of inspection

It is possible that inspections may need to be brought forward or pushed out to fit with
other planned works. The main concern for a risk assessment is whether the equipment is
already significantly overdue for inspection and not just in terms of timing but also historical
inspection effectiveness. Participation in this and approval of the outcome should include
senior site management in addition to inspection and assurance personnel. Any deferral
of such equipment based on site-local information that has to be controlled by another
discipline should not extend for longer than a few years, unless the strategy is adjusted to
reduce the risk, in accordance with good practice.
The outcome from the application of a CUI strategy will be a rolling programme of equipment
inspections scheduled within the MMS. However, it is often the case that strategies
change quickly due to almost overnight changes in awareness of good practice, and the
rolling programme turns into a five year backlog of intensive work with potential adverse
consequences on integrity.
I.12.6.4 Live equipment insulation removal considerations

Large scale stripping of insulation can only be carried out when operationally acceptable.
It may be that due to temperature or operational limitations systems can only be stripped
during plant outages. Therefore, the planned inspections need to be considered as part
of the overall plant operating strategy and tie in with shutdowns etc. where appropriate.
The process engineering and operational functions can assist. Practical tips about lower and
higher temperature equipment online inspection are as follows:
−− Ask the process engineer how much insulation can be removed at a time over the
estimated period to minimise losses and not upset the process. Typically, 6 m/day can
be removed and reinstated.
258
+44 (0)207 467 7100
−− Too cold – equipment operating <5 °C can frost and ice if inspected online. NII is
suitable for this unless where corrosion product staining or insulation damage is
evident.
−− Too hot – traditionally, equipment operating >70–80 °C has been deemed from a
safety perspective to require SD removal, but this equipment typically is suitable for
replacement of insulation with cages and also cages are not always needed i.e. at
height. Insulation removal AND reinstatement work have been carried out on 300 °C
systems applying safety assessments with regard to personnel protection. In general
most very hot equipment insulation work >2 m height consists of permanent removal
and is therefore more easily executed from a safety perspective.
If the equipment is very overdue for inspection, for example (16–20 yrs+) aged CS with no
full insulation strip history, consideration should be given to the risk of failure caused by
inspection. Threats include insulation removal and physical human weight placed on thin
wall piping. Good working practice should eliminate the latter. Risk of causing a failure by
insulation removal activities is unlikely for CRA and bolted joints and possible for carbon
steel, especially for low pressure systems, where most leaks are caused by attempts to 'clean
up' surface or remove insulation entangled with corrosion product.
−− Aim for offline inspection if equipment has not been inspected commensurate with
risk and risk is high (older, under-inspected CS equipment). If this is not possible, use
the following prior to insulation removal:
– FLIR camera pre-survey and post-insulation removal follow-up (particularly for
critical system bolted joints, CRAs, and open module/onshore systems).
– Staged HOLDs during insulation removal such as splitting cladding to reveal
whether insulation is soaked and ensuring that any surface preparation or
interaction with corrosion product is undertaken under the external surface
preparation guidance (typically prove via NII > 3–5 mm remaining wall or as
according to MAWT vs actual minimum measured wall).
Note: plants which have executed inspection cycles, techniques and coverage
commensurate with risk and this guidance i.e. successive complete insulation
strips for high risk equipment, should remain at low risk from online insulation
removal.
I.12.7 Monitoring and measuring performance – CHECK
KPIs are as per EFC No: 55

−− Failures.
−− Near-miss inspection findings (considered capable of causing a leak within FIVE yrs).
−− Severe anomalies (10 years).
−− Current risk of failure since last inspection i.e. is it overdue for inspection?
−− Quality of CRAs (which contribute to risk in terms of defining probability).
259
+44 (0)207 467 7100
I.12.7.1 Performance review

−− Annual (and if appropriate quarterly) reviews of CUI mitigation and inspection
outcomes and the achievement of performance targets. Corrective action for these
programmes if indicated.
−− RCA of CUI failures or management system failures with appropriate corrective
action recommendation.
Overall review of these together with verification findings for offshore installations and audit
results. Corrective action in strategy if indicated.
Particular attention should be paid to understanding true backlogs in inspection (i.e. not
just by due date but by examining whether enough inspection has been carried out).
Fabric maintenance activity should be controlled by rules sets; it is not always necessary or
cost-effective.
The relationship to budget and resource constraints should be examined. The advice of the
ICP should be sought in relation to safety critical items.
I.12.8 Audit – ACT
The effectiveness of CM activities, including the CUI programme will be included in the
planned integrity management system audits. The intention of the audit process is to provide
assurance that the CUI management programme is proceeding according to plan AND that
the strategy used to produce the plan is not flawed AND that all critical equipment has
records of adequate CUI inspection.
An annual audit and review plan for the Integrity Management System shall be developed
and maintained by the Duty Holder/Operator for each site. All aspects of CM, including the
CUI programme, may be audited against the checklist provided in Annex L of this document.
260
+44 (0)207 467 7100
Figure I.50: CUI examples
I.12.9 PLAN
I.12.9.1 Policy and strategy

As a matter of policy, the Duty Holder/Operator should seek to assure the continued integrity
of all sites with the aim of minimising risk to personnel, environment and business from the
threat of CUI. In addition, the Duty Holder/Operator should seek to optimise expenditure
without compromising integrity through the provision of efficient and effective management
strategies.
261
+44 (0)207 467 7100
It is considered good practice to document CUI strategy separately because it requires a

multidiscipline approach to manage effectively. A good strategy will consider history and
context in order to suit the asset. However, all strategies should contain the following
sequential elements:
a) Prioritise equipment based on criticality (consequence of failure). Identification of
equipment at risk using temperature is not recommended as a high level screening
method though it plays a key role in the Probability of Failure assessment in step d).
Steps b–e should first address the highest consequence of failure equipment.
(b) Data validation to assess insulation type, material and temperature.
(c) Challenge the need for insulation.
(d) Conduct RBI assessment (probability × consequence = risk of failure).
(e) Develop RBI/coating maintenance plans:
– The primary CUI control strategy for vulnerable CS is inspection.
– The primary CUI control strategy for vulnerable CRAs is application and
maintenance of coatings, where inspection has reduced value compared with
CS.
Increased effort in planning is always high value and rewarded in implementation phases
and asset performance. Fieldwork can focus on the highest risks first for any given budget.
I.12.10 DO
Organisation roles that can be involved in CUI management include:
−− Engineering and senior managers.
−− Integrity managers.
−− Corrosion and materials specialists.
−− Process engineers and plant operators.
−− Insulation materials suppliers and applicators.
−− Specialist contractors for insulation removal.
−− Facilities maintenance teams.
−− Inspection engineers and NDT contractors.
−− Structural and mechanical engineers.
−− Asbestos specialist companies for very old roughly pre-1980 insulated equipment.

−− factors that influence CUI;
−− the importance of having a sound tactical approach or strategy, and
−− ability to create a risk picture or KPIs which can communicate improvement with time
or key risk priorities at equipment level.
262
+44 (0)207 467 7100
I.13 STRESS CORROSION CRACKING AND LOCALISED CORROSION OF STAINLESS STEELS

IN CHLORIDE ENVIRONMENTS
I.13.1 Introduction
Stainless steels are employed in the upstream oil and gas industry for a wide variety of
applications. The majority of applications take advantage of the resistance to corrosion
in comparison with CS, where the additional CAPEX of selecting an alloy resistant to
corrosion in the given environment compares favourably with the OPEX or feasibility
of corrosion mitigation. Other applications exploit properties such as high temperature
oxidation resistance (310S in flare equipment), low temperature fracture toughness
(austenitics such as 316 in relief piping and cryogenic process), low magnetic permeability
(manganese austenitics in non-magnetic drilling equipment) and tendency for contamination
(potable water service, fuel handling and upstream of compressors).
A wide variety of stainless alloys is used in the industry, with the composition and heat
treatment condition dictated by the particular application requirements, e.g. for corrosion
resistance and strength. Examples of commonly applied grades and their applications are
shown in Table I.10.
Table I.10: Applications if stainless steels
Stainless Grade Typical applications Comments

type
Martensitic 13Cr/410/420 Downhole production tubing, Medium strength, good
pump and valve components corrosion resistance to CO2
corrosion in production
environments. Modified
grades utilise nickel and
molybdenum to improve
toughness and corrosion
resistance. Limited resistance
in oxygenated chloride
environments
Austenitic 316 Piping, vessels, valves and Common cladding material
associated equipment for for vessel service. Low
process, utility and chemical strength, high ductility. Can
service. Instrument tubing/ be strengthened by cold
fittings, sand screens, work for some applications
fasteners, etc (fasteners, smallbore tubing).
Not suitable for seawater
service
6Mo Pipework and other equipment Low strength, high ductility.
exposed to seawater. High PREN
Instrument tubing and fittings
263
+44 (0)207 467 7100
Table I.10: Applications of stainless steels (continued)
Stainless Grade Typical applications Comments

type
Duplex 22Cr Piping, valves and vessels Medium strength and
in corrosive production high corrosion resistance
conditions for internal production
conditions. Subsea
applications require
consideration of HISC
25Cr Higher strength applications Medium strength,
for piping, vessels and valves. duplex materials can be
Seawater service including lift strengthened by cold work.
pumps. Downhole production Superduplex materials have
tubing PREN >40
Precipitation 14PH/630 High strength components in High strength martensitic
hardened completion, valve and pump PH grade with wide range
applications of strength levels possible
via ageing treatment. Very
restricted application in sour
service conditions
A286/660 Fasteners Medium strength austenitic
PH grade. Used in subsea
applications
Precipitation 17-4PH/630 High strength components in High strength martensitic
hardened completion, valve and pump PH grade with wide range
applications of strength levels possible
via ageing treatment. Very
restricted application in sour
service conditions
A286/660 Fasteners Medium strength austenitic
PH grade. Used in subsea
applications
Corrosion resistance is primarily a function of composition, with alloys ranging from the
leanest 13Cr-type alloys at one end of the spectrum to the highly alloyed superaustenitic
and hyperduplex grades at the other. The concentration of the primary alloying elements
chromium and molybdenum is increased across this spectrum to improve the resistance to
corrosion. Other alloying elements such as nickel, nitrogen, copper, tungsten, niobium and
titanium can enhance corrosion resistance in specific grades or environments.
Stainless steels rely on the stability of a protective chromium-rich oxide film to resist corrosion,
the capability of which is principally dictated by composition. This film provides resistance to
substrate oxidation in conditions where it remains intact; however, it can be dissolved in
strongly acidic conditions, resulting in general corrosion. In upstream oil and gas conditions,
risk of localised degradation due to partial disruption of the passive film is more prevalent
with the chloride ion being the main protagonist.
264
+44 (0)207 467 7100
I.13.2 Environments
A variety of chloride-bearing aqueous environments can be experienced in upstream oil and

gas applications. Externally, such conditions include saliferous atmospheres with airborne
moisture, seawater immersion/splash zone service and under insulation where water ingress
has occurred.
Internal service can be broadly categorised into oxygenated and nominally oxygen-free
service. The former primarily pertains to untreated seawater service, either for firefighting/
utility purposes or for process cooling. Treated seawater, e.g. for water injection
applications, may contain small quantities of oxygen by design, through upset vacuum/
chemical scavenging treatments or unintentional external ingress. Oxygen-free aqueous
chloride conditions are predominantly associated with reservoir waters in the production
system.
In addition to natural waters, either from the reservoir or lifted from the sea, synthetic chloride
(and bromide) brines are regularly used in drilling and completion applications where contact
with stainless steels is common. These clear brine fluids typically contain very high dissolved
solids concentrations to maximise density, so for halide systems it is essential to control pH
and oxygen.
Figure I.51: Annular SCC of duplex production tubing attributed to oxygenated

calcium bromide brine
I.13.3 Factors affecting corrosivity and tendency for degradation
As indicated in the previous section, one of the primary differentiators in service environment
for stainless steels is the presence of oxygen, the reduction of which presents a cathodic
reaction to accompany the substrate oxidation process. Lower grade stainless steels such as
13Cr and 316 are successfully used in oxygen-free production conditions where corrosion
threats arise from dissolved acid gases. In such applications, these comparatively lean grades
have sufficiently low depassivation pH to resist corrosion even at elevated temperatures and
chloride concentrations. For oxygenated internal/external conditions, application envelopes
for specific grades are considerably more restricted. This should be borne in mind when
considering risks of oxygen introduction to systems designed for oxygen-free service.
265
+44 (0)207 467 7100
Temperature and chloride concentration are two other dominant factors for the suitability of
a stainless steel in a given application. Together with in situ pH, these parameters are the key
drivers for increased alloying requirements in low H2S, oxygen-free service. Temperature is
also a controlling parameter for resistance in oxygenated service, with the tendency for
localised corrosion and SCC increasing with temperature. There is also an effect of biofilm
to be considered, particularly for natural waters, relating to potential ennoblement and
cathode reduction efficiency. Where chlorination is used to control bacterial activity, excessive
concentrations have the effect of increasing corrosion potential.
For external service there is a limit to the effect of temperature, particularly in uninsulated
conditions, in view of the tendency for free water at temperatures approaching boiling
point. The downside of operation at elevated temperature in a saliferous environment is
the tendency for evaporation and concentration of salts on the surface of the material.
Evaporation effects and localised increases in chloride concentration can also occur in internal
production conditions if small amounts of formation water in contact with a gas phase are
exposed to a significant pressure drop, e.g. across a choke or level control valve.
Figure I.52: Internal SCC of 22Cr duplex resulting from chloride concentration effects
Local environmental effects promoting greater corrosivity can also be created by the
introduction of contact/retention features such as clamps, deposits, stickers, etc. An
environment with severity outwith design intent can also be created by the combination
of compromised insulation integrity and deluge activity. Use of materials which can leach
chloride or are chloride-bearing, e.g. inks, insulation materials, etc, can also result in increased
localised corrosivity. Coupling of dissimilar materials can result in accelerated localised attack
of the less noble alloy. For stainless steels, this is primarily an issue for oxygenated internal
environments, i.e. seawater service, where coupling with more noble materials such as
graphite, nickel alloys or higher alloy stainless grades.
266
+44 (0)207 467 7100
Figure I.53: SCC experienced on a cold worked dome end section of a previously
insulated vessel
Figure I.54: Evidence of corrosion taking place beneath label on 316L line
In addition to the severity of the service conditions, the resistance of a stainless steel to
degradation in aqueous chloride environments can be compromised by a number of other
factors. Such factors include microstructural anomalies (formation of intermetallic or carbide
phases, depleting alloy content locally), excessive oxidation in service or during fabrication
(heat tint) depleting the surface of alloy content, free iron surface contamination, use of high
sulfur free machining versions of a grade and intentional or incidental cold work.
267
+44 (0)207 467 7100
Figure I.55: Localised oxidation at stainless steel weld
I.13.4 Degradation mechanisms
Stainless steels are susceptible to various forms of chloride-influenced localised corrosion

including pitting corrosion, crevice corrosion, intergranular corrosion and SCC. All these
mechanisms are anodic, i.e. the damage to the steel is due to loss of metal at sites of
anodic activity, where the cathodic reaction is oxygen reduction or hydrogen ion reduction
in the absence of oxygen. Anodic processes increase with increasing temperature, hence
degradation rates resulting from these processes generally increase with temperature.
At elevated corrosion potential levels, stainless steels are at risk of localised passive film
breakdown and where chlorides are present the tendency to repassivate is impaired, resulting
in pitting corrosion. Pitting corrosion is a stochastic phenomenon, the prediction of which
relies on an understanding of numerous parameters with pitting tendency/time expressed
in terms of a statistical distribution. Of more practical use is the concept of a critical pitting
temperature (CPT), which should be regarded as a soft limit above which the probability of
pitting is significant. Example CPTs for bulk materials are shown in Table I.11.
Table I.11: Threshold temperatures for stainless steels
Stainless steel Threshold temperature for Threshold temperature for

category external pitting corrosion external crevice corrosion
316(L) Ambient Ambient
6Mo 50–60 °C 30 °C
22Cr DSS 40–50 °C 15–20 °C
25Cr SDSS 60 °C 30–40 °C
268
+44 (0)207 467 7100
Figure I.56: Pitting corrosion on 316L hydraulic piping
Crevice corrosion occurs in stainless steels at sites where the passive film is impaired by
the presence of a surface restriction to oxygen access. Repassivation is not possible in such
conditions and hydrolysis of liberated substrate ions plus migration of chloride ions to the
anodic site result in a very aggressive local environment, with commensurate corrosion rates.
Crevice geometry is a significant factor in the tendency for corrosion, together with more
universal aspects such as temperature. Crevices can be formed by a variety of means, such
as support clamps, flange faces, deposits, etc. It should be noted that critical temperatures
for crevice corrosion are significantly lower than those for pitting, as indicated in Table I.11.
269
+44 (0)207 467 7100
Figure I.57: Crevice corrosion at clamp location on 316 tubing
The resistance of a stainless steel to localised corrosion in chloride environments is very much
a function of the alloy content. This is can be expressed in the form of a Pitting Resistance
Equivalent Number (PREN), calculated from formulae derived from corrosion testing. A
common version of the PREN formula is shown here, although there are a number of variants
containing different coefficients and other elements such as tungsten.
PREN = %Cr + 3,3 × %Mo + 16 × %N (concentrations in wt%)
Intergranular corrosion in stainless steels pertains, in the main, to the situation where
the formation of grain boundary chromium carbides during thermal treatment, e.g. from
fabrication, results in chromium denuded zones which exhibit lower resistance to corrosion.
The mechanism is avoided by the used of low carbon or stabilised grades.
SCC of stainless steels50 51 52 53 54 in chloride environments is a significant concern, due to

the potential for rapid propagation in comparison with other mechanisms. Being an anodic
process, the risk is a function of operating temperature and a threshold temperature limit for
a given grade is often specified as a means of mitigation. However, it should be noted that
there are numerous environmental factors influencing SCC tendency, e.g. time of wetness
and chloride concentration affected by aspects such as humidity, insulation and evaporation
effects.
Additionally, given that tensile stress is required for the mechanism to operate, the level
of service and residual stress influences SCC risk and is affected by various factors from
fabrication and operation, i.e. global stress level, localised cold work, fabrication stresses,
geometrical stress raisers, presence of pits, etc.
270
+44 (0)207 467 7100
Figure I.58: Stress corrosion cracking on 316 fitting
An example of the approach taken in EI Guidance on external corrosion of stainless steels

is shown in Table I.12, which recognises the uncertainties and additional factors affecting
SCC tendency by adopting a tiered categorisation. Note that further text and references
accompany this table in the source document in order to justify and qualify the ranges.
Table I.12: Temperature ranges for stainless steels
Stainless steel Material At risk–specialist Material not

category considered safe advice should be recommended without
sought risk assessment
316(L) <20 °C 20–50 °C >50 °C
6Mo <100 °C 100–120 °C >120 °C
22Cr DSS <70 °C 70–100 °C >100 °C
25Cr SDSS <80 °C 80–100 °C >100 °C
In comparison with austenitic and duplex stainless grades, nickel-free ferritic and martensitic
stainless steels are highly resistant to chloride SCC but Ni-containing grades can be susceptible.
Localised corrosion and SCC can also be experienced in internal, oxygen-free chloride service
environments. Threshold levels are less well-defined than atmospheric service, but stainless
steel grades are successfully employed at temperatures well above their respective limits
for oxygenated service in such environments. Additional factors such as H2S concentration
and bacterial activity influence the tendency for internal mechanisms over and above the
common parameters such as chloride concentration, residual stress, etc.
Intergranular cracking is normally associated with sensitised materials, but can also occur
in high strength stainless steels, i.e. precipitation hardened martensitic grades. In this case,
271
+44 (0)207 467 7100
exposure to atmospheric chloride environments can result in hydrogen stress cracking where
hydrogen is generated by anodic corrosion processes.
I.13.5 Mitigation
Stainless steels are typically selected as a means of CM, so application of any additional
corrosion mitigation will usually arise from differing service severity on internal and external
surfaces. The primary means of corrosion mitigation would be to select a higher stainless
steel grade with alloying content capable of withstanding both internal and external service
environments; however, there can be economic and practical aspects associated with this
approach which favour mitigation instead.
Where the stainless steel is appropriate for internal conditions but susceptible to external
corrosion or cracking mechanisms, the application of barrier coatings is often specified.
Organic coatings and thermally sprayed aluminium are employed depending on criticality
and operating temperature requirements. Protective coatings are typically specified for
service under insulation as a contingency against water ingress in the event of the clad and
insulation system being breached.
Prevention of surface salt concentration on hot pipework, and reducing the potential for
insulation ingress can be achieved by minimising seawater deck-wash or deluge exposure.
In recent years, where insulation is required for personnel protection it has been common to
utilise open mesh guards instead, in order to remove the risk of CUI. In such instances, care
should be taken to mitigate risk of crevice corrosion at support ring contact points. Crevice
corrosion is also a recognised issue in relation to smallbore tubing clamps. Where the grade
of stainless steel is susceptible to crevice corrosion at the operating temperature, precautions
should be taken to mitigate against the mechanism. Approaches employed to date have used
inhibited polymers, specific design geometry/materials and barrier coatings.
Welded equipment has the potential for localised susceptibility to degradation where
control of oxidation has been inadequate. Where detrimental oxidation (and/or ferrous
contamination) has occurred, this can be removed by pickling and passivation treatments.
Whilst this is typically applied during fabrication, remedial electrochemical or chemical
treatments can be applied in situ.
In immersed seawater applications, protection from external corrosion mechanisms on

non-seawater resistant grades, e.g. 316, is afforded by CP in conjunction with coatings.
For internal chloride degradation mechanisms, the use of chemical inhibition is not
common for stainless steels, but instances of retrospective application when an issue has
been detected in service are known. More commonly, chemical treatments to address
corrodents are applied, principally pH modification and oxygen removal. Physical treatment
is to remove oxygen, e.g. by vacuum, are also common. Dilution with condensed water is
applied in situations where internal evaporation can result in chloride concentration effects
downstream of valves.
The risk of galvanic corrosion of a lower grade stainless steel connected to a more noble alloy
generally indicates that the original material selection is questionable. Where the risk exists,
typical mitigation measures would include isolation of the dissimilar materials or coating of
the cathode.
272
+44 (0)207 467 7100
I.13.6 PLAN
I.13.6.1 Policy
Localised corrosion and SCC of stainless steels can result in failure of pressurised process
equipment, with the potential consequence of hydrocarbon release. The operating company's
integrity policy and strategy should therefore be directed to prevent such failures or at least
to keep the risk ALARP.
Where a residual risk from mitigation of localised corrosion or cracking exists, the CMP
should recognise the implications of failure of relevant equipment and stipulate appropriate
treatment in the CMS.
I.13.6.2 Planning
Where stainless steels have been selected specifically to mitigate against envisaged corrosion
mechanisms in service, the expectation would be that appropriate selection using reliable
established guidelines or specific qualification testing would be the primary planning
aspect. This would be augmented by an appropriate level of surveillance to confirm design
assumptions during service life.
Where mitigation measures to protect the stainless steel material itself require to be
implemented, e.g. by coating or physical/chemical treatment, control and monitoring
measures require to be in place.
For these two scenarios, the CMS should include planning for the prevention of chloride-
induced corrosion and cracking in stainless steels via the relevant combination of inspection
and control activity.
I.13.7 DO

During design it is important that the CRAS considers the realistic worst case scenarios in order
to select the appropriate material grades for the required service. In service, it is imperative
that design assumptions are reviewed to determine if any evolution of degradation likelihood
is occurring.

−− Periodic review of well fluid composition data to assess for increase in chloride
content.
−− Assessing the implementation and reliability of mitigation measures such as
washwater injection or oxygen control treatments.
−− Reassessment of materials following significant modifications in operating conditions,
e.g. temperature increase, blanket gas composition, etc.
−− Assessment of premature degradation of mitigation means, e.g. coating breakdown
or formation of salt/debris deposits.
−− Downhole intervention activity and exposure to new fluids are not considered in
design.
I.13.7.2 Organising
That part of the Duty Holder which is responsible for managing corrosion risks in operation
should arrange for the development of mitigation measures to control any anticipated
chloride corrosion and cracking threat. It should be apparent that this may involve multiple
273
+44 (0)207 467 7100
parts of the organisation, given the widespread application of these materials, i.e. downhole,
subsea, topside, pipelines, etc.
The functions responsible for undertaking the following activities are to be identified by the
Duty Holder:
−− corrosion threat assessment and RBI generation/review;
−− inspection activities, findings review and completion of RBI loop;
−− remediation of anomalies found, and
−− application and monitoring of chemical and physical treatments.
It is important that the purpose of control activities and the implications of poor implementation
are effectively communicated to the responsible functions in the organisation.

in a cost-effective manner. To achieve this, the Duty Holder requires to ensure that adequate
resources are in place for mitigation and review activities as outlined.
I.13.8 CHECK

This aspect of the cycle primarily relates to confirmation that the control activities,
e.g. process treatments, coating, etc, continue to be effective and are implemented in
line with the plan. Where material selection is the sole means of addressing the corrosion
threat, the performance is confirmed by inspection, including NDE where applicable, to
confirm the absence of localised corrosion or environmental cracking damage.

It is important to investigate and record all incidents to a greater or lesser degree. In-service
failure of stainless steel materials may indicate an inappropriate original material selection,
anomalous material, mitigation shortfall or an incomplete understanding of the operating
conditions and their associated risks. As such, there may be wider implications for other
equipment/assets and the event should be investigated, irrespective of the consequence of
a particular failure.
I.13.9 ACT

The results of monitoring activity, trends in inspection findings and any service failures should
be assessed in order to determine if the mitigation approach is successful or if modification
to the plan is required.

in-house and, where possible, in the public domain. By the same token, the organisation
should actively participate in industry technical groups in order to benefit from the experiences
of other operators.
274
+44 (0)207 467 7100
I.14 EROSION/CORROSION
I.14.1 Erosion mechanisms
Erosion
The progressive loss of material from a solid surface due to mechanical interaction between
that surface and a fluid, multi-component fluid or solid particles carried within the fluid.
Erosion-corrosion
A conjoint action involving corrosion and erosion in the presence of a moving corrosive fluid
or a material moving through the fluid, leading to accelerated loss of metal.55
Erosion56, 57, 58, 59, 60, 61 often causes localised grooves, pits or other distinctive directional
patterns in locations of elevated velocity in comparison to corrosion degradation.
Potential mechanisms that can cause erosion damage are:

−− particulate erosion – mechanical removal of metal by impact of solid particles;
−− liquid droplet erosion – removal of metal by impact of liquid droplets in high velocity
wet gas and multiphase flows;
−− erosion-corrosion – combined/synergistic effect of particulate erosion and corrosion,
and
−− cavitation – removal of metal by implosion of gas bubbles formed in liquid flows.
Choke Valve 316 Stainless Steel Valve Impeller Copper Nickel Alloy
Colander
Particulate Particulate Cavitation Erosion

Erosion Erosion Corrosion
Original Photo from
previous guidelines
Figure I.59: Examples of erosion mechanisms
Erosion that occurs in process pipework is mainly due to particulate erosion caused by
sand or proppant from well clean-up entrained in the produced fluid. Erosion rates are
particularly dependent on the particle or fluid velocity and the total mass of solids in a system.
The erosive nature of solid particles is dependent on a number of factors including, but not
limited to:
−− fluid or particle velocity;
−− total mass of particles;
−− particle shape;
−− particle hardness;
−− particle size;
−− hardness of equipment material;
275
+44 (0)207 467 7100
−− angle of particle impingement (for ductile materials), and

−− flow effects that concentrate particle impingement locally.
Erosion of steels will not usually occur in solid-free fluids even at very high velocities.
In the absence of any solids, erosion by non-corrosive fluids in steel is not significant at
velocities below the process piping design velocity limits to prevent severe pressure drops
(~30 m/s). The conditions required for liquid droplet erosion are unlikely to occur in correctly
designed production pipework systems.
Erosion-corrosion mechanisms are a synergy of erosion and corrosion, often resulting

in significantly greater degradation than the sum of erosion alone and corrosion alone.
Many metals rely on the formation of a protective film of corrosion product for resistance
to corrosion. Erosion-corrosion occurs when protective films are damaged by the flow,
continuously exposing fresh metal. Corrosion of fresh metal progresses rapidly as the
protective film is removed by erosion.
Cavitation is rare in oil and gas production systems except in chokes, control valves and
pump impellers, as the operating pressure is generally much higher than liquid vaporisation
pressures. Cavitation occurs when the pressure is reduced below the vapour pressure of
the liquid, bubbles are formed and then collapse generating shock waves of sufficient
amplitude to damage pipework.
I.14.2 PLAN
I.14.2.1 Policy
The EI Guidelines on sand erosion and erosion-corrosion management may be used
as guidance to develop the erosion and erosion-corrosion management aspects of
the Company Integrity Policy and Strategy in order to manage the risk of failure ALARP.
I.14.2.2 Planning
A clear sand management strategy to optimise production without compromising safety
or environmental considerations can be an effective means to control erosion problems. It
should be updated regularly based on experiences and future requirements, in particular, after
sand-related incidents and to account for system modifications and changes in operating
conditions. Implementation of changes and modifications may fall with the remit of the
company MoC system.
The CMS should/shall define the approach to plan implementation and the analysis of
collected data. A corrosion control scheme/management matrix should be used to define
the requirement to maintain the integrity of the topsides static equipment and associated
pipelines by a programme of mitigation against, and by monitoring of, applicable degradation
mechanisms. The corrosion control scheme/management matrix should/shall:
−− identify locations where erosion and erosion-corrosion degradation may be
anticipated;
−− identify asset-specific management activities to mitigate and monitor plausible
threats;
−− reference PMRs;
−− define performance limits or indictors to ensure that monitoring and mitigation
data are reviewed appropriately to prevent loss of integrity and impact on personnel
safety, environment and the business;
276
+44 (0)207 467 7100
−− identify remedial actions to reduce plausible threats if performance limits or indictors

are exceeded, and
−− define clear responsibility, accountability, and ownership of erosion and
erosion-corrosion management.
277
+44 (0)207 467 7100
+44 (0)207 467 7100
IDENTIFY EROSION AND EROSION CORROSION RISKS FOR THE ASSET
Item identity
MITIGATION BARRIERS
Item location
Materials and process THREAT MONITORING
The barrier/mitigation activity:
parameters
Operating Guidelines
The likelihood of failure by
erosion or erosion-corrosion Downhole Sand Exclusion BARRIER MONITORING
The measurement method to
threats Desanders, Filters, etc. determine the success of the
The consequences of mitigation Corrosion/erosion allowance barrier against the identified
failure threat REMEDIAL ACTION(S)
Erosion resistant materials The measurement method for
The performance limit for that the effectiveness of the barrier
Piping and completion design measurement
to reduce velocity and The performance limit for that
changes of direction The monitoring activity: measurement The action(s) required on non-
conformity to the performance
Inspection The monitoring activity:
The location of the threat, measurement
278
barrier and monitoring activity Sand (acoustic) Monitoring Inspection
Online Erosion Monitoring Sand (acoustic) Monitoring Responsibility for action on non-
Process Parameters (velocity Online Erosion Monitoring conformity
inferred from pressure)
The frequency of monitoring, or
The frequency of monitoring, or the basis on which frequency
the basis on which frequency should be determined
should be determined
Figure I.60: Basis of an erosion and erosion corrosion control scheme/management
I.14.3 DO

One aim of the risk profiling process is to define or quantify the tolerable erosion damage
and functional life of the system components. Susceptible areas of pipework and plant
should be identified in order that the impact on facilities may be determined and appropriate
mitigation and monitoring strategies can be used to keep loss of containment due to
erosion risk ALARP. This may be done through sand prediction and erosion modelling prior
to detailed design and throughout life for changing process conditions (pressure reduction,
sand control failure etc).
Various erosion models have been developed from experimental observation of erosion and
fall into three broad categories:
−− empirical models that are simple mass or volume loss equations e.g. API RP 14E;
−− mechanistic models based on fluid and particle properties and flow rates e.g. Salama
Equation, DNV RP O501, SPPS Software – University of Tulsa, Sandman Software,
and
−− complex models requiring detailed input using computational fluid dynamics or finite
element analysis.
It is often preferable to use quick, simple, conservative calculations to identify potential

problems. If issues are identified then erosion estimates can be refined using more accurate,
but complex methods.
Figure I.61 illustrates some of the locations in a production system that can be particularly
susceptible to erosion. Care should be taken when considering sand production rates for
erosion assessment purposes. A high sand rate may be tolerable in low-velocity flow for
short durations and a low sand rate can cause significant damage over a long duration at
high-velocity.
279
+44 (0)207 467 7100
Pipework vulnerable if blowdown causes sand carryover

(thin walled pipe & high velocity gas flow)
Flare
choke
internals Compressor vulnerable to
& outlet rust particles & sand
Xmas tree
& flow line downstream
of choke
Gas
Export
bends downstream of
reduced-bore valves Mostly fines
Sand accumulation in
separator could cause
sand carryover and
restrictions in valve subsequent pipeline
well (sliding internals Primary separator inhibition issues
sleeves, SSSVs,
ESDs, ICDs etc.)
Oil
Export
separator
mesh failure in nozzles (liquid) Pump wear
partially blocked
sand screen pump wear
Mostly fines – pipework
vulnerable at high rates
Poor design or Sand Produced Sand accumulation in

operation makes Handling Water separator could cause
pipework sand carryover
vulnerable
Poor slurry cyclone cyclone

conditioning internals internals
makes Xmas tree
& pipework
vulnerable
Cuttings Water
Reinjection Reinjection
Xmas tree & pipework

vulnerable at high rates or
if filters fail
Figure I.61: Parts of the production system that typically suffer from erosion62
I.14.3.2 Organising
Definition of clear responsibility, accountability, and ownership of erosion and erosion-corrosion
management activities should be included the corrosion control scheme/management matrix.
A clear sand management strategy is an effective means to control erosion problems.

Disciplines that may be involved include, but are not limited to:
−− Materials and Corrosion Specialists – materials selection, erosion management;
−− Piping and Pressure System Design Engineers – pipe sizing and design, equipment
selection, computational flow dynamics;
280
+44 (0)207 467 7100
−− integrity – inspection and maintenance strategies, Inspection Engineers and NDT

contractors;
−− facilities operations – facility operation, sand disposal;
−− Process Engineers – facility operation and production limits, equipment selection,
sand disposal;
−− instrumentation – sand monitoring and degradation of other instrumentation, online
monitoring specialists;
−− Production Engineers – production limits;
−− drilling, completions and reservoir engineering – sand exclusion, reservoir depletion
and completion design, geomechanics, and
−− safety and risk – assessment of failure frequency and consequences.
Communication activities should aim at increasing awareness of the factors that influence
erosion and erosion-corrosion to ensure the impact of operating changes are fully understood.
I.14.3.3 Implementing your plan
I.14.3.3.1 Mitigation barriers

Production systems can be designed and operated to exclude or prevent sand production or
they can be designed to tolerate sand production. The best erosion mitigation strategies are
those directed at preventing and avoiding sand production at the surface, for example:
−− downhole sand exclusion measures (gravel packing, wire screens, proppant retaining
screens), and
−− desanders, filters and dropout vessels.
Many erosion problems can be avoided by using good design to reduce the likelihood of
loss of containment due to erosion damage, such as:
−− corrosion/erosion allowance;
−− erosion resistant materials;
−− piping and completion design to reduce velocity and changes of direction (correctly
sized chokes, larger bore pipework, minimising flow restrictions and number of
bends);
−− designing and operating to avoid areas of rapid decompression which could cause
cavitation, and
−− adhering to design velocity limits (see Table I.13).
Table I.13: Examples of design velocity limits to prevent erosion-corrosion
Environment Materials Velocity limit (m/s)

Oxygenated seawater CuNI 90/10 2,5
Oxygenated seawater CuNI 70/30 3,0
Lean amine Carbon steel 3,0
Rich amine Carbon steel 1,0
281
+44 (0)207 467 7100
I.14.4 CHECK
I.14.4.1 Measure performance
I.14.4.1.1 Threat monitoring

Several monitoring techniques are available to either infer flow velocities or to identify if
solids are present in the system such as:
−− monitoring the accumulation of sand within production separators or sand
accumulators to determine when water-jetting or flushing needs to be undertaken
thermography;
−− process parameter monitoring, e.g. temperature, pressure, flowrate, and
−− sampling of sand particles to obtain sand particle size distribution.
I.14.4.1.2 Barrier monitoring

Several monitoring techniques are available to either detect the extent of degradation or to
identify if solids are present in the system. The following methods may be used in order to
determine if significant degradation has, or may have, occurred once susceptible areas of
pipework and plant have been identified:
−− intrusive erosion probe (electrical resistance);
−− acoustic sand monitor (either permanent or temporary);
−− corrosivity measurement, e.g. coupons and probes;
−− inspection (UT using either manual or fixed array transducers, radiography, visual):
– on the inside and outside of bends;
– around tees;
– around bore restrictions and expansions;
– on choke outlets;
– upstream and downstream of welded joints, and
– downstream of any component that could disturb the flow (e.g. flowmeters,
valves).
I.14.4.2 Investigating accident/incidents/near misses

As per section on incident investigation.
I.14.5 ACT
I.14.5.1.1 Remedial actions

Erosion can be controlled on an ongoing basis by comparing measured or calculated
internal pipework damage against tolerable values and then applying mitigating measures
accordingly.
Operational restrictions such as pressure restrictions and velocity limits may be placed
on the operating envelopes of individual wells or systems if the original design becomes
inadequate. Some operators require solids risk assessments using erosion modelling and
sand tests as part of the management of solids-producing wells. Limitations may be placed
on the tubing head pressure (THP) or the choke opening position and recorded in the well
operating guidelines (WOGL) in order to operate with tolerable erosion rates.
282
+44 (0)207 467 7100
Computational Fluid Dynamics flow simulation can be used to assess systems that are
close to acceptable limits, in highly-convoluted pipe sections and in geometrically complex
components such as valves. Ultimately it may be necessary to redesign and replace piping in
order to avoid or minimise future degradation by erosion or erosion-corrosion.

Regular reporting according to the requirement of the CMS can be useful
in understanding if erosion and erosion-corrosion management aspects
have been managed in accordance with Company Integrity Policy and Strategy so that the
risk of failure is ALARP. An example of reporting format is illustrated in Table I.14.
Where industry safety alerts (Step Change, HSE etc.) are issued their applicability to the
Company assets should be assessed and documented to demonstrate that the risk of
failure is ALARP. If necessary the Corrosion Control Scheme/Management Matrix should
be updated with the appropriate monitoring and mitigation to address the threat.
Table I.14: Example report format
Location: AssetName
Corrosion control Annual review of corrosion control scheme.
scheme review Comment on last update and reference/link and
state next planned update
Design envelope Scheduled analysis achieved or not for CO2, H2S,
mercury etc., pressure, temperature. Comment if
within acceptable parameters and required actions
if not
Fluids monitoring Scheduled ion analysis achieved or not and
comment on significance of any changes in Fe,
Mn, Cl− etc from fluid sampling, and any required
actions e.g. inhibitor suitability
Chemicals and Target dose rates achieved or not. Target corrosion
corrosion inhibition inhibitor residuals sampled for and achieved or
not. Comment if within acceptable parameters and
required actions if not
Monitoring retrieval Planned visits vs actual visits. Last site visit summary
and service visits of work executed and report reference
Corrosion and Summary of degradation rates from probes or

erosion monitoring coupons. Comment on whether monthly average
degradation rates degradation rates <0,1 mm/y and any daily average
degradation rates by exception Comment on days
nominally solids free by acoustic monitoring if used
Confirm availability of each associated monitoring
location stating tag number, location and
% availability
283
+44 (0)207 467 7100
Table I.14: Example report format (continued)
Location: asset name

Inspection findings Any new degradation related anomalies identified
through inspection and suspected cause of
degradation
Progress with planned vs actual inspection programme
Defined life repairs All defined life (temporary) repairs, installation dates
and anticipated permanent rectification dates
Fabric maintenance Progress with planned vs actual fabric maintenance

programme
Management of Comment if any corrosion control related MoCs

change raised and reference/link to them
Operational risk Comment if any corrosion control related ORAs

assessments raised or still open and reference/link to them
Failure analysis Comment if any failure analysis carried out and

if root cause identified. Refer to MyHSE case or
equivalent
Technical notes Comment on any technical notes related to
corrosion control have been raised for the asset and
reference/link to them
Risk-based inspection Comment if RBI updated or corrosion/erosion threat
assessments carried out and reference/link to them
Audits Comment if integrity management aspects have

been covered in recent audits and pertinent
information
I.15 BLACK DUST IN GAS PIPELINES
I.15.1 Introduction
Black powder (BP) formation is a long-standing problem in gas pipelines, which is related to
corrosion of uncoated carbon steel in the presence of water.
BP can accumulate during cleaning pig operations of dry gas lines and has the potential to
cause blockages.
Comprehensive field and laboratory testing has identified that the two sources are:
−− formation of BP in the carbon steel pipelines due to reaction between iron (Fe) with
condensed water containing one or more of: carbon dioxide (CO2), hydrogen sulfide
(H2S), oxygen, and
−− BP carryover from gas production and processing facilities the main constituents of
BP has been found to be either is iron oxide (FeO) or iron sulfide (FeS).
284
+44 (0)207 467 7100
FeO is found in the form of magnetite (Fe3O4). Goethite (α-FeO(OH)) is also present and a
small amount of lepidocrocite (γ -FeO(OH)), as well as iron carbonate (FeCO3). These are
common hydrated iron oxides that are found in corrosion products. Some BP samples have
been found to also contain mercury and radioactive Pb-210 and Po-210. Research has also
shown that BP is regenerative and is formed as a product of internal corrosion in the presence
of condensed water containing H2S, CO2 or oxygen.
BP particles are very hard and jagged, (see Figure I.62), which makes them erosive to pipeline
fittings and components particularly when accelerated, due to flow restrictions, inside
pressure control valves where they can severely erode valve trim cages as shown in Figure
I.63.
Figure I.62: Black powder particles
Figure I.63: Damaged trim cage of a PCV-710
285
+44 (0)207 467 7100
I.15.2 Black powder formation and sources
Table I.15 shows some BP corrosion compounds and their potential sources. In addition, FeS
is formed by the reaction of H2S with Fe.
Table I.15: Black powder corrosion compounds and their potential sources constituent
sources formation reaction
Constituent Sources Formation Reaction

Siderite-FeCO3 CO2 corrosion H2O + CO2 H2CO3
H2CO3 + Fe (pipe steel) FeCO3 + H2
Goethite-FeOOH Low dissolved O2 in Fe + H2O + O2 a, b or g -FeO(OH)
and water corrosion g -FeO(OH) + Fe Fe3O4 + H2O
Magnetite-Fe3O4
The main cause for the internal corrosion was determined to be the presence of condensed
water containing CO2, oxygen, and H2S. While CO2 and H2S are inherently part of the
processed gas, the source of oxygen is related to ingress from leaks at low pressure points
throughout the systems or because of maintenance activities. Studies indicated that oxygen
ingress even in ppb level could cause corrosion and subsequently BP formation in the
presence of condensed water. The source of the condensed water is related to inadequate
gas dehydration, which results in exceeding the maximum allowable level. Subsequently,
water potentially condenses on the inner walls of the pipeline due to high water dew point.
Condensed water, coupled with corrosive elements such as CO2, H2S and oxygen, even
in small amounts, as low as ppm levels, can result in internal corrosion and formation of
corrosion products (e.g. BP), namely: FeCO3, FeS and iron oxides.
The common chemical forms of FeS include pyrrhotite, troilite, mackinawite, pyrite and
marcasite, ferric sulfide, smythite and greigite. Pyrophoric FeS is formed in the gas stream
where H2S exceeds the concentration of oxygen. FeS in the chemical forms of mackinawite,
smythite and greigite are typical indicators of microbial activity in the gas pipeline.
Additionally the confirmation of SRB and acid producing bacteria (APB) in the pipeline
is a positive indication that microbial corrosion exists. The SRB microbes Clostridium and
Desulfovibrio deulfuricans consume sulfates and produce H2S. While APB microbes do not
produce H2S, they supply nutrients and provide hospitable environments for SRB to grow.
On way FeS results from SRB mediated corrosion would be during hydrotest and/or wet
lay-up, as corroborated by the presence of SRB activity. Sulfur, in its elemental form, is also
present in BP in small quantities. The origin of this sulfur is from the oxidation of FeS during
air-drying of the line.
286
+44 (0)207 467 7100
Figure I.64: BP accumulations in a metering station
Figure I.65: BP accumulation in a cyclo-filter
Figure I.66: BP sludge observed when scrapping gas line pipe
The formation of BP in the upstream production and transpiration facilities is inevitable,

due to the corrosive nature of the raw wet gas streams. Most of the raw gas streams include
287
+44 (0)207 467 7100
high CO2 and/or HS with wet environment in contact with CS piping and equipment. Most
of the formed BP is expected to be captured in the inlet slug catchers/filters and gas treating/
dehydration units. The captured solids including BP will end up in the process streams such
as water, condensate, amine and TEG. Efficient filtration of these streams is critical to avoid
any negative efficiency or reliability impacts for the associated process units. However, some
BP will uncontrollably pass through to the network with sales gas; no further corrosion can
occur if the line remains dry – i.e. with no free water present. There should be no ongoing
corrosion in the absence of process upsets and no ongoing accumulation of BP, other than
old material removed during pigging operations.
If, however, future process upsets give rise to free water, then there is a risk of reinitiation
of accelerated corrosion due to the presence of surface films containing wet elemental
sulfur in contact with dissolved H2S (from the production gas). In this instance, the corrosion
product would be FeS, rather than iron oxide.
I.15.3 PLAN
I.15.3.1 Policy
Primarily, regular pigging is required to remove the remaining elemental sulfur from the
pipeline.
If process upsets result in free water in an otherwise dry gas line, there is the threat of
initiation of accelerated corrosion due to the presence of surface films containing wet
elemental sulfur in contact with dissolved H2S (from the production gas).
Company's Integrity Policy and Strategy should therefore be to avoid such circumstances or
at least to keep the risk ALARP.
I.15.3.2 Planning
The CMS will indirectly address the prevention of damage by BP by considering the susceptibility
of all materials of construction to this threat and the expected production conditions.
I.15.4 DO

The BP collected during pigging is historical i.e. it has not resulted from corrosion events
that occurred during production and is largely comprised of surface mill scale. No further
corrosion can occur if the pipeline remains dry, i.e. if there are no process upsets.
However, the small amount of elemental sulfur in the powder suggests there may have
been MIC during the pre-commissioning stage and if future process upsets give rise to free
water, then there is a risk of reinitiation of accelerated corrosion due to wet sulfur.
All personnel involved should be made aware of the factors relating to BP and be vigilant to
recognise the indications of, or changes that are likely to result in, a corrosion threat.
288
+44 (0)207 467 7100

−− Facilities Operations teams;

The strategic plan should then be implemented to ensure risks are ALARP and that it is
undertaken in a cost-effective manner and such that the planned activities can be carried out
at the specified frequency.
I.15.5 CHECK


−− monitoring the temperature, pressure and the water vapour content of the process
gas to ensure the water dew point remains within specification;
−− completion of inspection and cleaning activities against plan and schedule.
The following can be used as a reactive (lagging) indicator:

−− monitoring free water content in the pipeline following upset process conditions.

Investigate the causes of the occurrence of incidents or accidents relating to BP in order to
reduce the likelihood of reoccurrence.
wider integrity management plan.
The RCA of any incident relating to BP or management system failures will be investigated
I.15.6 ACT

The overall performance review should include consideration of the performance targets. If
indicated, the strategic plan may require correction.

Any activity relating to the management of BP should be included in CMS audits.
289
+44 (0)207 467 7100
I.16 MERCURY CRACKING
I.16.1 Introduction
Mercury is a naturally occurring element found in trace quantities in most hydrocarbon

formations, therefore it can be present either as liquid or vapour in hydrocarbon production,
processing and transportation systems. Crude oil and condensate typically contain elemental
mercury (Hgº), inorganic mercury (e.g. HgS, HgSe, HgCl2) and organic mercury (e.g.
dialkyl mercury) compounds which undergo changes in their physical states and chemical
compositions as they go through the systems. In natural gas the dominant mercury species
is elemental mercury (Hgº).
Elemental mercury condenses to liquid upon cooling below its dew point, and can remain
in this state over a wide range of temperatures common to oil and gas production and
processing environments. The liquid is easily identifiable due to its unique silvery white colour
and is also known as quicksilver for its mobility.
Figure I.67: Mercury (symbol – Hg, atomic number – 80, atomic mass – 200.59)
Elemental mercury (hereinafter referred to as mercury or Hg) is the primary mercury species
responsible for damage to equipment. Mercury and its compounds are also toxic and present
environmental and health hazards, the impact of which is not within the remit of this
discussion. Even at its lowest concentrations, mercury can degrade certain materials, creating
potential risks to the integrity of the facilities. The principal degradation mechanism that
leads to failure is Mercury Liquid Metal Embrittlement (Hg-LME).
Hg-LME refers to either a loss of ductility of a solid metal or its fracture below the normal
yield stress due to intergranular penetration of liquid mercury. When liquid mercury diffuses
into the grain boundaries of a solid metal, the material loses its strength and ductility, and
intergranular cracking occurs. The crack surface is typically brittle in appearance and may
appear to have a coating or monolayer of mercury. It is not necessary for the solid metal to
be saturated in mercury and a very small amount (microgram) of liquid mercury is sufficient
to cause this effect in susceptible metals.
290
+44 (0)207 467 7100
The liquid mercury must be in direct contact with the bare metal surface, and a metal surface
with a uniform, adherent oxide layer may not experience any direct contact unless the oxide
layer is disrupted. Therefore, plastically deformed surfaces with fresh metal exposed or stress
raisers which lead to easy rupture of surface protective films are likely initiation points for
Hg-LME. Locations where the surface films are removed either by erosion or chemical action
which expose underlying metal, will also be affected.
Tests conducted by Case and McIntyre (NACE Corrosion 2010, paper 10294) confirmed that
the following materials common to the oil and gas industry, are immune to Hg-LME:
−− ASTM A516 Gr 70 carbon steel;
−− ASTM A193 Gr B7 alloy steel;
−− AISI 317 austenitic stainless steel;
−− AISI 410 martensitic stainless steel;
−− Alloy C-276 (UNS N10276), and
−− Commercially Pure Gr 2 Titanium.
Use of duplex stainless steels in mercury service has also been successful. Aluminium alloy
5083 and Monel alloy 400 (UNS N04400) showed significant embrittlement in these tests.
This agrees with reports of service failures of these alloys in mercury service. Other Nickel
based alloys without chromium, such as Nickel 200 (UNS N02200) and Monel K-500 (UNS
N05500) can also be susceptible. Failure of a ASTM A353 9 % Nickel steel storage tank was
recently reported and subsequent tests have revealed the susceptibility of A353 9 % Nickel
base metal and weld heat affected zones to Hg-LME (NACE Corrosion 2013, paper 2701).
Although pure titanium resists Hg-LME, titanium alloys with aluminium additions may also
show susceptibility under dynamic conditions.
With mercury embrittlement, there is little indication of crack branching or striation,

following crack nucleation, that would indicate slow crack propagation. Crack propagation
rates can be exceedingly rapid and fast crack growth rates of 10–100 cm/s have been
estimated from tests. The fast crack growth rate and the low activation energy for this type
of cracking are distinguishing features of Hg-LME compared to other types of cracking such
as chloride or SSCC.
General conditions for Hg-LME
Mercury can cause cracking, when in contact with the following alloys:
−− aluminium based alloys of all types;
−− copper based alloys of all types, and
−− nickel based alloys without chromium (Nickel 200, Monel 400 and Monel K-500).
On susceptible alloys, conditions for cracking are:

−− liquid mercury presence;
−− wetting of the bare metal surface by liquid mercury, and
−− mechanical, thermal or residual stress (note: stress is generally always present in
operating equipment/components).
Contact with solid (frozen) mercury has not been shown to produce any attack. Contact
with mercury vapour is normally not harmful unless condensation occurs.
291
+44 (0)207 467 7100
Figure I.68: Mercury emerging from crack on aluminium heat exchanger (cold box)
Figure I.69: Close-up of crack on storage tank floor plate showing mercury droplets
(centre)
Other key threats posed by mercury on metals are amalgamation and amalgam corrosion.
Amalgamation occurs when a solid metal dissolves to form a liquid solution with mercury.
Mercury only forms a liquid solution with specific metals, primarily: aluminium; tin; gold;
silver and zinc; of these, only aluminium has mechanical significance. The tightly adhering
aluminium oxide layer (Al2O3) formed when aluminium reacts with oxygen can protect the
metal from amalgamation. Where the aluminium oxide layer is breached, either by abrasion,
chemical attack, or thermal and mechanical strains, mercury can wet the underlying surface
and amalgamation can occur. The rate of amalgamation will depend on the microstructural
condition.
Susceptible alloys and welds can be severely affected. The result of amalgamation is a loss of
mechanical strength, particularly at welds where the grain boundary chemistry and residual
stress make this area more susceptible to attack than the base metal.
The first step in the amalgam corrosion process is the formation of an amalgam whereby a
solid metal, on contact with liquid mercury, dissolves into the liquid mercury. If water vapour
or liquid water is in contact with the amalgam, this can result in uniform surface attack or
localised pitting on the underlying metal. Amalgam corrosion only occurs at temperatures
where liquid water can exist and the process is self-propagating as long as water is available
and the mercury continues to wet the metal surface.
292
+44 (0)207 467 7100
All aluminium alloys are susceptible to amalgam corrosion to varying degrees under a wide
range of conditions. Amalgam corrosion only develops in the form of pits if the mercury
deposits are not continuous and liquid water is available. A feature of amalgam corrosion of
aluminium is the production of hydrated aluminium oxide and hydrogen corrosion products.
The reaction rate is extremely rapid with a rate of penetration in excess of 1 mm/y (NACE
Corrosion Survey Database). The hydrated aluminium oxide corrosion products are observed
to grow as filaments from the metal surface, appearing very dramatically and rapidly.
I.16.2 PLAN
I.16.2.1 Policy
Hg-LME and amalgam corrosion can cause catastrophic failure resulting in a process safety
incident e.g. hydrocarbon release, fire and explosion. Numerous incidents regarding these
failures have been reported worldwide and are available in the public domain. The Duty
Holder’s CMP and strategy should therefore be to avoid such failures or reduce the risk to
ALARP.
I.16.2.2 Planning
The first step in planning for the prevention of Hg-LME and amalgam corrosion in oil and
gas production, is to determine whether mercury is present in the process stream or whether
it may be present from future tie-ins or new wells coming online. A variety of techniques is
available for determination of mercury concentration in field samples including:
−− atomic fluorescence spectrometry;
−− gold film mercury detection, and
−− calorimetric analysis.
Quantifying the mercury levels, identifying and characterising the mercury species and
compounds, and the distribution across the process systems can be undertaken either on
a one-off basis, or as part of a longer-term monitoring programme. Common industry
standards for sampling and measurement of mercury concentration are:
−− ISO 6978-1 Natural gas – Determination of Mercury – Part 1: Sampling of Mercury
by chemisorption on Iodine.
−− ASTM D7623-10 Standard test method for total Mercury in crude oil using
combustion-Gold amalgamation and cold vapor atomic absorption method.
−− ASTM D7622-10 Standard test method for total Mercury in crude oil using combustion
and direct cold vapor atomic absorption method with Zeeman background correction.
−− ASTM D7482-15 Standard practice for sampling, storage, and handling of
hydrocarbons for Mercury analysis.
The sampling and analysis programme should be documented so that all involved fully
understand the requirements and expectations. It should have clearly stated objectives with
written definition of responsibilities through every step of the programme.
293
+44 (0)207 467 7100
I.16.3 DO

Most companies set a mercury limit of 0,01 µg/m3. Thus, corrosion risk assessments can
be undertaken if the measured concentration is above this limit. It should be carried out in
accordance with one or more of the following methodologies:
−− API RP 580 Risk based inspection;
−− DNV RP G101 Risk based inspection of offshore topsides static mechanical equipment,
and
−− NACE 10367 High level corrosion risk assessment methodology for oil and gas
production systems.
Focus should be on systems and components where mercury is likely to be present in the
liquid phase and where crack initiation and propagation may be encouraged by factors
such as stress, abrasive wear and chemical action. An estimate of the conditions at which
mercury vapour will condense to the liquid phase for varying mercury concentrations and
gas pressures, is available from published data. Computer models can also be used to predict
the formation of liquid mercury in a process facility and estimate the distribution of mercury
across the systems.
Significant quantities of mercury can be adsorbed onto the surface of metals from
the vapour phase and released when changes in conditions occur. Also, during trips,
shutdowns or upsets when the streams are cooled, mercury levels can reach the saturation
limit, resulting in coalescing of droplets to form a free elemental mercury phase. There
is indication that even a mono-atomic layer of mercury could cause Hg-LME in sensitive
materials, thus systems carrying only mercury vapour cannot be ignored, although they
might be assigned a lower priority in terms of action.
The probability of failure criteria, designed to determine likelihood of a component being

subject to mercury attack, is presented in Figure 88. The probability of failure and its
consequences on people and the environment should be calculated, to determine a risk
ranking which can be used to prioritise the allocation of resources to manage the threats.
Appropriate mitigation measures should be defined (depending on the consequence of
failure) to prevent Hg-LME and amalgam corrosion. These may include:
−− mercury removal from the process stream;
−− review of materials and replacement of susceptible components, and
−− inspection of critical areas where mercury precipitation is predicted or found.
294
+44 (0)207 467 7100
Upstream Liquid mercury

mercury removal deposition/
Mercury present
YES unit available NO condensation
in process
and meets anticipated or
stream or likely to
performance evidence of free
be present
specifications mercury present
NO YES
System/
equipment Material
operates under YES susceptible to
mercury attack YES
stress or history
of mercury or susceptibility
related attack unknown
NO
NO
NO YES
UNLIKELY MEDIUM HIGH LOW
Figure I.70: Example of probability assessment for mercury attack
Organisational roles that can be involved in managing this threat include:
−− Corrosion and Materials Specialist;
−− Process Engineer;
−− Mechanical Engineer;
−− Plant Operators, and
−− Inspection Engineer.
Communication activities should aim at increasing awareness of the degradation mechanism,

factors that contribute to it and mitigation requirements.

The deliverables from the CRAS will include mitigation, monitoring and inspection activities.
These require discussion on a regular basis to assess the results, monitor performance and
identify corrective actions or interventions. The activities include:
−− Mercury removal
Mercury removal systems are used to remove mercury to sufficiently low levels so
that condensation does not occur. Several commercially available technologies are
available for removing mercury and its compounds from hydrocarbons, many of
which are targeted at gas phase treatment. The most common is the chemisorption
technique using sulfur-impregnated carbon beds. Decision on whether to employ
mercury removal and which technique to implement is determined by the amount
of mercury in the stream, the metallurgy of the processing system and the product
specifications for mercury in the sales gas. Mercury removal units are required for
virtually all LNG plants because of the sensitivity of cryogenic heat exchanges to
295
+44 (0)207 467 7100
mercury deposition and because the low temperatures required to liquefy gas usually
condense mercury as well. The cryogenic heat exchanger is referred to as a cold box
and is typically manufactured from aluminum.
−− Review of materials and replacement of susceptible components
Detailed review of construction materials is required to ensure that no susceptible
alloy is present in the zones where mercury deposition is possible. Where there is no
information on the performance of an alloy in mercury service, it is recommended to
undertake the Hg-LME test programme in the laboratory to evaluate its susceptibility.
Common test methods are:
– constant load tests in liquid Hg, and
– slow strain rate tests in liquid Hg and Hg vapour
The safest approach, if mercury condensation is predicted in specific parts of the
facilities, is to remove any materials considered to be susceptible to attack and
replace with mercury tolerant materials.
−− Inspection of critical areas
The usual aim of inspection is to detect the onset of a corrosion process, or monitor
that the rate of attack is within a preset safe limit. The problem in considering
inspection as a means of monitoring Hg-LME is that the initiation phase is virtually
undetectable. After initiation, the propagation of attack is extremely rapid and does
not permit timely corrective action. For this reason, it is not considered possible to
inspect for Hg-LME on any component. Nevertheless, inspection is invaluable for
monitoring amalgam corrosion and to verify or refute predictions obtained from
computer models for liquid mercury presence.
I.16.4 CHECK

Inspection should be aimed at detecting signs of amalgam corrosion and presence
of liquid mercury. Target areas should be low points where elemental mercury can
condense and accumulate due to its high density. Because of the high density of mercury,
radiography has been used to locate deposits inside heat exchanger tubes. As Hg-LME is
a rapid cracking mechanism, it is not routine practice to inspect for this form of cracking.
Cracking would also be very isolated and hence difficult to find. Damage will appear
as brittle cracks and can only be confirmed through metallography by the presence of
intergranular cracks.
KPIs can be used for measuring the performance of mercury removal systems. Several
factors affect the efficiency of mercury removal systems and it is not uncommon for the
units to allow mercury deposition due to damage to the beds, feed composition changes,
presence of impurities, etc. Therefore, the mercury content upstream and downstream
of the removal unit should be monitored periodically. Once the bed becomes spent (i.e.
exhausted its capacity to remove mercury), it should be promptly taken out of service for
the adsorbent material to be removed and disposed of appropriately.

When corrosion anomalies and defects are identified during inspection activities in systems
where mercury is present, a detailed assessment should be performed to understand the
cause and take corrective action. The effectiveness of the mitigation measures should also
be reviewed. Failure by Hg-LME generally indicates that the material of construction is
susceptible to cracking in the operating environment. Occasionally it may be that Hg-LME
may have been caused by unexpected localised events (such as failure of the mercury
removal system) or upset conditions.
296
+44 (0)207 467 7100
Failures should be investigated to derive any information that may have more widespread
relevance to the remainder of the facility. The failure investigation should be aimed at not
only identifying the mechanism of failure but also the circumstances which led to the failure,
so that corrective actions can be implemented to prevent a recurrence.
I.16.5 ACT

−− periodic reviews of mitigation, monitoring and inspection outcomes;
−− review of performance measures;
−− RCA of anomalies and failures with appropriate corrective action recommendation,
and
−− capture and roll-out lessons learned.

in-house and, where appropriate, into the public domain to raise awareness of such issues.
I.17 CAISSON CORROSION
I.17.1 Introduction
In oil and gas industry applications, caissons are generally considered to be tubular
components which provide a means of conveyance between the sea and the platform
topside. Applications include: housing of pump strings utilised for lifting seawater; liquids/
solids disposal; hydrocarbon liquids separation/recovery and containment/protection of risers
and other assets. Depending on the application, caissons can be of substantial dimensions,
i.e. up to 1,5 m in diameter, 75 m in length and weighing up to 50 tonnes. Therefore
the consequences of failure in terms of dropped object damage to primary structure and
submerged assets such as pipelines can be severe.
297
+44 (0)207 467 7100
Figure I.71: Example image of offshore caissons in the atmospheric zone
The dominant degradation mechanisms affecting the risk of caisson failure are fatigue
cracking and internal corrosion63, 64, with operator respondents to a survey published by iicorr
in 200965 indicating that internal corrosion was the prevalent mode of failure. Additionally,
the two mechanisms can operate together, with corrosion exacerbating fatigue crack
propagation and influencing initiation by reducing the cross-sectional area or providing an
initiation feature, e.g. pits, preferential weld attack, etc.
The prevailing failure mode for caisson deadweight supports is through fatigue cracking in
the structural weld details; this is caused by the stress concentrations and the high cyclic
loading transferred though the deadweight support.
Figure I.72: Example of cracking propagating from a localised internal corrosion defect
Whilst some caisson designs have used polymer composites, superduplex stainless steel and
even titanium, the majority of caissons installed to date have been manufactured from CS.
Given the demanding conditions to which they are exposed both externally and internally,
298
+44 (0)207 467 7100
coupled with the potential consequences of failure and high cost of in situ remediation/
replacement, management of caisson corrosion in design and service is worthy of specific
focus.
I.17.2 Caisson types and specific corrosion threats
The external corrosion aspects are common across caisson types and can include atmospheric,
splash and submerged zones, with differing protection requirements based on exposure
severity and operating temperature. Many caissons will possess all three zones, whilst
some terminate in the atmospheric zone or, in the case of suction caissons, will be fully
subsea. Mitigation of external corrosion utilises the conventional options such as corrosion
allowance, organic/metallic coatings, CP etc. Other coating systems for enhanced corrosion
protection, fire protection or avoidance of marine growth accumulation, may be employed
in the splash zone. The mitigation of external corrosion is covered in more detail in I.11.
I.17.2.1 Disposal caissons

These are probably the most straightforward caisson forms, providing a means of disposal
for various waste stream types, including treated produced water, seawater from cooling
applications and treated drill cuttings. Disposal caissons are typically free from internals, but
can have some complexity in the number and size of branch connections for the various
waste stream sources, e.g. in a seawater cooling application.
Internal corrosion threats for disposal caissons arise from corrodent species in the aqueous
phase. For untreated seawater disposal, e.g. from a once-through cooling system, the severity
of conditions is governed primarily by the presence of oxygen, the temperature of the waste
stream, and the flowrate (velocity), especially if particulates in the form of sand and/or scale
exist in the flow.
For produced water disposal, dissolved acid gases may also be present, although the
concentration will typically be low given that the water will have experienced low pressure
separation upstream. Residual CI may also be present. Produced water disposal is becoming
less common as a result of environmental restrictions on hydrocarbon discharge and disposal
wells are often favoured for this requirement. It is worthy of note that an interface in a
produced water disposal caisson will exist, where warm, potentially high chloride, oxygen-free
formation water will commingle with aerated seawater to produce a localised environment
with significant corrosivity. Depending on flow conditions, such an environment also has the
potential for promoting MIC.
In CS caissons, the most frequently adopted mitigation technique is the application of an

internal lining as a physical barrier to the corrosive species. An additional mitigation in
the form of corrosion allowance is also common, although traditionally caisson thickness
is minimised for weight and cost. Lining is mainly in the form of an internally sprayed
liquid coating system of the type used for either splash zone or vessel lining service,
i.e. reinforced epoxies, vinyl esters, etc, at a DFT of ≥500 mm. For reasons of mass
requirements, consumption rate in warm flowing conditions, etc, internal CP is atypical
for disposal caissons. The integrity of the lining is therefore paramount and strict controls
are required during fabrication to ensure surface preparation and application standards
are achieved, and that the adhesion, thickness and holiday requirements are obtained.
The nature of the construction sequence for caissons often means that individual coated
sections are field/site welded into the structure in situ, in order to develop the full caisson
length. This presents a challenge for the internal coating of the field weld, in terms of access
299
+44 (0)207 467 7100
and quality control, and caisson failures due to omission of the coating in this area have
been experienced. One means of avoiding the need for localised coating application at field
welds is to use localised overlay of CRA; however, this construction method is to be used
with caution, as even where the CRA is coated to the maximum extent in order to avoid
adverse bimetallic interaction at holidays on the CS side, there remains a risk of localised
accelerated bimetallic corrosion if coating breakdown on the CS is experienced. This should
be reflected in the inspection strategy. Latterly, technology based on repair of buried water/
sewer systems has been developed to apply a more robust composite liner over the entire
caisson length, either in construction or remediation phases.
As discussed previously, other options for corrosion mitigation of disposal caissons include
the use of reinforced polymer composites and solid or clad CRAs. The former option requires
specific assessment of mechanical characteristics, including support arrangements, whilst
the latter is primarily a question of cost versus benefit, although some additional technical
challenges from the use of solid duplex stainless steel or titanium under external CP require
consideration.
I.17.2.2 Separator caissons

These caissons are used for the disposal of oily waters, e.g. hazardous drains fluids, where
the hydrocarbon phase is recovered by gravity separation and pumped back into the topside
liquids process. Separator caissons are comparable with produced water disposal caissons
in terms of internal corrosion threat and mitigation, but have two significant differences:
complexity of construction and flow characteristics.
These caissons are constructed with internal compartments, baffles, etc, to aid the
separation process. For CS caissons, this places an additional emphasis on the need
to ensure the internal barrier coating is fully continuous, particularly where the
construction sequence involves field welds. As with disposal caissons, there have been
separator caisson failures attributed to localised corrosion as a result of discontinuous
coating coverage. Other aspects of the design complexity are associated with the ability
to perform inspection on critical areas of the caisson and the pump itself, i.e. the potential
for mechanical damage, etc. These aspects are discussed further in the following sections.
300
+44 (0)207 467 7100
Vent
Oil Out
Open Solids/Closed
Drains Drains
L.A.T.
Splash Zone Pump

(-) 10’ - 8”
Solids/Closed
Drains
Open
Drains
Quiescent
Areas
Flowing
Zones
Sampler
Clean Water
Outlet
Figure I.73: Schematic diagram of a separator caisson, depicting the complex nature
of the internals
On the flow characteristics, whilst lower flow rates and semi-stagnant zones may be seen
as positive from a flow-assisted corrosion perspective in comparison with disposal caissons,
the nature of the fluid presents a high risk of MIC where coating is degraded or absent.
The combination of hydrocarbon nutrient source, commingled waters, oxygen and low
301
+44 (0)207 467 7100
flow are all clear contributors to an MIC risk, in addition to the corrosivity associated with
oxygenated warm waters. Whilst the use of a lining is the primary mitigation method
for the protection of CS caissons, biociding should be employed to control the
bacterial threat.
Figure I.74: Example of caisson perforation at the waterline/produced water interface
I.17.2.3 Pump caissons

These caissons house electric or diesel driven submersible pumps (and their associated
rising main and drive/hydraulic/chemical system) used to lift seawater for cooling, injection
or deluge service. The pump string is typically fabricated from alloys with some resistance to
corrosion in seawater, e.g. nickel aluminium bronze, cunifer and latterly duplex/superduplex
stainless steels. The pump intakes are typically sited around 15 to 25 m below LAT (lowest
astronomical tide), with the caisson terminating deeper in order to avoid intake of marine
growth, algae blooms, etc. In terms of corrosivity, oxygenated seawater is the principal
corrosive medium; however there are other contributory factors for degradation risk in this
type of caisson. Examples of such factors include: local pump intake turbulence; chlorination
for antifouling; electrical continuity with noble pump string materials, surface contact
(abrasion) and tight clearances around the pump/motor affecting CP current distribution
and the tight clearance between pump string centralisers and the internal diameter of the
caisson.
Figure I.75: Example of caisson perforation initiating at internal contact point
302
+44 (0)207 467 7100
As with other caisson types, the external corrosion threats and mitigation strategies are
common with general structure, so are not discussed further.
Power umbilical and

chemical lines
Rising main pipes
Pump (2 or 3 stages)
with anodes fitted
Centralisers
Suction strainer
(several sets)
Motor with anodes

fitted
Hypochlorite dosing
ring
Anti-fouling unit
(supported from motor)
Figure I.76: Schematic diagram of example seawater lift pump caisson, showing key
components
303
+44 (0)207 467 7100
For the internal surface of CS caissons, the two means of corrosion prevention are internal
coating and, where submerged, CP. CP is most typically applied in the form of sacrificial
anode bracelets/shells connected to the pump riser string and supported at the flanged
joints. It is essential that the continuity between the anode bracelet and the riser string is
confirmed during installation. Electrical continuity with the caisson is typically via the topside
riser connection to the structure and requires to be confirmed during commissioning.
The design of the CP system is required to achieve polarisation of both the pump string and
the caisson metallic surfaces. Due to the flow around the pump, the antifouling chlorination
and the mixture of materials of construction between the pump bowl, the pump string
and the caisson the conventional approaches to CP design, e.g. DNV RP-B401, have been
found to be inappropriate for the internal caisson, surface and riser string geometry and CP
modelling is suggested as a prudent approach to optimising design66. The CP design should
define a life expectation for the sacrificial anodes in order to plan for replacement in the
pump maintenance schedule, i.e. when the pump string is retrieved to surface.
One of the main issues with achieving protection of exposed caisson surface is the ability to
distribute ionic current through the seawater in the pump/caisson annulus to areas of tight
clearance, e.g. at the motor/pump67 The tendency in design is to maximise pump size for
performance considerations and minimise caisson diameter. The need to provide localised
sacrificial protection in this area is therefore highlighted.
304
+44 (0)207 467 7100
Figure I.77: Finite element CP analysis showing ineffective protection at the pump/
motor restriction67
In these restricted zones, lack of polarisation of both the CS and CRA surfaces can give
rise to unfavourable galvanic couples and accelerated corrosion. Furthermore, where the
caisson bore has been coated, this area is prone to localised damage due to contact with
the pump string (pump string centraliser contact is another potential source of damage),
which can exacerbate corrosion due to relative anode/cathode size. It is therefore good
practice to coat the pump string in order to minimise this effect (also to reduce anode
consumption) and some caisson designs do not use internal coating in the submerged
region to mitigate the risk of creating highly localised anodic surfaces on the caisson.
305
+44 (0)207 467 7100
Although not the subject of this section, a further consideration for CP is the risk of HISC
in duplex and superduplex stainless steel pump strings. The risk is mitigated using measures
recommended in DNV RP-F112, particularly coating of susceptible areas such as welds. Other
approaches, such as removing anodes or using low voltage anodes, introduce the risk of
accelerated consumption and/or underprotection of the caisson and pump string materials
which require protection, i.e. 22Cr duplex stainless steel.
As mentioned, there are other factors which can increase corrosivity for the caisson, particularly
in the pump intake area. Firstly, where there are turbulent conditions, additional mechanical
action and oxygen transport will be present. Secondly, where chlorination is employed for
anti-fouling purposes, the dosing requires to be controlled in order not to expose the caisson
to this additional oxidising species.
I.17.2.4 Riser caissons

These caissons will typically run from near the base of the structure and provide a means
of isolation of risers from environmental loads or heat transfer in the case of hot risers.
Riser caissons may also be used for cooling purposes where a cooling medium is circulated
through the riser to meet pipeline entry temperature limits. Where these caissons are sealed
by welding, the main corrosion concerns are for the riser in the event that the caisson
is breached and flooded due to external corrosion or fatigue cracking. In some cases,
contingency measures to protect the riser, e.g. external riser coating within the annulus, have
been implemented. As such, the main CM consideration for these caissons is to ensure that
the benign internal environment is maintained by preventing external failure. Conventional
mitigation methods such as CP and coatings suitable for the operating temperature are
employed.
306
+44 (0)207 467 7100
Figure I.78: Riser cooling caisson example
307
+44 (0)207 467 7100
I.17.3 PLAN
I.17.3.1 Policy
Caisson failure and the resultant risk of a large dropped object carries the potential for a
serious incident from damage to primary structure or pressurised systems. Other consequences
of caisson failure include downgraded situations in the event of loss of firewater capacity
or production impact from loss of cooling water disposal. Despite these highly significant
consequences, caisson failures are not uncommon in the oil and gas industry and the cost
of replacement of a failed caisson in situ can run into millions of pounds. The Duty Holder's
structural Integrity Management Policy should be to avoid such failures or reduce the risk
to ALARP.
I.17.3.2 Planning
The mitigation of caisson corrosion is strongly influenced by decisions made at the design
stage, where the details on materials, coatings, CP, etc, are decided. It is important that the
operator Materials and Corrosion Specialist be involved in the project design phase in order
to provide operational experience and ensure robust options are selected. Equally, it is crucial
that specifications and quality requirements are adhered to during fabrication, especially
where site welds are employed.
In the operational phase, the Duty Holder requires to implement corrosion mitigation
and inspection activities identified during the design stage and subsequent in-service risk
profiling, in order to minimise deterioration in service.
I.17.4 DO

The risk assessment is a fundamental aspect of caisson management. The following aspects
should be included in the assessment in order to ensure that criticality and priorities are
well understood:
Consequence of failure – the location of the caisson within the structure, potential trajectory
on failure and location of vulnerable pipelines/structure is the primary consideration.
Other considerations include the potential cost of replacement and the implications of
unavailability, e.g. for firewater, cooling water, etc.
Probable modes of failure – in some instances the mode of failure may be predictable
based on inspection findings, design review, etc, and inspection may be targeted to address
particular concerns, e.g. fatigue cracking at dead weight supports. The mode of failure will
naturally influence consequence of failure, i.e. failure above the dead weight support or at
the bottom of a lift caisson may have lesser consequences.
Construction details – risk assessment should make use of available information on the
caisson design and materials selection to identify any particular vulnerabilities in coating
integrity, CP coverage, contact damage from pump centralisers, etc.
Previous inspection findings – as with any risk based approach, the consideration of
previous equipment condition is a key aspect, particularly where coating repairs, structural
reinforcement or other modifications have been implemented.
Mitigation performance – review of the mitigation activity should be considered in the risk
assessment for operational assets. Examples of mitigation performance may include anode
change-out interval, CP monitoring where implemented and control of bacteria in disposal
caissons.
308
+44 (0)207 467 7100
Organisational roles that can be involved in managing caisson integrity include:
−− Structural Engineer/TA who typically has overall responsibility for caissons.
−− Corrosion and Materials Specialist in the design and operational review.
−− Inspection Engineers who work closely with the structural and corrosion engineers in
the inspection activity.
−− Process Engineers where active mitigation is employed, e.g. biociding of separator
caissons.
−− Mechanical Engineer for aspects related to lift pumps, e.g. planning for anode
bracelet replacements.
Communication activities should aim at increasing awareness of the potential degradation

mechanisms, factors that contribute to ensure mitigation requirements are well understood.

The deliverables from the CRAS will include mitigation, monitoring and inspection activities.
These require discussion on a periodic basis to assess the results, monitor performance and
identify corrective actions or interventions. The activities may include:
−− monitoring of anode wastage during periodic lift pump interventions;
−− monitoring of potentials in lift strings where permanent reference cells are installed,
and
−− control of chlorination levels to ensure effective biociding without increasing the
risk of corrosion exacerbation.
Implementation of the inspection regime developed, inspection activities may include

external rope access and ROV surveys to visually assess the caisson condition and level of
CP in submerged zones. Particular areas identified by risk profiling may also be subjected
to ultrasonic thickness checks, e.g. at weld locations, or crack detection by techniques such
as magnetic particle inspection or eddy current, e.g. at dead weight supports. Other, more
advanced, techniques such as long range UT may be utilised for more widespread thickness
checks. Internal inspection is generally conducted by specialist inspection contractors and
can involve both visual camera inspection and ultrasonic wall thickness checks. This requires
surface cleaning, for which care needs to be taken not to damage the internal caisson
lining. An extensive review of inspection of caissons was undertaken by the HOIS group68.
I.17.5 CHECK

Evaluation of the effectiveness of caisson CM involves review of both mitigation and
inspection activities. For mitigation, this includes aspects such as biociding treatments for
separator caissons and anode bracelet replacement for lift caissons.
Inspection results require to be reviewed as soon as possible after execution in order

to allow follow-up on anomalies and identify any repair requirements whilst access is
potentially available. In particular, the condition of historical repairs or external reinforcement
should be a subject of specific focus. Repair requirements can include: internal lining
reinstatement (where practicable); clamp installation; structural reinforcement; swagelining;
CP upgrade etc. Long-term, the results of performance monitoring will feed into the update
to the risk profile.
309
+44 (0)207 467 7100

Given the potential consequences of caisson failure, the investigation of anomalies and
failures is generally given a very high profile in the industry. The potential for analogous
conditions in other caissons operating in similar conditions should be considered and the risk
profile re-evaluated.
I.17.6 ACT

−− periodic reviews of mitigation, monitoring and inspection results;
−− RCA of anomalies and failures, with appropriate corrective action recommendation,
and
−− capture and roll-out specific lessons learned.

The results of investigations into failures, particularly unusual failures and those occurring in
circumstances where the caisson may not have been expected to fail, should be disseminated
within the operating company and, where possible, in the public domain so that lessons can
be learned by other operators.
I.18 HYDROGEN FAILURE MECHANISMS
I.18.1 Introduction
H0 is responsible for a number of damage mechanisms in a range of metallic materials.

Irrespective of the source of that hydrogen, when the hydrogen atoms enter a
metallic material they can diffuse harmlessly through the microstructure (as interstitial
atoms) or they can interact with trap sites. Trap sites include: grain boundaries; vacancies;
dislocations; inclusions and laminations.
The terminology of hydrogen damage mechanisms is inconsistent across industries and a

range of terms is used, often incorrectly.
By far the most damaging effect of hydrogen in structural materials is HE.

HE is caused by dilation of the steel lattice to accommodate the hydrogen
atoms. Materials susceptible to this phenomenon exhibit a marked decrease
in their energy absorption ability before fracture in the presence of H0, i.e.
they are embrittled. The degree of embrittlement is enhanced by slow strain rates
in the material and is maximal around room temperature, reducing significantly
above approximately 80 °C. Embrittled steel is at significant risk of mechanical
failure when loaded in tension; this is the essential mechanism of SSCC of carbon
and low alloy steels.
In ductile materials including austenitic stainless steels and aluminium alloys, no marked
embrittlement may occur, but there may still be a significant reduction in tensile ductility
(% elongation or % reduction in area).
Delayed brittle failure is a form of HE seen in high strength structural steels, titanium alloys
and aluminium alloys.
310
+44 (0)207 467 7100
H0 can react chemically with some metals, including titanium, forming brittle metal hydride
precipitates.
Hydrogen may also affect the plastic flow behaviour of metals which can reduce fatigue and
creep properties.
Cracking resulting from the precipitation of internal hydrogen 'fisheyes' in forgings, welds
and castings etc. is not addressed in this section.
High temperature hydrogen damage mechanisms are not addressed in this section. HTHA
(which affects steels operating at temperatures above ~400 °C in hydrogen environments)
is the result of hydrogen molecules dissociating, generating hydrogen atoms that dissolve
in the steel then react with the carbon in solution in the steel to form methane gas.
A number of processes are capable of generating H0 on the surface of metals. If sufficient

hydrogen enters the metal it has the potential to cause embrittlement.
Sources of H0 include:
−− Cathodic protection – some hydrogen is generated on the surface of the
protected component. Subsea equipment, buried pipelines, jacket structures etc.
are therefore potentially at risk. The risk for CS is largely a function of CP potential
and the strength/hardness of the steel. The protected material can be polarised
to a very negative potential in impressed current systems, whereas in sacrificial
anode systems it cannot be polarised further than the anode open circuit potential;
this can result in a requirement for potential limiting devices in such systems. In
duplex stainless steels this mechanism is termed HISC; the risk of HISC depends
on the potential applied by the CP, the microstructure of the steel (specifically
the austenite spacing), hardness and the strain condition. DNV Recommended
Practice RP-F112 provides guidance on the design of duplex stainless steel subsea
equipment exposed to CP. Titanium is also at risk from damage when cathodically
protected to potentials more negative than ~−0,85 VSCE.
−− Electroplating – hydrogen is evolved on the component being electroplated. Zinc
electroplated fasteners are at significant risk of HE therefore it is standard practice
to remove the H0 from high strength steel fasteners by a 'relief bake'. Sensitive
materials (i.e. high strength steels) can be embrittled by the H0 generated during
the pickling stage of the hot dip galvanising process and by that generated during
corrosion of the zinc in wet conditions.
−− Corrosion – H0 generated at the cathode can enter the corroding metal (e.g. CS
or martensitic stainless steel) and cause embrittlement. In sour service the risk of
embrittlement is enhanced because a sulfide surface film encourages a higher
proportion of the hydrogen to enter the steel; the presence of a sufficient tensile
stress can cause the embrittled steel to crack (SSC). In a lower strength/hardness
steel that hydrogen may instead cause blistering if it combines to form hydrogen
molecules at inclusions, laminations etc. Depending on the exact conditions, this
may be termed hydrogen blistering, HIC, SOHIC or SWC. When dissimilar metals
are in direct contact in a sour environment the H0 generated on the corroding (least
noble) metal can diffuse through to the more noble metal (even though it is not
corroding), causing it to become embrittled. Tensile stress can result in cracking,
this is termed hydrogen stress cracking (HSC) or 'galvanically induced HSC'. When
dissimilar metals are coupled together in a non-sour environment there is some
risk of hydrogen damage to the cathodic metal but in practice this seems to be
confined to that of hydride damage of titanium at temperatures above ~80 °C, the
hydrogen resulting from galvanic corrosion of steel pipework. (Note that hydride
311
+44 (0)207 467 7100
damage of titanium alloys also occurs when hydrogen is generated by corrosion

caused by hydrochloric acid, e.g. cleaning chemicals.)
−− Welding – sources of hydrogen include from moisture (in welding consumables)
and some electrode coatings including cellulosic (AWS 6010) rutile (AWS 6012
and 6013). That hydrogen can enter the metal causing hydrogen cracking, usually
after the weld has cooled to ambient temperature. The risk of hydrogen cracking
of welds depends on material composition, material thickness, joint type, electrode
composition and heat input. The risk of hydrogen cracking is controlled by preheat,
control of interpass temperatures and PWHT as appropriate.
−− Chemical charging – due to decomposition of some chemicals, e.g. formate brines
used as completion fluids.
Figure I.79: Hydrogen-induced stress corrosion cracking in a low-alloy (1 %Cr) steel

bolt
312
+44 (0)207 467 7100
Figure I.80: Hydrogen embrittlement fracture surface of an oven bolt due to

hydrogen pick-up during plating
−− High strength fasteners and chains – there have been numerous instances of high
strength bolting (any strength grade over 8) and chains (including mooring chains)
exposed to liquid water or atmospheric service. A recent high profile example is the
HE of tower anchor rods and seismic stabiliser rods (galvanised) on Oakland/San
Francisco Bay Bridge 69. These high strength steel components failed while being
loaded, but delayed cracking can also occur later in service. A number of crane
collapses have been attributed to the HE of connecting and slewing ring bolts.
−− Hub clamps – a 1″ diameter Vector 'Techlok' pipework clamp connector
catastrophically failed on an offshore production platform in December 2014,
causing a gas release70. Hydrogen generated during atmospheric corrosion of the
clamp caused the cracking of the steel which was 48–50 HRC, well above the
intended 22 HRC, due to poor control of heat treatment in the manufacturing
process.
I.18.2 PLAN
I.18.2.1 Policy
Hydrogen damage mechanisms can cause catastrophic failure of components such as:
pipelines; valves; fasteners; structural elements etc. fabricated from carbon and low alloy
steels; martensitic stainless steel; duplex stainless steel and titanium alloys. A company's
Integrity Policy and Strategy should therefore be to avoid such failures, or at least to keep
the risk ALARP.
I.18.2.2 Planning
The CMS will indirectly address the prevention of damage by hydrogen degradation by
considering the susceptibility of all materials of construction to these mechanisms.
313
+44 (0)207 467 7100
I.18.3 DO

The potential for hydrogen damage to susceptible materials should be assessed.

−− reviewing CP criteria and design details;
−− consideration of the mechanism in the materials selection process;
−− identification of mitigation measures where susceptible material is necessary for the
application;
−− imposing controls during processing and fabrication to limit detrimental effects on
hydrogen susceptibility;
−− conducting verification (batch identification and hardness) checking of fasteners
used for fabrication of components to be deployed subsea, and
−− consideration could be given to monitoring hydrogen flux in components, but it is
noted that this technology is not well developed for components such as fasteners.
I.18.3.2 Organising
That part of the Duty Holder which is responsible for managing corrosion risks should ensure
that hydrogen damage mechanisms are included in any Corrosion Threats Assessment
Studies that are conducted.

Material that is susceptible to hydrogen damage mechanism should be replaced if it is

to be exposed to an operating environment that will generate H0 and hence sustain that
mechanism. Alternatively, the operating conditions should be controlled so as to limit the
rate of hydrogen generation, for example control of the polarised potential of a structure
when impressed current CP is adopted.
I.18.4 CHECK

There are few measurement techniques available since the presence of HE in a material is
not necessarily apparent or predictable until a catastrophic failure occurs. It is not routine
practice to inspect for the resultant forms of cracking, hence the performance of material
selection as a corrosion control method is not normally measured. Inspection for cracking
could be conducted, but this is not likely to be cost-effective; the onset of cracking can be
rapid and isolated, hence difficult to find.
The design and material selection should be reviewed and the level of susceptibility fully
assessed and determined as specified in the Planning and Corrosion Management Strategy
Risk Profiling.
314
+44 (0)207 467 7100

process conditions.

−− frequency of HE failures detected and positively identified following an appropriate
investigation.

Investigation of in service failures can generate information that may reduce the likelihood
of recurrence.
I.18.5 ACT

The overall performance review should include consideration of the performance targets. If
indicated, the strategic plan may require correction.

315
+44 (0)207 467 7100
ANNEX J
MITIGATION OF OIL AND GAS PRODUCTION AND PROCESSING
CORROSION THREATS
J.1 CORROSION MITIGATION BY CHEMICAL TREATMENTS
This section addresses oilfield chemicals associated with corrosion control and flow assurance
control, including:
−− corrosion inhibition;
−− bacteria control;
−− scavenging (oxygen and hydrogen sulfide);
−− mothballing and preservation;
−− mineral scales control;
−− wax control;
−− pour point depressants;
−− asphaltene control;
−− drag reducers;
−− hydrate inhibition;
−− foam control;
−− flocculants;
−− crude oil dehydration/desalting, and
−− water quality or water clarification.
In general, oilfield chemicals can be applied continuously or intermittently and are injected
with pumps to overcome the system pressure.
The decision to implement batch or continuous injection should consider the following
factors:
−− Batch injection is implemented where downhole CI is required, but it is too difficult
or too expensive to install downhole chemical injection facilities for continuous
injection.
−− Bull heading is the only mode of application to protect all wetted surfaces from fluid
inflow into the well.
−− Batch is preferred for very long residence time vessels where the dose rate of
continuous injection would be impractically low.
−− In pipelines with stratified flow, the top of the line may only be protected by batch
treatment between pigs.
J.1.1 Continuous
Chemicals are usually injected continuously, either because this is required for process
control, as in the case of demulsifiers, or because it is the most cost-effective method of
application, as in most CI applications. For continuous application, the dose rate must
be optimised to satisfy the requirements of cost-effectiveness and to limit the impact of
secondary issues caused by the treatment e.g. high CI dose rate is known to cause oil/
316
+44 (0)207 467 7100
water emulsion problems which affect the oil/water separation and water quality. The
point of application must be upstream of the location at which the chemical is required
to act in flowing systems to ensure adequate mixing with the process fluids and optimum
effectiveness, and the pump system must be capable of accurately delivering relatively
small volumes correctly sized to deliver the required chemical volume for long periods at
process pressures.
J.1.2 Intermittent
Intermittent treatments are used where short-term high dose rates are required to obtain
the desired effects or where continuous treatment is impracticable e.g. some downhole
treatments, pipeline pigging, etc.
The intermittent types of application which may be used are:

−− batch;
−− slug;
−− mothballing operations (long-term preservation);
−− displacement (downhole), and
−− squeeze (downhole).
A batch treatment is where a very high dose rate (hundreds of ppm to percentages) is
applied for a limited period. A typical example could be the periodic dosing of biocides into
a system or for long-term corrosion and integrity protection during mothballing operations.
A special form of intermittent treatment is the batch treatment used downhole. The
chemical to be applied is used to displace the produced fluids from the tubing string into the
reservoir, leaving the batch treatment soaking the tubing string. After the soak period
(typically hours) the well is brought back on-line to push the chemical from the tubing string
and surface equipment, leaving a residual protective film. This method may be used to apply
CIs to protect tubing where there are no means of applying continuous injection.
Squeeze applications are used downhole to protect tubing and topside equipment. The
chemical is pumped via the tubing string into the formation. During the soak period it is
allowed to absorb or precipitate onto the rock and when the well is brought back into
production the scale inhibitor very slowly leeches back into the water as it is being produced,
effectively protecting the wellbore and tubing string. As a general guide, one third of the
chemical is permanently lost to the formation, a third is returned immediately the well goes
back on stream and the remaining third is returned over a long period to provide the action
required. The most widely used example of this application technique is the control of
downhole scale deposition using scale inhibitors, which are typically diluted to 10–20 % into
a suitable carrier brine (e.g. inhibited seawater) in the main treatment stage.
J.1.3 Delivery systems
Oilfield chemicals are invariably applied by accurately calibrated pumping systems or skids.
They should, as a minimum, comprise a pump which can deliver chemical at the required
rate and accuracy, a method of measuring the delivery rate of chemical and a chemical
storage tank adequately sized to carry enough chemical to be compatible with the logistics
of supply and distributions.
317
+44 (0)207 467 7100
Many oilfields chemicals, including some CIs, are very aggressive to materials in their neat
condition, therefore delivery system materials including injection quills, must be selected to
withstand those aggressive conditions.
J.1.4 Corrosion control and integrity management chemicals
J.1.4.1 Corrosion inhibitors

The purpose of CIs is to reduce the threat to plant integrity by controlling the degradation
processes.
The aim is to use the minimum concentrations to control and reduce corrosion to an
acceptable level, in line with the operating life of the facility. In a system it is not possible
to achieve 100 % inhibition of the internal pipework; typically, 95–99 % inhibition is more
realistic.
A typical continuous concentration range is 5–100 ppm, which, for a chemical having
solubility in all phases present, would be on total fluids. In the case of acidisation treatment
inhibition for well stimulations, the typical inhibitor concentration range would be 1–5 % of
the acid volume.
A number of alternative methods of treating oil/gas production wells also exist based on
intermittent batching of inhibitor into the well. Infrequent batching of large quantities of
inhibitor into the produced fluids, through a suitable downhole injection point, can produce
persistent filming.
J.1.4.2 Batch
Batch treating main oil lines and wet gas lines may be used to ensure good filming of the
metal surface, followed by continuous injection at a low level (5–10 ppm) to maintain and
repair the film. Batch treating is, however, generally used where continuous treatments
present technical difficulties. The CI should, where possible, be diluted in solvent for batch
treatments, downhole injection and gas lines.
J.1.4.3 Continuous
More than one application location may be required in order to compensate for depletion
of CI as the fluids move through the system.
Injection should be as far upstream as practicable, just upstream of a turbulent region (bend,
valve and pump) to ensure good mixing.
For protection of pipelines/transfer lines, injection should be downstream of the final process
oil/water separation stage if the separation process may be upset by the CI or high partition
losses to the separated water phase would occur.
CIs may also be applied to control corrosion in closed systems such as cooling/heating
medium systems. For instance, inorganic nitrite inhibitor may be added to cooling water. The
concentration is usually maintained at >1 000 ppm by adding measured volumes via a header
tank rather than via a pump skid.
The primary source of data for monitoring CI performance is from corrosion monitoring
devices such as coupons and/or probes. Corrosion monitoring provides the most rapid
information relating to the corrosivity of the fluids and therefore the effectiveness of the CI.
Corrosion monitoring data should be used to optimise the CI dose rate to give the specified
required corrosion rates, both for general and pitting corrosion. Corrosion coupons give
a historical integrated corrosion rate for the relatively long period that they were installed
318
+44 (0)207 467 7100
and therefore need to be correlated with the CI consumption for the same period. Where
suitable conditions exist, probes can be used to provide rapid data for much shorter periods,
or virtually instantaneously in the case of electrochemical devices.
CI residuals should be determined periodically by chemical analysis. This does not provide
information as to whether the CI is effective but it does indicate whether it is present at the
sample point at the specified minimum concentration.
Total and dissolved iron levels from the brine in a system that is treated with CI are useful
data to capture for trending purposes at a weekly frequency (refer to NACE SP0192-2012).
If production rates are steady a sharp increase in iron level in the brine could indicate that
accelerated corrosion is occurring.
Note that iron coming from the reservoir matrix (minerals such as siderite) can make it
appear there is more corrosion occurring. However, iron coming out of the steel from corrosion
can precipitate as solids lowering the iron count and make it appear there is less corrosion.
For CS pipelines the iron level can be correlated with manganese for corrosivity assessment.
J.1.4.4 Biocides
Biocides are usually applied as batch treatments sized to produce the maximum effectiveness,
unless it has been conclusively shown that low continuous dose rates are effective in
controlling bacterial activity. Batch treatments are designed for a short contact time (hours)
where the objective is to kill all of the organisms present.
The relationship between required contact time and biocide concentration is not linear
e.g. if 200 ppm for six hours is recommended, 400 ppm for three hours may not be effective.
If a biocide batching regime is proving to be ineffective when applying the same chemical,
e.g. on a weekly basis, a second biocide chemistry can be used in rotation with the first
chemical, i.e. biociding is still a weekly occurrence, but each chemical will be used fortnightly.
The advantage of this practise is the bacteria do not develop a resistance to one specific
biocide chemistry.
Continuous treatments are usually considered to be biostatic treatments designed to inhibit

microbial growth, as opposed to a kill dose. This carries the risk of inadequate dosing and
necessitates frequent changes of chemical type to prevent bacteria becoming resistant.
Monitoring the performance of biocides in oilfield process systems may be achieved by

monitoring microbiological activity (GHB, SRB and NRB).
J.1.4.5 Oxygen scavengers

Oxygen scavenger applications must allow for the reaction times required. The required
reaction times are dependent upon the scavenger type, the fluid temperature, pH,
composition and presence of other interfering chemical species. Site tests should be
performed with the selected oxygen scavenger (with catalyst if required) and system water to
give an indication of the required reaction times.
The dose rate is directly dependent upon the concentration of dissolved oxygen in the
system water, the performance of the deaerator tower and indirectly dependent upon the
available reaction time. Site tests should be performed to confirm the required dose rate.
A target of no more than 3,2 mg/l residual sulfite is desirable for removal of any increases in
oxygen levels from leaks.
Oxygen scavenger should be applied far enough upstream to allow adequate time for
the scavenging reactions. Where possible, potential sources of oxygen ingress should be
319
+44 (0)207 467 7100
eliminated to aid the scavenging process. Oxygen scavenger should not be applied at
locations where oxygen ingress would consume the available scavenger without the desired
effect of removing oxygen from the system fluids e.g. 'open' topped tanks.
The effectiveness of oxygen scavenging should be determined by measuring the oxygen

content of the water at the point of interest. The dissolved oxygen may be rapidly
determined with proprietary analysis kits, designed to measure the dissolved oxygen at
flowing sample points on the system. This method of measurement is particularly useful in
determining how far upstream the scavenger should be injected or how much scavenger
or catalyst should be injected. However it only provides 'snap shot' data and should be
regarded as a supplemental monitoring technique to be used in addition to an online
oxygen meter.
Corrosion monitoring results may give an indirect indication of the unwanted presence of
oxygen. Most organic CIs are ineffective in the presence of oxygen therefore a significant
increase in corrosion rate in the presence of CI, when all other related parameters are
unchanged, may indicate the presence of dissolved oxygen.
J.1.4.6 Hydrogen sulfide (H2S) scavengers

H2S scavengers can provide a cost-effective alternative to conventional gas/liquid sweetening
processes such as amine units or solid dry bed processes to prevent H2S corrosion. For gas
treating, the choice of an H2S removal process is based on economics. In those systems
where the level of H2S is <500 ppm, the use of scavengers is a good economic choice. If the
H2S concentration is >500 ppm there are likely to be other more economic choices. It is still
technically possible to use a scavenger to remove high concentrations of H2S and this may
be the best choice for a short-term need, especially if capital cost can be minimised through
continuous injection.
Scavengers can be applied via pipeline/downhole continuous injection using an atomiser, or

applied via a 'bubble tower' contactor.
Liquid scavengers, such as triazines may be injected directly into the gas stream through an
atomising quill. This ensures that there will be improved efficiency and further downstream
there will be a gas scrubber, which removes the unreacted triazine and the reaction
products. The use of aldehyde based scavengers is more common when treating crude oil
or multiphase lines.
J.1.4.7 Mothballing chemicals

The efficiency of protection offered to the asset by way of mothballing is highly dependent
on: the corrosivity of the environment; the degree of cleanliness of the metal surfaces;
the ability of the chemicals to form a corrosion protective film, the inhibition efficiency of
mothballing chemicals and factors that affect chemical persistency.
Vessels, piping and columns should be drained, purged and cleaned and all fluids and
associated debris from the piping should be removed by flushing.
Serious corrosion during water-filled out of service lay-up is a risk unless an effective chemical
treatment package is applied throughout all the wetted surfaces of the asset, and that the
package is dosed at the correct concentration. The risk is especially acute for out-of-service
periods in excess of 18 months because the greatest risk is MIC, mediated by SRB, which
require time to grow and proliferate in order to cause accelerated localised corrosion.
These concepts apply to extended wet lay-up of newly commissioned pipelines and
equipment, following hydrotest and pre-commissioning as well as mothballing of pre-
existing equipment.
320
+44 (0)207 467 7100
The following chemicals are typically used for CS applications:

−− biocide (bactericide);
−− oxygen scavenger, and
−− CI.
Incompatibility between oxygen scavenger and biocide is common, in which case oxygen
scavenger may have to be dosed with a contact time of several minutes in advance of biocide.
For stainless steels, including duplex steels, there is a severe risk from chloride-induced pitting
or crevice corrosion during wet lay-up in the presence of chloride-containing water, the
initiation of which may be 'microbially-assisted' by biofilms, especially SRB.
Oxygen scavenger should be added in addition to biocide for waters containing greater
than 250 mg/litre chloride, because these materials are marginal at best for high chloride
water under stagnant conditions, especially at susceptible welds. In theory, pitting or crevice
corrosion cannot propagate unless supported by the consumption of oxygen on the general
metal surface outside of the pits.
The use of a CI is not required and is of no value for high chloride water in contact with CRA
materials.
Very good control of biocide dosing is needed and the biocide must have proven long-term
effectiveness, otherwise the residual scavenger may 'feed' SRB.
J.1.5 Oilfield flow assurance chemicals
J.1.5.1 Scale inhibitors

If a risk of scale deposition is predicted (or known to exist from past experience), scale
inhibitors may be required. For example, scale inhibitors may be incorporated into drilling
muds, completion brines, and process water, continuous injection into production systems
and batch (squeeze) treatment of production wells.
The criteria which a good scale inhibitor must satisfy are:

−− it must be able to prevent the scale formation in question, irrespective of the
mechanisms operating;
−− it must be sufficiently stable for the specific application, and
−− it must not interfere with the action of other oilfield chemicals, nor be affected itself
by them.
In order to be effective, the chemical should be deployed correctly. For example, injection
of scale inhibitor into a production system must be upstream of the mixing location of
incompatible waters.
Even though scale inhibitors may be applied intermittently in the form of squeezes, sufficient
concentration must always be present in the fluids to prevent deposition of scales. In the
case of squeezes, large volumes of scale inhibitor are 'lost' initially, in order to ensure the
minimum required concentration after acceptable elapsed times, i.e. the concentration of
scale inhibitor with time is a logarithmic decay.
For continuous injection applications, more than one injection location may be required
to compensate for possible depletion of available scale inhibitor as the fluids move through
the system.
321
+44 (0)207 467 7100
Scale inhibitor performance is difficult to monitor in the field. The minimum concentration for
effectiveness in laboratory tests should have been determined during the selection process.
From this, a minimum concentration in the field brine should be specified.
Scale inhibitors are consumed by scaling mineral species and may also be consumed
through sequestering elements such as iron. Water samples should be taken and stabilised
appropriately at the furthest upstream location in the system where scale deposition must
be avoided.
Scale inhibitor consumption should be monitored in a similar manner to CIs.
Plant inspection records may provide historical evidence for scale inhibition. Visual examination
should reveal the presence or absence of scale deposits. Whenever pipework/plant is opened up
or replaced in systems protected by scale inhibitor, it should be examined and reported upon for
any presence of scales.
Samples of scale deposits may be removed for analysis to determine the scale composition.
Deposits can occasionally be contaminated with Low Specific Activity (LSA) scale, also
known as NORM (Naturally Occurring Radioactive Material). Prior to handling the solids,
the radiation level should be checked by a suitably qualified person using a Geiger counter.
Advice should be sought on the radiation level permissible for solids analysis.
Scale coupons can be exposed in a system to test for scaling indications in a similar manner
to strip corrosion coupons. The flat side contains several small holes of varying diameter to
induce turbulence. Scale build-up is assessed visually, i.e. they are useful for qualitative rather
than accurate quantitative evaluations.
J.1.5.2 Wax inhibitors

Wax inhibitors should be applied continuously via a dedicated chemical injection pump which
must be capable of delivering the relatively high volumes generally required for this type of
oilfield chemical.
The chemical injection location should be upstream of the point/temperature at which the
first wax crystals can form. An exception to this may be made if the primary mode of action
of the wax inhibitors is as a surfactant or dispersant and it is not practicable to apply the
chemical when the crude oil is above the cloud point (temperature at which wax deposition
first occurs).
Where wax inhibitors are deployed to prevent wax depositions in pipelines, wax inhibitor
performance may be indirectly monitored by recording the increase in required pumping
pressure or ∆P (friction losses) with time. Wax inhibitor performance in pipelines can also be
monitored by analysis of the solids contents of pig traps.
Wax inhibitors may also be used in conjunction with demulsifiers to alleviate dehydration
difficulties caused by precipitation of waxes when the crude temperature falls below the
cloud point. The wax inhibitor and demulsifier performance is then monitored indirectly by
separation efficiency.
J.1.5.3 Pour point depressant (PPD)

In order to be effective in controlling the yield stress in susceptible crude oils, the PPD
should be injected continuously via a dedicated chemical injection pump which is capable of
delivering the relatively high volumes required for this type of product, which may also be
very viscous and/or require heating to assist pumping.
322
+44 (0)207 467 7100
The PPD has to be present in the bulk crude at the required concentration at all times to reduce
the high pipeline pumping pressures and start-up problems following a shutdown, therefore
the injection point must be upstream of the point/temperature at which the first wax crystals
begin to form and upstream of the pipeline/flowline which contains the susceptible crude oil
(whichever is furthest upstream).
The prime performance indicator for PPDs is laboratory measurement of yield stress from oil
samples collected periodically from the pipeline of interest. It is also possible to measure the
pour point of the treated crude oil in a laboratory at site using the ASTM D5853 method.
J.1.5.4 Thermodynamic hydrate inhibitors

It is common to continuously add methanol or MEG to a wet gas line in order to prevent gas
hydrates forming. Alcohols and glycols change the solvating properties of the aqueous phase
by forming hydrogen bonds with water molecules making gas entrainment more difficult.
The hydrate formation temperature is lowered by about the same amount that the freezing
point of water would be reduced.
Methanol and ethylene glycol (MEG) are the main products deployed, and in order to be
effective they should be added continuously at concentrations typically 10–50 % based on
the aqueous phase. Alternatively they may be added as a slug dose to pipelines and wells at
start-up or prior to shut-in periods.
It is possible to monitor hydrate inhibitor performance by checking the pipeline differential

pressure.
J.1.5.5 Asphaltene inhibitors

Chemicals may be used to prevent asphaltene precipitation. The inhibitors should be injected
into the oil phase before asphaltene precipitation has taken place.
In downhole completion systems where capillary ('macaroni') tubing already exists continuous
injection may be possible.
Asphaltene inhibitors can be squeezed into the formation; however, these inhibitors are
necessarily oil soluble, resulting in a short functional lifetime for the inhibitor.
Where inhibitors are deployed to prevent asphaltene depositions in pipelines or wells,

asphaltene inhibitor performance can be indirectly monitored by recording the increase in
line pressure or differential pressure with time.
J.1.5.6 Drag reducers

Drag reducers must be applied via dedicated chemical injection pumps which are capable of
delivering the required volumes of this type of oilfield chemical, which may be viscous and
difficult to pump.
Injection must be at the beginning of the pipeline to achieve the required objective of
reducing friction losses.
The performance of drag reducers is monitored through pipeline pump pressure and flowrate
requirements.
323
+44 (0)207 467 7100
J.1.6 Oilfield process chemicals
J.1.6.1 Flocculants
The purpose of flocculants is to aid water filtration or the removal of oil from water (where
they are termed 'reverse demulsifiers'). They are often applied at low doses in conjunction
with other chemicals, immediately upstream of water filters or occasionally to oily water
treatment plant. For oily water treatment they must be applied after the primary separation
of oil and water so as not to interfere with that process and still be present at sufficient
concentration to perform the required function.
Flocculants are deployed to increase the efficiency of filtration operations. The only effective
method of monitoring their performance is to monitor the performance of the filtration
package of interest.
Three major analytical procedures are usually employed to determine filtration efficiency:
(a) particle counters;
(b) gravimetric/membrane techniques, and
(c) ViPA (visual process analyser).
These three techniques allow the percentage efficiency of particle removal of a certain size
to be determined as well as an overall solids removal efficiency (as defined by weight). Most
filtration performance specifications are designed on both number particle removal efficiency
and total weight solids removal.
J.1.6.2 Antifoams
The required mode of action for antifoams in oilfield operations is to prevent the formation
of foams and the removal of foams after they form, therefore the chemical should be
applied immediately upstream of the vessels to be treated to avoid the possibility of affecting
upstream processes. The required dose rates of effective antifoams are very low. Care must
be taken to avoid over-treatments which could stabilise the foams.
Antifoam performance can be rapidly monitored from separation process performance. Fall
off in performance can be immediately indicated by such as high level alarms caused by
liquids carryover into the gas system. Both the optimum dose rate is obtained and product
performance is monitored through observing separator performance.
J.1.6.3 Demulsifiers
Demulsifiers are usually applied continuously at relatively low treatment rates to assist the
efficient separation of oil and water. In some specialised applications, such as for the removal
of emulsion pads, which can develop in tanks, short-term batch treatments at relatively high
treatment rates may be deployed.
Demulsifiers should be injected as far upstream of the separation facilities as possible to give
maximum benefit.
Demulsifier performance directly affects the system process performance. Demulsifiers are
utilised to enable oil/water separation during both dehydration and desalting operations.
The efficiency of both operations is directly related to demulsifier performance.
Demulsifier optimisation and performance monitoring is achieved by measurements of

BS&W, salt in crude and oil in water quality exiting separators.
324
+44 (0)207 467 7100
J.1.6.4 Reverse demulsifiers

Reverse demulsifiers, including flocculants and flotation agents, are injected immediately
upstream of the effluent water treatment plant.
The performance of reverse demulsifiers is monitored rapidly and directly through their
effect on effluent water treatment plant performance. Reverse demulsifier performance is
monitored through oil-in-water results obtained from downstream samples.
There are several methods available for measuring oil-in-water, one of the most common
being infrared absorbance. Oil is extracted from the sample with a suitable solvent such
as Tetrachloroethylene (TTCE) or hexane and absorbance of infrared light compared to
standards.
J.2 MITIGATION BY ORGANIC COATINGS AND LININGS
J.2.1 Introduction
Coatings are a primary method of corrosion protection, predominately used for protection
against atmospheric external corrosion. They are also used for protection from seawater
corrosion subsea and from a wide range of environments internally in processing plant.
Reference should also be made to Guidelines for the management of coatings for external
corrosion protection.
Most coatings are applied as relatively thin films of organic resin materials containing finely
ground inorganic pigments and fillers conveyed in a solvent, either organic or aqueous. These
are usually applied in a number of functional coats – a primer, for surface tolerance and
corrosion inhibition, a build coat for thickness and a topcoat for appearance. From a practical
point of view these coatings are generally the easiest to apply by spray, brush, etc. Nearly all
coatings used for external atmospheric protection are of this type, as well as some subsea
and internal coatings.
Figure J.81: Spray painting a vessel externally (credit: International Paint)
Some coatings are solvent-free, applied by airless spray or trowel and used for more
demanding applications including many internal protection applications. The build thickness
is higher and usually only one or two coats are used. These types of coating can also be
applied hot in piping spools, but this is a shop process.
325
+44 (0)207 467 7100
Figure J.82: Airless spray unit coating pipe internally with solventless epoxy coating
There are many special coating types, often thick film. Pipelines traditionally used fibre
reinforced bitumen and coal tar based coatings, but now use a variety of shop-applied
multi-layer coatings that include, for example, fusion bonded epoxy and thermoplastic layers
(i.e. three layer polyolefins).
Figure J.83: Multilayer pipeline coating – fusion bonded epoxy, copolymer adhesive
and polypropylene
The chief causes of coating/elastomeric wrap deterioration are:

−− Water transport through the film, by osmosis, causing under-rusting and blistering,
counteracted by film thickness, resin type, filler properties and surface cleanliness
after preparation.
−− UV component of sunlight breaking down the organic resin base, counteracted by
pigments or resistant topcoat binder system, e.g. polyurethane.
−− Chemical or solvent action attacking the resin base and pigments, counteracted by
appropriate choice of resin, pigment and fillers.
Important issues in coating application are:

−− Application conditions – surface preparation and coating application in a shop
or controlled habitat environment normally gives a superior quality result. Special
attention needs to be given to quality control and inspection of unavoidable field
joint coating.
326
+44 (0)207 467 7100
−− Surface preparation to remove contaminants and provide a key for coating adhesion.
Grit blasting, if acceptable, is much better than power and hand tool methods.
−− Design to avoid sharp edges, rough areas (e.g. weld caps) and difficult to reach
places where film thickness may not be achieved. Additional (stripe) coats are typically
required for such geometric features.
Further considerations for coatings are:

−− Appearance may be as important as protective qualities.
−− They are used subsea, and sometimes internally, in conjunction with CP. This allows
a low level of coating defects, but requires coating types tolerant to the higher pH
conditions at the cathodic surface and with good adhesion characteristics.
−− Some coatings are used as fireproofing. They are generally thicker film coatings
formulated for the role but still need to provide corrosion protection.
J.2.2 PLAN
J.2.2.1 Policy
Safety, environmental and commercial policies influence the choice of strategies for
mitigation and monitoring/inspection. Coating strategy depends mainly on the required life
and life cycle costing, which may be determined during the design phase.
J.2.2.2 Planning
Surface preparation and coating of all types needs careful quality control with attention to:
−− surface finish and cleanliness;
−− prepared surface profile;
−− paint film thickness;
−− curing and intercoat times, and
−− temperature and humidity conditions.
Blast cleaning provides the best surface preparation results, but in the operational phase this
may give rise to unacceptable contamination of plant areas and ignition hazards. Solvent
based materials may be a hazard. HP water blasting or hand tool preparation may be used
for preparation and water based paints for coating. However, both produce an inferior
coating life.
For accessible external coatings, the coating's maintenance is a 'high ticket' item in
maintenance budgets. The initial strategy may attempt to find an optimum between the
initial coating quality and cost and the coating maintenance costs that follow. Subsequent
maintenance strategy is generally one of the following:
−− Reactive maintenance following reports from inspection or coating condition survey.
Works where items are readily accessible, e.g. onshore plant and manned topsides.
−− A planned programme based on survey and prediction of coating breakdown. This is
better for inaccessible areas, e.g. splash zones and unmanned platforms.
−− Substrate condition monitoring, then coating maintenance only if metal loss trends
towards the limit for the planned item life. Requires engineering assessment of the
coated item, which is outside the scope of this section, but is considered in more
detail in I.11.
327
+44 (0)207 467 7100
−− Repair or replacement of the coated item if metal loss exceeds the limit, without
coating maintenance. Requires engineering assessment of the coated item, which is
outside the scope of this section, but is considered in more detail in AI.11.
Maintenance strategy needs to take account of operational restrictions for surface preparation
and painting when choosing methods and materials. This includes consideration of damage
to, and contamination of, plant areas, difficulties working on hot plant, ignition hazards, etc.
Normally inaccessible internal and subsea coatings will initially be chosen on lifetime
considerations. Coatings on subsea structures and pipelines are never replaced. Internal
coatings in vessels and tanks can be replaced at shutdown, but the lost revenue penalties
and cost of installing a high quality coating need to be taken into account in the life cycle
cost.
In-service inspection and survey of coating condition is normally visual.
J.2.3 DO
J.2.3.1 Risk profiling

CRAS should always take account of potential coating performance, which can be obtained
from trial data and service experience. Reviews of the assessment should take into account
the coating condition and its likely remaining protective life.
Corrosion mitigation by coatings will feature in the CMS plan matrix alongside:
−− performance targets, usually in terms of coating breakdown;
−− monitoring by visual survey and survey frequency;
−− action required on non-conformance, and
−− organisational responsibilities for mitigation, monitoring and remedial action.
Tactical plans may jointly cover activities relating to other corrosion threats. There are some
proprietary database driven risk based methodologies for coating maintenance programme
planning.

−− coating maintenance programmes, which may be risk based;
−− planned maintenance routines, e.g. for coating maintenance;
−− coating survey work packs, covering responsibilities, coordination, procedures, scope,
anomaly criteria and reporting requirements;
−− coating survey elements in subsea inspection work packs for structures, pipelines and
manifolds, and
−− coating work packs, covering responsibilities, coordination, specifications, scope,
quality control and reporting requirements.
Specific monitoring and inspection methods are generally confined to visual inspection.
Subsea, this will normally be by ROVs. For coating above water, Annex K, in BS EN ISO
12944-8 could be used for the measurement of coating deterioration.
Coating performance is dependent on a large range of factors. Judgement is required in

adopting appropriate values.
328
+44 (0)207 467 7100
The CM strategic plan may be part of a wider Integrity Management Plan. For offshore
installations the strategic plan should be in line.
J.2.3.2 Organisation
The organisational roles that can be involved include:
(a) Corrosion and Materials Specialists;
(b) Coating Materials Suppliers and applicators;
(c) specialist contractors for coating maintenance planning;
(d) Facilities Maintenance Teams;
(e) subsea inspection teams;
(f) Inspection Engineers;
(g) Coating Inspection Technicians.
Those taking on the roles of (a) and (c) lead on risk assessment, planning and analysis; (d)
leads on mitigation implementation with support from (b), (e)., (f) and (g). who also takes a
lead on coating condition surveys.
Either specialist personnel or the inspection team may engage in coating condition
evaluation, but in either case appropriate training should be provided. The coating
maintenance planning contractors may provide condition evaluation training.

(a) factors that influence coating deterioration;
(b) consistent reporting standards for coating breakdown (see J.2.6), and
(c) the importance of having a sound strategy for coatings maintenance.
The main factors influencing coating deterioration are location and temperature. Coating
breakdown may look bad, but may not need urgent action unless it has led to serious
corrosion loss.
J.2.3.3 Implementing the plan

Implementation of maintenance coating and coating survey should be carried out in
accordance with plan and work packs. Data should be reported:
(a) date and scope of coating completed together with QC data, and
(b) condition survey data relating to coating condition as an estimate of the extent of
deterioration71.
Data relating to external atmospheric CM are analysed in two stages:

(a) Coating condition performance target to determine need for coating maintenance
scheduling.
(b) Analysis of all the data, usually by the corrosion engineer, is to ensure that the
strategic plan objectives are met and the CRAS and tactical plans are amended if
necessary. Specialist contractors will update the coating maintenance programme
on the basis of the maintenance work carried out and the coating survey data.
329
+44 (0)207 467 7100
J.2.4 CHECK
J.2.4.1 Measuring performance

The strategic plan should give performance targets for coating deterioration limits, topside,
onshore and subsea.

(a) completion of coating maintenance against plan;
(b) amount of coating breakdown in excess of deterioration limit, and
(c) completion of coating survey against plan and schedule.
Where (b) and (c) only, for subsea coatings.
Breakdown of coating vs. expected life, however, can be used as a reactive (lagging) indicator.
J.2.4.2 Investigating accidents/incidents/near misses

The contribution of protective coatings or protective coating management in relation to

failures will be investigated with the appropriate corrective action(s) recommendation.
J.2.5 ACT
J.2.5.1 Reviewing performance

(a) Annual (and if appropriate quarterly) reviews of coating maintenance and survey and
the achievement of performance targets. Corrective action for these programmes if
indicated.
(b) Review of performance measures, in particular the assessment of reactive indicators
and planning if indicated.
(c) RCA of early coating failures or management system failures with appropriate
(d) Overall review of (a.), (b.) and (c.) together with verification findings for offshore
installations and audit results; corrective action in strategy if indicated.
Particular attention should be paid to any shortfall in meeting performance targets or

measures and related backlogs in coating maintenance and survey activity. The relationship
to budget and resource constraints should be examined. The advice of the ICP should be
taken in relation to SCEs.
J.2.5.2 Learning lessons

Activity for the management of coating maintenance and survey should be included in CMS
audits.
330
+44 (0)207 467 7100
J.2.6 Additional information coating deterioration guidelines
Assessment of the coating condition72 can be carried out using Annex K in BS EN ISO 12944-8.
The following criteria are suggested to establish the recommended action.
Table J.1: Degree of rusting
Degree of Degree of Degree of Degree of Recommended

rusting blistering flaking cracking (BS action
(BS EN ISO (BS EN ISO (BS EN ISO EN ISO 4628
4628 part 3) 4628 part 2) 4628 part 5) part 4)
Ri5 Density 5 5(S5)b 5(S5)c Maintenance painting
required immediately
Ri4 Density 4 4(S4)b 4(S4)c Maintenance painting
required in current/
next annual plan
Ri3 Density 3 3(S3)b 3(S3)c Plan next survey
to occur before
deterioration exceeds
Ri4
Ri2 Density 2 2(S2)a 3(S3)b Survey at intervals
related to expected
deterioration rate
Notes:
(a) Normally only the degree of rusting is relevant to corrosion loss resulting from coating
deterioration.
(b) 'Degree of rusting' is a measure of the extent of coating breakdown and not a
measure of metal loss. However, at Ri5 coating breakdown will have advanced to a
degree at which metal loss may be expected.
(c) For items sensitive to metal loss it is advisable to trend coating deterioration and
forecast when Ri4 may be reached and plan in advance for coating maintenance that
avoids corrosion loss of the substrate metal.
See I.11 for more information.
J.3 CORROSION MITIGATION BY CORROSION RESISTANT ALLOYS
J.3.1 Introduction
A range of CRAs is in widespread use in the oilfield.
There is no standardised definition of CRA. For the purposes of this document, a CRA is a
metallic material that is resistant to general and localised corrosion by oilfield environments
that are corrosive to CSs. This definition is in line with those adopted by NACE MR0175 and
ISO 21457.
331
+44 (0)207 467 7100
In practice, the term CRA covers stainless steels and alloys of nickel, copper, titanium and
cobalt. It excludes low alloy steels but includes some highly alloyed steels such as 9Cr-1Mo.
CRAs that do not find widespread use in process or utility systems in the oilfield include alloys
of aluminium, zinc and tin. Aluminium alloys are used for some structural applications, but
selection of a suitable grade is critical for successful service in offshore, marine and coastal
environments.
Table J.2: Applications of corrosion resistant alloys
Category Common UNS Example usage

designation number
Titanium alloys Grade 2 R50400 Seawater coolers, sodium hypochlorite
pump and piping
Nickel alloys Alloy 28 N08028 Vessels, piping
Nickel alloys Alloy 625 N06625 Xmas trees, wellhead valves, vessels and
piping (process fluids), heat exchangers,
seawater coolers, fasteners
Nickel alloys Alloy 718 N07718 Valve components, seal rings, fasteners,
xmas trees
Nickel alloys Alloy 825 N08825 Vessels and piping (process fluids), heat
exchangers
Cobalt alloys Stellite 6 R30006 Valve seats and hard-facing
Cobalt alloys Elgiloy R30003 Valve spring
Nickel cobalt Nimonic R30035 High strength fasteners, springs, pump
alloys MP35N drive shafts
Nickel copper Monel K500 N05500 Fasteners, pump shafts
alloys
Nickel copper Monel 400 N04400 Seawater handling
alloys
Copper Copper C12200 Fresh water
Copper alloys Nickel C95800 Pumps and valves (seawater and water
aluminium injection)
bronze
Superduplex 25 %Cr S32750, Vessels, pumps, valves and piping
stainless steel S32760 (seawater, process fluids), heat
exchangers, instrument tubing, chemical
injection, xmas trees, fasteners, seawater
strainers, fire mains, water injection pump
Superaustenitic 6 %Mo S31254 Vessels, pumps, valves and piping
stainless steel (seawater, process fluids), heat
exchangers
Superaustenitic 904L N08904 Vessels, piping
stainless steel
Duplex 22 %Cr S32205, Vessels, piping, pumps (fresh water,
stainless steel S31803 chemical injection)
332
+44 (0)207 467 7100
Table J.2: Applications of corrosion resistant alloys (continued)
Category Common UNS Example usage

designation number
Lean duplex S32003, Flexible pipe carcass, blast walls, pipe
stainless steel S32101 supports
Austenitic 316L S31603 Vessels, pumps and valves (process fluids,
stainless steels etc. produced water), heat exchangers,
glycol system, (amin?), piping (process
fluids, flare, instrument air, lubrication,
fresh water, flexible carcass), instrument
tubing, closed circuit cooling system, air
cooled heat exchanger, utilities, inhibitor
and chemical storage and injection
Austenitic 304 S30400 Not commonly used
stainless steels etc.
Martensitic F6NM/ S41500/ Xmas trees
stainless steels CA6NM J91540
Precipitation 17-4PH S17400 Valve stems
hardened
martensitic
stainless steels
The selection of CRAs is usually justified by considering life cycle costing, i.e. when the higher
CAPEX cost of their purchase at the fabrication stage reduces the OPEX costs associated with
the corrosion control options (inhibition, coatings, inspection etc.) required to achieve the
same service life with CS.
Depending on a number of factors, including the diameter of pipelines and pipework, the size
and pressure rating of vessels, the complexity of the manufacturing process (number of branches
and hence welds) etc., it can be most economic to use CRAs in the form of cladding or overlay
on a CS substrate, rather than in solid form. The strength of the product is provided by the steel
substrate; many CRAs are of lower yield strength than carbon steel, especially when used in the
solution annealed condition as is often the case for sour environments. Typically, a minimum
thickness of 2 or 3 mm of CRA is present; this layer provides the required corrosion resistance
for the service environment incorporating a safety margin against under-thickness, defects in,
and mechanical damage to, the CRA layer etc. CRAs commonly used in the form of cladding
include type 316L stainless steel, Alloy 625 and Alloy 825. External corrosion protection of the
steel substrate is typically provided by conventional anti-corrosion coatings, plus CP in the case of
buried or subsea equipment.
Plate steel can be purchased in clad form; the item of equipment (typically a vessel or larger
diameter pipeline) is then fabricated from that plate. The clad plate itself is manufactured
by roll bonding and explosive methods. The more common roll bonding involves hot rolling
CRA plate with the CS plate; diffusion of atoms across the interface creates a metallurgical
bond. Explosive bonding involves detonating an explosion in such a way as to force the CRA
and CS plates together; this causes deformation of the surfaces of both layers, creating a
mechanical bond.
333
+44 (0)207 467 7100
Seamless piping and smaller diameter pipelines (up to ~12–14") typically employ CRA cladding
or lining. Clad piping is made by thermo-mechanically processing (essentially extruding) a
CRA pipe within a CS pipe to achieve a metallurgical bond between the components. Lined
pipe is manufactured by inserting a CRA liner into the pre-heated CS pipe then hydraulically
expanding it but this produces limited bonding. Some CRAs, including 904L austenitic stainless
steel, can only be used in the form of lining or roll cladding because they are susceptible to
deleterious metallurgical changes if heated to the temperatures required for heat treatment
of the CS pipe when this is part of the cladding process.
A further technique is weld metal overlay. The CRA is deposited onto the CS substrate by
a welding process. This can be used for the fabrication of pipe but with obvious limitations
of geometry. It is used for strip cladding CS vessels after manufacture. Most commonly this
technique is used in the manufacture of discrete items such as valves; Alloy 625 is widely
used for Christmas tree valves.
The selection of CRAs can also be justified by their contribution to reducing the likelihood
of in-service failure (due to corrosion), particularly where the consequence of that failure is
severe in terms of safety, the resultant loss of production or environmental damage. However
,the process for justifying the selection of CRAs for this reason is complicated because the
limits of operation of each alloy (in terms of temperature, chloride content, pH etc.) are not
fully established for some grades. Where corrosion data are unavailable, and the engineer
considers it beneficial, application-specific qualification testing may be undertaken. One
consequence of this incomplete knowledge is that incorrect alloy selection can result in a more
rapid failure (e.g. through pitting corrosion) than CS would suffer in the same environment
through general corrosion. This problem is compounded by the difficulty in inspecting for
localised corrosion and SCC. More often, these issues probably result in conservatism in the
selection process, which in turn wastes money and the earth's resources.
Some CRAs can be susceptible to external corrosion and SCC in the marine atmosphere
and some industrial atmospheres. The oxidising nature of the external environment can
result in it being more corrosive than the (usually reducing) process environment. External
degradation is not visible on thermally insulated equipment but it can lead to catastrophic
failure.
The correct selection of CRAs for specific operating conditions normally considers the
following points:
−− The corrosion resistance of most CRAs is provided by a thin passive film (Cr2O3-rich
oxide film in the case of stainless steels). While that film is completely intact the
general corrosion rate is essentially nil (typically of the order of microns per year),
therefore no corrosion allowance is included in the design of items fabricated from
these materials.
−− In some circumstances the passive film can be completely removed from the
metal surface. Environments that can remove the passive film include strong acids
(therefore care is required to minimise exposure to well stimulation acids and
certain acid cleaning/descaling solutions), very strong alkalis and strongly oxidising
conditions. When the passive film is lost, general corrosion rates can be very high,
typically of the order of those on CS in the same environment.
−− Of greatest concern is the partial loss of the passive film from the metal surface. This
is most frequently due to the presence of chloride ions in the process stream and is
exacerbated by either oxidising conditions (including oxygen and chlorine) or reduced
sulfur species (sulfide, thiosulfate etc.). In these conditions CRAs become susceptible
to localised corrosion (pitting and crevice corrosion) and SCC mechanisms.
334
+44 (0)207 467 7100
Non-normal operation (including commissioning and upset conditions) can initiate localised
corrosion that then continues to propagate in normal operating conditions. Common
problems include leak testing (hydrotesting with water not meeting strict levels of cleanliness
or that is extended for unforeseen reasons can result in MIC), brief temperature excursions
(e.g. when the flow of cooling water to a heat exchanger is interrupted) and the ingress of
oxygen (at faulty pump seals or when a vessel is opened for inspection).
J.3.2 PLAN
J.3.2.1 Policy
Localised corrosion mechanisms tend to result in leak before break failures. However SCC can
cause catastrophic failure of components such as pipelines, valves, fasteners etc. fabricated
from CRAs. Additional failure modes apply to CRA clad and lined components. Company's
Integrity Policy and Strategy should therefore be to avoid such failures or at least to keep the
risk ALARP.
J.3.2.2 Planning
The CMS will indirectly address the risks associated with the use of CRAs and mandate the
use of appropriate inspection techniques to detect degradation by all the mechanisms to
which they are susceptible in normal operation, commissioning and upset conditions.
The American Society for Testing Materials (ASTM73) has a range of test methods for
determining the resistance of metals to: SCC; pitting corrosion; crevice corrosion; weldments.
J.3.3 DO

The potential for localised corrosion and SCC should be assessed for all CRAs in use. This
should include external (atmospheric, subsea etc.) as well as internal (process and utility
stream) conditions.

−− reviewing the selection criteria, i.e. whether the material is near its corrosion limit in
normal operation or during worst anticipated upset condition, and
−− conducting PIM to verify that the correct alloy is in place.
J.3.3.2 Organising
That part of the Duty Holder which is responsible for managing corrosion risks should
ensure that the risks associated with CRAs are fully addressed in any Corrosion Threats
Assessment Studies that are conducted.

CRAs in use in environments (normal operating or upset) in which they are susceptible to
SCC or a high rate of localised corrosion should be replaced if the consequence of failure in
service is severe and/or if the operator cannot be confident that the inspection programme in
place will provide early warning of degradation.
335
+44 (0)207 467 7100
J.3.4 CHECK

Ensure that the level of susceptibility to localised corrosion and SCC has been fully determined
and assessed for all CRA materials as specified in the CMS risk profiling. The appropriate
inspection techniques to detect degradation by all the mechanisms to which they are
susceptible are deployed in normal operation, commissioning and upset conditions at the
specified intervals or when appropriate.

process conditions.

−− frequency of CRA failures detected and the failure mechanism positively identified
following an appropriate investigation.

Investigation of in-service failures can generate information that may reduce the likelihood
of recurrence.
The failure in service of a CRA could indicate a more widespread problem such as:
−− incorrect material selection for a stream;
−− the use of defective material for fabrication;
−− inadequate QA procedures or material identification by the Operator, a contractor
or supplier, and
−− the process environment, external environment or upset condition is more aggressive
than anticipated.
J.3.5 ACT

An important element in CM is learning lessons from problems (underperformance of
The safe limits of use of CRAs are not fully understood, therefore any information relating to
failures in conditions in which the material was expected to be resistant is of great benefit
to the industry.
J.4 MITIGATION BY CATHODIC PROTECTION
J.4.1 Introduction
Corrosion is an electrochemical process and by taking advantage of this premise it is

possible to reduce damage rates by making the system more negative by the application of
an external electromotive force. This premise being reliant on electrical continuity between
336
+44 (0)207 467 7100
the structure/facility to receive protection, a suitable anode which can supply a potential
difference and both being in the same suitable electrically conducting environment.
CP is one of the main techniques used for protecting onshore buried or subsea pipelines
and structures against non-atmospheric external corrosion. CP can also be used to provided
internal protection in process vessels and storage tanks and can also be used for under tank
bases.
External protective coatings are normally used in conjunction with CP, to reduce the
amount of current required to be supplied by sacrificial anodes and/or transformer-rectifiers
to protect the at risk equipment/structures. In marine environments, calcareous deposits
(CaCO3 /Mg(OH)2) form also as a by-product of polarisation on the protected metal surface
(due to the increase in localised pH), these deposits act as an in situ coating, significantly
reducing the protection current required and their presence can be taken as an inference that
the item has been sufficiently polarised to mitigate corrosion.
There are two principal types of CP systems commonly employed:

−− Sacrificial or galvanic anode – the anode (e.g. AI, Zn or Mg alloys typically) corrodes
in preference to the pipe/structure (cathode) being protected, supplying it with the
necessary protection current.
−− Impressed current – in this case current being supplied by means of an external d.c.
source.
Hybrid systems of the two principal CP methods tend to be comparatively rare, difficult to
manage and can be expensive. There may, however, also be a particular case where there is
some delay between full installation of a impressed current system and sacrificial anodes are
used as an interim protection measure.
The planned activities to ensure effective operation of the CP system should be correctly
implemented and the obtained monitoring data should be reviewed and properly analysed.
Measurement requirements to confirm protection may include: pipe-to-seawater/soil
potentials; anode current outputs; visual inspection of anode dimensions; pipeline/structure
isolation testing, etc.
For impressed current CP the anode must always be connected to the

positive terminal and the cathode to the negative terminal, otherwise the structure or
pipeline being protected will corrode in preference to the anode.
Under protection is identified by instantaneous off potentials more positive than −0,8 V
(Ag/AgCl/Seawater) for Aerobic and −0,9 V (Ag/AgCl/Seawater) for anaerobic environments
respectively. Anaerobic environments may be commonly found in closed spaces such as
tanks, or in seabed mud or under heavy fouling and there may exist a potential for microbial
corrosion due to the consumption of dissolved oxygen.
For onshore equipment, the typical protection basis utilised is a potential in the range −0,85 V
to −1,15 V when measured using a Cu/CuSO4 standard reference electrode.
The other most commonly used criterion is the on/off potential which must be lower than
that of the freely corroding potential by 100 mv or greater.
It is important to note that overprotection can be a serious problem where high strength
steels such as duplex stainless steels are concerned due to susceptibility to HISC. Mitigation
includes mechanical design and materials related measures (refer specifically to DNV-RP-F112
for Duplex Stainless Steels) and potential limiting methods such as diode control.
337
+44 (0)207 467 7100
Overprotection is identified by potentials more negative than −1,1 V (Ag/AgCl/Seawater) for

low strength materials but the value is usually lower for higher strength materials somewhere
in the range −0,83 to −0,95 V (values measured using a Cu/CuSO4 electrode being typically
50 mv lower).
There are a significant number of relevant standards for the use and application of CP
generated by a number of National and international bodies and a number of the most
relevant are shown in the following section.
The full design basis should be defined in the early stages of design including proper
considerations of commissioning, possible out of service periods and decommissioning.
J.4.2 PLAN
J.4.2.1 Policy and planning

Safety, environmental and commercial policies influence the choice of strategies for CP
mitigation/monitoring and include the aims of:
−− The prevention of external corrosion of the pipeline/structure over the specified
system design life.
−− Provision and distribution of sufficient current to the protected pipeline/structure so
that the selected CP protection criteria are achieved effectively.
−− Provide adequate allowance for anticipated changes in current requirements with
time e.g. initial polarisation, subsequent coating breakdown, etc.
−− Avoidance of the overprotection of high strength or sensitive materials which may be
at risk of failure of hydrogen related cracking.
−− Ensuring that protective coatings are compatible with applied CP levels to ensure no
cathodic disbondment.
−− Install anodes at the optimal locations where the possibility of disturbance and
damage is minimal and full coverage of the protected surface is feasible.
−− Provide adequate monitoring facilities to test and evaluate the CP system performance.
J.4.3 DO

The CP system should be designed according to industry recognised codes and standards
(see (g)).
The following information is required to undertake a system requirement assessment or to

formulate plans for system design and operation:
(a) Description of the system and its components.
(b) CP System design life. (Which may not be the same as equipment life).
(c) Site survey details and results (including resistivity testing). May include requirements
for establishment of particular CP zones and definition of system boundaries.
(d) Commissioning report.
(e) Drawings for as-built components/systems.
(f) Design, manufacturer/supplier and installation documentation and certification.
(g) Design standards/specifications may commonly include ISO 15589-1, ISO 15589-2,
DNV RP-B401, DNV RP-F103, EN 12954, EN 13636, EN 14505, EN 16299, EN 15212,
338
+44 (0)207 467 7100
EN 13373, EN 12496, NACE standards SP0176, SP0408, SP0290, SP0575, SP0186,

RP0193 and others (expert guidance should be obtained to determine applicability
and proper choice as some relate to specific use).
(h) System minimum current requirements and company potential criteria (dependent
on material type also).
(i) Monitoring plan and frequency, including procedures, schedules and equipment for
each type of monitoring facility installed on the pipeline.
(j) Safe operating CP system guidelines.
(k) Maintenance procedures including lifetime assessment of transformer-rectifiers,
seals, cabling, etc.
(l) Interference testing as part of commissioning and any subsequent installation
impacting protection.
Notes:
CP design basis should include the basis of design, surface area considerations, current
demand calculations (Initial, Mean and Final) and project-specific requirements in terms of
maintainability and system life.
Drawings are required including anode distribution, detailed design, manufacturing and
installation (including connections), transformer rectifier documentation including capacity,
control etc.
Sacrificial anodes should be supplied with all required testing and materials specification
certificates.
J.4.3.2 Organisation
A person/owner with overall responsibility for the CP system should be clearly identified (one
example being Materials and Corrosion Technical Authority).
Organisational roles that should be involved in CP management include:

−− Cathodic Protection Specialists particularly in the case of CP design;
−− Materials and Corrosion Engineers;
−− Inspection Engineers and NDT contractors;
−− Pipeline and Facilities Engineers;
−− Marine Engineers;
−− Structural Engineers, and
−− Mechanical and Electrical Engineers and Technicians.

The implementation phase for CP should ensure correct operation to achieve complete
protection of pipeline and/or structure:
−− Instantaneous on and off potential measurements (where appropriate) post-
commissioning and during operational phase. This should include testing specifically
to confirm the establishment of polarisation within a reasonable timeframe.
−− Potential reading locations, (in terms of distance from a specified reference or test
point etc.). It is important for onshore applications in particular to take account of
what is commonly termed the IR criteria where it is necessary to take account of
the current flow through soil (it may be the case the level of protection tends to be
overestimated).
339
+44 (0)207 467 7100
−− Measured field gradients (if required).

−− Description of the operations performed.
−− Technical characteristics and operating parameters of the monitoring equipment
used.
−− Permanent reference electrodes should be validated using an external calibrated
reference electrode after a maximum of 2/3 system design lifetime.
−− Appropriate monitoring of installations and equipment over full lifetime.
−− Frequency of each type of measurement.
J.4.3.4 Impressed current cathodic protection

Impressed current systems commissioning procedures should include the following:
−− pipeline isolation testing;
−− energising of impressed current CP hardware;
−− measurement of adequate protection levels (potential measurements);
−− anode/cathode connections and cable integrity;
−− interference testing, if applicable, and
−− validation of automatic mode operation.
J.4.4 CHECK
It is important to define a holistic monitoring plan for CP systems. This should include regular
or periodic monitoring as well as longer term CP assessment and techniques applied also to
investigate anomalies, assess their significance and define remediation.
One example is standard monitoring using fixed reference test points with follow-up on
a longer frequency or, if anomalies are noted, using a more detailed survey such as Close
Interval Potential (CIPs) survey for an onshore pipeline.

The following should be used as proactive performance measures indicators:
Galvanic anode CP systems need to be surveyed at early stages if:

−− CP design and anode performance indicate any deviations from specified standards
e.g. ISO 15589, DNV-RP-B401, DNV-RP-F103 etc.
−− A post-installation survey had not been properly carried out and significant deficiencies
were identified (e.g. onshore soil resistivity).
−− Coating damage is more than the specified design standard assumption.
−− There is believed to be any potential interference with other pipelines and structures.
−− CP risk assessment has not been carried out with satisfactory outcome.
The following shall be used as reactive performance indicators for both galvanic anode and
impressed current CP:
−− Signs of under-protection (examples may include general or localized corrosion
damage or rust discolouration etc.) marine growth and over-protection (examples
of which may include heavy calcareous deposits close to anodes) during potential
survey analysis.
340
+44 (0)207 467 7100
−− Interference with other pipelines or structures.

−− Coating and electrical continuity cable damage.
−− Unexpected significant anode depletion or major corrosion product build-up.
Notes:
If interference is identified, the chances of stray current corrosion being present are very high.
Usually, sacrificial anodes are directly connected to the protected structures/equipment

(stand-off anodes on structures, bracelet anodes (SP0492-2006) on pipelines), with no
provision to measure current. Little or no maintenance is required for these installations
except for level-of-protection surveys, which indicate whether the installation is operating
satisfactorily or otherwise.
Visual inspection data should be carefully assessed (e.g. coating damage, anode condition,
connection cables, seals, corrosion damage etc.). Typically, visual inspection of anodes on
marine structures indicates anode condition and provides a basis for estimating future
anode life, ideally using metal gauges/calipers to provide a more accurate measure of anode
consumption.
Because potentials are not generally uniform over the surface of a cathodically protected
structure in seawater, the reference electrode must be placed relatively close to the surface
to accurately measure steel-to-water potential at any point and should always be as close
as possible. The higher resistivities in brackish waters can sometimes create issues in
measurement and this effect should be carefully analysed.
For structures in shallow water depths or vessels and where strong currents are not a
problem, the simplest method of checking level of protection is to suspend a reference
electrode from deck This may also be accomplished using an ROV and stab or proximity
potentials and is particularly of benefit under hull on vessels or in deep waters.
Measurement requirements may cover: pipe-to-seawater/soil potentials; anode current

outputs; visual inspection of anode dimensions; pipeline isolation testing, etc. See NACE
TM0497-2012.
For completely buried pipelines it can be important to place the reference electrode directly
over the structure. There may be significant issues in respect of dry high resistivity soils, as the
voltage drop may turn out to be a significant factor.
Additional information such as, water temperature at the seabed: oxygen concentration at
the seabed,;pipe burial depth (if buried) and identification of exposed span lengths and
locations; water flow rates at the seabed, including seasonal changes if relevant etc. may be
included for offshore CP assessment. It is important in brackish waters to confirm resistivity
and impacts of reference electrode location.
Close interval potential surveys (CIPS-see SP0207-2007), direct current voltage gradient
(DCVG) surveys, C-scan survey etc. are only some of the techniques which may be used for
carrying out CP potential measurements. For onshore pipelines regular survey assessment
using test leads is typically designed in and may be located at ~one mile intervals. It is
important in more detailed surveys to confirm the area and point of minimum protection.
Inspection observations for onshore pipelines relate to 'digs' to investigate potential anomalies
for onshore pipelines or which may relate to diver/ROV assessments offshore.
Potential surveys should usually take place on a minimum of an annual basis.
341
+44 (0)207 467 7100
A more detailed assessment should be planned in the range three to five years or to follow
up any anomalies observed.
The planned maintenance activities to ensure effective operation of the CP system should be
correctly implemented and the obtained data should be reviewed and analysed.
Cathode protection potential measurements should be taken at a number of relevant

locations to adequately represent the protected item and on a regular basis to demonstrate
CP system effectiveness based on a minimum protection criterion.

It is important to investigate the causes of excessive corrosion and degradation related
incidents and accidents in order to reduce the likelihood of reoccurrence.
The contribution of CP or CP management in relation to failures should be investigated

with the appropriate corrective action(s) recommendation in relation to failures to attain
performance standards also.
J.4.5 ACT
J.4.5.1 Reviewing performance

In reviewing performance it is important to carry out a full analysis of all data which should
include
−− Plotted graphs of pipe/structure potentials along the pipeline/structures, identification
of under-protected or over-protected areas, etc. with details of planned remediation
methods.
−− Inspection observations and measurements, including gauging of sacrificial anodes.
−− Failure reports specifically in breach of performance standards.
−− Comparison of recorded data to those from previous surveys.
Performance review should include the following activities with appropriate corrective actions
identified in the overall CP strategy, organisation and planning activities if need be:
−− carry out ongoing review of transformer current/voltage trends for ICCP systems;
−− quarterly and annual reviews of potential measurement values;
−− annual review of performance measures, in particular the assessment of reactive
indicators and overall trends;
−− RCA of any visual findings or significant changes in potential measurement readings;
−− review of maintenance and replacement activities, and
−− review of impacts on system design lifetime.
Note:
Root causes may be many and varied, including: coating breakdown; stray current corrosion
as a result of interference; anode wastage; deterioration of anode/cathode connection(s);
deterioration of anode or CP cables, breakdown or degradation of electrical equipment
(e.g. power supplies).
342
+44 (0)207 467 7100
CP systems do deteriorate over time and this is not only related to the consumption of
sacrificial anode material.
Unstable performance of permanently installed reference electrodes may be a longer term

and life related issue.

Overall performance review should take place of all monitoring activities together with
verification findings and audit results by an experienced and independent competent body,
typically on a five- yearly basis.
A detailed plan should be produced to correct any audit findings and confirm future design
lifetime in relation to management aspects and future expected system operation.
J.5 CORROSION MITIGATION BY PROCESS CONTROL AND ENVIRONMENTAL

MODIFICATION
J.5.1 Introduction
In addition to the materials selection and the application of a corrosion allowance, where
some deterioration of the component part is permitted within the design lifetime, other
common control methods are employed. These methods are often based on a physical
modification of the environment, examples of which are discussed in this section.
The primary aspect from a production perspective is that of separation where oil, gas and
water streams are effectively removed from each other to allow a better approach to the
correct corrosion control of these production streams. Heating may also be required when
the temperature is low to better promote separation and to reduce the water content of any
produced oil. There may also be additional downstream equipment utilised to remove high
levels of salts.
Additional mechanical equipment may be utilised to further mitigate against the consequences of
flow aspects and slugging of production fluids. The use of demisters to remove liquid droplets
from gas streams and the use of screens or post-separation, the use of hydrocyclones for the
removal of sand/solids is often employed.
Good operational monitoring and control can be a highly effective management approach
and can help in the early detection of damaging constituents such as sand or H2S. Following
detection, these species can then be managed by shut-in of wells, rerouting or possible
application of chemical scavengers, system flushing to prevent the build-up of damaging
corrosion species such as excessive levels of chlorides or heat stable salts.
Temperature control can also play an important role in the minimisation of corrosion aspects
by reducing corrosion reaction rates/kinetics or by ensuring critical thresholds/boundaries are
not crossed in terms of enabling a particular mechanism which may be related to either local
corrosion e.g. pitting or a potential for cracking to take place.
Proper filtration for the removal of constituents or particles can be beneficial in respect of
minimising any potential for under-deposit or microbial corrosion.
Velocity is a key control parameter in a wide range of applications. API14E is often applied for
materials in service without the presence of appreciable solids . Some materials have specific
343
+44 (0)207 467 7100
limits and the effects of seawater on CuNi materials can be appreciable when the velocity is
not controlled in the range 0,5–2,5 m/s. There are also limits on the applicability of corrosion
inhibition at high velocities, usually defined using a shear stress relationship.
There are also a considerable number of other related corrosion mitigation means such as
chemical treatment, including not only the control of pH, but also where scavengers are used
to remove damaging corrodent species such as oxygen or H2S. Careful design of chemical
treatments including mixing is essential as some chemicals which can be beneficial when
diluted are corrosive in their own rights and are hence damaging.
Some of the key aspects briefly discussed here are expanded upon in the following specific
sections.
J.5.2 Water removal/dehydration
From a corrosion perspective, dehydration is simplistically applying a treatment/process such

that free water is either reduced or is not present, in order to prevent contact with the
substrate.
In the case of oil production, target water levels in streams are typically less than 0,5–2,0 %,
but this is also related to whether the water may be fully entrained or may drop out and
accumulate. There are a number of rules of thumb dependent on water cut values which
may commonly range from 5–40 % however, this is dependent on associated flow patterns
and minimum velocity rules which can be difficult to achieve in practice. The type of
hydrocarbon liquid has a significant influence in this regard, e.g. water separates readily from
light condensates.
In gas streams dehydration may be accomplished by direct cooling of hot gas streams; as
the saturated water vapour content decreases with either increased pressure or decreased
temperature, the liquid phase is then separated. Conversely, for water saturated gas, another
means of corrosion mitigation is to reduce water condensation through the use of insulation,
bearing in mind that this may introduce a CUI risk. Other dehydration treatments rely on
the use of absorption and liquid desiccants such as TEG or adsorption using solid desiccants
as in the case of molecular sieve, and there are cases where a combination may be applied.
There are some limitations in either absorption or adsorption techniques which are usually
associated with the presence of impurities or build-up of contaminants over time.
A simple control basis is typically applied in gas systems where the constituents are well
known. This control measure usually requires careful monitoring to ensure that the stream
does not approach within a minimum of 10 °C of the stream dewpoint and should also
acknowledge potential effects of pressure drop within equipment or over valves, the impacts
of start-up/shutdown and loss of efficiency of dehydration systems over time. There are
often little or no additional control measures applied as it can be difficult to reliably predict
where condensation will take place and hence siting of corrosion probes or coupons may
provide little valuable information unless based on historical data, or drop-out is predicted.
J.5.3 Deaeration
Deaeration/deoxygenation of water systems takes place to remove oxygen, which is

probably the single most damaging corrosive gas which can be present in waters and can
have an impact of 10 times or more the corrosion impact of CO2. Oxygen can be considered
to be present in virtually all water sources, although often at widely varying concentrations.
344
+44 (0)207 467 7100
Oxygen is most commonly an issue in oil and gas production within source waters including
seawater or waters to be used within systems such as steam and condensate. Oxygen provides
a major pitting challenge on its own, and in combination with other corrosion mechanisms
can be extremely damaging.
Oxygen removal is required to reduce the potential for oxygen corrosion but also has the
added benefit of potentially reducing the level of any microbiologically influenced activity
present.
Water injection pipelines are usually constructed of CS relying on corrosion allowances

and require excellent oxygen control. Deaeration of the injection water to below 10 ppb is
normally the design measure applied although short-term excursions in the order of several
hours are permitted up to 50 ppb. There are two principal ways in which oxygen is removed.
The usual treatment basis is mechanical vacuum deaeration down to 50–200 ppb levels,
followed by polishing by the addition of chemical scavengers such as ammonium bisulfite to
achieve the very low levels <10 ppb required.
Careful control and monitoring is required to avoid what can often be quite significant
corrosion with both on-line monitoring and alarms being utilised. On-line measurement of
oxygen is comparatively commonplace but can be difficult to maintain reliably if there is
no redundancy built-in. Corrosion probes provide a good measure of system performance
typically using LPR probes but longer term reliability issues can be experienced and often ER
probes are utilised in combination to provide a longer term more reliable basis.
Efficient deaeration is also necessary within some ancilliary systems, with one example being
boiler and condensate corrosion. This also requires careful control of oxygen and the ppb
levels required are taken as function of pressure and which can again only be achieved by a
combination of mechanical and chemical treatments.
Gas blanketing can be used to try and minimise any impacts associated with oxygen corrosion
however, for any conventional nitrogen generator there is always likely to be some residual
oxygen present, commonly in the range 2–3 %. This can have a significant aspect particularly
in H2S-containing environments and can lead to the generation of free sulfur.
J.5.4 pH control
pH control typically sits under the section on chemical treatment; however, there are several
specific oil and gas applications which deserve specific consideration.
The pH stabilisation technique is a method commonly used for control of sweet corrosion in
wet gas pipelines and is a well established and studied method for control of CO2 corrosion,
typically using amine treatment plants. The pH in a CO2 environment is mainly determined
by the bicarbonate in the water and the CO2 partial pressure. An increase in the pH value
will reduce the bare steel corrosion rate and it will also promote the formation of protective
films. One of the biggest challenges with pH stabilisation is the risk for scaling, and a reliable
prediction of expected quantities of formation water is required. The design is normally more
complex than traditional systems and considerations of any potential interaction with MEG
systems and regeneration is essential. In partial pH stabilisation this may be combined with a
film-forming CI which is beneficial when some formation water is expected to be produced.
Organic acids will accumulate over time when using MEG also and may lead to other top-of-
line corrosion issues.
345
+44 (0)207 467 7100
J.6 CORROSION MITIGATION OF HYDROTEST WATERS
J.6.1 Hydrotesting
Hydrotesting of equipment and pipelines is considered a key aspect of demonstrating

integrity of the item. The specific details of testing are obtained from the fabrication code in
respect of times and pressures required. Due acknowledgement should also take place of the
minimum test temperature.
This document only concentrates on the main CM aspects in relation to hydrotesting.
Conventional oil and gas materials such as carbon steel and CRAs can suffer significant
damage due to corrosion when waters are improperly used in hydrotesting. There are many
instances of failure occurring shortly after hydrotesting as a result of the use of either poor
quality water sources or improper water treatment.
Corrosion may be general or local in nature, which is found to be due to effects such as
crevice corrosion, pitting, differential aeration effects or, as is often the case, MIC.
This is considered of particular relevance when the water used will be left stagnant over an
extended period as this can often lead to an increased propensity to under-deposit corrosion
or MIC due to the settlement of debris or solids.
There are often difficulties in unplanned extensions in hydrotesting and duration and
hence even when some maximum critical period is defined, chemical treatment is often
applied as a matter of course. One simple rule of thumb is that if water is considered to
be stagnant for a period of seven days or more, the water should always require chemical
treatment.
J.6.2 Hydrotest mediums
The potential for corrosion and the requirement for treatment necessary before hydrotesting
is strongly dependent on water source and this is usually either sea, river, or potable water.
The chosen source is usually that of the least contaminated but which is the most readily
available. Other water sources which could be used dependent on availability may also
include demineralised water or condensate.
Potable water is considered the best option for hydrotesting because it is low in chlorides and
solids, but it is also the most expensive and not always readily available and may still need
chemical treatment.
When seawater is used it should be sourced from a location free from external contamination
e.g. typically more than 20 m above the seabed and at least 15 m below the sea surface.
There is no maximum allowable chloride content of waters used in the testing of CSs.
However, the lowest chloride content water source available (i.e. conforming to other water
quality requirements) should typically be used. The maximum allowable chloride content for
stainless steels and nickel base alloys is typically taken as <50 ppm. In specific cases the use
of waters with low chloride contents could also be considered by use of simply flushing.
Higher chloride content waters may sometimes be used in cases with no viable economic
alternative (e.g. pipelines with a high internal volume dictating the need for seawater as a
hydrotest fluid). Chemical treatment is typically always required for high chloride content
waters in contact with CRAs.
346
+44 (0)207 467 7100
Anaerobic (very low oxygen) waters should not typically be used, as they may be indicative of
substantial contamination by chemicals and/or bacteria.
It may be possible to use alternatives to water (e.g. hydraulic fluids) which may be considered
for use in hydrotesting or the wet preservation of equipment. These should, however, be
treated to the same standards as required for hydrotest waters to ensure that all corrosion
mechanisms are properly controlled.
J.6.3 Microbial corrosion
MIC is one of the most prevalent types of corrosion that occurs because of the development
of microorganisms. The uncontrolled use of waters has the greatest risk of MIC because
solids or organic materials may also be present.
The corrosion effects of MIC are usually seen initially at the bottom of pipes, vessels, or
at weld positions, where solids and also bacteria can settle. Bacteria form colonies which
can result in the formation of local concentration cells, and acids may be formed as
by-products which can significantly increase corrosion rates. Biocides can help to prevent
MIC at appropriate dosage rates providing they can contact the metal surface appropriately.
One critical aspect of corrosion due to hydrotest waters relates to the contact period. This
critical time period is sometimes taken as a function of Microbial activity where the cell
numbers exceed typically 105 when measured using MPN (Most Probable Number). This can
also be related to the initial concentration of bacteria in the source water, temperature and
the sulfate content.
J.6.4 Mitigation measures
The potential for system corrosion during hydrotest can also be mitigated by:
−− reduction in hydrotest duration;
−− reduction in the volume of any solids present using filtration;
−− reduction of oxygen present by use of a scavenger;
−− microbial control by the use of biocides, and
−− application of CIs.
A reduction in contact time be effective in limiting potential for microbial growth and hence
potential corrosion damage.
Filtration is considered an important control aspect and all natural waters for hydrotest
should be filtered using a 50 micron filter. Filtration reduces the amount of sediment entering
the pipeline or equipment and decreases the potential for MIC and under-deposit corrosion.
The use of raw unfiltered seawater is not considered to be acceptable.
Filtration is an important preventative measure when dealing with under-deposit corrosion or

crevice corrosion which can occur particularly when CRAs are present. It has the additional
benefit that it helps to mitigate against MIC.
Oxygen control is often considered even more critical for CRAs than CSs, because of the
greater susceptibility to crevice corrosion effects.
347
+44 (0)207 467 7100
DemineraliSed water, high purity steam condensate and potable water generally are not
required to employ filtration. Seawater and all brackish waters, however, should be filtered
to remove all particles greater than 50 μm.
Oxygen scavengers can sometimes be eliminated for non-critical equipment or where the
impacts of corrosion can be considered as negligible when consuming all the dissolved
oxygen.
There may, however, be some potential for interaction between any chemicals used and
compatibility and interaction aspects should be assessed specifically with chemical vendors.
Oxygen scavengers are usually added after filtration and must be given enough time to react
before other chemicals such as biocides are injected.
To determine if the water was effectively treated by any biocides, sampling may take place in
advance of treatment and as a normal process samples should be collected before and after
treating, following standard sampling and culturing procedures e.g. NACE TM0194-2004,
Field monitoring of bacterial growth in oil and gas systems.
Cleaning may also be required in addition to the use of biocides to ensure the surface of
any biofilm is stressed and to ensure more effective biocide contact with the metal surface
e.g. biocide treatments should be scheduled to take place as soon as practicable after any
pipeline pigging run.
CIs are sometimes applied if the duration is likely to be significant or where even minimal
rusting is not permitted.
J.6.5 Drainage and drying
There may also be issues post-hydrotest and these are typically related to either incomplete
draining and drying, and consideration should be given during design, if feasible to the
proper drainage of any equipment to be hydrotested.
If hydrotest/preservation fluids treated with chemical additives remain in contact with

equipment or pipelines past their planned time of exposure, the hydrotest/preservation plan
shall be revisited to determine requirement for further action.
Samples should be taken to determine remaining treatment chemical activity should be

representative of both bulk fluid conditions and also non-bulk fluid conditions e.g. piping or
dead legs where feasible.
Drain hydrotest water from the system and dehydrate as quickly as reasonably practical,
minimising exposure times. Where it is not possible to drain an intervention may be required
to remove water using manual cleaning and drying.
Specific guidance on the level of drying required is highlighted here:

−− drying should take place to a water dew point spec 5 °C less than the minimum
anticipated air temperature;
−− temperature of drying medium (warm air, dry N2) shall be < 60 °C, and
−− equipment and piping ends should be sealed to prevent any further water or
moisture ingress.
348
+44 (0)207 467 7100
J.6.6 Wet storage
Where equipment or piping is to be wet stored it is important to:

−− confirm chemicals have been added in the right concentration;
−− ensure proper mixing of the chemicals with the test fluid takes place;
−− ensure adequate filtration and solids settlement cannot occur;
−− ensure appropriate winterisation, and
−− carry out periodic monitoring and potentially carry out circulation.
Hydrotest water which has been chemically treated may not be able to be directly discharged
into the sea. It must meet environmental regulation requirements and may require treatment.
Chemical manufacturers should be consulted on the correct disposal procedures to meet
environmental guidelines.
J.6.7 Preservation
The required degree of preservation is primarily a function of the time for which a plant is to
be standing idle and primarily there should be some consideration of the economic viability
of preservation over simply that of future replacement.
Preservation is usually not required where the item will become obsolete or has already
undergone significant deterioration or the cost of preservation is likely to exceed 30 % of its
estimated future replacement cost.
Preservation is usually thought of in three timescales:

−− temporary (<six months);
−− short-term (<two years), and
−− long-term (>two years).
Many preservation procedures require some maintenance or the use of utilities during the
out of service period.
Preservation should include both internal and external corrosion considerations.
Idle and retired pressure vessel equipment should be physically disconnected from remaining
active process equipment. It is not considered acceptable to isolate using valves that may
allow it to be accidentally reintroduced to service. Equipment and piping should also undergo
rigorous inspection prior to be placed back into service.
The equipment should be drained of inventory and then cleaned prior to preservation using
desiccants, oils or inert gases ensuring adequate sealing.
The preservation required for the exterior of an equipment should be determined largely by
the local corrosion conditions and the condition of any protective coating or covering, as in
the case of insulation.
Existing CP for submerged equipment should always be maintained as part of ongoing

maintenance procedures.
349
+44 (0)207 467 7100
Short-term preservation is usually accomplished by one of the following methods:

−− desiccants;
−− vapour phase inhibitor (VPI) powders, and
−− spraying of surfaces with corrosion preventive fluids.
Preservatives shall be renewed periodically, and flange covers reinstalled. Equipment, including
specifically heat exchangers should be inclined such that there is no possibility of water
hold-up within tubes or other vulnerable areas during the period of storage.
Longer term preservation is typically accomplished using an inert gas purge such as dry N2 at
a pressure typically >5 psi. Periodic review is required of pressure maintenance and to ensure
sealing is maintained.
For CRAs, and clad materials it may be acceptable to store filled with dry clean air, provided
no extraneous material contamination can take place. Vessels, equipment and piping of
austenitic stainless steel should be thoroughly cleaned and dried internally because deposits
or pockets of water can lead to serious local corrosion issues. Water containing chlorides may
cause SCC or pitting and there is also the possibility of MIC.
Winterisation should be considered whenever equipment and/or piping are preserved by

filling with inhibited water. Cooling water systems would typically be kept in operation even
for longer periods in range of more than several years. Only if this is not possible, drain the
system and refill with inhibited water.
Insulated equipment shall have the insulation system maintained on an appropriate interval
to prevent the ingress of water. This also applies to the regular maintenance of external paint
systems relied upon for corrosion protection.
Inspect fireproofing at regular intervals and maintain in good condition, paying particular
attention to places where rainwater can penetrate.
In general, non-ferrous alloys should be kept clean and free from deposits externally to avoid
any potential for localised corrosion where not painted or shielded. Rotating equipment is
considered to be a special case and should be as per OEM specified requirements. Lubrication
systems should be circulated on an ongoing basis. Wherever water is being used for
preservation, inhibitor levels shall be checked on a regular basis.
Non-metallics can degrade due to exposure to direct sunlight, heat and general weathering,
which will cause deterioration of most plastic and rubber-based materials. Protection usually
involves shielding or covering but lifetime is still usually considered to be short and these will
usually require replacement.
A visual inspection should be carried out as a minimum of preserved equipment on an

integrity basis on typically a two-year period to assure it is mechanically acceptable, and in
the required preservation manner, e.g. air/gas tightness, inhibitor levels, supporting, etc.
350
+44 (0)207 467 7100
ANNEX K
PERFORMING FAILURE INVESTIGATIONS
A generic outline of the steps that may be adopted as part of a failure investigation is shown
in Figure K.1.
Loss of containment reported to Asset Manager who appoints a

Lead Investigator and decides on the level of investigation required
Lead Investigator obtains Asset Manager ensures the

an overview of the site is made safe and not
problem, visits site as soon disturbed more than
as possible and then necessary
devises an investigation
plan
Detailed site inspection to assess the extent of the Creates an appropriate team to provide specialist input
problem. Record and preserve critical samples to the investigation and assist with site inspection
Physical destructive Obtain data of the operation Obtain details of the design Research the plant operat- Carry out simulated
examination and up to and including the time and build of both ing, inspection and mainte- testing and modelling
analysis of the samples containment was lost. This equipment and process nance records
collected from site to may include obtaining
establish the failure witness statements from
mechanism staff
Assimilate all the data and results obtained to

determine the actual or most likely mechanism and Implement corrective actions and monitor
cause of failure
Figure K.1: Common steps in undertaking failure investigations
There are normally two distinct stages to any failure investigation which are either conducted
in series or parallel to each other. The first stage is the mechanistic study to determine how
containment was physically lost e.g. the type of corrosion (general, pitting, under-deposit,
microbiological etc), the type of cracking/fracture (ductile, brittle, fatigue); this study often
involves detailed examination. The second part is the causation study. This stage of the
investigation tries to establish what the circumstances were that caused the component to
fail by a particular mechanism.
A full RCA takes the findings of the failure investigation further by considering all aspects
that may have resulted in the failure of a component and uses techniques that are effective in
exploring some of the other contributors to failures, such as the human and economic factors.
Properly performed, failure analysis and RCA are critical steps in the overall problem-solving
process and are key ingredients for correcting and preventing failures, thereby achieving
higher levels of reliability.
K.1 LEVEL OF INVESTIGATION REQUIRED
Not all incidents of LOPCs require a full investigation. For example, a leaking potable water
tap may be caused by a worn or faulty washer. Instigating a full investigation in this instance
would serve little purpose and would be disproportionate to the problem in question.
351
+44 (0)207 467 7100
When to initiate an investigation, or the level of investigation required, has to be assessed

on a case-by-case basis by managers responsible for the asset and/or plant. There are a
number of factors which need to be taken into consideration when deciding on the level of
investigation required; these include:
−− health – did the failure result in an injury or near miss to personnel on the plant or
to the public?
−− environmental – did the failure result in a discharge that impacted on the local
environment on or off site?
−− safety – does the loss of containment have an immediate or long-term effect in the
continued safe operation of the plant?
−− reliability – does the loss of containment have an immediate or long-term effect on
the reliability of the plant or other processes upstream or downstream of the affected
unit? Is there potential for the same problem to occur elsewhere in the asset?
−− frequency – is a loss of containment occurring regularly which shows similar trends/
symptoms?
−− cost – this may cover many aspects such as loss of production, reinstatement, effects
on adjacent facilities or process streams, cleanup, etc.
−− litigation – have regulations/laws been breached as a consequence of the failure.
Could the failure be the subject of a claim by an affected party?
−− loss of reputation – could the failure result in a loss of reputation for the company
either within the local, national or business communities? 'There is a need to be seen
to be doing the right thing'.
K.2 WHO LEADS THE INVESTIGATION?
Once a significant loss of containment has been discovered or reported, senior management
should assign a suitably experienced individual to drive and be responsible for the
coordination, management and completion of the investigation. This individual will not be
expected to cover all aspects of the investigation themselves. The candidate should have:
−− a thorough, analytical and logical approach to his/her work;
−− be assertive and a good communicator;
−− have good working knowledge and understanding of materials, manufacturing
methods and testing/examination techniques;
−− have good working knowledge and understanding for the affected facility plus
general/chemical/process engineering principles;
−− be familiar with how to conduct this type of investigation;
−− have a good working knowledge of what resources/specialists may be required to
assist in various aspects of the investigation, and
−− be empowered by senior management to investigate the problem.
K.3 THE INVESTIGATION TEAM
The constitution/make-up of the investigation team will be dictated by the problem in hand
and may change and/or require input from other specialists as the investigation proceeds. The
investigation team may require input from both in-house resources and external consultants.
Figure K.2 gives an example of a team make up.
352
+44 (0)207 467 7100
Corporate/local HSE
Plant operation
Process/chemical/mechanical/materials
engineering specialists
Asset manager Lead investigator Maintenance and inspection
Technical centre
Internal or external third party

laboratory examination and analyses
Original equipment manufacturer (OEM)

or design authority
External consultants
Figure K.2: Persons who may be involved in an investigation
K.4 STARTING THE INVESTIGATION
K.4.1 The plan
A basic understanding of the events leading up to the loss of containment and the
fluids/products which have been lost is an essential part of formulating any investigation
plan. A generic outline of the steps that may be adopted as part of an investigation is shown
in Figure K.1.
As failures of plant and equipment are often a result of an uncontrolled incident or occurrence,
an essential part of any investigation is ensuring the safety of those undertaking the hands on
investigation. All safety concerns must be fully assessed and appropriate procedures adopted
to mitigate any health and safety risks throughout the course of the investigation.
K.4.2 Securing and collecting the evidence
One of the most important first steps, where safety permits, is taking control of the damaged
component/item at an early stage (as soon as possible), especially if the more detailed
examination and analysis is to be carried out by others.
Once the site has been made safe, it is imperative for the 'first person on the ground',
be it the appointed Lead Investigator or Facility Manager, to preserve whatever evidence is
available. Both hard physical evidence (e.g. damaged items) and soft evidence (operating
records, witness statements etc.) should be preserved as quickly as possible because, in some
instances, evidence (including witness statements) can degrade with time.
It may be advisable for the Lead Investigator to delegate the site work to third party experts
in this type of 'forensic' engineering investigation or at least seek advice on sampling
353
+44 (0)207 467 7100
techniques/procedures etc. In some instances removing physical samples is neither practical

nor desirable, in which case a number of different on-site techniques can be adopted.
Control of the incident site is particularly important with regard to physical evidence and may
involve locking the incident site down. Inappropriate recording, poor/delayed sampling and
bad preservation of samples can introduce elements of doubt or limit the extent and range
of detailed examination/analyses possible.
Once the Lead investigator has an overall appreciation of the problem he can then devise
what additional inspection, if any, is required before sampling begins. If further inspection,
NDE e.g. dye penetrant inspection, at site is required, which may result in compromising
some of the hard evidence (e.g. corrosion deposits), then ensure that the evidence is sampled
prior to doing the additional NDE.
It is important to record the detail of the area of damage and to show how this relates to
the item as a whole. For example, showing a close-up photograph of a crack in a pipeline is
of little use if you are not able to determine from the photograph where in the pipeline the
crack is located. Photograph the crack and take general shots putting the location of the
crack into context, e.g. is it near to a flange?, is it at the 6 o'clock position?, etc.
Component samples should be taken and stored in such a way as to prevent further
damage during handling or degradation (e.g. protect from corrosion) in storage/transit. If
components have to be sectioned (e.g. a piece cut out of a pipeline), then this must be done
away from any features of possible interest. Hot cutting e.g. using oxyacetylene or plasma
cutting should be avoided if at all possible. If it cannot be avoided then any hot cuts must
be a minimum of 300 mm away from any possible features of interest that may be important
in the investigation. If samples are removed using an abrasive disc cutter then any cuts must
be a minimum of 100 mm away from any features of interest.
Great care must be taken in the removal and preservation of fractured/cracked components.
These must be carefully handled to prevent any crack/fracture surfaces suffering secondary
mechanical damage or corrosion which could remove the fine detail on the crack/fracture
surface which would allow positive identification of the cracking/fracture mechanism by
detailed examination. Under no circumstances should mating fractures be pressed back
together; this will inevitably lead to secondary damage.
Where samples are to be transferred to a laboratory for further examination, ensure that they
are adequately packed and protected to prevent handling and corrosion damage in transit.
K.5 WHO CONDUCTS THE LABORATORY INVESTIGATION
It is essential that the entity undertaking this stage of the investigation has qualified and
experienced specialists with a proven track record of undertaking this type of work. The
success of this stage of the investigation is entirely dependent on the experience and
interpretation of findings by the specialist investigator(s). Unless specialists exist in-house
this stage of the investigation should be carried out by an approved and experienced
independent third party consultancy. Splitting of samples and sending different parts
of the same investigation to different specialists should be avoided. The laboratory
examination should be carried out or controlled/coordinated by one entity.
354
+44 (0)207 467 7100
K.6 SCOPES OF WORK
There are no standard ways of completing the detailed laboratory examination of samples;
the tasks completed and analysis/testing undertaken are entirely dictated by the problem
being investigated and should be devised following an initial assessment of the samples by
the investigator. This stage of the investigation will almost certainly involve destructive testing
and so there will be permanent changes to the evidence. The sequencing of tasks should be
carefully thought through to limit any interference between the tasks.
It is frequently useful to include comparators in the lab investigation e.g. undamaged parts
of the same item/component or new unused items/components.
K.7 CAUSATION STUDY
All aspects from the design, installation and commissioning, inspection and maintenance histories
through to the operation of the component or plant may need to be researched as part of
the causation study. It is not only important to look at the individual item that has failed, but
also how plant process upsets elsewhere may influence the operation and performance of the
failed item/component. Sources of information will range from the OEM to the plant records.
Literature and internet searches are also useful sources of information. Very often witness
statements of the individuals operating or directly controlling a component or piece of plant are
not officially recorded, so discussing the lead-up to a failure with these individuals can provide
valuable information in determining the cause of a failure. It should be noted that the greater the
time lapse between an incident occurring and interviewing witnesses will decrease accuracy of
recollection and increase the likelihood of discrepancies between witnesses.
Causation studies are not confined to desk top studies alone; they may involve simulated
testing or modelling. Replicating a failure under lab conditions is the ultimate way of
demonstrating that the mechanism and cause of failure have been accurately identified by
the investigator.
Determining and understanding the cause of a failure is fundamental in trying to prevent

a recurrence of the failure. There are a number of methods that can be adopted to try to
establish the fundamental cause of a loss of containment. These may not be initially obvious
but need to be considered if a repeat of the problem is to be avoided. These can often be
identified by completing fault tree or 'fishbone' diagrams during in depth discussions by
members of the investigation team. These types of analysis take into account a number
of causal factors which may have influenced events and eventually led to failure. A simple
example is shown in Figure K.3 which analyses a leak at a flanged pipe connection. The
mechanism of failure of the joint was determined by detailed laboratory examination to be
due to fatigue failures of the fixing bolts. A number of causes resulted in this failure, the
majority of which, once recognised, could be 'engineered' out to prevent a recurrence of this
type of problem either at this joint or in similar joints in other parts of the plant.
K.8 TERMS OF REFERENCE FOR FAILURE INVESTIGATION
The terms of reference for the investigation detail the objectives (scope) and expected outcomes
(deliverables e.g. report) of each investigation. These will vary slightly from investigation to
investigation and should be agreed in advance. The main terms of reference (TOR) of any
355
+44 (0)207 467 7100
investigation should be aimed at not only identifying the mechanism(s) of failure but more
importantly the circumstances which led to the failure, i.e. the cause(s), so corrective actions
can be implemented to prevent a recurrence of the failure.
K.9 REPORTING
The report should clearly set out the results of all the investigations completed. It should set
down the background to the problem, and discuss the findings in a logical and systematic
way before coming to a conclusion. In many instances it will not be possible to be absolutely
certain with regard to the mechanism and cause of failure. In these instances, having gone
through reasoned arguments, the investigator, based on his experience and knowledge,
should state the most likely mechanism and cause of failure.
The report should generally include the following sections:

−− Identification of the item/component, the plant item/tag number and its location.
−− Brief service history (including length of service) and circumstances leading up to the
failure.
−− The inspection and maintenance history, including reference to previous failures.
−− The duty (e.g. operating temperature, pressure, products being handled).
−− The design requirements.
−− The circumstances leading up to the failure.
−− The results of the inspection, examination and analyses.
−− A reasoned analysis and discussion of the results of the mechanistic and causation
investigations.
−− Conclusions.
−− Recommendations to prevent recurrence of the problem, stating the action plan, the
party responsible and the target dates for remedial action completion.
356
+44 (0)207 467 7100
+44 (0)207 467 7100
Materials Methods
Inadequate controls on procurement

resulted in an unapproved supplier
Wrong strength
grade of bolt
used No incoming goods received checks before
bolts were put into engineering stores
Machine Poor quality bolts

numerous thread No procedure for installation
defects to ensure correct preload
Poor controls applied to bolt
Incorrect of equipment
tooling used uncalibrated
to fit bolts Bolts failed equipment No sign-off to show that the
by fatigue available for use work had been completed and
inspected
Loss of
357
containment
due to leak at
a flange
Fitter used
inappropriate
Torque not uncalibrated
correctly applied Inadequate management of task, usual
supervisor off sick stand-in didn’t know equipment
during fitting of
the bolts that the fitter assigned was not Pipework subjected to high
competent/trained to do the work. vibration due to worn pump
shaft coupling.
Measurement Procurement ordered
bolts from unapproved
supplier on cost basis
People Environment
Figure K.3: Example fishbone diagram for the causes leading to a leaking flange
Table K.1: Common non-destructive examination techniques (NDE)
Technique Notes
Dye penetrant This uses either a coloured dye or fluorescent dye solution (sensitive to
inspection (DPI) ultraviolet light), applied to a clean surface. The dye penetrates cracks
and defects by capillary action. The excess solution is wiped off and a
quick drying matt spray developer is applied to the surface of the metal.
The dye stains the developer at defects. DPI will only detect surface
breaking defects
Magnetic particle The magnetic particle technique uses a spray fluid containing magnetic
inspection (MPI) particles. A magnetic field is applied across the material using either
a permanent magnet or an electro-magnet. A white matt spray paint
is often used to coat the substrate to improve the observation and
delineation of defects. The presence of a crack is indicated by a line of
magnetic particles which congregate at the discontinuity in the magnetic
field adjacent to the defect area. The surface of the material being
examined must be clean, dry and free from corrosion products. MPI will
only detect surface breaking or just subsurface defects in ferromagnetic
materials
Ultrasonic A transducer converts electrical signals to high frequency mechanical
inspection (UT) vibrations (sound). These waves (ultrasonic waves) are transmitted
through materials at a velocity which is dependent upon the properties
of the material and are reflected from either discontinuities within
the bulk material (e.g. defects) or from the back wall and collected by
a receiving transducer. Measurement of the time of reflection of the
ultrasound waves is used to estimate the thickness of the metal and
intermediate traces can indicate the location and length or size of cracks
or discontinuities
Radiography X-rays or gamma rays are able to penetrate materials and detect
subsurface defects. The depth of penetration is dependent upon the
beam energy, the density of the metal and its thickness. A photographic
emulsion plate placed on the opposite side of the material to the
radioactive source records a shadow graph, on which the darker parts
represent the more easily penetrated areas and the lighter parts are those
which are less easily penetrated. Restrictions in use due to health and
safety issues
Eddy current Eddy current techniques are useful for detecting pits and cracks in metal
inspection surfaces. The technique depends upon the detection of anomalies in
eddy currents produced in metallic surfaces in an alternating magnetic
field. The eddy currents produce a back electromagnetic force (EMF)
in the exciting coil, or in a secondary detection coil, which may be
amplified and analysed. A probe is traversed across the surface of the
material being examined and the changes in the back EMF analysed. The
equipment is relatively simple and comprises a generator, a detection coil
within a suitable probe and an analyser
358
+44 (0)207 467 7100
Table K.1: Common non-destructive examination techniques (NDE) (continued)
Technique Notes
Positive materials Examination to determine that the materials used in the fabrication of
identification vessels conform with the requirements of design specifications
(PMI)
on-site This technique is essentially non destructive although it does require the
metallography surface of the component to be polished and etched. This can obviously
be a problem in some structures as the surface preparation damages
protective coatings such as paint films plating etc.
A small area of the surface of a component is ground back using
progressively finer grades of abrasive papers. The surface is then polished
back using diamond paste impregnated pads to a 1 pm finish then
etched. Etching uses a variety of different chemicals dependent on the
material being examined. The etch reveals the microstructure of the
material. Careful examination of the microstructure is then undertaken
using portable microscopes
In many instances a more detailed examination of the microstructure is
required using fixed laboratory microscopes and/or scanning electron
microscopes. To get round this replicas are taken of the prepared and
etched areas. Polymer sheets (normally based on acetate) are softened
and laid onto the prepared areas. This moulds to the surface. The sheet is
allowed to harden and is then carefully lifted off
Portable The hardness of a component is a measure of a material’s resistance to
hardness testing plastic deformation. It generally involves forcing some form of indenter
into the surface of a material under a fixed or known load; the 'stronger'
the material the smaller the indentation. By measuring the size of the
indentation a measure of the material’s hardness is obtained. Hardness is
often one of the mechanical properties specified for a material. In many
materials such as steel the hardness can be directly converted into a
tensile strength using standard charts
As with many types of testing the results obtained from portable
hardness testes are dependent on the knowledge, skill and experience
of the operator. In the right hands these tests produce results that are
comparable to laboratory based equipment
359
+44 (0)207 467 7100
ANNEX L
CHECKLIST FOR ASSESSMENT OF CORROSION MANAGEMENT IN
OIL AND GAS PRODUCTION AND PROCESSING FACILITIES
L.1 INTRODUCTION
The checklist (Table L.1) covers all the different areas of the CMS as described in the main
document, and is intended to be used by auditors to confirm that the CMS is being properly
implemented, and by individuals/organisations in setting up CMSsto ensure that all the
necessary actions and tasks are incorporated.
This checklist covers all the different aspects of a corrosion management system and as such
the entire checklist may not be applicable to the management system of particular facility
operators.
Reference should be made to the sections and items in the guideline document and the
informative information in Annexes A – H in order to interpret the questions.
In particular, auditors should bear in mind the scope of the document. The following terms
should be taken to include at least the scope described:
−− Item – vessel, pipe, structural member, pipeline section, subsea assembly:
−− Monitoring – on-ine corrosion rate and erosion monitors, on-line analysers and
instruments, sampling and chemical analysis, CP monitoring.
−− Inspection – vessel and pipework visual inspection, wall thickness NDT, subsea visual
inspection of pipelines, manifolds and structures, on-line inspection of pipelines,
visual survey of coating condition.
Table L.1: Corrosion management audit check list
CORROSION MANAGEMENT SYSTEM AUDIT
Date: Facility(ies): By:
Item Question Yes/ Not Supporting

no used evidence/references
1.0 Corrosion management system
1.1 Is there a documented corrosion
management system?
2.1 PLAN – Corrosion policy
2.1.1 Is there a company policy for corrosion
management (or including corrosion
management)?
2.1.2 Does it clearly state objectives for
corrosion control?
360
+44 (0)207 467 7100
Table L.1: Corrosion management audit check list (continued)

2.1.3 Is there evidence of an awareness of the
policy at all levels within the organisation?
Senior management?
Engineers and technicians?
Head office and facility staff?
2.2 PLAN – Corrosion strategy
2.2.1 Is there a documented corrosion strategy
for the asset?
Does it provide the method(s) by which
the policy is implemented?
2.2.2 Does it place responsibility for corrosion
management?
2.3 PLAN – Planning
2.3.1 Is there a strategic plan for mitigation and
monitoring activities that makes failure
risk as low as reasonably practicable?
2.3.2 Are measurable performance standards
set for the barriers to/mitigation of each
threat?
2.3.3 Are methods of monitoring, inspection
and measurement of barrier/mitigation
performance defined?
2.3.4 Are inspection programmes developed
using a risk based inspection (RBI)
methodology that relates inspection
intervals to a prediction of corrosion risk?
2.3.5 Are appropriate methods of detection
for the expected deterioration methods
documented?
3.1 DO – Risk profiling
3.1.1 Is a formal corrosion risk assessment
(CRAS) method used? Is it documented?
3.1.2 Are all significant deterioration threats
identified?
3.1.3 Are the operating conditions against
which the CRAS is carried out clearly
stated?
3.1.4 Does the CRAS consider process
excursions outwith the normal operating
case?
361
+44 (0)207 467 7100

3.1.5 Does the CRAS consider future
operational scenarios or 'what if' cases?
3.1.6 Are the results from historical operational
corrosion monitoring and inspection
used?
3.1.7 Is the CRAS subject to periodic review?
3.2 DO – organising – roles, responsibility and accountability
3.2.1 Is the organisational structure for
corrosion management fully documented?
3.2.2 Does this include any contractors used in
corrosion management?
3.2.3 Does it reflect the current organisation?
3.2.4 Are sufficient resources available to
implement the corrosion strategy?
3.2.5 Are roles and responsibilities for
individuals clearly defined and
documented?
3.2.6 Are authorities and reporting routes clear
and documented?
3.3 DO – organising – competence
3.3.1 Are the competence requirements for
all key operational and functional roles
defined?
3.3.2 Is authority given for key tasks in line with
competence, including:
−− Risk assessment?
−− Anomaly and fitness-for-purpose
assessment?
−− Approval of temporary repair and
limitation?
−− Item or facility suitable for use?
−− Inspection methods and non-intrusive
inspection schemes?
3.4 DO – organising – communication
3.4.1 Is appropriate information shared
including:
−− Information of hazards and preventative
measures, including lessons learnt from
incidents elsewhere?
−− Procedures, instructions and guidelines?
−− The organisation structure, the
key players and the accountable
management?
362
+44 (0)207 467 7100

3.4.2 Are key personnel formed into a corrosion
management team (CMT) that meets
regularly to review:
−− Implementation status?
−− Trends in deterioration and failures?
−− Status of corrective actions?
−− Planning and budgetary issues?
−− Performance against KPIs?
3.5 DO – organising – cooperation
3.5.1 Is appropriate input to the control of risks
obtained from relevant personnel?
3.5.2 Do change management procedures
require review by materials and corrosion
specialists for:
−− Engineering change?
−− Operating changes?
3.6 DO – implementing the plan
3.6.1 Is the plan translated into practical
instructions (e.g. work packs, planned
maintenance routines (PMRs), operating
instructions)?
3.6.2 Are locations for corrosion monitoring
and inspection clearly identified within the
work packs?
3.6.3 Do the inspection schemes, work pack,
PMRs and instructions include criteria of
non-conformance?
3.6.4 Are the physical means for
implementation in place (e.g. on-line
monitoring, inhibitor injection plant)?
3.6.5 Are the data to be gathered for corrosion
management requirements clearly defined
and reported in a form which enables
appropriate assessment?
3.6.6 Are data stored and shared so that trends
can be identified over time?
3.6.7 Are data from all sources (process
conditions, inspection and corrosion
monitoring and chemical data) collected
and evaluated centrally to allow
conclusion to be drawn holistically?
363
+44 (0)207 467 7100

3.6.8 Are the results fed back into the review
and improvement of strategic and tactical
plans?
3.6.9 Are corrective actions and their
completion time scales captured in
an information system that allows
implementation and close-out to be
tracked and verified?
3.6.10 Are investigations conducted to identify
the root cause of corrosion incidents?
4.1 CHECK – measuring performance
4.1.1 Are the relevant key performance
indicators (KPIs) of the success of the
corrosion management activities in place?
4.1.2 Are all measures presented to the
corrosion management team? Does the
team agree corrective actions?
4.1.3 Are measures made at a frequency that:
−− Allows corrective action before an
undesirable outcome occurs?
−− A meaningful magnitude of change?
−− Are changes made if these are not
met?
the root cause of serious or persistent
failures to meet targets?
4.2 CHECK – investigating accidents/incidents/near misses
the root cause of accidents/incidents/near
misses?
5.1 ACT – reviewing performance
5.1.1 Are the corrosion management activities
subject to a formal review?
5.1.2 Are reviews carried out at a specified
frequency that allows for timely corrective
action?
5.1.3 Does the review consider:
The effectiveness of the processes and
procedures in meeting performance
targets?
Shortcomings of facility and item
suitability for service?
364
+44 (0)207 467 7100

Results of investigations into root causes
of problems?
Feedback on contractor and supplier
performance?
Findings from audit?
5.1.4 Does the review feedback into the
corrosion strategy?
5.2 ACT – learning lessons
5.2.1 Are the corrosion management activities
audited to ensure:
The corrosion management system
includes all essential elements?
That the activities are implemented
in accordance with the plan and their
documented procedures?
5.2.2 Are audits carried out:
Using a check list and on the basis of
objective evidence of compliance?
By competent auditors with an
understanding of corrosion management
practice?
5.2.3 Are audit findings used to improve the
policy and plan and the implementation
and analysis processes?
365
+44 (0)207 467 7100
ANNEX M
INTERNATIONAL STANDARDS AND GUIDES RELATING TO
CORROSION MANAGEMENT
ENERGY INSTITUTE
Capability maturity model for maintenance management, 1st edition

Corrosion threats handbook – Upstream oil and gas production plant, 1st edition
External corrosion awareness handbook: A guide for visual recognition of external integrity
threats to upstream oil and gas production plant, 1st edition
Guidance on integrity testing for offshore installation temporary refuges, 1st edition
Guidelines for the avoidance of vibration induced fatigue failure in process pipework, 2nd
edition
Guidelines for the design, installation and management of small bore tubing assemblies, 2nd
edition
Guidelines for the design, installation and management of thermal insulation systems, 1st
edition
Guidelines for the life extension for safe operation of ageing rotating equipment on offshore
petroleum installations, 1st edition
Guidelines for the management of flexible hose assemblies, 2nd edition
Guidelines for the management of integrity of subsea facilities, 1st edition
Guidelines for the management of obsolescence in subsea facilities, 1st edition
Guidelines for the management of safety critical elements, 2nd edition
Guidelines for the management of the integrity of bolted joints in pressurised systems, 2nd
edition
Guidelines for the use of anti-corrosion tape systems for process pipework, 1st edition
Research report: A framework for monitoring the management of ageing effects on safety
critical elements, 1st edition
Research Report: Guidance on available literature for assessing and managing ageing plant
at bulk liquid storage facilities, 1st edition
Technical guidance and information relating to ageing and life extension of installations in
the upstream energy sector, 1st edition
The effect of nitrate anti-souring treatment on corrosion of mild steel, 1st edition
ASME
B31.3 Process piping guide

B31.4 Pipeline transportation systems for liquids and slurries
366
+44 (0)207 467 7100
API
5L Seamless and welded pipe

RP 570 Piping inspection code and inspector certification
RP 579 Fitness-for-service
RP 580 Risk based inspection
RP 58 Risk based inspection technology
ISO
15156 Petroleum and natural gas industries – Materials for use in H2S-containing
environments in oil and gas production
15589-2 (MOD) Petroleum and natural gas industries – Cathodic protection of
pipeline transportation systems
NACE
SP0607-2007 Petroleum and natural gas industries—Cathodic protection of pipeline

transportation systems
RP0104-2004 The use of coupons for cathodic protection monitoring applications
MR0103-2007 Materials resistant to sulfide stress cracking in corrosive petroleum
refining environments
MR0174-2007 Selecting inhibitors for use as sucker-rod thread lubricants
MR0176-2006 Metallic materials for sucker-rod pumps for corrosive oilfield environments
MR0175 Petroleum and natural gas industries – Materials for use in H2S-containing
RP0102-2002 In-line inspection of pipelines
DNV
RP-F101 Corroded pipelines – rules and standards
EEMUA
194 Guidelines for materials selection and corrosion control for subsea oil and gas
production equipment
NORSOK
M-001 Materials selection

M-503 Cathodic protection
M-506 CO2 corrosion rate calculation model
367
+44 (0)207 467 7100
ANNEX N
BIBLIOGRAPHY
ADCO
ADCO Document 30-99-37-0100 Failure investigation of surface facilities, Rev 1

ADCO Procedure Manual Volume 10/1 Part 7 – Procedure for investigation and reporting of
incidents
American Petroleum Institute (API)
950 Corrosion control in oil production

RP 14E Recommended practice for design and installation of offshore production platform
piping systems
TR 950 Survey of construction materials and corrosion in sour water strippers
Publ 581 Base resource document—Risk-based inspection
Publ 570 Piping inspection code: inspection, repair, iteration, and rerating of In-service piping
systems
RP 579-1/ASME FFS-1: Fitness-for-service
17TR2 The ageing of PA-11 in flexible pipes, 1st edition
RP 571 Damage mechanisms affecting fixed equipment in the refining industry
RP 580 Risk based inspection
RP 581 Risk-based inspection technology
RP 585 Pressure equipment integrity incident investigation
American Society for Testing of Materials (ASTM)
G4-01 Standard guide for conducting corrosion tests in field applications

G96 Standard guide for on-line monitoring of corrosion in plant equipment (electrical and
electrochemical methods)
G16 Standard guide for applying statistics to analysis of corrosion data
G161-00 Standard guide for corrosion–related failure analysis
E860-07 Standard practice for examining and preparing items that are or may become
involved in criminal or civil litigation
E1188-11 Collection and preservation of information and physical items by a technical
investigator
E1492-11 Standard practice for receiving, documenting, storing and retrieving evidence in a
forensic science laboratory
E2332-04 (Withdrawn) Standard practice for investigation and analysis of physical component
failures
368
+44 (0)207 467 7100
American Society of Non-Destructive Testing http://www.asnt.org/
Certification scheme for welding inspection personnel (CSWIP),
Det Norsk Veritas (DNV)
RP O501 Erosive wear in piping systems

RP G-101 Risk based inspection of offshore topsides static mechanical equipment
Engineering Equipment and Materials Users Association (EEMUA)
EEMUA 193 Recommendations for the training and development and competency assessment
of inspection personnel
Energy Institute (EI)
Model Code of Safe Practice Part 12: Pressure vessel examination

Model Code of Safe Practice Part 13: Pressure piping systems examination
Technical guidance and information relating to ageing and life extension of installations in
the upstream energy sector
A framework for monitoring the management of ageing effects on safety critical elements.
http://www.energyinstpubs.org.uk/pdfs/1346.pdf.
European Federation of Corrosion (EFC)
EFC 16 Guidelines on materials requirements for carbon and low alloy steel for H2S-Containing
EFC 17 Corrosion resistant alloys for oil and gas production: Guidance on general requirements
and test methods for H2S service
EFC 23 CO2 corrosion control in oil and gas production – Design considerations
EFC 55 Corrosion under insulation (CUI) guideline, Produced by EFC WP13 and WP15, ed. S
Winnik, ExxonMobil
Health and Safety Executive (HSE)
L112 Safety of pressure systems. Pressure Systems Safety Regulations 2000. Approved Code
of Practice, 2nd edition
HSG65 Successful health and safety management, 2nd edition
HSR 2002 002 Offshore hydrocarbon release statistics and analysis, 2002. HID statistics
report, http://www.hse.gov.uk/offshore/statistics/hsr2002/hsr2002.pdf
PBN 99/4 Evaluation of process plant corrosion/erosion incidents
HID CI 5B Under-lagging corrosion of plant and pipework
OTI 95 635 A test method to determine the susceptibility to cracking of linepipe steels in
sour service
369
+44 (0)207 467 7100
Corrosion prediction and risk assessment in oil and gas production

CRR 363/2001 Best practice for risk based inspection as a part of plant integrity management,
http://www.hse.gov.uk/research/crr_pdf/2001/crr01363.pdf
RR016 Guidelines for use of statistics for analysis of sample inspection of corrosion
KP4 report Ageing and life extension programme: http://www.hse.gov.uk/offshore/ageing/
kp4-report.pdf
Managing ageing plant: A summary guide
RR509 Plant ageing: Management of equipment containing hazardous fluids or pressure,
http://www.hse.gov.uk/research/rrpdf/rr509.pdf.
RR823 Plant ageing study: Phase 1 report, ESR Technology Limited, http://www.hse.gov.uk/
research/rrpdf/rr823.pdf
Offshore Information Sheet No. 4/2009 Guidance on management of ageing and thorough
reviews of ageing installations, http://www.hse.gov.uk/offshore/infosheets/is4-2009.pdf
Offshore Technology Report OTO 2000 052 Fatigue reliability of old semi-submersibles,
http://www.hse.gov.uk/research/otopdf/2000/oto00052.pdf
OTO 2001/088 Beyond lifetime criteria for offshore cranes, BAE Systems (Land and Sea
Systems) Ltd, http://www.hse.gov.uk/research/otopdf/2001/oto01088.pdf
Offshore Information Sheet No 5/2007 Ageing semi-submersible installations, http://www.
hse.gov.uk/offshore/infosheets/is5-2007.pdf
Institution of Engineering and Technology (IET)
Safety, competency and commitment: Competency guidelines for safety-related system

practitioners
International Organisation for Standardisation (ISO)
13680 Corrosion-resistant alloy seamless tubes for use as casing, tubing and coupling stock
– Technical delivery conditions
15510 Stainless steels – Chemical composition
7539-7 Corrosion of metals and alloys – Stress corrosion testing – Part 7: Slow strain rate
testing
12747:2011 Petroleum and natural gas industries – Pipeline transportation systems –
Recommended practice for pipeline life extension
National Association of Corrosion Engineers (NACE)
An historical perspective of the management of ageing infrastructures, D Geary,

J L Dawson and D G John
Corrosion engineers’ reference book, ed. Robert Baboin, 3rd edition
Corrosion engineering, M G Fontana, 3rd edition
Corrosion-resistant alloys in oil and gas production, eds. J. Kolts and S. Ciaraldi
Corrosion under wet thermal insulation, eds. W I Pollock and C N Steely
370
+44 (0)207 467 7100
Fundamentals of designing for corrosion control: A corrosion aid for the designer, R.J.
Landrum
MR0176 Metallic materials for sucker-rod pumps for corrosive oilfield environments
TPC 3 Microbiologically influenced corrosion and biofouling in oilfield equipment
TPC 5 Corrosion control in petroleum production, H G Byars, 2nd edition
MR0175/ISO 15156-1 Materials for use in H2S-containing environments in oil and gas
production – Part 1: General principles for selection of cracking-resistant materials
TM0177 Laboratory testing of metals for resistance to sulfide stress cracking and stress
corrosion cracking in H2S environments
TM0198 Slow strain rate test method for screening corrosion-resistant alloys (CRAs) for stress
corrosion cracking in sour oilfield service
TM0284 Evaluation of pipeline and pressure vessel steels for resistance to hydrogen-induced
cracking
Corrosion/97, Paper 58, Rippled strain rate test for CRA sour service materials selection, W J
R Nisbet, R H C Hartman, G van den Handel
Corrosion 2003, Paper 03179, Application of internal corrosion modelling in the risk
assessment of pipelines, Gartland,Per O, Johnsen, Roy and Ingar Øvstetun, Ingar
RP0192 Monitoring corrosion in oil and gas production with iron counts
RP0497 Field corrosion evaluation using metallic test specimens
RP0775 Preparation, installation, analysis, and interpretation of corrosion coupons in oilfield
operations
Technical Committee Report 1C187 Use of galvanic probe corrosion monitors in oil and gas
drilling and production operations
Technical Committee Report 3D170 Electrical and electrochemical methods for determining
corrosion rates
Technical Committee Report 3T199 Techniques for monitoring corrosion and related
parameters in field applications
Field guide for investigating internal corrosion of pipelines, R Eckert
NORSOK
M-001 Materials Selection, Revision 2

OTO 1999/064 Corrosion risk assessment and safety management for offshore processing
facilities
Z-CR-008 Criticality classification method, Revision 1
M-506 CO2 Corrosion rate calculation model, Revision 1
M-CR-505 Corrosion monitoring design, http://www.standard.no/pronorm-3/data/
f/0/01/37/0_10704_0/M-505-CR.pdf
Y-002 Life extension for transportation systems
371
+44 (0)207 467 7100
Norwegian Oil and Gas Association
Recommended guidelines for the assessment and documentation of service life extension
of facilities
Oil and Gas UK
Hydrocarbon release reduction toolkit

HS073 Guidance on the management of ageing and life extension for UKCS oil and gas
installations
Guidance on the management of ageing and life extension for UKCS floating production
installations, Issue 1
SINTEF
A15322 Ageing and life extension for offshore facilities in general and for specific systems
Step Change in Safety
Step Change Asset integrity toolkit, www.stepchangeinsafety.net/stepchange/resources_

asset.aspx
TWI Certification Ltd. http://www.cswip.com
Personnel certification in non-destructive testing (PCN), http://www.twi.co.uk/j32k/

unprotected/band_1/pcn.html
United Kingdom Accreditation Service (UKAS)
RG2 Accreditation for in-service inspection of pressure systems/equipment
Other
Managing competence for safety-related systems, HSE, Institution of Engineering Technology

and the British Computer Society
Developing and maintaining staff competence, Office of Rail Regulation, second edition,
Metallurgy for engineers, Rollason, E C, Edward Arnold, 3rd edition
Corrosion and materials engineering for oil and gas production
Corrosion control in oil and gas production, CorUPdate Inc, R.S. Treseder and R.N. Tuttle
1998 edition
Handbook of corrosion data, Materials data series, ASM International, D Craig, D B Anderson,
2nd edition Handbook of materials selection, John Wiley and Sons Inc, ed. M Kutz
Metallic materials specification handbook, R B Ross, Springer, 4th edition
372
+44 (0)207 467 7100
Principles and prevention of corrosion, D A Jones, Prentice Hall, 2nd edition

Pipeline corrosion risk analysis – An assessment of deterministic and probabilistic methods,
Anti-Corrosion Methods and Materials, Vol 52, No 1, pp 3–10, K Lawson
CO2 corrosion nomogram, C de Waard, D E Milliams, CorCon website, http://www.xs4all.
nl/~cdewaard/
An integrated approach to accurate corrosion prediction, Journal of Petroleum Technology,
Vol 58, No 5, pp 76–79, K Bybee
Extreme value statistics and its relevance to corrosion engineering, Institute of Corrosion, D
G John, P J Laycock
Introduction to life prediction of industrial plant materials – application of extreme value
statistical method for corrosion analysis, Allerton Press Inc, M Kowaka,
Probability and statistics in engineering, John Wiley and Sons, W W Hines, D C Montgomery,
D M Goldsman and C M Borror
Statistical analysis of extreme values, Birkhauser Verlag, R D Reiss and M Thomas
Extreme value prediction of maximum pits on pipelines, Materials Performance, March 1977,
pp 29–32, D E Hawn.
Statistical analysis of UT corrosion data from floor plates of a crude oil above ground storage
tank, Material Evaluation, Vol 52, No 7, July 1994, pp 948–849. Erratum, Vol 52 No 11, Nov
1994 p 1285, N R Joshi
Extrapolation of extreme pit depth in space and time, Electrochem. Soc., Vol 137, No 1,
1990, pp 64–69, P J Layceck, R A Cottis, and P A Scarf
Predicting the remaining lifetime of in-service pipelines based on sample inspection data,
Insight, Vol 43, No 2, pp 102–104, C R A Schneider, A Muhammed and R M Sanderson
Statistical tools for ultrasonic thickness data analysis, Part 1 – Piping Thickness Analysis,
Inspectioneering Journal, M Sparago,
Statistical tools for ultrasonic thickness data analysis, Part 2 – remaining life estimates,
Inspectioneering Journal, M Sparago,
Statistical approach to inspection planning and integrity assessment, Insight: Non-Destructive
Testing and Condition Monitoring, Vol 49, Issue 1, pp 26–36, F I Khan and R Howard
Statistical characterization of pitting corrosion – Part 2: Probabilistic modelling of maximum
pit depth, Corrosion, Vol 61, No 8, pp 766–777, R E Melchers
373
+44 (0)207 467 7100
ANNEX O
DOCUMENT REFERENCES
[1] http://www.hse.gov.uk/pubns/priced/HSG65.pdf
[2] http://www.hse.gov.uk/offshore/ageing/kp4-report.pdf
[3] http://www.iom3.org/corrosion-committee/corrosion-committee-board
[4] https://www.nace.org/Publications/Cost-of-Corrosion-Study/
[5] EI Guidelines for the materials selection and corrosion management of downhole
production and injection well equipment
[6] EI Guidelines for the avoidance of vibration induced fatigue failure in process
pipework, 2nd edition
[7] HSG 65 http://www.hse.gov.uk/pubns/books/HSG65.htm
[8] http://www.hse.gov.uk/offshore/offshore-oil-and-gas.pdf
[9] http://www.hse.gov.uk/risk/faq.htm
[10] www.hse.gov.uk/research/rrpdf/rr509.pdf
[11] http://www.hse.gov.uk/research/rrpdf/rr823.pdf
[12] Analysis of root causes of major hazard precursors (hydrocarbon leaks) in the
Norwegian offshore petroleum industry, Reliability Engineering and System Safety,
95/11, 2010, pp 1142–1153, Vinnem, Hestad, Kvaløy & Skogdalen
[13] http://www.legislation.gov.uk/uksi/2015/398/regulation/8/made
[14] http://www.legislation.gov.uk/uksi/2015/483/pdfs/uksi_20150483_en.pdf
[15] http://www.hse.gov.uk/risk/theory/alarpglance.htm
[16] The Management of Health and Safety at Work Regulations 1999
[17] http://www.hse.gov.uk/competence/what-is-competence.htm
[18] http://www.hse.gov.uk/competence/what-is-competence.htm
[19] www.hse.gov.uk
[20] http://www.engc.org.uk/
[21] http://www.engc.org.uk/engcdocuments/internet/Website/UK-SPEC%20third%20
edition%20(1).pdf
[22] Chemistry, Physics, Mechanical Engineering, Metallurgy, Chemical Engineering,
Maths
[23] https://www.gov.uk/government/uploads/system/uploads/attachment_data/
file/471452/UKCS_Maximising_Recovery_Review_FINAL_72pp_locked.pdf
[24] E.g. Institute of Corrosion, National Association of Corrosion Engineers, Institute of
Materials, Institute of Mechanical Engineers
[25] http://www.hse.gov.uk/humanfactors/introduction.htm
[26] http://www.hse.gov.uk/humanfactors/jee.htm
[27] https://www.energyinst.org/technical/human-and-organisational-factors/human-
factors-top-ten
[28] An independent review into the broader issues surrounding the loss of the RAF
Nimrod MR2 Aircraft XV230 in Afghanistan in 2006.
[29] The challenger launch decision: Risky technology, culture and deviance at NASA, The
University of Chicago Press Diane Vaughan.
[30] Health & Safety At Work etc Act 1974
[31] http://www.hse.gov.uk/risk/theory/alarpglance.htm
[32] http://www.hse.gov.uk/offshore/directive.htm
[33] HSE: The Safety Report Assessment Manual
[34] Fire, Explosion and Risk Assessment Safety Case Assessment Topic Guidance
[35] de Waard C, Lotz U (1994) Prediction of CO2 Corrosion of Carbon Steel EFC
Publication No 13. The Institute of Materials, London
374
+44 (0)207 467 7100
[36] de Waard C, D.E Williams (1975) Prediction of Carbonic Acid Corrosion in Natural
Pipelines, First International Conference on the Internal and External Protection of
Pipes, BHRA, Cranfield, UK
[37] NORSOK standard M-001, Rev. 5, Sept. 2014
[38] Zav'yalov, V. V., "Corrosion of Oilfield Pipelines", Protection of Metals, Vol. 39, No. 3,
2003, pp. 274–277.
[39] EEMUA 200 Guide to the specification, installation and maintenance of spring
supports for piping
[40] EI Guidelines for the integrity management of corrosion under pipe supports (CUPS)
[41] BS 4592-0:2006 + A1:2012, Industrial type flooring and stair treads – Part 0: Common
design requirements and recommendations for installation
[42] BS 4592-1:2006 Industrial type flooring and stair treads – Part 1: Metal open bar
gratings – specifications
[43] BS5395-3:1985 Stairs, ladders and walkways – Part 3 Code of Practice for the design
of industrial type stairs, permanent ladders and walkways
[44] NORSOK Standard C-002, Architectural components and equipment, edition 3, June
2006
[45] MMS Safety Alert 194: Guardrails (https://www.bsee.gov/sites/bsee.gov/files/safety-
alerts/safety/safety-alert-no-194.pdf)
[46] PD 6484:1979 Commentary on corrosion at bimetallic contacts and its alleviation
[47] EI Guidelines for the management of the integrity of bolted joints for pressurised
systems
[48] BS EN 61537:2007, Cable management – Cable tray systems and cable ladder
systems
[49] National Physical Laboratory, Guides for good practice In corrosion control – Pumps
and valves, http://www.npl.co.uk/lmm/docs/pumps.pdf
[50] HSE Offshore Information Sheet 7/2007 Stress corrosion cracking of duplex stainless
steel piping systems in hot chloride service.
[51] HSE RR129 Review of external stress corrosion cracking if 22 %Cr duplex stainless
steel.
[52] Chloride Stress Corrosion Cracking of Duplex Stainless Steels in the Absence of
Oxygen, HSE Research Report 298, 2005.
[53] NORSOK Standard M-001, Materials Selection.
[54] ISO 21457 Materials selection and corrosion control for oil and gas production
systems
[55] Definition from NACE Corrosion engineers’ reference book, 3rd edition
[56] NACE Corrosion engineer's reference book, 3rd edition
[57] EI Guidelines on sand erosion and erosion-corrosion management
[58] BS EN ISO 13703:2000 Petroleum and natural gas industries — Design and installation
of piping systems on offshore production platforms
[59] DNV RP O501 Erosive wear in piping systems
[60] API RP14E Design and installation of offshore production platform piping systems
[61] HSE RR115, Erosion in elbows in hydrocarbon production systems: Review document
[62] EI Guidelines on sand erosion and erosion-corrosion management
[63] Corrosion problems in seawater pump caissons. Practical solutions. S M Wigen &
H Osvoll. NACE Corrosion 2006, Paper 06105
[64] Internal corrosion protection of offshore sea water pump caissons, R Jacob,
J. Baynham, B. Wyatt & T. Froome, Eurocorr 2016, Paper 65987
[65] Industry survey study report – Offshore caissons integrity, iicorr June 2009
[66] Eurocorr 2016, Paper 65987
[67] NACE Corrosion 2006, Paper 06105
[68] HOIS(13)R6 Guidance on in-service inspection and integrity management of caissons,
375
+44 (0)207 467 7100
[69] https://www.nace.org/CORROSION-FAILURES-San-Francisco-Bay-Bridge-Bolt-Failure.
aspx
[70] HSE Bulletin ED 2-2015, 18/9/2015. Catastrophic failure of a pipework clamp
connector
[71] The standard scales for quantifying coating breakdown are in BS EN ISO 12944
Annex K, parts 1–8.
[72] Photographic and diagrammatic guides to the degree of rusting, etc, are available.
[73] www.astm.org
376
+44 (0)207 467 7100
ANNEX P
GLOSSARY OF TERMS
P.1 TERMS
Phrase Definition
as low as assessment of the risk to be avoided, and an assessment of the sacrifice
reasonably (in money, time and trouble) involved in taking measures to avoid that risk,
practicable and a comparison of the two to ensure there is no gross disproportionation
corrosion the corrosion management programme is that part of the overall
management management system, which is concerned with the development,
programme implementation, review and maintenance of the corrosion policy (HSE OTR
2001/044)
duty holder legally responsible person for the operation and safety of an installation as
defined in the Offshore Safety Case Regulations
hazard that which has the potential to cause harm or damage
installation an offshore structure associated with the drilling and/or production of
hydrocarbons as defined in the Offshore Safety Case Regulations
in-line refers to installation of monitoring equipment directly in the bulk of the
monitoring process, but data acquisition requires extraction of probes or process shut
down for analysis, e.g. corrosion coupons, bio-studs, etc
intrusive requires penetration through the pipe or vessel wall to gain access to the
monitoring interior of the equipment
key performance a measure of performance, preferably quantitative
indicator
non-intrusive monitoring from the outside of the pipe or vessel without having to gain
monitoring access to the interior of the equipment
off-line refers to measurements carried out on the equipment intermittently, for
monitoring example analysis of liquid samples, non-intrusive inspection (e.g. UT, PEC,
radiography, etc)
on-line refers to installation of monitoring equipment for continuous measurement
monitoring/ of metal loss, corrosion rate or other parameters in an operating system.
inspection Data are obtained without the requirement to remove the monitoring
device, e.g. LPR probes, ER probes, fixed ultrasonic transducers, etc
operator the operator of the pipeline is the person who has control of the pipeline at
any time during all stages of its life cycle from the design stage through to
final decommissioning
person a 'person' is an individual or company who has responsibilities for ensuring
the health and safety of employees and service providers when working on
a site for which they have responsibilities
proactive to investigate/review an item without any prior requirement. Use to predict
indicator events rather than to react to them. Also referred to as a leading indicator
377
+44 (0)207 467 7100
Phrase Definition
so far as is essentially the same as ALARP: assessment of the risk to be avoided, and an
reasonably assessment of the sacrifice (in money, time and trouble) involved in taking
practicable measures to avoid that risk, and a comparison of the two to ensure there is
no gross disproportionation
reactive indicator to investigate/review an item following an incident or some other factor
which prompts the investigation. Also referred to as a lagging indicator
risk the combination of the severity of the effect (the consequences) and the
likelihood of it happening (damage mode and probable frequency)
service provider a contracting or consulting company and/or person providing goods and/or
services to the Duty Holder or Owner of an installation
third party technical persons not directly employed by the Duty Holder or Owner of an
installation
P.2 ABBREVIATIONS
Abbreviation Description
ACOP approved code of practice
ALARP as low as reasonably practicable
ALE ageing and life extension
APB acid producing bacteria
API American Petroleum Institute
ASME American Standards for Mechanical Engineering
ASNT American Society of Non-Destructive Testing
ASTM American Society for Testing and Materials
CI corrosion inhibitor
CM corrosion management
CIP close interval potential
CMT corrosion management team
CMP corrosion management plan
CMS corrosion management system
CONC criteria of non-conformance
CoP cessation of production
CP cathodic protection
CRAS corrosion risk assessment system
CRA corrosion resistant alloy
CSWIP certification scheme for weldment inspection personnel
CTA corrosion threats assessment
DA deaerator tower
378
+44 (0)207 467 7100
DCR Offshore Installations And Wells (Design And Construction, Etc)
Regulations 1996 (SI 1996/913)
DCS distributed control system
DNV Det Norsk Veritas
DCVG direct current voltage gradient
ECA effective corrosion allowance
EEMUA Engineering Equipment and Materials Users Association
EFC European Federation of Corrosion
EI Energy Institute (formerly the Institute of Petroleum)
EMF electromagnetic force
ER electrical resistance
EVS extreme value statistics
FSM field signature method
HAZ heat affected zone
HIC hydrogen induced cracking
HSC hydrogen stress cracking
HSE Health and Safety Executive
HS&E Health, Safety and Environment
HSG Health and Safety Guide
HSWA Health And Safety At Work Etc Act 1974
ICORR Institute of Corrosion
ILI in line inspection
ISO International Standards Organisation
KPI key performance indicator
LPR linear polarisation resistance
LSA low specific activity
MAPD major accident prevention document
MAWT minimum allowable wall thickness
MCDR material corrosion damage report
MHSWR Management Of Health And Safety At Work Regulations 1992
MIC microbially induced corrosion
MMA manual metal arc
MMS maintenance management system
MPN most probable number
NACE National Association of Corrosion Engineers, NACE International
NII non-intrusive inspection
NDT non destructive testing
OBVI opportunistic based visual inspection
OLI on line inspection
379
+44 (0)207 467 7100
OSDSCR The Offshore Installations (Offshore Safety Directive) (Safety Case etc.)
Regulations 2015
PCN personnel certification in non-destructive testing
PEC pulse eddy current
PFD process flow diagram
PFEER Offshore Installations (Prevention of Fire and Explosion, and Emergency
Response) Regulations 1995 (SI 1995/743))
P&ID piping and instrumentation diagram
PMR PM routines
PV pressure vessel
PLL potential for loss of life
PPD pour point depressant
PREN pitting resistance equivalent number
PSV pressure safety valve
PWC preferential weld corrosion
PWHT post weld heat treatment
PWRI produced water re-injection
QRA quantitative risk assessment
RAD radiographic NDT
RBI risk based inspection
RCS risk control system
SCADA Supervisory, Control and Data Acquisition (System)
SCR15 The Offshore Installations (Offshore Safety Directive) (Safety Case etc.)
Regulations 2015
SFAIRP so far as is reasonably practicable
SHE Safety, Health and Environment
SMS safety management system
SRB sulfate-reducing bacteria
SSCC sulfide stress corrosion cracking
TFD time of flight diffraction
TIG tungsten inert gas
TSA thermally sprayed aluminium
TQM total quality management
UK United Kingdom
UKAS United Kingdom Accreditation Service
UKCS United Kingdom Continental Shelf
UKOOA UK Oil and Gas Operators Association (Now UK Oil and Gas)
UT ultrasonic NDT
ViPA visual process analyser
380
+44 (0)207 467 7100
VPI vapour phase inhibitor
WSoE written scheme of examination
381
+44 (0)207 467 7100
This publication has been produced as a result of
work carried out within the Technical Team of the
Energy Institute (EI), funded by the EI’s Technical
Partners and other stakeholders. The EI’s Technical
Work Programme provides industry with cost
effective, value adding knowledge on key current
and future issues affecting those operating in the
Energy Institute energy industry.
61 New Cavendish Street
London W1G 7AR, UK
t: +44 (0) 20 7467 7100
e: pubs@energyinst.org
www.energyinst.org
9781787250642
ISBN 978 1 78725 064 2

Registered Charity Number: 1097899
+44 (0)207 467 7100

EI Corrosion Management

Uploaded by

Copyright:

Available Formats

EI Corrosion Management

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

EI Corrosion Management

Uploaded by

Copyright:

Available Formats

Guidance for corrosion management in

oil and gas production and processing

The EI is licensed by:

For further information, please visit http://www.energyinst.org

Copyright © 2019 by the Energy Institute, London.

ISBN 978 1 78725 064 2

Published by the Energy Institute

2 Reason for document layout ���������������������������������������������������������������������������������������� 28

Annex A Structured framework for corrosion management ������������������������������������������ 65

Annex C Ageing and life extension ���������������������������������������������������������������������������������� 93

Annex I Oil and gas production and processing corrosion threats

Annex L Checklist for assessment of corrosion management in oil and

Annex M International standards and guides relating to corrosion

Annex O Document references ���������������������������������������������������������������������������������������� 374

LIST OF FIGURES AND TABLES

Figure 1 HSG65 PLAN-DO-CHECK-ACT�������������������������������������������������������������������������������� 29

Figure I.64 BP accumulations in a metering station������������������������������������������������������������������ 287

Table 1 Difficult to identify and quantify corrosion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

List of figures and tables continued

This guidance is useful to:

The Technical Department,

Corrosion Management Committee (CMC) Members

Observer and Guest Members

STEERING GROUP CHAIR'S FOREWORD

Annex D offers guidance on normal good practice for corrosion management.

Annex E contains information on organisational requirements for corrosion management.

Annex F provides overview advice on corrosion risk assessment and planning.

Annex H gives information on audits.

Annex J contains information on mitigation methods for the corrosion threats.

Annex K contains information on how to conduct failure investigations.

Annex M contains a list of standards and guidance relating to corrosion management.

Annex N contains the bibliography.

Table 1: Difficult to identify and quantify corrosion

Corrosion threat Reason for difficulty Requires more industry

1.2 SCOPE OF APPLICATION

1.2.1 Management system scope

1.2.2 Production facilities scope

The guidance applies to the following facilities:

This guidance does not specifically cover:

1.2.3 Deterioration processes scope

1.2.4 Structured framework for corrosion management support function

The corrosion support function may consist of a combination of:

2 REASON FOR DOCUMENT LAYOUT

In 2013 HSG657 was revised to create the PLAN-DO-CHECK-ACT approach, which

Table 2: Comparison of HSG65 to conventional health and safety and to process

PLAN-DO- Conventional health and safety Process safety

CHECK Measure performance (monitor Implement and manage control

HSG65 describes a circular relationship between PLAN-DO-CHECK-ACT which is reproduced

Figure 1: HSG65 PLAN-DO-CHECK-ACT

In relation to this guidance, the PLAN section of HSG65 requires Duty

−− who is responsible for achieving the CM aims;

'the person who is in control of the operation of an establishment, or in relation to an

In essence, a Duty Holder/Operator is in overall control of the asset/installation, and must

In relation to this guidance, the DO section of HSG65 requires Duty

– undertake CM audits, and

In relation to this guidance, the ACT section of HSG65 requires Duty

Figure 2: HSG65 PLAN

2.1.2 Legal framework

2.1.3 Worldwide legal basis for corrosion management

2.1.4 High level integrity management policy

2 Reason for document layout �� 28

Annex A Structured framework for corrosion management �� 65

Annex C Ageing and life extension �� 93

Annex I Oil and gas production and processing corrosion threats

Annex L Checklist for assessment of corrosion management in oil and

Annex M International standards and guides relating to corrosion

Annex O Document references �� 374

Figure 1 HSG65 PLAN-DO-CHECK-ACT�� 29

Figure I.64 BP accumulations in a metering station�� 287

Table 1 Difficult to identify and quantify corrosion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24