Moving Years of Offshore Thickness History Into a New Registry Without Inventing Corrosion

What is actually inside the legacy system

The tidy version of an offshore integrity migration is a table of locations with a table of readings hanging off it. The real version is layered. There is a core register created when the platform was commissioned, using a numbering scheme that encoded the line number and a sequence integer. There is a second layer from a re-lining or a project that renumbered part of the topsides and never fully propagated. There is a contractor-maintained database covering a period when inspection was outsourced. And underneath, boxes of scanned field sheets covering the years before any of it.

Each layer has its own conventions and its own gaps, and the seams between them are where the damage sits. A location that changed identity during a renumbering typically appears as two records, each holding half the history, and the corrosion rate computed on either half understates the total. Nobody notices, because the summary report only ever shows the current record.

Before any technical migration work begins, the single most valuable exercise is a census: how many locations, how many readings, across how many source systems and eras, in what units, and how many have a physical description good enough to re-find them. That census usually reframes the project. Teams that expected a data transfer discover they have a data reconstruction with a data transfer at the end of it.

The trap that fabricates twelve percent of corrosion

Seamless pipe manufactured to ASTM A106 may be supplied up to 12.5 percent under the nominal wall thickness, and this is entirely permissible. On a nominal 0.280 inch wall, that permits a genuine as-delivered thickness of 0.245 inches with no corrosion whatsoever. Legacy registers routinely recorded the nominal value as the baseline, because at commissioning nobody had measured anything and the schedule value was what was available.

When the first real ultrasonic reading arrives years later at 0.248 inches, the system sees 0.032 inches of loss. If that is spread over the elapsed years since commissioning it may look benign, but if the baseline date and the first reading date are close together, or if the interval was recorded incorrectly during a previous migration, the computed rate can be extreme. Offshore, where circuits are numerous and review time is scarce, these propagate straight into the remaining life ranking that drives scope.

The rule is simple to state and requires discipline to apply. A baseline that was never measured is not a reading. Import it, mark it as nominal, display it, and refuse to let it anchor a corrosion rate calculation. The first genuine measurement becomes the baseline, and the circuit carries a documented note that its early history is nominal. This costs the programme some apparent history and saves it from confidently wrong numbers.

Migrate observations, never conclusions

Legacy integrity tables are full of derived quantities: short-term rate, long-term rate, remaining life, next due date, sometimes a risk rank. Every one of them is a conclusion drawn by a previous system under assumptions nobody wrote down. Importing them feels efficient and it is the most common way a migration goes wrong, because it makes the new system's own calculations decorative.

The alternative is to import only what was observed: this thickness, at this location, on this date, by this technician, with this equipment, under these conditions. Everything else the new system computes. That has an immediate and uncomfortable consequence, which is the point of the exercise. The recomputed remaining life will disagree with the legacy value on a meaningful fraction of circuits.

Those disagreements are the deliverable. Each one is either a legacy error, a new configuration error, or a genuine difference in engineering basis, and all three need to be known before anyone plans a campaign against the new numbers. A migration that produces no disagreements has not recomputed anything. It has copied the old answers into a new interface and inherited every mistake in them without inheriting the ability to find them.

Offshore damage mechanisms the old identifiers were never built to carry

Upstream fluids are aggressive in ways the original register often did not describe. Carbon dioxide in produced fluids drives sweet corrosion whose rate is strongly dependent on temperature, partial pressure and water wetting, so two circuits on the same platform can differ by an order of magnitude. Where hydrogen sulphide is present, materials selection falls under ANSI/NACE MR0175 and ISO 15156 and the concern shifts partly from wall loss to cracking. Sand production drives erosion and erosion-corrosion at chokes, at the first bends downstream and at any geometry that turns the flow.

Water injection systems add microbiologically influenced corrosion and under-deposit attack at low points and dead legs. Wet gas lines can suffer preferential weld corrosion, which is invisible to a grid that reads parent metal either side of the weld and never the weld itself. Externally, the splash zone and the underside of topsides piping in a marine atmosphere corrode on a schedule of their own, and corrosion under insulation on heated lines does the rest.

A legacy identifier encoding only a line number and a sequence integer cannot express any of this. Part of the migration is therefore enrichment, not transfer: attaching an API 571 mechanism to each location, recording whether the point was chosen for a geometric reason such as an elbow extrados, and flagging the locations where the correct method is now corrosion mapping or weld-specific inspection rather than a spot reading. Skipping the enrichment produces a faster migration and the same blind spots in a newer database.

A missed location offshore costs more than the reading

Onshore, a location missed during a campaign is recovered with a truck and a technician. Offshore it is recovered with a helicopter seat, a bed, a weather window and, on a busy installation, a bump of somebody else's scope. Persons on board is a hard constraint, and inspection competes for it with drilling support, projects and maintenance. That economics is why offshore integrity teams care disproportionately about first-pass completion rate.

The registry is what makes first-pass completion achievable. A crew arriving with the previous readings, the datum description, the photograph, the access requirement and the surface preparation expected can work through a scope without returning to the office for clarification. A crew arriving with a list of identifiers spends its first day rediscovering the platform.

It also changes what belongs in the record. Scaffold requirement, rope access requirement, whether the point sits inside a hazardous area requiring a specific permit, and whether the last crew found it obstructed by a later piping modification are all things that cost a return trip if they are unknown and cost nothing to record. An obstructed location noted once and never resolved is a standing item that should surface every planning cycle rather than being rediscovered by each new crew.

Three audiences read the same history and want different things

An offshore operator's thickness history is read by more parties than a refinery's. The regulator wants evidence of a controlled system, whether that is a safety and environmental management system under 30 CFR Part 250 on the United States outer continental shelf or a safety case with a verification scheme under the United Kingdom regulations. In the latter case an independent competent person examines safety critical elements against a written scheme, and the inspection evidence has to be traceable and contemporaneous.

For a floating production unit, a classification society adds a further cycle with its own survey periodicity, and reconciling class survey requirements with API 510 and API 570 intervals for the same equipment is a routine planning headache. The two schemes were not designed together, and an item can be current under one and overdue under the other.

The registry cannot resolve the regulatory overlap, but it can stop it from generating duplicate work. One location, one history, multiple obligations attached to it, each with its own due date and its own audience. What must be avoided is the common pattern where class-driven inspection and integrity-driven inspection maintain separate records of the same steel, because they will diverge and the divergence will be found by whichever auditor arrives first.

A migration protocol that will survive an audit

Start with the census and freeze the source. Take a dated, hashed extract of every source system and keep it unchanged for the duration, so that any question about what the legacy system said has a single answer. Continuing to edit the legacy data during migration is how teams end up unable to explain their own numbers.

Migrate in the order identity, position, observation, then enrichment. Establish the location identities and their aliases first, including retired ones. Attach the physical descriptions and flag every location that lacks a re-findable datum as incomplete rather than migrated. Then load readings as observations with their source document reference retained. Only then attach mechanisms, criticality and inspection strategy.

Run the reconciliation before go-live, not after. For every circuit, compare the recomputed remaining life against the legacy value, and investigate every difference beyond an agreed tolerance individually, recording the cause. Publish the resulting list. It is uncomfortable reading and it is also the single strongest piece of evidence that the new system is trustworthy, because it shows exactly where and why it disagrees with what came before.

How to test a vendor's migration claim before you sign

Hand over a deliberately ugly sample: a few hundred readings including nominal baselines, mixed units, a renumbering seam, some NR and 0.000 entries and a spool replacement. Ask for the loaded result and the exception report. A vendor whose loader accepts all of it cleanly has silently made decisions on your behalf, and every one of those decisions is now embedded in your remaining life numbers.

Ask specifically what the system does with a zero. A 0.000 entry in a legacy thickness column is almost never a measurement, and a loader that accepts it will produce a location with no remaining life and an emergency flag, or will discard the whole record and lose the surrounding readings. The correct behaviour is to quarantine it as a coded non-reading and ask.

Then ask to see the reconciliation report format before the project starts. If the vendor cannot show you what the disagreement report between legacy and recomputed values will look like, they are not planning to produce one, which means they are planning to import your old conclusions. Atlantis runs this exercise against a real extract during scoping, and the output of that exercise, the exception list and the reconciliation format, is usually more informative than any demonstration. Requests go through info@atlantisndt.com.

Request a consultation