Making an offshore corrosion rate defensible before the auditor arrives

Why offshore changes the corrosion rate question

Onshore, a condition monitoring location is a painted circle you can walk to in ten minutes. Offshore, every reading carries a cost structure: a helicopter seat, a bed on the platform, a permit to work, a rope access team or a diver, and a weather window that may close before the scope is finished. That cost pushes frequency down and interval length up, and the rate arithmetic is exquisitely sensitive to interval length. A 0.004 in disagreement between two readings is 4 mpy across a one-year interval and 1 mpy across a four-year interval. The same instrument error produces a rate that differs fourfold purely because of when the boat could sail.

The damage mechanisms differ too. Sweet CO2 corrosion in wet gas gathering, top-of-line corrosion where condensation forms at twelve o'clock on a cooled flowline, under-deposit attack beneath solids in a low spot, microbiologically influenced corrosion in produced water and seawater injection systems, sand erosion at chokes and the first bend downstream, and corrosion under insulation aggravated by marine air and by passive fire protection that nobody wants to cut. Each has a different time signature, and several are step functions rather than slopes. A single averaged rate per line flattens all of them into a number that describes none of them.

Then there is the question of who owns the record. On most offshore assets the operator owns the integrity management system, an NDT contractor takes the readings, an engineering consultancy runs the fitness-for-service work, and a certifying authority, client or regulator audits all three. The corrosion rate is the number where those four parties meet, and it is invariably the number they disagree about first.

The two rates, and what the code actually requires

The long-term rate takes the earliest reliable thickness for a location, subtracts the current thickness, and divides by the elapsed years. The short-term rate does the same using the previous inspection instead of the earliest. Remaining life is the current thickness minus the required minimum thickness, divided by the governing rate. The next inspection interval is the lesser of half that remaining life and the maximum the code allows for the equipment class. The governing rate is the larger of the two unless a corrosion specialist documents a technical reason for using the smaller.

The asymmetry is deliberate. A long-term rate damps measurement noise and gives a stable planning number, but it is blind to change. A short-term rate is noisy but sees acceleration. By making the larger one govern, the code accepts a certain rate of false alarms in exchange for not missing a genuine step change. Software that computes only one rate, or averages the two, has quietly removed the safety behaviour the code was built around, and no auditor who understands the method will let that pass.

The rule also has a legitimate exit, and a good system makes that exit expensive rather than easy. A specialist may justify using the lower rate — for example when a short-term spike is traced to a demonstrated measurement artefact rather than metal loss. That justification is an engineering record: the mechanism, the evidence, a named individual, a date, and enough reasoning to stand up after that individual has left the company. If a planner can suppress a short-term rate with a dropdown and no artefact, the audit finding writes itself.

CML identity is the first thing an audit breaks

The formula assumes that both thickness values came from the same piece of steel. Offshore, that assumption is fragile in ways that rarely get written down. Grids are re-established from scaffold that was not in the same place last campaign. A rope technician reads what can physically be reached. A six o'clock location under an insulation band gets read at five o'clock because the band would not move. A spool is replaced during a shutdown and the old CML number is carried forward onto new pipe, so the next long-term rate is computed across a component boundary.

The observable symptom is the negative corrosion rate: this year's reading is thicker than last year's. Most systems either clamp the value to zero or drop the point from the trend. Both responses hide the real finding. A negative rate is not noise to be filtered — it is a measurement telling you that the two numbers came from different places, different temperatures, different transducers or different surface conditions. On a well-run offshore dataset, negative rates cluster around exactly the locations where access is hardest, which is precisely where you least want your data to be wrong.

A defensible system does the opposite of filtering. It keeps negative rates visible and demands a disposition. It stores photographs and a datum sketch against the CML rather than against the line, so the next technician can find the same spot. It versions the location when a component is replaced, starting a fresh long-term baseline and refusing to compute a long-term rate across the replacement. And it records who established the grid, because grid establishment is an engineering act, not a clerical one.

Readings taken hot, cold, and through coating

Ultrasonic velocity in carbon steel falls as temperature rises, roughly one percent per 100F. A gauge calibrated at ambient and used on a producing line therefore over-reads. On a 0.600 in riser wall read at 200F with no correction, that is about 0.006 in of metal that is not there. Across a one-year interval, 0.006 in is 6 mpy — comparable to the actual CO2 corrosion rate on many wet gas lines. If one campaign is taken on a running line and the next during shutdown, the correction error changes sign and the trend inverts.

Coating introduces a second systematic offset. A single-echo gauge measuring through paint includes the paint in the reading. Echo-to-echo mode removes it, but needs adequate back-wall signal and may fail on rough or heavily corroded surfaces. Offshore coating systems are thick, and passive fire protection thicker still. A contractor who switches from through-paint single-echo to echo-to-echo between campaigns generates an apparent step loss of ten to twenty thousandths across hundreds of CMLs simultaneously. That produces a fleet-wide short-term rate alarm from a method change, and an integrity engineer who cannot explain it will either ignore the whole dataset or spend a shutdown chasing corrosion that does not exist.

The requirement follows directly. The record must carry the instrument and firmware, the measurement mode, the transducer type and frequency, the couplant, the calibration block and its traceability, the surface preparation, and the metal temperature at the moment of reading. With those fields, a step change can be attributed to a method change in an afternoon. Without them, it cannot be attributed at all, and the honest engineering answer is that the previous decade of trend is unusable.

Sour service produces rates that are not corrosion

In H2S service governed by NACE MR0175 / ISO 15156, hydrogen-induced cracking and blistering create planar features inside the wall. An ultrasonic thickness gauge reading a mid-wall blister returns the echo from the blister, not the back wall, and reports roughly half the nominal thickness. Loaded as a thickness value, that produces a short-term rate in the hundreds of mils per year and a remaining life measured in weeks. The number is physically impossible for uniform corrosion, and the correct response is not to compute a rate at all but to reclassify the indication.

This is why a rate module has to be mechanism-aware rather than purely arithmetic. A location tagged for wet H2S damage — HIC, SOHIC, stepwise cracking, sulfide stress cracking — should route to an evaluation workflow requiring A-scan or full waveform review, not to a trend line. API RP 571 gives the mechanism definitions; the software's job is to make the tag consequential, so that tagging a CML changes what the system does with its data rather than adding a label nobody reads.

The same principle covers other non-thinning mechanisms present offshore: chloride stress corrosion cracking in austenitic stainless under insulation, fatigue at small-bore connections on vibrating lines, and preferential weld corrosion where the weld metal chemistry differs from the parent. None of these are described by a thickness slope. A rate engine that treats all metal loss as uniform corrosion will convert a cracking finding into a thinning statistic, and the statistic will look reassuringly ordinary right up until it is not.

Weather windows, deferrals, and the interval that quietly expired

An offshore inspection plan is a set of dates that the weather negotiates with. When a campaign slips, the equipment does not become safer; the interval simply gets longer. Audits check two things here: whether any next-inspection date was exceeded, and whether an exceedance was formally assessed and approved rather than absorbed. A deferral captured in an email thread and a spreadsheet cell is the single most common integrity documentation finding on offshore assets, and it is entirely a systems problem rather than an engineering one.

There is a subtler failure underneath it. Stretching the interval also stretches the denominator of the short-term rate. A location read at twelve months, then at thirty-six, has a short-term rate computed over three years — which mathematically converges toward the long-term rate. The system's own early-warning mechanism goes quiet at exactly the moment the asset has gone longest without being looked at. Nobody suppressed the alarm; the arithmetic did it for them.

The countermeasure is to track the interval clock as a separate object from the rate. The system should know the due date, the actual date, the deferral request, the risk assessment that supported it, the approver, and the expiry of that approval. It should flag rates computed across unusually long intervals as lower confidence, so a planner reading a trend chart can see that a flat-looking line is flat because it is under-sampled rather than because the corrosion stopped.

Sand, chokes, and the step change a long-term rate will not show

API RP 14E gives the familiar erosional velocity relationship, with the fluid velocity limit inversely proportional to the square root of mixture density and scaled by an empirical C-factor. It is a screening tool rather than a prediction, but it captures the essential point: velocity and solids together drive a loss mechanism that has nothing to do with electrochemistry and does not respond to inhibitor. A sanding well can put an order of magnitude more metal loss into the first bend downstream of a choke than the underlying CO2 corrosion rate would ever produce.

Run the arithmetic on a real shape of failure. A bend has lost 0.180 in over twelve years of service: a long-term rate of 15 mpy. If 0.120 in of that loss occurred in the last fourteen months after a workover, the short-term rate is roughly 103 mpy. With 0.140 in of wall available above the required minimum, remaining life is 9.3 years on the long-term rate and 1.4 years on the short-term rate. One number puts the component in the next five-year plan; the other puts it in the next shutdown. This single divergence is the entire justification for computing both.

What makes the short-term number credible to an auditor is a cause. If the system links condition monitoring locations to process and well events — sand detector alarms, choke position changes, a new tie-in, gas lift startup, a change in water cut — then the spike arrives with an explanation attached. Without that linkage, an engineer facing a hundred-mpy short-term rate has only two options: believe it and spend money, or disbelieve it and write a justification that will not survive review.

How to evaluate a system before the audit, not during it

The most informative demonstration you can ask for takes twenty minutes and uses your own data. Bring five real condition monitoring locations from your least tidy dataset, including at least one that has produced a negative rate and one where a spool was replaced. Ask the vendor to load them and reproduce your published remaining life and next inspection date, then ask to see the evidence chain behind one of those numbers — reading, datum, temperature, mode, technician certification valid on that date, calibration traceability. Most systems can show a chart. Fewer can show a chain.

Then test the behaviours that matter under audit rather than under demonstration. How does the system handle a negative rate — does it hide it, or force a disposition? What does it require before a short-term rate can be set aside? Does replacing a component start a new baseline automatically? Can a damage mechanism tag change how a location is processed rather than just how it is labelled? Are technician certifications live objects that expire and block, or are they scanned PDFs in a folder? Can you export the full audit trail for one location without a support ticket?

Atlantis builds inspection management, reporting and digital twin software around exactly this chain, configured to the way an offshore operator or an NDT service provider already works rather than forcing a rewrite of the procedure. The positioning is affordable, accessible and fully customizable. If you want to see the negative-rate workflow and the evidence chain run against your own CML history, request a demonstration or a consultation at info@atlantisndt.com and bring the messy data — it is more useful than the clean data.

Request a consultation