A Reliability-Centered Maintenance (RCM) Concept for Static Mechanical Equipment in Offshore Oil and Gas Operations

Full text

Text extracted from the article PDF for reading and search. Tables, figures and equations are in the PDF, which remains the authoritative version.

1. Introduction

Offshore oil and gas installations operate under a combination of conditions that few other industrial environments replicate: corrosive produced fluids containing carbon dioxide, hydrogen sulphide, chlorides, and sand; a saline marine atmosphere attacking external surfaces; severe weight and space constraints; limited bed space for maintenance personnel; and logistics chains in which a single replacement flange may take weeks to arrive by supply vessel. Within this environment, static mechanical equipment forms the pressure boundary of the entire process. Separators, scrubbers, heat exchangers, manifolds, kilometers of process piping, storage vessels, and the relief and flare systems that protect them together contain the vast majority of the hydrocarbon inventory on a platform or floating production unit. Major accident history demonstrates what is at stake. Investigations following the Piper Alpha disaster of 1988, and later regulatory reviews such as the United Kingdom Health and Safety Executive's Key Programme 3 on asset integrity, repeatedly identified degraded static equipment and deferred inspection as material contributors to hydrocarbon releases on the UK Continental Shelf (HSE, 2007). Loss of containment from a corroded pipe spool carries consequences of an entirely different order from the failure of a pump bearing, yet maintenance engineering literature and practice have traditionally concentrated on the latter. The offshore maintenance function also sits inside a wider operational ecosystem whose weaknesses it inherits. Studies of occupational safety management in oil and gas maintenance projects show that maintenance execution is itself a major accident exposure window requiring structured management systems (Obogo, Arumosoye, & Obriki, 2020c), and analyses of large energy infrastructure projects argue that safety risk control must be data-driven and designed into the work rather than added reactively (Obriki & Arumosoye, 2018). At the same time, research on procurement and materials management in energy facilities demonstrates that plant uptime is tightly coupled to strategic procurement and inventory availability (Okonkwo, Ogunwole, & Okeke, 2018a, 2018b), a coupling that offshore supply chains, with their vessel schedules and long lead times, amplify considerably. An RCM concept for static equipment must therefore be designed with these organizational, safety, and logistical interfaces in view.

Reliability-Centered Maintenance emerged from the civil aviation industry through the work of Nowlan and Heap (1978) and was codified for general industry by Moubray (1997) and the SAE JA1011 standard (SAE International, 2009). RCM asks what an asset must do, how it can fail to do it, what causes and consequences attach to each failure, and what task, if any, is worth doing to prevent or mitigate it. This logic is universally applicable in principle. In practice, however, classical RCM decision diagrams and their supporting statistical apparatus were built around failure behavior typical of rotating and electro-mechanical equipment: functions that degrade observably, failure modes detectable through vibration, temperature, or performance monitoring, and failure data plentiful enough to fit lifetime distributions.

Static equipment violates most of these assumptions. Its failures are rare, which makes conventional reliability statistics thin; its degradation is governed by physical and chemical mechanisms such as corrosion and cracking rather than by mechanical wear; its condition is largely hidden beneath insulation, cladding, and paint; and the consequence of its dominant failure mode, loss of containment, is potentially catastrophic. Applying an unmodified RCM template to a separator or a piping circuit therefore tends to produce either trivial outputs or a mechanical repetition of existing inspection routines without genuine analysis. The purpose of this paper is to develop an RCM concept specifically adapted to static mechanical equipment in offshore operations. The central proposition is that RCM should be retained as the governing decision logic, because no other framework links maintenance tasks to functions and consequences as rigorously, while Risk-Based Inspection should be embedded within it as the specialized engine that answers the on-condition task question for degradation-driven failure modes. The remainder of the paper is organized as follows. Section 2 reviews the relevant literature and standards. Section 3 establishes the theoretical framework and characterizes how static equipment fails. Section 4 presents the methodology step by step. Section 5 applies the methodology to an illustrative example, Section 6 discusses implementation, governance, performance measurement, and limitations, and Section 7 concludes.

The contribution of the paper is threefold. Conceptually, it resolves the frequently observed tension between RCM and RBI by assigning each a defined role inside a single decision architecture, rather than treating them as competing methodologies to be chosen between. Methodologically, it specifies a six-stage work process, with a degradation-oriented FMECA format and interval-setting rules, in enough operational detail to be executed by an installation team rather than merely endorsed in principle. Practically, it demonstrates the process on a worked example and equips it with the governance instruments, indicators, anomaly workflow, and phased roadmap, without which even a technically sound analysis decay into shelfware. Throughout, the argument is anchored in the failure physics of static equipment, because it is precisely the mismatch between that physics and the assumptions of generic maintenance templates that motivates the adaptation.

2. Literature Review and Standards Landscape

2.1. Classical RCM

Nowlan and Heap (1978), analyzing failure data from United Airlines, demonstrated that only a minority of failure modes exhibit the age-related wear-out behavior that justifies fixed-interval overhaul, and that a large share of failures occurs at essentially constant or even decreasing hazard rates. This finding undermined time-based overhaul as a default policy and motivated a decision logic in which tasks must be both applicable, meaning technically capable of addressing the failure mode, and effective, meaning worth doing given the consequences. Moubray (1997) extended the methodology into general industry as RCM II, giving prominence to hidden failures and to environmental and safety consequences. SAE JA1011 (2009) subsequently defined the seven questions that any process must answer to be called RCM: functions, functional failures, failure modes, failure effects, failure consequences, proactive tasks and intervals, and default actions. Rausand (1998) provided an influential academic formalization of the RCM work process and noted explicitly that the method requires adaptation when failure data are scarce, which is precisely the static equipment situation. The decades since have produced a family of streamlined and hybrid derivatives, from templated RCM variants that reuse analyses across similar plants to consequence-screened approaches that reserve full analysis for critical items, and the practical lesson from this evolution is directly relevant here: rigor and affordability are reconciled not by diluting the decision logic but by controlling where it is applied at full depth, which is the role the consequence classification of Section 4.2 plays in the proposed concept.

2.2. Risk-Based Approaches

A parallel body of work developed risk as the organizing variable for maintenance and inspection. Arunraj and Maiti (2007) survey risk-based maintenance techniques and argue that risk, the product of failure probability and consequence, allocates scarce maintenance resources more rationally than criticality rankings alone. Selvik and Aven (2011) propose an extended reliability and risk centered maintenance framework, arguing that classical RCM handles uncertainty too coarsely and should incorporate explicit risk description. In the inspection domain, the American Petroleum Institute codified Risk-Based Inspection in API RP 580 (2016), which sets out the essential elements of an RBI program, and API RP 581 (2019), which provides quantitative procedures for calculating probability of failure from damage-mechanism models and consequence of failure from release modelling. RBI has become the dominant paradigm for pressure equipment inspection planning in the process industries, and DNVGL-RP-G101 (2017) adapts it specifically to offshore topsides static mechanical equipment.

2.3. Offshore Maintenance Management Standards

The Norwegian petroleum industry consolidated its maintenance management practice in NORSOK Z-008 (2017), which mandates consequence classification of all equipment against safety, environmental, and production loss criteria, and prescribes that maintenance programs be established through generic or specific RCM and RBI analyses proportionate to criticality. ISO 14224 (2016) supplies the taxonomy, boundary definitions, and failure mode coding needed to collect and exchange reliability and maintenance data for petroleum equipment, including equipment classes for vessels, heat exchangers, and piping. Together these standards form the regulatory and normative backdrop against which any offshore RCM concept must operate, particularly on the Norwegian and UK continental shelves where risk-informed maintenance is an explicit regulatory expectation.

2.4. Adjacent and Supporting Literature

Beyond the core RCM and RBI canon, several adjacent bodies of literature inform the concept developed here. The first is aviation safety management, the industry in which RCM originated. Contemporary work on aviation safety oversight illustrates how structured, data-driven regulatory models continue to evolve in that sector: Adeyelu (2018) develops a predictive compliance monitoring framework that detects systemic safety risk from operational complaint data, Adeyelu (2019) proposes an adaptive safety management system implementation model for aerodromes in developing economies, and Adeyelu (2020) presents an artificial intelligence driven model for quantifying wildlife strike risk and its airworthiness impact. These works exemplify the same trajectory that this paper advocates for static equipment: from compliance-based routines toward risk-quantified, evidence-updated programs.

The second is the occupational safety and HSE governance literature, which supplies the human and organizational context in which offshore maintenance and inspection tasks are executed. Systematic use of near-miss and hazard observation data strengthens the leading-indicator base of safety management (Arumosoye & Obriki, 2019), while governance-oriented models address contractor safety performance in multi-contract industrial projects of exactly the kind found on offshore installations (Arumosoye & Obriki, 2020) and heat stress risk in extreme operating environments (Arumosoye & Obriki, 2018). Human error causation frameworks for high-risk construction and industrial activities (Obriki & Arumosoye, 2020) and evidence linking management walkthrough frequency and coverage to safety culture outcomes (Obriki & Arumosoye, 2019) bear directly on the quality of executed inspection and maintenance work. Complementary studies address leadership-driven safety culture transformation in large workforces (Obogo, Ozobu, & Uduokhai, 2019a), safety risk governance in multi-contractor projects (Obogo, Ozobu, & Uduokhai, 2019b), hazard identification and risk control practice (Obogo, Uduokhai, & Ozobu, 2019), internal QHSE audit systems for industrial engineering operations (Obogo, Arumosoye, & Obriki, 2020a), and risk management of heavy lifting and crane installation operations (Obogo, Arumosoye, & Obriki, 2020b), the latter being a routine feature of offshore maintenance campaigns. The third concerns corrosion control and inspection technology. Atta, Tofah, Kankam, and Adenuga (2020) critically review NDT-based integrity management and corrosion risk assessment strategies for refinery process equipment, an onshore analogue of the present problem, and Atta, Asomani, and Adenuga (2018) review green corrosion inhibitors derived from agricultural extracts for mild steel protection, pointing to emerging inhibition options for carbon steel systems. Remote inspection technology is advancing in parallel: Dagodzo (2018a, 2018b) examines UAV integration into national power grid and transmission line inspection programs, and Dagodzo and Ahiaeke Patrick (2020) review UAV-based pipeline and corridor monitoring practice, capabilities directly transferable to external visual inspection of offshore topsides, flare structures, and splash zones. The fourth is the broader engineering literature on maintenance strategy and energy systems. Sunday, Omoegun, Essien, and Oluokun (2020) chart the transition from reactive to predictive maintenance in mechanical systems, the same strategic movement this paper formalizes for static equipment, and related work addresses thermodynamic efficiency and control in building mechanical services (Sunday, Omoegun, Essien, & Oluokun, 2019) and the engineering of solar and hybrid power systems in developing economies (Sunday & Omoegun, 2018, 2019; Yeboah & Ike, 2020; Komi & Adeniji, 2020). Optimization studies of electrical machines and networks (Amayo, 2017; Amayo & Popoola, 2017a; Amayo, Ubeku, & Oshevire, 2015; Oshevire, Eyenubo, & Amayo, 2017) and of telecommunication deployment quality (Amayo & Popoola, 2017b) illustrate the maturity of quantitative objective-function methods in neighboring equipment domains, methods whose logic parallels the risk-minimization formulation used in RBI interval setting. The literature thus offers a mature generic RCM logic on one side and a mature, quantitative inspection-planning methodology on the other, but comparatively little structured guidance on how the two should be combined into a single coherent program for static equipment. In industrial practice the two are frequently run by separate departments, maintenance engineering owning RCM and technical safety or integrity owning RBI, with duplicated analysis, inconsistent criticality rankings, and gaps at the interfaces, for example relief systems that fall between the inspection plan and the maintenance plan. The concept developed in this paper addresses that gap.

3. Theoretical Framework: How Static Equipment Fails

3.1. Defining Static Mechanical Equipment

For the purposes of this paper, static mechanical equipment comprises equipment items whose primary function is performed without gross relative motion of major parts: pressure vessels including separators, scrubbers, and filters; shell-and-tube and plate heat exchangers; atmospheric and pressurized storage tanks; process, utility, and flare piping including flanges, small-bore connections, and supports; and pressure relief devices such as safety valves and bursting discs. Valve internals and actuators sit at the boundary; this paper treats the pressure-containing envelope of valves as static equipment while their functional mechanisms are better handled by conventional RCM. The primary function common to the whole class is containment: maintaining a pressure boundary between process fluid and environment at specified design conditions. Secondary functions include separation, heat transfer, flow distribution, and overpressure protection.

3.2. Degradation-Driven Failure

Static equipment rarely fails through the mechanisms familiar from rotating machinery. Instead, failure is the endpoint of one or more time-dependent damage mechanisms acting on materials: general and localized corrosion driven by CO2, H2S, oxygen, and chlorides; erosion and erosion-corrosion accelerated by produced sand; environmental cracking including sulphide stress cracking and chloride stress corrosion cracking; fatigue at nozzles, small-bore connections, and flare tips; corrosion under insulation on the external surface; and microbiologically influenced corrosion in stagnant water-wet locations. Each mechanism has a characteristic rate, morphology, susceptible location, and detection technique, and this mechanistic knowledge substitutes for the statistical failure data that classical RCM would otherwise demand. Table 1 summarizes dominant mechanisms, failure modes, and consequences by equipment class in the offshore context.

Table 1: Dominant degradation mechanisms and consequences for offshore static equipment Equipment class Dominant degradation mechanisms Typical dominant failure modes Principal consequences offshore Pressure vessels and separators CO2 and H2S corrosion, chloride pitting, erosion at inlets, hydrogen-induced cracking, corrosion under insulation Local wall thinning, through-wall pitting, weld cracking, nozzle degradation Loss of containment of hydrocarbons, jet or pool fire, escalation to adjacent modules Process piping and manifolds Erosion-corrosion at bends and tees, sand erosion, microbiologically influenced corrosion in dead legs, external marine corrosion Localized thinning, pinhole leaks, flange face damage, fatigue at small-bore connections Hydrocarbon release, potential ignition, production shutdown Heat exchangers Tube-side erosion, shell-side fouling, galvanic attack at tubesheets, vibration-induced tube wear Tube perforation, tube-to-tubesheet joint leakage, bundle blockage Cross-contamination of streams, loss of thermal duty, unplanned outage Storage and surge tanks Bottom-plate corrosion, water-phase attack, coating breakdown, external atmospheric corrosion Floor perforation, shell-to-bottom weld cracking, roof degradation Environmental release, inventory loss, structural compromise Pressure relief and flare systems Internal fouling, spring relaxation, seat corrosion, flare tip thermal fatigue Fails to open on demand, fails to reseat, passing valve, tip cracking Hidden loss of overpressure protection, potential vessel rupture on demand

3.3. Implications for RCM logic

Three features of this failure behavior reshape the RCM analysis. First, the potential-failure-to-functional-failure (P-F) interval, central to on-condition task justification, is not derived from vibration signatures or performance trends but from measurable damage states: remaining wall thickness relative to minimum allowable thickness, crack size relative to critical size from fracture mechanics, or coating condition relative to breakdown. The P-F interval is therefore calculable from degradation rates, which is exactly what RBI remaining-life methods provide. Second, the dominant consequence category is safety and environmental rather than operational, which under RCM logic mandates that a task be found or the design changed; run-to-failure is rarely admissible for hydrocarbon containment. Third, protective devices such as relief valves present classic hidden failures: a corroded, stuck safety valve betrays no evidence in normal operation and reveals itself only when an overpressure demand occurs, making failure-finding tasks with statistically derived test intervals indispensable.

3.4. Failure Patterns, The P-F Formalism, And Hidden

Functions Nowlan and Heap (1978) identified six characteristic conditional-probability-of-failure patterns and showed that only a minority of failure modes display a distinct wear-out zone, while the majority exhibit constant or infant-mortality-dominated behavior. For static equipment the picture is more structured than for machinery: the pressure boundary as a whole degrades progressively under corrosion and cracking mechanisms, so a slowly rising hazard is the norm for containment functions, whereas the ancillary elements, gaskets, small-bore fittings, and instrument connections, contribute a background of essentially random leak events. This duality matters for task selection, because progressive degradation rewards condition monitoring while the random background rewards design measures such as minimizing small-bore connections and flanged joints rather than more frequent inspection.

The P-F formalism translates directly into measurable quantities for static equipment. The potential failure point P is a defined damage state, for example wall thickness reaching an alarm level above the minimum allowable thickness, or a detectable crack of a size comfortably below the critical size computed from fracture mechanics. The functional failure point F is breach of the minimum allowable condition. The P-F interval is then the time for degradation to progress from P to F at the governing rate. For thinning mechanisms, remaining life is estimated as the difference between measured thickness and minimum allowable thickness divided by the corrosion rate, and a widely used conservative rule sets the next inspection at no more than half the remaining life, subject to any statutory ceiling. The essential point is that for static equipment the P-F interval is calculated from physics and measurements rather than inferred from failure statistics, which is why RBI, with its damage-mechanism models and inspection effectiveness grading, is the natural computational engine for the on-condition branch of the RCM logic.

Hidden functions require a different mathematical treatment. A relief valve that is stuck closed produces no evident symptom; its condition is revealed only by a test or by a real overpressure demand. If the dangerous failure rate of the device is approximately constant, the average probability of failure on demand grows with the time since the last test, and the failure-finding interval can be set so that the time-averaged unavailability meets a target value; to first order the interval is approximately twice the target unavailability divided by the failure rate. The target itself follows from the demand rate and the tolerable frequency of unprotected overpressure events, which ties the test interval directly to the installation's risk acceptance criteria rather than to habit or vendor recommendation. As-found test results then provide the evidence for updating the assumed failure rate, closing the loop between the program and its own experience.

3.5. Degradation Mechanisms in The Offshore Process

Environment Carbon dioxide corrosion, often called sweet corrosion, is the workhorse threat to carbon steel in produced-fluid service. Dissolved CO2 forms carbonic acid in the water phase, and attack concentrates where liquid water wets the steel, at the bottom of horizontal lines and vessels, downstream of water drop-out points, and at the top of lines where condensation occurs in wet gas service. Rates depend strongly on temperature, CO2 partial pressure, pH, flow regime, and the stability of protective iron carbonate scale, and semi-empirical models of the de Waard and Milliams family are used to predict them. The morphology ranges from uniform wall loss to mesa-type localized attack, which is why grid thickness measurement rather than spot readings is the appropriate monitoring technique, and why chemical inhibition and its availability become analysis variables in their own right.

Hydrogen sulphide introduces sour service damage. Beyond weight-loss corrosion, H2S charges atomic hydrogen into the steel and enables sulphide stress cracking of hard microstructures, hydrogen-induced cracking of dirty steels, and stepwise cracking in plate. Susceptibility is managed primarily by material and hardness limits of the kind codified for sour service, which makes weld procedure control and post-weld heat treatment integrity part of the maintenance concept: a single uncontrolled site repair weld can introduce a hard heat-affected zone that becomes the initiation point for cracking years later. Inspection for these mechanisms relies on surface and volumetric crack detection techniques, wet fluorescent magnetic particle inspection internally and advanced ultrasonics such as time-of-flight diffraction for weld volumes.

Chloride-driven mechanisms attack from both sides of the wall. Internally, produced water and seawater breakthrough supply chlorides that pit stainless steels and, at temperatures above roughly sixty degrees Celsius, enable chloride stress corrosion cracking of standard austenitic grades, a principal reason for the widespread offshore use of duplex stainless steels. Externally, the marine atmosphere deposits chlorides on every surface, and where thermal insulation traps moisture against warm steel the result is corrosion under insulation, arguably the most operationally troublesome external mechanism because it is invisible until insulation is removed. Carbon steel operating intermittently or continuously in the broad warm band between roughly minus a few degrees and one hundred and seventy five degrees Celsius is at risk, and inspection strategy therefore combines targeted insulation removal at predictable water entry points, support rings, penetrations, and low points, with screening technologies such as pulsed eddy current that measure through insulation. Microbiologically influenced corrosion flourishes wherever stagnant, nutrient-bearing water persists: dead legs, infrequently used firewater and utility lines, tank bottoms, and lines left full of untreated hydrotest water. Sulphate-reducing bacteria in particular produce aggressive localized pitting beneath biofilms at rates far exceeding the general corrosion prediction for the bulk fluid. The maintenance concept responds on three fronts: design review to eliminate or flush dead legs, chemical treatment and biocide programs with their own verification tasks, and inspection of susceptible locations by radiography, since the attack is localized and internal.

Erosion and erosion-corrosion are flow-driven threats that concentrate at geometry changes. Produced sand entrained at high velocity removes both metal and protective corrosion scale at chokes, bends, tees, reducers, and downstream of restriction orifices, and the combined erosion-corrosion rate can be an order of magnitude above either mechanism alone. Simple velocity criteria of the API RP 14E type are recognized as crude, and modern practice supplements them with sand monitoring, either acoustic detectors or erosion probes, so that the inspection interval for susceptible locations is driven by measured sand production rather than assumed. This is a clear example of the living-program principle: a sand breakthrough event in year twelve invalidates an inspection interval set in year five. Fatigue in static equipment concentrates where cyclic stress meets stress concentration. Small-bore connections excited by main-line vibration are the classic offshore leak source, cantilevered valves and instrument stubs failing at the weld toe after years of apparently benign service. Thermal fatigue affects flare tips and systems with intermittent hot service, and pressure cycling matters for equipment in batch or slugging duty. Because crack initiation consumes most of the fatigue life and detection windows are short, the effective tasks are as much design and survey tasks, bracing surveys, vibration measurement, and elimination of unnecessary stubs, as they are periodic NDE, and this is reflected in the task selection logic by allowing one-off change as a first-class outcome.

Finally, several lower-frequency mechanisms belong on the screening checklist even when they are ultimately screened out: brittle fracture susceptibility of older or cold-service steels during blowdown, hydrogen damage in specific process conditions, galvanic attack at dissimilar-metal junctions such as tubesheet-to-tube interfaces, and degradation of non-metallic components, linings, and coatings whose failure exposes the substrate to an environment it was never intended to see. The FMECA discipline of the proposed concept exists precisely to force this systematic screening, so that the absence of a mechanism from the program is a documented decision rather than an oversight.

3.6. Inspection Techniques and The Concept of Inspection

Effectiveness Because the on-condition branch dominates the static equipment program, the toolbox of non-destructive examination techniques and their limitations must be understood as part of the theoretical framework, not delegated entirely to specialists. Ultrasonic thickness measurement is the backbone for thinning mechanisms, but its value depends on sampling strategy: isolated spot readings systematically miss localized attack, which is why the methodology of Section 4 specifies gridded measurement over susceptible zones and treats the choice of measurement locations as an analysis output. Radiography, conventional and digital, sees through the pipe and is therefore the technique of choice for small-bore lines, dead legs, and locations where internal geometry hides attack from external ultrasonics. Long-range guided-wave testing screens tens of meters of piping from a single collar and earns its place on inaccessible runs, caisson penetrations, and road or deck crossings, with the caveat that it is a screening tool whose indications require local follow-up. Pulsed eddy current measures average wall thickness through insulation and passive fire protection, transforming the economics of corrosion under insulation programs by reserving costly insulation removal for screened suspect areas. For cracking mechanisms, surface techniques, magnetic particle and dye penetrant inspection, are complemented by volumetric ultrasonics, with time-of-flight diffraction and phased array providing sizing capability that feeds directly into fracture mechanics assessment. Acoustic emission offers global monitoring of active defects during controlled pressurization, and permanently installed sensors increasingly allow continuous thickness trending at the most critical locations. No technique is perfect, and RBI formalizes this through inspection effectiveness grading: an inspection is scored by how likely it is to detect and correctly characterize the damage state it targets, and only effective inspection reduces the calculated probability of failure. This has two consequences that the maintenance organization must internalize. First, an inspection of the wrong kind, in the wrong place, or with inadequate coverage is not merely wasted money; it is actively dangerous, because it generates unjustified confidence that enters the risk calculation as if it were evidence. Second, effectiveness is a property of execution as well as technique: surface preparation, procedure qualification, and inspector competence determine whether the nominal capability of a method is realized on a windswept deck at night during a shutdown. The concept therefore treats NDE procedure control and inspector qualification as integrity-critical activities subject to the same assurance regime as the analysis itself.

4. Methodology

The proposed concept is a six-stage work process that preserves the SAE JA1011 question sequence while delegating specific analytical steps to RBI and to failure-finding mathematics where those tools are superior. The stages are described below.

4.1. Stage 1: System Hierarchy, Boundaries, And Data

Foundation The installation is decomposed into systems, subsystems, and maintainable items following the ISO 14224 taxonomy, so that every analysis object has an unambiguous boundary and every recorded failure or inspection finding can be attached to it. Piping is grouped into corrosion circuits, sections of line expected to share fluid composition, operating conditions, materials, and therefore degradation behavior, since analyzing every spool individually is neither feasible nor necessary. Design data (materials, wall thickness, design pressure and temperature, corrosion allowance), process data (fluid composition, water cut, sand production, velocities, temperatures), and history (inspection results, repairs, previous failures) are compiled. Experience across implementations consistently shows this data-gathering stage to consume the majority of total effort, and its quality bounds the quality of everything downstream. Because this data foundation increasingly resides in computerized maintenance management and cloud-hosted integrity systems, its governance is itself a program requirement: enterprise data protection and legal risk frameworks (Mbonu, Aliliele, Iwuanyanwu, & Oluoha, 2018) and comparative analyses of data protection regulation and secure cloud implementation strategies (Mbonu, Aliliele, Uzoka, & Oluoha, 2019) indicate the controls needed to keep inspection and reliability records accurate, protected, and auditable.

4.2. Stage 2: Consequence Classification and Screening

Following NORSOK Z-008, every analysis object is classified by the consequence of its main-function failure against safety, environment, and production criteria, typically on a three-level scale of high, medium, and low. This classification performs the screening role that keeps analysis effort proportionate: high-consequence items receive full specific analysis, medium-consequence items may be covered by generic analyses transferred from similar equipment, and low-consequence items receive a minimum program or a documented run-to-failure decision. For static equipment, consequence assessment must account for inventory size, fluid flammability and toxicity, location relative to escape routes and accommodation, and the escalation potential of a release, considerations that align directly with the consequence-of-failure models in API RP 581 and allow a single consequence assessment to serve both the RCM and RBI legs of the program. The economics of this screening deserve emphasis. On a typical installation the static equipment population runs to thousands of tagged items and piping spools, and specific analysis of each is neither affordable nor useful; consequence classification typically concentrates full analysis on a modest fraction of the population while the remainder is covered by transferred generic analyses or minimum programs. The discipline lies in resisting two opposite temptations: inflating classifications defensively until everything is critical, which dilutes attention and recreates the resource problem the screening exists to solve, and deflating them to reduce workload, which silently removes protection. The concept therefore requires the classification rules to be written down before classification begins, applied by a team rather than an individual, and audited by sampling, so that the screening itself is a controlled process with a documented basis rather than an exercise in judgment drift.

4.3. Stage 3: Functional analysis and degradation-

oriented FMECA Functions are stated with performance standards: for example, to contain well fluids at up to 85 barg and 120 degrees Celsius with zero detectable external leakage, or to relieve vessel overpressure at 92 barg set pressure within rated capacity. Functional failures follow (contains partially, fails to relieve on demand, relieves prematurely). The FMECA then departs from generic templates: for each functional failure, credible failure modes are identified as damage mechanism plus location plus failure morphology, for instance CO2 corrosion at the water-wet bottom-of-line of the inlet nozzle leading to local thinning and pinhole leak. This mechanism-and-location specificity is what makes the subsequent task selection meaningful, because detection technique, inspection location, and interval all depend on it. Failure effects are recorded at local, system, and installation level, explicitly noting whether the failure is evident or hidden and estimating release rates and escalation paths for containment failures. Practical facilitation determines whether this analysis produces insight or paperwork. Effective sessions are anchored on marked-up drawings and corrosion circuit diagrams rather than spreadsheets alone, work mechanism by mechanism through a standing checklist so that absence is a decision, and are scheduled in half-day blocks because failure mode identification is a concentration task that degrades sharply with fatigue. The facilitator's craft is to keep the team at the right altitude: specific enough that each failure mode implies its detection technique and location, general enough that the analysis does not dissolve into an inventory of every conceivable pit. Two recording rules pay for themselves repeatedly. Every assumption, about inhibitor availability, about the service of a dead leg, about the absence of H2S, is logged with an owner and a verification action, because unverified assumptions are where analyses quietly fail. And every disagreement the team cannot resolve is recorded as an open point with a data-gathering task rather than settled by seniority, since the disagreement usually marks exactly the location of missing knowledge that inspection should target first.

4.4. Stage 4: Task Selection Logic

Task selection follows the RCM decision order (on-condition, scheduled restoration or discard, failure-finding, run-to-failure, redesign) but with the branches populated by static-equipment techniques and with RBI installed as the engine of the on-condition branch. For every degradation-driven failure mode with an evident or calculable damage state, the applicable task is condition monitoring by non-destructive examination, and the questions of which technique, where, and how often are answered by the RBI analysis: probability of failure is computed from damage-mechanism models and inspection effectiveness, consequence of failure from release modelling, and the inspection plan is set so that risk remains below the acceptance threshold throughout the plan period. For age-related consumable elements such as gaskets, sacrificial anodes, and coatings, scheduled restoration or discard tasks are set from useful-life data. For hidden failures of protective devices, failure-finding intervals are derived from the required probability of failure on demand and the device failure rate, using ISO 14224-coded generic data adjusted by site experience. Run-to-failure is admissible only where consequence classification is low and documented. Where no applicable and effective task exists against a high-consequence mode, the default action is compulsory redesign, which offshore typically means material upgrade, chemical inhibition, dead-leg removal, or improved coating and insulation practice. Table 2 summarizes the logic. A final selection consideration is packaging. Individual failure modes generate individual tasks, but offshore execution efficiency demands that tasks be grouped into campaigns sharing access, scaffolding, insulation removal, trade skills, and shutdown windows, and the grouping itself can change the optimal answer: an inspection that is marginal in isolation may be clearly worthwhile when the scaffolding is already standing for an adjacent task, while a nominally due task may be rationally advanced or deferred within its risk-tolerance window to join a campaign. The concept therefore distinguishes the analytical interval, the pure risk-based answer recorded in the analysis, from the execution date assigned in planning, and requires that any planning adjustment remain inside a documented tolerance band around the analytical interval, with excursions beyond the band treated as formal deferrals subject to the deferral governance described in the discussion. This separation preserves the integrity of the analysis while giving planners the flexibility that offshore logistics genuinely require.

Table 2: Task selection logic adapted to static mechanical equipment Failure characteristic Applicable RCM task category Representative techniques for static equipment Interval-setting basis Evident, gradual degradation (thinning, coating breakdown)

On-condition (predictive) task Ultrasonic thickness surveys, corrosion coupons and probes, pulsed eddy current, guided-wave testing, visual and drone inspection P-F interval derived from measured or modelled corrosion rate; RBI remaining-life calculation per API RP 581 Evident, age-related wear-out (gaskets, sacrificial anodes)

Scheduled restoration or discard Planned gasket and seal replacement at turnaround, anode renewal, recoating campaigns Useful-life estimate from ISO 14224 data and site history Hidden failure of protective function (relief valves, bursting discs)

Failure-finding task Bench pop-testing of PSVs, in-situ trevitest, bursting disc inspection and replacement Interval set to achieve target availability of the protective function given demand rate and acceptable probability of failure on demand Random, non-predictable failure with tolerable consequence Run-to-failure (no scheduled task)

Redundant utility piping, non-critical drain lines Documented decision showing consequence is acceptable and no applicable task is cost-effective No applicable and effective task, intolerable consequence Redesign or one-off change Material upgrade to duplex or clad steel, injection of corrosion inhibitor, geometry change to remove dead legs Mandatory where safety or environmental consequence cannot otherwise be reduced to a tolerable level

4.5. Stage 5: Interval Determination and Program

Assembly Intervals from the RBI calculations, failure-finding mathematics, and useful-life estimates are consolidated into an executable program. Offshore, this consolidation must respect practical constraints that onshore plants do not face: tasks requiring shutdown are aligned with planned turnarounds; bed-space and crane limitations cap simultaneous campaign work; and techniques are preferred that avoid habitat construction, insulation removal, or vessel entry where non-invasive alternatives such as pulsed eddy current or acoustic emission achieve adequate inspection effectiveness. Each task is documented with its originating failure mode, acceptance criteria, and the analysis reference, creating the auditable thread from regulation to work order that offshore safety cases demand.

Program assembly also has a materials and logistics dimension that offshore conditions elevate to a planning constraint. Supply chain risk management models developed for EPC and gas processing projects (Agbabiaka, Okonkwo, Ogunwole, Mayo, & Okeke, 2019), GIS-enabled ERP procurement frameworks (Ahiaeke Patrick, Okonkwo, Mayo, & Okeke, 2020), demurrage elimination and port logistics efficiency models for emerging economies (Okonkwo, Agbabiaka, Ogunwole, Mayo, & Okeke, 2020), and vendor governance approaches to contract cost reduction (Okonkwo, Ogunwole, Okeke, & Mayo, 2019) all address the practical question of whether the gasket set, anode inventory, or replacement spool will actually be on deck when the maintenance window opens. Predictive analytics for supply chain demand forecasting (Aifuwa et al., 2020) and structured profitability analysis of procurement operations (Akin-Oluyomi, Atima, Akinleye, & Akokodaripon, 2020) support spares stocking decisions, while decision frameworks reconciling material safety with circular economy targets (Okojie & Abioye, 2020) inform disposal and reuse choices for replaced components. Where installations are operated as joint ventures, multi-stakeholder governance alignment (Eyetsemitan, Ambali, Oyeleye, & Fadayomi, 2020) conditions how maintenance budgets and shutdown windows are agreed.

4.6. Stage 6: The Living Program

The program is not static. Every inspection result updates the degradation-rate estimates and hence the probability-of-failure calculations; every relief-valve as-found test result updates the failure-finding interval basis; process changes such as increased water cut, souring of the reservoir, or sand breakthrough trigger reassessment of the affected corrosion circuits; and failures or near-misses feed back into the FMECA. A formal management-of-change link between process engineering and the integrity function is therefore part of the concept, not an optional extra, because the dominant cause of RBI and RCM programs losing validity is silent drift of operating conditions away from the analysis assumptions.

5. Illustrative Application

To make the methodology concrete, this section applies it to a deliberately simplified but representative analysis object: a first-stage three-phase production separator, designated V-101, on a twenty-five-year-old fixed platform, together with its inlet piping circuit C-12 and its pressure safety valve PSV-101. All numbers are illustrative and chosen to be typical rather than drawn from a specific installation; the purpose is to show the mechanics and the character of the outputs, not to report a field study.

5.1. System Definition and Data Foundation

V-101 is a horizontal carbon steel vessel, 3.2 meters in diameter and 11 meters long, with a design pressure of 92 barg, an operating pressure of 68 barg, an operating temperature of 85 degrees Celsius, an original nominal shell thickness of 25 millimeters, and a corrosion allowance of 6 millimeters, giving a minimum allowable thickness of 18.5 millimeters after accounting for the design calculation. Produced fluid contains 4 mole percent CO2 with negligible H2S at start of field life, though souring has begun; water cut has risen from 5 percent at start-up to 62 percent; and intermittent sand production has been detected since a workover three years ago. Circuit C-12 comprises the flowline manifold to separator inlet piping in carbon steel with a corrosion inhibitor program, including two dead legs left from a decommissioned test header. The ISO 14224 boundary places the vessel shell, nozzles, internals, and supports in one maintainable item, the piping circuit in a second, and PSV-101, with its inlet and outlet pipework, in a third. History includes one internal inspection nine years ago, spot ultrasonic readings of variable quality, one site repair weld on the shell from an earlier nozzle modification, and PSV bench test records showing one as-found failure in the last four tests across the platform's relief valve population.

5.2. Consequence Classification

Applying the NORSOK Z-008 logic, loss of the containment function of V-101 is classified high on safety, because the vessel holds several tonnes of flashing hydrocarbon liquid and gas adjacent to a main walkway and below the module housing the main generators, high on environment for oil-to-sea potential, and high on production, since there is no bypass and a shutdown of V-101 stops the platform. Circuit C-12 inherits high safety and production consequence. PSV-101 protects against overpressure from blocked outlet and gas blowby scenarios; the consequence of its hidden failure is classified high safety, since the unmitigated scenario exceeds the vessel test pressure. All three objects therefore qualify for full specific analysis rather than generic coverage.

5.3. FMECA Extract

Table 3 shows an extract of the degradation-oriented FMECA. Each failure mode is stated as mechanism plus location plus morphology, its evident or hidden character is recorded, and the consequence category drives the stringency of the task requirement. The full analysis for these three objects contained twenty-eight failure modes; the extract shows the six that dominate the resulting program.

Table 3: FMECA extract for separator V-101, circuit C-12, and PSV-101 (illustrative) Function Functional failure Failure mode (mechanism, location, morphology)

Evident or hidden Dominant consequence Selected task Contains partially (external leak)

CO2 corrosion at water-wet bottom of shell and inlet nozzle; local thinning to pinhole leak Evident Safety and environment (hydrocarbon release)

On-condition: UT thickness grid and profile radiography of nozzle, interval from RBI Contains partially (external leak)

Corrosion under insulation at support ring and shell penetrations; external wall loss Evident Safety and environment On-condition: staged insulation removal and visual plus pulsed eddy current screening Fails to contain (rupture)

Sulphide stress cracking at repair weld with hardness above limit; crack growth to critical size Evident (late)

Safety (major accident potential)

On-condition: wet fluorescent MPI and TOFD of repair welds at internal inspection Separate oil, gas, and water to export specification Separates below specification Sand accumulation and internals degradation; weir and inlet device damage Evident Operational (off-spec export)

On-condition: process performance monitoring; internal visual at planned entry Relieve overpressure at 92 barg set pressure Fails to relieve on demand PSV seat corrosion and deposit bonding; stuck closed Hidden Safety (loss of protection)

Failure-finding: bench pop test at interval from PFD target Relieve overpressure at 92 barg set pressure Relieves prematurely or passes Spring relaxation and seat wear; simmer and passing below set pressure Evident (flare loss)

Operational and environment (flaring)

On-condition: acoustic monitoring of relief line

5.4. RBI Evaluation and Interval Setting For The

Thinning Modes The most recent reliable general shell readings average 22.4 millimeters against the 18.5 millimeter minimum, and comparison with the previous inspection yields a general corrosion rate of 0.18 millimeters per year. Remaining life on the general shell is therefore approximately 21.7 years, and the half-life rule would permit a long interval, which the risk assessment caps at the eight-year turnaround-aligned internal entry given the high consequence ranking and the medium confidence grading assigned to the historical data quality. The inlet nozzle region tells a different story: a proper ultrasonic grid laid over the water-wet bottom quadrant during the last opportunity found local rates up to 0.45 millimeters per year, consistent with the rising water cut and declining inhibitor availability recorded by the corrosion probes. Local remaining life is approximately 8.7 years, and half of that, rounded conservatively, sets a four-year external campaign of gridded thickness measurement and profile radiography of the nozzle, executable without shutdown. The repair weld identified in the history, combined with incipient souring, elevates the cracking susceptibility screening; wet fluorescent magnetic particle inspection and time-of-flight diffraction of that weld are attached to the eight-year internal entry, with a hold point that any hardness survey exceeding the sour service limit triggers engineering assessment rather than continued operation by default. For circuit C-12, erosion-corrosion at the bends downstream of the choke governs, with the interval set at three years and explicitly conditioned on the sand monitoring trend, while the two dead legs receive radiographic inspection and microbiological sampling on the same cycle, with a standing recommendation to the modification register that they be cut out, the redesign outcome of the task selection logic.

5.5. Failure-Finding Interval for Psv-101 PSV-101 is a hidden function with high safety consequence. The installation's risk acceptance criteria translate into a target average probability of failure on demand of 0.01 for this protective function given the estimated demand rate of the overpressure scenarios. Generic relief valve data of the ISO 14224 type, adjusted by the platform's own as-found record, support a dangerous failure rate estimate of 0.004 per year for this service, moderately fouling hydrocarbon duty with a history of deposit formation. The first-order failure-finding relation, interval approximately equal to twice the target unavailability divided by the failure rate, yields five years, which is adopted and aligned with the valve change-out logistics. The program attaches two governance rules: every test records the as-found condition before any adjustment, and a failed as-found result on this or a similar-service valve triggers recalculation, which in practice would halve the interval until the evidence base recovers. This is the failure-finding analogue of the corrosion-rate update loop and illustrates how the living program treats every execution of a task as a data-collection event.

5.6. Resulting Program Extract and Observations

Table 4 assembles the resulting program extract. Three observations follow. First, the program is heterogeneous by design: calculated on-condition intervals, a statutory-capped internal entry, a statistically derived failure-finding test, a useful-life anode renewal, and a redesign recommendation coexist, each traceable to a failure mode and a consequence. Second, the intervals are unequal on purpose; the four-year nozzle campaign against the eight-year general internal entry is precisely the risk-concentration effect that distinguishes this program from the calendar-based regime it replaces, under which the whole vessel was opened on a fixed cycle while the nozzle-specific threat went unmeasured between entries. Third, the analysis effort for these three objects, roughly six team-days including data assembly, is recovered many times over by a single avoided unnecessary vessel entry, before any credit is taken for risk reduction.

Table 4: Program extract for the worked example (illustrative) Item Task Technique Interval Basis V-101 shell and heads External general visual inspection GVI plus close visual of supports 2 years RBI plan; coating condition and CUI screening trigger V-101 inlet nozzle and bottom shell Wall thickness survey UT grid plus profile radiography 4 years Half remaining life at localized CO2 rate of 0.45 mm per year V-101 general shell Internal inspection and weld NDE Visual, WFMPI, TOFD of repair welds 8 years RBI risk target; aligned to turnaround cycle Inlet piping circuit C-12 Thickness monitoring at susceptible locations UT at bends, tees, and downstream of choke 3 years Erosion-corrosion rate from monitoring locations; sand production trend Circuit C-12 dead legs Dead leg inspection and MIC screening Radiography; coupon and bacteria sampling 3 years MIC susceptibility; stagnant water-wet service PSV-101 Failure-finding pop test and overhaul Bench test; as-found recording 5 years PFD target of 0.01 with dangerous failure rate of 0.004 per year V-101 anodes and coating Renewal of internal anodes; patch recoating Replacement at internal entry 8 years Useful life; consumption measured at previous entry

5.7. Sensitivity of the Example Results

The worked example also illustrates the sensitivity checking required by Section 6.3. The four-year nozzle interval rests on the 0.45 millimeter per year localized rate; if the true rate were 0.6 millimeters per year, within the plausible error band given inhibitor availability records, remaining life falls to about 6.5 years and the interval to three years, so the program registers this task as classification-sensitive and schedules the first campaign at three years, relaxing only if the campaign confirms the lower rate. The PSV interval is similarly stress-tested: doubling the assumed failure rate to 0.008 per year halves the interval to two and a half years, and since the platform's as-found evidence base is thin, one failure in four tests, the analysis records a medium strength of knowledge and commits to reassessment after the next two test results rather than after the full five-year cycle. By contrast, the general shell conclusion is robust, because even doubling the general rate leaves a decade of remaining life. Reporting which conclusions are fragile and which are robust, alongside the conclusions themselves, is what distinguishes a defensible risk-based program from a merely computed one.

6. Discussion

6.1. Complementarity of RCM And RBI In One

Framework Run alone, RCM applied to static equipment tends to conclude, correctly but unhelpfully, that inspection is required, without the quantitative machinery to set technique, coverage, and interval defensibly. Run alone, RBI produces rigorous inspection plans for pressure boundaries but has no systematic treatment of secondary functions, hidden protective functions, consumable elements, or the run-to-failure and redesign decisions, and it does not naturally generate the maintenance tasks (recoating, anode replacement, valve testing) that sit outside inspection. The merged concept lets each framework do what it does best under a single consequence model and a single equipment hierarchy, eliminating the duplicated criticality assessments and interface gaps observed when the methodologies are run in parallel by separate departments. This is consistent with the direction of NORSOK Z-008, which treats RCM and RBI as complementary instruments within one maintenance management loop rather than as competing philosophies. A subtler benefit of the merger is linguistic. RCM and RBI communities have historically used overlapping terms with different meanings, criticality, risk, consequence, and task, and installations running both frameworks in parallel accumulate two vocabularies, two registers, and eventually two versions of the truth about the same vessel. Forcing a single hierarchy, a single consequence model, and a single anomaly workflow eliminates this ambiguity at the root, and the practical experience of doing so is that a substantial share of the initial project effort is consumed not by analysis but by reconciliation of the legacy registers, an investment that pays off permanently in every subsequent audit, handover, and management review.

6.2. Organizational and Competence Requirements

The analysis team must combine competences rarely held by one person: RCM facilitation, materials and corrosion engineering, NDE technology, process engineering, and operations experience from the specific installation. Excluding operations personnel is a recognized failure pattern; they hold the knowledge of dead legs, bypasses in intermittent service, and temporary repairs that never appear in design documentation. Governance should assign a single owner for the combined program, with the integrity and maintenance functions working from the same register, the same criticality data, and the same anomaly-management process, so that a wall-thickness finding below minimum triggers the same workflow regardless of which discipline discovered it.

Competence development deserves deliberate design rather than assumption. The education literature offers transferable evidence: professional development measurably improves practitioner competence in managing demanding cases (Yeboah, Bobga, Boakye, & Ogbona, 2019), structured pedagogical strategies succeed even in resource-constrained settings (Bobga, Boakye, Ogbona, & Yeboah, 2018), and well-designed digital tools improve technical learning outcomes (Boakye, Ofori, Ogbona, Yeboah, & Bobga, 2020; Orise & Niniola, 2020). Offshore crews are multinational, so cross-cultural communication competence (Lilian, Liadi, Yeboah, & Apelehin, 2020) affects toolbox talks, permit-to-work discussions, and analysis workshops alike; career transition research (Ogbona, Yeboah, Bobga, & Boakye, 2020a) speaks to retaining scarce integrity engineers, and studies of structured collaboration between institutions and stakeholders (Ogbona, Yeboah, Bobga, & Boakye, 2020b) parallel the operator, contractor, and regulator partnership that a living program requires. Capacity-building experience from other Sub-Saharan sectors similarly emphasizes structured competence development as a precondition for sustainable outcomes (Michael & Ogunsola, 2019b). Lessons from other critical infrastructure sectors in resource-constrained settings reinforce the organizational argument. Studies of healthcare infrastructure show that capital project delivery models for high-risk facilities (Aminu-Ibrahim, Ogbete, & Ambali, 2019), regulatory-compliant design systems for highly controlled environments (Ogbete, Aminu-Ibrahim, & Ambali, 2019), sustainable materials selection and energy efficiency strategies (Ogbete, Aminu-Ibrahim, & Ambali, 2020), spatial planning for safety and throughput (Ogbete, Aminu-Ibrahim, & Ambali, 2018), and sustainable infrastructure models for underserved regions (Aminu-Ibrahim, Ogbete, & Ambali, 2018, 2020) depend on the same disciplines of lifecycle thinking, compliance by design, and maintainability that this concept demands of offshore operators. At health system level, analyses of financing and payment reform (Ilodigwe & Adesemoye, 2019a), of why technical innovation fails to improve outcomes without system redesign (Ilodigwe & Adesemoye, 2019b), and of delivery models that expand access (Ilodigwe & Adesemoye, 2020) carry a directly analogous warning: an analytically excellent RCM study will not improve integrity outcomes unless the surrounding organization is redesigned to consume it.

6.3. Data Quality and Uncertainty

Because static equipment failures are rare, the program leans on degradation models, generic data, and expert judgment, all of which carry uncertainty. The concept manages this in three ways: conservative default corrosion rates where measurements are absent, with conservatism relaxed only as inspection evidence accumulates; inspection effectiveness grading per API RP 581, so that a poor-coverage technique does not spuriously reduce calculated probability of failure; and sensitivity checks on the risk ranking, so that items whose classification flips under plausible parameter variation are inspected earlier rather than later. Selvik and Aven's (2011) criticism that maintenance frameworks understate uncertainty is accepted and addressed by reporting not only the risk ranking but also the strength of knowledge behind it. The concept additionally draws on the wider decision-systems literature: data-driven executive decision frameworks (Lawal & Oduleye, 2019b) and data-driven risk evaluation models for emerging-market institutions (Akomolafe & Agu, 2019b) show how quantitative outputs should be embedded in governance rather than left as engineering artifacts, while technology-enabled risk assessment (Akomolafe & Agu, 2018), risk-based internal control modelling (Akomolafe & Agu, 2019a), and integrated governance and compliance strategies for resilience (Akomolafe & Agu, 2019c) supply patterns for the assurance layer around the program. More generally, the value of systematic, graded empirical designs for optimizing outcomes under resource constraints is visible across applied research domains, including controlled graded-level feeding trials in animal science (Aye & Tawose, 2015, 2016), and the same discipline of incremental, evidence-updated adjustment underpins the living-program principle adopted here.

6.4. Economic Dimension

Offshore inspection is expensive; a single campaign requiring scaffolding, habitat, insulation removal, and specialist NDE crews can cost an order of magnitude more than its onshore equivalent, and vessel entry may force production deferment. The risk-based interval setting embedded in the concept is therefore not merely a safety instrument but an economic one: it concentrates spend on the circuits and vessels where probability and consequence justify it, extends intervals where evidence supports doing so, and provides the documented technical basis that regulators and class societies require before accepting such extensions. Experience reported across the industry indicates that risk-informed programs typically redistribute rather than simply reduce inspection effort, increasing attention on a minority of high-risk items while relaxing over-inspection of benign systems. Measuring the return on integrity expenditure raises the same attribution difficulties documented for marketing investment in regulated services (Sanni, Ajiga, & Atima, 2020a), where benefits are probabilistic and realized largely as the absence of loss; structured measurement and positioning frameworks from that literature (Sanni, Ajiga, & Atima, 2020b) and from product lifecycle management in network rollouts (Sanni, Ajiga, & Atima, 2020c) suggest disciplined ways of presenting avoided-risk value to decision-makers. Financial analytics frameworks for enterprise value creation (Lawal & Oduleye, 2018a), cross-border tax and compliance analytics (Lawal & Oduleye, 2018b), and transfer pricing risk assessment (Lawal & Oduleye, 2019a) become relevant where maintenance budgets and spares flows cross the corporate structures typical of international offshore ventures, and public-sector evidence on budget compliance and statutory reporting (Dogbatsey & Ebhojie, 2018) and on reconciliation control and workflow redesign (Dogbatsey, Ebhojie, & Oyeleye, 2019) underlines that financial workflow discipline is part of maintenance governance. Finally, access-to-finance research in other capital-intensive sectors (Michael & Ogunsola, 2019a) is a reminder that deferred integrity spend in emerging-market operations is often a financing problem before it is an engineering one.

6.5. Digitalization and Cybersecurity of The Maintenance

Management System The combined RCM-RBI program lives in software: a computerized maintenance management system, an inspection data management system, and increasingly cloud-hosted analytics. This digital estate must itself be engineered and protected. Identity and access management strategies for hybrid and multi-cloud environments (Mbonu, Aliliele, Iwuanyanwu, & Uzoka, 2020), agile digital transformation frameworks with embedded IT risk and ISO compliance (Mbonu, Iwuanyanwu, Aliliele, & Uzoka, 2020a), infrastructure-as-code governance for secure enterprise cloud deployment (Mbonu, Iwuanyanwu, Aliliele, & Uzoka, 2020b), and enterprise log analytics with automated incident response (Mbonu, Iwuanyanwu, Aliliele, & Uzoka, 2019) define the control set for the platforms holding integrity data. Directory and enterprise network management practice (Ladapo, Dosunmu, Jooda, & Abolaji, 2018; Ladapo, Jooda, Dosunmu, & Abolaji, 2019), disciplined CI/CD and platform governance for enterprise systems (Badmus, Dosunmu, & Ozowara, 2018, 2019a, 2019b; Badmus, Dosunmu, Ozowara, & Anunagba, 2020), security audit and enterprise risk assessment frameworks (Dosunmu & Ogundele, 2019), and intrusion detection and prevention models (Dosunmu & Ogundele, 2020) protect the availability and integrity of the systems through which work orders and inspection findings flow. Because offshore control and safety systems are operational technology, the systematic review of operational technology network security and compliance architectures by Adegbite, Adebayo, and Ahmed (2020), together with privacy-centric security engineering models for digital and cloud services (Okoruwa et al., 2020), completes the picture: a maintenance program whose data or systems can be corrupted is itself an integrity threat.

6.6. Regulatory and Safety Case Context

Offshore maintenance of static equipment does not occur in a regulatory vacuum, and the concept is designed to satisfy goal-setting regimes of the kind operated on the UK and Norwegian continental shelves, in which the operator must demonstrate, rather than merely assert, that major accident risk is managed to an acceptable level. Three properties of the concept serve this demonstration directly. The traceability thread from failure mode through consequence to task and interval provides the documented rationale that a safety case and its verification scheme require; safety-critical elements such as the pressure envelope and relief systems acquire performance standards whose assurance tasks are exactly the failure-finding and on-condition tasks of the program; and the indicator set of Table 5 supplies the evidence of ongoing compliance that thematic regulatory inspections, of the kind exemplified by the Health and Safety Executive's asset integrity programme (HSE, 2007), examine. The experience of adaptive safety management system implementation in developing-economy aviation contexts (Adeyelu, 2019) is instructive for operators in emerging offshore provinces, where prescriptive legacy rules and modern risk-based expectations often coexist: the practical path is to run the risk-based program as the master and demonstrate that it envelops the prescriptive minima, documenting equivalence wherever the risk-based interval exceeds a prescriptive one so that the longer interval can be defended or conservatively surrendered. In all regimes, the analysis records, not just the task lists, must be retained and retrievable, because it is the analysis that transforms an interval from an opinion into a defensible engineering position.

6.7. Program Governance, Performance Measurement, And Continuous Improvement A maintenance program is only as good as the management loop that executes, measures, and corrects it. The proposed concept adopts the closed loop implicit in NORSOK Z-008: analyze, plan, execute, record, evaluate, and improve, with defined owners at each station. The maintenance management system holds the tasks with their analysis references; execution generates records in the same structure; and a periodic management review, at least annual for the static equipment program, examines performance against the indicators of Table 5, the status of deferrals, the anomaly register, and the validity of the analysis assumptions. Internal QHSE audit practice of the kind reviewed by Obogo, Arumosoye, and Obriki (2020a) and the technology-enabled audit frameworks discussed by Akomolafe and Agu (2018) supply the assurance layer: independent verification, at defined intervals, that the loop is actually turning and that its records would withstand regulatory scrutiny. Table 5 defines a compact indicator set balancing leading measures, which predict trouble while there is still time to act, and lagging measures, which confirm outcomes. The design principle is that every indicator must have a defined owner, a defined response to breach, and a defined review forum; an indicator nobody acts on is decoration. Two indicators deserve emphasis in the static equipment context. Corrosion circuit data validity is the direct measure of the silent-drift problem identified in Section 4.6, and its degradation is the earliest visible symptom of a program detaching from reality. The PSV as-found failure rate is the empirical check on the failure-finding mathematics of Section 5.5; a platform whose as-found failure rate is persistently above the rate assumed in the interval calculation is operating with less overpressure protection than its safety case claims, whether or not any individual test is failed.

Table 5: Key performance indicators for the static equipment program Indicator Type Definition Purpose and typical target Inspection plan compliance Leading Percentage of risk-based inspection tasks completed within the due window Confirms the plan is executed as analyzed; typical target above 95 percent with zero overdue high-risk items Overdue safety-critical maintenance Leading Number of overdue work orders on safety-critical static equipment and relief devices Regulatory focus indicator; target zero, with escalation for any deferral Corrosion circuit data validity Leading Percentage of circuits with a measured corrosion rate newer than the analysis validity period Guards against silent drift of analysis assumptions; target above 90 percent PSV as-found failure rate Lagging Fraction of relief valves failing the as-found bench test Validates failure-finding intervals; sustained rate above assumption triggers interval review Hydrocarbon releases from static equipment Lagging Count and classified severity of releases attributed to static equipment Ultimate outcome measure; every event investigated and fed back to the FMECA Anomaly closure performance Leading Median time from inspection finding to engineering disposition and closure Measures whether findings are consumed; target dispositions within defined risk-based deadlines Deferral rate and risk exposure Leading Number of approved task deferrals and their aggregated risk exposure Makes accumulated deferral risk visible to management review Program maintenance effectiveness Lagging Ratio of proactive to corrective work hours on static equipment Tracks the intended shift from reactive repair to planned integrity work Inspection exists to find anomalies, so the program must define in advance what happens when it does. The concept requires a single anomaly workflow regardless of the discovering discipline: registration with location and measurement, immediate screening against minimum allowable condition, engineering disposition within a risk-based deadline, and closure by repair, monitoring with revised interval, or documented acceptance supported by a fitness-for-service assessment where the finding lies between the alarm level and the allowable limit. Temporary repairs, clamps, and composite wraps receive their own register entries with expiry dates and inspection tasks, because the accumulation of forgotten temporary repairs is a recognized precursor pattern in hydrocarbon release investigations. The reconciliation and workflow-control principles described for financial processes by Dogbatsey, Ebhojie, and Oyeleye (2019) apply almost verbatim: every finding must be traceable to a disposition, and every disposition to evidence. Continuous improvement in this concept is not a slogan but three specific mechanisms. First, measurement feedback: every thickness reading, probe trend, and as-found test result updates the rate and failure-rate estimates that set intervals, in the incremental, evidence-updated manner argued in Section 6.3. Second, event feedback: every release, near-miss, and failed component receives a mechanism-level investigation whose findings amend the FMECA, in line with the demonstrated value of systematic near-miss data utilization (Arumosoye & Obriki, 2019). Third, external feedback: industry alerts, joint-industry-project findings, and regulatory thematic reviews are screened annually against the installation's mechanism checklist, so that lessons paid for elsewhere are imported before they are re-purchased locally. Together these mechanisms convert the program from a periodically rewritten document into a continuously estimated model of the installation's condition.

6.8. Implementation Considerations

Experience with maintenance methodology deployments indicates that failure is more often organizational than technical, so the concept is paired with a phased roadmap. The phases are deliberately conventional in shape, assess, pilot, roll out, and institutionalize, because the difficulty lies not in the shape but in the exit criteria: each phase ends only when defined evidence exists, not when the calendar says so. The roadmap also assigns the two roles that experience shows cannot be improvised later: a single accountable owner for the combined program, named before the pilot begins, and a data steward responsible for the equipment register and inspection records, since every subsequent activity stands on that foundation.

The first phase is a readiness assessment. Before any analysis, the operator audits its foundations: completeness of the equipment register against the ISO 14224 taxonomy, retrievability of design and inspection records, quality of existing thickness data, capability of the maintenance management system to carry analysis references and due-date logic, and availability of the competences identified in Section 6.2. The output is a gap-closure plan, and the discipline of stating it honestly matters; launching FMECA workshops on top of an incomplete register reproduces the garbage-in problem at industrial scale. This phase typically consumes two to three months and is where data governance controls of the kind described in Section 4.1 are specified. The second phase is a pilot. A single high-consequence system, of the size of the worked example in Section 5 multiplied by one process train, is analyzed end to end by the full team, deliberately including the awkward objects, relief devices, dead legs, and insulated equipment, so that the method is stress-tested rather than showcased. The pilot has three explicit deliverables beyond the program for that system: a calibrated estimate of analysis effort per equipment class for planning the rollout, a tested template and terminology set, and a before-and-after comparison of task count, interval structure, and projected cost against the incumbent program, which becomes the business case evidence for management. A pilot of this scope is realistically a four-to-six-month undertaking including data assembly. The third phase is rollout by criticality. Systems are analyzed in descending order of the Z-008 consequence classification, high-consequence systems receiving specific analysis and medium-consequence systems receiving generic analyses transferred from analyzed sisters and adjusted for local history, which is where the effort economics of the approach are realized. Rollout is paced by the capacity of the team to implement results, not merely to produce them; an analysis whose tasks are not loaded, planned, and resourced within a defined period after approval is counted as a failure in the phase metrics. For a mid-size installation, complete first-pass coverage of static equipment in twelve to eighteen months is a realistic ambition.

The final phase is the transition to the living program, in which the project team dissolves into the line organization: ownership of each analysis transfers to a named engineer, the update triggers of Section 4.6 are wired into the management-of-change and operations reporting systems, the indicators of Table 5 enter the installation's performance review cadence, and the first annual management review closes the loop. The declared end state is deliberately modest: not a perfect program, but a self-correcting one, in which every deviation between predicted and observed condition makes the next prediction better.

Change management runs through all four phases, because the transition asks people to abandon habits that once counted as diligence. Craft technicians who took pride in opening every vessel on schedule must accept that a well-founded decision not to inspect is also integrity work; planners must learn to defend risk-based intervals to auditors trained on calendars; and managers must resist converting the risk language into a lever for cost cutting, since the fastest way to discredit a risk-based program is to harvest its interval extensions while starving its data collection. Practical measures that support the transition include involving execution personnel in the analyses so that the reasoning is owned rather than imposed, publishing the before-and-after comparison from the pilot so the logic is visible, and protecting the first budget cycles from claiming the projected savings before the measurement systems exist to confirm them. None of this is specific to offshore operations, but the small, closed populations of offshore crews make both success and failure travel faster, which is an argument for getting the pilot right before the story of the method is written on the installation grapevine.

6.9. Limitations and Further Research

The concept presented is methodological, and the worked example of Section 5, while representative, is illustrative rather than a validated field dataset; a full case-study application quantifying risk reduction, cost outcomes, and organizational effects over several inspection cycles is the natural next step. Quantitative RBI results are only as good as the fluid characterization and damage-mechanism screening behind them, and novel service conditions, for example CO2-rich injection streams or produced fluids from enhanced recovery, may fall outside the validated envelope of API RP 581 models. The failure-finding mathematics for relief devices assumes constant failure rates that site data may contradict. Finally, the concept addresses topsides static mechanical equipment; structures, subsea systems, and pipelines have their own integrity management regimes and are outside scope, although the same logic of consequence-led, mechanism-informed task selection extends to them in principle. Two further boundaries of the argument should be acknowledged. The concept assumes an operator with the organizational stability to sustain a multi-year program; in late-life assets approaching decommissioning, the economics shift toward risk-informed run-down strategies that this paper does not address, although the same analysis records are the essential input to any credible late-life case. And the worked example deliberately used a data-rich situation with usable history; brownfield installations with lost records face a harder start, in which the first inspection cycle serves primarily to rebuild the baseline that the analysis presumes, and interval setting must remain conservative until it does. Several research directions follow. The updating loop between inspection results and probability-of-failure estimates is at present largely deterministic in industrial practice, and formal Bayesian treatment of corrosion-rate and failure-rate uncertainty would strengthen both interval setting and the strength-of-knowledge reporting advocated in Section 6.3. The rapid maturation of remote inspection platforms surveyed in the UAV literature (Dagodzo, 2018a, 2018b; Dagodzo & Ahiaeke Patrick, 2020) invites systematic study of how drone-acquired visual and thermographic data can be graded for inspection effectiveness within the RBI framework rather than treated as informal supplements. The transition from reactive to predictive maintenance documented for mechanical systems generally (Sunday, Omoegun, Essien, & Oluokun, 2020) raises the question of continuous online corrosion and integrity monitoring as a partial substitute for periodic inspection, with its attendant sensor reliability and data governance problems. Finally, the human and organizational dimension, competence assurance, safety culture, and the behavior of deferral decisions under production pressure, remains the least quantified element of integrity management and arguably the most decisive, and deserves study with the same rigor that this paper applies to corrosion rates.

7. Conclusion

Static mechanical equipment carries the highest-consequence failure modes on an offshore installation while exhibiting failure behavior that classical RCM was not designed around: rare, hidden, degradation-driven loss of containment. This paper has developed an RCM concept that resolves the mismatch by retaining the SAE JA1011 decision logic as the governing framework and embedding Risk-Based Inspection per API RP 580 and 581 as the analytical engine of the on-condition branch, within a NORSOK Z-008 consequence classification and an ISO 14224 data structure. The six-stage methodology, spanning hierarchy and data foundation, consequence screening, degradation-oriented FMECA, adapted task selection, offshore-constrained program assembly, and living-program governance, produces a single auditable program in which every inspection, test, replacement, and redesign decision traces to a specific failure mode and its consequences. The decisive success factors are not analytical sophistication but disciplined data collection, genuine integration of the maintenance and integrity functions, and the management-of-change vigilance that keeps analysis assumptions aligned with operating reality. Adopted in this form, RCM ceases to be a rotating-equipment methodology awkwardly stretched over vessels and piping and becomes what it was always intended to be: a rigorous answer to the question of what maintenance is worth doing, applied to the equipment where the answer matters most. The worked example demonstrates that the outputs of such a program are visibly different from those of a calendar-based regime: unequal, risk-concentrated intervals, explicit sensitivity flags on fragile conclusions, statistically grounded test intervals for hidden protective functions, and standing redesign recommendations where inspection cannot economically carry the risk. The governance apparatus, indicators with owners, a single anomaly workflow, and a phased implementation roadmap, is presented as an inseparable part of the concept, because the history of the industry shows that hydrocarbon releases are seldom caused by ignorance of corrosion science and frequently caused by programs that existed on paper but not in practice. What ultimately distinguishes the proposed concept is its insistence that every task earn its place through a documented answer to the RCM questions, and that every execution of a task return evidence that makes the program's next answer better.