How 29 CFR 1910.119(j) reaches NDT inspector qualification and records

What PSM covers and why mechanical integrity is the NDT element

Process safety management applies to a process containing a listed highly hazardous chemical at or above its Appendix A threshold quantity, or 10,000 pounds or more of a Category 1 flammable gas or flammable liquid, subject to the standard's atmospheric storage tank exception. That threshold captures effectively every US refinery, petrochemical plant, ammonia refrigeration facility and bulk chemical terminal, which is why the mechanical integrity element sets the shape of inspection work across the entire sector.

Of the standard's fourteen elements, mechanical integrity is the one that consumes NDT, and it is also among the most heavily cited. OSHA enforcement history places mechanical integrity behind only operating procedures in citation volume across the PSM standard. Within the element itself, written procedures and inspection and testing draw the largest share of citations. Those are precisely the two subparagraphs an NDT program touches every working day.

The gap in the market is specific and persistent. PSM consultancies build the management system — process hazard analyses, management of change, operating procedures, compliance audits — and treat inspection as an input they schedule rather than a discipline they can evaluate. NDT vendors execute the examinations and hand over reports. Neither party owns the question OSHA actually asks: does the evidence chain from procedure to qualified examiner to documented result to corrected deficiency hold when read end to end?

The structure of 1910.119(j): six subparagraphs and no more

Paragraph (j) has six subparagraphs. (j)(1) Application defines the covered equipment. (j)(2) Written procedures requires established written procedures to maintain the on-going integrity of process equipment. (j)(3) Training for process maintenance activities covers maintenance employees. (j)(4) Inspection and testing carries four sub-items. (j)(5) Equipment deficiencies governs correction. (j)(6) Quality assurance carries three sub-items covering fabrication, installation, and maintenance materials. Nothing else lives inside the element.

The (j)(1) equipment list is closed and short: pressure vessels and storage tanks; piping systems, including piping components such as valves; relief and vent systems and devices; emergency shutdown systems; controls, including monitoring devices and sensors, alarms and interlocks; and pumps. Structures and supports are not on that list, and OSHA has issued a standard interpretation addressing the point. Scoping an inspection program wider than (j)(1) is a legitimate business decision rather than a PSM obligation.

Four of these six subparagraphs generate NDT evidence. (j)(2) is where the written NDT procedure lives. (j)(4) is where the examination, its frequency, its technical basis and its record live. (j)(5) is where the report's disposition lives. (j)(6) is where positive material identification, weld procedure control and spare-parts suitability live. Only (j)(3) sits outside the NDT program, and it is the subparagraph most often confused with technician qualification.

(j)(4)(ii): where inspector qualification actually enters

This is the point most guidance gets wrong. Paragraph (j) never names ASNT, SNT-TC-1A, CP-189, or any personnel certification scheme. Nothing in 1910.119 states that an NDE examiner must be certified. Employers who search the regulation for a qualification clause find nothing and conclude none exists. The reading is correct; the conclusion is not. An inspector cites them anyway, and the citation lands somewhere they were not looking.

It lands on (j)(4)(ii), which requires that inspection and testing procedures follow recognized and generally accepted good engineering practices. The employer selects its own RAGAGEP. For pressure equipment in US refining and petrochemicals, that selection is API 510 for pressure vessels, API 570 for piping systems and API 653 for aboveground storage tanks, with ASME Boiler and Pressure Vessel Code Section V governing the examination methods themselves and the codes of construction governing acceptance.

Those documents carry the qualification requirement the regulation omits. The API in-service codes separate two roles that plants routinely conflate: the certified inspector, who holds API individual certification and makes the inspection and fitness decisions, and the NDE examiner, who performs the examination and is qualified under the owner-user's written practice. ASME Section V Article 1 routes that written practice to SNT-TC-1A or ANSI/ASNT CP-189. The chain runs regulation, RAGAGEP, code, written practice, examiner.

The RAGAGEP memorandum and the 'shall' versus 'should' line

OSHA published a RAGAGEP enforcement memorandum in June 2015 and updated it in May 2016. It addresses exactly three provisions — (d)(3)(ii) on documenting that equipment complies with RAGAGEP, (j)(4)(ii) on inspections and tests performed in accordance with RAGAGEP, and (j)(4)(iii) on inspection and test frequency — and it sets out sixteen enforcement considerations for compliance officers. It is the single most useful document for predicting how an inspector will read your mechanical integrity file.

Its operative distinction is between 'shall' and 'should'. Deviation from a mandatory 'shall' provision in a RAGAGEP the employer itself selected creates a presumed violation, though the employer may explain its rationale. Non-compliance with a 'should' recommendation creates no such presumption; the compliance officer evaluates whether the employer's approach reflects good engineering practice. Employers who write 'API 510' into a procedure inherit every 'shall' inside that document, including ones they have never read.

Two further considerations bite directly on NDT work. Internal company standards qualify as RAGAGEP where they represent recognized and generally accepted practice, and an internal standard more stringent than the external one still binds the employer that authored it. And where a RAGAGEP is updated with more protective requirements that are not explicitly retroactive, PSM does not compel an upgrade — but the employer must still document that the equipment is designed, maintained, inspected, tested and operating in a safe manner.

(j)(4)(iv): five documentation elements and what breaks them

(j)(4)(iv) requires the employer to document each inspection and test performed on process equipment, and it names the content: the date of the inspection or test, the name of the person who performed it, the serial number or other identifier of the equipment on which it was performed, a description of the inspection or test performed, and the results of that inspection or test. Five elements. A report omitting any one of them fails the subparagraph on its face.

The elements that break in practice are the second and third. 'The name of the person who performed the inspection or test' means a person, not a company — a report signed only with a contractor's letterhead does not satisfy it. A report naming a person whose certification for that method had lapsed on the examination date satisfies (j)(4)(iv) in form while failing (j)(4)(ii) in substance. Equipment identifiers break when a report cites a line number the equipment file does not carry.

'Results' is the element most often reduced below what the regulation needs. A thickness survey reporting a minimum reading without the grid locations, the datum, the nominal, the previous reading and the calculated corrosion rate is a measurement rather than a result. The record has to support the fitness decision that follows it and the next interval calculation, because that is precisely the use OSHA and the API in-service codes both put it to.

(j)(4)(iii): frequency, the API intervals, and risk-based inspection

(j)(4)(iii) requires inspection and test frequency consistent with applicable manufacturers' recommendations and good engineering practices, and more frequently if determined necessary by prior operating experience. That final clause converts an NDT finding into a scheduling obligation: accelerated wall loss found on one circuit is prior operating experience for the equipment it belongs to, and leaving the interval unchanged after finding it is a documented decision the employer must be prepared to defend.

The API codes supply the base intervals. API 510 sets the internal or on-stream inspection interval at the lesser of one-half the remaining life or ten years, with external visual inspection at intervals not exceeding five years. API 570 sets maximum intervals by piping class, with Class 1 piping receiving thickness measurement and external visual inspection at intervals up to five years. API 653 sets external inspection at intervals not exceeding five years, with internal intervals driven by measured corrosion rate.

Risk-based inspection changes the interval basis rather than the evidence burden. Where an owner-user applies RBI to extend beyond a code default, the RBI assessment becomes part of the RAGAGEP documentation, and the inspection data feeding it — thickness readings, corrosion rates, damage mechanism assignments — has to trace to qualified examiners working to approved procedures. An RBI program built on undocumented examination data extends intervals on evidence that will not survive a compliance audit.

(j)(5): equipment deficiencies and the report handoff

(j)(5) requires the employer to correct deficiencies in equipment that are outside acceptable limits, as defined by the process safety information, before further use or in a safe and timely manner when necessary means are taken to assure safe operation. Two conditions sit inside that sentence, and one of them is not optional: the acceptable limits must already be defined in the process safety information before the examination is ever performed.

That is where the NDT report meets the regulation. An examination result becomes a deficiency only against a defined limit — a minimum required thickness, an acceptance criterion, a fitness-for-service assessment level. Where the process safety information does not carry the limit, the plant cannot classify the result, and an unclassified result sits in a report queue rather than in a deficiency workflow. OSHA reads that queue as a set of uncorrected deficiencies, because nothing distinguishes it from one.

'Safe and timely' carries no numeric definition, and the enforcement position turns on whether the employer took necessary means to assure safe operation while the deficiency stood. In practice that means a documented interim measure — a temporary repair to an appropriate code, a pressure reduction, an increased monitoring frequency — tied to the specific deficiency, with a completion date attached. A deficiency carried on a list without an interim measure is carried without a defense.

(j)(2) and (j)(6): procedures and quality assurance

(j)(2) requires written procedures to maintain the on-going integrity of process equipment, and it draws the largest share of citations within the element. For NDT the obligation is concrete: a written examination procedure for each method in use, approved under the employer's written practice, specifying technique, equipment, calibration, scanning parameters, acceptance criteria and reporting content. A procedure index that names methods without carrying approved procedures behind them fails this subparagraph directly.

(j)(6) covers quality assurance in three parts: verification during fabrication that new equipment is suitable for the process application; appropriate checks and inspections to assure equipment is installed properly and consistent with design specifications and the manufacturer's instructions; and assurance that maintenance materials, spare parts and equipment are suitable for the process application. Each part carries an inspection obligation with a direct NDT dimension attached to it.

Positive material identification sits squarely inside the third part. So does weld procedure and welder qualification control on repairs, and receipt inspection of pressure-retaining spare parts. Plants that run PMI as a project activity rather than as a standing maintenance-materials control leave that requirement evidenced only for capital work — and a compliance audit samples maintenance far more readily than it samples projects, because maintenance is where the recurring exposure lives.

The compliance audit under (o) and how the file gets tested

Paragraph (o) requires the employer to certify that it has evaluated compliance with the standard at least every three years, to verify that the procedures and practices developed under it are adequate and are being followed. The audit is conducted by at least one person knowledgeable in the process, findings must be responded to and the response documented, and the employer retains the two most recent compliance audit reports on file.

'Being followed' is the phrase that decides how the mechanical integrity file gets tested. A compliance audit that reads the written mechanical integrity procedure and stops has evaluated adequacy alone. Testing whether it is followed means pulling inspection records against the schedule, tracing named examiners back to certification records valid on the examination date, checking that reports carry all five (j)(4)(iv) elements, and confirming that classified deficiencies moved into correction with dates.

The retention rule has a consequence auditors use deliberately. Because the two most recent reports are on file, a finding appearing in both is a repeat finding with documentary proof, and a finding closed in the earlier report that recurs in the later one demonstrates the corrective action did not hold. Employers who close mechanical integrity findings administratively rather than at root cause assemble that record against themselves, one audit cycle at a time.

Where generic PSM consultancies stop and NDT depth begins

Generic PSM consultancies write and audit the management system competently. What they cannot do is read an ultrasonic thickness report and tell you whether the technique suited the damage mechanism, whether the calibration record supports the readings, whether the examiner's certification covered that technique on the date of examination, or whether the acceptance criterion the report cites matches the one the process safety information defines for that equipment.

NDT service vendors carry the opposite gap. They execute to the purchase order, report in their own format, and have no visibility into whether the resulting record satisfies (j)(4)(iv), whether the deficiency they identified entered a (j)(5) workflow with an interim measure, or whether the interval they were called out on has any RAGAGEP basis behind it. Neither party is failing at its own job. The evidence chain simply runs between them and belongs to neither.

Atlantis works that seam: reading the mechanical integrity file as an ASNT Level III reads it, aligning NDT procedures and examiner qualification to the RAGAGEP the site has actually selected, and rebuilding inspection records so the five documentation elements and the deficiency workflow hold under a compliance audit. Sector scoping is set out in /consulting/petrochemical-ndt-consulting and /consulting/oil-gas-ndt-consulting. Affordable, accessible, fully customizable — request a scoping call or a quote.

Request a consultation