Petrochemical NDT records built for 1910.119(j), not just for the code

A PSM audit reaches your NDT records as evidence, not as a topic

Petrochemical inspection uses the same methods as refinery inspection and answers to a different question. The refinery contractor audit asks whether your people are qualified. A PSM compliance audit asks whether the employer can demonstrate the ongoing mechanical integrity of covered process equipment, and it arrives at your NDT records because they are the proof. The auditor does not open a file marked NDT. He picks a vessel, asks for its inspection history, and follows it down to the person who held the probe.

That trace is the whole exercise, and it breaks at predictable points. The report names a line number that does not match the equipment register. The technician signed with initials. The result column reads acceptable with no readings, no locations and no acceptance criterion. The procedure the report cites has a revision number that does not exist in the document control system. Each break is a separate finding, and each one is written against the employer rather than the contractor who created it.

The practical consequence is that a petrochemical NDT report has a different minimum content than a code-conformance report. It must satisfy the construction or in-service code and it must satisfy 1910.119(j)(4)(iv) at the same time. Designing the report template for both from the start costs nothing. Retrofitting a decade of reports after an audit finding is a project with no budget line.

What (j)(4)(iv) actually requires on the face of every report

The regulation lists five items for each inspection and test: the date, the name of the person who performed it, the serial number or other identifier of the equipment, a description of the inspection or test performed, and the results. OSHA has confirmed in interpretation that documenting results means both negative and positive results, so that the record supports ongoing determination of mechanical integrity rather than acting as a pass stamp.

The identifier is where NDT reports fail most consistently. A report headed with a work order number, a drawing revision and a crew name contains no equipment identifier that ties to the PSI register, so the record cannot be filed against the asset. It exists, it was paid for, and it is invisible to the trace. The fix is a single mandatory field, validated against the equipment register, that no report can be issued without.

The results field fails second. A description of the inspection performed is not the same as the result of it, and a verdict is not a result. What a PSM auditor expects to read is what was measured or observed, where, against what criterion, and what the outcome was. That standard is not onerous. It is simply different from the habit of writing acceptable in a box and moving on, which is what most report templates encourage.

RAGAGEP: name the code, name the edition, keep it alive

1910.119(j)(4)(ii) requires inspection and testing procedures to follow recognised and generally accepted good engineering practices, and (d)(3)(ii) requires the employer to document that equipment complies with them. OSHA's interpretations confirm that published consensus documents qualify and that appropriate internal facility standards also qualify. The requirement is not that you use any particular document. It is that your procedure identifies what it implements and that the identification is current.

Staleness is the failure mode. A UT procedure written to a code edition from twelve years ago, referencing an appendix that a later edition deleted, is worse than one citing nothing, because it demonstrates that the document control system does not track the standards the plant depends on. The 2023 ASME Section V edition, for example, consolidated NDE personnel qualification requirements into Article 1 T-120(e) and removed mandatory appendices that older procedures still cite by number.

The maintenance mechanism is a standards register: every procedure mapped to the documents it invokes, every document mapped to its adopted edition, and a review triggered when an edition changes. Building it is a one-time exercise across a procedure set. Running it costs a few hours per quarter. Not having it converts every code revision into a latent audit finding across your entire procedure library.

Circuits, CMLs and the piping the trace cannot find

Petrochemical piping integrity runs on circuitisation. A circuit groups piping expected to corrode at a similar rate under similar conditions, condition monitoring locations are placed within it, and thickness history at those locations produces a corrosion rate that drives the interval. API 570 sets maximum intervals by piping class and caps the thickness interval at the lesser of the class maximum or half the remaining life. All of that logic collapses if the circuit boundaries were drawn once and never revisited.

The exclusions are where audits land. Dead legs and stagnant sections drop out because they carry no flow and attract no attention, yet they concentrate water dropout, under-deposit corrosion and freeze damage. Small-bore connections drop out because they do not appear at the drawing scale used for circuitisation, yet they fail from vibration-induced fatigue. Injection and mixing points drop out because they sit inside a circuit rather than defining one, yet they corrode at rates the parent circuit never shows.

Documenting the reasoning is what makes the programme auditable. API RP 970 frames corrosion control documents that record, per circuit, the credible mechanisms, the monitoring approach and the basis for it. When a PSM auditor asks why a CML sits where it sits, the answer must be a document, not an inspector's memory. That document is also what lets a new contractor pick up a circuit without re-deriving five years of judgement from scratch.

HTHA: the screening a PSM audit will trace end to end

High temperature hydrogen attack is the mechanism that most distinguishes petrochemical and hydroprocessing integrity work from general refinery inspection. Atomic hydrogen enters steel at elevated temperature and reacts internally, producing methane fissuring and decarburisation. Wall thickness stays intact while the material loses toughness and strength, so a thickness survey returns comfortable numbers up to the point of failure. API RP 941 governs material selection through the Nelson curves.

The curves have moved. The C-0.5Mo curve was removed in 1990, and the eighth edition published in 2016 added a separate curve for non-post-weld-heat-treated carbon steel roughly below the existing carbon steel curve, the first change to those curves in about twenty-five years. The US Chemical Safety Board, investigating a fatal HTHA failure, warned that the Nelson curves should not be relied upon as the sole safeguard and that inspection methods carry real limitations, including that external visual examination cannot detect subsurface damage.

For an audit file that means three linked records: a susceptibility screen identifying which equipment operates above the applicable curve at current conditions, a revalidation record showing the screen was refreshed after any change in feed, temperature or hydrogen partial pressure, and an inspection record whose technique is capable of detecting subsurface damage rather than wall loss. Advanced ultrasonic backscatter approaches, time-of-flight diffraction, phased array and in-situ metallography address the damage. Thickness UT does not, and recording it as HTHA inspection creates a documented false negative.

Training under (j)(3) is a different record from certification

1910.119(j)(3) requires the employer to train each employee involved in maintaining the ongoing integrity of process equipment in an overview of that process and its hazards and in the procedures applicable to their job tasks. That is a process record. SNT-TC-1A certification is a method record. Auditors ask for both and accept neither as a substitute for the other, and contractors routinely arrive with only the second.

The gap is real, not clerical. A technician who has examined amine circuits for a decade knows why a particular weld matters. A technician who arrived last week from a structural fabrication shop with an identical Level II certificate does not, and will scan the accessible face rather than the one the mechanism attacks. Unit-specific hazard training is what closes that, and it produces the attendance record, the content list and the assessment that an auditor can inspect.

Contractor management under 1910.119(h) then binds the two together. The host employer must obtain and evaluate information on contractor safety performance and programmes, which in practice means collecting the contractor's written practice, sampling its certification files, and confirming its technicians received the unit training. Contractors who supply that package unprompted at mobilisation are treated differently by every subsequent audit, because the host has already banked the evidence.

Deficiencies, management of change, and the finding that never closed

1910.119(j)(5) requires the employer to correct deficiencies in equipment outside acceptable limits before further use, or in a safe and timely manner when necessary means are taken to assure safe operation. NDT generates those deficiencies. A reported wall loss below retirement thickness, a recordable indication in a weld, a hardness result outside the specification: each starts a clock that the inspection record must show being answered.

The failure is the recommendation closed to monitor. An indication is found, an engineering evaluation is deferred, the item is logged for the next campaign, and the next campaign inherits the same wording. Three cycles later the record shows a known deficiency carried for six years with no evaluation, no fitness-for-service assessment and no acceptance decision by anyone qualified to make one. That reads as an unaddressed deficiency, and it reads that way to an incident investigator as well as an auditor.

Management of change under 1910.119(l) catches the quieter version. Inspection technique, scope and interval are all changeable, and all get changed for schedule and cost reasons between campaigns. Replacing encoded phased array on a set of welds with spot thickness readings alters the detection capability of the programme. If that happened without MOC, the plant lowered its own integrity assurance without any recorded decision, and the audit will say so.

The triennial audit, and why NDT findings repeat

1910.119(o) requires the employer to certify that it has evaluated compliance with the standard at least every three years, using an audit team including at least one person knowledgeable in the process, to develop a report of findings, to promptly determine and document a response to each finding, and to document that deficiencies have been corrected. Compliance guidance identifies the two most recent audit reports and the responses to each finding as documents an inspection will request.

Because two cycles are visible, repeat findings are structurally exposed. NDT findings repeat more than most, because the corrective action written against them is usually an instruction to a contractor rather than a change to a system. Telling a vendor to include equipment identifiers on reports does not survive a change of vendor. Changing the report template, the acceptance gate and the document control rule does.

That is where an outside Level III earns the retainer during an audit cycle: converting each records finding into a system change with an owner and an evidence trail, then producing the evidence at the next audit rather than reconstructing it. The measure of success is that the second cycle's NDT section is shorter than the first's, which is the only signal an auditor genuinely reads as improvement.

How an outsourced Level III fits inside a PSM programme

A retained Level III in a petrochemical setting owns the NDT technical layer: the written practice and its approval, the method procedures and the RAGAGEP they cite, the examination bank and its control, the certification decisions for technicians, and the technique selection reasoning against the credible damage mechanisms for each circuit and vessel. Our outsourced Level III scope and retainer page describes how that engagement is structured and reviewed.

What the role does not own is equally important to write down. Fitness-for-service acceptance, interval setting, retirement thickness and the decision to run or repair sit with the owner's mechanical integrity engineer and the authorized inspector. A Level III who signs those decisions has stepped outside the authority the written practice grants, and our page on what an outside Level III can and cannot do sets out the boundary in the terms auditors use.

Examination records deserve their own discipline in a PSM plant, because they are the records most likely to be requested years after the person concerned has left. The exam authorship and retention page covers what an examination file must contain, who may administer it, and how long it survives. Getting that right removes the most persistent repeat finding in petrochemical NDT audits at close to zero recurring cost.

Request a consultation