Writing a UT Procedure That Survives a Refinery Audit

Fix the referencing code before you write a word

ASME Section V is a method document. It tells you how to perform an ultrasonic examination and it deliberately contains no acceptance criteria. Acceptance, and the required extent of examination, come from the referencing code: Section VIII Division 1 for a new pressure vessel, B31.3 for process piping as built, API 570 for that same piping once it is in service, API 653 for the tank, and API 579-1/ASME FFS-1 when the decision is to leave a flaw in service and prove it safe. A procedure that opens "examination shall be performed in accordance with ASME Section V, Article 4" and never names what it is referenced by has already failed, because the technician has no basis on which to accept or reject anything.

In a refinery, one asset routinely passes through three regimes in its life. A reactor effluent line is fabricated to B31.3, examined to Section V during construction, inspected under API 570 for thirty years, and finally assessed to API 579 when a local thin area drops below t-min. Each regime asks a different question of the same instrument, and each has its own reporting threshold. The procedure has to state which technique serves which regime, and an auditor will ask that question before he asks anything technical.

The practical consequence is unglamorous. A single catch-all "UT procedure" written to cover construction weld examination and in-service corrosion monitoring will contradict itself on calibration, on scanning coverage and on what gets reported. When the contradiction is found, the finding is not against one paragraph — it is against the document, and the examinations performed under it are in question.

Essential variables are the part that actually binds

Article 4 of Section V splits the requirements of an ultrasonic procedure into essential and nonessential variables. Essential variables include search unit frequency, size and type, wedge or shoe angle, couplant, the technique, examination surface preparation, the surface temperature range, scanning coverage and directions, and the calibration block itself. When an essential variable is changed beyond the range the procedure qualified, the procedure must be requalified by demonstration. Nonessential variables — the report form, the identity of the operator, the sequence of examination — are revised in the document and that is the end of it.

The field failure is almost never deliberate. Glycerin thickens on a January night shift and the crew switches couplant. The 5 MHz dual element goes out for repair and a 3.5 MHz single is used instead. A weld cap is ground flush because access is poor, when the procedure was qualified as-welded. A line is examined hot because the unit could not be cooled in the outage window. Each of those may be an essential variable change. Nobody records it, and the examination is performed outside a qualified procedure without a single person realising it.

The fix is procedural design rather than discipline. Build a technique sheet that lists each essential variable with its qualified range in one column and a blank in the next, and require the technician to enter the actual value used. The moment a value falls outside the qualified range the record itself raises the flag, on the day, rather than eighteen months later in an audit conference room.

Refinery damage mechanisms decide the technique, not the other way round

The most common structural weakness in refinery UT procedures is that they describe an instrument configuration and never name what they are looking for. API RP 571 exists precisely so that the mechanism can be named. Sulfidation on hot crude and vacuum lines is general thinning, but it is not uniform: low-silicon carbon steel components in a run of otherwise identical spools can thin at several times the rate of their neighbours, which means grid density, not instrument sensitivity, is the variable that determines whether you find it.

Naphthenic acid corrosion is the opposite problem. It is velocity-driven and highly localised, concentrated on the outside of elbows, at reducers and downstream of any turbulence, and it grooves rather than thins. A fixed four-point TML rosette can sit entirely on sound metal a couple of inches from a groove that has taken half the wall. The procedure has to specify scanning coverage with a stated index and overlap, and it has to say so in language a technician can be held to, not as an aspiration in the scope paragraph.

Wet H2S damage in amine, sour water and FCC gas plant service is a third case again, because it is not thinning at all. HIC and blistering are laminar and answer to straight beam; SOHIC develops at the weld toe and needs angle beam from both sides with a named sizing method. And HTHA, in hydroprocessing equipment near the Nelson curves of API RP 941, produces fissuring that leaves wall thickness at nominal until damage is advanced — which is why the procedure must call an advanced technique and demonstrate it on HTHA-representative material rather than on a drilled hole.

DAC or DGS, and why the wrong choice becomes an audit finding

Sensitivity setting is where two standards families collide inside one refinery. The ASME approach builds a distance-amplitude correction curve on a basic calibration block containing side-drilled holes at the required depths. The block has to be of the same material specification, product form and heat treatment as the part, in the applicable thickness range, and the block temperature has to be within about 25°F of the examination surface. The couplant on the block must be the couplant on the part, and the search unit must be the same one. Every one of those is checkable in an audit and every one of them is regularly not recorded.

DGS, also called AVG, sets sensitivity from probe-specific curves referenced to an equivalent flat-bottomed hole, and it is the route the ISO family takes — ISO 16811 for sensitivity and range setting, ISO 17640 for ultrasonic testing of welds. It is perfectly good engineering, it needs less block preparation, and technicians trained in Europe or the Gulf often default to it. Using it on ASME-referenced work without the owner's agreement and a documented demonstration is a finding, and it is one of the easiest for an auditor to spot because the calibration record simply looks different.

There is a related trap on the output side. Amplitude-based sizing systematically under-reads the through-wall height of tight, branched, service-induced cracking. If the number leaving your procedure is going to be used in an API 579 Level 2 or Level 3 assessment, amplitude drop is not adequate and the procedure must specify tip diffraction, TOFD or an equivalent height-sizing technique — and say which one, for which flaw type, at which thickness.

The arithmetic that quietly destroys corrosion monitoring

A digital thickness gauge displays a thousandth of an inch, which invites everyone to believe that is the measurement uncertainty. On a rough, pitted, painted or scaled external surface the real repeatability between two competent technicians is more like ten to fifteen thousandths. Compute a short-term corrosion rate from two readings eighteen months apart with that spread and you can manufacture a rate of twenty mils per year on a line that is barely corroding — or a negative rate, a wall that has apparently grown, which is the tell that the whole data set is noise. Under API 570 that number sets the next inspection interval, so the error propagates directly into the integrity plan.

Temperature is the second arithmetic trap and it is systematic rather than random. Velocity in carbon steel falls with temperature at roughly one percent of the reading per 100°F above ambient. On half-inch wall at 400°F the uncorrected reading is off by about seventeen thousandths, which is several years of genuine loss at three mils per year. A procedure that does not state the temperature range it is valid for, and the correction to be applied within it, will produce a data set where hot readings and cold readings are silently mixed across cycles.

The third is the most dangerous and the least discussed: doubling. Below a dual-element transducer's minimum measurable thickness, the instrument can lock onto the second backwall echo and report twice the actual wall. A badly thinned component reads at nominal. The procedure must state the minimum measurable thickness for each search unit it permits, and must require A-scan verification rather than digital-only readings below a stated value. Corrosion monitoring programmes have missed near-through-wall loss for years on exactly this error.

What a qualification demonstration actually has to show

Qualification is not a signature on the cover page. It is a recorded trial in which the procedure, as written, finds what it claims to find in material that resembles the production article. That means blocks of the right material specification, product form, thickness and surface condition; flaws of the right type, orientation and size; acceptance criteria for the trial written down before the trial runs; and every operator who will apply the procedure taking part, because a technique that works for the Level III who designed it is not thereby qualified for the crew.

The record needs the block drawings, the flaw map, the instrument and settings exactly as run, the results, and the misses. A demonstration with a clean sheet and no failures is usually a demonstration performed on machined notches, and a notch is a specular reflector that almost any technique will find. Service-induced damage is tight, branched, often surface-breaking under scale, and frequently oriented in a way that returns almost nothing to a shear wave arriving from the convenient side.

For the two mechanisms that carry the highest consequence — HTHA and cracking in wet H2S service — owner specifications increasingly ask for a performance demonstration modelled on the nuclear approach in ASME Section XI Appendix VIII, with blind or semi-blind trials and stated detection performance. That is a heavier exercise than a Section V demonstration and it should be scoped and priced as a separate piece of work. It is also the only kind of evidence that answers the question an integrity engineer is really asking, which is not "was the procedure followed" but "would this technique have found it."

The findings that recur when this procedure is audited

The same handful of findings appear across refinery NDT audits year after year. The procedure revision in the field pack does not match the current revision in the document control system. Instrument linearity checks are overdue, or were performed on a different serial number than the one in the report. The calibration block used is recorded by nickname rather than by an identification traceable to a material certificate, heat treatment and velocity check. The block temperature versus part temperature is never recorded at all. Couplant contaminant certificates for sulphur and halides are missing on austenitic and nickel alloy work.

A second cluster is about what the procedure fails to state. Scanning speed and overlap are absent, so coverage is whatever the technician felt was reasonable. The reporting threshold is not stated, so two technicians on the same line report different populations of indications. The surface condition the procedure was qualified on is not described, so nobody can tell whether the as-found condition is inside or outside the qualification. None of these are exotic; all of them are fatal to the argument that the data is comparable across cycles.

The third cluster is authority. The Level III who approved the procedure is not certified in ultrasonic testing, or is certified under a written practice that does not cover the method. The procedure cites an edition of the referencing code that the owner's contract does not accept. The procedure was approved by a Level III who has since left, and no current technical authority has reviewed it. Each of those puts the entire body of work performed under the document into dispute, which is a far larger problem than any individual technical error.

Where Atlantis fits, and where it does not

We write the procedure against the referencing code that actually applies, define the essential variables and their qualified ranges, design and build the demonstration, run the trial, record it properly, and sign it as Level III. We then defend it when your client or your registrar audits it, and we revise it when the code edition or the service changes. The deliverable is a document set that a technician can work to and an auditor can follow without asking you a single question you cannot answer from the file.

There are firm boundaries. Atlantis does not act as the API 510, 570 or 653 inspector of record — that inspector authorises and signs the in-service inspection, and the role belongs to your organisation or to a contracted inspector. Atlantis is not a PSM auditor. What we supply is NDT technical authority: the written practice, procedure development and qualification, personnel certification within the practice, audit representation on technical questions, and independent review of inspection data.

If you have a procedure already, the fastest way to start is a gap review against the referencing code and against the damage mechanisms your unit actually has. Consultation and quote on request — write to info@atlantisndt.com with the referencing code, the service, and the mechanisms you are trying to find.

Request a consultation