Writing a UT Procedure That Survives an API 653 Audit

Two different jobs under one cover page

Almost every terminal I have audited keeps a single document titled "Ultrasonic Testing Procedure." Inside it are two unrelated pieces of work. One is thickness measurement — a metrology task whose output feeds straight into API 653 shell and bottom evaluation and into the corrosion-rate arithmetic that sets the next internal inspection interval. The other is angle-beam examination of welds: flaw detection and sizing against the acceptance criteria of a referencing code, applied to repair welds, replacement shell plate, reconstruction seams and nozzle installations.

They share an instrument and almost nothing else. Different probes, different calibration philosophy, different reference blocks, different demonstration, different failure modes and radically different consequences of being wrong. A thickness technique that reads a hundredth of an inch optimistic pushes a tank's remaining life out by years and does it silently. A weld technique that misses lack of fusion in a repair seam buries a planar defect behind a coating for the life of the asset.

Combining them into one document nearly always means one of the two gets four lines and no controlled variables. We write them as separate qualified procedures inside one program, cross-referenced, with separate qualification records and separate technician demonstrations. It costs one extra document number and removes the most common structural criticism a competent auditor makes.

The essential variables terminals leave open

ASME Section V, Article 4 gives you the categories: search unit type, frequency and element dimensions, examination angles, couplant, surface condition, calibration block, scanning technique and coverage, the sizing method, gain and sensitivity setting, data recording, and personnel requirements among others. Naming the list is not the same as controlling it. A procedure controls a variable only when it states a value or a bounded range and states what happens when the field departs from it.

The wording that fails an audit is familiar. "Couplant: suitable ultrasonic couplant" permits glycerin on a 300 °F asphalt shell, where it boils out of the interface mid-scan and the reading either drops out or drifts upward in a way the technician has no reason to distrust. "Surface condition: clean" is not a roughness limit; a needle-gunned shell and a lightly abraded one do not return the same backwall, and on badly thinned steel the difference decides whether there is an echo at all.

We fix each variable to a value or a range, state the requalification trigger next to it, and put the qualified range in the same table the technician actually reads. The test we apply before signing is blunt: hand the procedure to a competent technician who has never seen the site, and check whether he can only do it one way. If he has choices, the procedure has not yet done its job.

Damage mechanisms choose the technique, not the other way round

API RP 571 is the right starting point, and for terminals the shortlist is genuinely short: soil-side corrosion of the floor, microbiologically influenced and under-deposit attack in water bottoms, atmospheric corrosion at the chime and shell-to-bottom junction, corrosion at the product and vapour interface and in the vapour space, corrosion under insulation on heated tanks, and — in fuel ethanol service — stress corrosion cracking in weld heat-affected zones.

Each mechanism dictates a technique or defeats one. Straight-beam thickness on the shell tells you nothing about the floor. Corrosion under insulation, the subject of API 583, is invisible until jacket and insulation come off, which means the procedure has to define what happens when they do not: screening by another method with ultrasonic confirmation at defined intervals, not a blank space in the report. Fuel-grade ethanol cracking is the sharpest example of all. Cracks initiate in the heat-affected zones of shell and roof welds, run tight and shallow, and a thickness survey of a badly cracked FGE tank returns a complete set of perfectly nominal readings. API's ethanol work — TR 939-D and Bulletin 939-E — exists because that failure mode surprised experienced people.

A procedure written without the mechanism list attached is a general-purpose document doing a specific job. We put the mechanism, the location it appears, the technique that finds it and the technique that will miss it into one table, and reference that table from the scanning plan so the technician cannot separate them.

Temperature, geometry and the arithmetic that goes quietly wrong

Velocity in carbon steel falls as the steel heats. Calibrate on a step wedge in the shop at ambient, then measure a heated asphalt or bunker tank running between 250 and 350 °F, and the instrument reports steel that is not there — on the order of one percent per hundred Fahrenheit degrees above the calibration temperature. On a nominal half-inch course that is roughly twelve thousandths of an inch of fiction, comfortably more than the corrosion allowance two engineers will spend a week arguing about. The fix is trivial and the omission is close to universal: require surface temperature on every reading set, and require either calibration on a block at working temperature or a documented, shown correction.

Geometry works against you in the other direction. A dual-element probe averages across its footprint. A corrosion pit with a rough, non-parallel floor returns a weak and scattered echo, and the instrument frequently reports the surrounding ligament rather than the pit bottom — the one number that governs. On heavily thinned plate, V-path error and the doubling behaviour of some thickness gauges can hand back a reading close to twice the true wall. The procedure has to name the probe, name the minimum thickness it is valid to, and say what the technician does when a reading is unstable. The honest instruction is usually "stop and change technique," not "record the number."

The last trap is the code arithmetic itself. API 653 minimum thickness for a shell course is a function of the height of the point being evaluated. A reading taken four feet up a course, compared against a minimum computed for the bottom of that course, is not the comparison the code asks for. Depending on which direction the mistake runs it is either needlessly conservative or quietly unsafe, and neither is defensible in front of an auditor. That single failure is why the procedure must require elevation, not just a grid number.

Repeatability, monitoring locations, and corrosion rates that lie

API 653 asks for both long-term and short-term corrosion rates and works from the governing one. Both are differences between two numbers taken years apart. If the second number was taken six inches from the first, the rate you compute is not a corrosion rate at all — it is the spatial variation of a corroded plate, dressed up as time. Terminals rarely notice, because a plausible-looking rate never triggers a question.

A terminal procedure has to make repeat readings land on the same steel. That means a permanent, physically marked datum; circumferential position measured from a named reference such as a manway centreline; elevation from the chime; a grid identity that survives a recoat; and an explicit rule for what the technician does when the mark is gone. It also has to state what the technician records and what the evaluator is permitted to do with it. API 653 shell evaluation allows averaging over defined lengths. If the procedure instructs the technician to report only the single lowest reading in a grid, the evaluator loses the averaging the code actually permits, and a serviceable tank gets retired on data that never justified retirement.

We have seen the inverse just as often — an average reported as though it were a point measurement, concealing a locally thin band that governs the whole course. Both are procedure failures, not technician failures, and both are fixed with two sentences in the reporting clause.

What the qualification demonstration has to show

ASME Section V expects a written procedure and, where the referencing code requires it, a demonstration to the satisfaction of the Inspector. The word carrying the weight is "demonstration." A procedure signed by a Level III and never executed on a specimen is an opinion with a signature attached.

For thickness we build the demonstration around specimens that resemble the asset: corroded plate with thickness verified by an independent method, pitted coupons with measured remaining ligaments, a rough-backwall specimen, and where heated tanks are in scope, a block at temperature. The acceptance criteria are stated before anyone picks up a probe — agreement to a defined tolerance, correct identification of the minimum ligament under a pit, and repeatability between two technicians at the same marked point. For angle beam we use notched and cracked specimens and record detection, sizing tolerance and the false-call count, because a technique with no false-call record has not been characterised at all.

The qualification record is the deliverable an auditor actually wants to see: date, specimen identities and traceability, instrument and probe serial numbers, the technician and the certification he held on that day, the results measured against pre-stated criteria, and the Level III's approval. Without that record, the procedure and the demonstration are two separate claims that never met.

SPCC, STI SP001 and the containers the API 653 program forgets

40 CFR 112.8(c)(6) requires integrity testing of bulk containers on a regular schedule, combining visual inspection with another testing technique, in accordance with industry standards. It does not name ultrasonics, and — this is the part that catches people — it does not confine itself to the tanks in your API 653 population. Under 112.3(d) the plan carries a professional engineer's certification, which is the mechanism by which somebody's licence becomes attached to the quality of your inspection data.

The recurring citation is almost never on the large field-erected tanks. It is on the shop-built ones: additive tanks, day tanks, used-oil and slop tanks, generator belly tanks, the small vessels nobody puts on the inspection master list. Those sit outside API 653 scope and are normally evaluated to STI SP001, whose schedule and testing requirements are driven by container category, size and the presence of continuous release detection — an entirely different logic from the API 653 clock. Terminals with an exemplary 653 program routinely have no integrity testing evidence at all for these containers.

A UT procedure that acknowledges only the API 653 population leaves the technician without instructions for a large share of the site's containers, and leaves the SPCC plan certifier without support. We scope the procedure to the container population, not to whichever code the owner happens to be thinking about that week.

The findings that recur when this procedure is audited

Six turn up again and again. The procedure cites ASME Section V and states no essential variable values. The calibration block is of unknown material with no traceability record. Instrument linearity checks — screen height and amplitude control — have no records at the interval Section V sets. Surface temperature is never recorded, so nobody can determine whether the correction clause was applied. Reading locations carry a grid number and no elevation. And the demonstration record is missing entirely, so the procedure has never been shown to work on anything.

Two more are worse because they make no noise. The first is a technician certified in ultrasonics generally, performing shear-wave weld examination, whose practical examination covered thickness only — a written practice failure surfacing as a procedure failure, and one that puts every report he signed into question. The second is a revision history that simply stops: Rev 3, dated four years ago, with three undocumented field changes since, all agreed verbally between a supervisor and a technician who has since left.

None of this is exotic. It is what happens when a document is written once to satisfy a client's bid package and then never operated as a control. The remedy is not a longer procedure; it is a procedure with fewer open choices and a record trail that closes.

How Atlantis runs a procedure development engagement

We start from the asset population and the damage mechanisms, not from a template. That means a walk-down or a document package: container list including the small shop-built tanks, service history, product changes, heating arrangements, insulation, coating history, previous inspection reports, existing procedures and the written practice those procedures depend on. Gaps in the written practice usually show up here, and we flag them rather than writing around them.

Then a drafted procedure with every essential variable fixed and a qualified range stated, followed by a demonstration designed against your specimens and witnessed. The outputs are the procedure itself, the qualification record, the technician demonstration records, and a revision-controlled home for all of it inside your quality system — plus a short briefing for the people who will have to defend it when a client auditor or a pipeline inspector arrives.

Work is performed and approved by an ASNT NDT Level III certified in the applicable methods, and the scope of that certification is stated in writing before anything is signed. Consultation and scoping on request through info@atlantisndt.com.

Request a consultation