When the thickness workbook has three editors and nobody can reproduce the number

The workbook stops being a record the moment two people open it

The corrosion and blend workbook usually survives one person. It has a column for nominal, a column for depth removed, a formula that subtracts, and a conditional format that turns a cell red. It works because one engineer holds the conventions in their head — which nominal came from the Structural Repair Manual and which from the drawing, whether the value in row 40 was measured or estimated, why one aircraft's tab has an extra column. The system of record is not the file. It is the person.

Then a second and third person start editing. Someone copies a block of rows from last year's aircraft to save typing and inherits its nominal along with the formatting. Someone else pastes values over a formula. A row gets sorted while a filter is active. Six months later a lead engineer is asked how a remaining thickness of 0.0318 inch was arrived at, and the honest answer is that nobody can reconstruct it, because the inputs that produced it were overwritten during the next visit.

That is the point at which the question stops being about software features and becomes one about evidentiary weight. Under 14 CFR Part 145 and AS9110, a repair station has to be able to show how a maintenance determination was made, not merely that it was made. A registry earns its place by making the calculation reproducible: fixed inputs, versioned edits, an identity attached to every change, and a stored result that can be recomputed from the record rather than accepted on assertion.

Why a monitored point on an aircraft will not stay still

In a refinery, CML-14 on circuit 3-P-102 is in the same place in twenty years. Aerospace does not offer that stability. A monitored location may sit on a skin panel that is removed, repaired in a shop two thousand miles away, and reinstalled on a different tail number. A rotable component carries its own history by serial number. A structural location is described by zone, frame, stringer, waterline or buttline — and by effectivity, because the same part number on two aircraft in the same fleet may sit at different stations.

The consequence is that a registry keyed only on aircraft registration will shed data every time hardware moves. It needs two keys: a position key expressed in aircraft coordinates, and a hardware key on the serialized article. Readings attach to the hardware; interval and program logic attach to the position. When a panel comes off and goes back on somewhere else, the thickness history travels with the metal while the zone retains its inspection obligation.

This also determines what fleet analysis is possible at all. If every reading is filed by tail number alone, the only trend you can build is per-aircraft. If readings carry part number, zone and effectivity, you can ask a far more useful question: is this lap joint thinning across the whole fleet, or is this one airframe an outlier? That question is the difference between fixing an aircraft and fixing a program.

The blend-out arithmetic a spreadsheet almost always gets wrong

Corrosion removal in aerospace is not a slow curve. It is a series of discrete events. A technician blends out a corroded area, measures what remains, and compares that against the allowable damage limit for that location. If it passes, the area is dressed and protected and the aircraft returns to service. If it fails, the escalation is a repair scheme or a query to the manufacturer. Between those events, nothing measurable changes at that point.

The trap is cumulative removal. The limit is written against original nominal thickness, not against whatever the material happened to be at the start of the current visit. A location blended 0.004 inch in 2021 and 0.005 inch in 2024 has lost 0.009 inch from original stock. A workbook that records only an as-found figure at the beginning of each visit treats the 2021 removal as the new baseline and reports the second blend as 0.005 inch against a limit written to cover the whole 0.009. Every individual entry looks compliant.

The registry fix is structural rather than clever. Original nominal is stored once and locked. Each removal is an immutable child event with its own date, depth, technique and technician. Remaining thickness is always derived, never typed. When someone needs the number, the system recomputes it from the events. When someone disputes it, the events are still there to be read.

Chem-milled pockets, bonded doublers and which nominal is the nominal

Ask three engineers for the nominal thickness at a given point on a chem-milled skin and you may get three answers, each defensible. There is the sheet nominal before machining, the pocket nominal after chem-milling, and the land thickness at the pocket boundary. Repair manual limits reference a specific one of these. A workbook with a single "nominal" column silently forces a choice that varies with whoever filled the row and what they had open at the time.

Ultrasonic measurement adds its own ambiguity. A contact pulse-echo gauge over a bonded doubler returns the full stack thickness unless the operator resolves the bondline, and a reading taken slightly off the pocket onto the land reads high by the machining depth. Both errors point in the reassuring direction. Both are completely invisible once they are a number in a cell.

A registry answers this by making the feature part of the location definition rather than a remark in a notes field. The point record states pocket, land, doubler stack or monolithic; it stores the applicable nominal for that feature; and it carries the measurement technique required to obtain a valid reading there, including any mandated delay line or echo-to-echo mode. The next technician does not have to reconstruct the intent of the last one.

Recurrence, not rate: what the corrosion program actually needs

A corrosion prevention and control program does not care very much about a single reading. It cares whether a location keeps coming back. Findings are categorized by severity and by whether they exceed allowable limits, and repeated findings at the same location within a defined window are what force a program change: an interval reduction, a task revision, or a referral to the manufacturer and the maintenance review board.

This is a counting problem, and counting is exactly what a shared spreadsheet fails at. The same physical location appears as "FS 620 LH lower lap" on one visit and "L/H fwd fuselage lap jt sta 620" on the next. Two rows, two apparently isolated findings, no recurrence detected. The program sees nothing worth escalating because the data never joined up in the first place.

A registry with a controlled location identifier makes recurrence a query rather than an act of recollection. It also makes the opposite case defensible. When an operator proposes to extend an interval, the supporting evidence is a location-level history showing no repeat findings across several visits, rather than a claim that nobody remembers a problem in that area.

What a Part 145 or Nadcap auditor pulls out of the record

Auditors do not audit the aircraft. They audit whether the record supports the decision. An NDT assessment against the Nadcap AC7114 criteria traces from a result back to the written procedure and its revision, the technique sheet, the equipment and its verification, the reference standard used, and the examiner's NAS 410 or EN 4179 certification — level, method and, where applicable, technique authorization — current on the date the reading was taken.

The most common failure is not a wrong reading. It is a record assembled after the fact that cannot demonstrate contemporaneity. A certificate scanned into a folder proves the person is certified today. It says nothing about whether they were certified in March of last year, which is when the reading in front of the auditor was taken. A registry that snapshots qualification state at capture converts a recurring argument into a stored field.

The same logic applies to instruments. AS9100D clause 7.1.5.2 requires identifiable calibration status and a defined response when equipment is found out of tolerance, which in practice means being able to list every reading taken by a specific gauge between its last good verification and the failed one. That query is trivial against a registry and effectively impossible against a folder tree of workbooks.

Migrating off the workbook without losing what is in it

The fear that keeps teams on the spreadsheet is that migration means retyping years of history, and that a half-migrated dataset is worse than none. In practice the workbook already holds most of what a registry needs. What it lacks is discipline about which column means what. The migration work is a mapping exercise: resolving nominal columns to a feature, resolving location names to a controlled identifier, and deciding what to do with rows whose provenance nobody can vouch for.

The honest approach is to import historical rows as evidence rather than as fact. A migrated reading carries a flag showing it came from the legacy workbook without the technician identity, equipment and technique a native record would have. It still supports trending and recurrence counting. It simply does not claim an audit weight it never possessed. Fabricating the missing metadata to make an import look tidy is the one action that genuinely damages the record.

From there, growth is forward-only. New readings are captured natively with full provenance, and legacy rows age out of relevance as locations are re-measured. Within one or two check cycles the registry holds a complete native history for the locations that matter, and the workbook becomes what it should have been from the start: an archive that nobody edits.

Evaluating a registry: the questions that separate real from demo-ware

Most demonstrations show a clean data-entry screen and a trend chart. Neither is where these systems fail. Ask instead to see an edit reversed. Change a stored nominal, then show the full history of that field: who changed it, when, and what the derived values were before and after. If the previous value is simply gone, the tool carries the same defect as the spreadsheet with a better interface on top.

Then run the awkward scenarios in front of the vendor. Move a serialized panel from one aircraft to another and ask where the thickness history went. Record a second blend at a location blended three years earlier and see what the system compares against. Enter a reading from a technician whose certificate expired last week and observe whether it warns, blocks or accepts silently. Create a location that already exists under a different name and see whether the duplicate is detected.

Finally, ask what leaves the system. The record is only useful if it can be produced in the form someone else demands: an auditor's sample, a manufacturer's query about a repeat finding, or a customer's own maintenance information system. Export fidelity, including the provenance fields rather than only the numbers, is the difference between a registry and one more silo.

Request a consultation