Trusting thickness data you did not collect

The plant with no inspection department

A specialty or batch chemical site typically has no owner-user inspection organisation in the sense a refinery would recognise. Integrity sits with one reliability engineer who also owns maintenance planning, spares and a share of the capital programme. Every ultrasonic thickness measurement, every visual examination, every internal vessel inspection is bought from an outside firm. The site's integrity record is therefore assembled almost entirely from documents written by people who do not work there and who may not be back next year.

The regulatory picture is different from petrochemical too. Many chemical processes hold inventories below the threshold quantities that bring 29 CFR 1910.119 into force, so the driver is not always an OSHA auditor. More often it is the property insurer, the jurisdictional pressure vessel inspector, the corporate standard imposed by a parent company, and the plain commercial fact that an unplanned failure in a single-train plant stops revenue entirely. That mix produces less external pressure to keep records well and no less technical need for them.

The result is a specific and very common failure pattern. The site has years of thickness reports, each internally consistent, produced by four or five different contractors under four or five different conventions, and no way to know whether the trend across them describes the equipment or the vendors. The engineer suspects it does not, cannot prove which readings to distrust, and therefore treats the whole history as advisory.

Velocity, doubling and readings wrong by a quarter

Ultrasonic thickness measurement infers wall from time of flight using an assumed sound velocity, and chemical plants are where that assumption breaks most often, because the metallurgy is diverse. Carbon steel is near 5,900 metres per second. Austenitic stainless is a little lower. Titanium is a little higher. Zirconium, used in strong acid service, and several copper-nickel alloys used in exchangers sit near 4,600 to 4,700. A gauge left on the carbon steel setting reads those roughly a quarter thick, and the error is invisible because the number looks ordinary.

Several other errors travel with it. On thin wall a gauge can lock onto the second backwall echo and report double the true thickness, which reads as a comfortable, wrong margin. Temperature shifts velocity in steel by roughly one percent for every 55 degrees Celsius above ambient, so hot readings taken without correction under-read; readings corrected on one campaign and not the next produce a phantom trend. Paint or coating not accounted for adds thickness that is not metal. And a display resolving to a thousandth of an inch does not make the measurement accurate to a thousandth of an inch.

ASME Section V Article 23 with SE-797, and ASTM E797, address this directly by requiring calibration on reference blocks of like material and known thickness. The register's role is to make that requirement enforceable rather than aspirational: capture the velocity setting and calibration reference as mandatory fields on every reading, compare the declared velocity against the material recorded on the CML, and refuse the submission when they disagree.

Alloy and lined equipment break the standard CML model

Clad and weld-overlaid vessels create an ambiguity that spreadsheets never resolve. An ultrasonic reading through a stainless-clad carbon steel shell returns total wall including the cladding, but the pressure-retaining minimum thickness under ASME Section VIII Division 1 usually applies to the base metal, unless the cladding was credited in the design calculation. A history that does not record whether each reading includes the overlay is not a history; it is two incompatible datasets sharing a column, and the remaining life derived from it is wrong in a direction nobody can predict.

Lined equipment is worse, because the honest answer is that thickness is not the measurand at all. A glass-lined reactor fails by pinholing and spalling of the glass, detected by high-voltage spark testing, not by shell thinning. Rubber and PTFE linings fail by disbondment, permeation and mechanical damage. Fibre-reinforced plastic is assessed visually and by Barcol hardness and resin condition. In each case the vessel can be perfectly healthy on wall thickness and completely unfit for service.

A register that assumes every monitoring location produces a thickness forces the site to keep this equipment somewhere else, which recreates the fragmentation the register was bought to remove. The correct structure declares a measurand per location — wall thickness, holiday count, hardness, adhesion result, visual condition grade — each with its own units, acceptance criteria and interval, so the acid reactor and the carbon steel transfer line live in the same integrity record with the same approval workflow.

Six contractors, six deliverable formats

Over a decade a chemical site will typically use several inspection vendors, and each brings its own reporting conventions. One delivers a formatted PDF with the readings embedded in a table image. One sends a spreadsheet whose columns are named for its own internal database. One exports a datalogger dump straight from the gauge, unlabelled. One still submits scanned handwritten field sheets. One offers access to its own web portal and considers the data delivered when you can log in and look at it.

Underneath the format differences sit the substantive ones. Units vary between millimetres, inches and mils. Location identifiers drift, because a contractor's software will not accept your naming scheme so their technician invents one that will fit. Grid conventions differ: one crew reports the minimum of five points, the next reports all five, a third reports an average. No-reads are handled inconsistently, and the most damaging convention is the blank cell, which is indistinguishable from an inspection that was never scoped.

Manual reconciliation of all this is the hidden labour cost of integrity in a small chemical plant, and it is done under time pressure by the one person who already has three other jobs. It is also where errors enter that no later review will catch, because once a wrong number is transcribed into the master history it acquires the same authority as a right one. The reconciliation has to become a machine process with rules, or it will not be done consistently.

Validate at the gate, not after import

The decisive architectural choice is where validation happens. Most systems import everything and let engineers find problems during review, which means bad data is already in the history and the crew has left the site. The alternative is a submission gate: the contractor uploads against a location list issued by the register, the register applies a published rule set, and the submission is either accepted whole, or returned with the specific failures identified.

The rules that matter are unglamorous. Every location identifier must exist in the register and be active. Units must be declared, not inferred. Velocity setting must be present and consistent with the material recorded on the CML. The technician's certification must cover the method and level and be valid on the examination date. Every issued location must return either a value or a coded no-read with an access reason. And every reading must imply a corrosion rate inside a configured band for its circuit, with anything outside — including apparent metal growth — held as an exception rather than absorbed.

The commercial leverage is the reason this works. A rejection issued before the invoice is approved and while the scaffolding is still standing gets a re-shoot at the contractor's cost within days. The same rejection three months later gets an argument, a change order and a gap in the history. Making the gate part of the scope of work, with the rule set published to bidders, converts data quality from a hope into a contractual deliverable.

Re-finding the CML the last crew shot

The single largest source of apparent corrosion in a contractor-collected history is relocation. A new crew, working from a report that describes a location as "vessel V-204 shell, lower course", picks a reasonable point. It is not the previous point. The reading is competent, the report is honest, and the trend is now garbage, because it is comparing two different pieces of metal separated by whatever local variation the fabrication and service produced.

Prevention is physical and documentary together. Physically, locations should be marked in the field in a way that survives: low-stress stamping where the material and service permit, welded or mechanically attached identification tags, durable paint markings on coated equipment, and photographs taken at the time showing the point relative to a permanent feature. Documentarily, each location should carry a distance and orientation from a named datum such as a weld or flange face, a clock position, and the grid pattern and spacing used.

The register closes the loop by issuing that package with the work rather than archiving it. A contractor who receives a photograph, a datum offset and the previous grid values will hit the same point. And when they do not, the register should catch it: a step change against an otherwise flat history is the diagnostic signature of relocation, and it deserves an exception and a re-shoot rather than a new data point that quietly resets the trend.

Contractor scorecards and the rebid cycle

Once submissions pass through a gate, the register accumulates a performance record for each vendor without anyone setting out to build one. Gate rejection rate on first submission, proportion of readings missing mandatory metadata, uncoded no-read rate, plausibility exceptions per hundred readings, re-shoot rate and on-time delivery are all derivable from data the system already holds. None of it requires a survey or a subjective assessment.

That record changes how a rebid runs. Inspection services in chemical manufacturing are frequently awarded on unit price because nothing else is measured, which systematically rewards the contractor who moves fastest and validates least. A vendor whose submissions pass first time, whose metadata is complete, and whose readings do not generate plausibility exceptions is delivering a materially different product from one whose files take an engineer two days to reconcile, and until that difference is visible it cannot be paid for.

It also protects the site during transitions. When a new contractor takes over, their first campaign is the highest-risk data the register will ever receive, because they have never seen these locations. A visible baseline of what normal submission quality looks like lets the engineer set expectations in the kick-off meeting, watch the first submission closely against a known standard, and correct convention drift in week one rather than discovering it at the next turnaround.

How to evaluate a register when the data is not yours

Test the gate, not the dashboard. Bring a real contractor file — ideally one of the messy ones — and a deliberately corrupted copy with a wrong velocity, a renumbered location, mixed units and three missing readings. Ask the vendor to submit both and show what the system does with each. A register that accepts everything and asks an engineer to review afterwards has not solved the chemical manufacturing problem; it has re-hosted it.

Then check the things specific to this industry. Can a monitoring location declare a measurand other than thickness, so a glass-lined reactor and a zirconium column live in the same record? Can a reading record whether cladding is included in the measured wall? Can a contractor submit without a full internal licence, through a scoped external route that does not give them access to the rest of the plant's data? Can a submission be held in quarantine while a query is resolved, with the acceptance decision and its author recorded?

Finally, confirm you can leave. Ask for a complete export of locations, readings, metadata, attachments and calculation basis in an open format and reload it independently. A site with no inspection department is unusually dependent on its tools, and an integrity record locked inside a single product is a risk of the same kind as an integrity record locked inside one contractor's portal. Atlantis builds this module on a fully customisable, open Odoo-based platform; a demonstration using your own contractor submissions can be arranged through info@atlantisndt.com.

Request a consultation