Building an ammonia and fertilizer CML register that survives the audit
A fertilizer and ammonia CML and TML registry has to prove coverage, not just store numbers. Auditors ask which locations were due, which were read, who was certified to read them, and what happened to the ones that were missed. Because ammonia stress corrosion cracking, hydrogen attack, nitriding and carbamate corrosion are not thinning mechanisms, most of the register holds damage-state locations rather than thickness.
OSHA cites 29 CFR 1910.119(j), mechanical integrity, more often than any other process safety management element, and an anhydrous ammonia inventory above 10,000 lb puts the process squarely in scope. The audit rarely turns on a single bad reading. It turns on the gap: a wet fluorescent magnetic particle location on an ammonia sphere that was scheduled for the last turnaround, never executed and never formally deferred; a Nelson curve reassessment triggered when a later edition of API RP 941 lowered the carbon steel curve, with no follow-up recorded; a urea high-pressure stripper bundle examined by a technician whose eddy current certification had lapsed six weeks earlier. Each of those is a record problem before it is an integrity problem, and a register that cannot show planned against executed coverage on a given date cannot answer any of them.
Source: Sources relied on: OSHA 29 CFR 1910.119, in particular (d) process safety information, (j) mechanical integrity and (j)(4)(iv) on correction of deficiencies; EPA 40 CFR Part 68 risk management programs; API 510, API 570 and API 653 for in-service inspection of vessels, piping and tanks; API RP 571 for damage mechanisms including ammonia stress corrosion cracking, nitriding, metal dusting and creep; API RP 941 for steels in hydrogen service at elevated temperature; API RP 580 and API RP 581 for risk-based inspection; API 620 including Appendix R for low-pressure refrigerated storage; ASME BPVC Section V and Section VIII; ASME B31.3; ASTM E1444/E1444M for magnetic particle examination; ASNT SNT-TC-1A and ISO 9712 for personnel certification.
| Unit and mechanism | Monitoring technique | What the location record must carry | Question the auditor actually asks |
|---|---|---|---|
| Atmospheric ammonia storage tank, stress corrosion cracking at shell and annular welds | Wet fluorescent magnetic particle examination after surface preparation, with ACFM on selected seams | Weld map reference, surface preparation state, MT technique sheet, indication length, depth after grinding and final disposition | Show me every SCC location on this tank and the result of its last examination |
| Pressurised ammonia sphere, cracking driven by oxygen ingress | Internal WFMT at turnaround, supported by dissolved oxygen and water content trending | Ammonia purity and water content log linked to the same asset record, not held in a separate laboratory file | How do you know inhibition was maintained between inspections |
| Synthesis loop hot piping and vessels, high temperature hydrogen attack | Advanced UT including TFM and backscatter, velocity ratio, in-situ metallographic replication | Operating temperature and hydrogen partial pressure at that specific location, with its position against the applicable curve | What is the basis for saying this line sits below the curve today |
| Primary reformer catalyst tubes, creep and metal dusting | Laser profilometry for diametral growth, eddy current, tube-by-tube position mapping | Row and tube number, percentage diametral growth, creep damage stage — not wall loss | Which tubes were replaced last campaign and against what criterion |
| Urea high-pressure stripper tubes, carbamate corrosion after passivation loss | Eddy current and IRIS on a sampled tube set, ammonia leak testing of the tubesheet | Tube map, sample size with the selection rule that produced it, oxygen injection record for the campaign | Justify inspecting part of the bundle rather than all of it |
| Nitric acid absorber internals, intergranular and end-grain attack on 304L | Visual examination and pit depth gauging on trays, thickness on the shell | Pit depth distribution by tray number, acid strength and temperature at that elevation | Where is the written acceptance limit that made this pass |
| Refrigerated ammonia lines, corrosion under insulation in cold service | Insulation removal at defined windows, profile radiography or UT on removal | Insulation removal window identifiers, jacket and vapour barrier condition, date each window was last opened | Prove the CUI plan actually covered these lines rather than the easy ones |
The audit is a coverage question, not a thickness question
Plants preparing for an audit almost always start by checking their numbers. They pull remaining life figures, look for anything close to a limit, and rehearse the explanation. Then the auditor sits down and asks a completely different question: for this vessel, show me everything that was due since the last audit and tell me what happened to each item. Executed, deferred, or not done. That single question exposes more findings than any review of thicknesses, because it tests whether the plan and the execution are the same document.
In a spreadsheet-based register they are not the same document. The plan lives in one file, usually maintained by the inspection coordinator. The results live in the turnaround folders, organised by contractor and date. Reconciling them means someone manually ticking a list, which is exactly the work that gets abandoned when a turnaround overruns. The gap between planned and executed is invisible until an outsider asks for it, and by then it is a finding rather than a backlog.
A register that treats a monitoring location as a scheduled obligation rather than a row of numbers answers the question immediately. Every location has a due date, a status, and if the status is anything other than executed, a documented reason and an approver. The report an auditor wants is then a query, not a project, and the internal value is larger than the audit value: the same view run quarterly tells the integrity engineer where the programme is actually slipping while there is still time to fix it.
Ammonia damage mechanisms do not thin steel, and that reshapes the register
Ammonia stress corrosion cracking is the mechanism that defines this industry's inspection programme, and it produces no measurable metal loss at all. Carbon steel in anhydrous ammonia service cracks under the combination of residual or applied stress, oxygen contamination and the absence of a small water content that acts as an inhibitor. The cracks are tight, often branched, and concentrated at welds and their heat-affected zones, at nozzle reinforcements and at repair areas where post-weld heat treatment was omitted. They are found by wet fluorescent magnetic particle examination on a properly prepared surface, not by a thickness gauge.
That has a direct structural consequence for the register. The location is a weld or a weld zone, identified against a weld map, and the record is an indication list with lengths, orientations, depths after grinding and dispositions, plus the technique sheet that governed the examination. Whether the same weld was examined last time, over the same length, with the same surface preparation, matters more than any number. A register that cannot express partial coverage of a seam will report a weld as inspected when only a third of it was.
Two supporting datasets belong on the same asset record rather than in a laboratory system. The first is ammonia purity: oxygen content and water content over the interval, because the argument that a tank remains fit between examinations rests on inhibition having been maintained. The second is the repair and post-weld heat treatment history, because uncontrolled repairs create the residual stress that later cracks. Auditors ask for both, and sites that keep them in three systems spend the audit fetching rather than answering.
Urea and nitric acid: locations where a linear corrosion rate is the wrong model
Urea synthesis is the clearest example in the industry of a place where conventional corrosion rate mathematics misleads. High-pressure stripper tubes, carbamate condensers and reactor liners in urea-grade austenitic stainless, duplex or specialised alloys survive because an injected oxygen concentration maintains a passive film. While the film holds, corrosion is effectively immeasurable. When it fails — through an oxygen injection upset, a hydrogen excursion, or local flow conditions — attack proceeds at rates measured in millimetres per month.
Take two thickness readings four years apart across such an event and you get a modest, smooth annual rate that describes no physical process. It will be used to set the next interval, and it will be wrong in the only direction that matters. The register's job here is not to compute a rate but to keep the process evidence attached to the inspection evidence: the oxygen injection record, the operating excursions, the leak detection history on the tubesheet, and the sampling rule that decided which tubes were examined at all.
Nitric acid plants have a related problem in a different form. Attack on 304L absorber internals is localised and orientation-dependent, concentrated at end grain on cut edges and at intergranular paths in sensitised material. The meaningful record is a pit depth distribution by tray and elevation against a written acceptance limit, with acid strength and temperature at that elevation attached. Averaging pit depths into a mean thickness loss destroys the only information the inspection produced.
The reformer: monitoring locations that are tubes, not points
Primary reformer catalyst tubes break the point-based model entirely. The monitored population is a set of a few hundred centrifugally cast tubes identified by row and tube number, and the condition indicators are diametral growth measured by laser profilometry, creep damage stage assessed from eddy current and replication, and visual evidence of hot bands and bulging. None of these is a wall thickness, and the unit of decision is an individual tube: replace, retain, or retain with monitoring.
Two constraints follow. First, tube position identity has to be immutable across campaigns, because the entire value of the dataset is growth at the same tube over time. When a contractor renumbers a row from the opposite end, the trend for every tube in that row silently transposes, and the analysis that follows is not merely noisy but reversed. Second, the register must carry the replacement history, since a replaced tube resets to zero and any trend that carries the old tube's growth forward will condemn a new tube.
Metal dusting in the transfer line and waste heat boiler inlet is a further category, driven by carburising conditions in high carbon activity gas at intermediate temperatures. It produces localised pitting and metal wastage that a general thickness survey will miss between grid points. The location definition there has to be geometry-aware — an inlet cone, a refractory transition, a weld overlay boundary — rather than a coordinate on an otherwise uniform surface.
Evidence that has to travel with every reading
An audit-ready reading is a small evidence package. It carries the location it belongs to, the date, the method and technique, the instrument with its serial number and calibration status on that date, the reference block, the surface preparation performed, the technician with certification level and expiry as they stood that day, and the reviewing Level III who accepted the result. When any of these is reconstructed after the fact from a current list, it becomes an assertion rather than a record.
The certification field is where sites most often get caught. Personnel move between contractors, certifications lapse and are renewed, and a register that stores a link to a person rather than a snapshot of their qualification will show whatever is true today. An auditor picking a reading from three years ago and asking who took it, and whether they were certified then, is asking a question the system must answer from stored fact. The same applies to instrument calibration: a gauge calibrated last month says nothing about the gauge that took a reading in a turnaround two years ago.
Raw data closes the package. Advanced UT files from hydrogen attack assessments, eddy current data from tube bundles, profilometry files and magnetic particle photographs are the only means of revisiting a disputed call. They should be attached to the reading, not stored in a contractor's project folder that expires with the contract. When a mechanism turns out to have been active earlier than believed, the ability to re-read old data is the difference between a reassessment and a guess.
Deferrals, interval extensions and the paper trail expected of you
Every plant defers inspections. Access is unavailable, the turnaround is shortened, a scaffold does not get built, a vessel cannot be cleaned in the window available. Deferring is not the finding. Deferring without a documented decision is. The record has to show the original due date, the technical basis for concluding the equipment remains fit, any compensating measure applied in the interim, the person with authority to approve and their role, and the new due date. That is a small amount of writing, and it converts an apparent lapse into a managed risk decision.
Interval extensions deserve the same treatment with more rigour, because they change the programme rather than slipping it once. Where an extension rests on a risk-based assessment, the register should link the location to the assessment that justified it, so that a change in service or a new damage mechanism triggers a review of every location that inherited its interval from that study. Sites that extend intervals through a spreadsheet edit have no way of finding those locations again.
The pattern auditors look for is a location that has been deferred repeatedly with the same reason. Three consecutive deferrals for scaffold access is not an access problem, it is an inspection plan that has never been executed at that location, and the equipment has effectively been unmonitored for a decade. A register that surfaces deferral counts alongside due dates lets the integrity engineer see that pattern before the auditor does, which is the entire point of preparing early.
Assembling an equipment file in the room, not overnight
The practical test of an audit-ready register is whether an equipment file can be produced while the auditor waits. That file contains the equipment identity and design data, the current inspection plan with each location and its basis, the full reading and indication history with evidence attached, the repair and alteration history, the deferral and extension decisions, the qualification of the people who did the work, and the review and approval signatures. If assembling it requires an evening and three departments, the register is not the record — it is an index to records held elsewhere.
This matters beyond the audit. The same file is what an insurer's engineer asks for, what a client demands during a supplier qualification, and what a certifying body samples during a surveillance visit against ISO 9001 or ISO 45001. Building it once, as a standing capability rather than an audit project, removes a recurring cost that most plants absorb without ever measuring.
It also changes the conversation during the audit itself. When evidence appears immediately and completely, the auditor's confidence in the system rises and the sampling narrows. When each request triggers a search, the sampling widens, because the auditor is no longer testing the equipment — they are testing whether the records exist at all. Preparation is less about rehearsing answers and more about removing the delay between the question and the evidence.
How to evaluate a registry against your next audit
Run the evaluation as a mock audit rather than a feature comparison. Ask the vendor to show planned against executed coverage for a single vessel over two cycles, including deferrals with approvers. Ask them to record an SCC indication on a weld with partial coverage of the seam, then show what next campaign's technician sees when they arrive at that weld. Ask them to store a reformer tube population by row and number and demonstrate what happens when a contractor submits the row in reverse order.
Then check the boundaries. Can the system hold a damage-state location with no thickness and still schedule it? Does it snapshot certification and calibration at capture? Can it attach advanced UT and eddy current data files to the reading? Can it link a location to the risk assessment that set its interval, and flag every dependent location when that assessment changes? Any registry can display a thickness trend; comparatively few can answer these.
Atlantis NDT builds inspection management software around this evidence model — condition and thickness monitoring locations, coverage reporting, deferral control, and certification and calibration bound at the point of capture — configured to the plant's own procedures and the practices it has chosen to follow. It is affordable, accessible and fully customisable. To see it run against your own equipment list and your last audit's findings, contact info@atlantisndt.com and ask for a demonstration or a scoped quote.
What does an auditor check first in a CML register?
Coverage, not values. The first request is usually a list of everything that was due in the last cycle and what happened to each item: executed, deferred with approval, or missed. A register that can only show the readings it holds cannot show the readings it should have held, and the gap between the plan and the execution is where nearly every mechanical integrity finding lives.
Why do ammonia plants need condition locations rather than thickness locations?
Because the dominant mechanisms do not thin steel. Stress corrosion cracking on an ammonia storage tank produces tight surface cracks found by wet fluorescent magnetic particle examination. Nitriding hardens and embrittles a surface layer. High temperature hydrogen attack degrades microstructure well ahead of any measurable loss. A thickness column records nothing useful for any of them, so the register must hold indications, damage states and technique sheets.
How should a deferred inspection be recorded so it survives an audit?
As a decision with an author, not an absence. The record should show the original due date, the technical basis for deferral, any compensating measure such as a tightened operating limit or an interim external check, the approver's name and role, and the new due date. Mechanical integrity requirements expect deficiencies to be corrected or safely managed; an undocumented slip looks identical to neglect.
Does OSHA PSM require a specific CML register format?
No. 29 CFR 1910.119(j) requires written procedures, inspection and testing that follows recognised and generally accepted good engineering practice, documented results and correction of deficiencies. It does not name a data model. That freedom is the trap: the format is yours to defend, so the register has to make the practice you chose — API 510, 570, 653, RP 941 — visible against each location.
How do you keep technician certification and gauge calibration attached to a reading?
Bind them at capture, not at report time. The reading should carry the technician's certification level and expiry as they stood on the inspection date, the instrument serial number, the reference block used and the instrument's calibration status that day. Recomputed later from a current personnel list, those facts silently become wrong, and a lapsed certification found by an auditor calls into question every reading taken under it.
What breaks when a urea plant loses passivation between inspections?
The rate model. Urea-grade stainless and duplex in carbamate service depend on an oxygen-maintained passive film. While it holds, loss is negligible; when it fails, attack can run at millimetres per month. Averaging two readings across a campaign produces a smooth annual rate that describes nothing that actually happened. The register has to carry the oxygen injection and process record alongside the readings so the interpretation stays honest.
Built for any business that runs on operations
Most companies do not fail at their craft. They lose time, margin and goodwill in the gaps between the tools they use to run the place — a quoting spreadsheet that does not talk to the job sheet, a job sheet that does not reach accounts, and a compliance folder nobody can search when a client asks. Atlantis closes those gaps by putting the whole operation on one platform, so information is entered once and everything downstream stays in step.
What you can run on it
- Sales and CRM — leads, quotes, follow-ups and the pipeline that tells you what next month looks like.
- Projects and job costing — plan the work, track the hours and materials against it, and see the margin while the job is still live rather than at final account.
- Field and service teams — dispatch, schedules, mobile capture that works with no signal, and sign-off from site.
- Inventory and purchasing — stock, suppliers, reorder points and goods receipt, joined to the jobs that consume them.
- People — records, qualifications and licences with renewal reminders, timesheets, leave and payroll.
- Quality and documents — procedures and forms under revision control, with the audit trail an inspection or accreditation body actually asks for.
- Accounts — invoicing, expenses, multi-currency and the reporting your accountant stops chasing you for.
Affordable, accessible, fully customizable — and we mean each word
Affordable because the whole suite is included rather than sold to you a module at a time, and because implementation is done by people who have run operations rather than by a chain of subcontractors. Accessible because it runs in a browser and on a phone, works for a small team on day one, and does not need a specialist on staff to keep it alive. Fully customizable because your process is the thing that makes you competitive — the software should bend to it, not the other way round.
Industries we configure for
Service businesses and contractors, manufacturing and fabrication, trading and distribution, laboratories and testing houses, engineering consultancies, construction and facilities, and asset owners across energy, marine, aerospace and infrastructure. Inspection and testing is where we started, and it remains the sector we go deepest in — but the platform underneath is general-purpose, and most of what it does has nothing to do with inspection at all.
What happens when you get in touch
A short conversation, not a sales sequence. We ask how the business runs today and where it hurts, show you the platform doing that work, and send a written quote shaped to your region, your team size and the scope you actually need. No obligation, nothing to install first, and no pressure to decide on the call. Reach out and tell us what you are trying to fix.
Related: business management platform · inspection management software · choosing the right category of software · modules · by industry · asset integrity platform. Book a free consultation.