Thickness monitoring that survives spool rotation in oil sands service
A CML and TML registry for oil sands gives every monitoring location a permanent identity that survives spool rotation, spool replacement and campaign turnarounds. It stores grid readings rather than single points, keeps each reading's technician, instrument and procedure with it, and recomputes wall loss against the component actually measured, not the spreadsheet row it happened to land in.
Oil sands piping loses wall in ways a general-corrosion spreadsheet was never built to track. Hydrotransport and tailings lines wear by solids impingement, so loss concentrates at the extrados of a bend at one clock position rather than spreading evenly. Froth treatment and diluent recovery add naphthenic acid corrosion above roughly 220 C where total acid number is high, and sulfidation follows modified McConomy behaviour on hotter alloy runs. Because operators rotate and replace slurry spools to spread that wear, the physical metal behind a spreadsheet row changes without the row changing. A registry fixes this by separating three things a workbook conflates: the location on the circuit, the component currently installed there, and the individual reading. Each reading carries its own technician, instrument, procedure revision, surface temperature and grid coordinates, so any remaining-life number can be regenerated years later from stored inputs rather than trusted because it is already in the cell.
Source: Written against API 570 for in-service piping inspection, API RP 574 for inspection practices on piping system components, API RP 571 for damage mechanisms including erosion-corrosion, naphthenic acid corrosion and sulfidation, API RP 580 and 581 for risk-based inspection, API RP 578 for material verification, CSA Z662 for oil and gas pipeline systems, CSA B51 for pressure equipment in Canada, and the Alberta owner-user inspection requirements administered under AB-512 and the provincial Pressure Equipment Safety Regulation.
| Oil sands condition | What fails in the workbook | What the registry must store |
|---|---|---|
| Slurry spool rotated 90 degrees at turnaround | The 6 o'clock erosion scar is now at 3 o'clock, so the CML row keeps comparing unrelated metal | Component orientation and rotation history, with every reading tied to a clock position on the component rather than on the line |
| Spool replaced with new wall | Thickness jumps upward, the rate formula returns a negative or near-zero rate, and the interval is extended | Component serial, heat and install date, so wall history restarts at the component while the location keeps its identity |
| Impingement wear under a bend extrados | One stored value per CML hides a local low spot that only scanning finds | Grid origin, spacing, orientation, every point in the grid, and the minimum with the count of points behind it |
| Ore grade and throughput vary by campaign | A calendar-year corrosion rate averages a heavy ore campaign with a four-month turnaround | Wall loss normalised to tonnes processed or slurry operating hours, tagged to the campaign it belongs to |
| Readings taken on hot bitumen or steam-traced lines | Uncompensated readings over-read thickness by roughly one percent per 100 F above calibration temperature | Surface temperature at the reading, the compensation applied, and the raw uncorrected value alongside the corrected one |
| Four people editing the same file in the same week | Nobody can reproduce a number or say who changed it, and the filter left applied hides a circuit | Append-only readings with author, timestamp and amendment history, and calculations regenerated from stored inputs on demand |
The workbook did not fail. It succeeded until it had a second author
A thickness spreadsheet is usually the best thing that ever happened to an integrity programme. One engineer builds it, holds the whole model in their head, and it works. The tabs mean something, the formulas stay consistent, and the judgement behind each minimum thickness is remembered rather than written down. It scales to a few thousand rows without complaint. What it cannot survive is a second author. The moment a turnaround contractor, a new reliability engineer and a corrosion specialist are all editing the same file, the shared mental model that held it together is gone, and nothing inside the file replaces it.
The symptoms are consistent across every heavy oil site that hits this wall. A remaining-life number nobody can derive a second time. Two tabs applying different minimum-thickness bases to the same spool because one person used pressure design thickness while another used a structural minimum on a slurry line where internal pressure was never the governing case. A filter left applied, so an entire circuit was skipped in the last review and nobody noticed for a year. A pasted constant sitting where a formula used to be. None of this is carelessness. It is the ordinary consequence of shared editing in a file that keeps no record of who did what.
The fix is not a better-disciplined spreadsheet. It is a structural separation a spreadsheet cannot make. Readings are facts and must be immutable. Corrosion rates, remaining life and next inspection dates are derived, and must be regenerable from stored inputs at any point in the future. Once that separation exists, three people can work at the same time without the ability to damage each other's work, because none of them is editing a number. They are adding records. Reproducibility stops depending on anybody's memory, and starts depending on what was captured at the time of the examination.
Erosion-corrosion in oil sands does not behave like general corrosion
Hydrotransport, cyclofeed and tailings lines carry a slurry loaded with quartz sand. Metal loss comes from particle impingement, which is fiercely sensitive to velocity and to the local flow direction. That produces a wear scar, not a wasted circuit: the extrados of a long-radius bend at a specific clock position, the run side of a tee immediately downstream of the branch, the first two diameters after a reducer, the discharge spool off a slurry pump. API RP 571 catalogues the mechanism as erosion and erosion-corrosion, and the practical consequence is that the location of the CML matters more than the number of CMLs.
The rest of the plant adds mechanisms that a slurry-only model misses. Froth treatment and diluent recovery handle high total-acid-number bitumen, and naphthenic acid corrosion becomes credible above roughly 220 C, aggravated by velocity and turbulence and by low sulfur that fails to build a protective sulfide scale. Hotter alloy service sees sulfidation, which follows the modified McConomy relationships with temperature and sulfur content. Water treatment, recycle and tailings return lines see under-deposit attack and microbially influenced corrosion. Insulated lines in an Alberta winter cycle repeatedly through the wet band where corrosion under insulation does its work.
Each mechanism implies a different CML placement rule, and that rule is the thing most often lost. Nobody writes down why the CML sits at 5 o'clock on the third elbow rather than on the straight run, so at the next turnaround it moves ninety millimetres and the trend quietly restarts. A registry that carries a placement rationale field, tied to the damage mechanism from the corrosion study, prevents that. It also lets you answer the question a manager will eventually ask: if you added forty CMLs to this circuit, what mechanism were you adding them for?
Spool rotation and spool replacement quietly destroy CML identity
Oil sands operators deliberately rotate slurry spools. If wear concentrates along the bottom of a hydrotransport line, turning the spool sixty or ninety degrees on a planned cycle spreads that wear around the circumference and buys operating life out of steel you already own. It is good engineering and it is completely invisible to a spreadsheet. The row that used to describe the worn bottom of the pipe now describes an unworn quadrant. The next reading comes back thicker. The rate calculation, which cannot know that the metal moved, reports that corrosion has stopped.
Replacement does the same damage in the opposite direction. A spool swapped during a turnaround arrives at nominal wall, so the next reading jumps by several millimetres. A long-term rate computed from the original baseline collapses towards zero, and the interval extends on a component that has been in service for six weeks. A short-term rate computed across the swap goes negative, and most spreadsheets either clamp it to zero or throw it out. Either way, a real integrity signal has been erased by an accounting artefact, and no error appears anywhere on the sheet.
Modelling this properly needs three objects, not one. The location is a permanent address on the circuit. The component is a serialised physical object with its own heat number, nominal wall, install date and orientation. The reading belongs to a component at a location on a date. Rotation is an event on the component that remaps clock positions. Replacement is an event that closes one component's history and opens another's at the same address. Once those events exist as records, the corrosion rate engine can do the only correct thing: refuse to trend across a discontinuity, and say clearly why it refused.
Grids, not points, and everything that has to travel with a grid
A single stored value per CML is a general-corrosion assumption in disguise. It says the wall is roughly uniform in the neighbourhood of the point, so one measurement represents the area. Impingement wear violates that assumption by design. A four-by-four grid across an elbow extrados routinely spans a millimetre and a half of variation, and encoded corrosion mapping across the same elbow finds a low spot the grid missed. If the registry keeps only the minimum, the variation is gone, and with it any ability to say whether the scar is growing in depth, in area, or migrating downstream.
What has to be stored is the whole picture: grid origin referenced to a permanent datum such as an upstream weld toe, grid spacing, orientation relative to flow, the clock reference used for 12 o'clock, every individual point, the count of points, and the minimum with its coordinate. For scanned coverage, store the scan extent and the encoder resolution as well as the minimum. A photograph of the marked-out grid, attached to the record, resolves more disputes at the next campaign than any amount of written description.
The minimum also has to be treated as a claim rather than a fact. Dual-element probes over-read on thin sections through V-path error, couplant fails on scaled or blast-profiled surfaces, and a reading taken on a weld cap or a repad edge is not a wall reading at all. A registry that lets a technician mark a point as suspect, and that requires a documented re-check before a single anomalous minimum is allowed to drive a fitness decision, prevents the most expensive kind of false alarm: cutting a spool out of a running circuit because of a probe artefact.
The denominator problem: rate per year versus rate per tonne
API 570 practice computes short-term and long-term corrosion rates from thickness differences over elapsed time, and for uniform corrosion in steady service that is entirely reasonable. In oil sands slurry service the denominator is wrong. Metal is removed by particles passing through the pipe, so the exposure that matters is tonnes of ore moved, not months on the calendar. A circuit that ran high-fines, high-sand ore through a hot summer and then sat idle through a long turnaround has an elapsed-time rate that describes neither period accurately.
The practical effect is a planning error in the direction you least want. Elapsed-time averaging dilutes the active rate, so remaining life looks longer than it is, and the extended interval lands in the middle of the next high-throughput campaign. Then the reverse happens: after a heavy campaign, the short-term rate spikes, the system flags a hundred circuits, and the integrity team spends a week explaining that the spike is arithmetic rather than a new mechanism. Both errors come from the same missing field.
Fixing it costs less than the arguments it prevents. Store the campaign or operating window each reading belongs to. Store the throughput or slurry operating hours for that window, pulled from the historian rather than typed. Then the registry can express loss as millimetres per million tonnes as well as millimetres per year, and a planner can project the correct number onto a planned campaign profile rather than onto a calendar. Keep both rates visible. The calendar rate is what a code-based interval calculation expects; the throughput rate is what actually tells you when to look.
Two record regimes on one site, and the registry has to know which is which
An oil sands facility carries pressure equipment and pipelines under different authorities, often within sight of each other. Registered pressure vessels and pressure piping fall under the provincial pressure equipment regime, with in-service inspection typically run through an owner-user inspection organisation whose quality system is assessed against the AB-512 requirements, and with CSA B51 as the underlying construction standard. Licensed pipelines fall under the energy regulator with CSA Z662 governing design, operation and integrity management. The inspection is often performed by the same technician on the same day.
The two regimes want different evidence. The owner-user side asks about the written quality programme, the qualification of inspectors and NDT personnel, the control of procedures, the authority to accept results, and repair and alteration control. The pipeline side asks about the integrity management programme, mitigation records and reporting obligations. A registry that treats every circuit identically produces an audit pack that satisfies neither, and forces an engineer to hand-assemble the difference under time pressure.
The design answer is a jurisdiction attribute at the circuit level that drives which fields are mandatory, which approval role can accept a result, and what an export contains. It costs almost nothing at configuration time and it removes an entire recurring category of rework. It also prevents a subtler problem: a circuit that has quietly moved between regimes after a modification, and whose records were still being kept to the old pattern. If the registry knows the regime, the mismatch surfaces the day the circuit changes rather than the day the auditor asks.
Evaluating a registry before you migrate forty thousand rows
Ask vendors to demonstrate the three events that break spreadsheets, using your data, not a demo dataset. Rotate a spool and show what happens to the trend. Replace a component and show that the rate engine refuses to trend across the swap and says so in words. Import a sixteen-point grid and show that the minimum, the distribution and the grid coordinates all survive, then re-import the same grid a year later and show that the squares line up. A system that handles those three cleanly will handle almost everything else. A system that cannot will produce confident wrong answers faster than the spreadsheet did.
Then ask the questions that only surface later. Can a reading be amended, and does the amendment create a new record rather than overwrite the old one? Can you reconstruct exactly what the system would have told you on a date two years ago? Does the technician's certification status get checked when the reading is captured or when someone runs a report? Can an inspector work offline in a plant where coverage dies inside the froth treatment building, and does the sync resolve conflicts rather than silently pick a winner?
Migration itself has one rule worth stating plainly: migrate the readings, not the calculations. The historical thickness values, dates, locations and, where they exist, the grids are the asset. The corrosion rates and remaining lives in the old workbook are derived numbers of unknown provenance, and importing them imports the very problem you are leaving behind. Recompute everything from the migrated readings, then compare the new outputs against the old ones and investigate every material difference. That reconciliation is uncomfortable, and it is also the most valuable integrity review most sites will run that year. Atlantis NDT can walk a sample of your circuits through that exercise as part of a working demonstration; write to info@atlantisndt.com to arrange a consultation or request a quote.
What actually breaks first when a thickness workbook outgrows one owner?
Reproducibility breaks before accuracy does. The numbers may still be right, but nobody can show why they are right. Two people apply different minimum-thickness bases to the same spool, a paste overwrites a formula, rounding differs between tabs. Six months later a remaining-life figure cannot be regenerated from its inputs because the inputs were never stored beside it. That is the failure both an auditor and an integrity engineer hit, and no amount of workbook discipline repairs it.
How should a CML survive a spool rotation or a spool swap?
By separating the location from the metal. The location is a fixed address on the circuit: line, component, grid square, clock position referenced to flow direction. The component is a serialised object with its own install date, heat number and nominal wall. Rotating a spool changes the mapping between clock positions and the wear scar. Replacing it starts a new wall history at the same location. The registry records both events so rate calculations restart correctly instead of averaging two different pieces of steel.
Why is a calendar-year corrosion rate the wrong number in oil sands?
Because slurry erosion is driven by throughput and ore character, not by elapsed time. A line that moved high-solids ore for eight months and then sat through a four-month turnaround did not lose wall at a steady annual rate. Dividing loss by elapsed years understates the active rate and overstates remaining life at exactly the moment the next campaign begins. Normalising loss to tonnes processed, or to slurry operating hours, gives a rate you can project onto a planned campaign.
Should a single UT point or a grid minimum drive the remaining-life calculation?
The grid minimum, with the whole grid retained. Impingement wear is local, and a point placed forty millimetres from the scar reads near nominal and hides the controlling thickness. API RP 574 treats scanning and gridding as the appropriate technique where localised loss is expected. Store the grid origin, spacing, orientation and every point rather than only the smallest number, so the next campaign can re-measure the same squares and a suspect low reading can be re-examined rather than argued about.
What does a defensible record look like to an owner-user integrity audit?
It shows the chain end to end. A procedure in force on the examination date. A technician certified to that method and level on that date. An instrument with valid calibration and a documented check before and after the job. The raw reading, the correction applied, the calculation with its inputs, the fitness decision, and the interval that followed. Alberta's owner-user inspection framework and the API 570 programme it leans on both expect that chain to sit in records, not in recollection.
Is API 510, 570 or 653 inspector training part of this offer?
No. Atlantis NDT delivers NDT method training to ASNT SNT-TC-1A and ISO 9712, covering Level I, II and III across UT, RT, MT, PT, ET, VT, PAUT and TOFD, together with ASNT Level III consulting, inspection management and reporting software, digital twins, 3D laser scanning and report validation. API inspector certification programmes are administered by API and sit outside that scope. The registry supports work performed under those codes; it does not certify the inspector.
Built for any business that runs on operations
Most companies do not fail at their craft. They lose time, margin and goodwill in the gaps between the tools they use to run the place — a quoting spreadsheet that does not talk to the job sheet, a job sheet that does not reach accounts, and a compliance folder nobody can search when a client asks. Atlantis closes those gaps by putting the whole operation on one platform, so information is entered once and everything downstream stays in step.
What you can run on it
- Sales and CRM — leads, quotes, follow-ups and the pipeline that tells you what next month looks like.
- Projects and job costing — plan the work, track the hours and materials against it, and see the margin while the job is still live rather than at final account.
- Field and service teams — dispatch, schedules, mobile capture that works with no signal, and sign-off from site.
- Inventory and purchasing — stock, suppliers, reorder points and goods receipt, joined to the jobs that consume them.
- People — records, qualifications and licences with renewal reminders, timesheets, leave and payroll.
- Quality and documents — procedures and forms under revision control, with the audit trail an inspection or accreditation body actually asks for.
- Accounts — invoicing, expenses, multi-currency and the reporting your accountant stops chasing you for.
Affordable, accessible, fully customizable — and we mean each word
Affordable because the whole suite is included rather than sold to you a module at a time, and because implementation is done by people who have run operations rather than by a chain of subcontractors. Accessible because it runs in a browser and on a phone, works for a small team on day one, and does not need a specialist on staff to keep it alive. Fully customizable because your process is the thing that makes you competitive — the software should bend to it, not the other way round.
Industries we configure for
Service businesses and contractors, manufacturing and fabrication, trading and distribution, laboratories and testing houses, engineering consultancies, construction and facilities, and asset owners across energy, marine, aerospace and infrastructure. Inspection and testing is where we started, and it remains the sector we go deepest in — but the platform underneath is general-purpose, and most of what it does has nothing to do with inspection at all.
What happens when you get in touch
A short conversation, not a sales sequence. We ask how the business runs today and where it hurts, show you the platform doing that work, and send a written quote shaped to your region, your team size and the scope you actually need. No obligation, nothing to install first, and no pressure to decide on the call. Reach out and tell us what you are trying to fix.
Related: business management platform · inspection management software · choosing the right category of software · modules · by industry · asset integrity platform. Book a free consultation.