Thickness and condition monitoring locations in a GMP plant, after the spreadsheet

The workbook did not fail all at once

It started as a good spreadsheet. One tab per vessel, a column for nominal thickness, a column for retirement, dated columns for each campaign, and a rate formula at the bottom. Then the site added a second suite. A contract inspector took a copy into the field. Someone sorted a column without extending the selection. A reviewer inserted rows in the middle. Now there are two files with the same name, a rate formula pointing at a deleted sheet, and no way to say which number the last periodic review actually approved. Nobody was careless. The workbook outgrew the assumption it was built on, which is that one person holds the whole thing in their head.

The moment that assumption breaks, the question stops being what the thickness is and becomes whether you can reproduce the calculation. In a GMP plant that question carries a weight it does not carry elsewhere. A thickness record used to justify continued use of product-contact equipment is a GMP record. If two people can edit it, if there is no trail showing what changed and who changed it, and if the previous value is overwritten rather than preserved, it does not satisfy 21 CFR 11.10(e), which asks for a secure, computer-generated, time-stamped audit trail that does not obscure previously recorded information.

The practical consequence is that a better spreadsheet is not the fix. Under GAMP 5 categorisation, a workbook carrying its own calculations behaves as a bespoke application and inherits the validation burden of one: a specification, testing evidence, change control, a named owner and periodic review. Sites that reach this point usually find it is cheaper to move the register into a system designed to hold controlled records than to validate, and keep revalidating, the workbook they already have.

Why near-zero corrosion makes the location harder, not easier

In a refinery, a carbon steel line losing 0.15 mm a year produces a signal that outruns measurement error within two campaigns. A pharmaceutical plant has the opposite problem. Product-contact 316L in ambient or moderate service may show no measurable general loss for a decade. A hand-held gauge on a clean electropolished surface repeats to roughly two hundredths of a millimetre under good conditions and considerably worse across different operators, couplants, probe pressures and surface temperatures. When the true rate is smaller than the noise, every difference you compute between campaigns is measurement error wearing a corrosion rate's clothing.

That inverts what the register is for. It does not exist to produce a rate. It exists to make the comparison legitimate: to guarantee the second reading came from the same square centimetre as the first, taken the same way, by someone qualified to take it. A short-term corrosion rate derived from two campaigns on 1.65 mm of tubing is arithmetic performed on noise. In a system that will happily do the arithmetic anyway, the honest output is a flag reading below the resolution of the method, not a tidy number that will be quoted in a review three years from now.

Re-finding the point is also physically harder here. You cannot centre-punch a hygienic surface. You cannot leave a permanent mechanical marker on a product-contact line. Much of the system is jacketed, insulated, or inside a classified area with a gowning step between the technician and the point. The location record therefore has to carry the things that survive all of that: a named weld or fitting as datum, an offset in millimetres, a clock position referenced to a fixed external feature, and a photograph taken from a stance a different technician can reproduce next year.

Half your monitoring locations are not thickness locations

A glass-lined reactor is the clearest case. Nothing about its condition is a wall thickness. The relevant record is a high-voltage spark test at a stated voltage, a map of the pinholes and crazing found at the nozzle radius and in the impeller shadow, and the history of tantalum plug repairs. A site can run a dozen glass-lined vessels and have not one meaningful number to put in a thickness column, while the failure that actually stops production is a lining defect that exposes carbon steel to the batch.

Clean utilities behave the same way. Rouging in WFI and clean steam distribution is graded, not measured: Class I migratory particulate, Class II in-situ oxidation of the surface itself, Class III high-temperature oxide in pure steam service. The meaningful record is the grade, the extent, the date and method of the last derouging, and the repassivation performed afterwards to ASTM A967. Elastomer diaphragms in sanitary valves, gasket condition at ferrule joints and passivation state on newly installed spool pieces all fall into the same category.

This is where a thickness-shaped spreadsheet actually breaks. These locations end up in a comments column, a photo folder, or a second workbook owned by a different department, and the second workbook is the one that never gets reviewed. A registry that treats condition monitoring locations as first-class records — with their own location type, their own acceptance basis and their own due dates — keeps the whole population on a single schedule instead of splitting it across systems that only one person knows how to reconcile.

What a controlled CML record actually contains

A defensible location record carries far more than a number. It needs a permanent identifier that never gets reused, the parent equipment and its unique identity, the location type, the damage mechanism being watched, the datum and offset that fix its position, the method and technique required, the required surface preparation, the interval and its basis, the nominal and as-built thickness, the retirement thickness with the calculation that produced it, and the name and date of the engineer who set it. Every reading then inherits its own metadata: instrument, calibration status on the day, reference block, couplant, surface temperature, technician certification level and expiry as they stood at capture.

Two of those fields cause more trouble than the rest combined. Nominal is not as-built. Plate and tubing arrive with mill tolerance, welded fittings are thinner at the forming radius, and a location baselined against a catalogue number rather than a measured value will read as having already lost metal on day one. The register should hold both values and be explicit about which one the trend runs from.

The second is retirement thickness. On a pressure boundary it comes from a Section VIII calculation, but in a hygienic system the governing limit is often not pressure at all. A line that has been repolished several times to remove rouge or weld discolouration may reach a point where surface finish and cleanability under 21 CFR 211.65 fail before the pressure calculation does. If the register stores only the pressure-derived number, it is measuring against the wrong limit and will report comfortable margin on a line that should already have been replaced.

The GMP layer a spreadsheet cannot reach

Once the register is the record that justifies continued use of GMP equipment, Part 11 applies to it in full. That means unique user accounts with no shared logins, authority checks so that only permitted roles can approve a reading or change a retirement thickness, electronic signatures that carry the signer's printed name, date, time and the meaning of the signature, and an audit trail that captures the old value, the new value, the actor, the timestamp and a reason. The audit trail must not be disableable by the people using the system.

EU GMP Annex 11 adds an expectation many sites overlook until an inspection: audit trails are not just retained, they are reviewed. Somebody has to look at what changed, on a defined frequency, with the review itself recorded. A registry that stores a trail but offers no way to review it efficiently pushes that obligation back onto a person with a raw export, and the review quietly stops happening. Ask to see the review view, not the trail.

The rest of the layer is unglamorous and equally load-bearing: qualified backup and restore, defined retention that matches the equipment's life rather than the software contract, controlled export that cannot silently drop a decimal, and a documented position on what happens to the data if the system is retired. These are the questions that show up in a supplier audit, and they are far easier to answer for a system built for controlled records than for a network share holding twelve years of workbooks.

Change control on the register itself

Most sites apply change control to equipment and procedures and forget that the register is itself a controlled artefact. Adding a location, moving one, retiring one, changing a retirement thickness, changing an interval, or reassigning a location to different equipment are all changes that alter what the integrity record says. Each should require a reason, an authorised approver appropriate to the change, and preservation of the prior state. The system should make a silent edit impossible rather than merely discouraged.

The scenario that goes badly in an inspection is specific and common. An investigator notices that a retirement thickness on a transfer line differs from the value in the qualification package, asks when it changed and on what basis, and the answer is that nobody knows, because a cell was edited at some point between 2019 and now. The finding is not that the number is wrong. The finding is that the quality system cannot tell whether it is right, which is a data integrity observation and considerably harder to close.

Periodic review closes the loop. Once a year, or on the site's own cycle, the register should be reviewed as a document: locations that have never been read, locations whose parent equipment has been decommissioned, intervals that keep being extended, retirement thicknesses whose basis predates a change in service, and any location where the reading population is too small to support the conclusion drawn from it. That review is far more valuable than the corrosion rates it sits next to.

Migrating years of spreadsheet history without inventing data

The temptation when moving off a workbook is to import everything and let the new system compute rates over the full history. Resist it. Old readings usually have no recorded instrument, no calibration reference, no technician identity and no proof the point was the same point. Loading them as though they were equivalent to a controlled reading fabricates provenance the data never had, which is precisely the problem you are migrating to escape.

A defensible approach tiers the history. Readings with full metadata come across as verified. Readings with partial metadata come across flagged, visible in the trend but excluded from any calculation that drives a due date. Readings with no metadata come across as historical context only. The original workbook is frozen, versioned and attached to the equipment record as a controlled document, so nothing is lost and nothing is dressed up as more than it is.

Then run one re-baseline campaign. Walk the population, confirm each location physically exists and is accessible, photograph it from the stance the record will specify, capture a reading with complete metadata, and mark that as the verified baseline. It costs one campaign. Everything downstream — every rate, every due date, every remaining-life statement — inherits its credibility from that campaign, and for the first time the register can say honestly which of its locations it actually knows something about.

How to evaluate a registry before it becomes a GMP record

Evaluate on four questions, in order. Can it hold a location that has no thickness, as a first-class record with its own schedule and acceptance basis? Can it bind technician certification, instrument identity and calibration status to a reading at the moment of capture, rather than recomputing them later from a current list? Can it show you the audit trail for a change you make in front of the vendor, including the prior value and the reason? And can it refuse a change that lacks an approver, rather than merely logging that it happened?

Then test it with your own difficult cases. A glass-lined reactor with a spark test result and no thickness. A WFI loop with a rouge grade. A location whose retirement thickness is governed by cleanability rather than pressure. A reading taken by a technician whose certification expired the week before. A vendor demonstration built on carbon steel piping in refinery service will sail through all of these on paper and fail every one of them on your site.

Atlantis NDT builds inspection management software around exactly this record structure, with the condition monitoring and thickness monitoring locations, evidence binding and controlled change history described above, configured to the site's own procedures rather than a generic template. It is affordable, accessible and fully customisable. For a walkthrough against your own equipment list, or a scoped quote, contact info@atlantisndt.com and ask for a demonstration using your data.

Request a consultation