Turning inconsistent third-party corrosion findings into one rate you can defend

Aerospace does not manage corrosion in millimetres per year

Anyone arriving from process industry integrity work expects the corrosion rate to be the governing output. In aerospace it is not. The regulated obligation under a Corrosion Prevention and Control Program is classification: Level 1 corrosion is damage occurring between successive inspections that remains within allowable limits; Level 2 exceeds those limits and requires blend-out beyond negligible damage, repair or reinforcement; Level 3 is a finding of urgent airworthiness concern. What the operator owes the regulator is evidence that the programme keeps structure at Level 1, and a documented programme change when it does not.

That reframing matters because it changes what a rate is for. It is not the number that sets the interval directly. It is the forecasting instrument that tells you how many flight cycles a Level 1 location has left before it becomes Level 2, so that the repair can be planned into a scheduled check with the parts and the engineering disposition already in hand rather than discovered on a Saturday night with an aircraft on the dock and a departure the following afternoon.

It also means the data model has to hold more than thickness and date. It must hold the SRM nominal for that part, the allowable damage limit that applies to it, the cumulative material already removed at that location, and the classification assigned at each visit — because the pattern of classifications over time, not the rate, is what triggers the regulatory obligation to revise the programme.

What arrives from a subcontractor, and what is missing from it

A heavy check involves several organisations. The base maintenance provider holds the check, specialist NDT is subcontracted to a repair station with the relevant rating, and structural repairs may go to a third party again. Each returns results on its own form, in its own vocabulary, at whatever level of dimensional discipline its own customers have historically demanded. The finding comes back as a narrative sentence, a photograph and a number, and the number is often the only thing anybody transcribes.

The consistent gaps are predictable. Location is described in prose rather than in airframe coordinates, so the next visit cannot reliably return to the same spot. Nominal thickness is absent, so percent of nominal cannot be evaluated. The measurement basis — through paint, after strip, ultrasonic, eddy current, pit gauge, optical — is unstated. Units alternate between mils, thousandths of an inch and millimetres, sometimes within one report. Removal already performed is described as "cleaned up" with no depth. And the technician is identified by initials, with no certification method, level or expiry attached.

None of this is malpractice. It is what happens when a form designed to record a serviceability decision is used as a source for a longitudinal data set. The remedy is to make the ingest boundary strict: define the fields the calculation genuinely requires, publish that schema to your subcontractors, and reject records that cannot be normalised rather than accepting them and hoping an engineer catches the gap three years later.

Paint thickness is the same size as the allowable limit

This is the arithmetic trap that costs aerospace operators the most and is discussed the least. A typical exterior finish system — primer plus topcoat, sometimes over a previously unstripped layer — runs somewhere between 0.004 and 0.008 in. The allowable blend-out on a 0.063 in fuselage skin at ten percent of nominal is roughly 0.006 in. The coating and the entire serviceability margin are the same order of magnitude.

So the answer to "is this location serviceable" can be determined entirely by whether the ultrasonic reading was taken through paint or on bare metal, and neither number is wrong on its own. A through-paint reading compared against a bare-metal baseline shows a fictitious thickness gain; the reverse comparison shows a fictitious loss of the entire allowable removal in one interval. Both outcomes are common in real fleet data, and both are usually explained away as measurement noise rather than recognised as a systematic offset.

The engineering fix is to treat measurement basis as a first-class attribute with no default value. If the field is empty the record does not enter the trend. Where an operator has years of legacy data with no basis recorded, the practical approach is to hold that history as indicative only, establish a clean bare-metal baseline at the next opportunity on the locations that matter, and accept that the older series informs judgement without setting intervals. That is a less satisfying answer than a retrospective correction factor, but a correction factor applied to data whose basis is unknown is a guess wearing a decimal point.

Blend-out is not corrosion: separating removal from loss

Every time a location is reworked, metal leaves the aircraft for a reason that has nothing to do with the environment. Blend-out removes the corroded material and a margin of sound metal around it. If the next interval's thickness comparison ignores that, the corrosion rate absorbs the repair and comes out inflated — in the worked example above, by a factor of two and a half.

The consequence is not merely a wrong number. An inflated rate shortens the projected time to the allowable limit, which pulls the next inspection earlier, which finds the location again, which classifies it as recurring, which under a CPCP is exactly the trigger for a programme change and a report. An entirely bookkeeping artefact can therefore end up producing real regulatory correspondence and real unnecessary maintenance cost.

The model that works separates two event types on the same location. A corrosion observation records a measured remaining thickness with its basis. A removal event records the depth taken, the date, the authority for it and the resulting as-repaired thickness. Rates are computed only between corrosion observations, with as-repaired thickness resetting the baseline. Cumulative removal accrues on the location independently so that the next shop is checking its blend-out against what is actually left rather than against the SRM nominal, which is the other half of the same problem.

Cycles, hours and base environment: choosing the right denominator

Corrosion on an airframe is driven by exposure to a corrosive environment and by the mechanical work that breaks the barriers keeping the environment out. Pressurisation cycles flex lap joints and fatigue faying-surface sealant. Short-sector operation multiplies cycles per calendar year. A coastal base supplies chloride continuously; a high desert base does not. Galley and lavatory areas corrode on their own schedule regardless of where the aircraft is based, because the source is inside the aircraft.

A rate expressed per calendar year quietly assumes that none of this varies, which is why fleet corrosion averages are so often useless for planning. The same location on two tails of the same type can differ by a factor of several, and the fleet average predicts neither. The denominator should be chosen to match the driver: flight cycles for joint and fastener corrosion, calendar time in a defined environment class for pooled-water and condensation locations, and flight hours where the mechanism is genuinely time-at-altitude related.

Practically this means the system holds utilisation alongside the finding — cycles and hours at the date of measurement, and a base-environment classification for the period between measurements. Aggregation across the fleet then becomes a deliberate analytical act with a stated basis, instead of an accident of putting everything in one column. It also produces the argument you need when proposing a differentiated inspection programme: not an assertion that coastal tails corrode faster, but a rate per cycle with the population and the environment stated.

The certification of the person who took the reading

In aerospace, NDT personnel qualification runs to NAS 410 in North America and EN 4179 in Europe, under an employer's written practice with a responsible Level 3. That is a different scheme from the SNT-TC-1A framework common in industrial NDT, and a subcontractor whose technicians are certified under one may not satisfy a customer requiring the other. When results arrive from outside your organisation, the certification question is not a formality — it is the basis on which the record is admissible in your maintenance records at all.

What makes this hard operationally is that certification is method-specific, level-specific and dated. A technician certified Level 2 in eddy current may not be certified in ultrasonic thickness. Certification expires and is renewed on its own cycle. And the status that matters is the status on the date the inspection was performed, which is frequently weeks before the record reaches you. Validating on upload date rather than inspection date is a subtle error that produces a clean-looking record set with holes in it.

The mechanism that solves it is unglamorous: hold a certification matrix per external technician, per method, per level, with effective and expiry dates, and validate every incoming record against the inspection date. Records failing validation are quarantined and returned to the subcontractor rather than accepted with a warning nobody reads. This costs a small amount of friction at ingest and removes an entire class of audit finding at source.

Evaluating a system against your own contractor mix

Do not evaluate on a clean data set. Collect the last six months of incoming findings from your three least consistent subcontractors — the ones whose forms differ, whose units drift, whose location descriptions are prose — and ask the vendor to ingest them. What you are watching for is what happens to the bad records. A system that accepts everything and produces a tidy dashboard has moved your problem downstream and made it invisible. A system that rejects a third of them with a specific reason per record is telling you the truth about your data.

Then test the specific behaviours that this industry needs and general integrity software usually lacks. Can a location carry cumulative removal and enforce it against the SRM allowable, not just per-visit removal? Does the measurement basis field have no default? Are removal events and corrosion observations distinct record types, with rates computed only between the latter? Can you map a subcontractor's form to the internal schema once and have subsequent submissions ingest without retyping? Does it store cycles and hours, not only dates? Does it hold NAS 410 or EN 4179 status and validate on inspection date?

The Atlantis NDT inspection management ERP is built on Odoo 18, which is why mapping an unfamiliar contractor form to the internal schema is a configuration exercise rather than a development project. The corrosion rate module computes short-term and long-term rates separately, takes the conservative one, and refuses to difference across a recorded removal event. It is affordable, accessible and fully customizable to an MRO's actual subcontractor mix. To try it against a real batch of your incoming findings, or to request a scoped quote, contact info@atlantisndt.com.

Request a consultation