When the corrosion workbook has more editors than it has controls

The job: the workbook has outlived its controls

Nobody sets out to run a plant's mechanical integrity on a spreadsheet. It grows. One engineer builds a clean workbook for a handful of measurement locations on the amine unit, it works, and it spreads. Ten years later it holds a train's worth of data, it is edited by three inspection coordinators, a corrosion engineer and a contractor, and there is a folder containing five files whose names all end in some variation of final.

The moment that forces the change is almost always a question rather than a failure. An auditor, a new integrity manager or an insurer asks how a particular remaining life was arrived at. The workbook shows a number. It does not show which two readings produced it, whether the short-term or long-term rate governed, what minimum thickness was in force at the time, or who last changed the cell. The answer becomes an archaeology exercise conducted by whoever has been there longest, and it takes a week to reconstruct one number.

That is the actual requirement, and it is worth stating plainly before anyone starts comparing software features. The plant does not need better arithmetic — the arithmetic in the workbook is usually fine. It needs the arithmetic to be attributable, so that a number can be defended without depending on anyone's memory, and so that the departure of a single engineer does not take the calculation basis with it.

Why an LNG corrosion rate is mostly a decision about where not to compute one

This is the point where an LNG facility diverges sharply from a refinery, and it is the point that generic integrity software handles worst. The great majority of an LNG train's piping and equipment operates dry, sweet and cold. There is no aqueous phase, no acid gas after treating, and no temperature at which conventional corrosion mechanisms proceed. Internal metal loss on the cold end is, for practical purposes, zero. So is the rate — and any short-term rate computed from two readings on cryogenic piping is composed entirely of instrument and technician scatter.

The consequence is that most of the asset register should not have a computed rate at all, and the software's real job is to represent that correctly rather than to fill the column. A system that manufactures a two-mil-per-year rate on a 304L cold line because a formula fired is not being conservative. It is populating an inspection plan with fiction, consuming inspection budget on locations that will never corrode, and diluting attention that belongs on the circuits that will.

It also mishandles the mechanisms that actually threaten cold service, because none of them are thinning. Corrosion under insulation on lines that cycle between cryogenic and ambient, chloride stress corrosion cracking of austenitic stainless once wet insulation warms past roughly 140 °F, and mercury-induced embrittlement of brazed aluminium heat exchangers all progress with no measurable wall loss whatsoever. A register that grades health by remaining life will show these locations green until the day they are not.

The spreadsheet failure modes that survive a migration if you let them

Each of these has been found in production workbooks, and none of them announce themselves. A governing rate typed directly over a MAX function, so the cell displays a plausible number that no longer responds to new readings. A date column stored as text, so the interval computes as zero and the rate returns an error or, worse, a default. Two measurement locations both labelled N2 on different vessels, silently merged by a lookup. Millimetres pasted into an inches column during a contractor handover. A row filtered out of view and then pasted over.

The most damaging one is subtler. Someone updates the minimum required thickness column after a re-rate, entirely correctly, and every historical remaining life in the file changes retrospectively. The workbook has no concept of a value that was true in 2021 and a different value that is true now, so the record of what the plant believed and acted on at the time is simply gone. Nothing in the file indicates that anything happened.

Migration is the only realistic opportunity to catch these, and it needs to be treated as an inspection of the data rather than a copy. Screen every series for a thickness increase larger than the measurement band. Screen every interval for zero or negative duration. Screen every rate for whether it can be recomputed from the readings on the same row. Publish the exception list to the engineers who own the data and resolve it before loading, because a clean-looking import of dirty data is worse than the workbook — it carries the same errors with an implication of rigour.

Assigned rates: the honest way to handle equipment with no history

A full containment LNG storage tank will not be opened for internal inspection for the greater part of its design life. The inner 9% nickel shell holds product at around −260 °F, the annular space is under nitrogen or insulated with perlite, and there is no meaningful way to take a thickness series on the inner tank while the facility is operating. The same constraint, less absolutely, applies to a cold box that is never warmed and to buried and encased sections of loading lines. These are not edge cases in LNG; they are a large fraction of the register.

The codes anticipate the situation for vessels and piping. API 510 and API 570 both allow a rate to be estimated from similar service, from documented owner-user experience or from published data, with an on-stream measurement after roughly a thousand hours of service to confirm it. For a cryogenic inner tank the confirmation step will never occur, so the assigned rate is permanent, and it has to be governed differently — as an engineering position with an author, a date, a stated basis, a review interval and a defined trigger that would cause it to be revisited. The tank itself is managed under a tank system regime in the sense of API 625 and EEMUA 147, with instrumented monitoring rather than a thickness trend.

This is precisely what a workbook cannot do. A cell holds a number. It cannot hold the fact that the number is an engineering assessment rather than a measurement, cannot record who made it, and cannot distinguish a rate backed by twenty years of readings from a rate backed by a judgement made once in a meeting. Both appear in the same column, in the same font, and both feed the same remaining-life formula. Separating measured from assigned, visibly and permanently, is the single largest gain from moving off the workbook.

The circuits that do thin, and how their rates behave

Acid gas removal is where an LNG facility earns its corrosion programme. An MDEA circuit carries alkaline solution loaded with carbon dioxide, and the mechanisms described in API 571 for amine corrosion, amine stress corrosion cracking and wet hydrogen sulphide damage all apply. Rates are strongly non-linear in the operating parameters: rich loading, regenerator temperature, velocity in the rich lines and heat stable amine salt concentration. A circuit that has behaved for five years can change character within weeks when salts accumulate or the reclaimer falls behind, which makes the short-term rate genuinely informative here in a way it never is on the cold end.

The regeneration gas loop on molecular sieve dehydration has a different signature again. It is cyclic by design, so calendar time is a poor exposure basis — the meaningful denominator is cycles, or hours at temperature. Condensation on cooldown, sieve dust carryover and thermal cycling concentrate damage at predictable locations rather than distributing it, which means the governing measurement point matters more than the average and a moving governing point is a stronger signal than a rising average.

On regasification terminals the seawater system introduces mechanisms that a thinning rate describes badly. Open rack vaporisers, seawater pumps and their piping face erosion-corrosion, chlorination effects, crevice attack at gaskets and supports, and microbiologically influenced corrosion during idle periods. The damage is localised and deep rather than general and shallow, so remaining life from an average thickness is misleading and pitting depth criteria with appropriate examination methods carry the decision. The system should be able to say so per circuit rather than applying one calculation to everything.

Reproducibility as an engineering requirement, not an IT feature

Set the acceptance test in advance and make it concrete. Hand the same set of readings to the system twice, a year apart, with an intervening staff change, and require that it returns the same governing rate and can display which two readings produced it, which rate governed, what minimum thickness applied, what code edition and calculation basis were in force, and whether anyone applied an override and on what basis. Five facts. If the system cannot produce all five on demand for any number it displays, it has not solved the problem you are buying it to solve.

Concurrency is the second half. A workbook resolves simultaneous edits by whoever saves last; a real system needs record-level ownership, so an inspection coordinator entering field readings, a corrosion engineer revising an assigned rate and a contractor uploading a report can all work at once without overwriting one another. Every change carries an author and a timestamp, values that were true in the past remain retrievable as they were, and a corrected reading is a new record with a reason rather than a silent replacement of the old one.

Under a Part 193 maintenance and corrosion control programme, and under process safety management more generally, this is not administrative comfort. The regulator's question is not whether your rate is correct; it is whether you can demonstrate that your programme is executed as written. A calculation whose provenance cannot be shown is difficult to defend even when it is right, and the effort of reconstructing it after the fact is invariably spent at the worst possible moment.

Evaluating a replacement for the workbook

Ask for the awkward demonstrations rather than the polished ones. Show me a measurement location classified as not rate-governed, and show me that it still appears on the inspection plan with a method and an interval of its own. Show me an assigned rate next to a measured rate and tell me, on the report, which is which. Show me what happens when someone enters a reading that is thicker than the previous one. Show me a minimum thickness changed after a re-rate, and then show me last year's remaining life exactly as it was published.

Then test the LNG-shaped requirements specifically, because they are the ones generic vessel and piping software fails. Can a rate be expressed per cycle or per exposure hour as well as per calendar year, for the regeneration loop? Can a circuit be governed by pitting depth criteria rather than general thinning, for the seawater system? Can a cryogenic tank be held in the register under a tank system regime with no computed rate at all, without dropping off every report? Can an integrity operating window excursion on the amine unit raise an inspection action independently of the reading schedule?

Atlantis configures this on Odoo 18 rather than shipping a fixed product, because the classification of which circuits are rate-governed and which are not is a plant-specific engineering decision that has to be made properly once and then enforced by the system. The specification work is done with an ASNT Level III, and the migration off the workbook — including the exception screening described above — is treated as part of the deliverable. It is affordable, accessible and fully customizable. Send a sample of your current workbook to info@atlantisndt.com and ask for a reproducibility review before you shortlist anything.

Request a consultation