Making a steel plant's corrosion rate record defensible when the auditor arrives

The circuits that actually move in a primary metals plant

A steel plant's mechanical integrity register is dominated by equipment that barely corrodes: structural steel, cooling water headers, compressed air, hydraulic lines. The corrosion rate calculation earns its keep on a small population. Pickle line and acid regeneration off-gas ducting. The sulphuric acid dewpoint zone of reheat furnace waste-gas ducts, breechings and stacks. Coke oven by-product plant lines carrying ammonia liquor, light oil and gas laden with hydrogen sulphide and hydrogen cyanide. Caustic circuits on strip cleaning lines. The reformer outlet and transition ducting of a direct reduced iron plant. Roughly a tenth of the CML population produces nearly all of the wall loss on site.

That concentration is precisely why a single site-wide rate model fails. The damage mechanisms described in API RP 571 that are present in a steel plant do not share a time signature. Acid dewpoint corrosion is a duty-cycle phenomenon: metal only corrodes while it sits below the acid dewpoint, which on a reheat furnace duct means startups, shutdowns and long low-fire spells, not steady operation. Metal dusting is episodic, localised and capable of consuming a wall inside a single campaign. Caustic corrosion is concentration- and temperature-driven and can accelerate sharply after a process change nobody logged as one.

So the first design requirement for a corrosion rate module in a steel plant ERP is not the formula. It is the association between the CML and its damage mechanism, because it is the mechanism — not the number — that you will be asked to justify when an interval looks longer than the measured wall loss appears to allow.

Why one rate is never enough on a mill circuit

The convention in API 510 and API 570 is not decorative. A short-term rate computed across the last two inspections and a long-term rate computed from the earliest reliable baseline are two different statements about the same steel, and the code requires the one producing the shorter remaining life to govern. The worked example above shows the reason in numbers: an identical current reading yields 27.8 years of remaining life on the long-term basis and 8.0 years on the short-term basis, and the difference is the difference between a five-year interval and a four-year one on a line that cannot be inspected while running.

The valuable output is not either rate on its own but the ratio between them. When the short-term rate exceeds the long-term rate by a factor of two or more, something changed: a process upset, a duty change, a coating failure, a new operator measuring a different spot, or a genuine acceleration. When the short-term rate is far below the long-term rate, that is usually a data problem rather than good news — a reading taken over scale, a CML that migrated, or a baseline that was never real. Either way the divergence is the signal and the system should surface it rather than let a spreadsheet quietly average it away.

Plants that keep only one rate almost always keep the long-term one, because it is the flattering one and because it survives staff turnover. That choice is what an experienced auditor looks for first, and it is the easiest finding they will write all week.

Nominal thickness is not a measurement

Most integrated steel plants have equipment older than their inspection programme. When a circuit built in the 1960s or 1970s enters a modern integrity system, the baseline that gets typed in comes from an isometric or a datasheet, not from a gauge. That number is a design nominal, and it is legitimately allowed to differ from what was installed. ASTM A106 and ASME B36.10M permit 12.5 % under-tolerance on seamless pipe wall, so a line specified at 12.70 mm may have arrived at 11.11 mm and been entirely compliant.

Baseline that circuit on nominal and you have manufactured 1.59 mm of corrosion that never occurred. Spread across a fifty-year long-term window it looks like a harmless 0.03 mm/yr. Drop the same error into a five-year window — which is what happens when someone rebaselines a legacy circuit against nominal after a recent inspection — and it becomes 0.3 mm/yr of pure fiction that will drive an unnecessary replacement or, worse, be corrected later by an engineer with no record of why.

The fix is structural, not procedural. Store the baseline with its origin as a mandatory attribute: measured, nominal-derived, or as-built certified from a mill test report. Rates derived from a nominal baseline are marked indicative and excluded from interval-setting until a real measured set exists. When the first proper baseline survey completes, the system rebaselines and retains both histories rather than overwriting, because the overwritten value is exactly what an auditor will ask to see.

Temperature, scale and the readings that lie

Steel plants gauge hot metal more often than refineries do, because the circuits that corrode are frequently the ones that cannot be taken out of service for a routine inspection. Ultrasonic velocity in carbon steel falls with temperature at roughly one percent per 55 °C above the calibration temperature, and an uncorrected reading therefore comes back thick. A waste-gas duct measured at 190 °C against a room-temperature calibration block reads about 3 % high. On an 8.6 mm wall that is 0.26 mm — the whole of a year's short-term corrosion, with the sign that makes the circuit look healthier than it is.

The compounding problem is that a mill's data set is usually mixed. Some readings are taken on-line at temperature by one crew, others at ambient during a scheduled outage by another. Differencing those two populations produces alternating fake gains and losses, which is why so many steel plant histories contain negative short-term rates that nobody can explain. Surface preparation adds another layer: mill scale, weld spatter and refractory anchors defeat coupling, and a reading through loose scale will either fail to register or register the scale.

Everything here is recoverable if the metadata is captured at the point of measurement rather than reconstructed afterwards. Metal temperature, correction applied, couplant type, probe and delay line, surface condition and preparation method belong on the reading itself. A module that accepts a bare thickness value with a date has already lost the audit; the number cannot be defended because nothing about the circumstances of its capture survived.

What the auditor is really testing

Audit findings on corrosion rates almost never concern the mathematics. They concern traceability. Where OSHA 29 CFR 1910.119(j) applies — and in a steel plant it typically applies to the coke oven by-product plant, anhydrous ammonia refrigeration, chlorine and hydrogen systems rather than to the iron and steel line itself — the mechanical integrity record is explicitly required to identify the date of the inspection, the person who performed it, the equipment concerned, a description of what was performed, and the results. Miss any one of those and the record is non-conforming regardless of how good the engineering behind it was.

Customer and certification audits test the same chain from a different direction. ISO 9001:2015 clause 7.5.3 and IATF 16949 are about control of documented information: can you show that the record was not altered after the fact, that the person who signed it was competent per your written practice, and that the revision you are showing today is the one that was in force when the decision was made. An automotive customer auditing a strip mill will pull an inspection record and follow it to the technician's certification file and the instrument's calibration certificate for the date in question.

This is where most integrity data fails, because it lives in spreadsheets. A spreadsheet has no immutable history, no link from a reading to a technician's certification validity on that day, and no way to prove that the retirement thickness in cell D14 has always said 6.40 mm. Rebuilding that chain by hand for one circuit takes an afternoon; being asked for twelve circuits with two hours' notice is the situation the module exists to prevent.

Where a steel plant's regime differs from a refinery's

A refinery runs on one broadly coherent code family. A steel plant does not. In a single asset register you will find pressure vessels and piping that the owner-user has elected to manage under API 510 and API 570, jurisdictional boilers and pressure vessels inspected under NBIC NB-23 and state law, power piping to ASME B31.1 on the cogeneration and steam side, and large-diameter waste-gas ducting and fume handling that no pressure code covers at all, where the retirement thickness is whatever the owner's engineering function decided and documented.

The consequence for a corrosion rate module is that minimum thickness has at least three different meanings on the same site, and the meaning must travel with the number. A pressure-design t-min calculated from ASME Section VIII, a structural minimum from API RP 574 guidance, and an owner-set retirement thickness that deliberately sits above code minimum because a circuit cannot be inspected on-line are not interchangeable, and a remaining life computed against the wrong one is indefensible even when the corrosion rate is perfect.

There is a second difference in who audits. Refineries are audited by regulators and insurers. A steel plant is audited by those plus its customers — an automotive purchaser under IATF 16949, a line pipe buyer under API Q1 and API 5L — and customer audits are unannounced far more often. Building the record so it is always presentable is cheaper than building a capability to assemble it quickly.

Evaluating a corrosion rate module before you commit to one

Test it with your own worst circuit, not a demo data set. Take a legacy line with a nominal baseline, a run of readings taken at temperature, one CML that was weld-overlaid at some point, and a gap where three years of records are missing. Ask the vendor to load it and reproduce the interval decision your team made last cycle. A system that returns a single tidy rate has failed the test; a system that returns two rates, flags the nominal baseline, refuses to difference across the overlay, and tells you the missing years widen the uncertainty band has passed it.

Then ask the harder questions. Can a reading be edited after approval, and if so does the prior value survive with the identity of whoever changed it? Is technician certification held per method and level with expiry, and does the system refuse a record from someone whose certification lapsed on the reading date? Is the retirement thickness versioned with its basis and the calculation behind it? Can you export a complete evidence package for one circuit — readings, provenance, rates, interval logic, deviations and their dispositions — without an engineer assembling it by hand?

The Atlantis NDT inspection management ERP is built on Odoo 18 and is designed around exactly that evidence chain, with the corrosion rate module computing short-term and long-term rates separately and carrying the governing basis into the inspection plan. It is affordable, accessible and fully customizable to a mill's mixed code environment rather than assuming a refinery's. For a working demonstration against your own circuit data, or a scoped quote, contact info@atlantisndt.com.

Request a consultation