Retiring the inspection workbook at a combined-cycle plant

The workbook is not a list, it is a calculator

Almost every plant that describes itself as outgrowing spreadsheets is describing two different artefacts at once. There is a list of findings, which a spreadsheet handles badly but survivably, and there is a calculation, which a spreadsheet handles in a way that is quietly unsafe. The list is what people complain about. The calculation is what actually breaks.

The workbook takes thickness readings, subtracts them from something, divides by an elapsed time to get a rate, compares the result with a minimum thickness looked up from another tab, and produces a remaining life and a next examination date. Those numbers then drive outage scope, spare purchasing and, on occasion, a decision to run a unit through another summer. They are engineering outputs presented as spreadsheet cells.

Once more than one person edits the file, the calculation loses the property that made it acceptable: you can no longer state, with evidence, how any given number was produced. That is the real threshold being crossed, and it is why moving the list into a database while leaving the calculation in Excel solves the visible problem and none of the important one.

Where the numbers actually go wrong

The failures are specific and repetitive. Someone types a value over a formula, usually for a good reason at the time, and the cell keeps its formatting so nothing looks unusual; from that moment the row is frozen and no longer responds to new readings. A lookup against a nominal-thickness tab uses approximate match, someone re-sorts the tab, and every minimum thickness shifts to the adjacent size without a single error appearing.

The baseline is the other reliable source of error. Corrosion rate computed from drawing nominal minus current reading overstates loss on pipe that was delivered at the thick end of mill tolerance, and understates it badly on anything replaced mid-life, because the replacement's real starting thickness never entered the sheet. Both errors are invisible in the output and only surface when someone cuts a component out and measures it.

Then there is the version problem, which is not a calculation error at all but produces the same result. Four files on a share drive, distinguishable only by a suffix somebody added in a hurry, and two engineers in the same meeting quoting different remaining life for the same tube panel. Nobody is wrong; they are reading different files, and there is no mechanism that could tell them so.

Long-term and short-term rates, and the one the workbook forgets

In-service inspection practice expects two corrosion rates: a long-term rate from the original or baseline reading, and a short-term rate from the most recent previous reading, with the more conservative of the two governing. Spreadsheets almost always maintain one, and it is almost always the long-term rate because it is the easier formula to write once and copy down.

In combined-cycle service that omission has a name. Flow-accelerated corrosion in LP economiser and evaporator circuits is strongly sensitive to chemistry, temperature and velocity, and a change in any of those, a switch in amine, a modification to feedwater treatment, a change in dispatch pattern that alters flow, can move the rate by a large factor within a single year. Averaged across ten years of history, that step change disappears completely.

The system should compute both rates from stored readings, show which one governed the interval, and flag divergence between them as a condition worth an engineer's attention. That flag is one of the few genuinely predictive outputs available from routine thickness data, and it is exactly the output a single-rate spreadsheet is structurally incapable of producing.

Which code owns your piping, and why it changes the rule

Power plants routinely import refinery inspection habits along with the engineers who learned them, and the workbook inherits assumptions that do not apply. Power piping is designed and built to ASME B31.1, not B31.3. Boiler and HRSG pressure parts fall under ASME Section I, and their in-service repairs and alterations run through the National Board Inspection Code with a commissioned jurisdictional inspector, an R-stamp holder and a documented repair plan.

B31.1 does not carry the in-service interval framework that API 570 provides for process piping. Where a plant applies API 510 or 570 methodology to balance-of-plant equipment, it is doing so as an owner decision, and that decision has scope boundaries which people forget within about two years of making it. A system that records which regime governs each equipment class removes an argument that otherwise recurs at every outage.

This matters to the deficiency register concretely, because the disposition path differs. A finding on a Section I pressure part heads toward a repair plan and an inspector sign-off; a finding on a non-code service line heads toward maintenance. Recording the governing code on the asset means the workflow routes itself, instead of relying on someone recognising which kind of pipe they are looking at.

Cycling duty means the clock is not a calendar

A combined-cycle unit that two-shifts accumulates damage in a pattern that annual thinking cannot represent. Gas turbine inspection intervals are counted in equivalent operating hours and factored starts, with starts weighted heavily because the thermal transient does the damage. A unit dispatched for short peaking runs reaches a hot gas path inspection on starts long before it approaches it on hours, and a register keyed to a calendar date will be wrong in both directions across a fleet with mixed duty.

The damage mechanisms follow the same logic. Thermal fatigue cracking at HRSG harp tube-to-header attachment welds is driven by ramp rates and start counts. Attemperator damage, liner cracking and downstream pipe fatigue arise from spray events during transients rather than from steady operation. Creep in HP superheater and reheater tubing accumulates with hours at temperature, so a unit that runs hard in summer and sits in spring has two mechanisms advancing on two different clocks simultaneously.

The register should accept an interval expressed in hours, starts or calendar time, read the operating counters, and forecast the due date rather than storing one. That single capability changes the outage planning conversation, because the forecast moves when dispatch changes, and the change is visible months before it becomes a surprise.

The register is really the outage scope document

Findings at a power plant are not closed continuously. They are closed in a defined window that arrives once a year or once every few years, and between raising and closing there may be ten months in which the only thing preserving the finding is the register. A workbook that nobody trusts loses items in that interval, and the loss is discovered during the outage when a scope item that everyone remembers discussing turns out never to have made it onto the list.

That reframes what good looks like. The register's job is not primarily to report a backlog number; it is to accumulate a defensible scope, with each finding carrying the evidence, the assessment, the parts required, the access required and the estimated duration. When scope freeze arrives, the outage list should be generated from the register rather than assembled from it, and items deferred out of scope should be deferred as recorded decisions with a named approver.

The follow-through matters equally. Work executed during an outage generates repair records, replacement components with new baselines, and re-examination results, and all of those have to land back on the finding before the plant returns to service. A system where post-outage close-out is a separate spreadsheet has simply moved the original problem two months later in the year.

The ammonia system quietly changes the compliance picture

Many combined-cycle plants hold aqueous ammonia on site for selective catalytic reduction, and at typical inventories that can bring the plant within the scope of the OSHA process safety management standard. Plants that fall in scope frequently do not think of themselves as process safety sites, and their inspection practice reflects that until an audit says otherwise.

The relevant consequence for a deficiency register is direct. Under the mechanical integrity provisions, equipment found to be outside acceptable limits must be corrected before further use, or in a safe and timely manner where interim measures assure safe operation. That converts a deferral from an operational judgement into a documented determination: what the acceptable limit was, why continued operation is safe, what interim measures apply and who authorised them.

A spreadsheet status of deferred does not meet that expectation and cannot be made to. The system needs a deferral record on covered equipment that requires an engineering basis, an interim-measures statement and an approver, and it needs to be able to produce those records for a nominated date range on request. This is a small amount of configuration that removes an entire category of audit finding.

Keeping what the engineers liked about Excel

Spreadsheet replacements fail for a predictable reason. The workbook was not only a record, it was a thinking tool, and an engineer who could answer a novel question in fifteen minutes on a Tuesday will not accept a system that requires a change request to add a column. If the replacement removes that capability, a shadow workbook appears within a quarter, and the plant is back where it started with an extra licence.

The resolution is to separate authority from analysis. The system holds the readings, the calculations, the versions and the audit trail, and it is the only place a number becomes official. Alongside it, engineers get a live export or a query view they can pull into whatever tool they like, for scenario work, one-off correlations and the pattern-hunting that no product roadmap anticipates.

What changes is the direction of flow. Analysis reads from the system rather than the system reading from analysis, and nothing computed in a personal workbook can become the authoritative answer without being written back through a recorded, attributed action. Engineers keep their Tuesday afternoon; the plant stops inheriting it.

How to evaluate the replacement

Do the evaluation on your own data and run the six tests in the table above. Five of them take a minute each, and together they separate a product that owns the calculation from a product that owns a list and calls the calculation an integration. The one that takes longer, re-deriving a past number as it stood on a past date, is the one worth insisting on, because a system that cannot do it has not really replaced the workbook.

Bring the awkward cases too. A component replaced mid-life with a new baseline. A circuit whose short-term rate diverges from its long-term rate. A finding on a Section I pressure part that needs a repair plan and an inspector. An interval expressed in factored starts. Those four cover most of what a combined-cycle plant does that a generic inspection module was not designed for.

Atlantis builds this module on Odoo from an operating NDT and integrity practice, so the calculation rules are inspectable configuration rather than a sealed black box, and existing workbooks are migrated with their history and baselines intact rather than restarted. Atlantis NDT is affordable, accessible and fully customisable; send a sanitised copy of the workbook you want to retire to info@atlantisndt.com and ask for the six tests to be run against it.

Request a consultation