Scheduling inspections you did not perform yourself

Most of your inspection history was produced by someone else

An LNG terminal or liquefaction plant runs with a small owner-operator team and a large contractor population. The jetty and marine loading arms are one vendor's scope, the full-containment tanks another, the fixed equipment inside the trains a third, and the EPC's construction radiography a fourth whose records you inherited at handover and will live with for the life of the asset. The mechanical integrity file is therefore an assembly of other people's work, formatted to other people's conventions, produced under other people's written practices.

Scheduling software designed for a plant that employs its own inspectors quietly assumes that the person who performed the work and the person who owns the due date are the same person. On an LNG site they never are. That assumption surfaces at one specific point: the transition from work order complete to next due date calculated. In an in-house model the inspector closes the task and the interval rolls forward. In a contracted model, closing on submission rolls the interval forward on evidence nobody has examined.

The report may be complete, competent and still unusable, because the readings cannot be tied to the condition monitoring locations in your own register, or because the basis of measurement was never stated. The fix is structural rather than procedural. The schedule needs two states where most systems have one, received and accepted, and the interval clock must start on the second.

The five-year mistake, and why LNG makes it expensive

The cost of accepting a bad result is set by how soon you could take another look. In a refinery on a two-year turnaround cycle with reasonably free access, a closure made on weak evidence is corrected at the next opportunity and the damage is a wasted scaffold. An LNG train is not that. Major shutdowns fall four to six years apart. The main cryogenic heat exchanger sits inside a perlite-filled cold box that cannot be entered while the plant is cold. An inner tank in refrigerated service needs a controlled warm-up, inerting and gas-free certification measured in weeks before anyone stands on the annular plate.

So the arithmetic of a bad closure changes character. If a contractor's thickness survey on a cold-end circuit is accepted without a resolved datum, and the error surfaces eighteen months later during a data review, there is no corrective inspection available. What you have instead is a hole in the thickness history at exactly the points that drive the next remaining-life calculation, and a choice between an engineering assumption and a fitness-for-service assessment under API 579-1/ASME FFS-1 to justify running to the window.

This is why the acceptance gate belongs inside the scheduler and not in a document management system. A document system can tell you that a report exists and who signed it. Only the scheduler knows that the next chance to be right is five years away, and only the scheduler can refuse to spend that chance on data it cannot verify.

Access windows in cryogenic service are coarse, few and shared

Most plants have a spectrum of access: some equipment can be examined on stream, some at a short outage, some only at turnaround. LNG compresses that spectrum. The warm sections, utilities, flare and boil-off gas systems behave conventionally. Everything cold behaves as a single block that opens rarely. Add the marine side, where jetty structural and loading arm inspection competes with berth occupancy, and the calendar acquires windows defined by shipping schedules rather than by maintenance planning.

The consequence for a scheduling module is that an access event has to be a first-class object. A tank warm-up, a train shutdown, a berth-free period and a cold box entry are each events with their own dates, durations, preparation chains and owners. Individual inspection due dates attach to those events as dependencies. Systems that store only a planned date per task cannot express this, and produce plans that look complete and are internally inconsistent the moment one event moves.

There is a second-order effect worth planning for. Because cold-side access is scarce, scope competes. A boil-off gas compressor overhaul, a cold box internal examination and a tank floor survey may all want the same shutdown weeks. The schedule needs to show which due dates are genuinely constrained by the code interval and which are being pulled forward only because the window exists, so that the argument happens in a planning meeting instead of on the day.

The thickness datum problem is arithmetic, not paperwork

Contractors report wall thickness in more ways than an owner expects: absolute readings taken on bare metal, remaining wall after subtracting an allowance defined in the vendor's own procedure, loss from a stated nominal, or nothing but the grid minimum. In a wet, corroding service the differences are noise against a real signal. In dry cryogenic service, where general corrosion rates are close to zero, the differences are the entire signal.

Take a real shape of problem. A circuit with nominal wall 9.53 mm and a calculated minimum of 8.90 mm reads 9.45 mm at baseline in 2011 and 9.45 mm again in 2023 from a vendor measuring absolute wall on bare metal. In 2026 a different vendor reports 9.20 mm, having subtracted a standard 0.25 mm allowance per their procedure; the metal they actually measured was 9.45 mm. Nothing has corroded. But the short-term rate computed across 2023 and 2026 is 0.083 mm per year, the long-term rate is 0.017 mm per year, and a procedure that takes the greater of the two now governs on a number that does not exist.

Follow it through. Remaining life becomes (9.20 - 8.90) divided by 0.083, about 3.6 years, and a half-life interval rule sets the next inspection at roughly eighteen months. On a train whose next shutdown is four years out, an eighteen-month due date is unschedulable. You are now writing a temporary justification, an on-stream workaround or an API 579 assessment to defend running to the window, all because two contractors defined remaining wall differently. A scheduling module must refuse to compute a rate across readings whose declared basis differs, and must treat the basis as a mandatory field on submission rather than as a footnote in a report.

Qualification has to be true on the day of work

ASNT SNT-TC-1A is a recommended practice implemented through the employer's own written practice. A contractor's Level II is qualified under that contractor's document, with that contractor's training hours, experience credit and examination content. Equivalence to your expectations is a judgement you have to make and record, not a property of the certificate. ISO 9712 certification is third-party, with a defined scope, sector and expiry, which makes it easier to verify but no less necessary to check.

Under 49 CFR Part 193 the qualification of personnel performing covered work is itself subject to inspection, and the operator is the one holding the obligation. The practical failure is mundane. A campaign runs eleven weeks. The scheduling system checked certification when the crew was assigned in week one. Two technicians' near-vision acuity checks lapsed in week six, and a third's ISO 9712 certificate expired in week nine. Every reading after those dates is contestable, and the argument will happen years later when the vendor no longer exists.

The design requirement is small and specific: evaluate qualification against the date the work was performed, per individual, per method, per level, and surface the conflict at submission rather than at audit. The same check should cover the procedure revision used and the calibration status of the reference blocks and equipment, because those expire on their own schedules too. This is also where a scheduling module earns its place over a shared calendar, which cannot know any of it.

What an acceptance gate actually looks like

Structural checks run first and run automatically, because they need no expertise. Does every reading reference a condition monitoring location that exists in the register? Is the measurement basis declared? Does the report cite a procedure, and is that the currently approved revision? Are the named technicians on the approved list, at the right level, current on the performance date? For radiography, are the technique details, penetrameter or wire IQI and density or contrast requirements present as ASME Section V Article 2 expects? A submission failing any of these should bounce within seconds, before anyone spends review time on it.

Human review then handles the part machines cannot: does the interpretation make sense given the damage mechanisms credible for this circuit, and does the finding change the risk basis? Disposition is one of three states. Accepted, and the interval rolls forward. Rejected with a reason code, and the due date stays open. Accepted with exception, which records that the data has a known limitation and constrains how it may be used in future rate calculations.

The rejection reasons are more valuable than they look. Aggregated by vendor, method and site, they turn contractor data quality from an anecdote into a metric you can put in a bid evaluation or a pre-qualification review. Most LNG operators discover that failures cluster on two or three vendors and two or three check types, which makes the remedy a specific conversation rather than a general complaint.

Evaluating a scheduling module for this job

Ask to see a report rejected in a demonstration, not accepted. Any system can show a green tick. The question is whether the product has a state between submitted and complete, whether the due date visibly stays open in that state, and whether the reason for rejection is structured data rather than a comment. If the answer is a comment field, the vendor has a document workflow with a calendar attached, not an inspection schedule.

Next, ask what happens when a submission carries readings for a location that does not exist in the register. Correct behaviour is to hold the reading, flag the mismatch and refuse to trend it. Common behaviour is to create the location silently, which is how registers acquire duplicate condition monitoring points and how a fifteen-year history quietly splits into two five-year histories that both look healthy.

Finally, test the dependency model. Ask the vendor to move a tank warm-up event by three weeks and show every due date that moves with it, including scope that was planned around it by other departments. Then ask them to reopen a closed due date and show the audit trail. Those two demonstrations separate systems built for contracted inspection from systems built for an in-house crew and sold to everyone. A working session with an inspection engineer who has run an LNG programme is worth more than a feature list; Atlantis runs those as consultations on request at info@atlantisndt.com.

Where the schedule meets the regulator

Three regimes converge on the same records. OSHA 29 CFR 1910.119(j) requires that inspections and tests on process equipment be performed following recognised and generally accepted good engineering practice, that they be documented, and that equipment deficiencies be corrected before further use or in a safe and timely manner. 49 CFR Part 193 adds maintenance procedure and personnel qualification expectations specific to LNG facilities. NFPA 59A supplies the design and operating framework those sit within.

None of them ask for a scheduling product. All of them ask questions that a scheduling product answers or fails to answer in an afternoon: show me the inspection that was due on this vessel, when it was performed, by whom, under which procedure, what was found, what was done about the finding, and what the next due date is based on. When the work was contracted, every one of those answers passes through someone else's document, which is exactly why the acceptance state matters.

The practical test is whether an auditor can be handed a single asset and follow the thread end to end without a person narrating it. If the narration is required, the system is storing outcomes rather than evidence, and the gap will be found by someone less friendly than an auditor at some point in the asset's forty-year life.

Request a consultation