One inspection calendar for every refinery in the network

Sites diverge under a single corporate procedure

Every multi-site refiner has a corporate mechanical integrity procedure, and every one of them has sites that execute it differently. This is not usually indiscipline. It is the accumulated result of different unit configurations, different histories, different regulators, different contractor markets and, most often, different people solving the same problem independently over fifteen years. One site built its programme around a legacy inspection database and thinks in circuits. Another grew out of a turnaround planning group and thinks in work orders. A third was acquired and still carries the previous owner's criticality scale.

The divergence is invisible while each site reports on itself. It becomes acute the moment a corporate integrity function asks for a network view, because the metrics arrive in incompatible units and the natural response is to normalise them in a spreadsheet. That spreadsheet becomes the corporate number, it is rebuilt monthly by whoever is available, and nobody can explain in a review why a site's compliance moved four points.

The instinct at that point is to buy a system and impose it. That usually fails, because the divergence being solved is definitional rather than technical, and a new system with the old definitions produces the same incomparable numbers faster. The sequence that works is the reverse: agree the definitions that must be common, agree explicitly what stays local, then implement.

The denominators that stop the numbers rolling up

Start with the unit of work. If site A schedules an inspection per piping circuit and site B schedules one per condition monitoring location, a circuit with forty CMLs is one item at A and forty at B. Both sites can be at ninety per cent complete and be doing wildly different amounts of work. The physically defensible unit is the circuit, because a circuit is what an isolation, a scaffold and an insulation removal actually serve. CMLs are scope within that item, not independent items.

Then completion. Three definitions circulate in every refiner: readings taken, report issued, and deficiency dispositioned. They can be months apart. Under API 510 and 570 the interval clock runs from the inspection, so completion for interval purposes has to be tied to the inspection and its accepted report. Deficiency correction is a separate and equally important obligation under the process safety mechanical integrity provisions, and it needs its own clock rather than being folded into the completion percentage where it distorts both numbers.

Then overdue. Measuring overdue at month end rather than daily hides every item that went past due and was closed within the same month, which is precisely the population most worth seeing. And finally criticality: a locally invented A/B/C scale cannot be mapped onto an API 580/581 risk ranking by assertion. Where risk-based inspection exists, the network scale should derive from its output; where it does not, the site should say so rather than supply a number that looks like the others.

The calendar has to schedule access, not just inspections

The cost and duration of a refinery inspection are usually dominated by everything that is not the inspection. Erecting scaffold to reach a vessel nozzle, stripping and reinstating insulation on a hot line, permitting a confined space entry under 29 CFR 1910.146 with attendant and atmospheric monitoring, isolating and locking out under 1910.147 — these consume the schedule. The ultrasonic technician's time on the item can be minutes.

This inverts the design of the calendar. Scheduling inspections and treating access as an administrative consequence produces a plan that is unbuildable and a scaffold bill that dwarfs the inspection budget. Scheduling access as a resource, and bundling every inspection that shares that access into one campaign, is where the recoverable cost lives. It also changes the scheduling question from 'when is this CML due' to 'what else should we look at while this scaffold is standing', which is a question a planner can only answer if every due date within reach of that access point is visible at once.

Corrosion under insulation makes this concrete. API 583 addresses inspection of insulated systems, where the damage is hidden and the inspection requires the same insulation removal whichever technique is used. The economics of a CUI programme are almost entirely an access-planning problem, and a scheduling engine that cannot group by access point cannot support one.

Unit damage mechanisms decide what can be scheduled at all

A refinery is not one plant with one damage profile. It is a dozen units with distinct mechanisms, and those mechanisms determine whether an item can be inspected on-stream or only during a shutdown. Sulphidation in crude and vacuum heater transfer lines is a thinning mechanism, amenable to external thickness survey while running. High temperature hydrogen attack in hydroprocessing, assessed against the Nelson curves in API 941, is a subsurface material degradation that requires specialised techniques and a very different inspection plan. Ammonium bisulphide corrosion in a hydrotreater reactor effluent air cooler is velocity and concentration dependent, localised, and often only accessible internally.

Naphthenic acid corrosion in high-TAN crude service is velocity-dependent and concentrates in specific geometries — elbows, reducers, downstream of control valves — so the inspection plan is geometry-driven rather than uniform. Wet hydrogen sulphide cracking in amine and sour water systems is a cracking mechanism requiring different methods and, frequently, internal access. Creep in fired heater tubes brings its own techniques and its own inspection cycle tied to the heater's own outage rather than the unit turnaround.

The scheduling consequence is that 'due' does not mean 'schedulable'. An item whose mechanism can only be assessed internally is constrained to a shutdown window, and its due date has to be reconciled against a turnaround cycle that may be four to six years long. This is the mechanism by which deferrals get created, and a calendar that does not distinguish on-stream-capable from shutdown-only items will generate a plan that quietly assumes the impossible.

Turnaround gates and the price of discovery scope

Refining turnarounds run to a gated schedule, and the gate that matters for inspection is scope freeze, typically set many months ahead of execution. After the freeze, adding scope is expensive: materials are not procured, contractor manning is set, the critical path is built, and late additions land as discovery work at premium rates and premium schedule risk. Everyone in a refinery knows this. What is surprisingly hard is answering, on the freeze date, which inspection items will become due before the following turnaround.

That question requires a forward projection across every clock at the site — vessel internal intervals under API 510, piping thickness intervals under API 570, tank internal intervals under API 653, pressure-relieving device test intervals under API 576 and the site's own practice, heater tube cycles, and any risk-based intervals with their own expiry. It is a projection, not a status report, and it has to include items that are currently comfortably in date but will not be by the time the next window comes round.

Sites that build this projection by hand build it inconsistently, which is one of the clearest expressions of the standardisation problem. One site projects to the next turnaround, another to the next plus a margin, a third only to the end of the fiscal year. The result is that some sites systematically carry more discovery scope than others, and the corporate view cannot see why. A shared engine that runs the same projection at every site with the same horizon turns that into a comparable, reviewable number.

Deferrals, management of change, and what counts as good practice

Not every due date can be met, and pretending otherwise is what produces informal deferrals. The mechanical integrity provisions under 29 CFR 1910.119(j) require inspections and tests at a frequency consistent with manufacturer recommendations and good engineering practice, and require that equipment deficiencies be corrected before further use or that necessary means be taken to assure safe operation. Extending an interval is therefore an engineering decision with a documented basis — a fitness-for-service assessment under API 579-1/ASME FFS-1, a risk assessment under API 580/581, or a documented evaluation by the responsible engineer — not a planning convenience.

The recurring compliance exposure across a network is not that deferrals happen. It is that they happen differently. One site routes them through management of change with engineering approval. Another handles them by verbal agreement between the inspector and the unit engineer. A third does not record them at all, so items simply appear as overdue on a report and are closed retrospectively. All three sites believe they are compliant. Only one can demonstrate it.

There is a second dimension an auditor will probe. OSHA assesses mechanical integrity frequency against recognised and generally accepted good engineering practice, and if sites within one company cite different practices for identical equipment in identical service, the inconsistency invites the question of which one is right. Recording the basis for each frequency, and being able to show it is the same across the network for the same equipment class, closes that line of enquiry before it opens.

Standardising the definitions without flattening the sites

The standardisation that succeeds is narrow and deep. Make common the things that make numbers comparable: asset and circuit identification, criticality derivation, due-date rules and their basis, the completion definition, the overdue definition, the deferral workflow with its approval authority, and the forward projection horizon. Leave local the things that depend on local reality: crew assignment, daily sequencing, permit coordination, contractor call-off, scaffold vendors and the order in which a site works its units during a shutdown.

This division is not a compromise, it is the correct architecture. A corporate integrity function needs comparable numbers and consistent justification. It does not need to know which contractor is on which scaffold on Tuesday, and any attempt to centralise that will be routed around within a quarter by sites keeping their own real schedule in a spreadsheet — which reproduces the original problem with an expensive system on top of it.

Evaluate a scheduling engine against this division explicitly. Ask whether due-date rules are held centrally and versioned while execution stays local. Ask it to produce, for a chosen site, the list of items becoming due before the end of the next turnaround cycle. Ask how a scaffold or insulation-removal event is represented and whether inspections can be bundled to it. Ask how a deferral is created, who can approve it, what basis is compulsory, and whether it is visible on the corporate roll-up. Then ask for the same outputs from a second site and compare them line for line. To run that comparison against your own sites' data, request a working session at info@atlantisndt.com.

Request a consultation