Making remaining life comparable across a fertiliser group

Three codes in one plant, and a column that cannot be summed

An ammonia-urea complex runs API 510 on synthesis loop vessels, separators and pressurised storage bullets; API 570 on the interconnecting piping; and API 620 with API 653 on refrigerated atmospheric ammonia storage. Each of the three derives its next date by a different route and caps it differently. API 510 works from remaining life halved, subject to a ceiling for internal inspection. API 570 works from a piping class that carries its own thickness and external inspection ceilings. API 653 works from shell and bottom evaluations, with a separate external visual frequency and a much longer internal ceiling.

A single next-inspection column that has forgotten which code produced each number cannot be aggregated honestly. "Sixty-two assets overdue" is not a fact when the population mixes a refrigerated ammonia tank whose internal inspection falls in year nineteen with a Class 1 ammonia line whose thickness survey falls in year five. Worse, the same physical installation appears under two codes: the shell of an ammonia bullet under 510, its associated piping under 570, with different dates, different ceilings and often different owners inside the organisation.

The engine must carry the governing code, the basis for the interval and the ceiling applied as data attached to every interval, and the roll-up must slice by them. This is not documentation for its own sake. It is the mechanism by which a corporate integrity manager can state, with evidence, that two sites either are or are not comparable — which is the entire point of standardising in the first place.

The initial thickness argument, and why it silently ages a fleet

API 510 defines a long-term corrosion rate from an initial thickness and a current thickness over the elapsed period, and a short-term rate from the previous and current readings. The code leaves the owner-user to decide which initial thickness to use. That single decision, taken independently at each site years ago by engineers who have since moved on, is the largest single source of incomparability in a multi-plant register.

If one site uses nominal plate thickness from the manufacturer's data report, it books mill overtolerance — often a few tenths of a millimetre on plate — as corrosion that never occurred. Spread over twenty-five years that produces a real-looking rate of several hundredths of a millimetre per year on equipment that has not corroded at all. If the sister site uses the first post-commissioning measurement, it starts clean but loses whatever loss happened before that survey. Both approaches are defensible. Neither is comparable to the other, and no amount of dashboard styling will make them so.

The fix is not to force one convention retroactively, which destroys history and invalidates every interval currently in force. It is to store the basis as an attribute of every rate, present both rates wherever both can be computed, and let the group standard specify which one governs the published interval going forward while keeping the alternative visible. A roll-up that cannot tell you which basis a number came from is a roll-up you cannot defend in a process safety audit.

Short-term versus long-term rate, and the one noisy survey

The code expects the owner-user to apply judgement when choosing between short-term and long-term rates, and sound programmes generally take the more conservative of the two. The trouble is what "more conservative" does to a fleet when one site applies it mechanically. A single survey performed by a different examiner, with a different probe, on a rougher surface, can produce a short-term rate several times the long-term rate on an asset whose service has not changed in any way.

Applied without review, that one survey shortens the interval, pulls the asset into the next turnaround, consumes crew hours that were allocated elsewhere, and — because the roll-up now compares sites — makes that plant appear to be corroding faster than its sister. Applied with review, the same result triggers a re-read before it triggers a schedule change. The engine should support the second behaviour: flag a short-term rate that diverges from the long-term rate beyond a set factor, hold the interval change pending, and record who accepted or rejected it and why.

In ammonia service there is a physical reason to take divergence seriously rather than dismiss it as noise. Process upsets that admit oxygen or shift water content do not thin metal, but they change cracking susceptibility sharply. A step change in a thickness trend is more often an inspection artefact than corrosion, but a step change in operating conditions warrants a damage mechanism review regardless of what the thickness data says.

Piping class is a judgement, and ammonia exposes it

API 570 assigns piping to classes according to the consequence of failure, and the class sets the maximum interval for thickness and external inspection. Anhydrous ammonia is toxic, is stored and transferred as a liquefied gas, and flashes on release, which is exactly the profile the highest class exists to cover. Yet across a group it is common to find one site running ammonia lines as Class 1 and another running identical service as Class 2, because the classification exercise was done by different engineers a decade apart with no shared basis document.

The difference is not cosmetic. It roughly halves or doubles the inspection frequency on the most hazardous lines in the plant, and it does so on a basis neither site can now reconstruct. When a corporate standard is finally written, the sites that were running the looser class discover a backlog they did not know they had. That backlog is the genuine output of a standardisation programme, and it should be surfaced deliberately and planned for, rather than arriving as a surprise during a PSM compliance audit.

The engine's job is to make classification an explicit, reviewable attribute with a recorded consequence basis, to recalculate every affected interval when a class changes, and to model the schedule impact before the change is committed. Reclassifying two hundred circuits without first seeing the workload that results is how standardisation programmes get quietly abandoned in their second year.

Assets where remaining life is not a thickness calculation

Stress corrosion cracking of carbon steel in anhydrous ammonia — the classic threat in fertiliser storage — is driven by oxygen ingress, by water content in the ammonia, and by high residual stresses in welds that were not stress relieved. The long-standing mitigation is maintaining a minimum water content and excluding air during transfers. None of that appears in a thickness trend. The examination that matters is wet fluorescent magnetic particle inspection of internal weld seams and heat affected zones, and the interval that matters is set by cracking risk and by what the last examination found.

The urea high-pressure loop is a different problem again. Ammonium carbamate attacks almost everything, and the engineering answer is a corrosion-resistant liner over a carbon steel pressure-retaining wall, with leak-detection holes drilled through so that a liner breach announces itself before the wall is attacked. Integrity here is a liner and leak-detection question, checked at every shutdown, not a corrosion rate question. A group engine that assigns these vessels a thickness-derived date is producing a comfortable number about entirely the wrong thing.

The synthesis loop and reformer outlet add high temperature hydrogen attack, screened against the API 941 Nelson curves and monitored by advanced ultrasonic techniques rather than thickness. Reformer tubes add creep, assessed through diametral growth and in-situ metallography. Nitric acid trains add end-grain attack of austenitic stainless in absorbers and cooler-condensers. Each needs its own interval basis in the engine, its own evidence type, and its own visibility in the roll-up — not concealment behind a thickness column reporting that everything is fine.

Statutory ceilings a group standard cannot override

Fertiliser groups are rarely single-jurisdiction. A North American site runs its mechanical integrity programme under OSHA 29 CFR 1910.119, using the API codes as the recognised and generally accepted good engineering practice, with state jurisdictional requirements applying to boilers and certain vessels on top. A European site holds pressure equipment under national in-service inspection rules administered by a notified or approved body, with statutory periodicities that no internal risk assessment may extend.

The engine has to hold both and always publish the binding one. In practice that means storing the statutory interval in a separate field from the derived interval, taking the earlier of the two as the published date, and labelling which one governed. Systems that keep a single date field and let the risk-based module write it will, sooner or later, push a European vessel past a statutory examination because the calculation said the metal was fine. The calculation was right and the site is still in breach.

The same discipline applies within the United States. Risk-based inspection can extend an API 510 internal inspection interval within the code's own limits; it cannot extend a jurisdictional inspection required by the state boiler and pressure vessel authority. Collapsing those two clocks into one field is a common and expensive migration error, and it is nearly always discovered by an inspector rather than by the system.

What the group roll-up must actually show

A corporate integrity report claiming ninety-four per cent compliance is worthless without knowing what the denominator is made of. The useful roll-up shows, per site: the population by governing code; the proportion of intervals derived from a measured corrosion rate versus assigned by default; the proportion of assets with a documented required thickness; the proportion whose credible damage mechanisms include something a thickness calculation cannot see; and the count of intervals extended by risk-based inspection, with their approvals attached.

Those five figures expose the real differences between plants far more sharply than a compliance percentage. A site at ninety-eight per cent compliance with sixty per cent of its intervals assigned by default is in materially worse shape than a site at eighty-eight per cent where every interval is calculated from data. Standardisation that harmonises only the output date, and not the inputs behind it, produces uniform-looking numbers laid over completely unchanged practice.

Trend the composition, not only the compliance. The measurable goal of a standardisation programme in its first year is not a higher compliance percentage — that can be achieved by assigning defaults. It is a fall in default-assigned intervals and a rise in assets carrying a retained, reproducible required thickness. Those two numbers are what a group actually bought.

How to evaluate the engine across sites

Bring readings from two sites, with their existing conventions intact, and ask the vendor to load both without normalising anything by hand first. Ask for the same class of vessel's remaining life computed under each site's convention, side by side, with the basis labelled on each. Then ask what happens when the group convention is imposed: how many intervals move, in which direction, and what the resulting workload looks like broken out by site and by quarter.

Test code coverage explicitly rather than accepting a feature list. Ask the engine to derive a date for a refrigerated ammonia tank under API 653, a Class 1 ammonia line under API 570, and a urea carbamate vessel whose basis is liner leak detection. Ask where the API 941 screening lives and what triggers it. If all three come back as the same corrosion-rate calculation wearing three different labels, the engine has one model and a naming convention.

Atlantis configures this on Odoo so the interval engine, the examiner certification register under SNT-TC-1A and ISO 9712, equipment calibration and the outage work order backlog sit in one system rather than three that reconcile by spreadsheet at quarter end. It is built to hold each site's convention explicitly rather than to assume a single one. Affordable, accessible and fully customisable. To walk it through your own multi-site register, contact info@atlantisndt.com.

Request a consultation