Turning six contractors' reports into one defensible next date
A food plant rarely owns its inspection data. It arrives from a refrigeration contractor, an NDT firm, a boiler insurer's inspector and a piping crew, in four formats with four naming conventions. The interval engine's real work happens at ingestion: identify the location, validate the reading, reject what cannot be trusted, and only then compute a date.
The damage in an ammonia refrigeration system is mostly on the outside. A closed, dry, oil-managed circuit sees very little internal metal loss, while cold insulated lines cycling through the dew point corrode under the insulation and behind a compromised vapour barrier. That inverts the usual model. A fixed grid of condition monitoring locations on a suction line is close to useless if the attack is localised at a support, a hanger penetration or a jacket seam. Meanwhile the vessels can carry a cracking mechanism rather than a thinning one: carbon steel in anhydrous ammonia service is susceptible to stress corrosion cracking, which no thickness extrapolation will ever predict. An interval engine for this industry has to hold assets whose date comes from insulation and jacket condition, assets whose date comes from a crack-detection method on a fixed cycle, and assets that genuinely do thin — and never blend the three.
Source: Written against IIAR 6 (Standard for Inspection, Testing and Maintenance of Closed-Circuit Ammonia Refrigeration Systems), OSHA 29 CFR 1910.119 including the mechanical integrity and compliance audit provisions, EPA Risk Management Program requirements at 40 CFR Part 68, ASME Section VIII Division 1, ASME B31.5 and B31.1, API 510, API 570, API 571 (notably ammonia stress corrosion cracking and corrosion under insulation), the National Board Inspection Code NB-23, 3-A Sanitary Standards, ASNT SNT-TC-1A and ASTM E797 for ultrasonic thickness measurement.
| Defect in the incoming report | Effect on the derived interval | What the engine must do at ingestion | Evidence to retain |
|---|---|---|---|
| Reading with no condition monitoring location identity, only a line name | Readings from different spots are trended as one location, producing a fictional rate | Refuse to trend; hold the reading against the line as uncorrelated until a location is assigned | The original report page and the assignment decision with its author |
| Gauge reporting to two decimal places on a thin wall | Rounding alone creates an apparent rate floor of several mils per year over a short interval | Record instrument resolution with the reading and suppress rates below the resolution-derived threshold | Instrument model, resolution, calibration record and block used |
| Later reading thicker than the earlier one | A negative rate becomes an effectively infinite remaining life and the date silently moves out | Flag as non-physical, exclude from the rate, and require disposition before any date changes | The flagged pair, the disposition and who made it |
| Readings taken at operating temperature with no correction noted | Velocity change with temperature shifts apparent thickness by a margin comparable to the corrosion signal | Capture surface temperature at measurement and the correction applied, or mark the reading as uncorrected | Temperature recorded, correction basis, procedure revision |
| Nominal thickness differs between contractors for the same component | Remaining allowance and long-term rate both change depending on whose file was loaded last | Hold nominal as an asset property owned by the plant, never taken from the incoming file | Source of the plant's nominal value, drawing or certificate reference |
| Technician certification expired before the visit date | Every reading in the campaign is challengeable at a compliance audit | Validate certification currency against the visit date at ingestion, not at report review | Certification record, level, method, expiry and vision test currency |
The data arrives from six sources in six shapes
A food plant with an ammonia refrigeration system, a steam plant and a few hundred metres of process pipework will typically receive inspection data from at least four organisations. The refrigeration contractor submits an inspection, testing and maintenance checklist, sometimes as a scanned pdf with handwritten ticks. An NDT firm submits thickness readings, often as a spreadsheet with columns that are almost but not quite the same as last year's. The boiler insurer's commissioned inspector submits a jurisdictional report on the insurer's template. Somebody's piping crew submits a summary email with three numbers in the body.
None of these organisations is negligent. They are each producing what their own system produces, to the scope they were bought. The plant's problem is that it has to assemble a single defensible position from all of it, usually with a maintenance manager who is not an inspection specialist and has half a day a month for the task. That assembly is where the errors enter, and they are not exotic errors. They are naming mismatches, missing baselines, unstated units and unrecorded exclusions.
The consequence is specific and quantifiable. A remaining-life calculation is a subtraction between two numbers and a division by a rate, and every one of those three quantities is imported from someone else's file. If the two thickness values came from locations two metres apart, or if the nominal thickness came from the contractor's assumption rather than the plant's drawing, the arithmetic is impeccable and the answer is invented. No downstream reporting fixes this. It has to be caught where the data enters.
Ammonia refrigeration breaks the linear corrosion model
The intuition carried over from refinery integrity work is that fluid attacks metal from the inside and thickness declines roughly linearly. In a closed-circuit ammonia system that is largely not what happens. The circuit is dry, sealed and oil-managed, and internal general corrosion is slight. The metal loss that matters is external, under insulation, driven by moisture that penetrates a damaged vapour barrier and cannot escape because the steel is below ambient dew point for most of its operating life.
That inversion has direct consequences for how an interval should be derived. Corrosion under insulation is localised, not general. It concentrates at pipe supports where the jacket is compressed, at hanger penetrations, at valve stations and elbows where jacketing is discontinuous, at low points where condensate collects and at any repair made without restoring the vapour barrier properly. A regular grid of condition monitoring locations laid out for convenience will systematically miss all of those places, and will keep returning reassuring numbers while the real loss proceeds three feet away.
So a credible interval for an insulated cold line is driven far more by insulation and jacket condition survey than by thickness trend, with thickness confirmation targeted where the survey finds a defect and supported by profile radiography where insulation cannot be removed. The engine has to be able to express that: an asset whose interval is keyed to an external condition survey, with thickness readings attached as confirmatory evidence at specific locations rather than as the interval driver. Any system that only understands rate-driven intervals will quietly mis-schedule the largest population of assets in the plant.
Cracking mechanisms have no remaining life
Alongside the piping sit the pressure vessels: high-pressure receivers, recirculator and accumulator vessels, intercoolers, oil pots. They are ASME Section VIII Division 1 construction, and in most jurisdictions they are also registered vessels inspected under state law with a National Board commissioned inspector. Their internal surfaces, again, see little general thinning. What they can see is stress corrosion cracking of carbon steel in anhydrous ammonia service, a mechanism described in API 571 and associated with residual and applied stress, oxygen contamination and low water content in the ammonia.
A cracking mechanism is categorically different from a thinning one for interval purposes. There is no wall-loss rate to extrapolate; a vessel can carry cracks while returning perfectly comfortable thickness readings. Detection needs a technique aimed at cracks — wet fluorescent magnetic particle examination of the internal surface at welds and heat-affected zones, applied on a cycle chosen from mechanism susceptibility and service history rather than computed from a rate.
This is a hard requirement on the engine and a good evaluation question. Ask whether an asset can carry a mechanism-driven interval that is independent of, and can be more frequent than, whatever the thickness arithmetic returns; whether the mechanism itself is a recorded object drawn from a damage mechanism register rather than a note in a comment field; and whether the technique required by that mechanism is tied to the schedule so the work order specifies the right examination. Plants that get this wrong send a thickness crew to a vessel that needed a crack inspection, and close the task.
The arithmetic traps hiding in contractor thickness files
Four traps account for most fabricated dates. The first is location identity. Contractor A calls it Suction Line 3 East Elbow; contractor B calls it S3-E1; the plant calls it the line to Freezer 2. Trending readings across those three is trending three different spots, and the resulting rate is noise with a sign. Location identity has to be owned by the plant and asserted at ingestion, with any reading that cannot be matched held aside rather than absorbed.
The second is resolution. A gauge that reports to a hundredth of an inch cannot resolve a change smaller than that, so on a two-year cycle the smallest observable change corresponds to roughly five mils per year of apparent loss. On thin-wall refrigeration piping that fabricated rate can exceed the genuine one. The engine must store each reading's instrument resolution and suppress or flag any rate that sits below what the instrument could have detected.
The third is temperature. Ultrasonic thickness measurement depends on sound velocity in the material, and velocity changes with temperature. A reading taken on a line at deep operating temperature and compared against one taken at ambient during a shutdown carries an apparent difference of the same order as the corrosion signal being sought. ASTM E797 practice expects temperature to be accounted for; contractor files frequently do not record it at all, which means the correction cannot be applied afterwards.
The fourth is the non-physical reading. Steel does not grow. When this year's value exceeds last year's, the rate goes to zero or below, remaining life becomes unbounded and the next date moves to whatever cap applies — silently, because the calculation did exactly what it was told. On mixed contractor data this occurs constantly, and it always errs in the unsafe direction. It must be trapped, dispositioned by a named person, and the disposition retained.
What process safety coverage changes about the record
An ammonia charge above the regulatory threshold quantity brings the refrigeration system into process safety management under OSHA and, in parallel, into the EPA risk management programme. The mechanical integrity element requires written procedures, inspection and testing of covered equipment on a schedule following recognised and generally accepted good engineering practice, personnel trained for the work, and documentation of each inspection and test. For closed-circuit ammonia refrigeration, IIAR 6 is the consensus standard most facilities name as that practice.
What this changes in the record is the burden of retrievability. A compliance audit is conducted on a defined cycle, and it does not audit the equipment — it audits whether the written procedures exist, whether the schedule follows them, and whether the documentation shows completion. Each item of that documentation must identify the date, the person who performed it, the equipment identity, the test performed and the result. A stack of contractor pdfs filed by month can contain every one of those facts and still fail, because the auditor needs them per equipment item, not per visit.
There is a second-order effect worth planning for. If the plant's named practice specifies a task at a given frequency and the schedule shows a longer one, the gap is a finding regardless of asset condition. So the engine has to carry the practice-derived frequency alongside any condition-derived one and show which governs, and it has to make a deviation visible as a deviation with a recorded justification. Facilities that manage this in a spreadsheet almost always discover the mismatch during the audit rather than before it.
Product-contact stainless runs on a different kind of schedule
The utilities side of a food plant thins; the product side generally does not, and it fails differently. Product-contact pipework and fittings built to 3-A Sanitary Standards are managed for cleanability and surface integrity. The failure modes are crevices at poorly made welds, surface finish degradation, gasket and seat wear, and dead legs that clean-in-place flow does not reach. Verification is coverage testing and inspection, not wall thickness.
There is a metallurgical concern too. Austenitic stainless in contact with chloride-bearing sanitisers at elevated temperature is susceptible to chloride stress corrosion cracking, and hot caustic cycles bring their own considerations. These are mechanism-driven inspection triggers again, keyed to the chemistry and temperature of the clean-in-place regime rather than to a rate.
Including product-contact assets in the same register as the ammonia and steam systems is worth doing, provided the register can hold several rule types without forcing them into one. The value is a single view of what is due across the plant, which is what the maintenance manager actually needs when planning a shutdown window. The danger is a system that insists every asset produce a thickness-derived date, which pushes someone to invent a nominal thickness for a sanitary line so the record looks complete.
Evaluate on ingestion, not on the dashboard
Dashboards demo well and tell you nothing about whether a system will survive your contractors. So run the evaluation on real files. Take last year's refrigeration contractor checklist, last year's thickness spreadsheet, and one jurisdictional boiler report, and load them as they are — including the scan, including the inconsistent naming, including the columns nobody renamed.
Then watch what happens at the boundary. Does an unmatched location get rejected or absorbed? Does the system ask for instrument resolution, or accept a number with no provenance? Is technician certification currency checked against the visit date, so an expired certification is caught while there is still time to have the work redone rather than discovered at audit? Does a thicker-than-last reading stop and demand a disposition, or does it move the date? Can a single asset carry both a practice-derived frequency and a condition-derived one, with the governing one shown?
The last question is the most revealing: ask to see the ingestion rejection log. A system that has one is a system whose designers expected the data to be imperfect, which is the correct expectation in this industry. A system with no concept of rejecting a reading will accept everything your contractors send and compute confidently on top of it, which is precisely the position you are trying to leave. For a walkthrough using your own contractor files, request a consultation at info@atlantisndt.com.
Why is corrosion under insulation the dominant concern on a refrigeration circuit?
Because the inside of a well-managed closed ammonia circuit barely corrodes while the outside cycles through the dew point every defrost and every shutdown. Water gets behind a damaged vapour barrier, sits against cold steel and does not evaporate. The attack concentrates at supports, hanger penetrations, valve stations and jacket seams — precisely the places a tidy grid of monitoring locations avoids because they are awkward to reach.
How does a thicker reading than last time push a date further out?
Arithmetically, the corrosion rate goes to zero or negative, remaining life becomes unbounded, and the next date lands on whatever code or policy cap applies. Nothing warns anyone, because the calculation performed exactly as written. On contractor data with inconsistent location identity this happens routinely, and it always moves the date in the unconservative direction. Non-physical rates have to be trapped at ingestion and dispositioned by a person.
What does gauge resolution do to a short interval?
It sets a floor on the smallest change you can observe, and that floor becomes an apparent corrosion rate. A gauge reporting to a hundredth of an inch cannot resolve anything finer, so on a two-year interval the smallest non-zero change reads as roughly five mils per year of apparent loss. On thin-wall refrigeration piping that fabricated rate can dominate the real one, so the engine must know each reading's resolution and refuse to trend below it.
Why can a vessel need a fixed inspection cycle regardless of thickness?
Because the credible mechanism is cracking rather than thinning. Carbon steel in anhydrous ammonia service can suffer stress corrosion cracking, described in API 571, and cracking is not predicted by any wall-loss extrapolation. Those vessels need a crack-detection technique such as wet fluorescent magnetic particle examination on a defined cycle, and the engine must let a mechanism-driven interval govern independently of whatever the remaining-life arithmetic returns.
Where does IIAR 6 sit relative to OSHA process safety requirements?
For a covered ammonia refrigeration system, IIAR 6 is the industry consensus standard a facility will typically name as its recognised and generally accepted good engineering practice for inspection, testing and maintenance. The regulation requires the facility to establish and follow written procedures on an interval consistent with that practice, and a compliance audit will read the two together. The engine's job is to make the tasks, frequencies and completion evidence retrievable per asset.
How should product-contact stainless pipework be handled?
Not as a thickness problem. Product-contact lines and fittings built to 3-A Sanitary Standards are managed for cleanability and surface integrity — verified through clean-in-place coverage checks, riboflavin or comparable testing, and inspection for crevices, weld defects and surface finish degradation. Chloride-bearing sanitisers at temperature also raise a stress corrosion cracking concern in austenitic grades. These belong in the same register on their own rule type, not forced into a corrosion-rate schedule.
Built for any business that runs on operations
Most companies do not fail at their craft. They lose time, margin and goodwill in the gaps between the tools they use to run the place — a quoting spreadsheet that does not talk to the job sheet, a job sheet that does not reach accounts, and a compliance folder nobody can search when a client asks. Atlantis closes those gaps by putting the whole operation on one platform, so information is entered once and everything downstream stays in step.
What you can run on it
- Sales and CRM — leads, quotes, follow-ups and the pipeline that tells you what next month looks like.
- Projects and job costing — plan the work, track the hours and materials against it, and see the margin while the job is still live rather than at final account.
- Field and service teams — dispatch, schedules, mobile capture that works with no signal, and sign-off from site.
- Inventory and purchasing — stock, suppliers, reorder points and goods receipt, joined to the jobs that consume them.
- People — records, qualifications and licences with renewal reminders, timesheets, leave and payroll.
- Quality and documents — procedures and forms under revision control, with the audit trail an inspection or accreditation body actually asks for.
- Accounts — invoicing, expenses, multi-currency and the reporting your accountant stops chasing you for.
Affordable, accessible, fully customizable — and we mean each word
Affordable because the whole suite is included rather than sold to you a module at a time, and because implementation is done by people who have run operations rather than by a chain of subcontractors. Accessible because it runs in a browser and on a phone, works for a small team on day one, and does not need a specialist on staff to keep it alive. Fully customizable because your process is the thing that makes you competitive — the software should bend to it, not the other way round.
Industries we configure for
Service businesses and contractors, manufacturing and fabrication, trading and distribution, laboratories and testing houses, engineering consultancies, construction and facilities, and asset owners across energy, marine, aerospace and infrastructure. Inspection and testing is where we started, and it remains the sector we go deepest in — but the platform underneath is general-purpose, and most of what it does has nothing to do with inspection at all.
What happens when you get in touch
A short conversation, not a sales sequence. We ask how the business runs today and where it hurts, show you the platform doing that work, and send a written quote shaped to your region, your team size and the scope you actually need. No obligation, nothing to install first, and no pressure to decide on the call. Reach out and tell us what you are trying to fix.
Related: business management platform · inspection management software · choosing the right category of software · modules · by industry · asset integrity platform. Book a free consultation.