What an auditor asks about a next-inspection date, and what a workbook cannot answer

An audit does not test the programme. It tests the record.

The distinction matters because most mining integrity programmes are considerably better than the paperwork describing them. The vessels get inspected. The autoclave gets relined on a campaign that engineering can defend with real data. What fails under sampling is the ability to reconstruct, for one specific asset on one specific date, why the next inspection was set where it was and who stood behind that decision. Auditors do not audit intent. They pull twenty assets and follow each one down to its evidence.

A typical chain runs: the manufacturer's data report and code of construction; the current MAWP and any re-rate calculation; the derivation of the required minimum thickness; the last inspection with its type and extent; the inspector's name, certification number and the expiry that applied on the date of the work; the instrument serial number and a calibration certificate valid on that date; the readings themselves; the corrosion rate calculation with both long-term and short-term terms; the resulting due date and its code basis; and, if that date has passed, the written deferral with its technical justification and its approver.

A workbook can usually produce three or four of those ten. The rest live in a technician's PDF, a certification folder on a shared drive, a calibration binder in the instrument crib, and somebody's email. The resulting finding is never your equipment is unsafe. It is that the owner cannot demonstrate that inspection intervals are established and controlled — which is the finding that costs a permit condition or a corrective action plan with a date attached.

Mining fixed equipment does not look like a refinery's

Every commercial integrity system was designed around a refinery: uniform carbon steel, general thinning, dense CML grids, a turnaround every four to six years. A mine site's pressure envelope is stranger than that. A gold pressure oxidation circuit has brick-lined or titanium-clad autoclaves at 200 to 230 degrees Celsius and three to four megapascals in sulfuric acid with chloride, flash vessels, an oxygen plant with cryogenic equipment, quench and neutralisation tanks, and slurry piping in rubber-lined steel or HDPE. A nickel high-pressure acid leach train is harsher again. A smelter adds an acid plant, sulfur dioxide handling, waste heat boilers and offgas ducting where the governing damage is acid dewpoint corrosion. An alumina refinery adds Bayer digestion, where caustic cracking and scaling both matter.

Materials follow the chemistry, not the code book. Autoclave internals run in titanium grade 7 or 16 rather than grade 2, because the palladium addition survives the reducing acid that would otherwise drive hydrogen into the metal; agitator shafts, valves and spargers are each a different alloy with a different degradation mode. Chloride stress corrosion cracking waits for any 300-series stainless that strayed into hot chloride service. A remaining-life field that quietly assumes carbon steel and a linear thinning rate will produce a number for every one of these and mean it for almost none.

The audit consequence is that we apply API 510 is only partly true. Much of a mine's fixed equipment is governed by API 510 because the owner-user adopted it as the recognised practice, not because the code was written for the service. The record therefore has to state which practice was adopted for which asset class and on what basis. That written mapping is one of the first things an experienced auditor asks for, and it is exactly the thing a spreadsheet has no place to hold.

Erosion is measured per tonne, not per year

The most mining-specific error in a calendar-based system is treating slurry wear as if it were a corrosion rate. Erosion in a tailings, concentrate or classifier line is driven by mass throughput, solids concentration, particle size and velocity. It is properly expressed as wall loss per million tonnes at a defined wear scar, not as thousandths of an inch per year, and the two only agree while the plant runs at a constant rate — which is the one thing a mine reliably does not do.

The numbers make the point quickly. Take a 24-inch tailings line at a mill running 20,000 dry tonnes per day, losing 0.9 mm per million tonnes at the outside radius of a long-radius elbow. Nominal wall is 12.7 mm, retirement thickness 6.0 mm, and the current survey reads 8.5 mm. The remaining 2.5 mm of margin is 2.78 million tonnes, which at 20,000 tonnes per day is 139 days. Debottleneck the plant to 30,000 tonnes per day and the same margin is 93 days. The calendar cell still says four months. The pipe is now six weeks past due and nothing in the file changed.

There is a second wrinkle that exists almost nowhere else. Crews routinely index a worn slurry spool by 120 degrees rather than replacing it, moving the wear scar onto fresh wall. That is an intelligent maintenance decision and a catastrophic data event, because the CML that was thinning at 0.9 mm per million tonnes now reads full wall and the history becomes nonsense. An engine that can accept a spool-rotated event, close the old series and open a new one carrying the inherited wear model is describing what actually happens on site. One that cannot will show an auditor a step change it has no explanation for.

Brick-lined autoclaves invert the remaining-life question

On a lined autoclave the shell is not the corrosion barrier. The acid brick and the membrane behind it are, and the steel is designed to stay cool and dry. As long as the lining is intact the shell corrodes at effectively nothing, so a thickness-driven remaining life on the shell returns an enormous number that is simultaneously true and useless. The question that actually governs is how long the lining lasts and whether it has breached anywhere.

That reorders the entire data flow. Shell thickness surveys are only practical during a reline, every four to six years, when the vessel is stripped and scaffolded. Between relines the condition indicator is thermal: fixed shell thermocouples and periodic thermographic survey looking for the hot spot that says acid has found steel. A hot spot is not a slow trend that shifts a date. It is an event, and the correct response is an inspection now, with a defined response time and a named responder.

So the engine has to hold two things against one asset: a long-cycle, thickness-derived interval anchored to the reline campaign, and a condition-triggered inspection driven by monitoring exceedance. An auditor will ask what happens when the trigger fires — who is notified, within what period, what was actually done, and where that is recorded. Those are workflow questions rather than calculation questions, and they are where a spreadsheet-plus-email arrangement stops resembling a programme at all.

Tanks that were never built to API 650

API 653 gives you a defensible interval basis for a welded storage tank, but its arithmetic assumes a tank built to API 650 or a comparable standard, with a known joint efficiency, a defined bottom plate minimum and a shell course calculation you can actually run. A large share of a mine site's tankage — process water, thickener overflow, reagent, barren and pregnant solution — was built to a drawing, or to AWWA D100, or to something nobody can locate twenty years later.

API 653 does contemplate this. It permits an engineering evaluation to establish the required minimum thickness where original design data is missing, and it places that judgement squarely on the engineer performing it. The practical requirement on the software is therefore that minimum thickness is stored as a value with a stated derivation — from original design, from a re-rate calculation, from a named engineering evaluation with a document reference — rather than as a bare number in a cell. Under audit, 0.100 inch with no derivation behind it is worse than no number at all, because it looks like a decision.

The other tank-specific trap is the release prevention barrier. API 653's internal interval logic leans heavily on whether a tank has an RPB and leak detection, because that is what supports a longer bottom interval. Mine site tanks in cyanide, acid or process water service frequently have partial containment or none, and a system that defaults every tank into the same interval class without recording RPB status is producing dates an auditor can invalidate with a single question.

Deferrals: the question that ends most audits badly

Ask an experienced auditor for their sharpest single question and it is some version of: show me every asset currently past its inspection due date, and the approved deferral for each one. It is sharp because a real system answers it in seconds and a workbook essentially cannot, since next due there is a value somebody retypes forward rather than a computed field that turns red on its own. In a spreadsheet operation, nothing is ever past due, which is a far worse answer than a list.

Mining generates deferrals structurally, and most of them are legitimate. Shutdowns move with ore grade, metal price, a furnace campaign, reline crew availability, weather at a remote site or a labour agreement. A six-month slip in a smelter reline moves dozens of due dates simultaneously. What makes any of that defensible is a written technical justification — usually a fitness-for-service argument under API 579-1/ASME FFS-1, or a demonstration that projected loss over the extension still leaves adequate margin — approved by a named engineer or inspector with the authority to approve it.

The system behaviour that matters is simple and rarely present. The due date must be computed and immutable. The deferral must be a separate record attached to it, with its own justification, approver and expiry. Past-due status must persist visibly until the inspection actually happens, not until somebody edits the date. Any product that lets a planner overwrite a computed due date directly has faithfully recreated the exact behaviour the audit exists to find.

Certification and calibration on the date of the work

Two of the most common findings in a pressure equipment audit are about validity in the past tense. Was the technician's certification current on the day of the examination, not today? Was the thickness gauge inside its calibration on that day, and is there a certificate that proves it? Both are trivially checkable in a system that timestamps everything and binds each reading to a person and an instrument. Both are effectively unauditable in a workbook, where the readings are numbers and the credentials are folders on a different drive.

Mining makes this harder because the workforce is mixed by design. Site inspectors, a corporate integrity group and rotating contractor crews all take readings, often under different qualification schemes — written practices under ASNT SNT-TC-1A from three different employers, CGSB or ISO 9712 certificates from Canadian and international crews, and an API-certified or authority-recognised inspector holding the interval decision itself. Each certificate has its own scope and its own expiry, and a reading is only ever as good as the scope of the person who took it.

The engine should refuse quietly and early. A reading submitted against an expired certification, or against an instrument whose calibration lapsed before the reading date, is quarantined at ingestion with a named owner and a stated reason. That produces a queue the integrity group can work through in the weeks before an audit, instead of a finding discovered mid-sampling with an auditor sitting across the table.

Evaluating the engine against your next audit

Run the audit on yourself first. Pick ten assets across the real range — an autoclave, a lined slurry circuit, a tank that was never built to API 650, an air receiver sitting under MSHA's metal and non-metal rules, and something currently past due — and ask the vendor to produce the complete chain for each from your own data. Watch carefully what happens where the data is incomplete, because it will be. A product that cheerfully computes a confident date for a tank with no recorded minimum-thickness derivation is not a capability; it is a liability with a user interface.

Then ask three questions that cut past the demonstration. Can a planner edit a computed due date, and if so does the edit leave a record that survives? Can the system express an interval in tonnes as readily as in months? Can it produce, without anyone assembling it by hand, a pack for a sampled asset containing the readings, the calculation, the certifications and the approvals exactly as they stood on the inspection date?

Atlantis builds this on Odoo, which puts the equipment register, the shutdown plan, contractor purchase orders, certification records and the calibration register in one database — which is why the audit pack assembles itself rather than being compiled by an engineer over a weekend. Affordable, accessible, fully customizable; the interval rules and the deferral workflow are configured against your own written practice and your regulator's expectations. For a working session on your equipment list, contact info@atlantisndt.com.

Request a consultation