Migrating decades of in-service inspection history into a Section XI interval engine
Nuclear in-service inspection does not derive a date from a corrosion rate. ASME Section XI sets a 120-month interval with staged completion percentages, and the engine's real work is tracking selection, credit, successive inspections and relief. A migration therefore succeeds or fails on whether the fields that carry that state — Code edition, period credit, successive flags — survive the import.
The records being migrated are usually older than the people migrating them. A unit that entered commercial operation in 1974 and holds a renewed licence has four or five completed 120-month intervals behind it, each governed by a different edition and addenda of Section XI as incorporated by 10 CFR 50.55a at the time. The same weld may have been examined in 1988 under one acceptance standard, in 2001 by a technique qualified under a predecessor regime, and in 2019 by a procedure qualified through Appendix VIII performance demonstration. Those examinations are not interchangeable, and a data model with a single global code field flattens them into something that no longer supports an evaluation. Meanwhile IWA-6000 requires the records to be retained for the life of the plant, so the migration is not a convenience exercise — it is the movement of a quality record whose pedigree an inspector may test decades from now.
Source: Referenced here: ASME Boiler and Pressure Vessel Code Section XI, including Subsections IWA, IWB, IWC, IWD, IWE and IWL, its successive-inspection provisions and the Appendix VIII performance demonstration requirements; 10 CFR 50.55a, which incorporates Section XI by reference and governs alternatives and relief; 10 CFR 50 Appendix B and NQA-1 for quality assurance; 10 CFR 21 for reporting of defects and non-compliance; 10 CFR 73.54 for cyber security of digital assets; 10 CFR 54 and the NRC's GALL reports for licence renewal ageing management programmes; NRC Generic Letter 89-08 for erosion and corrosion induced pipe wall thinning; and ASME Section XI Code Cases N-513 and N-597 for evaluated wall thinning and temporary flaw acceptance.
| Population | Governing programme | How the next examination is determined | What a migration must carry forward |
|---|---|---|---|
| Class 1, 2 and 3 pressure-retaining welds and components | ASME Section XI, Subsections IWB, IWC and IWD | 120-month interval with staged period completion, not a corrosion rate | Interval and period boundaries, the selection population, credited exams and relief requests |
| Components with flaws accepted for continued service | Section XI successive-inspection requirements | Examination in each of the next three inspection periods | The successive flag, the accepting evaluation, and how many periods have been served |
| Metal and concrete containment | Subsections IWE and IWL as required by 10 CFR 50.55a | Fixed programme schedules with augmented areas where conditions warrant | Prior examination areas, augmented designations, coating and repair history |
| Safety-related piping subject to wall thinning | FAC programme established under Generic Letter 89-08 | Predictive model plus measured wear rate, expressed per operating cycle | Component identity, measured wall, model inputs and prior wear rates |
| Buried and underground piping and tanks | Owner programme aligned to licence renewal ageing management commitments | Risk-ranked frequency committed in the ageing management programme | The commitment text itself, plus prior excavations and condition assessments |
| Balance-of-plant and non-safety systems | Owner discretion; API methodology sometimes adopted | Corrosion rate and remaining life where the owner has adopted it | Thickness history, exclusions, and the basis for any adopted interval rule |
The interval is fixed; the arithmetic is completion, not corrosion
Every integrity platform sold into industry is built around the same core loop: measure a wall, compute a rate, divide down to a limit, halve the result, publish a date. That loop is the whole product in refining and it is entirely beside the point for the safety-related population at a nuclear station. Section XI defines a 120-month inspection interval, divides it into inspection periods, requires the licensee to select a population of components for examination during the interval, and requires staged minimum credit against that population as the periods elapse.
So the question the software is asked is structurally different. Not when is this weld due, but: which components are in the interval population, how many of them have been credited, is the plant on track for the period boundary, which examinations were deferred and under what basis, and which components carry obligations that override the base selection. The output is a completion picture with exceptions, not a calendar of per-component dates.
This is why so many nuclear evaluations of general-purpose integrity software end badly and late. The demonstration goes well, because thickness modules demonstrate well. The gap appears during configuration, when it becomes clear the data model has no concept of an interval population, no place to record period credit, and no way to express that a component is on a successive-inspection clock. Establishing that in week two of an evaluation is inexpensive. Establishing it in month nine of an implementation is not.
Where a remaining-life clock genuinely exists in a nuclear plant
It would be wrong to conclude that nothing in a nuclear station has a remaining-life clock. Several populations do, and they are exactly the populations that legacy systems handled worst. Flow-accelerated corrosion programmes established in response to Generic Letter 89-08 run on predicted and measured wear rates, with a wear rate typically expressed per operating cycle and a component either replaced, repaired or accepted for another cycle. That is a genuine remaining-life calculation with a genuine engineering basis behind it.
Wall thinning evaluated under the relevant Section XI code cases behaves similarly but with a hard constraint that refinery-trained users tend to miss: the acceptance is bounded by an explicitly defined evaluation period rather than an open-ended remaining life, and it typically comes with an augmented examination requirement during that period. The software has to hold the expiry as a hard stop that generates work, not as an advisory field. An expired temporary acceptance that nobody actioned is a finding waiting to be written.
Buried and underground piping is the third population, driven by licence renewal ageing management commitments rather than by Section XI selection. Here the clock is a committed frequency the licensee wrote into its ageing management programme, and the record that matters is the commitment text itself. Migrating the excavation results without migrating the commitment they were performed against leaves the plant unable to demonstrate that it did what it said it would do, which is the specific thing licence renewal inspections examine.
The fields a migration silently drops
Every migration loses something, and the losses that hurt are never the obvious ones. Nobody loses the component identifier or the examination date; those map cleanly and get checked. What goes missing is the surrounding context that made the examination meaningful: the Code edition and addenda in force, the revision of the examination procedure used, the qualification basis of the personnel, the calibration block and its certificate, the essential variables of the technique, and the reason the examination was performed at all — base selection, successive requirement, augmented programme, or a commitment.
These fields are dropped for a mundane reason. In the legacy system they often live in a scanned data sheet, a vendor report, or a free-text remarks field, not in a structured column, so an automated mapping has nothing to bind them to. The migration team maps what maps, flags the rest as attachments, and the structured record that emerges is thinner than the one that went in. It looks complete because every row has an entry in every column that exists.
The way to prevent this is to define the target record before touching the source, working backwards from a question rather than forwards from a schema. Take a specific weld and write down everything an inspector might ask about a 1996 examination of it thirty years from now. Every one of those answers is a required field. Then measure the source data against that target and accept, explicitly and in writing, which fields will arrive as structured data, which as attachments, and which are simply not recoverable — because the third category exists and pretending otherwise only defers the discovery.
Successive inspections: the flag that has to survive the import
This is the single highest-consequence field in a nuclear migration and it is routinely lost. When a flaw is detected and the component is accepted for continued service by evaluation rather than repaired, Section XI does not simply return the component to the normal schedule. It requires examination during each of the next three inspection periods, and permits reversion to the base schedule only after the successive examinations are acceptable. The component is on a different clock from its neighbours for years.
In a legacy system that state is often expressed as a note on a page, a coloured cell in a tracking workbook, or knowledge held by the ISI coordinator who set it up. It is rarely a database field with a defined lifecycle. So the migration carries the component, carries the examination history, and drops the obligation. The new system then schedules the component from base selection logic, the successive examinations are not scoped, and the omission is invisible because everything that was scoped was completed.
The discovery usually comes from outside — an NRC inspection, an INPO evaluation, a peer team, or an engineer reconstructing a flaw evaluation for an unrelated reason. By then several periods may have passed. The migration control that prevents it is deliberately unsophisticated: before cutover, produce a list of every flaw evaluation in plant history that resulted in acceptance for continued service, reconcile it by hand against the successive flags in the target system, and have an engineer sign the reconciliation. It is a week of work that removes a category of finding entirely.
Percentage completion across a mid-interval cutover
Migrations rarely land tidily at an interval boundary. They land in year four or year seven, mid-interval, which means the new system inherits a partially completed programme and has to state accurately how partial it is. Getting that arithmetic wrong in either direction is damaging, and both directions are common.
Restart the count at zero and the plant appears to be far behind its period minimum. The response is a scope surge into the next outage, engineering hours spent proving that examinations already performed were in fact performed, and a loss of confidence in the new system during the exact window when it needs to be trusted. Import at assumed full credit and genuine gaps disappear, which is the more dangerous error because nothing in the system will ever surface it again.
The correct approach is to migrate the numerator and the denominator as separate, evidenced quantities. The denominator is the population selected for the current interval, which is a documented engineering product, not a query result over the component table. The numerator is the set of examinations credited toward that population, including those credited under an approved alternative or relief request, each tied to its examination record. Then compute the percentage in the new system and reconcile it against the number the old system reported. Where they differ, and they will, the difference is either a data problem or a real finding, and both are worth knowing before cutover rather than after.
The population moves, so the denominator has to move with it
An inspection interval population is not a fixed list for 120 months. Components are replaced. A steam generator replacement, a recirculation piping replacement, a large valve body change or a modification package removes welds from the population and adds new ones, and the new welds enter with their own preservice examination requirements rather than inheriting the history of what they replaced.
Legacy systems handle this badly and in a characteristic way. The replaced component is often left in the table because deleting it would destroy history, and the replacement is added, so the population count quietly inflates and the completion percentage quietly deflates. Or the record is overwritten in place, and the examination history of the removed component becomes attached to metal that was never examined — the worst possible outcome for a record that has to survive for the life of the plant.
A defensible model separates the physical component from the position it occupies, so that a replacement is an event on the position with an effective date, the removed component retains its own full history as a closed record, and the interval population resolves as of a date rather than as a live list. That structure is more work to configure and it is the difference between a record that answers questions in 2050 and one that merely stores rows. Test it during evaluation: retire a component mid-interval, add a replacement, and ask the system for the interval population as of a date before the swap.
Quality assurance, cyber security and where the software is allowed to sit
Nuclear procurement asks questions that no other industry asks of an integrity system, and they arrive late in an evaluation if the vendor has not met them before. The first is quality classification: whether the software performs a function that falls under the licensee's 10 CFR 50 Appendix B programme and NQA-1 commitments, whether it will be dedicated for a safety-related function, or whether it is handled as augmented quality with the controlled record retained elsewhere. That determination belongs to the licensee, but the vendor has to be able to supply evidence toward it, including development and configuration control records and a position on defect reporting obligations.
The second is cyber security. Digital assets associated with safety, security and emergency preparedness functions fall within the licensee's cyber security programme under 10 CFR 73.54, and the consequence for a software purchase is architectural. A cloud-only product with mandatory outbound connectivity may be unacceptable regardless of its functional fit, and discovering this after a functional selection has been made wastes a procurement cycle. Deployment flexibility — on-premises, isolated, with defined interfaces — is a qualification criterion here rather than a preference.
The third is records. IWA-6000 expects examination records to be retained for the plant's lifetime, and license renewal extends that lifetime past the working career of everyone involved in the migration. That reframes the export question. It is not whether the system can export; it is whether the export, opened by somebody in forty years with no access to the application, is self-describing enough to be read. Ask to see one, in a neutral format, containing a single examination with all of its context attached.
How to run the migration so it can be defended
Treat the migration as an engineering activity with a written basis, not as an IT task with a cutover date. The deliverables that make it defensible are a mapping specification that states field by field where each target field comes from and what happens when the source is empty, a documented reconciliation of counts and completion percentages between old and new, a hand-verified list of successive-inspection obligations, and a signed acceptance of the fields that could not be recovered as structured data.
Run the two systems in parallel for at least one outage cycle, and resist the pressure to shorten this. The parallel period is where you find the interpretation differences that no amount of specification prevents: a component the old system counted in the population and the new one does not, an examination the old system credited to a different period, a relief request whose scope the two systems read differently. Every one of those is a conversation worth having while a fallback still exists.
Finally, plan the migration around the outage calendar rather than the fiscal one. Cutting over between refuelling outages gives the organisation a quiet window to reconcile, retrain and challenge the numbers before the system is load-bearing. Cutting over as an outage scope is being finalised puts the migration's first real test on the critical path of the plant's most expensive activity, which is precisely how a technically sound migration acquires an organisational reputation it never recovers from.
Why can a corrosion-rate interval engine not run a Section XI programme?
Because Section XI does not ask when a component will reach a minimum thickness. It defines a 120-month inspection interval divided into periods, a population of components selected for examination during that interval, and minimum percentages of that population that must be credited by the end of each period. The output is not a date per component; it is a completion state per population, plus a set of components carrying successive-inspection obligations. A corrosion-rate engine has nowhere to store any of that.
What breaks when successive-inspection flags are not migrated?
The component quietly returns to the base selection logic. Where a flaw has been accepted for continued service by evaluation, Section XI requires examination during each of the next three inspection periods, and reversion to the normal schedule only after acceptable successive results. A migration that carries the component and its last examination but drops the successive obligation produces a schedule that looks complete and is not. Nobody notices until an NRC inspection or an internal assessment reconstructs the flaw evaluation history.
How is period completion percentage carried across a cutover?
By migrating both the numerator and the denominator, explicitly. The denominator is the population selected for the current interval, which is not the same as the total component count. The numerator is the examinations already credited, including any credited under an approved alternative or relief. Restarting at zero makes a compliant plant look badly behind and triggers a scope panic. Assuming full credit hides genuine gaps. Both errors are common and both come from importing exam records without importing the selection basis.
Which Code edition should a migrated examination record carry?
The edition and addenda that governed at the time the examination was performed, held on the examination record itself rather than as a plant-level attribute. Each interval is performed to the edition incorporated by 10 CFR 50.55a for that interval, so a plant with five completed intervals holds examinations under five different rule sets, with different acceptance standards and different personnel and procedure qualification regimes. A single global code field destroys that distinction and with it the defensibility of the older records.
Does an inspection data system fall under 10 CFR 50 Appendix B?
That depends on the function it performs and on the licensee's own quality assurance programme, and it is a question the licensee answers, not the vendor. Many utilities treat integrity data systems as augmented quality with the controlled quality record retained elsewhere; others dedicate the software for a safety-related function. The practical procurement questions are which classification applies, what evidence the vendor can supply toward it, and how the system meets the licensee's cyber security controls for digital assets.
Is API 510, 570 or 653 inspector training part of this offer?
No. Atlantis NDT delivers NDT method training to ASNT SNT-TC-1A and ISO 9712, Level I, II and III across UT, RT, MT, PT, ET, VT, PAUT and TOFD, together with ASNT Level III consulting, inspection management software, reporting software, digital twins, 3D laser scanning and report validation. API inspector certification is administered by the American Petroleum Institute through its own individual certification programme, and Appendix VIII performance demonstration is administered separately through the industry's qualification programme.
Built for any business that runs on operations
Most companies do not fail at their craft. They lose time, margin and goodwill in the gaps between the tools they use to run the place — a quoting spreadsheet that does not talk to the job sheet, a job sheet that does not reach accounts, and a compliance folder nobody can search when a client asks. Atlantis closes those gaps by putting the whole operation on one platform, so information is entered once and everything downstream stays in step.
What you can run on it
- Sales and CRM — leads, quotes, follow-ups and the pipeline that tells you what next month looks like.
- Projects and job costing — plan the work, track the hours and materials against it, and see the margin while the job is still live rather than at final account.
- Field and service teams — dispatch, schedules, mobile capture that works with no signal, and sign-off from site.
- Inventory and purchasing — stock, suppliers, reorder points and goods receipt, joined to the jobs that consume them.
- People — records, qualifications and licences with renewal reminders, timesheets, leave and payroll.
- Quality and documents — procedures and forms under revision control, with the audit trail an inspection or accreditation body actually asks for.
- Accounts — invoicing, expenses, multi-currency and the reporting your accountant stops chasing you for.
Affordable, accessible, fully customizable — and we mean each word
Affordable because the whole suite is included rather than sold to you a module at a time, and because implementation is done by people who have run operations rather than by a chain of subcontractors. Accessible because it runs in a browser and on a phone, works for a small team on day one, and does not need a specialist on staff to keep it alive. Fully customizable because your process is the thing that makes you competitive — the software should bend to it, not the other way round.
Industries we configure for
Service businesses and contractors, manufacturing and fabrication, trading and distribution, laboratories and testing houses, engineering consultancies, construction and facilities, and asset owners across energy, marine, aerospace and infrastructure. Inspection and testing is where we started, and it remains the sector we go deepest in — but the platform underneath is general-purpose, and most of what it does has nothing to do with inspection at all.
What happens when you get in touch
A short conversation, not a sales sequence. We ask how the business runs today and where it hurts, show you the platform doing that work, and send a written quote shaped to your region, your team size and the scope you actually need. No obligation, nothing to install first, and no pressure to decide on the call. Reach out and tell us what you are trying to fix.
Related: business management platform · inspection management software · choosing the right category of software · modules · by industry · asset integrity platform. Book a free consultation.