One rule set, every petrochemical site, numbers that roll up

Same code, different answers: where the divergence lives

A group integrity manager who asks five sites for their overdue inspection count and gets five numbers that cannot be added is not looking at a reporting problem. The numbers disagree because the underlying calculations disagree, and they disagree because API 510 and API 570 deliberately leave a set of decisions to the owner-user. The codes tell you the interval is the lesser of half the remaining life and a ceiling. They do not tell you which corrosion rate to use, where a circuit begins and ends, how many condition monitoring locations a circuit needs, or what to assume before a component has two readings.

Those decisions accumulate historically rather than deliberately. One site was set up by a contractor who used long-term rates. Another inherited a practice from a joint venture partner. A third rebuilt its programme after an incident and became conservative in ways nobody has revisited in twelve years. Each site's written procedure is internally consistent and passes its own audits. The group number is still fiction.

The consequence is not merely cosmetic. Capital allocation, contractor framework agreements, insurance disclosures and the corporate risk register all consume that rolled-up number. If the site with the loosest rate selection reports the fewest overdue items, the group will keep sending money to the site that is being most careful, which is the exact inversion of what the reporting was built to prevent.

Legitimate local variance versus undocumented drift

Standardising is not the same as flattening. A site in a jurisdiction that adopts the National Board Inspection Code with state amendments may face a mandated external inspection interval shorter than the API 510 ceiling. A site operating under a specific permit condition, an insurer requirement or a consent decree may carry commitments that no corporate rule can override. A site with a documented history of a particular damage mechanism may hold a conservative interval on engineering grounds. All three are correct and none of them should be normalised away.

What separates those from drift is the record. A legitimate variance has an authority behind it: a citation, an approver, a scope, and a date at which it is reviewed. Drift has none of that, and looks identical from a distance. The practical design requirement is therefore that the corporate rule is the default and every departure from it exists as an explicit, attributed override rather than as a differently configured site.

This also solves the political problem, which is usually the harder one. Site integrity engineers resist standardisation because they read it as head office overruling local knowledge. An architecture in which the corporate rule is the baseline and the site can hold an override with a reason gives the local engineer somewhere to put their knowledge, while giving the group a report on how many overrides exist, why, and which have gone unreviewed for years.

Petrochemical damage mechanisms that resist a single default

A corporate default corrosion rate library only works if it is keyed on service, not on site. Petrochemical plants make that plain. Chloride stress corrosion cracking of austenitic stainless under insulation is driven by temperature, chloride availability and coastal or cooling tower drift, so an identical line at two sites genuinely has different susceptibility. Caustic service produces both gouging and stress corrosion cracking with a strong temperature and concentration dependence, and the mitigation is post-weld heat treatment rather than a shorter interval.

Shutdown chemistry adds a mechanism that has nothing to do with operating hours. Austenitic stainless exposed to sulphidic scale forms polythionic acid when it meets air and moisture during a shutdown, and cracks. NACE SP0170 sets out the neutralising wash and purge practices that prevent it. That is an inspection and preservation requirement triggered by a shutdown event, not by a due date, and an interval engine that only understands calendar cycles will never raise it.

Then there are the assets whose life is not a thinning problem at all. Ethylene cracking furnace coils degrade by carburisation, creep and coke-driven overheating, assessed through tube metal temperature history, diametral growth and metallurgical replication rather than through a wall loss trend. Refrigerated ammonia storage sits under API 653 for the tank but under a nitrate stress corrosion cracking regime for the shell welds. Cold box and cryogenic equipment barely corrodes and fails by other routes entirely. A group standard that assumes every asset is a corrosion rate divided into a wall will quietly exclude some of the highest-consequence equipment on the site.

Why the numbers do not roll up, in detail

Take the simplest group metric, percentage of inspections completed on time. It requires four agreed definitions: the population being counted, the event that starts the clock, the event that stops it, and the treatment of approved deferrals. In practice each site has answered those four questions differently and none of them wrote the answer down, so the resulting percentages can differ by twenty points on identical physical performance. A site reporting ninety-four percent and a site reporting seventy-six percent may be doing the same work equally well.

Unit handling is the quiet one. A group with sites in North America and Europe will have mils per year and inches sitting alongside millimetres per year and millimetres, and often a legacy system that stored whichever the technician typed. Conversion is arithmetically trivial and operationally treacherous, because a corrosion rate of 5 in the wrong unit is still a number a reviewer will accept without blinking, and it produces a remaining life wrong by a factor of twenty-five. The rule is that units are a property of the stored value, never of the site, and every display converts on the way out.

Equipment scope is the other. Idle, mothballed and spared equipment, equipment leased to a joint venture, equipment inside a battery limit operated by a third party, equipment that has been physically removed but never retired in the register, and equipment acquired with a plant and never fully catalogued all move the denominator in ways the group cannot see. Standardising the calculation without first standardising the asset register produces a metric that is precise, auditable and still wrong.

A corporate rule set with governed site overrides

The working architecture has four layers. A corporate rule set defines rate selection, minimum thickness basis, half-life application, ceilings, default rates and deferral handling. A service-based library assigns expected damage mechanisms and starting rates by process service, so a caustic line inherits caustic behaviour wherever it sits. A site layer holds overrides, each with a citation, an approver and a review date. An asset layer holds the component-specific exceptions an engineer has justified in writing.

Every derived date should then be able to state its provenance: which rule version produced it, which layer supplied each parameter, which reading drove the rate, and who last touched an override. That provenance is what makes the number defensible to an auditor and, just as importantly, what makes a site engineer willing to trust a date they did not compute themselves.

Rule sets must be versioned with effective dates, and changes must be simulated before they are committed. A corporate decision to move from long-term to greater-of rate selection will shorten thousands of intervals simultaneously. Knowing in advance how many of those land inside an already-frozen turnaround scope, and at which sites, is the difference between a controlled policy change and a year of firefighting.

Rolling out across sites without stalling on site one

The failure mode of multi-site standardisation programmes is that the first site becomes the whole project. Reconciliation work at site one uncovers every undocumented rule in the group, and the programme stops while a committee argues about rate selection. The way through is to separate the rule debate from the deployment: agree a provisional corporate default early, deploy against it, and let every site difference land as an override with a reason. The override register then becomes the agenda for the rule debate, backed by counts instead of opinions.

Sequence matters too. Start with the site that has the cleanest data rather than the largest asset base, because the first deployment is where the reconciliation method is built. Then take the site whose practice differs most, because it will surface the override cases the rule set has to support. The remaining sites are then a repeatable exercise.

Throughout, keep the legacy site system authoritative until reconciliation for that site is signed off. Running both and comparing is not duplicated effort; it is the only evidence that the new engine reproduces the dates your inspectors are already working to, and the only way a site integrity engineer will accept the switch.

What the group gets once the numbers are comparable

The first payoff is a corrosion rate library built from the group's own measurements rather than from published tables. Once every site computes rates the same way against the same service taxonomy, a new caustic circuit at one plant can inherit a starting rate from twenty years of measurement on identical service at three others, instead of an assumption or a textbook figure. That is a materially better default, and it only becomes available once the calculation is common. It also works in reverse: a service whose measured rate at one site sits well outside the group distribution is either a process problem or a measurement problem, and both are worth knowing.

The second is workload visibility. Specialty crews - phased array, tank floor magnetic flux leakage, heater tube creep assessment, rope access, advanced ultrasonic backscatter - are scarce and are normally booked site by site, three months out, in competition with each other. A group schedule computed on one rule set shows inspection load by technique and by quarter across every site a year or more in advance, which is what makes a levelled schedule or a shared framework contract possible instead of five separate scrambles for the same contractor in the same month.

The third is credibility. When a corporate risk register, an insurer submission or a regulator conversation cites an overdue count, that number now has a derivation behind it that survives being questioned line by line. That is worth more than the reporting itself, because it is what lets an integrity function argue for capital on evidence rather than on anecdote, and what stops a single site's data quality problem from discrediting the whole programme.

How to evaluate multi-site interval software

Ask to see the override register, not the dashboard. Any product can render a green compliance donut. The question is whether it can list every place where a site departs from the corporate rule, what authority each departure rests on, and how many have not been reviewed since they were created. If overrides are implemented as per-site configuration rather than as attributed exceptions, the group can never report on them.

Ask for the rule change simulation. Give the vendor a policy change you are actually contemplating and ask for the delta across all sites before commit. Ask what happens to a date computed under rule version three when rule version four takes effect, and whether the historical record still explains the older date.

Ask how the system holds assets that fall outside the thinning model - heater tubes under API STD 530, cracking mechanisms driven by technique, relief devices, and equipment on jurisdictional rather than API intervals - because those are the assets that leak out of a group roll-up first. Atlantis inspection management software is built around the codes and the written programme your own group cites, configured per site with the corporate rule set intact. A scoping consultation with an ASNT Level III is available on request through info@atlantisndt.com.

Request a consultation