Deriving the next inspection date for pharmaceutical pressure equipment
A remaining life and interval engine recalculates each vessel's next inspection date from measured wall loss against code — API 510 for vessels, API 570 for piping — instead of a planner typing a date. In pharmaceutical plants the calculated life is almost always longer than the code ceiling, so the engine's real job is to prove which assets can safely skip the coming turnaround window.
Pharmaceutical service is chemically mild and mechanically hostile. General corrosion in 316L reactors, WFI loops and clean steam headers runs close to zero, so the API 510 arithmetic — remaining life equals actual thickness minus required thickness, divided by corrosion rate — divides by a number that is mostly ultrasonic repeatability. A five-year interval with a ±0.005 in instrument spread can return a rate of 2 mpy, or of zero, or a negative one, from the same steel. The interval that matters is therefore the ceiling: ten years internal for a vessel, a fixed test frequency for most pressure relief devices, and whatever the site's validated procedure sets. Meanwhile the damage that actually opens a vessel is not general thinning. It is chloride cracking under insulation on jacketed reactors, pitting at CIP dead legs, glass-lining holidays that ultrasonics cannot see, and nozzle fatigue from steam-in-place cycling counted in cycles rather than years.
Source: Sources: API 510 Pressure Vessel Inspection Code (inspection intervals, on-stream inspection in lieu of internal, pressure relief device test frequency); API 570 Piping Inspection Code (piping class and thickness interval); ASME Boiler and Pressure Vessel Code Section VIII Division 1, including the UG-27 internal pressure and UG-28 external pressure thickness rules; ASME Section V for NDE methods; ASNT SNT-TC-1A and ISO 9712 for examiner qualification; 21 CFR Part 211 current good manufacturing practice and 21 CFR Part 11 electronic records and signatures; ISPE GAMP 5 for computerised system validation.
| Asset | Dominant degradation | What the engine must derive the date from | Cost of getting it wrong |
|---|---|---|---|
| Glass-lined jacketed reactor | Lining holidays; chloride cracking on the jacket side | Holiday test results and jacket-side CMLs, not shell ultrasonics | A lining failure found mid-campaign contaminates product and scraps the batch |
| 316L reactor on CIP/SIP duty | Nozzle and jacket-attachment fatigue from thermal cycling | Accumulated SIP cycles against the design cycle basis | A cycle-limited nozzle keeps a ten-year date it never earned |
| WFI and clean steam distribution | Rouging and pitting at dead legs and low points | Fixed-point CMLs at dead legs plus borescope findings | Loop rebuild forced during a validated campaign |
| Insulated jacketed vessel exterior | Chloride stress corrosion cracking under insulation | External inspection interval with an insulation-removal plan | Through-wall crack in a classified area |
| Relief devices on reactors | Fouling, set-point drift, rupture disc ageing | Device test interval for the service, independent of the vessel date | Relief device out of certification during a regulatory inspection |
| Solvent and process gas piping | General thinning; erosion downstream of control valves | API 570 piping class with its own interval ceiling | Piping inherits the vessel's date and is missed for a decade |
Why the pharmaceutical interval arithmetic degenerates
API 510 derives remaining life as actual thickness minus required thickness, divided by the corrosion rate. In hydrocarbon service that division is meaningful, because both the numerator and the denominator are large relative to measurement error. In a 316L reactor holding a buffered aqueous product at 60 °C, the true general corrosion rate may be under 0.1 mpy. Across a five-year interval that is roughly half a thousandth of an inch of metal — an order of magnitude below the repeatability of a hand-held ultrasonic thickness gauge on a machined surface, and further below what a rough or slightly convex surface will return. The engine is not measuring corrosion. It is measuring the gauge, the couplant, the operator and the surface finish.
The consequences are predictable and they cut both ways. Some condition monitoring locations return a small negative rate, because this survey read thicker than the last. Naive engines either discard those points, which biases the surviving population toward loss, or clamp them to zero, which hides the fact that the data set is dominated by scatter. Others return a few mils per year from pure noise, and because the numerator is large the interval that emerges is nonsense in the opposite direction: a vessel with 0.35 in of wall over a 0.09 in requirement and a fictitious 3 mpy rate is told it has eighty years of life. Neither figure should drive a turnaround decision.
A defensible engine refuses to publish a rate it cannot support. It carries a minimum detectable corrosion rate derived from the procedure's stated repeatability and the elapsed interval, reports anything below that threshold as not distinguishable from zero, and falls back to the code ceiling for the date. It should also let you set the threshold per procedure, because a corrosion mapping survey and a spot check with a twin-crystal probe do not deserve the same confidence.
The external pressure case that sets required thickness on CIP and SIP vessels
Most interval engines store one required thickness per component and quietly assume it came from an internal pressure calculation. On a pharmaceutical reactor that assumption is frequently wrong. Vessels subject to clean-in-place and steam-in-place cycles are usually rated for full vacuum, because a sealed vessel cooling after a steam cycle will pull one whether the design allows for it or not. Under ASME Section VIII Division 1 the thickness required to resist external pressure is a stability problem governed by UG-28, and it depends on diameter, unsupported length and stiffener spacing rather than on the hoop stress formula in UG-27.
For a large-diameter thin-wall reactor the external pressure requirement is often several times the internal pressure requirement. If the engine holds the UG-27 number, every remaining life it prints is generous by that difference, and the vessel can be declared fit long after it has lost its vacuum rating. The failure mode is not a rupture; it is a collapse during a cool-down, and it takes the internals and the batch with it. The engine has to record which load case governs each component, and re-evaluate it whenever a stiffener, a jacket or a nozzle reinforcement is modified.
The jacket compounds the problem. A jacketed reactor is two pressure envelopes with two sets of conditions, two required thicknesses and often two owners inside the plant — process engineering for the inner shell, utilities for the jacket. Asset registers routinely carry the inner vessel and omit the jacket entirely, or carry both as a single record with a single date. The jacket sees steam, tower water or glycol brine, and it is the side on which chloride cracking and corrosion under insulation actually occur.
Turnaround readiness: the useful question is what is nearly due
In a refinery, the marginal cost of adding a vessel to an existing turnaround scope is mostly labour and scaffold. In a pharmaceutical plant it is requalification. Opening a vessel in a classified area means breaking a clean or sterile boundary, which drags in cleaning validation, surface sampling, area re-classification, and in aseptic operations potentially a media fill before the line can make saleable product again. The inspection itself may take four hours; returning to a released state can take weeks.
That asymmetry inverts the planning question. The engine should not simply list what falls due inside the window. It should list everything due inside the window plus a look-ahead band that the planner sets — normally the interval to the next credible opening — and show the trade-off between deferral and pull-forward for each item. A vessel due fourteen months after the window, where the following window is eighteen months out, must be pulled forward or it will demand a dedicated opening at full requalification cost. That decision is invisible in a system whose only output is a due date.
The look-ahead has to be code-aware, because pulling work forward resets the clock differently depending on what is done. An internal visual inspection restarts the internal interval. An on-stream examination does not. An engine that advances every date by one rule after any inspection event will silently convert an external check into a ten-year reprieve, and nobody will notice until an auditor reconstructs the history.
On-stream inspection in lieu of internal, and what it is worth here
API 510 permits on-stream inspection to be substituted for internal inspection under defined conditions — broadly, where the corrosion rate is known and low, remaining life is long, the credible damage mechanisms are understood and detectable from the outside, and the owner-user documents the basis. In hydrocarbon service that substitution saves a vessel entry and a confined space permit. In a pharmaceutical plant it can save an entire requalification sequence, which makes it one of the highest-value decisions the interval engine supports.
It is also the decision most often taken informally. The substitution needs a written justification, an approving engineer, the specific external techniques applied, and a record that survives a regulatory inspection three years later. The engine must therefore treat on-stream inspection in lieu of internal as a first-class event type, with its own mandatory fields and its own approval step, rather than as a note typed into a comment box. If the justification cannot be reproduced on demand, the interval it purchased is not defensible.
The technical half matters as much as the paperwork. Substitution assumes the credible damage mechanisms are externally detectable. Chloride cracking initiating on the process side beneath a deposit at a CIP dead leg is not, and neither is a glass-lining defect. The engine should hold a credible mechanism list per vessel and refuse the substitution — or at minimum raise a blocking warning — where a listed mechanism has no external detection method assigned to it.
Assets where a corrosion rate must not produce the date
Glass-lined reactors are the clearest case. Their integrity is the lining, and the lining is assessed by high-voltage holiday testing and visual inspection, not by ultrasonic thickness. A shell thickness result on a glass-lined vessel says almost nothing about whether it is fit to hold product tomorrow. The engine needs a separate interval basis keyed to holiday test results, repair history and the number of patch repairs already accepted, and it needs to prevent the corrosion-rate logic from overwriting that date.
Cycle-limited components are the second case. Nozzles and jacket attachments on vessels that see daily SIP heat-up and cool-down accumulate fatigue damage per cycle, not per year. A vessel that ran two campaigns last year and eleven this year has not aged at the same rate, and a calendar interval cannot express that. The engine should pull cycle counts from the historian or the batch record and raise an inspection when the count, rather than the calendar, crosses a threshold set against the design cycle basis.
Pressure relief devices are the third, and the most commonly mishandled. API 510 sets test frequencies for relief devices by service, and those frequencies are independent of the protected vessel's inspection date. Rupture disc and relief valve combinations, common on reactors handling solvents, add a further trap, because the disc has a replacement life of its own. Registers that hang the relief device off the vessel record inherit the vessel's date and let devices run past certification unnoticed.
An interval engine in a GxP plant is a computerised system
This is the evaluation criterion that separates pharmaceutical buyers from every other industry, and most inspection software vendors have never been asked about it. If the software's output influences a decision about equipment used in the manufacture of drug product, it sits inside the site's quality system. Under 21 CFR Part 11 that implies a secure, computer-generated, time-stamped audit trail of record creation and change, authority checks that limit who may act, and electronic signatures demonstrably linked to their records.
In practice the questions are concrete and easy to test. Can the required thickness on a vessel be changed without an audit trail entry naming who changed it, when, and why? Is a change to a corrosion rate treated as a controlled change? Are examiner qualifications under ASNT SNT-TC-1A or ISO 9712 held as controlled records with expiry? Can the system reproduce, for a named vessel on a named past date, the exact inputs that produced the interval then in force — not the inputs as they stand today? A system that overwrites rather than versions cannot answer the last one.
Vendors should expect to supply a validation package: a functional specification you can trace, installation and operational qualification protocols, and a documented approach to GAMP 5 categorisation for the configured elements. Ask whether the calculation engine is treated as configured software or as custom code, because the qualification burden differs materially, and ask who owns performance qualification. Buying a system that your own quality unit must then validate from scratch is a cost that evaluations routinely fail to price.
How dates turn into a frozen turnaround scope
Turnaround readiness is a sequence of freezes, and the interval engine feeds the first one. Scope freeze needs the due list, the look-ahead band, the deferral decisions and their approvals, all settled before engineering starts drawing. Access planning then needs to know which vessels require entry, which need insulation removed for external examination, and which are being handled on-stream, because scaffold and insulation are usually the long-lead constraint rather than the examination itself.
Crew planning needs method and level, not just a count. A scope of twelve internal visual inspections, four ultrasonic thickness surveys, two positive material identification checks and one phased array weld examination is a very different crew from a scope of the same size weighted toward volumetric work, and the certifications required differ under SNT-TC-1A. An engine that outputs dates but not the method and examiner level behind each due item has handed the planner half the problem and kept the harder half.
Finally, the deferral record has to exist before the window, not after it. Every asset that is due and is not being done needs a documented basis and an approval dated ahead of the window. Assembling those retrospectively is how sites end up with inspections that were technically overdue and no contemporaneous justification, which reads badly to an auditor and worse to an insurer.
Evaluating the module against your own equipment
Ask the vendor to load one of your own vessels — a jacketed, vacuum-rated, glass-lined reactor with ten years of history is the ideal test case — and show the interval it derives with every input visible on one screen. Then ask them to change a single input and show the resulting audit trail. Most demonstrations stop at a coloured Gantt chart of due dates. The value is entirely in what sits behind one date, and a chart proves nothing about that.
Then test the edge cases deliberately. Feed it a survey in which three condition monitoring locations read thicker than last time. Feed it a vessel with no retained design calculation. Feed it an on-stream inspection and check whether the internal interval moved. Ask it to reproduce the interval that was in force eighteen months ago. A system that handles all four is doing real work. A system that handles none is a spreadsheet with a login page.
Atlantis builds this interval engine on Odoo, so the calculation sits beside the work orders, contractor and examiner certifications, and equipment calibration records that a turnaround actually runs on, and it is configured to the site's own conventions rather than to a fixed template. Affordable, accessible and fully customisable. For a walkthrough against your own asset register, contact info@atlantisndt.com.
Why does a pharmaceutical vessel's calculated remaining life come out at hundreds of years?
Because the denominator is noise. General corrosion in 316L on clean aqueous or solvent duty is often below 0.1 mpy, which over five years is less metal than a hand-held ultrasonic gauge can resolve. Divide a large thickness margin by a rate that is mostly measurement scatter and the answer is absurd in either direction. The interval that genuinely governs is the code ceiling, not the arithmetic.
Can on-stream inspection replace an internal inspection on a clean-service reactor?
API 510 permits substitution under defined conditions: a known low corrosion rate, long remaining life, damage mechanisms that are understood and externally detectable, and a documented owner-user basis. In pharmaceutical service the saving is unusually large, because opening a vessel triggers cleaning validation and area requalification. The condition that most often fails is detectability — internal pitting at a CIP dead leg is not visible from outside.
What sets the required thickness on a jacketed reactor rated for full vacuum?
Frequently the external pressure case, not internal pressure. Under ASME Section VIII Division 1, external pressure thickness is a stability calculation involving diameter, unsupported length and stiffener spacing, and on a large thin-wall reactor it can demand several times the internal pressure thickness. Engines that store only the internal pressure requirement overstate remaining life on every vacuum-rated vessel in the register.
How should the engine treat a glass-lined reactor?
As an asset whose integrity is the lining, not the wall. Fitness is established by high-voltage holiday testing, visual examination and repair history, and none of that is expressed by a shell thickness reading. The engine needs a separate interval basis keyed to lining test results, and it must stop corrosion-rate logic from overwriting that date with a comfortable and irrelevant number.
Does an inspection interval engine sit inside the site's validated system boundary?
If its output influences decisions about equipment used to manufacture drug product, treat it as in scope. That brings 21 CFR Part 11 expectations for audit trail, authority checks and electronic signatures, change control over required thickness and corrosion rate values, and a GAMP 5 categorisation for the configured elements. Ask the vendor for a validation package and settle early who owns performance qualification.
What does a turnaround scope freeze actually need from this module?
Four outputs, not one. The list of assets due inside the window; the look-ahead band of assets due before the next credible opening, so they can be pulled forward; the NDT method and examiner level behind each item, because that drives crew and access; and a dated deferral record with a named approver for everything due that is not being done.
Built for any business that runs on operations
Most companies do not fail at their craft. They lose time, margin and goodwill in the gaps between the tools they use to run the place — a quoting spreadsheet that does not talk to the job sheet, a job sheet that does not reach accounts, and a compliance folder nobody can search when a client asks. Atlantis closes those gaps by putting the whole operation on one platform, so information is entered once and everything downstream stays in step.
What you can run on it
- Sales and CRM — leads, quotes, follow-ups and the pipeline that tells you what next month looks like.
- Projects and job costing — plan the work, track the hours and materials against it, and see the margin while the job is still live rather than at final account.
- Field and service teams — dispatch, schedules, mobile capture that works with no signal, and sign-off from site.
- Inventory and purchasing — stock, suppliers, reorder points and goods receipt, joined to the jobs that consume them.
- People — records, qualifications and licences with renewal reminders, timesheets, leave and payroll.
- Quality and documents — procedures and forms under revision control, with the audit trail an inspection or accreditation body actually asks for.
- Accounts — invoicing, expenses, multi-currency and the reporting your accountant stops chasing you for.
Affordable, accessible, fully customizable — and we mean each word
Affordable because the whole suite is included rather than sold to you a module at a time, and because implementation is done by people who have run operations rather than by a chain of subcontractors. Accessible because it runs in a browser and on a phone, works for a small team on day one, and does not need a specialist on staff to keep it alive. Fully customizable because your process is the thing that makes you competitive — the software should bend to it, not the other way round.
Industries we configure for
Service businesses and contractors, manufacturing and fabrication, trading and distribution, laboratories and testing houses, engineering consultancies, construction and facilities, and asset owners across energy, marine, aerospace and infrastructure. Inspection and testing is where we started, and it remains the sector we go deepest in — but the platform underneath is general-purpose, and most of what it does has nothing to do with inspection at all.
What happens when you get in touch
A short conversation, not a sales sequence. We ask how the business runs today and where it hurts, show you the platform doing that work, and send a written quote shaped to your region, your team size and the scope you actually need. No obligation, nothing to install first, and no pressure to decide on the call. Reach out and tell us what you are trying to fix.
Related: business management platform · inspection management software · choosing the right category of software · modules · by industry · asset integrity platform. Book a free consultation.