Deriving refinery inspection due dates instead of typing them in

What the engine computes before it computes a date

The chain runs in one direction: readings give a corrosion rate, the rate and the required thickness give a remaining life, the remaining life and a code ceiling give an interval, and the interval plus the last inspection date gives a due date. A planner typing a due date into a field short-circuits four calculations at once, and the four inputs that mattered stop being visible to anyone. When someone later asks why the hydrocracker reactor feed circuit is due in 2029, the honest answer in most refineries is that it has always been due every four years.

API 570 requires both short-term and long-term corrosion rates to be calculated where the data supports it, and the higher of the two to be used for remaining life unless an engineering evaluation justifies otherwise. A circuit that has lost 40 mils in twenty years and 12 mils in the last two has a long-term rate of 2 mpy and a short-term rate of 6 mpy. Those give remaining lives that differ by a factor of three, and therefore intervals that differ by a factor of three. Software that stores a single rate has already made a decision no integrity engineer ever saw.

Required thickness carries the same trap running the other way. A vessel whose minimum is recorded as nominal minus corrosion allowance shows remaining life collapsing at the corrosion allowance boundary, even though the pressure-design minimum sits well below it, and generates turnaround scope that does not need to exist. A vessel whose minimum was set from a superseded MAWP and never revisited after a re-rate shows remaining life it does not have. The engine has to hold the minimum with its basis - pressure design to ASME Section VIII Division 1 or ASME B31.3, structural minimum, or owner-user policy - and flag every component whose basis has not been reviewed since the last alteration.

The turnaround window is the only door, and it does not move

A code-derived due date is a floating point in time. The opportunity to act on it, for anything requiring entry, blinding, cleaning or internal access, is a discrete window that recurs every four to six years and is set years in advance by catalyst life, market conditions and the availability of a specialty contractor. The engine's real output is not the date. It is the relationship between the date and the window.

Three cases matter and they need three different actions. A due date landing before the window opens needs either an on-stream substitute - external UT on a corrosion monitoring grid, automated ultrasonic corrosion mapping, profile radiography on small-bore - or a documented deferral into the window. A date landing inside the window is straightforward scope. A date landing after the window but before the following one is the interesting case, because the marginal cost of an extra vessel entry while the unit is already open, gas freed and scaffolded is a small fraction of the cost of creating that access again.

Most integrity groups make the pull-in decision informally, in a meeting, from a spreadsheet sorted by date. Done properly it is arithmetic: compare the remaining life consumed by advancing the inspection against the cost and risk of a mid-cycle opportunity, and do it consistently across several hundred components rather than the twenty someone happened to raise. An engine that models the window can rank pull-in candidates by value rather than by whoever spoke loudest at the scope challenge meeting.

Refining damage mechanisms that a straight line describes badly

Sulfidation in hot crude and vacuum service is the mechanism that most exposes a naive interval engine. Rate depends strongly on silicon content in carbon steel, and a line assembled from mixed heats can contain a single low-silicon component corroding several times faster than its neighbours while the circuit average looks stable. This is precisely the pattern behind the 2012 Chevron Richmond crude unit fire, and it is why API RP 578 material verification on susceptible circuits belongs in the same conversation as interval setting. A remaining life computed on the circuit mean is not conservative; it is simply wrong.

Naphthenic acid corrosion behaves differently again. It is velocity and temperature dependent, concentrates at elbows, tees and control valve outlets, and appears or vanishes with the crude slate. A rate measured through eighteen months of a high-TAN opportunity crude campaign is not a property of the metal; it is a property of a purchasing decision. The engine should let a corrosion rate be bounded to an operating period rather than assumed to run forever, and it should force a review when the feed changes.

Then there are the mechanisms that produce no wall loss at all. High temperature hydrogen attack in hydroprocessing, evaluated against the API RP 941 curves, damages the microstructure rather than the wall. Wet H2S service produces blistering, HIC and SOHIC. Amine units crack at welds. Austenitic stainless left in shutdown condition is exposed to polythionic acid stress corrosion cracking unless it is neutralised or purged. None of these are described by a thickness trend, and an interval engine that only knows how to divide by mpy will report those components as healthy right up to the failure.

Worklist freeze, and where turnaround scope growth actually comes from

A large refinery turnaround runs a T-minus schedule with a scope freeze somewhere between twelve and eighteen months out, because material procurement, contractor mobilisation, specialty crews and scaffold estimating all depend on a stable worklist. Every item added after the freeze costs a multiple of what it would have cost inside it, and the accumulation of those additions is the mechanism by which turnarounds overrun both duration and budget.

A meaningful share of that late scope is inspection scope that was always going to be due and simply was not visible at freeze. Its due date sat in a spreadsheet on someone's laptop, or it moved because a reading taken nine months before the window changed a corrosion rate, or the vessel was on a fixed cycle nobody had recomputed since the last re-rate. The fix is not more discipline in meetings. It is a system that recomputes on every reading and reports the delta against the frozen list, so that a change of date arrives as an exception with an owner rather than as a discovery in month eleven.

Freeze discipline also runs the other way. Items sitting on the worklist purely because they have always been on it consume entry permits, confined space attendants and cleaning crews that could go elsewhere. Being able to demonstrate, from measured data, that a vessel has eleven years of remaining life and a code interval that clears the following turnaround is what allows an integrity manager to defend removing it from scope without being accused of cutting corners.

Deferral is an engineering document, not a checkbox

Every refinery defers inspections. The question an auditor, an insurer or a process safety management inspector asks is not whether you deferred but on what basis. Under 29 CFR 1910.119(j)(4) inspection and testing intervals must follow recognised and generally accepted good engineering practice, and where the API codes are your stated RAGAGEP, an interval extension without an engineering evaluation is a mechanical integrity deficiency in its own right.

The evaluation itself is usually a remaining-strength assessment: an API 579-1/ASME FFS-1 Level 1 or Level 2 assessment on a locally thinned area, an MAWP recalculation at the current measured thickness, or an operating envelope restriction that reduces the driving force. What the record needs to contain is the component, the measured data it rests on, the assessment performed, the person accountable, the new date, and an expiry beyond which the deferral is void.

This is where an interval engine earns its place in a PSM audit. A deferral held as an explicit override on the derived date, with its evaluation attached and its expiry enforced, survives questioning. A deferral implemented by typing a new date into the due-date column looks identical to negligence, because from the outside the two are indistinguishable.

A due date list is not a plan - the output is a bill of access

Turnaround readiness is settled in access, not in dates. A vessel due for internal inspection implies isolation and blinding, gas freeing, cleaning and possibly grit blasting, a confined space entry permit, an attendant, lighting, and scaffold inside and often outside. A tank due under API 653 implies emptying, cleaning, sludge disposal, floor scanning crews with MFL, and a vacuum box crew for the critical zone welds. Those are procurement decisions with long lead times, not line items.

The useful transformation is therefore from a list of components to an aggregated requirement: how many entries, in which units, needing what cleaning, on what dates, requiring which qualifications, and how many technician-days of UT, PAUT, MFL and vacuum box testing that adds up to. That number drives crew size, and crew size drives the contract you sign a year out.

The same aggregation catches clashes that a date list never shows. Two vessels due in the same unit on the same day, both needing the single available confined space rescue team. Four circuits requiring scaffold on the same structure, where one erection would serve all four if the dates were nudged. A specialty technique - advanced ultrasonic backscatter for hydrogen attack, or creep assessment on a heater - requiring a contractor booked eighteen months out. None of that is visible from a compliance report and all of it is visible from a bill of access.

Questions that separate a real interval engine from a date field

Give a vendor your data, not theirs. Take one unit, with real thickness histories including the messy parts - readings from three different technicians, a component that was replaced, a circuit with a re-rate in its history - and ask the system to reproduce the due dates your own integrity engineer computed. Every difference is informative. Some will be the software being wrong; some will be your spreadsheet being wrong; and the ones that are neither will turn out to be a rule that was never written down.

Then ask for the audit trail. When a date moves, can the system say which reading moved it, what the rate was before and after, who approved the change and under what version of the rules? When the corporate minimum thickness policy changes, can it recompute every component and show the effect before the change is committed rather than after? An engine that cannot show the delta is one you will never be permitted to change.

Finally, ask what happens to the components a thickness model does not describe: fired heater tubes assessed under API STD 530 and API RP 573, cracking mechanisms driven by technique rather than rate, relief devices on their own cycle, and equipment inspected under jurisdictional rules rather than the API codes. If those fall out of the schedule because the model cannot hold them, the turnaround worklist is incomplete in exactly the places where incompleteness matters most. Atlantis inspection management software is configured around the codes your own written programme cites, and a scoping consultation with an ASNT Level III is available on request through info@atlantisndt.com.

Request a consultation