Turning third-party offshore UT into an interval you can defend

The problem is not the contractor, it is the absence of a schema

The usual framing is that contractor data quality is a vendor performance issue, to be handled with a stern conversation and a clause in the next contract. That framing is mostly wrong and it never fixes anything. Three vendors working on the same platform under three different scopes will produce three internally consistent, mutually incompatible datasets, and every one of them will believe they delivered what was asked for. What was asked for was a report. What the integrity engine needs is a record.

The difference is specific. A report is a document with a conclusion; a record is a structured set of measurements, each attributable to a location, an instrument, a procedure, a calibration and a qualified person, on a stated date, at a stated surface temperature. A PDF satisfies the first and destroys the second. So does a spreadsheet with a vendor-designed layout, because the meaning of each column exists only in the head of whoever built it.

Which is why the fix belongs at the interface rather than in the relationship. Publish a schema, make it part of the scope of work, validate against it at submission, and return failures to the contractor while the crew is still offshore. Vendors comply with a schema far more reliably than they comply with an instruction, because a schema tells them immediately and unambiguously whether they have complied.

What an unnecessary offshore inspection actually costs

Onshore, a suspect reading is cheap to resolve. Someone walks out with a gauge and settles it in twenty minutes. Offshore, that same resolution consumes a helicopter seat, a bed, and a POB slot on an installation where the total is fixed and already contested by drilling, projects and operations. A rope-access UT scope is planned months ahead, mobilised into a weather window, and demobilised on schedule regardless of what remains unresolved.

This changes the economics of the calculation in a way that most inspection software does not reflect. Onshore, when in doubt you re-measure. Offshore, when in doubt you either accept an unverified number into your integrity basis, or you carry a gap until the next campaign, which may be twelve months out. Both options are bad, and the choice between them is being made implicitly, usually by whoever is reconciling the spreadsheet weeks after the crew has gone home.

The design consequence is that validation has to happen at the moment of capture, not at the moment of analysis. If the ingest layer can tell the technician on the deck that a reading has failed a plausibility check against its own history, the correction costs an hour. If the same failure surfaces in a desktop review in the following month, the correction costs a mobilisation, and in practice it does not happen at all: the number gets accepted with a note, and the note is forgotten.

The specific ways third-party UT goes wrong

Temperature is the most consequential and the least visible. Ultrasonic thickness gauges compute from an assumed sound velocity, and velocity in steel falls as temperature rises. Measure a hot line with an ambient velocity setting and the reading comes back thicker than the metal actually there, by roughly one percent per fifty-five degrees Celsius as a working rule. That error is non-conservative, it looks like healthy pipe, and it is undetectable unless surface temperature was recorded alongside the reading. If your data schema has no temperature field, you cannot audit for it at all.

Location is the second. A CML is a defined area, but corrosion offshore is rarely uniform across it; the loss is at the six o'clock position, in the crevice at a support, or in a band at a splash-zone transition. A technician who lands the probe fifty millimetres from where the last one did is not making a mistake by their own standards, and the resulting scatter reads as corrosion or as recovery depending on which way it falls. Holding grid-point identity below the CML, with photographic or scan evidence, is the only way to distinguish real change from relocation.

Then there is everything that comes from how the data was written down rather than how it was taken. Coating included because the instrument was in the wrong measurement mode. Precision destroyed by rounding to two decimals in millimetres, which cannot resolve a low corrosion rate over any realistic interval. A CML numbering scheme that follows the vendor's job rather than your asset register. And, quietly, work performed by a technician whose qualification had expired before the survey date, which nobody checks because the certificate was valid when the contract was signed.

Offshore damage mechanisms the rate model has to respect

Upstream production fluids are aggressive and variable in ways that make a single general corrosion rate per circuit close to meaningless. Carbon dioxide drives sweet corrosion whose rate depends on partial pressure, temperature and water wetting. Hydrogen sulphide brings sulphide stress cracking and hydrogen-induced cracking, governed by material selection under NACE MR0175 and ISO 15156 rather than by any thinning trend. Water injection and produced water systems support microbiologically influenced corrosion, which pits aggressively and locally and is often first found by a leak.

Sand is the mechanism most badly served by conventional interval logic. Erosion concentrates at bends, tees, chokes and downstream of any restriction, and it scales with production rate and solids loading, neither of which appears anywhere in a thickness history. The routine error is to treat the erosional velocity constant from API RP 14E as though it predicted erosion; it does not, it was never derived for solids-bearing service, and treating a circuit as safe because it sits below that velocity is unjustified. Sand-prone circuits need CMLs placed where the impingement is and a rate that responds to production data.

Topsides adds mechanisms that thickness monitoring will never see. Corrosion under insulation is severe in a salt-laden marine atmosphere, concentrating at supports and penetrations. The splash zone attacks structure and caissons under conditions no gauge reaches on a routine campaign. And small-bore connections on vibrating lines fail by fatigue, where the governing variables are excitation and geometry rather than wall loss. An interval engine has to let a circuit's basis be set by its actual mechanism, because a fatigue-driven small-bore tee and a CO2-driven flowline share nothing but a plant number.

Quarantine, not rejection

The instinct when data fails validation is to reject it. In practice, wholesale rejection is what makes people stop using the system, because a rejected dataset means an asset with no current reading, a plan with a hole in it, and a planner who now maintains a private spreadsheet to work around the gap. Within two campaigns the integrity record has forked, and the shadow spreadsheet is the one people actually use.

Quarantine behaves better. The submission is accepted and stored intact, exactly as the contractor sent it. Readings that fail plausibility or provenance checks are marked and held out of the calculation. The asset continues to run on its previous accepted values and its existing interval, so the plan stays whole. The quarantined readings appear in a data-quality queue with the reason for the hold, and each one is eventually accepted, corrected with a recorded basis, or formally rejected with a reason.

This distinction between the raw submission and the accepted value is the structural feature that makes the record defensible later. When a corrosion rate is disputed two years on, you can show what was submitted, what was accepted, what was changed and by whom, and why. A system that normalises data on import and stores only the cleaned result has destroyed the evidence needed to defend its own numbers, and it will not be able to reconstruct them when the dispute is with the contractor who supplied them.

Attribution is what makes a third-party reading usable

A thickness value on its own is not evidence, it is a number someone typed. What makes it usable in an integrity basis is everything attached to it: the exact location including grid point, the date and surface temperature, the instrument and its serial number, the probe type and frequency, the calibration block and the calibration record covering that date, the procedure and its revision, and the technician with their method, level and qualification status on that date under a named written practice.

Most of those fields already exist somewhere in the contractor's paperwork; they are simply not carried through into anything structured. Requiring them in the schema costs the vendor very little, because they are recording the information already, and it changes what you can do with the result entirely. You can then answer questions no PDF-based record can answer: which readings on this platform were taken with an instrument that was subsequently found out of calibration, or which results were produced under a procedure revision that has since been superseded.

Qualification validity against the inspection date deserves particular attention, because it is checked almost nowhere and found in audits routinely. The relevant test is not whether the technician holds a current certificate today; it is whether they held a valid certificate, in the right method and level, on the day the work was done. Storing qualifications with effective and expiry dates and validating at ingest turns that from a retrospective discovery into a submission-time block.

How data quality feeds back into the interval itself

Once readings carry a quality state, the interval logic can use it. A corrosion rate computed entirely from validated readings is treated as accepted. A rate that depends on a quarantined reading is provisional, and the engine should behave conservatively while it is provisional: keep the shorter of the derived and the previous interval, and mark the asset as awaiting data resolution rather than presenting a confident date it cannot support.

This also gives you a genuine measure of contractor performance that survives contract negotiation, because it is derived from data rather than opinion. First-pass acceptance rate by vendor. Median time to resolve a query. Proportion of readings rejected for temperature, location or provenance defects. Those figures are far more useful in a vendor review than the general impression that a particular crew is careless, and they identify systematic problems, such as a single instrument producing anomalies across every campaign it appeared in.

The last piece is bidirectional traceability. From any due date, you should be able to reach the corrosion rate, the readings behind it, the submission file each arrived in, the technician and the procedure. From any submission, you should be able to reach every interval it currently influences. That second direction is the one systems omit, and it is the one you need on the day a calibration failure or a qualification lapse is discovered, when the only question that matters is which of your inspection dates are now unsupported.

Request a consultation