When the Thickness Workbook Outgrows the Person Who Built It

What actually breaks when a thickness workbook gets a second editor

The workbook did not degrade gradually. It broke at identifiable moments, each of which left no trace. The first is the sort. Someone groups the sheet by plant area to make a walkdown list, selects the reading columns without the location column, and applies the sort. Every reading is now attached to the wrong location, and because all the values are plausible thicknesses in plausible ranges, nothing looks wrong. This single event can invalidate an entire year of trend data and is essentially undetectable by inspection.

The second is the paste-over. A formula throws a reference error because a row was inserted, so someone pastes the displayed value in its place to clean up the sheet. The cell now looks identical and behaves completely differently. When an input changes later — a nominal thickness corrected, a survey date fixed — the pasted cells do not follow, and the sheet becomes internally inconsistent in a way that only shows up if two people compute the same figure by different routes.

The third is the save-forward. Last year's file is copied to this year's name, the date column is updated in bulk, and the crew measures perhaps sixty percent of the points. The other forty percent silently carry last year's readings under this year's date, which the sheet then interprets as a full year with zero loss. The corrosion rate for those locations converges toward zero and their calculated remaining life climbs. Of the three failures this is the most dangerous, because it does not corrupt the data randomly — it biases it in the reassuring direction.

Hygienic tube is not schedule pipe, and the template does not know

Nearly every thickness workbook in a food plant descends, through some consultant or a former refinery engineer, from an oil and gas template. That template is built around schedule pipe: you look up nominal wall from NPS and schedule, you compute a required thickness from internal pressure, and remaining life follows. Hygienic process lines break the first two steps at once. The tube is sized on outside diameter with wall specified in decimal inches or gauge under ASTM A270 and the ASME BPE dimensional tables, so a schedule lookup returns a number that has nothing to do with the installed tube.

The second break is worse because it produces a comfortable answer rather than an obvious error. Run a pressure-based required-thickness calculation on two-inch 316L hygienic tube at normal process pressure and the answer lands around six thousandths of an inch. The installed nominal is sixty-five thousandths. On paper the tube can lose ninety percent of its wall and still satisfy the calculation. In reality it will fail on support span, on vibration fatigue at a clamp, or by perforating at a pit long before the pressure limit is approached.

So the retirement criterion in a food plant is not derived from a formula; it is set by engineering judgement and written down. Typically it combines a structural floor, a hygiene criterion for surfaces in product contact, and a rule about pitting depth relative to remaining wall. The software's job is to hold that criterion per asset class as an explicit, attributed value with an effective date — not to compute it from a pressure equation that does not govern.

Vacuum, not pressure, sets the floor on CIP-cleaned vessels

Clean-in-place cycles finish with a rinse, and a hot vessel that is rinsed cold with its vents closed or partially blocked will pull vacuum as the vapour inside condenses. This is one of the most common causes of catastrophic tank damage in food and beverage plants, and it has almost nothing to do with the wall thickness calculation people actually maintain. External pressure resistance is governed by ASME Section VIII Division 1 UG-28 rather than UG-27, and it depends strongly on the ratio of thickness to diameter and on the unstiffened length between supports.

The practical implication for the thickness record is that a large-diameter, thin-walled vessel has far less margin against collapse than against burst, and general wall loss erodes that margin quickly. A vessel that has lost fifteen percent of its shell wall is still comfortably inside its internal pressure rating and may have moved from an adequate to a marginal external pressure rating. If the workbook only carries an internal-pressure retirement thickness, it will report the vessel as healthy right up until a cold rinse finds the answer.

This is a case where the record structure has to reflect the physics. A vessel needs both a general wastage figure across the shell and a defined stiffener spacing, because the collapse calculation depends on the unstiffened length. A system that stores only a per-point minimum cannot support the calculation at all. Ask the vendor how the vessel geometry is stored, not just the readings, and whether the retirement thickness for a vessel can differ from that of a pipe run in the same service.

Ammonia refrigeration turns the workbook into a regulated record

Most food and beverage plants of any size operate anhydrous ammonia refrigeration, and once the charge in a covered process crosses the OSHA threshold, the mechanical integrity provisions of the process safety management standard apply. That standard requires inspection and testing procedures that follow recognised and generally accepted good engineering practice, and IIAR 6 is the standard the ammonia refrigeration industry has settled on for inspection, testing and maintenance of closed-circuit systems. The consequence is direct: your thickness record is now something a compliance officer can ask to see.

The damage mechanism that matters here is not what most people expect. Anhydrous ammonia is not aggressive to carbon steel in a clean, dry system; the wall loss that closes plants comes from the outside, as corrosion under insulation on cold suction lines where the vapour barrier has failed. The worst temperature band is around and just above freezing, where condensation cycles keep the steel wet without ever freezing it solid. That means readings are taken through insulation inspection windows at specific, deliberately chosen locations, and the record must state where the insulation was opened and where it was not.

A spreadsheet cannot easily express the thing that matters most in this programme: coverage. The question a PSM audit asks is not what the wall thickness was at the points you measured, but how you selected those points and what your basis is for concluding the unmeasured line is sound. That is a documented sampling rationale, revised over time, linked to the readings that support it. It belongs in a system that can version a rationale, not in a column of numbers.

Temperature correction on a thin wall

Ultrasonic thickness gauges are calibrated at ambient and assume a fixed sound velocity. Velocity in carbon and stainless steel falls with temperature at roughly one percent per hundred degrees Fahrenheit of rise, so a gauge reading a hot surface reports a thickness slightly greater than the truth. On a half-inch refinery pipe this is a rounding error that many programmes reasonably ignore. On a sixty-five thousandth tube or a thin evaporator body it is a different proposition, because the corrosion allowance available before retirement is itself only a few thousandths.

Food plants have more hot surfaces than people expect: evaporator bodies, retort shells and steam headers, pasteuriser and UHT sections, dryer inlet ducting, and CIP supply lines running caustic near boiling. Each is a location where an uncorrected reading contributes an error in the same direction every time, which is the worst kind. Random error averages out over a series; systematic error accumulates into a fictitious trend, and because it makes walls look thicker, it makes corrosion rates look slower.

The record therefore needs four fields where the workbook has one. Raw gauge reading, surface temperature at the time of measurement, correction factor applied, and corrected value. Storing only the corrected number destroys your ability to revisit the correction if the factor is later found to be wrong, and storing only the raw number means every downstream consumer applies their own correction, which is how two reports on the same asset end up disagreeing.

Pitting, gaskets and dead legs: why the average lies

The mental model behind a thickness spreadsheet is uniform wastage — a wall thinning evenly, a line on a chart sloping gently down. Food and beverage stainless does not usually behave that way. 316L in a well-designed hygienic system loses essentially no wall at all across most of its surface, then perforates at a single point, and the point is nearly always one of a small number of predictable geometries.

Gasket faces trap chloride-bearing residue and create crevices where the passive film cannot re-form. Dead legs beyond the length-to-diameter limits set out in ASME BPE hold stagnant fluid through a CIP cycle, so the cleaning chemistry never reaches them and the residue concentrates. Sample valves, instrument tees and abandoned branches are the usual suspects. Chloride stress corrosion cracking is a live risk where hot caustic CIP meets chloride carryover from a water supply, and it is the one mechanism a thickness reading will not see at all, because a crack propagates through full wall thickness with no measurable general loss.

This changes what the record must support. A location's history matters less than the population of locations sharing a geometry: every gasket face on a given skid, every dead leg over a length limit, every sample point on a filler. A system that can only chart one point against time is answering a question the plant does not have. Ask instead whether it can retrieve the minimum reading across all locations of a defined type, plant-wide, and show which of them are trending — and whether it can flag the mechanisms, such as cracking, that thickness measurement is structurally unable to detect.

Evaluating a system on reproducibility rather than features

The requirement you are actually buying for is narrow and testable: given the dataset as it stood on a past date, the system returns the figures that were reported on that date. Everything else follows from it. Ask a vendor to demonstrate it directly. Load a year of data, produce a report, then correct a nominal thickness and a survey date, and ask the system to reproduce the original report unchanged alongside the revised one. A system that cannot do this is a prettier spreadsheet with the same failure mode.

Then test the three spreadsheet failures explicitly. Ask what happens when a survey is closed with only sixty percent of locations measured — the correct answer is that the unmeasured locations show a gap, not an inherited value, and the corrosion rate for those points is not updated. Ask what happens when two technicians submit a reading for the same location on the same day. Ask whether a value can be edited in place at all, and if the answer is yes, ask to see the record of the edit.

Finally, be honest about the transition. The existing workbook is not a liability to be discarded; it is the only history you have, and it must be migrated with its uncertainties intact rather than cleaned into false precision. That means importing every row, marking which values are formulas and which were pasted, and flagging the copy-forward runs where a reading repeats under successive dates. Atlantis scopes this against the actual workbooks during a consultation, so the import rules are written against your data rather than a generic template, and a quote follows from what the files contain.

Request a consultation