Trusting third-party UT data on an HRSG and its balance of plant

Combined-cycle thinning does not behave like refinery thinning

A refinery corrosion loop has a chemistry you can name and a rate you can defend across years. A combined-cycle plant has a duty cycle that follows the power market. The same HRSG that ran baseload a decade ago now starts several times a week, and its damage mechanisms track dispatch rather than process. Flow-accelerated corrosion in the LP evaporator, economizer inlet headers, feedwater piping and heater drains is governed by temperature, pH, dissolved oxygen, chromium content and local hydrodynamics, every one of which shifts when the unit cycles. A rate derived from a baseload decade does not predict a cycling one.

That makes each individual reading unusually load-bearing. FAC damage is local. It appears as a scalloped patch a few inches across downstream of an orifice, a control valve or a tee, thinning fast while the CML eighteen inches away loses effectively nothing. There is no general corrosion signal underneath to average against and no comfortable statistical floor. If the grid moved, the probe changed, or the coating was left in place, the artefact is the same order of magnitude as the damage you are trying to detect.

The honest statement about a combined-cycle thickness programme, then, is that its accuracy is bounded by the consistency of the crews taking the readings. In this industry those crews are almost never yours. They are mobilised for an outage, demobilised, and frequently a different company entirely by the next one.

What a contractor deliverable usually loses on the way in

The typical package is a PDF report with a cover sheet and an Excel workbook with three useful columns: point identifier, nominal, and reading. The instrument is named once in an appendix. The probe is named once for the whole job. The technician is named on the cover, even though the readings were taken over six shifts by three people. Whatever provenance existed lives in prose, and the moment the workbook is loaded it collapses into a tuple of point, date and number. Every one of the failure modes in the table above becomes invisible at that instant.

The fix is unglamorous and specific. Provenance has to bind at the level of the individual reading, not the job: technician identity with certification method, level and expiry as of that day; instrument serial with calibration due date; probe type, element configuration and frequency; couplant; measurement mode; surface temperature; surface condition and what preparation was done; the nominal and the governing minimum thickness in force at that time; and the datum used to locate the point. The import batch itself must be an object too, holding the source file, its hash, who loaded it, when, and what the loader rejected.

An import that cannot fail is not an import, it is a paste. The loader needs rules that stop a batch: a reading against a point that does not exist, a reading from an instrument whose calibration lapsed before the date on the row, a technician with no valid certification on that date, a value above nominal plus mill tolerance, a value below the governing minimum with no accompanying flag. Rejected rows go into a quarantine the contractor is asked to resolve, not into the trend.

A negative corrosion rate is the cheapest diagnostic you own

Metal does not grow back. Any point that reads thicker than it did last time is telling you that something in the measurement changed, and it is telling you for free. Yet most spreadsheets and a surprising number of commercial systems clamp negative rates to zero, on the reasoning that a negative rate is physically meaningless. It is. That is precisely why it is worth reading.

There are three common causes and they are distinguishable if the provenance survived. First, coating: a crew working in single-echo mode with a couplant film on painted steel adds the coating to the wall, typically two to twenty thousandths of an inch, whereas echo-to-echo mode ignores it. Second, relocation: the new crew re-established the grid from a different datum and is measuring different steel. Third, doubling, where a dual-element probe on a wall below its usable range locks onto the second backwall echo and reports roughly twice the true thickness.

Work an example. A 0.375 inch nominal feedwater elbow reads 0.311 inch in one outage and 0.331 inch in the next. Taken at face value that is a gain of twenty thousandths and a corrosion rate of zero, which closes the case. Taken as a data-quality event, it is a twenty-thousandths coating on a point that has already lost seventeen percent of wall, and the real rate is still running. The difference between those two readings of the same pair of numbers is whether the record kept the measurement mode.

Temperature, velocity, and the reading that is thick only on paper

Longitudinal sound velocity in carbon steel falls as temperature rises, by roughly one percent for every 55 C above ambient. An instrument calibrated on a step block in the workshop and then used on a hot line computes thickness from a velocity that is too high, and therefore over-reads. On a feedwater line at 200 C, calibrated at 20 C, that is about three percent. On a 9.5 mm wall it is close to 0.3 mm of wall that does not exist.

The correction is arithmetic a technician can do in their head. The problem is not the correction, it is that the temperature was never recorded, so you cannot apply it afterwards and, worse, you cannot tell a corrected value from an uncorrected one. A history module that stores a single number per point has already destroyed the distinction. It has to store the raw reading, the correction factor and its basis, the corrected reading, and an explicit statement of which value the corrosion rate is computed from.

The same discipline applies to the calibration itself. Calibrating on a five-step block of unknown provenance and then measuring a different alloy imports a velocity error into every reading of the outage. Record the block or reference sample used, its identity, and the velocity the instrument was set to. When two outages disagree by a percent and a half, that field is usually the answer.

Exclusions are data, and blanks are a lie

Every outage produces points that could not be read. The scaffold was not built. The insulation was not opened because the removal crew ran out of window. The line was still above the couplant's temperature limit. A valve body, a support shoe or a pipe clamp sat over the CML. The cladding was intact but the jacket screws sheared. These are ordinary, and they are not failures of the inspection crew. What is a failure is recording them as nothing.

When a skipped point comes back as a blank cell, three things happen. Coverage reports show a number close to a hundred percent because the denominator quietly shrank. The corrosion rate at that point stays at whatever it was, which is often zero. And the points that are hardest to reach, which for structural reasons are frequently the points nearest the failures you fear, present as the healthiest assets in the fleet. Back-filling last outage's value is the same error with the evidence removed.

An exclusion record needs a coded reason drawn from a governed list, the person who authorised it, and a link to what would have to change for the point to be read next time. That last field is what turns exclusions into a work list. If the module can produce a report of every CML excluded for two or more consecutive cycles, ordered by remaining life at last successful reading, it has paid for itself before anyone looks at a trend chart.

Score the contractor instead of arguing with the contractor

Data quality disputes after an outage go nowhere because both sides are reasoning from the same impoverished file. The way out is to instrument the deliverable in advance. Seed roughly five percent of the grid as blind repeat points, read by a different technician on a different shift without either being told. The spread on those points is your reproducibility, measured on your steel, in your conditions, with that crew.

From there the metrics are all things the deliverable already contains. Percentage of readings with complete metadata. Standard deviation across seeded repeat pairs. Count of readings that exceed the prior reading beyond combined uncertainty. Exclusion rate against the agreed scope, split by reason. Number of resubmissions before acceptance. Days from last reading to accepted delivery. None of this requires the contractor's cooperation to compute, and all of it is defensible.

Then use it. Publish the scorecard back after every outage, with the specific rows that failed, and carry the running score into the next tender as a weighted evaluation criterion alongside price. Contractors respond to being measured on something they can control. The plants that solve this problem do not solve it with a better clause about accuracy, they solve it by making data quality a line item that affects who wins the next job.

The regulatory boundary that runs through the middle of the plant

A combined-cycle site is not uniformly regulated. Natural gas burned as fuel for the facility's own consumption is outside OSHA process safety management, so the HRSG and its feedwater train are governed by ASME Section I, B31.1, the jurisdictional boiler inspector and the National Board Inspection Code when repairs happen. Meanwhile the SCR system's anhydrous ammonia storage, above the threshold quantity, is a covered process, and its piping and vessels fall under 1910.119(j) mechanical integrity with documented inspection and test results and mandatory correction of deficiencies.

So on any given day one crew, moving across one site, generates readings that belong to two different record regimes with different retention, different deficiency-closure obligations and different audit exposure. Aqueous ammonia at typical dilution changes that picture again. Plants that keep two systems for this end up with two truths, and the ammonia records are usually the ones nobody can find during an audit.

The module answer is a per-asset regulatory classification carried on the equipment record and inherited by every CML beneath it. Readings on covered equipment then enforce the extra fields, block closure of an inspection with an open deficiency, and export in the form the PSM audit expects, while readings on the HRSG follow the boiler regime. One system, one import, two behaviours.

Questions to put to a vendor before you sign

Ask to see an import fail. Hand over a workbook with one row from a lapsed instrument, one from an uncertified technician, one value above nominal and one blank cell where a reading was scoped, and watch what the loader does. A system that swallows all four and produces a clean trend chart is the system that will lose your data quietly for four years. Ask what the quarantine looks like and who is notified.

Ask whether the raw and corrected values are both retained, and whether the corrosion rate can be recomputed on demand under a different convention without editing history. Ask whether an exclusion can exist as a record. Ask to see the audit trail on an edited reading, including the prior value, the reason and the approver. Ask whether the technician certification held on the record is the one valid on the reading date or the one valid today, because those are different questions and only one of them is useful in an audit.

Finally, ask what leaves the system. Thickness histories outlive vendors. The export must be complete, human-readable, and independent of the application that produced it, with every provenance field intact rather than a printed trend chart. If a vendor cannot demonstrate that in a session, the answer to how your data will look in fifteen years is already known.

Request a consultation