When the thickness workbook can no longer prove its own numbers

The workbook did not become inaccurate. It stopped being reproducible

Almost every thickness spreadsheet starts correct. One engineer builds it, understands every formula, and knows which columns are typed and which are derived. It stops being correct not through a single error but through ordinary shared use. A second person joins and adds a column. A third pastes values over a broken formula to clear a reference error. Someone hides a row containing readings they judged unreliable, and the hidden row still feeds the minimum function that governs the whole sheet. A formula is dragged one column too far and now takes its nominal from the next asset.

None of these produce a visible failure. The workbook still opens, still charts, still prints a remaining-life column. What has been lost is the ability to answer a question, and the question always arrives at the worst moment: during an outage planning meeting, or when a jurisdictional inspector asks how the next inspection date was justified. The honest answer, that the number came out of a sheet whose formula history nobody can reconstruct, is the point at which the plant decides it has outgrown the tool.

The important consequence is that replacing the spreadsheet is not primarily a user interface problem. Every product will show a nicer trend chart. The requirement is narrower and harder: a system that stores the inputs to every historic calculation so that any number the plant has ever cited can be replayed as it was, using the rules and data in force at the time, not the rules and data of today.

Temperature: the correction a spreadsheet cannot prove it applied

A steel plant measures hot. Hot blast mains, stoves, bustle pipe, offgas ducts, coke oven collecting mains and steam headers are read on line at surface temperatures well above ambient, because taking them cold means waiting for a reline or an outage. Sound velocity in carbon steel decreases as temperature rises, so a gauge calibrated on a block at ambient reads thick on hot steel. The conventional allowance is on the order of one percent per hundred degrees Fahrenheit above calibration temperature, which the technique procedure should state explicitly for the material and instrument in use.

The magnitude is not marginal. On a three eighths inch wall at six hundred degrees Fahrenheit an uncorrected reading is roughly nineteen thousandths of an inch high. That is larger than several years of real metal loss on a slow mechanism. It means an uncorrected hot reading followed by a corrected cold one produces an apparent loss that is entirely instrumental, and the reverse produces an apparent wall gain that most software clamps to zero, hiding the discrepancy rather than surfacing it.

This is the exact point at which a spreadsheet fails irrecoverably, because it almost never stores surface temperature. The value in the cell may or may not already include a correction. There is no way to tell from the sheet, and the technician who knew has moved on. A record that stores the raw reading, the surface temperature, the calibration temperature and the correction applied as separate fields can be validated years later. One that stores a single number cannot, and every historic trend built on it is unverifiable.

Hot on-line and cold outage readings are two populations, not one series

Blast furnace and steelmaking assets have a measurement calendar dictated by campaign life. A furnace reline may be fifteen or twenty years apart; a converter reline is a matter of weeks but rare; the annual outage gives access to some assets and not others. The result is that a single measurement point accumulates a mixed population: a handful of cold, careful, well-prepared readings taken during shutdowns, and a larger number of hot, quick, on-line readings taken through scale during operation.

Plotted together without segregation, the series oscillates on the outage cycle rather than describing metal loss. Worse, whichever population happens to sit at each end of the interval determines the computed rate, so the answer depends on when you happened to look. A plant can move from comfortable to alarming and back again with no change whatsoever in the condition of the steel. Engineers learn to distrust the chart, and distrust of the chart is precisely what pushes work back into private spreadsheets.

The fix is structural. Store measurement condition as a first-class attribute, allow trends to be filtered and computed within a condition, and make cross-condition comparison an explicit, corrected operation rather than the default. It also changes what a good survey plan looks like: if the only defensible rate comes from cold readings, the interval between outages is the real sampling interval, and the plant should know that rather than believing it has an annual data point.

Where the nominal came from, and why it is usually wrong

Rate calculations against original thickness are only as good as the original thickness. In a steel plant the nominal is contested for three separate reasons. First, much of the fixed equipment is plate rather than pipe: furnace and stove shells, ducts, dustcatchers, hoods, tanks. Plate ordered to a specified thickness under ASTM A6 or A20 general requirements may legitimately be supplied slightly under that thickness, and the permitted under-tolerance is a different rule from the percentage under-tolerance that governs seamless pipe. A workbook that applied a pipe rule to a plate shell has booked phantom loss.

Second, steel plants repair by welding. A stove shell with a hot spot gets a build-up or an overlay patch; a duct gets a doubler. The local nominal at that measurement point is now different from the drawing, and different from the point six inches away. If the record holds one nominal per asset rather than per measurement point, every subsequent reading in the repaired area is compared against the wrong baseline, usually in the unconservative direction.

Third, minimum required thickness is frequently a number that was typed once and never sourced. For jurisdictional equipment under the National Board Inspection Code, or piping designed to ASME B31.1 or B31.3, that figure has a calculation behind it. For a refractory-backed shell it may derive from a structural or thermal criterion rather than pressure. The record must store the figure, the basis and the revision date, because the first question anyone asks about an aggressive remaining-life number is where the minimum came from.

Rate method, measurement noise, and the false precision of remaining life

API 510 and API 570 both distinguish a long-term corrosion rate, taken across the full history, from a short-term rate taken across the most recent readings, and expect the more conservative to govern the interval. A spreadsheet almost always implements one of the two, and which one is invisible to anybody reading the output. The two answers can differ by a factor of several when a mechanism accelerates, which is exactly the situation the calculation exists to catch.

Layer measurement noise on top. Take a point that read 0.500 inch and, twelve months later, 0.494 inch. That looks like six thousandths per year. If each reading carries a realistic uncertainty of about four thousandths on a scaled surface, the combined uncertainty on the difference is roughly six thousandths, so the true rate lies somewhere between a fraction of a thousandth and about twelve thousandths per year. Against a minimum of 0.300 inch, that is a remaining life anywhere from about seventeen years to several centuries. The workbook prints one figure to two decimal places and the reader treats it as knowledge.

A record that is honest about this stores instrument resolution, keeps the readings that establish repeatability, and can express a rate with the interval and population it came from. It should also make the short interval problem visible: a rate derived from two readings a few months apart in a slow mechanism is noise, and the system should say so rather than converting it into a maintenance decision. This is the single most valuable behaviour a replacement can offer a plant coming off spreadsheets, and it is worth testing directly during evaluation.

Correcting versus overwriting, and why exclusions must survive

A workbook has one mechanism for fixing a wrong number: type over it. The previous value is gone, along with any indication that it ever existed. That is acceptable for a scratch calculation and unacceptable for an integrity record, because the difference between a transcription error and a genuine measurement is exactly what a later reviewer needs to see. A reading that was corrected from 0.512 to 0.412 because a digit was transposed is a different event from one that was re-shot because the probe was on scale, and both are different from one that was quietly adjusted to make a trend look reasonable.

The correct structure supersedes rather than replaces. The original reading stays, marked superseded, with the replacement, the reason, the person and the timestamp. Exclusions work the same way: a reading judged unreliable is retained with a status and a reason code, removed from the rate calculation by an explicit rule, and visible in the record. This is where hidden spreadsheet rows do their worst damage, because a filtered row is invisible to the reader and still visible to the aggregate function, so the excluded reading silently governs the minimum.

Steel service generates exclusions constantly. Heavy scale on a hot blast main, refractory anchors returning a false back-wall echo, weld caps in the measurement path, external cladding on a steam line, and access restrictions during operation all produce readings a competent technician rejects. Those rejections are data about the measurement programme. Retaining them tells you which locations are chronically unmeasurable and therefore need a different technique, a permanent sensor, or scaffolding in the next outage.

What to test when you evaluate a replacement for the workbook

Do not evaluate on the chart. Evaluate on replay. Take a remaining-life figure your plant actually cited to a jurisdictional inspector or in an outage scope two years ago, load the underlying history, and ask the vendor to reproduce that exact number with its inputs displayed: which readings, which nominal and its source, which minimum and its basis, whether a temperature correction was applied, which rate method governed, and which readings were excluded and why. A system that cannot reconstruct a historic answer will not be able to defend a future one either.

Then test the failure paths. Enter a reading with a null value and an exclusion reason and confirm it is retained and excluded from the rate. Change a nominal and confirm the system records both states and shows what recomputed. Have two users edit the same measurement point in the same session and confirm both actions are attributable and neither is silently lost. Enter a value with more decimal places than the instrument resolution and see whether the system challenges it. Look up every reading taken with one gauge serial number in a date range, which is the query you will need the day a gauge fails its calibration.

Finally, check that the technician, method and technique travel with the reading rather than sitting on the survey header. The person who took a reading and their qualification level, the method and technique used, the reference block, and the procedure revision are all part of the reading's meaning. Atlantis builds inspection management around that reading-level record, and a working session against one of your own historic calculations can be arranged through info@atlantisndt.com.

Request a consultation