When the thickness workbook has two editors and nobody can reproduce the number

The workbook stopped being a record the day it got a second editor

A thickness workbook usually starts as one engineer's private tool and works well for years, because that engineer holds the missing context in their head: which columns are trustworthy, which rows were re-shot, why the elbow on that flowline has a manual override. The system fails not when the data grows but when the context stops being held by one person. A second editor arrives, then a contractor, then a replacement for the original author, and the tacit knowledge that made the file work is gone.

The mechanics of the failure are unglamorous and universal. Someone inserts a row and a SUM range no longer covers the last CML. Someone sorts by circuit and a VLOOKUP against an unsorted reference table starts returning the wrong nominal thickness. Someone types a value over a formula because the formula was giving an odd answer, and the override survives for six years. A date column formatted as text reads 03/12/24 differently on a North Sea asset and at a Houston head office. None of these produce an error message.

What replaces the workbook is not simply a bigger workbook. It is a different data shape. In a record, a thickness reading is an event with an author, a timestamp, an instrument and a method, and it is never modified. Everything else — the current minimum, the short-term rate, the long-term rate, the remaining life, the next inspection date — is computed from those events on demand. When the inputs are immutable and the outputs are derived, two engineers asking the same question get the same answer, and if they do not, the difference is traceable.

Offshore intervals are set by access, not by risk

Onshore, an inspection interval is largely a risk decision. Offshore it is a logistics decision wearing a risk decision's clothes. Persons-on-board limits cap how many technicians can mobilise. Helicopter availability and weather decide whether they arrive. Scaffolding or rope access for a single high-level CML can cost more than the entire ultrasonic campaign around it. The result is that the inspection plan you wrote and the inspection plan you executed are different documents, and the difference lands in the thickness history as gaps.

This makes the record of what was not done as important as the record of what was. A CML deferred because the scaffold was reallocated to a shutdown job is a different integrity position from a CML deferred because RBI said it could wait. Both look identical in a workbook, where the row is simply blank for that campaign. In a proper history, each is a deferral event with a reason, an approver and a new due date, and the outstanding deferrals are a report the integrity engineer can put in front of the offshore installation manager.

The access constraint also shapes the arithmetic. Long, irregular intervals mean the corrosion rate for a given CML is often derived from readings six years apart, then applied forward as if it were a steady process. Where the mechanism is not steady — an intermittent water breakthrough, a period of sand production, a coating failure that began at a known date — the calendar average is misleading in both directions. Storing the operating history alongside the readings is what lets an engineer segment the interval rather than smear it.

Short-term and long-term rate are two different numbers and you need both

API 570 asks for a corrosion rate determined from the most recent readings and one determined over the long term, and expects engineering judgement about which governs. The reason is measurement uncertainty. Manual pulse-echo thickness on a corroded, pitted back wall is not a precision measurement. Surface preparation, couplant, probe wear, back-wall roughness and operator technique all contribute, and repeatability of plus or minus 0.1 to 0.2 mm is a fair working expectation on real offshore pipework, not a laboratory figure.

Now do the arithmetic. Sweet CO2 corrosion on an offshore flowline often runs 0.05 to 0.3 mm per year. Over a two-year interval, real loss is 0.1 to 0.6 mm and measurement noise is up to 0.4 mm on the difference of two readings. On the low end of that range the short-term rate is essentially noise, and on a short interval it can easily come out negative. Over twelve years, real loss is 0.6 to 3.6 mm against the same noise band, and the long-term rate is comparatively stable.

This is why destroying the reading history is not a housekeeping inconvenience but a technical loss. The long-term rate is the noise-suppressed estimate, and it requires the oldest reading and the construction thickness to still exist. A workbook with one live cell per CML can only ever compute a short-term rate between the current campaign and whatever was there before, and on a slow-corroding circuit that number is close to meaningless while looking entirely authoritative.

One instrument, one campaign, one systematic error

The most expensive data problem an offshore integrity team encounters is not a wrong reading; it is a wrong campaign. A technician sets a velocity for carbon steel and gauges a run of duplex. A dual-element probe with a worn delay line drifts on zero. A single-element probe measures interface to first back-wall on a coated topsides line, including three hundred microns of coating in every reading, while the previous campaign used echo-to-echo and excluded it. Every CML that technician touched now carries a consistent offset.

Discovering that two years later is the normal case, usually because one CML gets re-shot for an unrelated reason and the number does not fit. At that moment the only question that matters is scope: which readings share the same instrument, the same technician, the same probe mode and the same date window, so they can be quarantined and re-examined together. In a spreadsheet that question is unanswerable, because none of those attributes were ever recorded against individual values.

In a record they are answered in seconds, and the quarantine is a state rather than a deletion. The affected readings stay in the history, marked suspect with the reason, excluded from rate calculations, and available if a later investigation clears them. The circuits they belong to get flagged for re-measurement. The relevant point is that this is a routine, recoverable event when attribution exists and an unrecoverable one when it does not.

The mechanism decides where the reading has to be

Upstream and offshore damage is directional and local in ways that defeat evenly spaced grids. Sweet CO2 corrosion concentrates where water wets the wall and where flow is disturbed. Top-of-line corrosion in a wet gas line attacks the twelve o'clock position while the bottom of the pipe stays sound, so a CML placed at six o'clock will report a healthy line indefinitely. Sand erosion attacks the outer radius of elbows and the downstream side of tees, and API RP 14E's erosional velocity C-factor is a design rule of thumb, not a wear model that tells you where to gauge.

Water injection and produced water systems add microbiologically influenced corrosion and under-deposit attack, both of which produce discrete, deep pits rather than general wastage. A grid minimum tells you a pit exists somewhere; per-point history tells you whether the pit is growing, whether a new one appeared, or whether the technician simply found a different pit this time. That distinction changes the response, and it only exists if every point in the grid retains its own coordinate and its own series.

Sour service brings a different requirement again. Under NACE MR0175 and ISO 15156, materials selection and hardness control govern susceptibility to sulphide stress cracking, and the relevant damage is cracking rather than wall loss. A thickness history has to be able to hold the fact that a given circuit's dominant threat is not thinning at all, and to link to the crack-detection inspections that actually manage it, rather than letting an untroubled thickness trend imply the circuit is fine.

Reproducing a number you have already published

The moment that usually triggers the move off spreadsheets is not a data loss. It is someone asking why the remaining life on a riser is eleven years in this month's report and seven years in the report issued last quarter, and nobody being able to answer. In a workbook, the past is not stored; only the present is. Reconstructing last quarter's answer means finding last quarter's file, and even then it will not tell you which cell changed or who changed it.

A thickness history that supports this has to distinguish when something was true from when it was recorded. A reading taken in March and entered in June is a March fact recorded in June. If it is later corrected, both the original and the correction exist, with authors and timestamps. That structure lets the system answer a genuinely different question: not what is the remaining life today, but what was the remaining life on 30 June using only what was known then. That is the question a regulator, an insurer or a joint venture partner actually asks.

It also protects the engineer. When a number changes, the record shows whether it changed because new metal loss was found, because an error was corrected, or because a t-min was revised after a re-rate. Without that, every change looks like either incompetence or concealment, and the integrity team spends its time defending arithmetic instead of managing corrosion.

Migrating the workbook without cleaning it first

Teams often delay the move because they believe the workbook has to be cleaned before it can be imported. That sequencing is backwards and it is the main reason these projects stall for years. Cleaning inside the spreadsheet has no audit trail, no way to mark a value as questioned rather than fixed, and no way for a second engineer to review what the first one decided. You end up doing the hardest data work in the least suitable tool.

Import first, in a state that preserves the mess honestly. Every row comes in with a source reference to the workbook, the sheet and the cell it came from. Values that fail validation come in flagged rather than rejected. Cells that held a hard-coded override rather than a formula are marked as overrides. Ambiguous dates are flagged as ambiguous instead of being silently resolved. The result is an ugly but truthful starting record, and from there every correction is an auditable act by a named person.

The cleanup then becomes a normal integrity workload rather than a migration blocker. Prioritise by consequence: circuits with the shortest remaining life, highest-risk service and most imminent inspection dates get their history reconciled first, and low-consequence utility circuits can carry flags for a year without harming anyone. Nothing is deleted at any point, which matters both technically and politically, since the original workbook stays available as the cited source for every migrated value.

What to test in a trial before you commit

Run the trial on one real circuit that you already argue about internally. Load its full history, then ask the system to produce the short-term rate, the long-term rate, the governing rate and the next inspection date, and check that each one shows the specific readings it used. If the system gives you a number without letting you click through to its inputs, it is a prettier spreadsheet.

Then attack it. Enter a reading that is thicker than the last one and confirm it is flagged rather than accepted or discarded. Enter a reading with a probe mode that differs from the circuit's history and confirm the system says so. Have two people edit the same circuit simultaneously and confirm the second write is refused with a visible difference rather than silently winning. Correct a reading from six months ago and confirm the original survives and the change is attributed.

Finally, test the boundary with the field. Most bad data is created at the point of capture, on a deck, in weather, on a device with gloves on. Ask how readings arrive: whether the technician's certification and the instrument's identity are captured automatically from the assignment rather than typed, whether the app works with no connectivity and reconciles later, and whether a reading captured offline that conflicts with one entered onshore is surfaced rather than merged. A record is only as good as the discipline at its edge, and offshore the edge is the hardest part.

Request a consultation