Mechanical Integrity and Fixed Equipment Inspection Software: How Do You Trust a Corrosion Rate Built From Two Readings and a Spreadsheet?

Why the corrosion rate you plan turnarounds with is probably fiction

Turnaround scoping meeting, eleven months out. The inspection engineer is defending a proposal to replace a section of piping on circuit C-1204. The corrosion rate on the sheet is 8 mils per year. Where does it come from. Two thickness readings, four years apart, taken by two different contractors, and on inspection of the raw data the second reading was not taken at quite the same location as the first because the original condition monitoring location marker had been painted over during a coating job. The rate is therefore the difference between two measurements of two different points, divided by four.

Everyone in the room knows this. They approve the scope anyway, because the alternative is arguing about a number nobody can improve before the meeting ends. Somewhere else in the plant is a circuit where the same data quality problem is hiding a real corrosion rate, and that one will not be found in a meeting.

The stack is usually a spreadsheet estate: a workbook per unit, or per contractor campaign, with thickness readings keyed to location identifiers that only partly match the isometrics. The equipment register is in SAP PM or Maximo, with its own naming. Inspection reports are PDFs on a shared drive. Some plants have bought Metegrity Visions, Cenosco IMS, Antea or GE Vernova APM, which are serious products with proper data models. What tends to defeat them is not capability but the boundary conditions: your drawing estate, your circuit definitions, your contractor's spreadsheet format, and the specific way your damage mechanisms were assessed a decade ago by a consultant who has moved on.

Problem 1: the location identity problem, which is the whole problem

Everything in mechanical integrity depends on measuring the same point over time. That is deceptively hard. Markers get painted over, insulation gets replaced, scaffolding limits access so a contractor takes a reading 300 millimetres away and records it under the same identifier, a spool gets replaced during a turnaround and the old readings should no longer trend against the new metal but nobody reset them, and circuits get renumbered when a unit is re rated.

Commercial packages assume clean identity. They store readings against locations and trend them, which is correct behaviour with correct data. What they do not do is fight for identity, and identity is where your data goes wrong.

What a custom build does: treat a condition monitoring location as an object with a history including its position on the isometric, photographs, access notes, coating and insulation events, and any replacement of the underlying component. Trending is broken deliberately when metal is replaced, rather than silently producing a negative or absurd corrosion rate. Suspicious readings are flagged at intake, not discovered in a meeting a year later. In our delivery experience roughly the first third of an integrity project is data forensics on existing readings, and the mills and refineries that skip that step get a prettier version of the same fiction.

Problem 2: contractor data arrives in whatever format the contractor uses

Ultrasonic thickness campaigns are typically performed by contract inspectors who return a spreadsheet. Every contractor has their own layout. Some record grid readings, some record minimums only. Units differ. Location naming differs from yours. A campaign might contain several thousand readings and it gets typed or pasted into the master workbook by an inspection technician, which is where transcription errors enter.

What a custom build does: an intake pipeline that accepts the contractor's own format, maps it once per contractor, validates on arrival and quarantines anything suspicious. Validation should include a reading above the previous one by more than measurement uncertainty, a rate that implies impossible corrosion, a location that does not exist, and a missing reading in a grid that was read last time. Nothing enters the trend until it passes or is accepted with a reason. That single control changes the credibility of every rate the system produces, and it is precisely the work that never gets done when data lands in a spreadsheet.

Problem 3: the rate maths is not as simple as the standards make it look

API 510 for pressure vessels, API 570 for piping and API 653 for storage tanks each set out how inspection intervals relate to remaining life and corrosion rate, and they distinguish short term from long term rates for good reasons. Applying that correctly across thousands of locations means handling the awkward cases: a location with only one reading, a location where the last two readings disagree with the ten year trend, a component replaced mid history, a grid where the governing reading moves from one point to another, and the treatment of measurement uncertainty when the wall loss over an interval is close to the accuracy of the instrument.

What a custom build does: compute short term and long term rates, apply your own governing rules, calculate remaining life against the correct minimum thickness for the component, and produce a next inspection date that respects both the calculation and the maximum interval in the applicable standard. Crucially, every number is explainable: click the rate and see the readings, the rule applied and the exclusions. An integrity system that cannot show its working is one an auditor will not accept and an engineer will not trust.

Problem 4: your risk based inspection model is a consultant report in a drawer

Many plants had an API 580 or 581 style risk based inspection study performed. It produced a set of intervals and a report. Five years later the process conditions have changed, a unit runs a different crude slate or feedstock, some equipment has been replaced, and the study is a static document nobody has revised because revising it means paying for the study again.

What a custom build does: hold the risk model as live data rather than as a report. Damage mechanisms per circuit, consequence category, confidence in inspection effectiveness and the resulting interval all live in the system, so when a process change happens the affected circuits are identifiable immediately. It does not replace the engineering judgement in a study, it stops that judgement decaying into a PDF. Be honest about scope here: encoding a full quantitative risk model is a large project and most plants get the majority of the benefit from a well maintained qualitative model tied to real inspection history.

Problem 5: turnaround scope and temporary repairs fall between systems

Scope for the next turnaround is built from inspection findings, but the findings live in inspection reports and the scope lives in a planning spreadsheet, so the traceability from a specific thickness trend to a specific job is manual. Temporary repairs are worse. A clamp installed under an approved temporary repair procedure has a defined life and a plan to replace it, and in too many plants that plan is a note in a report that surfaces when someone remembers.

What a custom build does: findings become tracked items with an owner and a required action date, temporary repairs are first class objects with expiry and mandatory review, and turnaround scope is generated from open items with each line traceable to the data that justified it. That last capability changes scoping meetings entirely, because the discussion moves from opinion to evidence, and scope that cannot be justified from data becomes visible for what it is.

What this costs and how long it takes

Across the 2,000 plus projects Digital Heroes has delivered, an integrity first release runs $80,000 to $170,000 in 14 to 20 weeks. That covers the equipment, circuit and monitoring location register, contractor data intake with validation, corrosion rate and remaining life computation with explainable working, and interval scheduling with due date reporting. The full platform, adding isometric and drawing linkage, risk based inspection support, damage mechanism modelling, repair and temporary repair tracking, turnaround scope generation and mobile field capture, runs $220,000 to $500,000 phased over 9 to 18 months.

Cost drivers specific to mechanical integrity:

• The number of monitoring locations and the state of the existing data, since migration is genuinely forensic work and not a load script.
• Drawing linkage, particularly if your isometrics are scanned paper rather than intelligent drawings, because placing locations on drawings by hand is slow.
• The number of contractors whose formats need mapping, though each additional one is cheap once the pipeline exists.
• Risk based inspection depth, since a qualitative model tied to inspection history costs a fraction of a full quantitative implementation.
• SAP PM or Maximo integration, so notifications and work orders flow from findings without double entry.

What keeps cost down: start with one unit and piping circuits only. Vessels and tanks have their own rules and can follow once the intake and calculation engine is proven.

Build versus buy, and where the packages are the right answer

Buy Metegrity Visions, Cenosco IMS or Antea if you want a mature data model and are prepared to adapt your practice to theirs. These are credible products used at serious plants and there is no shame in choosing one, particularly if your corporate group has already standardised. Buy GE Vernova APM if you are already inside that ecosystem for reliability and want integrity in the same place.

Build when two or more of these are true. Your inspection data is spread across spreadsheets with location identifiers that do not reliably match your drawings. Your contractors return data in formats that a package cannot ingest without manual rework each campaign. You have implemented a package and are running a parallel spreadsheet for the calculations your engineers actually trust. Your risk based inspection study is a static report and process conditions have moved. Your turnaround scope cannot be traced line by line back to the data that justified it.

The threshold is scale times data quality. A small terminal with a few hundred locations and one contractor does not need this. A refinery or chemical plant with thousands of circuits, several contractors and a drawing estate accumulated over decades has a coordination problem that has become a safety problem, and that belongs in a system you own and can correct the week you find a fault in it.

How to choose a developer for mechanical integrity software

Ask them what happens when a spool is replaced. If readings simply continue to trend against the new metal, the system will produce corrosion rates that are nonsense in the safest looking direction, and that is the failure mode that matters. The correct answer involves breaking the trend deliberately and recording the component change.

Ask how a corrosion rate will be explained. Every number must open into the readings behind it, the rule applied, and anything excluded. An engineer will not stake a remaining life assessment on a figure they cannot audit, nor should they.

Ask how contractor data is validated on arrival. If the answer is import and review, the same transcription and identity errors you have today will simply arrive faster. Quarantine rules and acceptance with a documented reason are the minimum.

Ask what they have integrated by name. SAP PM notifications, Maximo work orders, an intelligent isometric system and a document management estate are four separate problems. Ask which plant and which version.

Ask who owns the code and settle it in writing before kickoff. You should own the repository, the infrastructure accounts and the right to hire another firm. At Digital Heroes the code is yours from the first commit. Integrity data is the evidence that your pressure envelope is fit for service, and it should never live somewhere you cannot retrieve it in full.