Mechanical Integrity Software Problems: The 5 That Cost Real Money, and How to Avoid Them

Why does loading every unit and every location at once go wrong?

The proposal covers the whole plant: vessels under API 510, piping under API 570, tanks under API 653, every circuit and every condition monitoring location in one migration. It sounds efficient because the data is all sitting in the same spreadsheet estate. What actually happens is that vessels, piping and tanks have genuinely different rules for minimum thickness, interval limits and inspection scope, so the calculation engine has to be right three times before anything is usable once, and the migration work multiplies across three sets of identity problems at the same time.

This is specific to mechanical integrity because the migration is not a load script, it is forensics. Roughly the first third of the effort on a real project is reconciling location identifiers against drawings, resolving duplicates, identifying trends broken by component replacement, and deciding which historical readings are trustworthy enough to keep. Doing that at plant scale before anyone has proven the intake and calculation path means you discover your rules were wrong on ten thousand locations rather than on eight hundred.

The fix is to start with one unit and piping circuits only. Prove the intake pipeline, the validation rules and the rate calculation there, then bring vessels and tanks in behind it with their own rules. In Digital Heroes delivery experience a first release covering the equipment, circuit and monitoring location register, contractor data intake with validation, corrosion rate and remaining life computation with explainable working, and interval scheduling runs $80,000 to $170,000 in 14 to 20 weeks. The full platform adding drawing linkage, risk based inspection support, damage mechanism modelling, repair and temporary repair tracking, turnaround scope generation and mobile field capture runs $220,000 to $500,000 phased over 9 to 18 months.

What goes wrong when spreadsheet thickness history is migrated?

The workbooks come in one per unit, or one per contractor campaign, with location identifiers that only partly match the isometrics. Someone writes a mapping and imports. Three things then go wrong quietly. Readings that were taken at a location before a spool was replaced continue to trend against new metal, producing a negative wall loss or an implausibly low corrosion rate, which is the safest looking wrong answer and therefore the most dangerous. Duplicate identifiers from two campaigns merge into one series that mixes two physical points. And locations that were renumbered when a unit was re rated appear as new series with a single reading each, so no rate can be computed at all and they drop out of the due date report.

What makes this worse than ordinary data migration is that nothing looks broken afterwards. A corrosion rate is a small number, and a wrong small number is indistinguishable from a right one on a dashboard. The error surfaces in a turnaround scoping meeting a year later, as a rate nobody can defend and everyone approves anyway.

The fix is to treat a monitoring location as an object with a history rather than as a key on a reading. It carries its position on the isometric, photographs, access notes, coating and insulation events, and any replacement of the underlying component, and the trend is broken deliberately when metal changes rather than continuing silently. Migrate with a confidence flag on every imported series, review the low confidence ones with an inspector rather than an analyst, and accept that some history is not worth keeping. Budget the forensics explicitly rather than treating it as a load step at the end.

Why do maintenance system and drawing integrations break after launch?

The finding to work order path is demonstrated against SAP Plant Maintenance in a test client and works. In production it starts failing on the cases nobody modelled: a notification type the plant uses for one unit only, functional location codes that were restructured in 2019 with the old codes still present in inspection history, and a work order that gets rejected because a required field is populated differently by the reliability group than by inspection. Drawing linkage degrades a different way. It works for the intelligent isometrics and quietly does nothing for the scanned paper drawings, which is most of the older units.

The difficulty is that your equipment register in SAP PM or Maximo was built for maintenance while your circuit and location structure was built for integrity, and the two naming conventions were never reconciled. Every mismatch becomes either a manual step or a wrong link.

The fix is to make the mapping between the maintenance hierarchy and the integrity hierarchy an explicit, maintained object with an owner, not an assumption buried in an interface. Fail loudly: a finding that cannot create a notification should sit in a queue with the reason, not vanish. For drawings, separate the two cases in the plan and price them separately, because placing locations on scanned paper isometrics is slow manual work and pretending otherwise is how the schedule slips. Ask a developer what they have integrated by name, at which plant and which version, because SAP PM notifications, Maximo work orders and an intelligent isometric system are four separate problems.

What happens when API interval rules are not covered properly?

The system computes a corrosion rate, divides remaining wall by it, and produces a next inspection date. That is arithmetic, not compliance. API 510, 570 and 653 each relate inspection intervals to remaining life and corrosion rate in their own way, they distinguish short term from long term rates for good reasons, and they cap intervals regardless of what the calculation returns. A build that implements the division and not the caps will hand an inspector a date that is longer than the standard allows, and the inspector will not notice on every circuit.

Then there are the awkward cases, which are most of them at scale. A location with only one reading. A location where the last two readings disagree with the ten year trend. A component replaced mid history. A grid where the governing reading moves from one point to another between campaigns. Wall loss over an interval that sits close to the accuracy of the instrument, so the computed rate is mostly measurement uncertainty.

The fix is to compute both short term and long term rates, apply your own documented governing rules, calculate remaining life against the correct minimum thickness for that component, and cap the resulting date at the maximum interval in the applicable standard. Then make every number explainable: click the rate and see the readings behind it, the rule applied and anything excluded. An integrity system that cannot show its working is one an auditor will not accept and an engineer should not sign, and no amount of interface design compensates for that.

Should you build custom or configure what you already own?

Buy Metegrity Visions, Cenosco IMS or Antea if you are prepared to adapt your practice to theirs. These are mature products with sound data models, used at serious plants, and there is no shame in choosing one, particularly where a corporate group has already standardised. Buy GE Vernova APM if you are already inside that ecosystem for reliability and want integrity in the same place. If you run a small terminal with a few hundred monitoring locations and one contractor, a disciplined spreadsheet with a competent inspector is proportionate and much cheaper than either.

Build when two or more of these are true. Your inspection data is spread across spreadsheets with location identifiers that do not reliably match your drawings. Your contractors return data in formats a package cannot ingest without manual rework each campaign. You have implemented a package and are running a parallel spreadsheet for the calculations your engineers actually trust. Your risk based inspection study is a static report while process conditions have moved. Your turnaround scope cannot be traced line by line back to the data that justified it.

The threshold is scale multiplied by data quality. Above roughly a few thousand locations with several contractors and a drawing estate accumulated over decades, the coordination problem has become a safety problem, and that belongs in a system you own and can correct the week you find a fault in it. If you are already paying for a package and still keeping the spreadsheet, that is the signal.

How do hidden costs get into the quote?

Five places, and four of them are data rather than code.

• Existing data condition. The dominant driver. A quote that treats migration as an import task has not looked at your workbooks. Ask for it to be priced as a reviewed forensic exercise with a stated sample already inspected.
• Drawing linkage. Intelligent isometrics and scanned paper are different jobs. Price them separately with a count of each, or the paper ones will consume the contingency.
• Contractor formats. Each additional contractor is a mapping, cheap once the intake pipeline exists and not free before it. List them by name in the scope.
• Risk based inspection depth. A qualitative model tied to inspection history costs a fraction of a full quantitative implementation. A quote that says risk based inspection without saying which one is hiding a large number.
• Maintenance system integration. Notifications and work orders flowing without double entry is real work, and it depends on a hierarchy mapping somebody has to own after go live.

What separates an integrity build that works from one that fails?

Four things, all testable in a first conversation.

Ask what happens when a spool is replaced. If readings simply continue to trend against the new metal, the system will generate corrosion rates that are nonsense in the safest looking direction, and that is the failure mode that matters most. The correct answer involves breaking the trend deliberately and recording the component change as an event on the location.

Ask how a corrosion rate will be explained. Every number must open into the readings behind it, the rule applied and anything excluded. Engineers will not stake a remaining life assessment on a figure they cannot audit, and if they cannot audit it they will keep the parallel spreadsheet, which means you have bought a second system rather than replaced the first.

Ask how contractor data is validated on arrival. If the answer is import and review, the same transcription and identity errors you have today will simply arrive faster. Quarantine rules are the minimum: a reading above the previous one beyond measurement uncertainty, a physically implausible implied rate, an unknown location, a gap where a grid point was read last time, each held until accepted with a recorded reason.

Settle ownership in writing before kickoff: the repository, the infrastructure accounts and the right to hire another firm. At Digital Heroes the code is yours from the first commit. Integrity data is the evidence that your pressure envelope is fit for service, and it should never live somewhere you cannot retrieve it in full.