Fitness for service after a finding: the decision record

An inspector finds a thinned area on a drum shell below the minimum required thickness. The unit is running. Three answers are possible: run as is, run at a reduced rating, or take the equipment out for repair. Which answer is right is an engineering question with a well defined method, API 579-1/ASME FFS-1. Whether the answer can be defended in five years, to an auditor, an insurer, or an investigator, is a records question. The two are usually treated as separate. They are not. API 579 makes documentation a step of the procedure. This paper covers what the fitness-for-service decision record must carry, level by level, so the decision made under time pressure remains a decision and not a memory.

What does API 579-1/ASME FFS-1 require the assessment to document?

Part 2 of the standard lays out the fitness-for-service procedure as a sequence of steps: identify the flaw and the damage mechanism, confirm the applicability and limitations of the assessment procedure, gather the data, apply the assessment technique and acceptance criteria, evaluate remaining life, decide on remediation, set in-service monitoring, and document. Documentation is the last step and it has its own content requirements: the assessment procedure and level, the data used, the calculations, the results, and the basis for the remaining life and any remediation or monitoring.

Two features of the standard shape the record.

First, applicability is a decision. Each Part opens with the conditions under which its procedures may be used: the design code the component was built to, the loading conditions, the temperature range, the material behaviour, and the absence of other damage mechanisms. Using Part 4 on a component that also has cracking is outside the procedure. The record must show the applicability checks were made, not just that the calculation was run.

Second, the level is a decision. Level 1 is a conservative screen using minimal data. Level 2 is a more refined calculation. Level 3 permits advanced analysis. A component that fails Level 1 has not failed; it has qualified for the next level. The record must state which level was applied and, if a lower level was failed on the way, that result too.

The decision record is therefore not a calculation sheet. It is the trail from finding to disposition, with the calculation as one exhibit.

How does the damage mechanism decide the Part?

API 579 is organized by damage type, and the mechanism found in the field decides which Part governs. Getting this wrong at the start produces a correct answer to the wrong question.

• Part 4, general metal loss. Thinning spread over a region, where the average thickness over the region is a fair description of the loss. The assessment compares average measured thickness less future corrosion allowance against the minimum required thickness.
• Part 5, local metal loss. Thinning confined to a defined area: a pit, a groove, a locally thinned patch. The extent and shape of the area matter. The result is a remaining strength factor from the flaw dimensions and the required thickness.
• Part 6, pitting. Widespread pitting, assessed by pit couples and pit density.
• Part 7, hydrogen blisters and HIC. Part 8, weld misalignment and distortion. Part 9, crack-like flaws, using a failure assessment diagram. Part 10, high temperature creep. Part 11, fire damage. Part 12, dents and gouges. Part 13, laminations. Part 14, fatigue.

The mechanism is fixed by the inspection data, not by convenience. A thickness grid that shows a uniform loss across the region justifies Part 4. The same grid showing a localized trough justifies Part 5. If the inspector took spot readings rather than a grid, the record may not support either, and the first item in the decision record becomes a request for more data.

For piping under external pressure or in pipeline service, ASME B31G and its modified form offer a related remaining strength method for corroded pipe. Where a program uses B31G, the record must state the edition (the original method and the 1991 and 2012 modified forms give different results) and treat the output as an engineering input, not a disposition.

What data does a Level 1 or Level 2 metal loss assessment need?

The inputs are specific and each must be sourced in the record.

• Component geometry. Inside diameter or radius, nominal thickness, and for heads the type and dimensions.
• Design basis. Design pressure and temperature, the construction code and edition, allowable stress, joint efficiency, and any supplemental loads.
• Minimum required thickness computed to the construction code, with the method shown. Every FFS result is a ratio against this number, so an error here propagates everywhere.
• Thickness data. For Part 4, thickness readings over the region on a grid whose spacing the standard sets from the component dimensions; the average and minimum measured thickness. For Part 5, the flaw's longitudinal and circumferential extent and the thickness profile through it.
• Future corrosion allowance. The loss expected before the next inspection, from the corrosion rate and the planned interval. This is where the FFS record links to the CML history.
• Remaining strength factor allowable, where used, and its source (the standard's default or an owner-user value).
• Proximity to structural discontinuities. Nozzles, heads, supports. Metal loss near a discontinuity may take the assessment out of Level 1.

The Level 1 Part 4 screen is simple: average thickness less future corrosion allowance must exceed the minimum required thickness, and the minimum measured thickness must exceed a fraction of it. Level 2 refines the average with the thickness profile. Both depend on the same inputs and both are only as good as the tMin.

A screening ratio of measured thickness to minimum required thickness is a useful early indicator of where a component stands and how much margin the inspector is looking at. It is an indicator, not a disposition. The disposition comes from the assessment.

What does the run, repair, or replace decision record look like?

The disposition is where engineering judgment enters, and the record has to make the judgment visible.

1. The finding. Location, dimensions, technique, date, inspector. Photos and the thickness grid attached.
2. The mechanism. What is causing the loss and whether it is active. This decides whether the future corrosion allowance is credible.
3. Applicability. The checks in the relevant Part that permit the chosen procedure and level.
4. The assessment. Part, level, inputs with sources, calculation, and result. If a lower level was failed, that result and the decision to proceed to a higher level.
5. Remaining life. Computed from the assessment result and the corrosion rate, with the inspection interval it supports.
6. Disposition. Run as is, run at reduced MAWP (with the new value and its basis), repair (with scope), or replace, and the reasoning that chose it.
7. Monitoring and remediation. Added CMLs, changed interval, process controls, temporary repairs and their expiry.
8. Acceptance. The engineer who accepted the result, their qualification basis, and the date. Separately, if the equipment is rerated, the rerate record under API 510 or API 570.

The assessment answers whether the component can run. The record answers why anyone believed it.

A common failure is that items 1 through 4 exist in a consultant's report and items 5 through 8 exist in an email. Five years later, the report is on a shared drive and the email is gone.

Why must a remaining strength result stay provisional until an engineer accepts it?

Software can compute an RSF. It cannot confirm that the mechanism was correctly identified, that the thickness grid covered the flaw, that the applicability limits were met, or that a nearby nozzle did not disqualify the level. Those are engineering judgments, and API 579 assigns them to qualified people.

A calculated result that automatically changes the equipment's rating, or automatically extends its interval, has removed the engineer from the loop. The record then shows a disposition with no one behind it. The safer design is a result flagged as provisional until a named engineer reviews and accepts it, with the acceptance stored as its own event. The equipment rating changes only when that acceptance occurs, and a rerate remains a separate, formally engineered act.

This is also an honesty control for the software vendor. Some assessment procedures are straightforward to implement and easy to verify. Others, notably the Part 5 local metal loss procedures with their flaw geometry rules, warrant licensed-engineer verification of the implementation before results are trusted. A platform that ships everything and lets the user find the errors has made the engineer's job harder. A platform that states what it has implemented, what it has verified, and what it has deliberately withheld has made the decision record more trustworthy.

Where do FFS records fail in audits?

• No applicability check. The calculation is present; the reason the procedure was allowed is not.
• Level not stated. A number labelled RSF with no indication whether it came from Level 1 or Level 2.
• tMin without method. The minimum required thickness the whole assessment hangs on was typed in from somewhere.
• Future corrosion allowance unexplained. The FCA does not match the corrosion rate on the CMLs or the interval on the schedule.
• Disposition without acceptance. The report recommends run as is; nobody signed.
• Rerate by drift. The MAWP in the system changed after the assessment with no rerate record.
• Monitoring not implemented. The report added CMLs; the CMLs never appeared in the survey plan.
• Report separated from equipment. The assessment is filed by project or by consultant, not against the vessel, so the next inspector never sees it.

Every one of these is fixable with a record structure that binds the assessment to the equipment, stores the inputs with the result, and stores acceptance as its own event.

How intelliSPEC handles it

intelliINTEGRITY keeps the assessment, the inputs, and the acceptance in one record against the equipment.

• Screening with the formula shown. The API 579-1 Part 4 Level 1 screening returns the ratio of measured thickness to minimum required thickness, and the tMin it uses is computed by equipment type to ASME B31.3, ASME VIII Division 1, or API 653, with the design code and formula returned alongside the number.
• B31G with the edition named. Remaining strength for corroded pipe is available in the original method and in the modified method for both the 1991 and 2012 editions. Results are provisional until an engineer verifies them, and the platform never auto-derates equipment on a calculated result.
• Part 5 deliberately withheld. API 579 Part 5 Level 1 is not implemented pending licensed-engineer verification. The platform states this rather than shipping an unverified procedure.
• Inputs on the CML. Each CML point carries 64 fields including nominal thickness, tMin and its method, design pressure, material, allowable stress, joint efficiency, corrosion allowance, grid geometry, and three corrosion rates, so the future corrosion allowance in an assessment traces to the same rate that sets the interval.
• Damage mechanisms as records. Thinning and cracking mechanisms attach to the component as first-class records, so the Part selection has a documented basis.
• Acceptance as a workflow event. Workflow transitions include submit, approve, reject, hold, and owner sign-off, each recorded with the actor. A segregation-of-duties rule prevents a calculator's author from approving their own calculator.
• A record that renders as executed. Completed records pin the configuration they were executed with, and the hash-chained audit trail records every change with actor, tenant, and a SHA-256 chain that a verify routine can recompute. Audit events are never auto-deleted.

Definitions used here are in the glossary. For the context these assessments most often arise in, see oil and gas and chemical.