Pipelines and terminals: tanks, piping, and integrity

A liquids terminal sits at the seam between three integrity disciplines. The tanks are an API 653 program, usually run by a tank group. The station piping, manifolds, and pump piping are an API 570 program, often run by a facilities group. The line pipe that enters the fence is a 49 CFR 195 integrity management program, run by the pipeline integrity team. A PHMSA inspector or a state agency does not see three programs; they see one facility and one operator, and they will ask questions that cross the boundaries. This paper is about what pipeline terminal integrity software has to do to hold the three records as one.

What does 49 CFR 195 expect the terminal record to show?

Part 195 is the federal safety standard for hazardous liquid pipelines, and several of its provisions land directly on the terminal:

• Breakout tanks must be inspected according to API 653, which the rule incorporates by reference. The tank record is therefore a regulatory record, with the intervals, methods, and documentation API 653 requires.
• Subpart F integrity management (195.452) requires operators to identify segments that could affect high consequence areas, complete baseline assessments, evaluate and remediate anomalies within prescribed time frames, and reassess at defined intervals. Documentation must be kept for the life of the pipeline.
• Corrosion control requirements cover external and internal corrosion, atmospheric corrosion on exposed pipe, and cathodic protection records.
• Operator qualification requires that covered tasks are performed by qualified individuals, and the operator must be able to show who did what and that they were qualified.

The operator's obligation across all of these is to produce the record on request. The software requirement that follows is a single asset record across tanks, piping, and segments, with attribution on every entry and a log that cannot be quietly edited. In intelliSPEC every create, update, delete, login, and export is recorded with actor, tenant, request id, IP, and user agent, and events are chained per tenant with SHA-256 hashes that a verify routine recomputes for an auditor. Audit events are never auto-deleted.

How should the API 653 breakout tank program be recorded?

API 653 asks for routine in-service inspections, external inspections by an authorized inspector at intervals not exceeding five years, ultrasonic thickness of the shell at intervals set by the corrosion rate, and internal inspections at intervals based on the bottom corrosion rate, subject to code maxima. For a breakout tank under Part 195 these intervals are regulatory.

The record content:

• Shell course thickness by course and location, with the required minimum thickness per course and the corrosion rate.
• Bottom plate thickness from floor scanning, with the projected bottom corrosion rate and the internal inspection interval derived from it.
• Settlement surveys and foundation condition.
• Roof, seal, nozzle, and appurtenance condition.
• Repairs and alterations with their NDE, hydrostatic test decisions, and the authorized inspector's involvement.

In intelliSPEC CML points carry 64 fields including nominal thickness, tMin and its method, material, allowable stress, joint efficiency, corrosion allowance, and three corrosion rates, and the tMin engine routes tanks to API 653 and returns the design code and formula with the number. The corrosion summary computes short-term, long-term, and maximum rates with the maximum governing, and remaining life as (t minus tMin) divided by the governing rate. Tank internals are dead zones for connectivity, and the field app captures fully offline with no time limit on the local store.

What does station piping need under API 570?

Terminal piping is API 570 territory: manifolds, pump suction and discharge, meter runs, loading racks, and the interconnecting piping between tanks. It is often the least well-documented part of the facility, because it was built in phases over decades and ownership has shifted.

The program needs:

• Circuits defined by service and material, classified by consequence, with the CMLs attached.
• Thickness monitoring at intervals set by class and remaining life, capped at half the remaining life.
• Injection points, dead legs, and soil-to-air interfaces flagged as specific scope, since corrosion at the soil-to-air interface is one of the most common findings at terminals.
• CUI scope for insulated lines, especially heated product lines.
• Atmospheric corrosion inspection on exposed pipe as Part 195 requires.

The asset hierarchy in intelliSPEC is a graph with roles down to component and weld, so a circuit can be an asset whose components are spools, with CMLs where the readings are taken and welds as nodes. The tMin engine routes piping to ASME B31.3, and the API 570 interval calculation is capped at half the remaining life. Visual inspection of racks and supports runs through intelliINSPECT, and NDE through intelliNDT.

How does ASME B31G fit into the record?

When an in-line inspection tool or a direct examination finds metal loss on line pipe, the engineering question is whether the pipe still has adequate strength at operating pressure. ASME B31G provides the standard method: from the defect length and depth, the pipe diameter, wall thickness, and specified minimum yield strength, it estimates the failure pressure of the corroded pipe, and the operator compares that to the maximum operating pressure with a safety factor.

The details that the record must capture, because they change the answer:

• Which method: the original B31G, or the modified (0.85 dL) method.
• Which edition: the 1991 and 2012 editions differ in their treatment of flow stress and in the options they provide.
• The measured defect dimensions and how they were measured (tool call versus direct measurement).
• The pipe attributes used.
• The result, and who reviewed it.

intelliSPEC implements ASME B31G remaining strength in both the original and modified forms and in the 1991 and 2012 editions. Results are provisional until an engineer verifies them, and the software never auto-derates the asset. That is the correct posture for a calculation whose conservatism depends on choices an engineer has to own. API 579-1 Part 4 Level 1 screening (remaining strength factor as t over tMin) is also available for general metal loss, and API 579 Part 5 Level 1 is deliberately not implemented pending licensed-engineer verification.

How should ILI anomalies, digs, and repairs connect?

The integrity management chain for a segment runs: tool run, anomaly list, prioritization, dig, direct examination, remaining strength assessment, repair or acceptance, and closure within the time frame the rule requires. Every link is a record, and the regulator will ask to see the chain end to end for any anomaly they choose.

The software requirement is that the anomaly is a record on the segment, with odometer and clock position, the tool call, the dig result, the B31G result, the repair, and the closure date, all on one asset. Anomaly lists arrive as spreadsheets from the ILI vendor. intelliSPEC's Excel workbook import with AI-assisted column mapping, along with CSV import, is the way that data enters the record; there is no proprietary connector to any specific ILI vendor, and none is claimed. Once in, the dig findings are captured in the field, the GPS location picker fixes the excavation, photos are bound to the anomaly at capture time, and the repair is recorded against it with its NDE. The intelliINTEGRITY module holds the assessment.

Operator qualification and inspector certification records belong beside this chain. intelliCREW carries inspector qualification, skills, and training records so the "was this person qualified for this covered task" question is answered from the record.

What does the regulator need to trust the record?

A PHMSA or state inspection is a records audit as much as a field visit. What makes a record credible:

• Attribution on every entry, with the signer identified even on a shared device.
• A log that can be verified, not merely displayed.
• Records that render as they were executed, even after forms and reference lists have changed in the years since.
• Exportability, so the operator can produce the record in the form the agency asks for.

intelliSPEC's completed records pin their field configuration, locale, and reference options; the audit chain is verifiable; the signature widget records per-signer identity; and reporting produces PDFs with cover, header, and footer, bulk export, and workbook export from report definitions. Security controls are described at the Trust Center, where the posture is stated as controls mapped to SOC 2 criteria.

How intelliSPEC handles it

For a terminal or pipeline integrity team, the facts that bear on the three-program problem:

• Ten modules write to one asset record, so tank, piping, and segment data share equipment identities and one audit trail.
• The asset hierarchy is a graph with roles down to the weld.
• The tMin engine routes tanks to API 653 and piping to ASME B31.3, returning the design code and formula; API 570 and 510 intervals are capped at half the remaining life.
• ASME B31G remaining strength (original and modified, 1991 and 2012 editions) and API 579 Part 4 Level 1 screening are implemented, with results provisional until an engineer verifies them and never auto-derated.
• Workbook and CSV import, an OpenAPI 3.0 specification with 514 documented endpoints, and tenant self-service API keys are the integration surface for ILI and other external data.
• Full offline capture with no time limit, GPS location, photo binding, and per-signer signatures in the field.
• Hash-chained, verifiable, never-auto-deleted audit trail; completed records render as executed.

The pipelines and terminals solutions page describes the module mix. The evaluation that matters is to pick one anomaly and one breakout tank and see whether the full chain for each can be shown from the record.