Forensic Scheduling

Five P6 Schedule Manipulation Patterns Found in XER Files — and How to Detect Each One

Contractors can manipulate a Primavera P6 schedule in ways that look completely normal in a Gantt chart but are immediately obvious to an experienced P6 reviewer in the XER. Here are the five patterns seen most often — and exactly how to find them.

11 min read Forensic Scheduling

Why the Gantt Hides What the XER Reveals

The Gantt chart is a representation of the schedule. The XER file is the schedule. This distinction matters enormously when you are trying to evaluate whether a contractor's P6 schedule is an honest reflection of the project's status and trajectory — or a managed document designed to minimize the appearance of delay.

All five manipulation patterns described below are invisible in a standard Gantt bar chart export. They only appear when you open the XER natively in Primavera P6 and run specific checks against the underlying data. This is why independent schedule review — and forensic analysis — requires a P6 expert, not just a construction manager who can read a Gantt.

Pattern 1: Constraint Abuse to Suppress Negative Float

What it looks like in the Gantt: The schedule appears on track. Milestone dates are green. No activities show negative float.

What it looks like in the XER: Multiple activities have "Finish No Later Than" or "Start No Earlier Than" constraints that were not present in the baseline or prior update. These constraints are set to the current data date or a date in the near future, preventing the CPM calculation from showing negative float on activities that are actually behind schedule.

How to detect it: Run a filter in P6 for all activities with a primary constraint. Compare the count and type of constrained activities against the prior period's update. Any constraint added after baseline acceptance should have a written justification in the project record. Constraints added without justification, particularly to activities approaching or past their original early dates, are manipulation.

Pattern 2: Logic Deletion to Float Artificial Activities

What it looks like in the Gantt: Activities that were previously connected to the critical path now appear to have substantial total float, suggesting the project has recovered schedule.

What it looks like in the XER: Finish-to-Start relationships between activities have been deleted between update periods. The deletion breaks the logical chain from a critical predecessor to a near-critical successor, releasing float into the successor chain artificially.

How to detect it: Compare total relationship counts between the current and prior update. In P6, you can export the relationship table to Excel and compare period-to-period. A reduction in total relationships without a corresponding scope reduction (activities deleted from the schedule) indicates logic deletion. Pay particular attention to relationships connecting major scope packages — these are the deletions that have the largest impact on apparent float.

Forensic Tip

Logic deletion is one of the most powerful manipulation techniques because its effect is cumulative. A contractor who deletes two or three relationships per month over a 12-month program can accumulate months of artificial float. Forensic schedule analysis traces this accumulation across the entire update history.

Pattern 3: Activity Splitting to Absorb Delay

What it looks like in the Gantt: A large activity that was previously running late appears to have been replaced by two activities — an "in progress" portion that shows completion, and a "remaining" portion that shows a new late start date.

What it looks like in the XER: The original activity has been split into two activities with a new relationship between them. The "completed" portion shows 100% complete and is no longer driving the critical path. The "remaining" portion has a new planned start date that absorbs the slippage without reporting it as a delay.

How to detect it: Look for activities added between update periods with names that closely match existing activities — "Foundation Work (Part 1)" and "Foundation Work (Part 2)" where only "Foundation Work" existed previously. Also compare activity ID sequences for new activities that fall between existing sequential IDs, which often indicates activities inserted post-baseline.

Pattern 4: Data Date Games

What it looks like in the Gantt: The schedule appears current. The data date shown on the Gantt title block matches the submission date.

What it looks like in the XER: The data date in the XER file (the TASK table last_recalc_date field) does not match the data date shown in the Gantt header, or the data date is set to a date in the future — effectively treating future planned work as if it were already complete.

How to detect it: Always compare the data date in the XER file directly against the contractually required data date for the submission period. A data date set two or three weeks into the future from the required cutoff date can artificially show dozens of activities as "complete" that were actually in progress or not started as of the required data date.

Pattern 5: Percent Complete Inflation Without Physical Progress

What it looks like in the Gantt: Activity percent complete values are consistent with the progress narrative and the project appears to be executing on plan.

What it looks like in the XER: Activity percent complete values for specific activities increased significantly between update periods without corresponding increases in the activity's actual cost billing, installed quantity records, or inspection logs.

How to detect it: For high-value activities approaching the 80–100% completion range, cross-reference the P6 percent complete against the contractor's pay application for the same period. A structural concrete activity showing 90% complete in the schedule while the corresponding pay application item shows 65% billed is a discrepancy that warrants formal inquiry. In a forensic context, this cross-referencing across the full update history can reconstruct a much more accurate as-built record than the contractor's self-reported percent complete values alone would suggest.

What to Do with Manipulation Evidence

If you suspect schedule manipulation, the first step is documentation — not accusation. Compile the evidence into a structured comparison showing the specific change, the update period it appeared, and the quantifiable impact on reported float and milestone dates. This compilation is the foundation of either a formal schedule correction request or, if the project heads toward litigation, a forensic schedule analysis engagement.

CPM Pros performs forensic P6 analysis for owners, attorneys, and agencies who need to establish a documented, defensible record of schedule manipulation across a project's update history. Our forensic expert witness service includes XER-based reconstruction, float erosion tracing, and expert report preparation — scoped to the specific requirements of each engagement.

This content is for informational purposes only and does not constitute project-specific consulting advice. Please contact info@cpmpros.com for project-specific services. © 2024 CPM Pros. All rights reserved. Reproduction or distribution without permission is prohibited.
Related Resources