Turning Corrosion Rates Into a Turnaround Scope That Holds

The rate is not the deliverable; the window date is

In a refinery running risk-based intervals, a corrosion rate produces an inspection due date and life carries on. In a fertilizer complex the calendar is far less forgiving. An ammonia plant may run three to five years between major turnarounds, the urea plant is tied to it, and outside that window almost nothing above ground can be opened, entered, scaffolded or replaced. The corrosion rate therefore answers exactly one question that matters to the business: will this circuit still be fit for service when the next window opens, or does it have to be dealt with in this one?

That reframes the output. A remaining life of seven years is not an answer, it is a number requiring interpretation. The answer planners need is a projected thickness at the next window opening date, compared against the retirement thickness, with an uncertainty band attached. Circuits then sort into three buckets with no ambiguity: replace or repair in this window, monitor and reassess with a defined trigger, or defer with confidence. Everything the module does should aim at producing that classification.

The uncertainty band is not decoration here. A projection that lands 0.3 mm above the retirement thickness with a band of plus or minus 0.4 mm is a coin toss dressed as a decision, and a planner who is shown the single number will treat it as settled. Showing the band is what prompts the right response, which is usually to buy the long-lead item as insurance or to add a mid-cycle inspection to a circuit that can actually be accessed online.

When the short-term rate must override a comfortable average

The governing rule, take whichever rate gives the shorter remaining life, exists because corrosion is not a constant. In most plants that is a modest safeguard. In urea synthesis it is the entire ballgame. Carbamate corrosion is controlled by an oxide film maintained by oxygen dosed into the carbon dioxide feed, and the difference between a passivated and a depassivated surface is not a percentage, it is orders of magnitude. The metal does not corrode faster gradually; it switches regimes.

This means an averaged rate misrepresents the plant in two directions at once. It overstates what the circuit experiences during normal, well-passivated operation, which leads to unnecessary conservatism and premature replacement of components with long procurement lead times. Simultaneously it understates what a single excursion can do, which is the case that actually threatens the run. A plant that has averaged its way through two mild excursions and reports a reassuring long-term rate is not measuring the thing that will end its campaign.

The module has to be able to hold process context beside the thickness. Passivation air flow trends, oxygen analyser records, excursion durations, ammonia to carbon dioxide ratio and temperature excursions all belong attached to the interval. When the interval is decomposed into a passivated baseline and an event contribution, three useful outputs appear: a realistic normal-operation rate for planning, a quantified cost per excursion hour that gives operations a hard number to argue with, and a defensible basis for deciding whether a stripper or condenser can survive another cycle.

The two-point problem on shutdown-access CMLs

A large fraction of the CMLs that matter most in a fertilizer complex can only be read with the plant down: internal points in the urea reactor and stripper, exchanger internals, high-temperature piping requiring insulation removal and scaffold, anything inside the reformer. Those points get one reading per turnaround. On a four-year cycle a circuit that entered service in 2018 has three readings by 2030, and for much of its life it had two.

With two readings the short-term rate and the long-term rate are the same number. A system that displays them in two columns creates a powerful illusion of corroboration where none exists, and engineers reading a report at three in the morning during scope development will take it at face value. Worse, a two-point rate carries the entire measurement uncertainty of both readings without any averaging benefit. On a 12 mm wall with 0.15 mm of combined uncertainty over four years, the rate is uncertain by roughly 0.04 mm per year before anything real has happened, which on a 3 mm corrosion allowance is a range of decades in projected life.

Handling this honestly costs nothing and prevents a lot of bad decisions. Label the rate as two-point. Show the projected thickness as a band rather than a line. Where the band straddles the retirement thickness at the next window, escalate the circuit for a repeat survey during the current window rather than deferring on the mid-point. And record which CMLs are shutdown-access only, so that scope planning knows in advance that a given decision cannot be revisited until the plant is down again.

Four mechanisms a thickness trend cannot see

Ammonia stress corrosion cracking is the first. Carbon steel in aqueous ammonia service, particularly storage spheres and refrigerated tanks, cracks under the combined influence of stress, oxygen contamination and low water content, and post-weld heat treatment together with maintaining a small water addition and excluding air are the classic mitigations. The mechanism produces no measurable wall loss. A sphere with an immaculate thickness history can carry cracking at nozzle welds and knuckle regions, and only a wet fluorescent magnetic particle or shear wave scope will find it.

High temperature hydrogen attack is the second. In the hot high-pressure hydrogen sections of an ammonia plant, methane forms at carbides within the steel and produces fissuring, not thinning. API RP 941 defines the operating envelope, and detection is a specialist ultrasonic exercise using advanced backscatter, time-of-flight diffraction and velocity ratio techniques. A corrosion rate module will report the affected circuit as perfectly healthy throughout, which is why the material-and-service basis for HTHA screening has to sit in the asset record alongside the thickness data.

Metal dusting and creep make up the third and fourth. Metal dusting attacks high-temperature alloys in high carbon activity gas around the reformer effluent and waste heat boiler, producing localised pitting and metal wastage that a grid average will miss entirely. Creep in reformer catalyst tubes is assessed by diameter growth and by in-service inspection techniques rather than by wall measurement. All four belong in the turnaround scope, and all four are invisible to the calculation this page is about. The right response is not to stretch the corrosion rate to cover them, but to make sure the asset register records the credible mechanisms so the scope is built from mechanisms rather than from whichever data happens to exist.

Long-lead materials drag the decision date backwards

The reason scope freezes nine to twelve months ahead of a window is procurement, not planning etiquette. High-alloy items for urea service, exchanger bundles in duplex or specialty grades, reformer catalyst tubes, large forgings and reactor liner materials routinely quote in the forty to sixty week range, and longer when mill capacity is tight. A replacement decision taken six months out is a decision to run another cycle on the existing component, whether or not anyone frames it that way.

This inverts the usual relationship between inspection and planning. The engineering group does not get to inspect, then decide. It has to decide, then confirm during the window. That means the corrosion rate module must be capable of producing a projection well before the last inspection, from data that is already three or four years old, and must present it with the uncertainty that implies. It also means the module needs a materials lead-time field per component, because the meaningful alert is not remaining life below a threshold, it is remaining life below the sum of the window interval and the procurement lead time.

That derived alert is one of the highest-value things such a system can compute, and it is rarely present in generic maintenance software. The logic is simple: for each critical component, compare projected thickness at the next-plus-one window against retirement thickness, and where the projection fails, back-calculate the latest order date from the quoted lead time. What emerges is a procurement calendar driven by corrosion data rather than by memory, and it typically flags two or three items nobody had on the list.

Nested windows: the units do not shut down together

A fertilizer complex is not one plant. Ammonia, urea, nitric acid, ammonium nitrate and the utility block have their own reliability drivers and their own economic optima, and they rarely share a single window. Urea depends on ammonia, so it usually comes down with it, but nitric acid and ammonium nitrate trains may run on entirely separate cycles, and the utility block, boilers, cooling water and the ammonia refrigeration system, may only ever be partially available at any given time.

That means remaining life cannot be evaluated against a single site interval. Each circuit belongs to an outage group with its own next window date, and the projection has to be run against that date. A cooling water exchanger in the nitric acid train sitting on a three-year cycle and a synthesis loop exchanger on a four-year cycle produce different answers from the same corrosion rate, and a system with one global interval will get one of them wrong.

There is a second-order effect worth building for. When a circuit fails its projection against its own group's window but would pass against a nearby group's earlier window, there is a real option: bring the work forward and execute it during the adjacent outage, borrowing access. That option only becomes visible if the module knows the outage group structure and their dates. Sites that lack that structure discover the opportunity retrospectively, which is to say they discover that they missed it.

Evaluating the module against a scope freeze

Test the software against the deadline it actually has to serve. Ask to see a scope freeze report: every circuit in a nominated outage group, its governing rate and which of the two rates governs, the projected thickness at the next window date and the one after, the retirement thickness and its basis, the uncertainty band, the two-point and provenance flags, the credible mechanisms that thickness does not cover, and the recommended action. If producing that requires exporting to a spreadsheet and rebuilding it by hand, the tool is a database rather than a decision system.

Then probe the awkward behaviours. What does it do when a reading increases. What does it do when passivation records show an excursion inside the interval. Does it recognise that a circuit is shutdown-access only, and does it treat a two-point rate differently from a six-point trend. Does it hold a lead time per component and compute a latest order date. Does it flag the case where the half-life interval falls between turnarounds. Does it let a circuit belong to an outage group with its own dates rather than a single site-wide cycle.

Finally, ask what happens after the window. The turnaround is when the data arrives: hundreds of new readings, replacements that reset a baseline, repairs that change local geometry, findings that alter the credible mechanism list. A system that makes post-turnaround data entry a three-month clerical exercise will be a cycle behind forever, and by the time the record is current the next scope freeze is already underway. Field capture, bulk ingestion of contractor data sets, and clean baseline resets on replaced components are what determine whether the module is useful in the second turnaround as well as the first.

Request a consultation