Corrosion rates you can trust when six contractors supplied the readings

Why oil sands corrosion rates arrive already damaged

The integrity engineer at a bitumen upgrader, a SAGD central processing facility or a mine extraction plant rarely takes their own readings. Data arrives from contractors, often several of them working simultaneously during a turnaround under schedule pressure, each with their own procedures, equipment, reporting templates and habits. Some hand over a gauge export. Some hand over a PDF with a photograph and a table. Some hand over a corrosion map file that only their software can open, with a summary sheet giving one number per component. All of it has to be merged into a single history before anyone can compute a rate.

The merge is where the damage happens, and it happens quietly. A thickness column in a spreadsheet does not record whether a value came from a spot reading or the minimum pixel of a C-scan, whether it was taken through coating, whether it is millimetres or thousandths of an inch, or whether it represents the same physical steel as the value above it. Once flattened, that information cannot be recovered. The corrosion rates computed afterwards look entirely reasonable and are, in a meaningful fraction of cases, describing measurement methodology rather than metal loss.

The consequence is not academic. Oil sands facilities run capital-intensive turnarounds on multi-year cycles with long lead-time replacements. A fabricated short-term rate pulls a component into a replacement scope that did not need it. A suppressed rate, caused by a blank cell carried forward or an averaged grid, leaves a thin component in service until the next window. Both errors are expensive, and both trace back to a data intake step that most organisations treat as clerical.

The rate rule, and what it assumes about the data feeding it

The method itself is not in dispute. The long-term rate is the earliest reliable thickness minus the current thickness over the elapsed years. The short-term rate is the previous thickness minus the current thickness over the shorter interval. The larger governs remaining life unless a corrosion specialist documents a reason to use the smaller. Remaining life divides the available wall above the required minimum by the governing rate, and the inspection interval is the lesser of half remaining life and the code maximum for that equipment class.

What is easy to overlook is how much the method assumes. It assumes both thicknesses describe the same physical point. It assumes both were produced by comparable techniques with comparable detection capability. It assumes both are in the same units. It assumes a missing reading is recorded as missing rather than inferred. It assumes that when a value is unusually low, someone has established whether that is new damage or newly found damage. On a single-operator, single-contractor dataset those assumptions hold most of the time. On an oil sands turnaround with six vendors, they hold much less often than anyone would like.

This is why the rule that the higher rate governs is a double-edged instrument in this environment. It is the correct engineering conservatism when the data is sound, and it is an amplifier for data quality defects when it is not, because every intake error that makes a reading look thinner immediately becomes the governing rate. An organisation that cannot clean its intake ends up either drowning in false alarms or, worse, learning to dismiss them.

The corrosion map minimum versus the spot reading

Heavy oil service pushes inspection toward area coverage. Erosion-corrosion at bends, under-deposit attack in low-flow regions, and localised naphthenic acid attack downstream of turbulence are all point phenomena that a nine-point spot grid can miss entirely. So corrosion mapping and automated ultrasonic scanning have become standard on the lines that matter. That is good inspection practice and bad trend data, unless the difference is handled deliberately.

The arithmetic is stark. Suppose a component with a 12.7 mm nominal wall has been trended on spot readings for eight years, sitting comfortably at 11.4 mm. This turnaround it is corrosion mapped, and the scan reports a minimum of 8.9 mm in a 40 mm patch that no spot ever touched. Loaded as a thickness, the short-term rate over a three-year interval is 2.5 mm divided by three years, roughly 0.83 mm/yr or 33 mpy, against a long-term rate of about 0.16 mm/yr. Remaining life collapses from decades to a couple of years and the component enters an emergency assessment.

The metal loss may be entirely real, but the rate is not — the damage probably accumulated over the full eight years and was simply never detected. The correct treatment is to reset the baseline for that location using the new technique, record the technique change explicitly, and where a decision is needed now, take it through a fitness-for-service assessment on the measured profile rather than through a fabricated rate. A system that stores technique against every reading can do this automatically. A system with one thickness column cannot do it at all.

Two contractors, one location, two different walls

Ultrasonic thickness measurement has real reproducibility limits between operators and instruments. Different transducer diameters and frequencies, different couplants, different surface preparation, different gain and gate settings, and different practice on whether to record the first stable reading or the lowest of several all contribute. On coated or rough heavy oil piping, an inter-vendor bias of 0.2 to 0.3 mm is unremarkable. On a one-year interval, 0.25 mm of bias is 0.25 mm/yr — around 10 mpy of corrosion that exists only in the difference between two technicians.

The way to control this is the way any measurement system is controlled: characterise it before you trust it. Circulate a reference block with known stepped thicknesses through every contractor mobilising to site, have each vendor measure it with the equipment and personnel they will actually deploy, and record the bias and spread. It takes an hour per crew. It gives you a defensible basis for saying whether a 0.3 mm change is corrosion or contractor, and it gives the integrity engineer something to point at when a vendor disputes a finding.

It also changes how you handle repeat visits. When a second vendor re-reads a location mid-turnaround — which happens whenever a number looks alarming — the two values are not two points in a time series. They are two measurements of the same state. Recording them as sequential thicknesses generates a short-term rate over an interval of days, which yields nonsense figures in the hundreds of mils per year. A system that understands a repeat measurement as a repeat, not as a new inspection, avoids the whole class of problem.

Mechanisms that make a single averaged rate misleading

Oil sands and heavy oil processing concentrate several mechanisms that are strongly localised and strongly condition-dependent. Naphthenic acid corrosion, addressed in API RP 939-C, depends on total acid number, temperature in roughly the 220 to 400 C range, sulfur content and above all velocity and turbulence, so it attacks elbows, transfer line entries and areas downstream of pressure letdown rather than distributing evenly. High-temperature sulfidation follows its own temperature and sulfur relationships and depends heavily on alloy chromium content. Ammonium bisulfide corrosion in sour water systems, covered by API RP 932-B, is governed by the Kp product of hydrogen sulfide and ammonia partial pressures together with velocity, with commonly cited thresholds around a Kp of 0.35 and velocities near 20 ft/s for carbon steel.

In the upstream and mining parts of the operation the picture differs again. Hydrotransport slurry lines suffer abrasive wear that is measured in millimetres per thousand operating hours, not mils per year, and that is why spools are rotated on a schedule. SAGD produced water and de-oiling circuits see under-deposit corrosion and microbiologically influenced attack in low-flow regions. Once-through steam generators face waterside deposit-related tube damage driven by feedwater chemistry rather than by process fluid. Averaging any of these into a single line-level corrosion rate produces a number that describes no location on the line.

The practical implication for a rate module is that the mechanism has to be an attribute of the location, and it has to change behaviour. An erosion location should be trended against operating hours or throughput, not calendar years. A naphthenic acid location should be trended within a feedstock and temperature window. A sour water location should carry its Kp and velocity so a process change triggers a review. Without that, the rate engine is arithmetic with no physics behind it.

What a regulator or client audit tests in this environment

Alberta's regime puts the burden squarely on the owner. Pressure equipment integrity management expectations under ABSA AB-506, and the quality management system requirements for owner-user inspection organizations under AB-512, together mean that an operator must be able to show a coherent line from written procedure through qualified personnel and controlled equipment to recorded results and documented decisions. Pipelines add CSA Z662 and, in Alberta, Directive 077 obligations from the Alberta Energy Regulator. Tank inspection follows API 653 with its own interval logic.

None of these documents will tell you how to reconcile a C-scan minimum with a spot reading. What they will do is ask you to demonstrate that your program does what your procedure says it does. If your procedure states that corrosion rates are computed per API 570 with the governing rate applied, and your dataset contains rates computed across a spool rotation, a technique change and a unit mismatch, the finding is that the program is not in control — which is a considerably more serious finding than a single wrong number.

This is also where contractor data quality becomes an owner problem rather than a vendor problem. The contractor's obligation ends at delivering readings per their procedure. The owner's obligation is the integrity decision built on them. Auditors ask who verified the incoming data, against what acceptance criteria, and what happened to the deliverables that failed. An organisation with a documented intake gate and a rejection log is in a materially stronger position than one whose answer is that the data was loaded into the database.

Designing an intake gate that actually stops bad data

An effective intake gate is a small number of hard checks applied before any reading joins a trend. Does every value carry units, technique, value type, instrument, operator and date? Is the operator's certification valid on that date for that method and scope? Does the location exist, and has it been versioned since the last reading? Is the value within a physically plausible band, given nominal thickness and the known mechanism? Does it produce a rate above a mechanism-specific threshold, and if so is there an event that explains it? Is the value type comparable to the previous value type at that location?

Each failed check should produce a queued exception with a named owner rather than a silent rejection or a silent acceptance. In practice a well-run oil sands turnaround will throw a few hundred exceptions across tens of thousands of readings, and the great majority resolve in under a minute — a unit flag, a technique tag, a location version. The residue, perhaps a few dozen, are the genuine findings, and they are now visible on the day the data arrives rather than three months later when someone builds the integrity report.

The economic argument is straightforward. The cost of the gate is a modest amount of intake configuration and a data coordinator's attention during the turnaround. The cost of not having it is a corrosion rate population that nobody senior fully trusts, which produces two behaviours: unnecessary replacement scope added defensively, and legitimate alarms discounted because so many previous ones were artefacts. The second behaviour is the one that eventually hurts.

Evaluating a system on intake, not on its dashboard

Every inspection management product demos well on clean data, and every one of them can draw a thinning trend. The differentiator in a heavy oil environment is entirely upstream of the chart. When you evaluate, hand the vendor a genuinely representative package: two contractors' deliverables in different formats and unit systems, one corrosion map summary, one location that was rotated, one blank cell, and one repeat reading taken three days after the first. Ask them to load it and show you the corrosion rates. The interesting output is not the rates — it is the exception list.

Then probe the model rather than the interface. Can a single location hold multiple value types with different trends? Does the system distinguish no reading from no change? Can a location be versioned at a component replacement or spool rotation without losing history? Is measurement technique stored per reading or per project? Can a damage mechanism tag alter the trending basis from calendar years to operating hours? Can you produce, for one location, a complete provenance record for an auditor without exporting to a spreadsheet and editing it?

Atlantis builds NDT inspection management and reporting software around this intake problem specifically, because it is where multi-contractor sites lose control of their data, and configures it to the formats your existing vendors already produce rather than requiring them to change. The positioning is affordable, accessible and fully customizable. Send a representative sample of your last turnaround package to info@atlantisndt.com and ask for a working session against your own data — the exception list it produces is usually more informative than any presentation.

Request a consultation