When the Corrosion Workbook Has Three Editors and No Audit Trail

Two things called corrosion rate, and why mixing them is the real defect

Ask three people in a water utility for the corrosion rate and you will get two incompatible answers. The reliability engineer means wall loss: mils per year derived from ultrasonic thickness readings on an elevated tank shell, a steel force main or a pressure filter vessel. The water quality chemist means corrosivity: the mass loss of a metal coupon exposed to the treated water, reported in mils per year under ASTM D2688 with the coupon cleaned to ASTM G1, used to demonstrate that corrosion control treatment is doing its job.

Both are legitimate, both are expressed in mils per year, and they describe entirely different phenomena answering to entirely different oversight. One drives a rehabilitation decision on a physical asset the utility owns. The other drives a treatment decision aimed at what leaches from customer-side lead and copper plumbing well downstream of the plant. Neither predicts the other. Corrosion control treatment can be performing to target while a 1962 elevated tank quietly loses shell metal at the waterline, and the coupon rack will never hint at it.

In a shared workbook these two sit on adjacent tabs and, in the worst cases, on the same tab. The moment a second editor arrives, the units and the underlying mental model blur. The first deliverable of any real system is therefore not a better formula. It is two separate registers, each with its own governing standard, its own owner, its own reporting path, and no column that can be dragged from one to the other by someone in a hurry.

Wastewater's dominant mechanism is not general wall loss

In collection systems and headworks the dominant deterioration mechanism is not thinning steel. It is biogenic sulfide corrosion. Sulfate-reducing bacteria in the submerged slime layer generate hydrogen sulfide, it partitions into the sewer atmosphere, and Thiobacillus species on the moist crown oxidise it to sulfuric acid. The attack falls on concrete and cementitious lining at the crown and in the splash zone, and it presents as loss of cover and exposed reinforcement rather than as mils per year of wall.

This matters for a corrosion-rate module because the calculation has nothing to hold. A system built entirely around current thickness minus required thickness has no meaningful output for a manhole losing several millimetres of cover a year, or for a lined interceptor where the question is coating integrity rather than substrate thickness. Utilities that force concrete deterioration into a thickness model end up with a register full of empty fields and an inspection programme that quietly reverts to a separate spreadsheet within a year.

The correct handling is parallel rather than unified. Maintain a wall-loss register with short-term and long-term rates for metallic assets, and a condition-grading register for concrete and coatings scored on a defined scale with photographic evidence and an explicit re-inspection trigger. The two share the asset register, the location hierarchy and the scheduling engine. They do not share a calculation, and pretending otherwise is the fastest route back to two disconnected systems.

The assets that actually have a wall to lose

The metallic assets in a utility that genuinely warrant short-term and long-term rate calculation form a smaller set than the asset register implies, and they are worth naming explicitly: welded steel storage tanks to AWWA D100, steel transmission mains and force mains, hydropneumatic tanks and air receivers under ASME Section VIII, pressure filter shells, digester gas piping and chemical feed piping. For these the standard arithmetic applies — a short-term rate from the last two readings, a long-term rate from the earliest defensible baseline, the more conservative governing remaining life.

Steel water storage tanks bring a specific geometry problem. Corrosion concentrates at the waterline fluctuation band and in the roof headspace, where condensation and disinfection by-products meet steel that the coating protects least effectively. It does not distribute itself evenly over the shell. A rate computed from readings taken at convenient heights on a dry shell will be low, entirely defensible in procedure, and worthless as a decision input. The measurement plan has to put readings where the mechanism actually is.

Buried steel behaves differently again. External soil-side loss on a force main is governed by soil resistivity and moisture, stray current from nearby traction or rail systems, coating condition and cathodic protection status, in the framework of AMPP/NACE SP0169. You cannot obtain an ultrasonic reading without an excavation, so the rate for a buried main is inferred from a handful of bell-hole exposures. The system should record it as inferred and carry the exposure count, rather than presenting it with the same visual confidence as forty direct readings on a tank shell.

Chemical feed systems corrode on a chemistry, not a calendar

Chemical feed systems are where a water or wastewater plant loses metal fastest and monitors it least. Sodium hypochlorite decomposes and its degradation products are aggressive. Ferric chloride at feed strength attacks 316 stainless steel readily enough that most specifications call for lined or non-metallic materials outright. Sodium bisulfite, alum and polymer lines each carry their own material constraints. These are short-life, high-consequence systems, and their corrosion rate is set by a chemistry and a material selection decision rather than by elapsed time.

The practical consequence is that the short-term rate matters far more here than the long-term rate, and it matters on a timescale of months rather than years. A metallic component in a mismatched chemical service can lose enough wall between two annual inspections that a long-term average is not merely imprecise but actively misleading. Where a plant has already had a leak, the useful record is not a rate at all. It is a material-versus-chemical compatibility decision with a date attached, and a replacement whose baseline starts from that date.

A module that handles this well lets inspection frequency be driven by the damage mechanism rather than by asset class or by a plant-wide default. Twelve-month intervals on a hypochlorite header and sixty-month intervals on a raw water tank shell are both correct answers to different questions. A single utility-wide interval is wrong in one direction for the header and wrong in the other for the tank, and it wastes inspection budget while missing the thing most likely to leak.

Why the spreadsheet fails specifically here

Spreadsheets do not fail loudly. The workbook that produced the last five years of tank condition reports still opens, still calculates and still looks right. What changed is that three people now edit it and none of their changes left a trace. A column sorted without its neighbours silently reassigns every reading to the wrong location. A hardcoded value pasted over a formula continues displaying a plausible number indefinitely. Dates entered as text yield a zero interval, which produces either a visible error or, worse, a rate someone quietly rounded away.

The specific test is reproducibility, and it is worth running before any procurement conversation. Take any remaining-life figure from last year's report and try to reconstruct it: which readings, taken on which dates, by whom, with which instrument and calibration, against which required thickness, approved by whom. In most utility workbooks at least two of those are unrecoverable. That is not a criticism of the engineer who built it. A spreadsheet is a calculation tool and was never intended to be a record-keeping system.

What replaces it does not need to be elaborate. It needs immutable readings, a computed rate that is never hand-editable, an override path that demands a stated reason and an owner, and a per-record change history. Once those four exist, arguments about whose number is right stop being arguments, because the system answers the question directly instead of by recollection. Most of the value arrives on the day the first disagreement is settled in ninety seconds.

Access, not measurement, is the binding constraint

In a utility the constraint on corrosion data is almost never the measurement itself. It is getting to the steel. An elevated potable tank has to be taken out of service, drained, ventilated and entered as a permit-required confined space under OSHA 29 CFR 1910.146, then disinfected under AWWA C652 before it returns to service. A digester cannot be emptied on a whim. A force main cannot be excavated without traffic control, a permit and a customer outage plan. Access is expensive and infrequent, sometimes once in eight years.

That changes what a corrosion-rate module is actually for. In a refinery, the software schedules inspections against calculated rates and the access is comparatively routine. In a utility, the software's higher-value job is to make certain that when access is finally obtained, the crew takes every reading the next rate calculation will need, at locations that match the previous set, with enough coverage that the following interval can be defended without another entry.

In practice that means the measurement plan must be generated before the entry, from the last survey, with the locations that produced the governing rates flagged and mandatory. A crew inside a drained tank working from a generic checklist will produce readings that are perfectly good in isolation and comparable to nothing. The cost of that mistake is not a re-read. It is another eight years of ambiguity and a capital decision made on judgement instead of evidence.

Public money changes the evidence standard

A corrosion rate in a municipal utility ends up somewhere an industrial rate rarely goes: into a capital improvement plan, a rate case, a bond prospectus or a consent-decree compliance schedule. The number saying that a 1.5 million gallon elevated tank needs recoating and structural repair is the number that justifies the appropriation. It will be read by a finance director, by a council or board, and in many jurisdictions by any member of the public who asks for it.

That raises the evidentiary standard in a way engineers consistently underestimate. Utility records are generally subject to public records disclosure, and a challenged capital request is examined by people who will not evaluate the engineering but will absolutely notice that the calculation exists only as a workbook with no author, no version history and a hardcoded cell. The project does not fail because the engineering was wrong. It fails, or is deferred, because it could not be shown to be right.

The same records support the opposite decision just as strongly, which is the part that usually goes unnoticed. A defensible rate history is the best available argument for not spending money — for extending a recoating interval by four years on measured evidence rather than on the last consultant's rule of thumb. Utilities that put their corrosion records in order tend to find the first payback in a deferral, not in a repair.

How to evaluate the module

Evaluate on your worst record rather than your best asset. Bring the workbook with three editors and ask the vendor to import it in front of you. What you want to see is what happens to the rows the system cannot trust: quarantined and visible, or silently defaulted into a rate that will look authoritative next year. A tool that imports everything cleanly on the first attempt has almost certainly guessed at something, and it will not tell you what.

Then confirm the model can carry both registers without merging them. Wall loss in mils per year with a required thickness and a remaining life. Coupon corrosivity in mils per year with an exposure period, a cleaning method and a compliance report. The same unit, different tables, no shared formula and no shared report. A vendor who does not immediately understand why those must stay apart has not worked in water, and will build you a system that produces a confident, wrong number within eighteen months.

Last, ask what the system does about access. Can it generate the measurement plan for a tank entry from the previous survey, flag the locations that produced the governing rates, and reject a completed survey that is missing them? The utilities that get lasting value from a corrosion-rate module get it there — not from the arithmetic, which is trivial, but from never wasting a confined space entry again.

Request a consultation