Cathodic Protection Management Software: Proving Every Rectifier and Test Point Was Read Before the Interval Closed

Why cathodic protection records fall apart above a few hundred assets

It is the second week of December at a gas distribution utility. The corrosion control manager has 1,900 test stations, 260 rectifiers, 40 interference bonds and two technicians. Compliance for the calendar year closes in three weeks. The district spreadsheets say the annual test point survey is complete, so the dashboard is green. What the spreadsheets do not say is that rectifier 14 sits behind a locked gate inside a chemical plant, the plant changed its contractor badging in August, and the last reading on that unit is dated September 2. That is already outside the interval the rule allows, it happened four months ago, and nobody will find out until someone reconciles the year, if they reconcile it at all.

Meanwhile the remote monitoring units on 90 of those rectifiers report every day into three separate vendor portals, each with its own login, export format and idea of what time a reading was taken. The GIS that knows which main each test station protects sits in a different department and was last reconciled against the corrosion asset list two reorganizations ago.

American Innovations is the most complete offering in this category, and if you standardize on their hardware and accept their data model it works well. MOBILTEX CorTalk, Abriox and Elecsys build strong remote monitoring hardware with portals designed around their own units. All four are device first: they report accurately on what a specific unit is reading. The question they are not built to answer is whether your compliance program is complete across every asset regardless of who manufactured the sensor, including the large share of your fleet with no sensor at all. None of them owns your GIS or your leak history, which is where a reading turns into a decision about replacing a main.

Problem 1: the interval clock is per asset and the calendar year hides violations

The federal rule for gas pipelines in 49 CFR 192.465 sets two constraints at once, and a spreadsheet sorted by date satisfies only one of them. Rectifiers and the interference bonds critical to protection are inspected six times each calendar year at intervals not exceeding two and a half months. Pipelines under protection are tested at least once each calendar year at intervals not exceeding fifteen months. Liquids operators live under an equivalent structure in Part 195. A technician who reads a rectifier on January 5 and again on March 25 has produced the second reading of the year and has also blown the interval, and a count based tracker will still show that asset as compliant.

What a custom build does is model the applicable rule per asset rather than per program, because your fleet is not uniform. A rectifier, a critical bond, a non critical bond, a galvanic system test point and a casing test point do not carry the same obligation, and if a state code is stricter than the federal floor the stricter one governs. The system computes two dates for every asset: next due and last legal, then drives route planning from last legal rather than from a monthly average. Escalation fires at 30, 14 and 7 days out to a named person, not a shared inbox. And the year cannot close green if an asset satisfied the count while breaking the gap, because that is precisely the finding an auditor is trained to look for.

Problem 2: four telemetry vendors, one clipboard and no common record

A remote monitoring unit from one manufacturer reports a daily structure to soil potential sampled at a fixed hour. Another samples on an interrupter cycle synchronized by GPS and gives you both the on potential and the instant off. A third reports rectifier output current and voltage but leaves the potential to a separate probe. Timestamps land in local time, in UTC, or in whatever the installer configured. Then a third of your fleet has no telemetry at all and arrives as numbers a technician wrote down.

What a custom build does is define one reading object and normalize everything into it through adapters. Each reading carries its source, its measurement method as on potential, instant off or native, the reference electrode used, the instrument and its calibration date, the technician and a coordinate. The electrode detail is not bookkeeping. The protection criteria in Appendix D of Part 192 are written against a saturated copper sulfate half cell, and a silver chloride cell reads differently, so the raw value and the electrode both get stored and conversion happens at evaluation time rather than at ingest. Convert on the way in and you have destroyed the evidence.

Problem 3: a reading means nothing until it attaches to the pipe it protects

Negative 780 millivolts at a test station is not a fact about a test station. It is a fact about a segment of coated steel installed in 1963 with a shorted casing under a state highway, crossed by a foreign operator's line 200 feet away, in soil a DC transit system has been injecting stray current into for decades. The reading becomes actionable only with that context, and the context lives in the GIS.

What a custom build does is link every corrosion asset spatially to the pipe segment it protects, with material, vintage, coating type, casing and isolation status carried through. Then a reading below criterion flags the segment, not just the point. That matters because your distribution integrity management program under Subpart P evaluates the corrosion threat by segment, and because a segment with two corrosion leaks in five years and a test point that has drifted across three consecutive surveys is your next main replacement candidate. That correlation is what gets replacement capital approved, and most operators assemble it by hand each budget cycle instead of having it standing.

Problem 4: a deficiency is a case with a clock, not an email

The rule says deficiencies must be promptly corrected. Your procedures put a number on prompt and your state may put a shorter one on it. The path from a low reading to a closed deficiency runs through investigation, because a reading below criterion might be a genuine loss of protection, a bad test lead, a tripped rectifier or a shorted casing, and each has a different remedy. Then remediation happens as field work, an anode installation or a rectifier repair or a bond, and the only proof it worked is a verification reading taken afterward.

What a custom build does is make that a case object with an assignment, a clock, a cause code, a work order and a hard rule that the case cannot close without a verification reading that meets criterion. The cause codes are the quiet payoff. After a year you can see that rectifier failures cluster on one manufacturer, or that a particular contractor's anode installations fail verification more often than anyone's. None of that is visible when a deficiency lives as a thread in someone's mailbox.

Problem 5: proving it years later, to an auditor and to yourself

Records of these tests and surveys have to be retained for as long as the pipeline stays in service under 192.491, which for buried steel means effectively forever. An inspector picks twenty assets, asks for every reading in the period, the criterion applied to each, and the full trail behind any deficiency. If the answer requires three vendor portals, two spreadsheets and a technician's recollection, the audit has already gone badly regardless of what the readings say.

A custom build stores readings as an append only record where corrections are new entries with a reason rather than edits, and generates an evidence packet per asset per period on demand. It also produces the annual report figures on protected and unprotected steel and on leaks attributed to corrosion from that same data, rather than from a parallel counting exercise in November. And it solves the lock in nobody discusses here: when you change remote monitoring vendors, your reading history is already in your own system instead of stranded in a portal you stopped paying for.

What this costs and how long it takes

Digital Heroes has run more than two thousand delivery engagements, and for corrosion control programs the shape holds steady. A first release covering per asset interval tracking with correct rule logic, normalized reading capture from your existing remote monitoring hardware plus a field entry path that works offline, criteria evaluation and deficiency cases runs $55,000 to $120,000 and ships in 10 to 14 weeks. That is a system your technicians route from on Monday morning. A full platform adding GIS segment linkage, interference and casing investigation workflows, close interval survey and DCVG data handling, corrosion threat scoring against leak history and audit evidence generation runs $150,000 to $400,000 phased over 6 to 12 months.

What drives the number up: each additional remote monitoring vendor is a real adapter with its own authentication, sampling semantics and failure behavior. A GIS integration against a well maintained Esri geodatabase is straightforward, while reconciling an asset list against a geodatabase nobody has audited in years is discovery work measured in weeks and it is the item most often underestimated. Close interval survey data brings large coordinate aligned datasets and its own interpretation rules. Offline field capture that survives a day in a truck without signal is not free, and skipping it means your technicians keep using paper.

What keeps the number down: starting with rectifiers and critical bonds only. They carry the tightest interval on the smallest asset count, which is where the year end panic comes from.

Build versus buy, and when buying is the right call

Buy if you operate one system with a few dozen rectifiers and a couple hundred test points, read by the same two people every year, on a single state's rules. American Innovations or a vendor portal paired with a well kept spreadsheet will carry that program, and a custom build would be an expensive way to reach the same compliance position.

Build when the program has outgrown a person's memory: more than about 150 rectifiers or 1,000 test points, hardware from more than two manufacturers already in the ground, operations across state lines and therefore across rule sets, asset lists left disagreeing with the GIS by acquisitions, or corrosion data that needs to feed replacement prioritization rather than only compliance reporting. The threshold is not asset count on its own. It is the point where proving compliance costs more than achieving it, which is where most operators are by the time they call.

How to choose a developer for cathodic protection software

Ask them to explain the difference between an on potential and an instant off reading, and why the system has to store both without converting one into the other. If they treat a reading as a single number, they will build a database that fails its first audit question.

Ask how they will model the interval rule. The correct answer involves a per asset rule with both a count constraint and a maximum gap, and a last legal date that route planning is driven from. Anything that starts with a monthly schedule is a calendar, not a compliance system.

Ask what they have integrated. A vendor telemetry API, an Esri geodatabase, a work management system such as Maximo or Cityworks, and an offline field application are four different problems. Ask for the specific names and data flows, not a general claim about integrations.

Ask who owns the code, the cloud accounts and the vendor API credentials, and put it in the contract before kickoff. Your reading history is a lifetime record for buried assets and it should never sit anywhere you cannot reach without a renewal. At Digital Heroes the client owns the repository and the infrastructure from the first commit. Start your next vendor conversation with that question and see how quickly the room changes.