Cathodic Protection Software Problems: The 7 That Cost You a Violation, and How to Avoid Them

Why does the interval rule get modelled wrong so often?

Because the obvious model satisfies half the requirement and looks complete. A schedule with a monthly cadence, or a counter that ticks up to six, produces a dashboard that goes green, and nothing in it will ever tell you it is wrong. The rule imposes two constraints at once: a number of inspections in the calendar year and a maximum gap between them. Pipelines under protection carry the other pattern, at least once each calendar year at intervals not exceeding fifteen months, and liquids operators live under an equivalent structure in Part 195.

The second half of the scope failure is treating the fleet as uniform. A rectifier, a bond critical to protection, a non critical bond, a galvanic system test point and a casing test point do not carry the same obligation, and where a state code is stricter than the federal floor the stricter one governs. An operator running across three states is running three rule sets.

The fix is to model the applicable rule per asset rather than per programme, and to compute two dates for every asset: next due and last legal. Route planning should be driven by last legal rather than by a monthly average, escalation should fire at thirty, fourteen and seven days out to a named person rather than a shared inbox, and the year must not be able to close green when an asset satisfied the count while breaking the gap. That is precisely the finding an auditor is trained to look for.

What goes wrong when reading history is migrated out of portals and spreadsheets?

The values migrate easily. The context does not, and the context is what makes a reading defensible. A number in a spreadsheet column headed potential does not say whether it is an on potential or an instant off taken on an interrupter cycle, which reference electrode was used, which instrument took it and when that instrument was last calibrated. Those fields were in a technician's head or on a paper sheet, and they are what an inspector will ask about.

The electrode detail is not bookkeeping. The protection criteria in Appendix D of Part 192 are written against a saturated copper sulfate half cell, and a silver chloride cell reads differently. Any migration that converts values on the way in has destroyed the original evidence, and the converted number cannot be checked.

The fix is to store the raw value with its measurement method, electrode, instrument, calibration date, technician and coordinate, and to convert only at evaluation time. Where history lacks those fields, mark it as legacy with the fields absent rather than assuming a default, because an assumed electrode is a guess wearing the appearance of a record. Store readings append only, so a correction is a new entry carrying a reason rather than an edit to history. Then pull a sample of twenty assets and reconstruct their full period from the migrated data before go live, because that is exactly the exercise an audit will run.

Why do telemetry, GIS and work management integrations break after launch?

Because each of them changes without asking you. A remote monitoring vendor updates an interface or an authentication method. A field technician swaps a failed unit for a different model and the new one samples on a different cadence and reports different fields. Your geographic information system, maintained by another department, gets edited when a main is replaced, and the test station that used to protect that segment now points at something that no longer exists. Work management systems such as Maximo or Cityworks carry their own asset identifiers, which were probably never reconciled with the corrosion asset list in the first place.

The characteristic failure is silence rather than an error. A unit that stops reporting looks the same as a unit reporting nothing unusual, and a rectifier that has been offline for two months still appears in the fleet.

The fix is to alert on the absence of expected data per asset rather than on failures, and to hold a last heard from timestamp on every monitored unit so a silent unit becomes a work item. Run an automated reconciliation between the corrosion asset list and the geographic information system on a schedule, with exceptions landing in a named person's queue. Keep vendor specific behaviour in adapters at the edge so a hardware change is an adapter change rather than a data model change, and record which adapter produced each reading so a suspect batch can be traced to its source.

What happens when deficiency handling is not covered as cases with a clock?

The rule requires deficiencies to be corrected promptly, your procedures put a number on prompt, and your state may put a shorter one on it. Without a case object, a low reading becomes an email, and an email has no clock, no owner after the first reply, and no definition of closed.

The specific loss is verification. A reading below criterion might be genuine loss of protection, a bad test lead, a tripped rectifier or a shorted casing, and each has a different remedy. Someone installs anodes or repairs a rectifier, the work order closes, and nothing ever confirms that the remedy worked. Your record then shows a deficiency and a repair with no evidence connecting them, which is not a closed deficiency in the eyes of anyone reviewing it.

The fix is a case with an assignment, a clock, a cause code, a linked work order and a hard rule that it cannot close without a verification reading that meets criterion. The cause codes are the quiet payoff. After a year you can see that rectifier failures cluster on one manufacturer, or that a particular contractor's anode installations fail verification more often than anyone else's. None of that is visible while deficiencies live as threads in a mailbox, and both findings change how you spend money.

Should you build custom or configure what you already own?

Do not build if you operate one system with a few dozen rectifiers and a couple of hundred test points, read by the same technicians every year under a single state's rules. A vendor portal plus a disciplined spreadsheet handles that programme, and the money is better spent on remote monitoring hardware or an extra survey. We would say that on the call rather than quote for it.

Configure before commissioning. American Innovations is the most complete offering in this category and works well if you standardise on their model. MOBILTEX CorTalk, Abriox and Elecsys build strong remote monitoring hardware with capable portals. Ask each vendor in writing two things: what the platform does that you are not currently using, and whether it can produce a full historical export in a documented format. The second question matters more than the first, because it tells you what a future migration costs.

Build when the programme has outgrown a person's memory. More than roughly one hundred and fifty rectifiers or a thousand test points. Hardware from more than two manufacturers already in the ground. Operations across state lines and therefore across rule sets. Asset lists left disagreeing with the geographic information system by acquisitions. Or corrosion data that needs to feed replacement prioritisation rather than only compliance reporting. The real threshold is when proving compliance costs more effort than achieving it.

How do hidden costs get into the quote?

The compliance logic is not what moves the number. These are.

• Each telemetry vendor. Every manufacturer is a real adapter with its own authentication, sampling semantics and failure behaviour, so four vendors is not one integration.
• Asset to map reconciliation. On a system that has been through acquisitions, establishing which test station protects which segment is investigation measured in weeks and it is the item most often underestimated.
• Offline field capture. An application that survives a day in a truck with no signal costs more than one that assumes coverage, and skipping it means technicians keep using paper.
• Close interval survey data. Large coordinate aligned datasets with their own interpretation rules are a separate workstream, not a feature of the reading model.
• Work management integration. Reconciling corrosion assets with the identifiers in Maximo or Cityworks is its own reconciliation before any interface is built.
• Historical import depth. Loading values is cheap. Loading them with defensible provenance, or marking honestly where provenance is missing, is not.

What separates a corrosion control build that works from one that fails?

Ask a prospective developer to explain the difference between an on potential and an instant off reading, and why the system must store both without converting one into the other. If a reading is a single number in their model, the database will fail its first audit question.

Ask how they will model the interval rule. The right answer involves a per asset rule carrying both a count constraint and a maximum gap, with a last legal date that route planning is driven from. Anything that starts with a monthly schedule is a calendar rather than a compliance system.

Ask what they have integrated by name: a vendor telemetry interface, an Esri geodatabase, a work management system and an offline field application are four different problems.

Then settle ownership before kickoff, covering the repository, the cloud accounts and the vendor credentials. Records of these tests must be retained for as long as the pipeline remains in service under 192.491, which for buried steel is effectively permanent, so your history must never sit anywhere you cannot reach without a renewal. Successful builds also start narrow: rectifiers and critical bonds only, which carry the tightest interval on the smallest asset count and produce most of the year end risk.