Piping
Corrosion control documents — writing down why the plant corrodes
What a CCD is for, what API 970 expects it to contain, what happens in a corrosion workshop and why the operators in the room change the answer, and why a document written once and never reopened has already failed.
A plant’s inspection programme is the answer to a question: what can damage this unit, and how would we know? The corrosion control document is where that question is answered in writing.
Without one, the reasoning exists only in the memory of whoever did the original study, and it leaves when they do.
What it is
A CCD is written per process unit, and it records — loop by loop — what the unit is made of, what runs through it, what can damage it, what drives that damage, how it is monitored and what is holding it back.
| Unit description | What the unit does, its feed and products, the process licensor and the design basis | Someone reading this in ten years needs to know what they are looking at |
|---|---|---|
| Materials of construction | The materials selection diagram, line classes, cladding and lining, and any upgrades already made | Damage mechanisms follow from the material as much as from the fluid |
| Corrosion loops | Each loop with its boundaries, the equipment and piping inside it, and a process description | It is the unit of everything else in the document |
| Damage mechanisms | Per loop, the credible mechanisms with their API 571 references, susceptibility and expected morphology | Naming the mechanism is what decides the inspection method |
| Critical process parameters | The variables that drive each mechanism — temperature, water content, chlorides, pH, velocity, sulphur | These are what to watch if you want warning before damage, not after |
| Integrity operating windows | Limits on those parameters, with the action required when one is exceeded | Turns a corrosion concern into something the control room can act on |
| Monitoring | CMLs, corrosion coupons and probes, process sampling points and their frequencies | States how the mechanism will actually be detected |
| Mitigation | Inhibitor injection, wash water, pH control, coatings, linings and cathodic protection in place | Mitigation that is assumed but not recorded gets removed by someone who does not know why it was there |
| Inspection history and incidents | Known failures, leaks and repairs in the unit, with what was found | The most reliable evidence of what actually damages this plant |
No rows match that filter.
A CCD is written per process unit, not per plant. Its value is that it records the reasoning behind the inspection programme, which otherwise lives only in the heads of the people who did the original study.
API RP 970 is the recommended practice that sets out this structure. It sits alongside API RP 571, which defines the damage mechanisms themselves, and feeds risk-based inspection, which uses them.
The distinction that makes it useful
An inspection record says this line measured 7.2 mm in March. A CCD says this line is in wet chloride service above the dew point, so it is susceptible to under-deposit attack at the cold end, which is why the CMLs are at the low points and why the sample point is monitored for chlorides.
Critical process parameters
For each mechanism the CCD names the handful of variables that drive it — water content, chloride concentration, pH, temperature, velocity, sulphur, oxygen ingress.
This is the step that converts a corrosion concern into something operable. Once you know that a mechanism runs on chlorides above a concentration, you can measure chlorides, set a limit, and act on it — which is what an integrity operating window does.
The corrosion workshop
A CCD drafted from documents is a hypothesis. The corrosion workshop is where it is tested against the people who run the plant.
Around the table: the corrosion or materials engineer who drafted it, the process engineers, the operations representatives, and the inspection engineers who hold the failure history.
The workshop output is a corrected CCD — mechanisms added, removed or re-ranked, monitoring adjusted, and the inspection methods matched to what the mechanism actually does. A mechanism that produces localised pitting is not found by a grid of thickness readings, and that correction usually happens in the room.
Mitigation is a control, and controls get removed
It has to stay current
What to take away
- A CCD records why a unit corrodes and how that is managed — the reasoning, not the readings.
- It is written per process unit, structured per API RP 970, using mechanisms defined in API RP 571.
- Critical process parameters are what make a mechanism measurable, and what integrity operating windows are then set on.
- The corrosion workshop exists because operations know things no drawing contains, and those things change which mechanisms are credible.
- Record the mitigation. Unrecorded controls get optimised away by people who cannot see what they were for.
- It is revised on MOC and after every significant finding. A CCD written once and filed has already stopped being true.
- RBI consumes the CCD. Without one, the damage mechanisms are being guessed at the keyboard.
Check your understanding
7 questions. Nothing is recorded — this is just for you.