What Passivation Is and When It Matters

Why this matters

Most of the metal in most water systems survives because of a film a few molecules thick. Not because stainless steel is inert, not because copper is noble enough on its own, and not because the treatment chemistry is holding back the water by force. The film does the work, the conditions in the water decide whether the film forms and stays, and almost every localised water-side failure in a system that looked fine is the story of that film being broken somewhere small and not repairing. Understanding it changes what you do at commissioning, what you tell a customer about leaving a system idle, and why a pinhole appears at one weld while forty feet of identical pipe is untouched.

What passivation is not

It is not a coating. Nothing is added to the wall. The film is the metal's own oxide, grown from the surface, and it is thin enough that a passivated surface and an unpassivated one look identical.

It is not cleaning, though it cannot happen without it. Cleaning removes oil, embedded iron, heat tint and deposit. Passivation is what the clean surface then does in the right conditions. Confusing the two is why a system gets scrubbed, signed off, and pits anyway.

It is not permanent, and it is not a one-time service. A passive film is maintained by the water it sits in. Change the water, stop the flow, or put a deposit over it, and the same surface that was protected last month is not protected this month.

It is not the same requirement for every metal in the building. This is the part that catches people, and it is the load-bearing idea on this card: the conditions that maintain the film on one metal actively destroy it on another, and most systems contain both.

And it is not verifiable by eye. Bright metal is not passive metal, and a dull surface is not necessarily a bare one.

What a passive film actually is

Metal in water wants to oxidise. On a few metals the first oxide formed is dense, adherent and non-porous, so it separates the metal from the water and the reaction slows by orders of magnitude rather than continuing at its initial rate. That is passivity. On other metals the first oxide is loose and porous, water reaches fresh metal through it, and the reaction continues at a roughly steady rate, which is ordinary rusting.

Two properties matter in the field. A passive film is self-repairing where the conditions that formed it still hold, so a scratch heals. And it is locally destructible, so an attack that gets through it in one spot concentrates there, because the surrounding passive surface acts as a large cathode against a small anode. That geometry is why passive metals fail by pitting and cracking rather than by general thinning, and why a stainless system can be in excellent condition everywhere except the one place it leaks.

The conditions differ by metal, and two of them are opposites

Read the first two rows together. Stainless steel needs oxygen to form and repair its film. Carbon steel in a closed loop needs the absence of oxygen to hold magnetite. A building that contains both, which is most buildings, is not asking for one water condition, and the resolution is not to compromise the chemistry: it is that carbon steel in a closed system is protected by removing oxygen and by inhibitor, while stainless is protected by keeping the water moving, keeping chloride within the limits of the grade, and keeping deposits off the surface.

Two rows carry conditions that are easy to state one step too wide. The galvanized entry is a temperature and chemistry effect together: in some water chemistries above roughly 140 F, the polarity between zinc and steel can reverse so the zinc stops protecting and the steel starts pitting, and whether that happens depends on carbonate, nitrate and oxygen levels as much as on the temperature. Below that range zinc is normally the sacrificial partner, but soft or carbon-dioxide-rich water attacks the zinc directly whatever the polarity, so the temperature rule is a necessary condition and not a sufficient one. The aluminium entry is what makes an alkaline cleaner chosen for steel a hazard to an aluminium component in the same circuit, and it applies to both ends of the pH scale rather than only to acid.

What breaks a film

Chloride breaks the passive film on stainless locally rather than generally, producing pits and, where tensile stress and elevated temperature are also present, stress corrosion cracking on the common austenitic grades. All three terms are needed for cracking, so inspect the hot, stressed, chloride-bearing location rather than the cold run.

Stagnation is the underrated one. Still water goes oxygen-depleted under any deposit, and a stainless surface starved of oxygen cannot repair its film. An idle line is more dangerous than a busy one, and the length of a construction delay is a corrosion variable.

Deposits and crevices make the same oxygen-depleted geometry: under a gasket, in a threaded joint, beneath a settled solid.

Weld heat tint is specific, common and preventable. The coloured oxide left on a weld and its heat-affected zone inside a pipe welded without purge gas is chromium-depleted, so that band is not passive when the rest of the pipe is. It is the most likely place for a stainless water line to fail first.

Embedded free iron from carbon steel tooling, grinding dust, wire brushes or bench contact rusts on a stainless surface and starts local attack, which is why stainless fabrication keeps dedicated tooling.

Worked case: a pinhole at a weld in a stainless recirculation line

A stainless domestic hot water recirculation line developed a weeping pinhole at a weld eleven months after handover. Nowhere else on the run showed anything.

The facts on hand: recirculation setpoint 140 F; supply chloride 90 mg/L; welds made in the field without an inside purge; and a construction delay that left the system hydrostatically tested with untreated municipal water and standing full and unmoving for about six weeks before it went into service.

Work the candidates against the evidence, not the reverse.

General corrosivity of the water would produce thinning across the run, weighted toward the hottest sections, not one hole in an otherwise sound line. The evidence is a single location, so it is out as the cause even if the water is aggressive.

Erosion shows up downstream of restrictions, at elbows and tees, with directional undercutting and a polished look. This failure is at a weld on a straight section, so the geometry does not fit.

Chloride stress corrosion cracking is a real candidate at 90 mg/L chloride, 140 F and residual welding stress, but its signature is branched cracking rather than a round hole, and this was a perforation.

Localised attack at chromium-depleted heat tint fits everything: the location is the one place on the line with a non-passive band, the six weeks of stagnant untreated water is exactly the condition under which a non-passive band cannot recover, and the chloride and the temperature supply the aggressiveness. That is the finding, and the reason the rest of the line is fine is that the rest of the line is passive.

The corrective work follows from the mechanism. Remove the heat tint and free iron from the affected joints, mechanically or chemically per the applicable standard, restore passivity per a recognised procedure, and purge future welds. Being a potable line, three consequences follow the chemistry off the job. Spent pickling solution carries fluoride and nitrate and goes to licensed collection unless the sewer authority states a limit it can be neutralised to. The line is rinsed to a verified endpoint and then disinfected and returned to service under the adopted plumbing code before any fixture is released. And purging displaces air, so an inert purge inside pipe in a plant room or shaft is an asphyxiation route needing ventilation and, where the space qualifies, the entry controls of 29 CFR 1910.146. The same six weeks also did something this article is not about: a potable line held full, warm and unmoving is a biological finding as well as a corrosion one, and the return to service belongs under a water management programme following ASHRAE Standard 188. Then fix what let it develop: do not leave a system full and unmoving, and where a construction delay is unavoidable, either drain and dry it or keep it circulating and treated.

Note what a parts-swap response would have produced. Cut out the weld, put in a new one made the same way, and the failure recurs at the new weld a year later, on schedule, with a different invoice.

Establishing passivation on a new system

On stainless, the sequence is clean, remove free iron and heat tint, passivate to a recognised procedure, verify. ASTM A380 covers cleaning, descaling and passivation of stainless parts, equipment and systems; ASTM A967 covers the chemical treatments themselves. Where a system is specified to either, the acceptance test is part of the specification rather than an extra.

Two hazards belong in the same breath. Pickling pastes for stainless commonly contain hydrofluoric acid alongside nitric, and hydrofluoric acid penetrates skin, causes deep burns whose pain can be delayed by hours, and carries systemic toxicity: use the glove and suit materials named on that product's safety data sheet, work with the ventilation it requires because nitric acid also releases irritant oxides of nitrogen, and have its first-aid measures, including calcium gluconate gel where called for, physically present before the container is opened. Grinding or welding stainless releases hexavalent chromium, an inhalation carcinogen under 29 CFR 1910.1026, so the control is local exhaust and respiratory protection selected under a programme meeting 29 CFR 1910.134, not gloves and glasses.

On a closed carbon steel loop, passivation is not a chemical service but a run-in period: clean, fill with treated water at the supplier's target, exclude air, circulate. Magnetite forms over the following weeks and you watch it through the total iron trend, which rises while the film forms and then flattens. Iron that never flattens is not a film forming, it is metal leaving.

On copper, the film forms in service over the first weeks and very high velocity during that period impairs it, which is one reason a commissioning flush is a defined operation with an endpoint rather than water left running for days.

Verifying it without cutting the pipe

On stainless, the free iron and passivation tests in ASTM A380 give a pass or fail on an accessible surface, and a look inside an accessible weld tells you whether purging was actually done.

On a closed loop, three trends read together are the verification: total iron flattening, inhibitor residual holding flat at a known makeup volume, and a patch test whose loading falls sample over sample. Any one alone is ambiguous.

Where the answer has to be a number, corrosion coupons in a side stream, exposed for the period the treatment supplier specifies and returned for mass loss, convert the argument into a corrosion rate. It is the only measurement here that produces a value rather than a direction, and it is worth the wait where a customer needs proof rather than reassurance.

References

• ASTM A380, standard practice for cleaning, descaling and passivation of stainless steel parts, equipment and systems
• ASTM A967, standard specification for chemical passivation treatments for stainless steel parts
• OSHA 29 CFR 1910.1026, chromium (VI), and 29 CFR 1910.134, respiratory protection, for exposures created by welding or grinding stainless steel
• OSHA 29 CFR 1910.1200, hazard communication, for the safety data sheet governing pickling and passivating products, including hydrofluoric acid first-aid measures
• See related: Why a New System Needs Cleaning Before It Needs Treating; Pitting, Crevice and Uniform Corrosion