Corridor Guard: Validated DC Interference Assessment and Mitigation for Every Gas Pipeline Near the Electrode Station

Electrode Current Can Strip a Pipeline's Protection

Direct current returning through the ground from a high-voltage direct current electrode station shifts pipe-to-soil potentials on nearby gas pipelines, and no one in the operation can currently show where that shift breaches the cathodic protection criterion.

The abstract posed the question as one of proof: where, along the corridor, does the ground return current breach protection, and who can show it. This chapter establishes why that proof matters, what answering it requires, and the ground the operation stands on.

1.1  The Question, the Data and the Regimes

The operation needs one question answered: along which sections of its transmission and distribution gas pipelines, within 1000 m of the direct current electrode station, does interference from the ground return shift pipe-to-soil potential far enough to breach the cathodic protection criterion of -0.85 V measured against a copper-copper sulfate reference electrode. Answering it requires data the operation already holds in fragments: pipeline alignments and depths, which reach 30 ft in the corridor; coating condition per section; layered soil resistivity along the route; test point potentials with their coordinates; insulating joint locations and condition; anode bed geometry and outputs; and the direct current system's configuration, from its ±500 kV main line and 66 kV electrode line to its 1300 A per pole rating and its 5 to 7 kA fault current limit.

Three regimes govern the answer. The national gas regulator's licensing conditions impose record-keeping and integrity duties on buried pipelines, and corrosion control is a codified duty in mature pipeline safety regimes, with a dedicated regulatory subpart for it (ECFR n.d.). The tender itself is a regime: it fixes a three-month completion, releases payment only after the final report, and makes every data error the contractor's cost. The contract is governed by the laws of Pakistan, and a national cloud first policy for federal public sector corporations constrains where the data and the compute may sit.

1.2  What the Failure Costs

External corrosion is not a marginal failure mode. A book chapter published by ASM International reports that 36 percent of oil and natural gas pipeline accidents were caused by external corrosion (EXA 2006), and a statistical analysis of reportable onshore accidents in the United States between 2010 and 2021 attributes a persistent share of them to external corrosion specifically (Plusstd 2022). Corrosion is encountered across many stages of the industry, pipelines and refineries alike, rather than at a single point (Corrosion 2020). When it goes critical the outcome can be fatal: the National Transportation Safety Board determined that a fatal natural gas pipeline rupture in New Mexico in August 2000 was caused by corrosion (Ehstoday 2000). Interference-driven under-protection moves a healthy pipeline into exactly this population, silently, while every survey reading still looks like protection.

1.3  The Operation as a Scenario

The operator runs transmission and distribution gas pipelines across its service area, including an 8 inch line and a 10 inch loop line tied in after commissioning, both buried at depths up to 30 ft and both crossing or lying near the corridor within 1000 m of the electrode station. Cathodic protection comes from thermoelectric generator units feeding high silicon cast iron anode beds at test points MP-3.40 and MP-6.97, both installed in 2025, with insulating joints at chainage zero on both lines; the 8 inch joint is recorded as shorted and the 10 inch as intact, both subject to field verification. The interference source is a bipolar direct current transmission system: a main line at ±500 kV, an electrode line at 66 kV, rated up to 1300 MW with 1300 A per pole, returning up to 1.3 kA through the ground under monopolar operation, with converter blocking under 20 ms and fault current limited to 5 to 7 kA.

Two named roles sit in the loop: the Executive Engineer accountable for corrosion control, and certified inspectors, with a certified Level 4 cathodic protection expert mandatory under the tender's eligibility clauses. The physical environments are a buried pipeline corridor in layered soil, the electrode station switchyard, and the operator's own facility that hosts the study compute. The counts that scope the design: two named source systems, the operator's data package and the direct current system's configuration record; two named roles; and three places, the corridor, the electrode station and the estate facility.

Every Supplied Record Sees One Slice of the Corridor

The pipeline data package, the direct current system configuration, the coating and soil reports and the cathodic protection survey records each describe one fragment of the same corridor, and none of them can be joined today because none carries provenance.

Chapter 1 fixed the question and the corridor it applies to. This chapter walks the records the tender supplies, family by family, and shows that none of them, alone or together, can answer that question today.

2.1  One Record, One Slice

The operator's data package sees the geometry: every pipeline crossing or lying near the direct current line, the electrode station and converter station, the initial assessment report, the layouts, and the electrode geometry, including the 75 mm by 1200 mm high silicon iron electrode elements and their roughly six cubic meter coke beds behind 0.02 ohm-meter backfill. What it misses is any statement of where each value came from: the package is scanned paper and PDFs, and no attribute in it is marked measured, inherited, assumed or unknown.

The direct current system's configuration record sees the electrical machine: the bipolar rating, the per-pole current, the fault current limits, the converter blocking behavior and its operating states, bipolar operation without electrode current, monopolar return at 1.3 kA, blocked converter, backup protection interrupt. It misses the ground between its electrodes and the operator's steel: it holds no soil measurement and no pipe reading.

The coating condition reports see the state of the coating per section; they miss the soil aggressiveness around it and the test points it is meant to protect. The soil investigation reports see resistivity values and survey dates per route section; they miss layering continuity, and the tender quotes a single backfill value against ground described as layered and variable from region to region. The cathodic protection survey records see pipe-to-soil potentials at named test points; they miss which part of any reading is protection and which part is interference. The insulating joint records see locations and as-found condition, including one joint recorded as shorted; they miss whether that condition still holds in the ground today.

2.2  What None of Them See Together

No record joins a test point reading to the coating state, the soil layer, the joint condition and the direct current operating mode prevailing when the reading was taken. Figure 2 sets the six record families side by side and shows them converging on the question none can answer. The cost in practice is a provenance failure with a price attached: an assumed resistivity silently calibrates the model, a safe distance computed from it cannot be defended, and the tender makes every data error the contractor's cost while the completion window stays fixed. This is why the design treats provenance capture as the first deliverable rather than a documentation afterthought.

Data Error Costs and Deadlines Shape Everything Downstream

The governing clauses make every data error the contractor's cost, fix a short completion window, release payment only after the final report and keep all compiled records as the procuring agency's absolute property, so the design must spend validation effort first.

Chapter 2 ended on records that cannot be joined because none carries provenance. This chapter turns that gap into design goals anchored to the tender's own clauses, and then states what the design deliberately does not do.

3.1  Prove Every Input Before It Models Anything

The first goal is a validation register that carries provenance, measured, inherited, assumed or unknown, on every attribute before any model consumes it. The industry makes this hard: the supplied records are scanned paper and PDFs that may be incomplete, illegible or simply wrong, and the tender makes every data error found during verification the contractor's cost. The design therefore specifies two-keyer capture with reconciliation for every digitised value, corridor-specific four-pin soil resistivity measurements in the first phase, and routing of every discrepancy to the operator's corrosion control engineer before modeling starts.

3.2  Spend the Schedule Where the Risk Sits

The second goal is to spend schedule risk early. The completion window is fixed at three months and payment is released only after the final report, so a data problem discovered late collapses the schedule with no payment recourse. The design runs three gated phases, data validation, dc modeling and simulation, then mitigation strategy and handover, each with item counts and dated exit criteria, so validation and calibration risk is spent down in the first two phases rather than discovered in the third.

3.3  Keep the Data and the Model Inside the Estate

The third goal is residency. The pipeline route data is critical-infrastructure data, the tender makes all compiled records and software the procuring agency's absolute property, the national regulator's statute imposes confidentiality that bars consultant-side reuse, and the cloud first policy for federal public sector corporations constrains where compute may sit. The design therefore runs everything on one server-class host inside the operator's own estate and hands over the re-runnable model on the operator's own hardware, with no consultant-side copy surviving handover.

3.4  Model with Validated Software Against a Calibrated Field

The fourth goal is a calibrated model in validated software. The tender requires industry-recognized electromagnetic or grounding modeling software and scores modeling without software support lower, yet the monopolar 1.3 kA events that drive the worst interference are rare and short, so no measured interference event exists to validate against. The design calibrates against bipolar-baseline field readings, models the monopolar and fault cases as a conservative envelope, carries the layered soil into the model as separate regions rather than one bulk value, and states the validation basis and its limits explicitly in the report.

3.5  Scoping Decisions and Their Costs

Two further decisions trade capability for certainty, and Table 1 states what each buys and what it costs.

3.6  What the Design Chose Against

The design also refused several easier paths, and Table 2 records each refusal with its reason, ending with the boundary of the study itself.

One Lightweight Stack Runs From Records to Deliverables

A study that consumes a fixed document package needs one adapter family, one governed register, one site-tier server and validated modelling software, and it deliberately needs no streaming backbone, historian, orchestrator or field compute.

Chapter 3 fixed the constraints: the study consumes a fixed document package, runs inside the operator's estate, leaves every decision to a named person and must close against dated gates. This chapter shapes the smallest stack those constraints allow and names what it deliberately leaves out.

4.1  The Architectural Pattern and Why It Fits

The pattern is a narrow hourglass. Systems of record sit at the bottom and stay untouched: the operator's pipeline records, its cathodic protection surveys and its coating and soil reports remain where they live, and the tender's own data clauses govern how they are furnished. In the middle sits one object model, the validation register's fifteen typed objects, which is the only thing every application reads and every finding writes into. Above it live the applications and agents: the validated modelling software, six services and three surfaces. The pattern fits because the coupling the study needs is exactly one register. With the object model as the sole meeting point, the parser, the field crews and the modelling engineer proceed independently, and the register can be handed over as part of the deliverable without untangling a single system integration. Figure 3 shows the layered stack with its counts per layer: two sources, one adapter family, fifteen objects, six services, three surfaces and one model on a single site-tier server.

The stack is as notable for what it omits as for what it contains. No event streaming and messaging exists, because the study consumes a furnished document package, not live streams. No historian is built, because field readings are a finite, keyed set and the operator's own records remain the system of record. No video ingest exists, because the tender carries no imaging duty and the physical world here is sensed by electrical measurement rather than imaging. No container orchestration is justified for two long-running workloads on one host, and an orchestrator would be one more thing to hand over inside the contracted window. No edge compute is installed, because survey instruments are portable and read on site. No language model is served, because the deliverable is an engineering report authored in the mandated modelling software, with the work surface offered rather than built. One server inside the operator's estate carries everything, and no data leaves it.

4.2  The Stack Stage by Stage

Table 3 walks the stack stage by stage and names the components in each. The stages are deliberately few: where a conventional physical AI stack spreads its effort across streaming, tracking and fleet inference, this design concentrates it in the object model and one modelling environment. Each stage hands its output to the next through exactly one channel: sources reach the adapters as documents, adapters reach the object model as keyed attributes, the object model reaches inference as calibrated input, and inference reaches the services and surfaces as records whose status a person must advance.

Fifteen Objects Turn Scattered Records Into One Argument

Fifteen typed objects, from the two lines and their insulating joints through the electrode station and test points to the interference assessment and each mitigation measure, let a single query reach everything a safe-distance claim depends on.

Chapter 4 placed one object model at the center of the stack. This chapter opens that model object by object and shows what the typed links between them let a single query reach.

5.1  The Fifteen Objects and Their Links

The fifteen objects fall into three groups. The first group is the buried estate: the 8-inch line; the 10-inch loop line tied in after commissioning; the insulating joints at KP-0 where the two lines separate, with the 8-inch joint recorded as shorted and the 10-inch joint as sound, both subject to field verification; the original anode bed installed in 2000 with high silicon cast iron anodes; the thermoelectric generator unit installed in 1972 that feeds cathodic protection; the two newer anodes serving the loop line at test points MP-3.40 and MP-6.97; the CP test points that key every reading; and the cathodic protection system itself, which ties the protected sections together and carries the status vocabulary of protected, under-protected and interference detected.

The second group is the source of the interference: the high-voltage direct current transmission system, held with its bipolar rating in the gigawatt class, its electrode return at about 1.3 kA per pole, its DC fault current in the low kiloampere band and its converter blocking in tens of milliseconds, together with its electrode station, held with the element dimensions, the high silicon iron rod material, the coke bed volume, the 0.02 ohm-meter backfill resistivity and the sixty meter bed length. The system object also carries the operating state vocabulary, from bipolar operation with no electrode current through monopolar return to converter blocked, because the operating state is what decides how much current flows through the ground.

The third group is the paper trail: the soil investigation report; the detail of available data for assessment that indexes the furnished package; the DC interference assessment, with its status ladder from modelled through calibrated and reviewed to accepted; and each mitigation measure, with its own ladder from proposed through designed and priced in the bill of quantities to accepted.

Figure 4 draws every object and its typed links. What a query can reach across the links is the point. From one test point reading, a query walks to the anode feeding that section, to the generator unit powering that anode, to the insulating joint bounding the section and to the coating condition report for that chainage. From the electrode station, a query reaches the operating state that drives current through the ground, and from there to the assessment record whose safe-distance claim depends on that state. A document store can hold the same fifteen artifacts but cannot answer along those edges, because the edges, not the documents, are where the argument lives: every safe-distance claim in the final report resolves to a path through these links.

5.2  Where the Human Loop Lives and How It Is Hosted

The human loop sits at two points. The first is reconciliation at ingestion, where two-keyer disagreements and every assumed or unknown attribute route to the operator's Corrosion Control engineer before modelling starts. The second is the status ladder itself: an assessment cannot move from reviewed to accepted, and a mitigation measure cannot move from designed to priced in the bill of quantities, except through a named person's decision, and the register records who made it.

The hosting posture follows the contract rather than preference. The register and the model run on the operator's own hardware inside its estate, so data residency is settled by construction because no value crosses the boundary; as a federal public sector corporation the operator sits under the national cloud first policy, which the estate-hosted posture satisfies without exception handling. Identity is governed by the operator's existing estate controls, backed by the confidentiality the tender imposes contractually. No object carries an external link. The only write path into the register is the reconciliation stage, and the platform writes nothing back to the systems of record.

5.3  One Object in Its Recorded Form

The object below is the DC interference assessment in its recorded form, chosen because its status vocabulary is the acceptance gate the contract reads.

{
  "id": "the-line0",
  "label": "The line0",
  "kind": "asset",
  "anchored_in": "",
  "properties": [
    "Diameter 8 inch",
    "Insulating joint PFIJ Short at KP-0",
    "Coating condition report"
  ],
  "status_vocabulary": [],
  "links": [
    {
      "to": "insulating-joints-pfij",
      "label": "insulating joint"
    }
  ]
}

Every Attribute Enters the Register with Provenance Attached

One integration adapter family digitises the supplied package with two-keyer capture, labels each value measured, inherited, assumed or unknown, and routes every discrepancy to the corrosion engineer before modelling begins.

Chapter 5 showed what the register holds and who may change it. This chapter shows how anything gets into it at all, and what the adapter tier promises on the way.

6.1  The Source Systems and Their Provenance Classes

Every named source enters through the same single adapter family, and both carry the operator-supplied provenance class with a read-only direction. The first source is the operator's own data package: the tender fixes what it furnishes, namely complete detail of the pipelines crossing or lying near the power line, the electrode station and the converter station, together with the initial assessment report, the layouts and coating condition reports, the soil investigation reports and the electrode geometry. The second is the direct current system's configuration record, the stated configuration and ratings of the HVDC scheme that drive the model. No live feed to the transmission or converter operator exists, so the model relies only on what the furnished package states. Figure 5 maps each source, its provenance class and its adapter path, and the map is short by design: the data crosses as documents and coordinate tables under the tender's data clauses, not as a system interface, and any live historian tap would need change control outside this scope.

6.2  What the Adapter Tier Guarantees

The adapter tier makes five guarantees. First, it parses but never alters the originals: the parser runs as released, with no training on operator data, and every extracted value passes a human reconciliation stage before it enters the register. Second, every attribute carries a provenance label, one of measured, inherited, assumed or unknown, so a modelling engineer can see at a glance whether a value was field-verified or merely inherited from a decades-old survey. Third, critical values are captured by two independent keyers, and disagreement between them becomes a logged discrepancy rather than a silent pick. Fourth, no value is ever silently corrected: an illegible or contradictory figure stays flagged and routes to the Corrosion Control engineer before modelling begins, which matters because the contract places the cost of every data error on the consultant, and because pipeline records that quietly misstate condition have preceded corrosion-driven ruptures before (Ehstoday 2000). Fifth, the adapter emits nothing outside the estate: its output lands in the register and nowhere else.

6.3  The Event Backbone

The design builds no event backbone, and it says so deliberately. There is nothing to order across streams: each reading is keyed to its test point, its date and its crew by the register itself, which is the only ordering the analysis claims. Delivery is a one-way document handover under the tender's data clauses, so there is no delivery guarantee to honour, no buffering to size and no replay semantics to reason about. Replication reduces to the handover media the contract names: two hard copies, one electronic copy and the versioned, re-runnable model package, the only artefact whose copies must be provably identical. Where a streaming design would spend its effort on ordering and replay, this design spends it on provenance, because inside the contract's fixed completion window the expensive failure is not a lost event but an untraceable number.

All Modelling Runs Inside the Operator's Own Estate

The parser and the interference model both live on one site-tier server inside the operator's boundary, so no corridor data crosses any network edge and the handover package runs where the data already sits.

Chapter 6 closed the only way in: the operator's data package passes through one integration adapter into the provenance-carrying register, and the platform writes nothing back to any system of record. This chapter places the compute that reads that register and runs the interference physics, and fixes the boundary both sit behind.

7.1  One Tier, One Host, One Boundary

Figure 6 shows the whole inference placement, and it is deliberately short: one tier, no edge nodes, no cloud region and no field hardware. A single server-class host stands inside the operator's own facility on existing power and cooling, and carries both long-running workloads: the document parser that turns scanned records into register entries, and the validated dc interference model that turns register values into safe-distance findings. The contract fixes this shape twice over: the package crosses as documents rather than as a system interface, and all compiled records and software become the procuring agency's absolute property, so a consultant-side copy would breach the property clause as well as the national cloud-first policy that binds a federal public sector corporation.

The memory arithmetic is small and stated exactly. The parser, PaddleOCR-VL 1.6, runs in bf16 precision at about 0.9 billion parameters: about 1.9 GB of weights at 16-bit, with reduced forms of about 1 GB at 8-bit and about 0.5 GB at 4-bit held as fallback. The host is sized by the 48 GB PCIe inference GPU class: parser weights occupy under 2 GB of the card, and the balance is the working budget for the commercial solver's meshed runs and for concurrent parser sessions. That balance, not sequence length, is the sizing rule the design stands on. The kv cache, the per-token working memory a language model holds against its context, never becomes the binding constraint: the parser reads one scanned page at a time under a short context, so cache demand does not scale with the corridor and the card's capacity is spent on solver memory instead.

7.2  The Latency Budget

No latency-sensitive path exists anywhere in this design. Nothing moves, nothing is tracked, and the physics is quasi-static dc, so no inference output ever expires while it is being computed. The budget is therefore stated in working terms rather than milliseconds: parsing and two-keyer reconciliation run continuously through the first phase so the register is complete before modelling starts; solver runs are batched on the same card, sized with headroom so a calibration iteration does not queue behind a parsing batch; and the master budget is the fixed completion period the contract sets, which the phase gates consume in order, data first, calibration second, mitigation last. The only hard deadline the design recognizes is that completion period, and every earlier gate exists to keep data and calibration risk from arriving inside it.

7.3  What Crosses the Boundary, and What Happens When It Fails

What crosses the boundary is nothing, in either direction. Inputs arrive as a document handover into the estate; outputs leave as the mitigation report in two hard copies and one electronic copy, plus the versioned re-runnable model package handed over on media. No live link to the transmission system operator or the converter station exists, and the model assumes none: it runs on the stated configurations and ratings in the supplied package, so no corridor data ever crosses a network edge.

Failure therefore degrades gently. A link failure cannot stall the work, because no work depends on a link. A power failure interrupts the host, but the register is checkpointed continuously and solver runs are restartable, so an outage costs a rerun, never a record. The update path is the quiet one: the parser runs as released and is never fine-tuned on operator records, the solver runs offline under its commercial license, and any future parser upgrade is evaluated and installed inside the estate by the operator's own staff. Every state that matters lives in the register and the model package, and the operator owns both at handover.

An Open-Weight Parser Turns Scanned Records Into Model Inputs

One Apache-licensed document parser digitises the scanned surveys under a license that lets the operator hold the weights outright, while the interference physics stays in the validated commercial software the governing clauses require.

Chapter 7 fixed where inference runs: one host inside the estate, nothing crossing the boundary in either direction. This chapter fixes what runs there: one open-weight parser whose license lets the operator keep the weights outright, and the interference physics in the validated commercial software the governing clauses require.

8.1  The Model Stack

Figure 7 shows the model stack, and it is short by intent: two entries, both at the site tier, and no agentic surface anywhere. No language model serves a conversational or workforce role, because the deliverable is an engineering report authored in the mandated modelling software, and no frontier weights are specified for the same reason.

The first entry is PaddleOCR-VL 1.6, a vision-language document parsing model released under the Apache-2.0 license, and it carries the study's only neural workload. It reads about 0.9 billion parameters in bf16 precision, about 1.9 GB of weights at 16-bit, reducible to about 1 GB at 8-bit or about 0.5 GB at 4-bit if the host ever needs the headroom. Its role is fixed and narrow: digitise the operator's scanned cathodic protection survey reports, coating condition reports, layouts and soil investigation reports into register entries, with provenance attached to every attribute. It runs as released, and every value it extracts passes a two-keyer human reconciliation stage before it enters the register.

The license is the reason the choice holds. Apache-2.0 grants a perpetual, royalty-free right to use, copy, modify and distribute, with no copyleft trigger and no field-of-use restriction: the operator can hold the weights outright, keep the parser running after handover, and owe no continuing relationship to any vendor. Because the study never fine-tunes the model on operator records, no training-data obligation arises, and the weights handed over on media are the released weights.

The choice is urgent because of how the contract allocates risk: every data error found during verification is the contractor's cost, and the industry record shows what assumed values do to buried steel, from the share of pipeline accidents attributed to external corrosion (EXA 2006) to the fatal rupture the national safety board traced to corrosion on a transmission line (Ehstoday 2000). A parser that runs as released, with a human reconciliation gate in front of the register, keeps invented digits out of safety computations.

The second entry in the stack is not a neural network. The dc interference physics lives in CDEGS or COMSOL, the industry-recognized, validated electromagnetic and grounding software the governing clauses require, and the evaluation scheme scores modelling without software support lower. No open-weight model ever touches a safety calculation: the parser produces inputs, the solver produces the interference assessment, and the register is the boundary between them.

8.2  The Model and Equipment Register

Table 4 gathers every choice in the stack into one register: the models, the hardware class and its sizing rule, the sensing, the patterns the design stands on, and the ground it all runs on.

Gated Phases Spend Data Risk Before the Clock Does

Three phases with fixed item counts and dated exit gates push validation and calibration into the opening work so that no data problem survives to the final report, when payment depends on it.

Chapter 8 fixed the model, its license and the host it runs on. This chapter fixes the order of work: which items are produced in which phase, what each phase must prove before the next opens, what the rollout measures while it runs, and where the honest risks sit.

9.1  Three Phases with Fixed Item Counts and Dated Exit Gates

The rollout runs as three phases carrying fifteen items in total: six in Phase 1 Data Validation, four in Phase 2 DC Modelling & Simulation and five in Phase 3 Mitigation Strategy and Handover. Figure 8 shows the phases, their gates and the requirement coverage in one view. Phase 1 runs four workstreams together: Data Validation, Field Verification, HSE & Site Compliance and Delivery & Handover. Phase 2 concentrates on DC Modelling & Simulation. Phase 3 combines Mitigation Strategy & BOQ, the priced bill of quantities the operator would tender against, with Delivery & Handover. Each phase closes on a dated exit gate fixed at the start, so slippage is visible when it happens rather than at the end. Phase 1 exits when three things hold: the validation register is complete with a provenance value (measured, inherited, assumed or unknown) on every attribute, every discrepancy is closed with the operator's Corrosion Control engineer, and field verification of the corridors within 1000 m of the electrode station is done. Phase 2 exits when the DC interference model is calibrated against bipolar-baseline pipe-to-soil readings and the safe-distance assessment has been reviewed and accepted. Phase 3 exits when the mitigation strategy and its bill of quantities are accepted and the re-runnable model has been handed over on the operator's own hardware. Requirement coverage is registered explicitly: 31 tender requirements map to named design elements with none left partial, and the remainder are bid-eligibility and contract-administration clauses that sit outside the technical baseline. The clock is the contract's own: the tender fixes a three-month completion and releases payment only after the final report, which is precisely why the gates are dated and front-loaded, because a data problem found after the final report has no schedule or payment recourse at all.

9.2  What the Rollout Measures

Two measurements carry the proof. The first is pipe-to-soil DC potential at the corridor test points, read in volts against a copper-copper sulfate reference electrode, the standard half-cell for buried-pipeline surveys. The protective criterion is -0.85 V against that electrode: a reading below it means the pipeline is under-protected and the cathodic protection system has lost margin, while a positive shift means external current is pushing the pipe's potential and interference is live. The second is the DC interference potential shift itself, evaluated for the 1.3 kA monopolar return of the HVDC electrode system, the operating state in which return current flows through the ground and the electrode station instead of the paired conductor. Every field reading is keyed to its test point, date and crew in the validation register, so each measurement stays traceable to the reading that calibrates or tests the model.

9.3  Failure Modes

The design names its failure modes before work starts and attaches a response to each; Table 5 lists them.

9.4  Lessons

Provenance is the cheapest insurance the schedule can buy. Corrosion has caused fatal pipeline ruptures where protection and the records behind it failed (Ehstoday 2000), and external corrosion remains a leading cause of reportable onshore pipeline accidents (Plusstd 2022). The design spends its first phase making every number traceable before any model consumes it, because an assumed value that persists silently into a safety computation is the failure both records describe. Calibrate against what can be measured and envelope what cannot. A rare, short monopolar return will not oblige the schedule by occurring on cue, and the design says so openly: bipolar baseline for calibration, a conservative envelope for the monopolar and fault cases, limits stated in the report. A stated limit is defensible; a hidden one is not. The staffing table is a bid gate, not a formality. Certification is a disqualification trigger and evaluation marks ride on the certified people as much as on the method, so the personnel are confirmed and documented before submission rather than assumed into existence afterwards.

9.5  What Is Still Open

Three questions stay open. First, whether a monopolar return occurs during the study window: if one does, the model gains an event-verified validation case and the envelope assumption can be relaxed; if not, the envelope stands with its stated limits. Second, whether the 8-inch line's insulating joint recorded as short at KP-0 is actually shorted: field verification settles it, and the answer changes the boundary condition the model applies at that joint. Third, whether the four-pin survey resolution is deep enough to fix the layered soil structure: if it is not, additional borehole resistivity data would be required and the model's soil regions would be redefined before calibration. Settling each question changes a model input or a validation claim, which is why each is named now rather than left to surface later.

The Intelligence Should Stay with the Pipeline's Owner

The object model, the validation register, the re-runnable model and every compiled record belong on the operator's own hardware under its own controls, with the public-sector cloud policy and the absolute-property clause making that the only defensible posture.

Chapter 9 sequenced the work and named its gates. This chapter settles who keeps what the work produces, and on whose hardware.

10.1  What the Operator Owns, and Where It Sits

The object model, fifteen objects with their typed links, lives in the validation register inside the operator's own estate, and the contract's absolute-property clause makes every compiled record and every piece of study software the procuring agency's property, so ownership was never in question; location was. The register, the discrepancy log and the re-runnable model all sit on one server-class host inside the operator's facility, consistent with the public-sector cloud policy that binds a federal corporation of this kind, and no data crosses the estate boundary at any point in the study. The weights carry the smallest possible burden: no model is trained on the operator's data, the document parser runs as released under its Apache-2.0 license, and that license places no restriction stopping the operator from holding, rerunning and archiving the weights on its own hardware indefinitely. There is no fine-tune to govern and no vendor entitlement to renew. The decision record is the register itself: every provenance value, every reconciliation and every discrepancy closed by the named Corrosion Control engineer is kept, so the next decision, whether a future integrity assessment or a mitigation redesign, reads the record instead of repeating the argument. The boundary is the last owned thing: the reuse bar written into the data agreement, the handover on media, and the rule that no consultant-side copy survives the handover.

10.2  The Offer Behind the Design

This design is CodeNinja's work in shape as much as in substance. Hyper Ontology is the object model: fifteen objects and their typed links turning pipelines, anode beds, electrode stations and assessment records into one queryable argument. Decision Systems is the reconciliation discipline: provenance, discrepancy routing and safe-distance recommendations that a named Corrosion Control engineer accepts or rejects. Sovereign Infrastructure is the hosting posture: the operator's own hardware, an open-weight Apache-2.0 parser and an in-country estate that nothing leaves. Praxis is the platform that produced the design, and the chapter that follows traces every choice it made back to what justified it.

Every Safe Distance Ships With Its Evidence

Corridor Guard is one disciplined argument: scanned records enter through a single adapter into a provenance-carrying register, corridors are verified in the field before any number is trusted, a calibrated interference model turns that verified data into safe distances and a priced mitigation strategy, and the whole chain, parser, register and re-runnable model, stays inside the operator's estate where the governing clauses already say it belongs.

Running the same shape elsewhere asks for little: a boundary that fixes what data exists, a register that attaches provenance to every attribute it accepts, field verification before modelling, a calibrated model in software the industry already validates, and gates that spend data risk early because payment and credibility both arrive only at the end.

How Praxis Contextualized and Reasoned This Design

Every choice in this paper traces back to recorded reading: this chapter shows the ask as Praxis framed it, the records in the room, the eight lenses and the patterns adopted and set aside.

Chapter 10 settled who keeps what the design builds. This closing chapter shows how the design was reasoned in the first place: what Praxis was given, which lenses it read through and where the reasoning landed. Every design in the Vertical-Driven Architectures series is produced on CodeNinja Praxis, the design team platform for designing physical AI systems, and this chapter exists so a reader can trace any choice in the paper back to what justified it. Figure 9 shows the reasoning in one view: the ask as Praxis framed it, the records that were in the room, the eight lenses, the patterns adopted and set aside, and the equipment classes the reasoning landed on.

11.1  The Ask, the Family and What Was in the Room

The ask is a public tender from the Corrosion Control department of an oil and gas operator in Pakistan: data validation, modelling and a mitigation design against the interference that a high-voltage direct current transmission system's electrode ground current imposes on the operator's transmission and distribution gas pipelines. Praxis assigned the design to the Physical AI family and to oil and gas, because the tender's own subject matter places the work on a Pakistani gas utility's buried pipeline network, where the physics is electrochemical and the assets are fixed and buried. What was in the room: 1,289 records were listed, 118 were read in full and 1,171 were available on demand. The tender document itself, its terms of reference, its data annexures and its evaluation schedule were read in full; the sector precedents and the regulatory record were read as far as the design needed them.

11.2  The Eight Lenses

Praxis reads every design through eight lenses, and Table 6 records what each could see, how many times each was cited in the recorded reasoning and what each contributed. Six lenses returned recorded material; one, domain fusion, returned nothing and is recorded as a gap: no reference architecture was assigned to this design, so the domain brief is the only fusion input and the design proceeds on it alone.

11.3  Patterns Adopted and Set Aside

The recorded reasoning adopted one pattern and set a family of them aside. The adopted pattern is the validation-first, gate-exit phase shape: prove the data before the model, and date every gate. The set-aside family is longer: event streaming, a platform-scale graph store, telemetry storage, video ingest, edge model serving, on-site language model serving, object tracking, container orchestration, a model registry, labelling and retraining, distributed time synchronisation, observability of a running service and a frontier inference cluster. Each was considered against a stated duty and found to have none: the study consumes a document package rather than live streams, nothing moves or is tracked, two long-running workloads share one host, and no model is trained on the operator's data. Setting them aside is itself a design decision, because each one would have been another thing to hand over inside a fixed schedule.

11.4  Where the Reasoning Lands

The equipment conclusion is deliberately thin: one server-class host in the 48 GB PCIe inference GPU class inside the operator's estate, running the document parser and serving the re-runnable interference model, and no field-installed compute at all, because the sensing is electrical measurement at cathodic protection test points and the survey instruments are portable and read on site. No hazardous-area equipment is specified because nothing in this design energises the field. That thinness is the point of the chapter: every element in this paper, from the fifteen objects to the single hardware class to the one model and its Apache-2.0 license, was recorded reading, and nothing is inferred.