Passivation in the Pharmaceutical Industry: Why & When

In the pharmaceutical industry, passivation restores the corrosion-resistant passive layer on stainless product-contact systems – it is required after fabrication and periodically in service to prevent rouge, corrosion, and contamination. On a regulated system, it must be documented with a passivation certificate.

When passivation is required

• After fabrication and welding of new piping, tanks, and vessels
• After modifications or repairs that expose fresh metal
• Periodically in service (especially hot WFI and clean-steam systems that rouge)
• Whenever rouge or corrosion is detected

Documentation and certificates

A pharmaceutical passivation is only complete when it is proven and recorded – test results (water-break, copper sulfate, ferroxyl) and a passivation certificate the quality team can file. Paul Industries passivates to ASTM A967 and provides the documentation your audit needs.

Related: Passivation services · Passivation standards · Passivation testing · Request a quote · Passivation Certificate: What ASTM A967 and A380 Require It to Record · Passivation vs Derouging: What Each Does and When Each Is Indicated

Passivation supports cGMP compliance for product-contact equipment. Read our guide to current good manufacturing practice (cGMP).

Standards referenced: ASTM A967 · ASME BPE · ASTM A380

Passivation events across a pharmaceutical system’s life

Passivation is not a single milestone on a project schedule. It recurs, and each occasion has a different scope and a different closing document. The reference below is how we scope the work on regulated systems.

In-place passivation vs shop immersion for pharmaceutical equipment

Installed systems are passivated in place, by circulating heated solution through the loop from a temporary skid. Nothing comes apart, the plant keeps its piping, and the circuit that gets treated is the circuit that carries product. The limits are physical. High points trap air, valve pockets and instrument tees can sit unwetted, and the far end of a long run cools below the target temperature while the supply reads correctly. Those are managed by venting high points, stroking every valve during circulation, and recording temperature and concentration at the return rather than at the pump.

Shop immersion works the other way. Parts are submerged, so every surface including the exterior sees the same solution at the same temperature, rinsing is complete, and testing is straightforward because the part can be handled. The price is disassembly, transport, and reassembly, which on a welded system means cutting and rewelding joints that then need treatment themselves.

The split in practice: welded loops, tanks in place, and anything with a validated position stay in the plant and are treated in place. Removable parts, spare valve bodies, replacement spools, and components supplied loose by an OEM go into a tank, because immersion gives better coverage and a cleaner record on anything that fits in one.

Why two passivation quotations for the same loop differ

Wetted surface area and circuit volume drive the chemistry and the heat load, and neither tracks neatly with pipe footage, so a compact loop with many use point drops can outprice a longer, simpler one. Above that sit the site conditions. Whether the plant can supply heat or the contractor must bring it. How many instruments, gaskets, and diaphragms come out and go back. Whether drains and vents are where they need to be or have to be added. What the site requires for neutralization and discharge. Then the schedule: a shutdown window over a holiday weekend is not priced like a Tuesday. Last is evidence. A certificate with a rinse reading is one number, and a package with coupons, witnessed testing, and before and after borescope imagery is another.

What to require on a pharmaceutical passivation scope of work

• The ASTM A967 practice named by its nomenclature, with concentration, temperature, and contact time written into the procedure.
• Certificates of analysis for the chemicals, confirming no chloride-bearing additive is present in the formulation.
• A pre-clean step to ASTM A380 for degreasing and soil removal, because passivation chemistry does not clean a dirty surface.
• A marked-up drawing showing high points to vent, low points to drain, valves to stroke during circulation, and instruments to remove beforehand.
• Temperature and concentration logged at the return line as well as the supply, with the chart retained in the package.
• A final rinse acceptance value stated as conductivity or resistivity against the incoming feed water, with pH recorded.
• The acceptance test named in advance, with sample locations fixed rather than chosen on the day.
• Coupons of the same alloy and surface finish, installed in the circuit and tested alongside the system.
• The neutralization method and the discharge authorization, on file before the first drum is opened.
• A certificate identifying the system by tag number, the date, the practice used, every test result, and the responsible signatory, in a form quality can file against the validation package.

Frequently asked questions

What standards apply to pharmaceutical passivation?

Pharmaceutical passivation references ASTM A967 and A380 for the treatment and testing, ASME BPE for sanitary surface finish and construction Knowing which document does what prevents the most common specification error, which is naming one and meaning both. ASTM A380 is the practice covering cleaning, descaling and passivation of parts, equipment and systems, and it governs the preparation stages and in-place treatment of assembled systems. ASTM A967 is the specification for the chemical treatments themselves, defining nitric and citric classes with their concentrations, temperatures and immersion times, and listing the acceptance tests. ASME BPE governs the hygienic construction being treated, including the surface finish designations. A specification citing a chemistry without its treatment class leaves the most consequential decision to the contractor by default., and cGMP and FDA expectations for documentation. High-purity water work also ties to USP <643>, <645>, and <1231>.

Does the FDA require passivation of pharmaceutical equipment?

The FDA does not mandate a single method, but cGMP expects product-contact surfaces to be corrosion-resistant, cleanable, and non-reactive. Passivation to ASTM A967/A380 with documented testing is the accepted way to demonstrate stainless surfaces meet that expectation. This is worth understanding because it changes how the work should be documented. Since no rule prescribes passivation, an inspector does not check whether you passivated; they examine whether your product-contact surfaces are demonstrably suitable and whether you can show how you established that. A passivation certificate with no chemistry records, no temperature and dwell logs, no rinse endpoint and no named acceptance test does not answer that question. Conversely a well-documented treatment to a recognized standard answers it completely. The obligation is evidentiary rather than procedural, which is why the documentation package matters more here than in trades where a code compliance certificate is the deliverable.

What is rouging in pharmaceutical water systems?

Rouging is iron-oxide discoloration, reddish, orange, or black, that forms on stainless surfaces in high-purity and WFI systems over time. It can shed particles and contaminate product. It is managed by de-rouging and re-passivation to restore the passive film. Rouge is classified into three types and the class determines the treatment, so identifying it before selecting chemistry is the first step. Class I is migratory, originating elsewhere in the system, usually orange to red, and wipes off. Class II forms in place from the surface itself, is more adherent, and is frequently associated with chloride attack. Class III is black magnetite, forming at high temperature, typical of clean steam systems and the hottest parts of a WFI loop, and the most tenacious; it can also be abrasive and migrate into valve seats and instruments. Treating Class III with a Class I chemistry achieves little; treating Class I aggressively damages the surface unnecessarily.

How often should pharmaceutical systems be re-passivated?

It depends on the system, water quality, temperature, and rouging rate. WFI and clean-steam systems are re-passivated on a risk-based interval or when rouging appears. Paul Industries sets up de-rouging and re-passivation schedules within preventive maintenance programs. As a planning guide rather than a rule, a loop circulating at 80 degrees C or above, or one regularly sanitized with clean steam, commonly needs attention every one to three years, while an ambient purified water loop, particularly an ozonated one, may run five years or considerably longer. Neither should be used as a schedule on its own. The defensible trigger is inspection evidence: annual borescope examination compared against commissioning baseline photographs, supported by trending of conductivity, total organic carbon and periodic iron testing. That evidence is also the justification an inspector will ask for if you are challenged on why the interval is what it is.

Why does WFI equipment rouge and need passivation?

Hot, high-purity WFI and clean steam are corrosive to stainless over time, mobilizing iron and forming rouge on distribution loops and vessels. Regular passivation and re-passivation restore the chromium-rich film and control iron release into the water. The mechanism is worth stating because it explains why good stainless still rouges. Hot ultrapure water is aggressive precisely because it is pure: with almost nothing dissolved in it, it readily takes ions into solution, including iron from the passive layer. That iron then oxidizes and redeposits downstream. Higher temperature accelerates the process substantially, which is why hot WFI loops and clean steam systems rouge fastest. It is not a sign of defective material or poor workmanship; a well-built loop rouges as a normal function of temperature and time. What distinguishes a well-run system is that it is inspected and treated before rouge conceals pitting underneath it.

What documentation is needed for pharmaceutical passivation?

cGMP work requires records of chemistry, concentration, temperature, dwell time, rinse-water quality, and acceptance-test results, tied into IQ/OQ qualification. Paul Industries delivers this passivation documentation package so the work supports validation and inspection. What makes such a package actually usable is that it lets someone else reconstruct the treatment years later. Recording that a system was passivated proves nothing on its own. The chemistry and its measured concentration rather than its nominal one, the solution temperature and how it was maintained across the whole system rather than at one point, the dwell time, the rinse endpoint expressed as a water quality rather than a duration, and the acceptance test result with the method named together allow a reviewer to judge whether the treatment could have worked. Calibration records for the conductivity meter and temperature probe belong in it too, since uncalibrated instruments undermine every number.

Is citric or nitric passivation better for pharmaceutical systems?

Both meet ASTM A967. Citric is common in pharma for its lower hazard and easier in-situ handling inside facilities, while nitric remains an option per specification. Paul Industries selects based on alloy, system, and site conditions, and documents the choice.

How is passivation integrated into pharmaceutical system validation?

Passivation is performed after fabrication and welding and before or during commissioning, with its records feeding IQ/OQ. As a single-source contractor, Paul Industries passivates and validates together, so surface-condition evidence is part of the qualification package. Sequencing is the part most often got wrong, and it is unforgiving. Passivation must follow all welding including the final tie-ins, because any weld made afterwards destroys the film locally and leaves a chromium-depleted heat-affected zone exposed. It must precede sanitization and any qualification sampling. The classic and expensive error is passivating a skid or a loop before it is connected to the rest of the plant, which leaves the connecting joints as the only untreated surfaces in the system, discovered months later as corrosion at exactly those points. On a project with several contractors, this is the sequence that breaks at handovers.

What surface finish do pharmaceutical passivated surfaces need?

ASME BPE specifies sanitary surface finishes (often mechanically polished or electropolished to a defined Ra) for cleanability. Passivation follows finishing to remove free iron and stabilize the passive film; smooth, passivated surfaces resist fouling and rouging. The finish designations are worth knowing in detail because two of them share a roughness limit and behave very differently. The ASME BPE product-contact series runs SF1 to SF6: SF1, SF2 and SF3 are mechanically polished at 20, 25 and 30 microinch Ra maximum, and SF4, SF5 and SF6 are the electropolished equivalents at those same three limits. SF1 and SF4 therefore share a 20 microinch ceiling, but electropolishing preferentially dissolves iron from the surface and leaves a chromium-enriched layer, which is a corrosion property rather than a smoothness one. That is why WFI loops specify SF4 while a food-grade line is frequently well served by SF1.

Can you passivate a pharmaceutical water loop without shutting the plant down completely?

In-situ passivation still requires the loop offline and drained for cleaning, chemical dwell, and rinsing, but it avoids removing piping. Paul Industries schedules this into shutdowns or maintenance windows to minimize disruption, then tests and documents before restart. The outage duration is the number that matters for planning and it is consistently underestimated. The chemistry itself is rarely the longest step. Draining, degreasing, rinsing between stages, heating a large volume to temperature, holding the dwell and then rinsing down to a conductivity endpoint each take time roughly proportional to system volume, and the final rinse is usually the longest because its endpoint is a measured water quality rather than a fixed number of flushes. On a compendial loop, sanitization and a sampling campaign follow before water can be released, and those are governed by laboratory incubation. Plan backwards from when production needs water, not forwards from when the crew arrives.

What causes passivation to fail in pharmaceutical systems?

Incomplete cleaning, chloride exposure, embedded iron from tools, unaddressed weld heat tint, and contaminated solutions cause failures. In service, high-temperature high-purity water drives rouging. Proper cleaning, chemistry, testing, and periodic re-passivation prevent these issues. Two of those causes deserve emphasis because they account for most repeat failures. Incomplete cleaning is the leading one and the hardest to detect, since the treated system looks correct and the certificate is issued while masked areas were never reached by acid; those areas begin rusting months later and nobody can prove what happened. The defense is a water-break test before acid is introduced, which costs nothing. Chloride exposure is the second, and it frequently arrives from outside the process entirely: chlorinated cleaning products, chlorinated municipal water used for rinsing, or insulation leaching chloride onto the outside of a hot line.

Do pharmaceutical filling and formulation vessels need passivation?

Yes. Any stainless product-contact vessel, mixer, or transfer line benefits from passivation to prevent iron contamination and corrosion. Paul Industries passivates tanks, vessels, and piping across pharmaceutical formulation, filling, and process operations. Vessels raise a problem piping does not, which is proving coverage. A tank is treated either by filling, which is simple but needs a large volume of chemistry and provides no flow, or more usually by circulating through its own spray device, which uses far less solution and keeps it moving. Either way the spray device must be qualified for coverage before the chemistry is trusted, conventionally with a riboflavin test, because the surfaces most often missed are precisely the ones nobody can see: the underside of the top head, the agitator shaft and impeller, baffles, and the many small nozzles and instrument ports a process vessel carries.

How do you test passivation on pharmaceutical equipment?

Paul Industries applies ASTM A967/A380 acceptance tests such as copper sulfate, ferroxyl, and high-humidity, choosing methods that suit product-contact surfaces, and documents results. For rouging, surface swabbing and water-quality monitoring supplement the acceptance testing. Those acceptance tests answer different questions and are not interchangeable, so the choice should be specified rather than left to the contractor. Water immersion and high humidity are general corrosion-resistance checks revealing whether a surface will rust under mild exposure, and they take hours to days. Copper sulfate gives a rapid visible indication of free iron by depositing copper where iron is exposed, but it must be removed thoroughly and is unsuitable on some product-contact surfaces. Ferroxyl using potassium ferricyanide is the most sensitive for free iron but uses reagents some sites will not permit on premises. Name the test and its pass criterion in the specification.

Can passivation be done during a pharmaceutical facility shutdown?

Yes, and shutdowns are the usual window. Paul Industries performs passivation and re-passivation of WFI loops, vessels, and clean-steam systems during turnarounds, testing and documenting the work so systems return to service qualified. Sequencing within the shutdown determines whether this fits at all. Passivation has to follow every piece of mechanical work and precede sanitization and qualification sampling, which places it near the end of a window already under schedule pressure. That makes the rinse-to-endpoint phase the one most often compressed, and compressing it is a false economy: acid remaining in a dead leg or a low point reappears weeks later as a conductivity excursion that takes far longer to investigate than the rinse would have taken to finish. Booking the specialized scope when the outage dates are first set, rather than after the mechanical scope is awarded, is what protects it. Call 201-450-8280.

Who performs passivation for pharmaceutical manufacturers nationwide?

Paul Industries, a single-source cGMP process-equipment contractor, passivates pharmaceutical systems in its Virginia shop and via field crews in all 50 states, integrating passivation with fabrication, welding, and validation under one accountable party. The reason that integration matters is a specific failure mode rather than a general preference. When welding, passivation and validation sit with different parties, the plant frequently discovers during qualification that the weld map does not reconcile with the passivation certificate, or that a section was treated before the final tie-ins were made so the connecting joints were never covered. Nobody is contractually wrong in that situation and the facility absorbs the cost of resolving it. On a project where release dates are tied to production or clinical commitments, the resolution time is usually far more expensive than the rework itself.

Why is passivation important in the pharmaceutical industry?

It restores the corrosion-resistant passive layer on product-contact stainless, preventing rouge, corrosion, and contamination that would threaten product quality and compliance. The consequences are concrete rather than theoretical. Iron released into compendial water shows up as conductivity drift and as particulate; rouge provides a rough surface where biofilm establishes, which appears as intermittent bioburden excursions at specific points of use; and Class III magnetite is abrasive, migrating into valve seats, diaphragms and instruments, which produces mechanical failures that look unrelated to water quality. Left long enough, rouge conceals pitting underneath it, and at that point metal has been lost and no chemistry recovers it. Catching the problem while it is still a surface deposit rather than metal loss is the entire economic case for inspection.

When is passivation required in pharma?

After fabrication/welding, after repairs that expose fresh metal, periodically in service (especially hot WFI/clean-steam loops), and whenever rouge is found. Two further triggers are frequently overlooked. After derouging, re-passivation is mandatory rather than optional, because the chemistry that removes iron oxide also strips the protective chromium-rich film beneath it, and a system derouged without re-passivation rouges again faster than before. And after any cutting, grinding or mechanical polishing on a product-contact surface, however small, since all three expose fresh metal and embed contaminant. A single valve replacement on a compendial loop therefore reopens the requirement for that leg. Treating passivation as a commissioning activity rather than a recurring one is how plants end up with untreated sections accumulating quietly over years of modifications.

Do you get a passivation certificate?

Yes – a pharmaceutical passivation should include test results and a certificate for the quality records. Paul Industries provides both. What the certificate should contain to be useful in a quality record is specific: the system or component identified unambiguously, the standard and treatment class applied, the chemistry and measured concentration, solution temperature and how it was maintained, dwell time, rinse endpoint as a measured water quality, the acceptance test method and its result against a stated pass criterion, the date and the personnel who performed it, and calibration references for the instruments used. A certificate stating only that a system was passivated to ASTM A967 on a date is not evidence; it is an assertion, and it will not survive a reviewer asking how the result was established.

What standard is used for pharmaceutical passivation?

ASTM A967 (with ASTM A380 for cleaning), verified by water-break, copper sulfate, or ferroxyl testing. Worth adding that the water-break test sits at a different point in the sequence from the other two and is frequently skipped. It is a pre-treatment check on cleanliness: a properly degreased surface holds an unbroken continuous film of water, while one still carrying oil or handling residue lets that film retract into droplets. It is the recognized go or no-go before acid is introduced, it costs nothing, and skipping it is precisely how invisible failures happen, because acid cannot reach metal through a contaminant layer. Copper sulfate and ferroxyl are post-treatment checks for residual free iron and say nothing about whether the surface was clean to begin with.

When in a project should passivation be performed?

After all welding, grinding and mechanical work on the system is complete and after cleaning, and before the system is put into service or into qualification. Passivating before the last weld is made undoes the work at that weld.

Does a system need passivation after a repair?

Any repair that involves welding, grinding or the introduction of new material creates a surface that has not been passivated. The local area is cleaned and treated, and the extent of the treatment is decided by the extent of the work.

How does passivation interact with qualification?

It is performed and documented before the water system qualification sampling begins, because the qualification is measuring the system in its final state. Passivating partway through a qualification sampling period invalidates the data already collected.

Can passivation be validated?

The process is validated in the sense that the parameters are established, controlled and shown to produce an acceptable result by defined testing. It is a special process, because the outcome cannot be fully verified by inspecting the finished system.

How does passivation affect microbial control?

Indirectly but significantly. A passivated, smooth, corrosion-free surface gives organisms far less to adhere to than a rouged or corroded one, so passivation supports the microbial control strategy rather than being part of it.

Who witnesses passivation on a pharmaceutical project?

The manufacturer's quality or engineering representative typically witnesses key stages and reviews the records, with the extent agreed in advance. Witnessing decisions should be settled before mobilisation because they affect the schedule.

When does a pharmaceutical system need passivation?