isolated -Cr-O-Cr-mer units. As a result of the selective dissolution of Fe or Ni that occurs during primary passivation, it was reasoned that such unconnected locally passive regions could be dissolved out and that the only way of preventing this was if these incipient oxide nuclei were continuous or percolating across the alloy surface 20,22 . The percolation thresholds for bcc and fcc random solid solutions including up to the third NN, here termed p 3D c 1; 2; 3 f g I , are 0.095 and 0.061, respectively 23 . Importantly, these thresholds only set lower compositional bounds for the mole fraction of Cr required for passivation. As demonstrated below, at these thresholds, in order for primary passivation to occur, Fe or Ni would have to be selectively dissolved over depths corresponding to thousands of monolayers.

It is essential to recognize that the primary passivation process occurs on a topological or roughened surface that has evolved by electrochemical metal and chemical metal-oxide dissolution. Figure 1a is a cartoon showing the evolution of such an alloy surface and how the initial alloy composition dictates the depth of dissolution, h, required for the formation of the primary passive film. Figure 1b shows analogous results from kinetic Monte Carlo (KMC) simulations of the passive surface that developed for a bcc Fe/17-at.%-Cr alloy (Supplementary Information). As Fe is selectively dissolved, Cr enriches on the roughened surface. Metallic surface Cr atom clusters of sufficient size serve as sites for the nucleation of -Cr-O-Crmer units, and Fe atoms bridged or immediately adjacent to these mer units form an incipient mixed oxide nucleus. Since the Fe atom neighbourhood that surrounds small Cr clusters will attenuate the Gibbs free energy for mer-unit formation, the electrochemical potential to passivate a particularly sized Cr cluster will depend on its size. In principle this scenario is amenable to first-principles-based quantum calculations, but owing to the huge number of possible cluster configurations 24,25 , a complete enumeration of such alloying-cluster size effects is beyond today's computing power. Nevertheless, as shown below, clear trends emerge as a function of the number of Cr atoms in very small surface clusters.

Primary passivation evolves as the system 'looks' for mer-unit connectivity on the topological surface in the thickness direction by selectively dissolving Fe or Ni. As shown in Fig. 1, this results in a reduction of the percolation threshold on the topological surface. This argument can be elucidated within the context of percolation theory. The interlayer neighbour connectivity of Cr atoms in the thickness direction is described by the percolation correlation length, ς, which depends on the Cr atom fraction, p (ref. 26 ). The correlation length diverges as we approach the threshold according to,

where ν 3D is a scaling exponent that

Yusi Xie has a universal value of 0.878 in three dimensions (3D) 26 . This correlation length defines the depth over which Cr percolates, which by ansatz we take equal to h and set p = p c (h) to obtain the result,

, where c is a constant of order unity 27 ; p c (h) represents a series of percolation thresholds determined by the alloy composition on the two-dimensional (2D) topological surface 27 . Similar 2D-3D crossover effects have been used to explain the surface electrical conductivity of metal-insulator composites 28 .

Experiments, KMC simulations, DFT calculations and large-cell Monte Carlo renormalization group (MC-RNG) methods are used to examine the predictions and assumptions of the theory. The KMC simulations treat Cr atoms that are in clusters of sufficient extent to form -Cr-O-Cr-mer units as elemental Cr in regard to their propensity for oxidation. Since the theory only involves percolation, these simulations exclude the electronic effects related to how Fe might attenuate the Cr electronic structure and so the oxidation of variously sized Cr atom clusters.

Figure 2a shows linear sweep voltammetry (LSV) results of KMC simulations modelling the primary passivation process in Fe-Cr alloys (Supplementary Information). Owing to the finite thick ness of the cell size in the simulations, we found that the 11-at.%-Cr alloy dissolved completely prior to passivation. Figure 2b,c shows experimental LSV of Fe-Cr and Ni-Cr alloys in 0.1 M H 2 SO 4 (Methods). The behaviour of the Fe-Cr alloys containing up to 11.6 at.% Cr shows two waves, and as the Cr concentration in this alloy increases, the waves shift down in potential. Since our KMC results do not display this behaviour, we suggest that it is connected to the electronic Cr cluster size effects described above. In order to determine the charge density and h during primary passivation as a function of Cr concentration, potential step experiments were performed (Methods). A single potential for these experiments was chosen that included the peak in the passivation wave for each of the Fe-Cr and Ni-Cr compositions examined. In the case of the KMC simulations, a potential step was performed from 0.1-0.7 V to determine the charge density (Supplementary Fig. 7) and h associated with the primary passivation process. Figure 2d-f shows the results. This analysis reveals the excellent fit to the theory, in that the p 3D c 1; 2; 3 f g I values obtained are within 0.01 of the theoretical values for bcc and fcc lattices 23 .

Online inductively coupled plasma mass spectroscopy (ICPMS) was used to examine two assumptions of the model: undercutting of -Cr-O-Cr-mer units, and selective dissolution 29,30 (Methods). Figure 3a,b shows the ICPMS results for key compositions of the Fe-Cr and Ni-Cr alloys. For the Fe/9.4-at.%-Cr alloy, there is a hint of selective dissolution in the active region, but otherwise the dissolution is virtually congruent to the alloy composition. For this alloy composition, the passivation process is similar to that of elemental iron, and a good self-healing passive film is not formed. Both the Fe/14.4-at.%-Cr and Fe/20.1-at.%-Cr alloys exhibit selective Fe dissolution in the active region, and just past the peak in the potential wave, we observe substantial increases in the selective dissolution of Fe. For the Ni-Cr alloys, selective Ni dissolution initiates at potentials below the corrosion potential and continues throughout the LSV. Figure 3c,d shows results for the mass density dissolution rates converted to current densities (Methods). For all the Fe-Cr and Ni-Cr alloys, the ICPMS-evaluated current densities are larger than that observed in the corresponding LSV. This is despite the fact that the ICPMS data do not include the oxidative process associated with the formation of the stable, non-dissolved, -Cr-O-Cr-mer units and the oxidized iron or nickel incorporated in the primary passive film. We attribute these discrepancies between the electrochemical current densities and the ICPMS data to undercutting of isolated mer units. We now address the cluster size effects previously described. As the Cr composition in the alloy increases from 5 to 20 at.%, the average surface Cr cluster size changes from isolated monomers to trimers (Supplementary Table 3). DFT calculations were used to examine how the dissociative heat of adsorption of dioxygen varies with the size of surface Cr atom clusters (Supplementary Information). Figure 4 and Supplementary Fig. 8 show results for Fe, Cr and Fe-doped Cr(110) and (100) surfaces. The adsorption energy for Cr(110) is -4.25 eV, and that for Fe(110) is about 76% of this value. There is an almost linear decrease in the adsorption heat as the Fe(110) surface is doped with a monomer Cr atom to a trimer Cr cluster. For Fe(110) doped with a trimer surface cluster, the adsorption energy is already about 91% that of pure Cr. The situation for the (100) surface is similar except that the adsorption energy on Fe is only about 25% that of Cr. For the Fe(100) surface doped with a Cr trimer cluster, the adsorption energy is 78% that of Cr(100). We conclude that there is rapid convergence of the adsorption energies to that of pure Cr with increasing Cr cluster size.

Our results for Fe-Cr and Ni-Cr alloys assume that the alloys are ideal solid solutions. Importantly, almost all real alloys show some degree of non-ideality, often described in terms of the statistics of regular solutions and their tendency to short-range order or cluster 31 . To address how this would impact our theory, we performed large-cell MC-RNG calculations 32 to determine the effect of short-range order and clustering on percolation thresholds in bcc Fe-Cr alloys (Supplementary Information). In this model, the tendency towards ordering or clustering is determined by the interaction parameter, ΔE = (E Fe-Cr -1/2(E Fe-Fe + E Cr-Cr )), where E is the pairwise bond energy. Over the composition range of interest, we examine ΔE values between -0.015 to +0.015 eV. Supplementary Fig. 5 summarizes our MC-RNG results, which show that small tendencies towards ordering and clustering can have large effects on the first NN percolation threshold, p 3D c 1 f g I . For ΔE = +0.015 eV, p 3D c 1 f g I changes from the random value of 0.246 to 0.162, and in the case of short-range order, for ΔE = -0.015, p 3D c 1 f g ¼ 0:296 I . These results show that for passivation processes that depend on first NN connectivity, ordering and clustering can substantially affect the corrosion behaviour of alloys. Supplementary Fig. 6 shows KMC results for fits to our theory for Fe-Cr alloys in the case of short-range ordered and clustered alloys. We note that the differences are small because in the case of Fe-Cr alloys, passivation depends on p 3D c 1; 2; 3 f g I , which is barely affected by the small deviations from randomness considered above. However, for alloy systems showing stronger ordering or clustering, our results indicate that that these phenomena can be used as a 'knob' to tune alloy passivation behaviour.

As shown in Supplementary Fig. 10, our theory provides a quantitative path forward for designing corrosion-resistant alloys that minimizes the requisite metal dissolution for passive film formation in aqueous electrolytes. Within a range of composition, for simple binary alloys like Fe-Cr and Ni-Cr, the NN spacing is inexorably tied to the composition. However, modern alloys, currently being developed for a variety of potential applications, such as those containing multi-principal elements are different, in that the NN spacing can be separately tuned by varying the composition and number of components that do not directly contribute to passivation behaviour [11][12][13] . Additionally, in alloy systems for which passivation can be tuned to first nearest neighbours, ordering and clustering are predicted to have important effects on composition requirements for corrosion protection.

Sample preparation. Sets of Fe-Cr and Ni-Cr alloys were prepared by vacuum induction melting starting with pure elements (99.85% Fe, 99.99% Ni and 99.99% Cr; Goodfellows). Energy dispersive spectroscopy was used to confirm the alloy compositions. For electrochemical analysis, the specimens were fabricated as cylinders of 5 mm diameter by electrical discharge machining. These samples were abraded to 1,500-grit finish, sealed in quartz tubes in an atmosphere of Ar plus 5% H 2 , homogenized at 1,100 °C for 24 h and water quenched to room temperature. Immediately prior to each experiment, the specimens were polished with successively finer grades of silicon carbide paper and diamond suspension to a particle size of 1 μm.

Electrochemical measurements. LSV and chronoamperometry were performed with a Gamry series-G potentiostat at room temperature in de-aerated 0.1 M H 2 SO 4 . De-aeration was accomplished by bubbling with ultra-high purity (UHP) N 2 just prior to experiments. The specimens were mounted in the holder of a rotating disk electrode system, leaving only the cross-section in contact with the electrolyte. Platinum mesh and a mercury/mercurous-sulfate electrode were used as the counter and reference electrodes, respectively. All potentials reported are referred to the standard hydrogen electrode. Following immersion of the working electrode in the electrolyte, the air-formed oxide was cathodically reduced with a protocol of -0.76 V for 300 s, -1.26 V for 3 s and -0.76 V for 60 s. Before initiating experiments, the potential was switched to -0.36 V for 10 s when UHP N 2 was used to blow hydrogen gas bubbles from the sample surface. LSV was obtained at a scan rate of 5 mV s -1 in order to minimize possible effects connected to grain boundary dissolution that are often observed in the higher-Cr-content alloys (Supplementary Information). In order to determine the charge density required for primary passivation, chronoamperometry was conducted at 0.04 V (stepped from -0.36 V) for Fe-Cr alloys, and at 0.02 V (stepped from -0.36 V) for Ni-Cr alloys. The alloys were held at these voltages until the current density was low enough so that further hold times would not have contributed more than one percent to the charge density-that is, 100 s for Fe-Cr alloys and 400 s for Ni-Cr alloys. During these experiments, UHP N 2 flow was maintained above the solution. The current density versus time data from these experiments were numerically integrated to obtain the charge density. The number of monolayers dissolved, h, to primary passivation was determined by assuming that Cr, Fe and Ni are oxidized to valence states of +3, +2 and +2, respectively. We did not take into account any variation of lattice parameter with composition, as our inspection of this indicated that the effect was too small to be important over the Fe-Cr and Ni-Cr compositional range of interest. Accordingly, the number of layers dissolved for the Fe-Cr alloys exposing a primarily (110) bcc face to the electrolyte was evaluated according to,

where t is time, A is the area of the exposed surface, I is the magnitude of the current, C is the mole fraction of Cr, q is the elementary charge and a Fe is the lattice parameter of bcc Fe. The analogous equation for Ni-Cr alloys exposing a primarily (111) fcc face to the electrolyte was evaluated according to,

Stationary probe rotating disk electrode ICPMS. All in situ stationary probe rotating disk electrode ICPMS experiments were performed using a Perkin-Elmer NexION-350S spectrometer, equipped with a dual-detector (analogue and pulsed modes) Secondary Electron Multiplier detector 29,30 . The plasma parameters were set to 1,600 W radio frequency power, with 15.6 litres per minute (lpm) plasma flow rate and 1.0 lpm for both auxiliary and nebulizing gas. To avoid interference from ArC + and ArO + , which are isobaric to 52 Cr and 56 Fe, respectively 33 , we utilized dynamic reaction cell mode, with NH 3 as collision gas. The 48 SO species formed in the plasma due to the use of sulfuric acid electrolyte, which was used as an internal reference in all measurements. Since the extent of dissolution produces a local ion concentration on the order of parts per million, we performed a dual-detector calibration to ensure that detector response was linear in the region of overlap between pulsed and analogue signals. Calibration curves were collected before each experiment from 100 ppb up to 5 ppm with the linear regression coefficient always at a minimum of ~0.998. Data acquisition was set at four points per second. One single voltammetric scan was collected at 5 mV s -1 to monitor dissolution of Fe, Ni and Cr from the Fe-Cr and Ni-Cr alloys. A Pt counter electrode and Ag-AgCl reference electrode connected by a glass bridge were employed in all experiments. All potentials reported are referred to the standard hydrogen electrode. A fresh and clean electrolyte was used prior to each voltammetry scan to minimize accumulation of transition metal ions in the solution. The electrolyte was purged with argon for at least 45 minutes before commencing the experiment to remove any traces of dissolved oxygen in the cell. The mass dissolution rates per unit area, v (μg cm -2 s -1 ), were converted to effective current density, i, according to,

Here, M is molecule weight; F is Faraday's constant; and M Fe/Ni and v Fe/Ni refer to M Fe or M Ni and v Fe or v Ni in the case of Fe-Cr alloys or Ni-Cr alloys, respectively.