SystemAsset Integrity & Inspection

Integrity Operating Windows

Integrity operating windows software that answers each crossing with so what: which metal it fed, and whether the next inspection is still soon enough.

Replay the wash water night, then the 08:21 booking ↓
The problem

The window was crossed overnight, and nobody can say which metal it hurt

A wash water pump trips on a seal leak and the standby makes less than the limit asks. The board alarm sounds, the crew follows the critical response card, and by morning the flow is back. The historian logged hours outside the window. It did not say what those hours did to the line downstream.

Working that out means trends, the shift log, the lab sheet and the wall readings, opened days later by an engineer with hundreds of other crossings in the queue. Quiet informational limits drift for months with no alarm at all, and a feed change can outrun the windows long before anyone reviews them.

Built forCorrosion engineersIntegrity technical authoritiesShift operations leadsInspection plannersInternal auditors

The Problem Today

Monitors flag each limit crossed, but nobody has time to work out which metal it hurt and when to look.

1,360
engineer hours a year to read 340 exceedances a month our estimate

Opened one by one today

  • Trends
  • Shift logs
  • Lab sheets
  • Wall data
  • Quiet limits go unreadSlow drift adds up with no alarm and no owner
  • Feed moves, limits stayA new crude or rate quietly outruns the windows

The Solution

  1. Count the hoursEach window read against the historian, with a yearly budget of hours
  2. Tell bad from realA second meter, a balance or the lab confirms the reading first
  3. Follow it to the metalCrossing to mechanism to circuit, with the sums and their sources
  4. A person moves the dateThe engineer decides, a second person signs, the planner books

Built-in controls

  • The signer opens each piece of evidence first
  • Agents never touch the control system or a limit
  • Audit trail and evidence file for each case

What You Get

Engineers spend their time on the few cases that can hurt metal, and slow drift gets an owner.

  • Hours tied to a circuitExposure counted by window and circuit over twelve months
  • Bad readings set asideSuspect readings stay on the clock until two people agree
  • Evidence ready to exportAudit trail and case file, with who agreed and why
One exceedance, followed to the metal

Eleven hours short on wash water, from the clock to a booked crew

On a diesel hydrotreater, the wash water pump stopped on a seal leak at 18:40 and the new seal went in at 05:40. By 08:21 the inspection had moved and the crew was booked.

demoThe unit, the shift and each value shown here are sample data.

  1. 01Start of day

    11.0 hours outside, and the year's budget of 24 already gone

    Corrosion engineer

    The first screen is one trend inside its critical, standard and informational lines, with 0.0% for 12 minutes marked where the pump stopped. Beside it, the counter reads 11.0 hours this event and 30.0 hours in twelve months against 24 allowed. Underneath, four steps answer so what: what happened, what it feeds, which metal, and when to look.

  2. 0218:40 to 05:40, replayed

    Played back, the night shows the hour the yearly budget ran out

    Corrosion engineer

    The replay draws the night again. Flow falls to nothing for twelve minutes, under the 3% critical line, then sits at 3.2% on the small standby pump, under the 5% standard limit. The counter climbs and the ring turns from inside budget to used up. The engineer sees the exact hour the window's yearly allowance ran out, which no daily report shows.

  3. 0306:48

    80% of the water stayed liquid, and its salt reached 7.9 wt%

    Corrosion engineer

    One citation opens the agent's two sums line by line. The wash rate in pounds an hour, the water the gas can carry at 240 °F, then the water left as liquid: 80%, above the guide. Then the salt made from the feed's nitrogen, 1,340 lb/h, and salt in that water at 7.9 wt%, over the site's 6 wt% limit. Every figure can be checked against its source.

  4. 04Before deciding

    Eight monitoring points, all last read before the feed change

    Corrosion engineer

    The circuit sheet shows the injection point on carbon steel at 240 °F, upstream of an air cooler in a corrosion-resistant alloy. Eight monitoring points, read every three years. The thinnest, at the first elbow after the quill, reads 0.796 in against a 0.450 in minimum. Spot readings cannot see local attack, and none is newer than the feed change.

  5. 0507:02

    Six pieces of evidence, six cited steps and one honest unknown

    Corrosion engineer

    The case puts the evidence on the left: the historian, the sums, the circuit sheet, the plan, the shift note and the wall readings. In the middle, each agent's step with its source. Below, how sure they are: high that it happened, high on the mechanism, unknown whether metal was lost. That unknown is why the proposal is to look within 30 days.

  6. 0608:12

    The date and the reason are hers, and the signature is not

    Corrosion engineer

    She can take the proposed date, an earlier one, the next turnaround, or keep the plan as it stands, and a reason is required. She chooses the proposal with the reason exposure over budget and sends it on. The panel then says she made this decision, so she cannot sign it. The technical authority signs.

  7. 07After 08:12

    Opened 0 of 6, and the sign button stays grey

    Integrity technical authority

    The same case, seen by the checker. The evidence list now counts openings, and the decision panel reads opened 0 of 6 pieces of evidence beside a greyed sign button and a send back. Only opening each one turns it on. A send back clears what he opened, so a changed decision needs a fresh check.

  8. 08Before signing

    The shift lead's own words, filed before handover at 06:05

    Integrity technical authority

    Fifth of the six is the shift log. The lead wrote that the seal let go at 18:40, wash water went to zero, the board ran the critical response card, and the crew put the small spare on by hand at 18:52. It makes about 39 gpm. Maintenance had the new seal in at 05:40. The counter reads 5 of 6 opened.

  9. 0908:15

    Signed after six openings, and only then is the work order released

    Integrity technical authority

    With all six opened, the sign button turns on. He signs, and the panel records the date, the reason and who decided. The held work order goes to the inspection planner. Until this moment the inspection plan had not changed, because nothing moves there until a person decides and a second person signs.

  10. 1008:21

    The scan is booked inside the signed date, and the other two stay held

    Inspection planner

    The plan shows the injection point scan as booked, its work order and slot beside it. Two other circuits wait, held with the corrosion engineer, and their book buttons stay off. Below sit six moves signed in October. In the plan file it downloads, each unsigned row is marked not to be loaded.

Thirty hours against a budget of 24 on one wash water window

Four events in twelve months on the same window. The fourth crossed the yearly budget at 23:40.

First event7.5 h
Second event5.0 h
Third event6.5 h
The pump tripThe first 12 minutes under the critical limit11.0 h
Hours outside in twelve monthsAgainst 24 allowed30.0 h

demoSample data, from the working solution.

Beyond the one case

Suspect readings, quiet drift and the feed change nobody reviewed

The rest of the corrosion engineer's month, on the same windows.

Each IOW exceedance this month41 so far: 6 so-what cases, 5 logged, 19 cleared in time and 11 suspect. Cleared rows close in a sampled batch the technical authority signs.
Suspect readingsA moisture reading of 1.3 ppm against 0.2 ppm on a spare analyzer. Its hours stay on the clock until two people agree it was bad.
Quiet limitsInformational windows past the watch line, with hours added up over a year. The wash water window reads 1,904 hours, with nothing alarmed.
The window register1,860 windows by unit, each tied to the damage mechanism it guards and the circuit it touches, with its three limits.
Feed changesThe feed change that raised salt made from 946 to 1,340 lb/h, with its window review 51 days late and the budget cut proposed.
Audit trailFrom the alarm at 18:41 to the booking at 08:21, each agent step and each person's decision, with an audit file and a case evidence file.

demoSample data, from the working solution.

Who drafts

Integrity operating windows read by seven agents, and none sets a limit

Window watcher

Reads the historian against each window, counts hours and tracks budgets.

  • Never writes to the control system
  • Never changes a setpoint
Reading checker

Compares neighbor tags, balances, lab sheets and analyzer status.

  • Never removes hours itself
Shift explainer

Asks the shift, in plain words, what happened while they still remember.

  • Never writes a cause for a person
Damage reasoner

Reasons from the crossing to the mechanism and the circuit, cited at each step.

  • Never judges fitness for service
  • Says what it does not know
Plan drafter

Drafts the change to the inspection plan and releases a work order after signature.

  • Never changes the plan
Window reviewer

Finds the windows a feed change touched and drafts the review.

  • Never changes a limit
Evidence clerk

Builds the audit file and each case's evidence file.

  • Never edits a record

Limits, inspection dates and fitness stay with the integrity team

A limit changes only with two signaturesThe engineer proposes a new limit and its reason; the technical authority signs. Relaxing one needs a damage basis.
A suspect reading keeps its hoursThe shift lead marks a reading bad or real, and the hours leave the clock only when a batch is signed.
A case with no shift note waitsWhere an explanation is still owed, the decision on that case is blocked until the shift lead files it.
A feed rate rise waits for its reviewWhile a feed change review is unsigned, a rate rise on that unit is refused, with the reason and the owner named.
Wall and feed questions go to named peopleAsk how much wall is left, or whether feed can go up, and the assistant gives no figures: it names the technical authority and the shift lead.

Seven systems behind one IOW exceedance

Read only, except the signed work order released to the maintenance system.

Process historianEvery minute of each windowed tag
Lab systemSample results, such as separator water salt
Shift logWhat the crew wrote, in their own words
Document managementCorrosion control documents and drawings
Inspection dataWall readings and the inspection plan
Maintenance systemNotifications in, signed work orders out
Change recordsFeed and process changes that touch a window

What corrosion engineers ask about integrity operating windows

What are integrity operating windows?

Integrity operating windows are limits on process conditions that keep equipment from being damaged, such as wash water rate, pH or temperature. Each window carries a critical, standard and informational limit. This solution counts the hours outside each one and follows a crossing to the damage it feeds and the circuit it touches.

What happens after an IOW exceedance?

The agents check the reading against a second source, ask the shift what happened, and reason from the hours to the mechanism, the circuit and the inspection date. A corrosion engineer decides, an integrity technical authority opens the evidence and signs, and an inspection planner books the work.

How are critical, standard and informational limits treated?

A critical crossing needs action on the board straight away, and the case records how the crew answered it. Standard limits are about how long you stay out, so hours count against a yearly budget. Informational limits are added up quietly over months and shown once they pass a watch line.

How does it tell a bad reading from a real exceedance?

It compares neighboring tags, balances, lab results and analyzer status before anyone reads the case. A suspect reading keeps its hours on the clock until the shift lead marks it and a checker signs the batch.

Can it change our limits or the inspection plan?

No. Agents draft. A limit changes when the engineer proposes it and the technical authority signs, and it applies to new counts, while any open case on that window goes back for a fresh look. The plan moves only after a signed decision.

What happens when the feed changes?

Each change record that touches a window owes a limit review. The window reviewer drafts it with the before and after figures, and a clock runs until it is signed. Questions about whether the damage mechanism has changed go to the damage mechanism review.

Replay one of your own crossings
and follow it to the metal.

We’ll take one exceedance from your historian through the mechanism, the circuit and the date, with your team deciding.