Reads the historian against each window, counts hours and tracks budgets.
- Never writes to the control system
- Never changes a setpoint
Integrity operating windows software that answers each crossing with so what: which metal it fed, and whether the next inspection is still soon enough.
Replay the wash water night, then the 08:21 booking ↓A wash water pump trips on a seal leak and the standby makes less than the limit asks. The board alarm sounds, the crew follows the critical response card, and by morning the flow is back. The historian logged hours outside the window. It did not say what those hours did to the line downstream.
Working that out means trends, the shift log, the lab sheet and the wall readings, opened days later by an engineer with hundreds of other crossings in the queue. Quiet informational limits drift for months with no alarm at all, and a feed change can outrun the windows long before anyone reviews them.
Built forCorrosion engineersIntegrity technical authoritiesShift operations leadsInspection plannersInternal auditors
Monitors flag each limit crossed, but nobody has time to work out which metal it hurt and when to look.
Opened one by one today
Built-in controls
Engineers spend their time on the few cases that can hurt metal, and slow drift gets an owner.
On a diesel hydrotreater, the wash water pump stopped on a seal leak at 18:40 and the new seal went in at 05:40. By 08:21 the inspection had moved and the crew was booked.
demoThe unit, the shift and each value shown here are sample data.
The first screen is one trend inside its critical, standard and informational lines, with 0.0% for 12 minutes marked where the pump stopped. Beside it, the counter reads 11.0 hours this event and 30.0 hours in twelve months against 24 allowed. Underneath, four steps answer so what: what happened, what it feeds, which metal, and when to look.
The replay draws the night again. Flow falls to nothing for twelve minutes, under the 3% critical line, then sits at 3.2% on the small standby pump, under the 5% standard limit. The counter climbs and the ring turns from inside budget to used up. The engineer sees the exact hour the window's yearly allowance ran out, which no daily report shows.
One citation opens the agent's two sums line by line. The wash rate in pounds an hour, the water the gas can carry at 240 °F, then the water left as liquid: 80%, above the guide. Then the salt made from the feed's nitrogen, 1,340 lb/h, and salt in that water at 7.9 wt%, over the site's 6 wt% limit. Every figure can be checked against its source.
The circuit sheet shows the injection point on carbon steel at 240 °F, upstream of an air cooler in a corrosion-resistant alloy. Eight monitoring points, read every three years. The thinnest, at the first elbow after the quill, reads 0.796 in against a 0.450 in minimum. Spot readings cannot see local attack, and none is newer than the feed change.
The case puts the evidence on the left: the historian, the sums, the circuit sheet, the plan, the shift note and the wall readings. In the middle, each agent's step with its source. Below, how sure they are: high that it happened, high on the mechanism, unknown whether metal was lost. That unknown is why the proposal is to look within 30 days.
She can take the proposed date, an earlier one, the next turnaround, or keep the plan as it stands, and a reason is required. She chooses the proposal with the reason exposure over budget and sends it on. The panel then says she made this decision, so she cannot sign it. The technical authority signs.
The same case, seen by the checker. The evidence list now counts openings, and the decision panel reads opened 0 of 6 pieces of evidence beside a greyed sign button and a send back. Only opening each one turns it on. A send back clears what he opened, so a changed decision needs a fresh check.
Fifth of the six is the shift log. The lead wrote that the seal let go at 18:40, wash water went to zero, the board ran the critical response card, and the crew put the small spare on by hand at 18:52. It makes about 39 gpm. Maintenance had the new seal in at 05:40. The counter reads 5 of 6 opened.
With all six opened, the sign button turns on. He signs, and the panel records the date, the reason and who decided. The held work order goes to the inspection planner. Until this moment the inspection plan had not changed, because nothing moves there until a person decides and a second person signs.
The plan shows the injection point scan as booked, its work order and slot beside it. Two other circuits wait, held with the corrosion engineer, and their book buttons stay off. Below sit six moves signed in October. In the plan file it downloads, each unsigned row is marked not to be loaded.
Four events in twelve months on the same window. The fourth crossed the yearly budget at 23:40.
| First event | 7.5 h |
| Second event | 5.0 h |
| Third event | 6.5 h |
| The pump tripThe first 12 minutes under the critical limit | 11.0 h |
| Hours outside in twelve monthsAgainst 24 allowed | 30.0 h |
demoSample data, from the working solution.
The rest of the corrosion engineer's month, on the same windows.
demoSample data, from the working solution.
Reads the historian against each window, counts hours and tracks budgets.
Compares neighbor tags, balances, lab sheets and analyzer status.
Asks the shift, in plain words, what happened while they still remember.
Reasons from the crossing to the mechanism and the circuit, cited at each step.
Drafts the change to the inspection plan and releases a work order after signature.
Finds the windows a feed change touched and drafts the review.
Builds the audit file and each case's evidence file.
Read only, except the signed work order released to the maintenance system.
Integrity operating windows are limits on process conditions that keep equipment from being damaged, such as wash water rate, pH or temperature. Each window carries a critical, standard and informational limit. This solution counts the hours outside each one and follows a crossing to the damage it feeds and the circuit it touches.
The agents check the reading against a second source, ask the shift what happened, and reason from the hours to the mechanism, the circuit and the inspection date. A corrosion engineer decides, an integrity technical authority opens the evidence and signs, and an inspection planner books the work.
A critical crossing needs action on the board straight away, and the case records how the crew answered it. Standard limits are about how long you stay out, so hours count against a yearly budget. Informational limits are added up quietly over months and shown once they pass a watch line.
It compares neighboring tags, balances, lab results and analyzer status before anyone reads the case. A suspect reading keeps its hours on the clock until the shift lead marks it and a checker signs the batch.
No. Agents draft. A limit changes when the engineer proposes it and the technical authority signs, and it applies to new counts, while any open case on that window goes back for a fresh look. The plan moves only after a signed decision.
Each change record that touches a window owes a limit review. The window reviewer drafts it with the before and after figures, and a clock runs until it is signed. Questions about whether the damage mechanism has changed go to the damage mechanism review.
Decades of thickness readings on one line per point, every join signed.
1-min demoInspection Report ReviewEvery planned point checked on every report, before a reading reaches the record.
1-min demoEquipment Deficiency ManagementA job marked complete is no longer the fix: proof is.
1-min demoWe’ll take one exceedance from your historian through the mechanism, the circuit and the date, with your team deciding.