SystemProduction Operations & Oil Sands

Operating Procedure Management

Operating procedure management software that walks each procedure on the unit drawing, finds the steps a closed change left behind, and backs the yearly signature with what the superintendent opened.

See the demo Book a demo

Follow one restart procedure from 23:40 to 09:27 ↓

The problem

The procedure says open a valve the outage cut out of the line

A change closes with an action to update procedures, and the update list names the one the engineer remembered. Three more startup and shift procedures still tell the crew to open the old valve. The crews work around the wrong line, stop mentioning it, and after a while stop trusting the book.

At year end the superintendent signs that hundreds of procedures are current and accurate. Nobody can read them all, so the signature rests on a list. Paper copies in the field shelters stay on the revision before last.

Built forProcedure ownersUnit superintendentsShift operatorsProcess safety engineersProcess safety auditors

The Problem Today

A closed change can leave an old valve in a procedure, and the yearly signature certifies it as current anyway.

Yearly: signature that each procedure is current and accurate published

Compared by hand today

Procedures
Changes
Drawings
Shift logs

Update lists miss stepsOne procedure named, three more keep the old valve
Paper stays on the shelfField copies stay on old revisions after an update

The Solution

Each step tested nightlyEach tag checked against closed changes, drawings and equipment lists
Walked on the drawingEach valve lights up, and the walk stops where book and plant disagree
The owner edits the draftAgents draft only; the live procedure stays as signed
Certify by exceptionRead startup, shutdown and emergency in full, and sample the routine

Built-in controls

A checker opens all of it before signing
A held step stops new copies and the certificate
Plant questions go to a named person, unanswered

What You Get

The yearly signature says what was read, what was only tested and what is not current.

182: superintendent hours a year reading them, at 20 minutes each our estimate

Finds what update lists missedEach procedure naming what changed, beyond those listed
Logs read, never taken as truthA different practice goes to the owner, not into the book
Evidence in one fileWho opened what, who signed, and what was left out

One stabilizer restart procedure

Operating procedure management on one restart, from the nightly test to Rev 7

An outage cut a corroded dead leg and its hand valve out of the reformer stabilizer's pump recycle. The change closed, and the restart procedure still names the old valve. Here is how it gets fixed, on the working screens of the unit.

demoThe refinery, its units, tags and people, and every count on these screens are sample data.

0123:40
Of 50 tag mentions in 34 steps, one valve is on no drawing
Procedure owner
Each night the agents test every procedure. For the stabilizer restart they read the 34 steps and 50 tag mentions, look each tag up on the current drawing and in the maintenance system, and read the closed changes on that drawing. 49 tags are found. HV-2218 is not. The shift log reader adds that 5 restarts in 14 months each name HV-2231.
0209:16
The walk stops at step 17, where the valve is a dashed ghost
Procedure owner
She presses walk it, and each valve, pump and line the steps name lights up on the drawing in step order. At step 17 it stops: the procedure says open HV-2218, which shows as a dashed ghost where the book thinks it is, while the logged valve shows amber. Four sources sit under the drawing, each with its page.
0309:16
The crew's own log says what they really do at the reboiler
Procedure owner
One click opens the log line behind the count. An operator on C Crew wrote at a restart that the procedure says HV-2218, that they used HV-2231 and opened HV-2226 first, as they all do, and that the shift supervisor was told. The agents quote the logs; a log is evidence of practice, and proves nothing about whether the practice is right.
0409:16
The agents' own draft is refused: the pump would start with no recycle
Procedure owner
The agents' draft swaps one valve name for the other and stops there. That fails the check: on the current drawing the recycle now leaves past HV-2226, so with HV-2226 shut until step 19 the pump starts with no recycle path. The agents say plainly they cannot tell whether moving the tap changes the order. That call is hers.
0509:17
Rev 7 moves the valve before the pump, and is marked not compared
Procedure owner
She rewrites steps 18 and 19 in her words: open HV-2226 slowly before the pump with the reflux line kept shut, then start the pump from the field and confirm at least 160 gpm. Her text is marked not compared, a person must read this. Only the tags are looked up; the meaning goes to two people in her exact words.
0609:21
Process safety answers the open question yes, in his own words
Process safety engineer
He cannot agree until he has opened the whole procedure, the closed change and the drawing, and each opening is recorded. Then he answers the question the agents could not: does moving the recycle tap change the step order? Yes, and this edit answers it: step 18 opens HV-2226 before the pump. A no would block Agree.
0709:24
Signing waits on one more thing: the engineer's answer, in his words
Unit superintendent
The superintendent opens the same three records. The sign button stays off, and the line under it says what is still to open: the engineer's answer. His name goes on exactly what he read, so a review he has not opened does not count. A hold he placed on this procedure stays in place until the revision is live.
0809:26
Rev 7 is live, and 648 differences become 647
Unit superintendent
He opens the answer and signs. Rev 7 goes live with steps 17 to 19 in the new order, edited by the owner and signed by the superintendent. The count at the top falls to 647. The paper copy tracker puts 3 copies on the collect list, and the crews have a new revision to read.
09Year end
The certificate counts only what he opened: 1 of 322 so far
Unit superintendent
For the annual SOP certification on Unit 22, 37 procedures wait to be opened in full: every changed one and every startup, shutdown and emergency procedure, plus a sample of 13 routine ones from a recorded draw nobody who signs chose. 238 are tested by agents and not read by a person, and 46 differ. The certificate says all four.

What 322 procedures on one unit add up to on the yearly certificate

The unit as the certificate opened, before Rev 7 went live. The superintendent signs only what he read; the rest is listed by what happened to it.

Procedures on Unit 22	Count	What the certificate says
Differ from the plant record	47	Not certified; each sits with its owner on a due date
Changed this year	12	Read in full
Startup, shutdown and emergency, unchanged	12	Read in full, and kept out of any sample
Routine, sampled from a recorded draw	13	Read in full; one failure draws 5 more, a second stops the certificate
Routine, not drawn	238	Tested by the agents; no person read them
Total	322	Each procedure on exactly one line

demoSample data, from the working solution. Even when all 13 read clean, about 21% of the routine set could still be wrong at 95% confidence, and the screen says so.

Around the unit

Where the book and the plant differ, across the refinery

The rest of what owners, operators and auditors see, after Rev 7 went live.

Differences between refinery operating procedures and the plant, by cause and unit, each with its owner and clock — **Differences by cause**290 a closed change never reached, 204 where the drawing or list disagrees, 137 where logs differ, 16 unreadable. Late items name who was told.

Closed management of change records, what each updated by name, and the procedures it never reached — **Changes that never reached a procedure**Each closed change against every procedure that names what it altered, including the ones its update list left off.

Shift logs line by line for one restart, and procedures where the logs show a different practice, with the step and the log text — **What the shift logs show**11,900 logs read over 14 months. A different practice may be a crew habit or a change nobody managed; the owner decides which.

Numbered paper copies of procedures by location and revision, with copies to collect and held procedures — **Paper copies**215 of 1,944 numbered copies are off the current revision. A held procedure cannot print, except an emergency one, which prints marked with its known fault.

Operator's unit view: held steps with who to call, an emergency procedure line, copies to collect and a report box — **What the operator sees**Seven steps held or flagged, each with who placed or decides it and who to call, the copies to collect, and a box to say what the crew really does.

Audit trail for one procedure revision: each record opened by each person, the review answer and the signature — **The audit trail**Each test, edit, opening and signature in order, with the edit's words and the not compared mark kept on the line.

demoSample data, from the working solution.

The agents

The agents test and draft; no agent writes a word of a live procedure

Each has its own job and its own stop.

Step tester

Tests each step against closed changes, the drawing and the equipment list.

Never says a procedure is right
Never places a hold

Shift log reader

Quotes the log lines behind each procedure.

Never calls a practice correct

Edit drafter

Drafts the smallest edit the sources support, or says it cannot.

Never edits a live procedure
Never drafts from logs alone

Certification planner

Lists what changed, the exceptions, each startup, shutdown and emergency procedure, and the routine sample.

Never signs or redraws
Never samples a startup, shutdown or emergency procedure

Paper copy tracker

Compares numbered copies with current revisions.

Never marks a copy collected

Question router

Answers record questions and sends any plant question to the superintendent and process safety.

Never gives a how-to or says something is safe

Evidence clerk

Keeps the trail and builds the exports.

Never edits a past entry

Holds, practice and certification stay with named people

What the agents find is a finding. These calls need a person who opened the record.

A hold is placed by a personA flagged step is not a hold until the superintendent places one, the same day.

A log is not a rulingWhen crews work differently, the owner decides whether the book or the practice is wrong. On a safety step, process safety and the superintendent rule.

Typed words are read by peopleAn edit, an answer or a note in a person's own words is marked not compared, and the second person must open the record before they can agree.

Process safety is not overruled by the signerAn objection goes back to the owner, or to the refinery manager, who opens the record first.

No one signs their own editThe superintendent cannot sign a revision he wrote.

Seven records behind each procedure on the unit

Read only, each cited with its page or line.

Procedure libraryEach procedure, its revision and its owner

Management of changeClosed changes and what their update lists named

Drawing registerThe current drawing for each unit

Maintenance systemEquipment in service and retired

Shift logsWhat each crew wrote at each restart

Copy registerNumbered paper copies and where they sit

Training recordsWho on each crew has read the new revision

What process safety leads ask about operating procedure management

What is operating procedure management?

Operating procedure management keeps written operating procedures matched to the plant as it is today. Here agents test each step against closed changes, the current drawing, the equipment list and the shift logs, and draft an edit for the owner. People edit, review and sign, and the yearly certificate says what was read.

How does it support the annual certification that procedures are current and accurate?

The superintendent reads every changed procedure and every startup, shutdown and emergency procedure in full, and a routine sample from a draw he did not choose. The certificate counts only recorded openings, lists every procedure not read and every one that differs, and a second person countersigns.

What happens to procedures after a management of change closes?

The agents read each closed change and look for every procedure that names what it altered, including the ones its update list left off. A procedure the change never reached becomes a difference, assigned to its owner with a due date.

Do the agents ever change a live procedure?

No. They draft the smallest edit the sources support, or say they cannot. The owner edits, process safety reviews safety steps, and the superintendent signs before a revision goes live.

Can the system tell whether an owner's wording is safe?

No, and it does not pretend to. It looks up the tags in typed text and refuses a removed or unknown valve. The meaning is marked not compared, and two people must open the record and read the exact words.

What if the crews already work differently from the book?

The logs are quoted as evidence of practice, and that is all. A different practice can be right, or a change nobody managed, so it goes to the owner, and on a safety step to process safety and the superintendent.

What does an operator see on the unit?

Which steps are held, who placed each hold and who to call, the paper copies to collect, new revisions to read, and a place to report what the crew really does, in their own words.

Production Operations & Oil Sands

Bring one unit's
procedures and drawings.

We will walk your procedures on your own drawings and show you where the book and the plant disagree.

Book a demo Browse solutions

Operating Procedure Management

The procedure says open a valve the outage cut out of the line

The Problem Today

The Solution

What You Get

Operating procedure management on one restart, from the nightly test to Rev 7

Of 50 tag mentions in 34 steps, one valve is on no drawing

The walk stops at step 17, where the valve is a dashed ghost

The crew's own log says what they really do at the reboiler

The agents' own draft is refused: the pump would start with no recycle

Rev 7 moves the valve before the pump, and is marked not compared

Process safety answers the open question yes, in his own words

Signing waits on one more thing: the engineer's answer, in his words

Rev 7 is live, and 648 differences become 647

The certificate counts only what he opened: 1 of 322 so far