Journal of Loss Prevention in the Process Industries 35 (2015) 352e356

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

Utilizing Integrity Operating Windows (IOWs) for enhanced plant

reliability & safety
Vishal Lagad*, Vibha Zaman
Lloyd's Register Energy Americas, Inc, 1330 Enclave Parkway, Suite 200, Houston, TX 77077, USA

a r t i c l e i n f o a b s t r a c t

Article history: Several industry codes, standards and recommended practices have been developed and utilized to
Received 1 July 2014 maintain pressure equipment integrity and improve reliability. These industry standards focus heavily on
Received in revised form inspections (time or risk based) and guidelines for operating equipment at conditions that enable a
18 September 2014
tolerable deterioration rate. RBI (risk based inspection), in effect, utilizes process conditions at a snapshot
Accepted 15 October 2014
in time to recommend inspection strategies which can cover the span of the equipment's remaining life.
Available online 16 October 2014
On a day to day level, changes that occur in process conditions (excursions and upsets) are not fed back
into the risk and criticality calculation. When such changes to operating conditions affect key process
Keywords:
IOW
variables, new damage mechanisms could be introduced that affect the remaining life of an asset or
Integrity Operating Windows accelerate existing damage mechanisms. The increase in risk resulting from these process changes goes
Reliability unaccounted for until the effect of the deterioration is captured at the next inspection.
RBI Integrity Operating Windows (IOWs) are established limits for key process variables that can affect the
Risk based inspection integrity of the equipment if the process operation deviates from the established limits. The develop-
Integrity ment of these IOWs requires fundamental understanding of the process and resulting damage mecha-
API 584 nisms and is best facilitated by a team of corrosion and process engineers along with feedback from plant
operators. A well-established IOW program is designed to provide real time notication of an increased
risk to the integrity of an asset so that identied actions can be taken by the operators and/or plant
managers proactively in a timely manner. Combining an RBI program with an IOW program can greatly
increase its effectiveness and provide early recognition of equipment risks due to process changes. This
paper will focus on the development of an IOW program and the benets of combining it with a viable
RBI program.
2014 Elsevier Ltd. All rights reserved.

1. Background on reliability, integrity and IOWs
The use of the term Reliability focuses on avoiding malfunc-
tions of equipment that might impact the performance of the unit
in meeting its intended function for a specied time frame.
Integrity addresses the more signicant issue of a breach of
containment in pressure equipment which in turn impacts
reliability.
Many existing practices and standards have specically noted
the importance of monitoring operating conditions as part of asset
integrity programs. For instance API RP 580 Section 6.4 states (API
Recommended Practice 580) Operating within the boundaries is
critical to the validity of the RBI study as well as good operating
practice. It may be worthwhile to monitor key process parameters
* Corresponding author.
E-mail address: Vishal.Lagad@lr.org (V. Lagad).
to determine whether operations are maintained within bound-
aries. API 510 Section 6.2 states (API 510) This likelihood of failure
assessment should be repeated each time equipment or process
changes are made that could signicantly affect degradation rates
or cause premature failure of the vessel.
The understanding that changes in operating conditions can
potentially affect the integrity of the vessel has been embedded in
age old standards for pressure equipment safety. Controlling key
operating parameters such as temperature and pressure in the form
of Safe Operating Limits has been a key component of asset integ-
rity for years. Limits in the form of alarms etc. have routinely been
set on operating conditions for pressure containment (SOL) and for
process control/performance related to product throughput and
quality. These limits on operating conditions are set with an im-
mediate timeframe in mind e in other words, operating outside
these limits could lead to an incident (breach in the pressure en-
velope or loss of product quality) in the very short term (minutes, or
hours).

http://dx.doi.org/10.1016/j.jlp.2014.10.008
0950-4230/ 2014 Elsevier Ltd. All rights reserved.
 V. Lagad, V. Zaman / Journal of Loss Prevention in the Process Industries 35 (2015) 352e356
Integrity Operating Windows, on the other hand, can be briey
identied as limits on key process parameters that identify the
boundaries of safe operation for the design life e operating outside
these boundaries can lead to a reduced life and an incident in the
short to medium time frame (days to months). Operating outside an
IOW for even brief periods of time can lead to new damage
mechanism or the acceleration of an existing damage mechanism
that affects the remaining life of an asset. While this simplies the
idea of IOWs it helps distinguish it clearly from the typical oper-
ating limits and SOLs. Operating within an IOW does not mean that
no degradation should be expected, it only means that the resulting
degradation will be acceptable for the expected remaining life of
the equipment.
The development of these IOWs requires a detailed review and
fundamental understanding of the process, materials of construc-
tion, and corrosion and other damage mechanisms. The key re-
quirements for identifying IOW candidate process parameters are
to ensure that the parameters are both measurable and preferably
controllable. The IOW program implementation requires that the
IOWs are regularly monitored, either via regularly specied sam-
pling and monitoring program or real-time via a system that is
capable of both notifying key personnel of any excursions and
facilitating corrective actions.
Typically, an IOW for a particular process parameter has three
limits e Critical, Standard and Informational. A Critical IOW limit is
an established limit, which, when exceeded results in rapid dete-
rioration and requires operator action to bring the parameter
within required limits in a short time frame (usually minutes to less
than an hour). In many cases the Critical IOW limit is the same as
Safe Operating Limit. When a Standard IOW limit is exceeded,
increased degradation rate or activation of new damage mecha-
nisms can be expected. Required operator response times to
exceeding a Standard IOW limit vary greatly (from a few hours to a
few days) depending on the damage mechanism to be expected and
criticality of the equipment. These limits are illustrated briey in
Fig. 1. Informational IOW limits are used to capture and record
events that can affect the long term reliability and are often used on
parameters that are beyond an operator's immediate direct control.
There are various variations used in the industry for the names of
these IOW limits, the timeframes for action and relative prioriti-
zation for action based on criticality or risk. API RP 584
(Recommended Practice) is working towards identifying the
importance of implementing IOWs and providing a structure for
the process involved in identifying and implementing them.
2. Benets of an IOW program e enhancing RBI
Operating companies in high risk business sectors (rening, oil
and gas production and chemicals) are always under increasing
pressure to improve business performance and lately are being held
to a higher standard to becoming more socially and environmen-
tally responsible. A failure of a critical asset typically has a signi-
cant impact on the safety, health, environment or the reputation
and protability of the business. Short term focus on reducing asset
management costs often result in higher risk and long term loss of
value to the organization.
Over the last few years, API RBI methodology has been instru-
mental in driving asset integrity improvements by focusing in-
spections costs to the most critical assets. The calculation of RBI
involves the determination of a probability of failure combined
with the consequence of failure. With age, as equipment degrades
during in-service operation the risk associated with the failure in-
creases. At some point, a risk tolerance is exceeded and an in-
spection is recommended to better quantify the state of the
component. The inspection in itself does not reduce the risk but it
353
reduces the uncertainty associated with the current state of
degradation thereby allowing better quantication of the current
damage present in the component and projections for remaining
life.
RBI utilizes process conditions and equipment history at a
snapshot in time to recommend inspection strategies which can
cover the span of the equipment's remaining life. On a day to day
level, changes that occur in process conditions (such as excursions
and upsets) are not fed back into the risk and criticality calculation.
In today's operating environment with multiple changes in feed-
stock, higher throughputs and process creep, it is not sufcient to
develop future inspection plans only on prior history of equipment
condition. A deeper understanding of the process and resulting
damage mechanisms is required in order to establish and maintain
an inspection program that yields the highest probability of
detecting potential damage in a timely manner. Inspection plans
should be dynamic and account for changing process conditions,
process upsets and current equipment condition. Establishing an
IOW program provides a framework to capture these process
changes as they happen and facilitate a direct and immediate
response to prevent the onset of rapid deterioration of an asset in
order to increase reliability and prevent a potential incident in the
short to near future term.
To make such an IOW program successful, a fundamental un-
derstanding of the process, materials of construction and potential
damage mechanisms is a necessary condition. The implementation
of an IOW program is best facilitated by a team of corrosion engi-
neers and subject matter experts (SME) with close interaction from
process engineers along with feedback from plant operators.
Corrosion control documents or detailed corrosion studies form the
basis of identifying candidate parameters for developing IOWs. It is
also important to note that IOWs are typically recommended for
only a small number of assets (less than 20% of the equipment and
piping in a typical renery) and are focused on key corrosion loops
for critical equipment.
The goal of a well-established IOW program is to provide real
time notication of an increased risk to the integrity of an asset so
that pre-identied actions can be taken by the operators and/or
plant managers proactively in a timely manner to either prevent an
incident or identify the increased potential for an incident in the
near future.
Fig. 2 illustrates the benet of enhancing traditional RBI pro-
grams with an IOW program through the identication and pre-
vention of potential incidents in the future. This illustrates how
carbon steel piping operating in hot suldation service can expe-
rience increased deterioration rate caused by operating at tem-
peratures higher than the IOW Standard limit (typically 500 F for
0.5 wt.% Sulfur) leading to signicantly reduced life. The top part of
the chart presents Temperature of carbon steel piping tracked with
time on the X-axis along with the associated risk and remaining life
of the equipment (presented on a split Y axis). A temperature
excursion lasting 3 months that crosses the Standard IOW limit
causes a signicant increase in the deterioration rate and results in
a signicant higher risk and shorter remaining life. While tradi-
tional RBI techniques could help alert operators about this damage
through the planned inspections within a few years, an IOW pro-
gram can help prevent this happening through effective operator
control as soon as the temperature excursion is detected.
There have been reports of successful IOW programs in the
literature (Reynolds, 2006; Hanson et al., 2011) with case studies of
success in rening industry. Existing RBI programs can be signi-
cantly enhanced using an IOW program by:
 Allowing for more accurate turnaround and management
planning and execution
354 V. Lagad, V. Zaman / Journal of Loss Prevention in the Process Industries 35 (2015) 352e356

Fig. 1. IOW schematic demonstrating difference between SOLs, IOWs etc.

 Preventing the appearance of potentially new and impending
damage mechanisms
 Permitting use of alternative and opportunity feedstock
 Reducing cost overruns and unplanned shutdowns
3. Examples of IOWs
3.1. Potential damage from creep in charge heater tubes
Type 347H SS heater coils normally operate with a typical
maximum sustained metal temperature well below the API 579
lower limit for Creep of 1000  F (538  C) for this material. Rapid
deterioration begins to take place at temperatures above 1500  F
(815  C) at which Creep damage can quickly accumulate.
Accordingly, this furnace can be considered to not be at a risk of
developing Creep under normal operating conditions. However,
ame instabilities can create locally hot areas and fouling can result
in greatly reduced heat transfer, resulting in elevated skin tem-
peratures that may exceed the Creep threshold temperature. The
potential for Creep is primarily determined by tube metal skin
temperatures, which are directly monitored. These skin tempera-
ture monitors have a history of failing or not reading accurately and
have been found to be unreliable on many occasions. A Critical IOW
of 1500  F (815  C) with action to bring the temperature below the
Standard IOW limit within minutes to less than an hour can be
recommended. A Standard IOW limit of 1000  F (538  C) with ac-
tion to bring the temperature within Safe Operating Limits within
24 h can also be recommended.
The heater outlet manifold process temperature is also moni-
tored and may be more reliable in some cases. Industry experience
indicates that, in the absence of fouling or ame impingement, the
outlet process temperature in a heater is usually no less than about
150  F (83  C) below the average maximum tube metal tempera-
ture. Sustained heater outlet manifold temperatures exceeding
about 850  F (455  C) can also be recommended as a possible
Standard IOW limit with actions to perform infrared scans to
conrm skin temperatures. Breaching this IOW by small tempera-
ture excursions for short periods usually has no discernible effect
on tube life. However prolonged or signicant excursions will affect
the design life and should be evaluated by an SME for its effect on
tube life due to Creep damage. Breaches of the Critical IOW can

Fig. 2. Visualization of IOW e Illustration of suldation damage in carbon steel piping.

 V. Lagad, V. Zaman / Journal of Loss Prevention in the Process Industries 35 (2015) 352e356 355

cause tube rupture in a few hours to a few days, depending on Table 1

severity. IOW's for the quality of desalter wash water.

Parameter Standard IOW Critical IOW Affected assets

3.2. Quality of wash water injected into the desalter in a crude unit pH 5 (min) 3 (min)  Desalters,
 Brine system
Wash water is injected into the Desalter in a crude unit in order NH3 content 25 ppm (max) 100 ppm (max)  Preheat train,
to help remove base sediments (salts, solids, and metals) entrained  Desalters,
 Brine system,
in the crude (process ow illustrated in Fig. 3). Providing high-
 Fractionator
quality wash water to the Desalter is important for maintaining overhead system,
good Desalter operation and prevents fouling and corrosion dam-  Naphtha piping
age to downstream equipment. Key parameters that are monitored O2 content 1 ppm (max) 10 ppm (max)  Desalters,
 Brine system,
include the pH, ammonia (NH3) content, and oxygen (O2) content in
 Fractionator
the wash water. Standard and Critical IOW limits can be set as overhead system
shown in Table 1, with recommended sampling and testing of these
parameters performed daily.
For a particular crude slate at one of the units, experience has
shown that a pH of 6e8 is required to minimize corrosion in the
4. Conclusions
electrostatic Desalter and optimize operation. A pH of 5 can be
tolerated for short periods of time and a pH of 3 or lower will result
Well-managed and properly implemented RBI programs enable
in accelerated corrosion leading to a failure of the Desalter.
a sustainable and continuously improving business process best
The NH3 content in the Desalter wash water is typically
practice for asset integrity management. These programs systemi-
controlled because at high pH conditions, NH3 can promote the
cally allow the user to document both cost and risk reductions over
formation of difcult to break emulsions and lead to excessive
time. Incorporating an IOW program enhances existing RBI pro-
water carryover to the fractionator tower. In addition, NH3 will
grams and helps predict, locate and recommend actions to avoid
react with HCl in the fractionator overhead system to form NH4Cl
incidents and proactively manage asset integrity. This transforms
salts. These salts can cause fouling in the overhead system when
an ofine RBI program that is usually reactive, to a dynamic online
dry and, due to their hygroscopic nature can absorb water from the
proactive framework that assesses the changes in the risk on an
vapor phase and are highly corrosive when wet.
ongoing basis.
Dissolved O2 in the wash water can lead to problems with
Development of a high quality IOW program requires strong
pitting corrosion in the Desalter water wash and efuent brine
teamwork between the corrosion SMEs and plant personnel to
systems. In addition, dissolved O2 in the entrained water is carried
ensure effective implementation and ownership. A properly
into the fractionator tower overhead systems. O2 can react with
implemented IOW program is designed to provide real time noti-
H2S in the crude to form elemental sulfur, which can cause fouling
cation of an increased risk to the integrity of an asset so that ac-
as well as corrosion. O2 can also react with sulfur to form acid
tions can be proactively taken by the operators to prevent incidents
gases such as SO2, SO3, SOx which are precursors to sulfuric acid
or evaluate increased risks in a timely manner. The rening in-
and sulfurous acid formation. In order to rectify the problem, the
dustry has shown a great interest in enhancing their RBI programs
source of oxygen should be identied (e.g. overhead steam
with IOW implementation and has also demonstrated its success.
condensate, cooling water leaks, pump seal leaks, etc.) and
While IOW identication and knowledge base has been around for
eliminated.

Fig. 3. Process ow diagram for crude unit desalter and atmospheric tower.
356 V. Lagad, V. Zaman / Journal of Loss Prevention in the Process Industries 35 (2015) 352e356
a few years, industries are just beginning to implement them on an
actionable format in the form of alarms and alerts. While the value
an IOW program brings to current RBI implementations is certainly
tangible, it is however not very quantiable at this stage in its life
cycle. A few years from now when the industry has had some
experience with these implementations we could benet from a
case study that could help quantify the effect.
References
API 510, Pressure Vessel Inspection Code.
API Recommended Practice 580, Risk Based Inspection.
API Recommended Practice 584-Draft, Integrity Operating Windows.
Hanson, D., Paletta, F., Penuela, L., Tkachyk, B., 2011. Establishing Integrity Operating
Windows and Safe Operating Limits for Hydrocarbon Plants. IPEIA.
Reynolds, J., 2006. Establishing Integrity Operating Windows (IOWs). Inspection
Summit, Galveston, TX.