Integration Of Integrity Operating Windows Into Process Safety Management
Integrity Operating Windows (IOWs) are an important component of a world class mechanical integrity program. IOWs are not a new concept, as they have been around in different forms for many years. However, due to some recent high-profile industry indictments and with the publication of the first edition of API RP 584 Integrity Operating Windows (2014) and the release of the second edition (2020), increased focus has been placed on these concepts within the refining and petrochemical industry. The more recent first edition of API 970 Corrosion Control Documents (2018) also discusses the importance of IOW programs as part of a complete Corrosion Management System. Many owner-user organizations that do not have a program currently in place are considering implementing one of these programs.
IOWs are defined as established limits for process parameters that affect the integrity of fixed equipment and piping. When operating parameters deviate from these limits, degradation is more likely to occur. IOWs should be considered a subset of a larger group of unit operating parameters. If operations are kept within these limits, degradation should be predictable; however, this does not necessarily mean low rates of damage.
API 584 defines IOWs in three categories:
• Critical – Parameters where rapid deterioration occurs when the limit is exceeded (typically hours to days).
• Standard – Parameters where exceedances over a specified period of time will cause increased degradation (typically weeks to months or within a turnaround interval).
• Informational – Parameters monitored for long-term damage mechanisms.
Implementing a new IOW program can have many challenges, which can be mitigated through attention to detail in the planning and implementation stages of the program to ensure that it will remain evergreen. The list below provides best practices that owner-users have followed when planning and implementing an IOW program.
- IOWs should focus on parameters that affect mechanical integrity. Operational and Product Quality limits should not be included in the list of IOWs to allow focus on integrity concerns.
- Less is more – IOWs should be limited to important operating variables to allow focus on the parameters that truly affect integrity. Too many IOWs can lead to lack of focus.
- IOW exceedances should be logged and responded to in a formal and documented approach.
- IOWs are often programmed into the distributed control system or plant historian software in order to alarm/notify responsible parties and aid in documentation.
- IOWs should be developed by a team of differing backgrounds supplemented by subject matter experts, such as Materials/Corrosion and Process.
While setting these limits for a given process requires significant effort and technical knowledge, the effort to integrate IOWs into other facility work processes beyond the inspection program where limits have been exceeded is often overlooked. In order to have a robust IOW program, integration of IOWs into other areas of Process Safety Management (PSM) is critical. IOWs are generally considered a Mechanical Integrity function; however, there are many areas where IOWs can be integrated into a site’s Process Safety programs.
Management of Change (MOC)
The Management of Change process is used at PSM-covered facilities to document significant changes and to assess the impact of those changes. The MOC process focuses on changes made to procedures, process chemicals, equipment, and technology. Impacts to health, safety, and mechanical integrity should be evaluated as part of the process.
Once in place, IOWs become part of the unit operating procedures and should fall under the MOC process. The IOW program falls within the MOC process in two distinct ways. First, once IOW limits are determined, any changes to these limits should be reviewed within the MOC process. Many operators will limit the need for the MOC process to review only critical or “higher-risk” standard IOWs.
For example, an operator may choose to increase the tube metal temperature limit of a fired heater in the 6 months before the tubes are replaced to increase throughput and utilize all of the tubes’ remaining life. A change like this should be reviewed through the MOC process to ensure the tubes are capable of withstanding the increase in heat duty.
Secondly, changes to procedures or operating modes can impact the integrity of the fixed equipment within a process unit. These changes can lead to accelerated corrosion or operating outside of the design limits for the unit. Adding a review step around the impact of all changes on the existing set of IOWs is a best practice that some operators follow.
Feedstock changes are another example of changes impacting IOWs. Bringing in a new feedstock is typically reviewed as part of the MOC process. Assessing the impact to existing IOWs can help determine if additional actions are needed to ensure integrity. These actions could include additional inspections in vulnerable areas of the unit, increased process sampling, or adding permanently installed monitoring systems (PIMS). Depending on the MOC review, an IOW that was previously in the “informational” category may need to be increased to the “standard” category to account for a change in the severity to the potential damage mechanisms.
Process Hazard Analysis (PHA) Process
The PHA process is used at PSM-covered facilities for a formal assessment of hazards associated with an operating process. PHA reviews are required by PSM regulation to be reevaluated at least every 5 years. The PHA process focuses on process hazards, previous incidents, engineering and administrative controls, failure of controls, and facility siting, as well as human factors.
The existing set of IOWs should be reviewed during the unit PHA review. This helps to ensure that necessary limits are covered within the facility. Specifically, OSHA 1910.119(d)(2)(i)(D) on process safety information requires establishing “Safe upper and lower limits for such items as temperatures, pressures, flows or compositions.”
PHAs focus on practices and controls that are in place to prevent an incident from occurring through different layers of protection. A review of IOW exceedances since the last PHA also aids in noting areas of vulnerability and places where additional controls may be needed.
An additional best practice that ties PHAs and IOWs together is Damage Mechanisms Reviews (DMRs). A DMR identifies areas in the unit where corrosion, mechanical damage, environmental cracking, and other damage mechanisms have a potential for occurring. After some high-profile industry incidents, some states have recently passed legislation that requires that all refineries have a documented DMR for each process unit and assurance that the DMR coincides with the existing PHA program. Identifying monitoring limits can help to reduce the potential for damage to occur and should be part of a complete DMR. While not currently required in all areas, DMRs provide a defined process for identifying damage mechanisms. Identifying damage mechanisms is also the first step in developing an IOW program.
Operating and Maintenance Procedures
Operating procedures are developed to ensure safe and consistent operation of process units. For critical and standard IOW limits requiring operator intervention, IOW limits and descriptions should be integrated directly into the operating procedures. Documenting these parameters in operating procedures helps all stakeholders understand the importance of these limits to safe operation of each process unit. Examples would include:
- Process sampling requirements
- Heater tube temperature limits
- Washing to remove process fluids prior to steam out
- Minimum pressurization temperatures
An IOW program is more than just settings limits on the process. Understanding the actions that are required when limits are exceeded is just as important as the limits themselves. Defining short-term actions (typically an operator response) as well as a long-term action (more along the lines of added inspections or completing an engineering evaluation) are critical to ensuring the IOW program is effective in preventing losses of containment.
Similarly, maintenance procedures are required to reduce risk during routine or non-routine maintenance tasks. Certain equipment can be vulnerable to specific damage mechanisms during these non-normal conditions. IOWs associated with maintenance, downtime, or unit shutdowns should be included in maintenance procedures. Examples would include:
- Neutralization of acids
- Downtime protection for stainless steels
- Hydrotest water monitoring and limits
- Refractory drying rates
Integrating these types of limits into documented maintenance procedures helps to ensure the integrity of fixed equipment during downtimes and outages. Documentation helps to ensure that IOWs are considered when developing maintenance and downtime work plans.
Inspection Programs
Inspection programs are an integral part of the Mechanical Integrity requirement within PSM regulations. Inspection programs ensure that fixed equipment and piping are in good condition for continued operation. There are numerous instances where IOWs interface with different aspects of an inspection program. Below are a few of the most common examples of this interface.
Risk-based Inspection (RBI) programs are used to plan inspections based on risk assessments instead of more traditional time-based intervals. A key part of any RBI program is a damage mechanism assessment. However, most RBI programs are designed to use static values (corrosion rates, environmental cracking potentials, etc.) for their damage assessments. IOWs provide limits to ensure that the original, static damage assessments are still valid.
For example, a corrosion rate would be assigned to the equipment and piping in a fractionator tower overhead system as part of an RBI analysis. This system would also normally have IOWs around chemical injections, water wash, containments, and/or pH. If the process is kept within the IOW limits, then it is likely the original corrosion rate assessments would be valid.
The example above also illustrates another key interaction between IOWs and RBI programs. If the IOW limits associated with the Fractionator overhead are exceeded on some basis, it indicates that the original RBI assessment should be reevaluated based on the new information. Corrosion rates or cracking potentials could be significantly worse than originally expected causing a higher risk for the system.
An integral part of any IOW program is the tracking and formal review of exceedances. The tracking and review provide information about what is happening within the process unit. Reviewing IOW exceedances can also provide key insights that can improve an inspection program. This process can help determine the expected amount of damage in an equipment item prior to an outage and help to estimate the amount of repairs that would be needed.
Additionally, reviews of IOW exceedance can identify areas where existing materials are not suitable for the current operation and can recommend upgraded materials for new limits. For example, most amine regeneration units have a lower limit around lean amine loading to prevent over-stripping of the amine which can lead to accelerated corrosion. If IOW limits around lean amine loading frequently undershoot the lower limit, upgrading of certain piping circuits to a more corrosion resistant material may be required.
Conclusions
At times, Mechanical Integrity employees can feel like they are fighting an uphill battle. While the focus of these resources is specifically on Mechanical Integrity, there are competing priorities throughout the facility. One important side benefit an IOW program offers is a structured communication between different functions within the facility. From development of IOWs to exceedance reviews and MOC changes, a robust IOW program will facilitate conversations between different facility functions about the importance of mechanical integrity.
Integrity Operating Windows have received a lot of attention in the last 5 years. The majority of the focus on IOWs has been around setting limits and selecting monitoring software. While IOWs are typically managed by the group in charge of Mechanical Integrity at the facility (this could be Reliability, Corrosion/Materials, Inspection), there are many other stakeholders that have a vested interest in this program.
This article provides four concrete examples of integration; however, there are many ways to weave IOWs into the fabric of an operating facility. Programs such as alarm management, process safety information, and turnaround planning also have interfaces with an IOW program. When starting a similar program, it is important to consider how this program will interact with existing programs and how it will integrate with the current work processes at the facility. In order to take an IOW program from a “flavor of the day” to an everyday work process, it is critical to integrate the IOW program into other PSM processes.
Have a question or comment? Please click below:
References
- API Recommended Practice 584, “Integrity Operating Windows,” First Edition, May 2014. The American Petroleum Institute.
- API Recommended Practice 970, “Corrosion Control Documents,” First Edition, December 2017, The American Petroleum Institute.
- Reynolds, J., “Potholes on the Road to IOW Implementation,” Inspectioneering Journal, January/February 2020.
