Vous êtes sur la page 1sur 5

Journal of Loss Prevention in the Process Industries 35 (2015) 352e356

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

Utilizing Integrity Operating Windows (IOWs) for enhanced plant

reliability & safety
Vishal Lagad*, Vibha Zaman
Lloyd's Register Energy Americas, Inc, 1330 Enclave Parkway, Suite 200, Houston, TX 77077, USA

a r t i c l e i n f o a b s t r a c t

Article history: Several industry codes, standards and recommended practices have been developed and utilized to
Received 1 July 2014 maintain pressure equipment integrity and improve reliability. These industry standards focus heavily on
Received in revised form inspections (time or risk based) and guidelines for operating equipment at conditions that enable a
18 September 2014
tolerable deterioration rate. RBI (risk based inspection), in effect, utilizes process conditions at a snapshot
Accepted 15 October 2014
in time to recommend inspection strategies which can cover the span of the equipment's remaining life.
Available online 16 October 2014
On a day to day level, changes that occur in process conditions (excursions and upsets) are not fed back
into the risk and criticality calculation. When such changes to operating conditions affect key process
variables, new damage mechanisms could be introduced that affect the remaining life of an asset or
Integrity Operating Windows accelerate existing damage mechanisms. The increase in risk resulting from these process changes goes
Reliability unaccounted for until the effect of the deterioration is captured at the next inspection.
RBI Integrity Operating Windows (IOWs) are established limits for key process variables that can affect the
Risk based inspection integrity of the equipment if the process operation deviates from the established limits. The develop-
Integrity ment of these IOWs requires fundamental understanding of the process and resulting damage mecha-
API 584 nisms and is best facilitated by a team of corrosion and process engineers along with feedback from plant
operators. A well-established IOW program is designed to provide real time notication of an increased
risk to the integrity of an asset so that identied actions can be taken by the operators and/or plant
managers proactively in a timely manner. Combining an RBI program with an IOW program can greatly
increase its effectiveness and provide early recognition of equipment risks due to process changes. This
paper will focus on the development of an IOW program and the benets of combining it with a viable
RBI program.
2014 Elsevier Ltd. All rights reserved.

1. Background on reliability, integrity and IOWs to determine whether operations are maintained within bound-
aries. API 510 Section 6.2 states (API 510) This likelihood of failure
The use of the term Reliability focuses on avoiding malfunc- assessment should be repeated each time equipment or process
tions of equipment that might impact the performance of the unit changes are made that could signicantly affect degradation rates
in meeting its intended function for a specied time frame. or cause premature failure of the vessel.
Integrity addresses the more signicant issue of a breach of The understanding that changes in operating conditions can
containment in pressure equipment which in turn impacts potentially affect the integrity of the vessel has been embedded in
reliability. age old standards for pressure equipment safety. Controlling key
Many existing practices and standards have specically noted operating parameters such as temperature and pressure in the form
the importance of monitoring operating conditions as part of asset of Safe Operating Limits has been a key component of asset integ-
integrity programs. For instance API RP 580 Section 6.4 states (API rity for years. Limits in the form of alarms etc. have routinely been
Recommended Practice 580) Operating within the boundaries is set on operating conditions for pressure containment (SOL) and for
critical to the validity of the RBI study as well as good operating process control/performance related to product throughput and
practice. It may be worthwhile to monitor key process parameters quality. These limits on operating conditions are set with an im-
mediate timeframe in mind e in other words, operating outside
these limits could lead to an incident (breach in the pressure en-
velope or loss of product quality) in the very short term (minutes, or
* Corresponding author.
E-mail address: Vishal.Lagad@lr.org (V. Lagad). hours).

0950-4230/ 2014 Elsevier Ltd. All rights reserved.
V. Lagad, V. Zaman / Journal of Loss Prevention in the Process Industries 35 (2015) 352e356 353

Integrity Operating Windows, on the other hand, can be briey reduces the uncertainty associated with the current state of
identied as limits on key process parameters that identify the degradation thereby allowing better quantication of the current
boundaries of safe operation for the design life e operating outside damage present in the component and projections for remaining
these boundaries can lead to a reduced life and an incident in the life.
short to medium time frame (days to months). Operating outside an RBI utilizes process conditions and equipment history at a
IOW for even brief periods of time can lead to new damage snapshot in time to recommend inspection strategies which can
mechanism or the acceleration of an existing damage mechanism cover the span of the equipment's remaining life. On a day to day
that affects the remaining life of an asset. While this simplies the level, changes that occur in process conditions (such as excursions
idea of IOWs it helps distinguish it clearly from the typical oper- and upsets) are not fed back into the risk and criticality calculation.
ating limits and SOLs. Operating within an IOW does not mean that In today's operating environment with multiple changes in feed-
no degradation should be expected, it only means that the resulting stock, higher throughputs and process creep, it is not sufcient to
degradation will be acceptable for the expected remaining life of develop future inspection plans only on prior history of equipment
the equipment. condition. A deeper understanding of the process and resulting
The development of these IOWs requires a detailed review and damage mechanisms is required in order to establish and maintain
fundamental understanding of the process, materials of construc- an inspection program that yields the highest probability of
tion, and corrosion and other damage mechanisms. The key re- detecting potential damage in a timely manner. Inspection plans
quirements for identifying IOW candidate process parameters are should be dynamic and account for changing process conditions,
to ensure that the parameters are both measurable and preferably process upsets and current equipment condition. Establishing an
controllable. The IOW program implementation requires that the IOW program provides a framework to capture these process
IOWs are regularly monitored, either via regularly specied sam- changes as they happen and facilitate a direct and immediate
pling and monitoring program or real-time via a system that is response to prevent the onset of rapid deterioration of an asset in
capable of both notifying key personnel of any excursions and order to increase reliability and prevent a potential incident in the
facilitating corrective actions. short to near future term.
Typically, an IOW for a particular process parameter has three To make such an IOW program successful, a fundamental un-
limits e Critical, Standard and Informational. A Critical IOW limit is derstanding of the process, materials of construction and potential
an established limit, which, when exceeded results in rapid dete- damage mechanisms is a necessary condition. The implementation
rioration and requires operator action to bring the parameter of an IOW program is best facilitated by a team of corrosion engi-
within required limits in a short time frame (usually minutes to less neers and subject matter experts (SME) with close interaction from
than an hour). In many cases the Critical IOW limit is the same as process engineers along with feedback from plant operators.
Safe Operating Limit. When a Standard IOW limit is exceeded, Corrosion control documents or detailed corrosion studies form the
increased degradation rate or activation of new damage mecha- basis of identifying candidate parameters for developing IOWs. It is
nisms can be expected. Required operator response times to also important to note that IOWs are typically recommended for
exceeding a Standard IOW limit vary greatly (from a few hours to a only a small number of assets (less than 20% of the equipment and
few days) depending on the damage mechanism to be expected and piping in a typical renery) and are focused on key corrosion loops
criticality of the equipment. These limits are illustrated briey in for critical equipment.
Fig. 1. Informational IOW limits are used to capture and record The goal of a well-established IOW program is to provide real
events that can affect the long term reliability and are often used on time notication of an increased risk to the integrity of an asset so
parameters that are beyond an operator's immediate direct control. that pre-identied actions can be taken by the operators and/or
There are various variations used in the industry for the names of plant managers proactively in a timely manner to either prevent an
these IOW limits, the timeframes for action and relative prioriti- incident or identify the increased potential for an incident in the
zation for action based on criticality or risk. API RP 584 near future.
(Recommended Practice) is working towards identifying the Fig. 2 illustrates the benet of enhancing traditional RBI pro-
importance of implementing IOWs and providing a structure for grams with an IOW program through the identication and pre-
the process involved in identifying and implementing them. vention of potential incidents in the future. This illustrates how
carbon steel piping operating in hot suldation service can expe-
2. Benets of an IOW program e enhancing RBI rience increased deterioration rate caused by operating at tem-
peratures higher than the IOW Standard limit (typically 500 F for
Operating companies in high risk business sectors (rening, oil 0.5 wt.% Sulfur) leading to signicantly reduced life. The top part of
and gas production and chemicals) are always under increasing the chart presents Temperature of carbon steel piping tracked with
pressure to improve business performance and lately are being held time on the X-axis along with the associated risk and remaining life
to a higher standard to becoming more socially and environmen- of the equipment (presented on a split Y axis). A temperature
tally responsible. A failure of a critical asset typically has a signi- excursion lasting 3 months that crosses the Standard IOW limit
cant impact on the safety, health, environment or the reputation causes a signicant increase in the deterioration rate and results in
and protability of the business. Short term focus on reducing asset a signicant higher risk and shorter remaining life. While tradi-
management costs often result in higher risk and long term loss of tional RBI techniques could help alert operators about this damage
value to the organization. through the planned inspections within a few years, an IOW pro-
Over the last few years, API RBI methodology has been instru- gram can help prevent this happening through effective operator
mental in driving asset integrity improvements by focusing in- control as soon as the temperature excursion is detected.
spections costs to the most critical assets. The calculation of RBI There have been reports of successful IOW programs in the
involves the determination of a probability of failure combined literature (Reynolds, 2006; Hanson et al., 2011) with case studies of
with the consequence of failure. With age, as equipment degrades success in rening industry. Existing RBI programs can be signi-
during in-service operation the risk associated with the failure in- cantly enhanced using an IOW program by:
creases. At some point, a risk tolerance is exceeded and an in-
spection is recommended to better quantify the state of the  Allowing for more accurate turnaround and management
component. The inspection in itself does not reduce the risk but it planning and execution
354 V. Lagad, V. Zaman / Journal of Loss Prevention in the Process Industries 35 (2015) 352e356

Fig. 1. IOW schematic demonstrating difference between SOLs, IOWs etc.

 Preventing the appearance of potentially new and impending temperatures, which are directly monitored. These skin tempera-
damage mechanisms ture monitors have a history of failing or not reading accurately and
 Permitting use of alternative and opportunity feedstock have been found to be unreliable on many occasions. A Critical IOW
 Reducing cost overruns and unplanned shutdowns of 1500  F (815  C) with action to bring the temperature below the
Standard IOW limit within minutes to less than an hour can be
recommended. A Standard IOW limit of 1000  F (538  C) with ac-
3. Examples of IOWs tion to bring the temperature within Safe Operating Limits within
24 h can also be recommended.
3.1. Potential damage from creep in charge heater tubes The heater outlet manifold process temperature is also moni-
tored and may be more reliable in some cases. Industry experience
Type 347H SS heater coils normally operate with a typical indicates that, in the absence of fouling or ame impingement, the
maximum sustained metal temperature well below the API 579 outlet process temperature in a heater is usually no less than about
lower limit for Creep of 1000  F (538  C) for this material. Rapid 150  F (83  C) below the average maximum tube metal tempera-
deterioration begins to take place at temperatures above 1500  F ture. Sustained heater outlet manifold temperatures exceeding
(815  C) at which Creep damage can quickly accumulate. about 850  F (455  C) can also be recommended as a possible
Accordingly, this furnace can be considered to not be at a risk of Standard IOW limit with actions to perform infrared scans to
developing Creep under normal operating conditions. However, conrm skin temperatures. Breaching this IOW by small tempera-
ame instabilities can create locally hot areas and fouling can result ture excursions for short periods usually has no discernible effect
in greatly reduced heat transfer, resulting in elevated skin tem- on tube life. However prolonged or signicant excursions will affect
peratures that may exceed the Creep threshold temperature. The the design life and should be evaluated by an SME for its effect on
potential for Creep is primarily determined by tube metal skin tube life due to Creep damage. Breaches of the Critical IOW can

Fig. 2. Visualization of IOW e Illustration of suldation damage in carbon steel piping.

V. Lagad, V. Zaman / Journal of Loss Prevention in the Process Industries 35 (2015) 352e356 355

cause tube rupture in a few hours to a few days, depending on Table 1

severity. IOW's for the quality of desalter wash water.

Parameter Standard IOW Critical IOW Affected assets

3.2. Quality of wash water injected into the desalter in a crude unit pH 5 (min) 3 (min)  Desalters,
 Brine system
Wash water is injected into the Desalter in a crude unit in order NH3 content 25 ppm (max) 100 ppm (max)  Preheat train,
to help remove base sediments (salts, solids, and metals) entrained  Desalters,
 Brine system,
in the crude (process ow illustrated in Fig. 3). Providing high-
quality wash water to the Desalter is important for maintaining overhead system,
good Desalter operation and prevents fouling and corrosion dam-  Naphtha piping
age to downstream equipment. Key parameters that are monitored O2 content 1 ppm (max) 10 ppm (max)  Desalters,
 Brine system,
include the pH, ammonia (NH3) content, and oxygen (O2) content in
the wash water. Standard and Critical IOW limits can be set as overhead system
shown in Table 1, with recommended sampling and testing of these
parameters performed daily.
For a particular crude slate at one of the units, experience has
shown that a pH of 6e8 is required to minimize corrosion in the
4. Conclusions
electrostatic Desalter and optimize operation. A pH of 5 can be
tolerated for short periods of time and a pH of 3 or lower will result
Well-managed and properly implemented RBI programs enable
in accelerated corrosion leading to a failure of the Desalter.
a sustainable and continuously improving business process best
The NH3 content in the Desalter wash water is typically
practice for asset integrity management. These programs systemi-
controlled because at high pH conditions, NH3 can promote the
cally allow the user to document both cost and risk reductions over
formation of difcult to break emulsions and lead to excessive
time. Incorporating an IOW program enhances existing RBI pro-
water carryover to the fractionator tower. In addition, NH3 will
grams and helps predict, locate and recommend actions to avoid
react with HCl in the fractionator overhead system to form NH4Cl
incidents and proactively manage asset integrity. This transforms
salts. These salts can cause fouling in the overhead system when
an ofine RBI program that is usually reactive, to a dynamic online
dry and, due to their hygroscopic nature can absorb water from the
proactive framework that assesses the changes in the risk on an
vapor phase and are highly corrosive when wet.
ongoing basis.
Dissolved O2 in the wash water can lead to problems with
Development of a high quality IOW program requires strong
pitting corrosion in the Desalter water wash and efuent brine
teamwork between the corrosion SMEs and plant personnel to
systems. In addition, dissolved O2 in the entrained water is carried
ensure effective implementation and ownership. A properly
into the fractionator tower overhead systems. O2 can react with
implemented IOW program is designed to provide real time noti-
H2S in the crude to form elemental sulfur, which can cause fouling
cation of an increased risk to the integrity of an asset so that ac-
as well as corrosion. O2 can also react with sulfur to form acid
tions can be proactively taken by the operators to prevent incidents
gases such as SO2, SO3, SOx which are precursors to sulfuric acid
or evaluate increased risks in a timely manner. The rening in-
and sulfurous acid formation. In order to rectify the problem, the
dustry has shown a great interest in enhancing their RBI programs
source of oxygen should be identied (e.g. overhead steam
with IOW implementation and has also demonstrated its success.
condensate, cooling water leaks, pump seal leaks, etc.) and
While IOW identication and knowledge base has been around for

Fig. 3. Process ow diagram for crude unit desalter and atmospheric tower.
356 V. Lagad, V. Zaman / Journal of Loss Prevention in the Process Industries 35 (2015) 352e356

a few years, industries are just beginning to implement them on an References

actionable format in the form of alarms and alerts. While the value
an IOW program brings to current RBI implementations is certainly API 510, Pressure Vessel Inspection Code.
API Recommended Practice 580, Risk Based Inspection.
tangible, it is however not very quantiable at this stage in its life API Recommended Practice 584-Draft, Integrity Operating Windows.
cycle. A few years from now when the industry has had some Hanson, D., Paletta, F., Penuela, L., Tkachyk, B., 2011. Establishing Integrity Operating
experience with these implementations we could benet from a Windows and Safe Operating Limits for Hydrocarbon Plants. IPEIA.
Reynolds, J., 2006. Establishing Integrity Operating Windows (IOWs). Inspection
case study that could help quantify the effect. Summit, Galveston, TX.