Technical Blog
Integrity Operating Windows: 10 Questions Every Engineer Should Be Able to Answer
In the world of process safety and asset integrity, managing risk is an ongoing endeavor. Many operators rely on Risk-Based Inspection (RBI) programs to manage mechanical integrity, using assessments for likelihood and consequence of failure risk results to prioritize inspections. However, RBI programs have a critical blind spot: they are time-dependent and only as good as the data available at the time of the risk assessment.
The Blind Spot in Mechanical Integrity: Operational Variability
Operations don’t stay static. Day-to-day shifts in temperature, flow, pressure, and composition can change the risk profile of a system in ways that RBI assessments cannot predict in real time. Operational shifts generate unknowns—and these unknowns lead to unexpected failures. So, what is the answer?
The Answer: Integrity Operating Windows
What exactly is an Integrity Operating Window (IOW), and how does it differ from other operating limits?
IOWs (also referred to as Reliability Operating Limits) are real-time, integrity-specific operating limits for process variables that, when maintained, help ensure the mechanical integrity of equipment over time. IOWs are not about process control or optimization. They’re about damage management and prevention.
IOWs are not the same as:
- Normal Operating Limits (NOLs), which are the range of process conditions that a process is normally expected to operate during routine operations. Exceeding NOLs doesn’t always mean immediate danger but may affect efficiency or product quality.
- Safe Operating Limits (SOLs), which are the essential boundaries that enable equipment and processes to operate safely and effectively. These limits are determined based on rigorous analysis and assessment of various equipment design and operating parameters and prevent the system from entering potentially hazardous or unstable conditions, such as equipment over-pressurization.
What is the regulatory or standards basis for IOWs, and how do auditors (PSM OSHA/API/Insurance) expect them to be implemented?
The foundational standard is American Petroleum Institute Recommended Practice (API RP) 584, which defines how IOWs should be established and managed. Regulators expect IOWs to be part of a facility’s mechanical integrity and process safety management systems. Auditors often look for evidence of:
- Documented IOWs and their technical basis.
- Clear procedures for monitoring and responding to excursions.
- Training and communication with staff.
How do I determine what process parameters require an IOW?
Parameters should be selected based on known or potential damage mechanisms. Sources include corrosion control documents, inspection histories, risk-based inspection (RBI) assessments, and process safety information studies. If a process variable can accelerate or trigger damage mechanisms, it likely needs an IOW.
What is the difference between a Critical, Standard, and Informational IOW?
IOWs are categorized into three levels (per API RP 584), based on their impact on equipment integrity and required response:
- Critical IOW: An established IOW level that if exceeded could result in rapid deterioration such that the operator is required to take immediate predetermined actions to return the process variable back within the IOW to prevent significant defined risks of potential equipment damage or hazardous fluid release.
- Standard IOW: An established IOW level defined as one that if exceeded over a specified period of time could cause increased degradation rates or introduce new damage mechanisms beyond those anticipated.
- Informational IOW: An IOW Informational limit is a parameter that may be used to predict a change in corrosion potential. It may simply be trended rather than having a specified limit or range. Informational IOWs are used for parameters that cannot be controlled by operators.
How do I establish IOW limits (upper/lower boundaries)?
Limits are set using data from industry practices (e.g., API, NACE/AMPP, Industry Journals), corrosion control documents, damage mechanism manuals, historical operational and inspection data, maintenance information, and engineering judgment. For example, if a vessel is a service where equipment can be susceptible to stress corrosion cracking above a certain temperature, that excursion temperature becomes an IOW.
Who is responsible for IOWs?
Operations, process engineers, and mechanical integrity disciplines all share responsibility.
- Mechanical integrity/inspection teams own the IOW process and ensure excursions are investigated, understood, and reflected within the integrity program.
- Operations enable the monitoring of IOWs in real time through monitoring systems.
- Process Engineers help define and validate limits.
How do I manage an IOW excursion when it occurs?
The response depends on the severity:
- Critical excursions require immediate corrective action—possibly including equipment shutdowns or inspections.
- Standard excursions require engineering review, mitigation actions, and potential adjustments to inspection plans.
- Informational excursions are logged and trended but may not trigger immediate intervention.
How do IOWs tie into Time-based, Condition-based, or Risk-Based Inspection Intervals?
Operational changes impact all inspection intervals, regardless if they are time-based, risk-based, or condition based. IOWs ensure that all intervals are successful in ensuring equipment is inspected prior to a critical failure.
- If process conditions remain within defined IOWs, especially for critical variables, then the damage mechanisms are likely to be controlled. This helps enable maximum inspection intervals with confidence.
- Deviations from IOWs—especially critical ones—may increase the rate of damage mechanisms degradation. These excursions can increase the likelihood of failure, triggering a reduction in the inspection interval or even immediate inspection or shutdown depending on severity.
How often should I review and update IOWs?
Regularly. API RP 584 emphasizes that IOWs are “living documents”. Best practice is to review, validate, and update IOWs whenever:
- Process condition changes occur.
- Inspection or failure data reveals new risks.
- Damage mechanism reviews are updated.
However, it is best practice to routinely review IOWs even without major changes. Many organizations adopt annual or periodic review intervals.
How are IOWs documented, communicated, and monitored?
Best practices include:
- Visualization: Display IOW limits alongside process variables on dashboards.
- Alarms: Configure alerts for excursions, with clear escalation paths.
- Procedures: Document expected departmental actions in deviation response guides.
- Training: Ensure personnel and departments understand the “why” behind IOWs, not just the numbers.
Final Thoughts
Integrity Operating Windows are more than just numbers; they are an essential part of a holistic mechanical integrity strategy. By bridging operations and integrity, IOWs ensure that day-to-day decisions protect long-term asset health, regulatory compliance, and most importantly, safe operation.
Meet the Author
Justin Daarud – Director of Asset Integrity & Reliability
Justin is an experienced mechanical engineer with over 17 years of experience in the asset and mechanical integrity program management field. He specializes in defining programs to help reduce inspection costs while increasing production availability and safety performance. Justin leads the asset integrity and reliability team for Cognascents.
Related Cognascents Solutions
At Cognascents, we have the expertise to meet your needs. Explore the variety of related services we offer and discover how our tailored approach can support your business.
Our mission is to empower our clients with innovative solutions that enhance process safety, reliability, asset integrity, and technical business acumen. To elevate your engineering solutions, please contact us today.
