Integrity operating windows — limits that protect the metal, not the product

An inspection plan rests on an assumption: that the plant will keep running roughly the way it was running when the corrosion rates were established. An integrity operating window is what makes that assumption explicit, and detectable when it stops being true.

What an IOW actually is

It is a limit — or a range — on a process variable, set specifically to protect equipment integrity.

That qualifier matters. A plant is full of limits: product specification limits, control loop setpoints, equipment design limits, safety trip settings. An IOW is none of those. It exists because a damage mechanism runs on that variable.

Not an alarm, and not a trip

The right home for most IOWs is an alarm or an operator-visible limit with a defined response — which puts them straight into the territory of alarm management, and subject to exactly the same discipline. An IOW added to the alarm list still competes for operator attention, and still needs a defined action and the time to take it.

The three tiers

Type	What crossing it means	Expected response	Example
Critical	Damage can occur rapidly, and the equipment's integrity basis no longer holds	Immediate operator action to return within limits; escalation if it cannot be done	Feed chloride above the limit set for a stainless system at temperature
Standard	The assumed degradation rate is being exceeded, but not rapidly	Action within a defined period — shift, day or week — with engineering notified	Overhead water pH drifting below the range the inhibitor was selected for
Informational	A parameter is moving in a direction that matters, with no immediate consequence	Recorded and trended; reviewed by engineering rather than acted on by operations	A slow rise in sulphur content that will eventually change the corrosion rate

The tier is decided by what happens when the limit is crossed and how quickly, not by how important the parameter feels. A limit with no defined action does not belong in the set at all.

The tier follows from consequence and time available, not from how important the parameter feels to whoever proposed it. The same reasoning that sets alarm priority applies here.

Where the parameters come from

Not from a workshop brainstorm. From the critical process parameters already identified in the corrosion control document — the variables each credible damage mechanism actually runs on.

Typical ones: water content and dew point, chloride concentration, pH, sulphur, oxygen ingress, velocity, temperature at specific points, inhibitor residual, wash water rate.

Every window needs an action and an owner

The failure that is almost universal

Responding to exceedances honestly

A recorded exceedance means more than a return to limits.

Significant or prolonged excursions should also trigger a review of the affected corrosion loop’s rates, and may justify an inspection ahead of schedule — the same logic by which risk-based inspection shortens an interval when evidence changes.

What to take away

• An IOW bounds the variables that drive damage mechanisms, so the inspection plan’s assumptions stay valid.
• It is not a trip and not a product limit. Different timescale, different purpose.
• API 584 tiers them as critical, standard and informational, by consequence and time available.
• Parameters come from the CCD’s critical process parameters, not from a brainstorm.
• Every window needs a mechanism, an action, a response time and an owner.
• Implementation is the deliverable. Windows that reach no operator-visible system protect nothing.
• Repeated exceedances mean revisit the plan, not widen the window.