AGGUS (Becht Engineering Co., Inc.) 

With Becht Engineering, we are now working with clients very frequently to develop integrity operating windows. So, I want to begin by saying that although the FCC guys will argue with my opinion, I believe the subject of IOWs is unique in refining because you have everything you would not want for mechanical integrity. You have high temperature/high pressure, a process that can run away either, and high concentrations of both hydrogen sulfide and hydrogen. You also put a little water in the process just for fun. 

I find that within a lot of the sites where we work, the definition of the IOW varies. For some of the refineries, the IOWs are synonymous with the SOLs (safe operating limits). These are limits that require immediate operator response. Parameters – such as operating temperature limits, as we are discussing – can be considered IOWs in those cases. Other refineries are in a unique category where the critical limit would be something that requires 24 to 48 hours for a response. A downtime informational limit, which those “damned engineers come up with”, is something that could have a long-term (months or years) type of impact. The value of these informational alarms is often up for debate. For the guy sitting at the console who must deal with the alarm, it is sort of a nuisance. It is better monitored by the engineers via their own monitoring tools, which is my take as well. 

My recommendation is for sites to maintain commonality between SOLs and IOWs, if only just to eliminate confusion between Operations and Engineering personnel. In that case, your critical IOW alarms would be the ones associated with exceeding MAWPs (maximum allowable workable pressures), including those that could induce cracking mechanisms, like getting in a 50ºF or a 25°F approach to your Nelson curve for HTHA (high-temperature hydrogen attack) or anything that could rapidly foul your process equipment; for example, total loss of wash-water. By this methodology, standard alarms would be the one-week window ones. For example, a typical standard alarm would be low wash-water rate, e.g., less than 10% free water remaining after injection into the reactor effluent stream. Reactor heater outlet temperatures that are getting close to a high temperature sulfidation limit or separator temperatures that are approaching your desublimation temperatures would be standard alarms also. Another example, in the case of the gasoil hydrotreaters, would be hot feed temperature approaching naphthenic acid corrosion temperature: approximately 450°F or so. 

For many sites, setting the severity level of the alarms is a collaborative effort. You get the process engineer and the fixed equipment engineer involved, as well as the Ops team. Then, if a site has a reliability engineer, he/she tends to lead the team. Many refineries – although not all – are managing the IOWs through the Management of Change process. I think that is a great idea; because not only do you get those groups involved, you would then also be involving Process Safety personnel, as well as Environmental bringing a little insight to the effort. 

The flow of operator response is shown the next slide. That process is typically coordinated by the board operator at most refineries we have come across. So, he or she, being the first point of contact with the alarm and the required response, will typically receive it via the DCS (distributed control system) alarm management system. The board operator is the first set of eyes, so it makes sense for that person to respond. Some sites are now proceduralizing the responses to these alarms. I do not know the efficacy of that approach. Often, excursion is best dealt with using operator judgment rather than a controlled procedure. So, for a lot of refineries, we also find that their alarm management system has the ability to text, page, and/or email the process engineer down on the bottom and your fixed equipment engineer up on the top. So, almost 10% of the time, Operations response will be coordinated through the Console Supervisor. However, it is best to have a notification system, so the engineers are aware of the event. I recommend using that system to contact your engineers. 

JOHNSON (Motiva Enterprises LLC) 

Motiva’s approach to integrating operating windows is joined at the hip with the safe operating limits where we have multiple layers of data we are monitoring. In the beginning, we set up these limits into different layers to manage corrosion limits, safe operating limits, and any other pertinent information available. All the data is managed through a Management of Change work process. Process engineers are interfacing and performing alarm rationalization, as part of their daily routine work with console operators, to ensure that these layers we have are appropriately set and being abided by and responded to accordingly. Whether it is with procedure or the electronic system that is monitoring parameters, all of this is being performed daily. Motiva’s approach is a multi-layer, multi-discipline approach. 

BRANT AGGUS (Becht Engineering) 

Hydroprocessing is an area that is somewhat unique in refining in the sense that it has everything that you do not want for mechanical integrity: high temperature, high pressure, and a process that can run away at both, as well as high concentrations of hydrogen sulfide and hydrogen; and just to make things fun, injection of water into the process. 

Defining hydroprocessing IOWs varies. For some refiners, IOWs are synonymous with SOLs (safe operating limits); therefore, ‘critical’ limits require immediate operator response. In this case, parameters such as operating temperature limits (typically 800 to 850°F for reactor vessels based on reactor design and operating pressure) can be considered IOWs. 

At other refineries, IOWs are in a unique category with a ‘critical’ limit being a 24- to 48-hour response, down to an ‘informational’ limit being something that could have a long-term (months to years) impact. The value of informational IOW alarms is often open for debate. To the unit operator, these alarms are often perceived as a nuisance and better off monitored by the unit engineer via his/her own monitoring tools. 

My recommendation is to maintain commonality between IOW and SOL severities, if only to eliminate confusion among Operations and Engineering personnel. In that case, critical IOW alarms should be those that are going to be those associated with exceeding MAWPs and those that could potentially induce cracking mechanisms (in the case of hydroprocessing HTHA) or rapidly foul process equipment (loss of wash-water in circuits without amine scrubbers). Standard alarms would be the ‘one-week window’ type those with: 

1. Low wash-water rate (less than 10% in liquid phase at the injection point), 

2. Reactor heater outlet temperatures approaching high-temp sulfidation limit (for low alloys),  

3. Separator temperatures approaching near ammonium bisulfide/ammonium chloride desublimation temperatures, and  

4. Hot feed temperatures approaching naphthenic acid corrosion temperature (typically 450°F). 

Setting the severity level of IOW alarms is really a collaborative effort. At many refineries, an Operations team representative, process engineer, and fixed equipment engineer are required approvers. Several refineries manage IOWs through the management of change process, which typically requires sign-off from the Process Safety Group also. 

Operator response to critical IOW alarms is coordinated by the board operator at most refineries. He or she is the first point of contact with the alarm and the required response, which is typically relayed via the DCS alarm management system. At some (not all) sites, these responses are proceduralized, with the alarm management system referring the board operator to a refinery standard operating procedure. Note that for critical and standard alarms, most DCS alarm management systems can also notify plant personnel by email or text. I recommend using one of these electronic methods to contact the unit process engineer and fixed equipment engineer.