Integrity Operating Windows (IOWs) Explained: The Limits That Protect the Steel
What integrity operating windows are, the three IOW categories in API RP 584, how IOWs and corrosion control documents fit together, and how to start.
By Syed Hasan1 Nov 20265 min read
Operators watch hundreds of process variables to keep a unit on specification. A handful of them also decide how fast the equipment corrodes or cracks. Run outside those limits for long enough and the damage builds up quietly, long before any leak or inspection shows it. Integrity operating windows (IOWs) are how a plant writes those limits down, alarms them and acts on them.
This guide explains what IOWs are, the three categories in API RP 584, how they link to corrosion control documents, and the steps to build a working IOW programme.
Short answer: IOWs are limits on process variables that affect equipment integrity, such as temperature, pressure, chemistry or flow. API RP 584 groups them as critical (immediate action, damage within hours to days), standard (return within a set time, damage over weeks to months) and informational (trended by specialists for long-term damage). They work best when built from a corrosion control document and written into operating procedures.
What an IOW is, and what it is not
API RP 584, Integrity Operating Windows, now in its second edition (December 2021), describes IOWs as established limits for process variables that can affect the integrity of equipment if the process deviates from them for a set period of time. The second edition added an annex on barriers to successful IOW implementation.
IOWs are a subset of operating limits. A product-quality limit or a throughput target is not an IOW. A limit on, say, wash-water rate, overhead pH, chloride in a feed, or a heater tube metal temperature can be, if exceeding it speeds up a damage mechanism. A good rule: if breaking the limit for a week would change what the inspector finds at the next turnaround, it is a candidate IOW.
The three categories
| Category | When damage happens | Who acts, and how fast |
|---|---|---|
| Critical | Rapid: typically hours to days | Operators take immediate, predefined action to return within the limit, or shut down in a controlled way |
| Standard | Over a specified time: typically weeks to months, or within a turnaround interval | Operators and engineers return the variable within a set response time; exceedances are reported |
| Informational | Long-term damage mechanisms | Specialists trend the data and adjust inspection or other limits |
Two practical points follow. First, critical limits must be few and clearly justified, because each one demands an immediate response; too many and operators stop trusting them. Second, every critical and standard limit needs a defined response time and action, not just an alarm.
How IOWs and corrosion control documents fit together
A corrosion control document (CCD), the subject of API RP 970, records for each circuit the damage mechanisms, the factors that drive them, and the history. It is the natural source of IOWs: each important driver in the CCD becomes a candidate limit. When an IOW is exceeded, the integrity team uses the CCD to judge what damage may have occurred and whether inspection needs to change.
The link runs both ways. When the feed, the process or the inspection findings change, the CCD and the IOWs are reviewed together, through management of change.
Building an IOW programme: seven steps
- Start from the damage mechanisms. Use the CCD or a damage mechanism review for each unit.
- Pick the variables that drive them. Only those that measurably affect integrity.
- Set the limits with the specialists who understand the mechanism, using data, experience and standards.
- Choose the category (critical, standard, informational) by how quickly damage develops.
- Define the response for each critical and standard limit: who acts, what they do, and within what time.
- Build it into operations: alarms, operating procedures, shift handovers and training.
- Review exceedances regularly and feed them into inspection planning and RBI.
Common reasons IOW programmes fail
- Too many limits. A list of hundreds of IOWs is a list nobody reads. Fewer, better limits work.
- No defined response. An alarm without a procedure is just noise.
- Limits nobody can measure. Sampling once a week cannot police a limit where damage happens in hours.
- No feedback. If exceedances are never reviewed, the programme cannot improve and inspection cannot adjust.
Learn more with EIM
EIM's self-paced Integrity Operating Windows (IOW) & Corrosion Control Documents (CCD) programme shows how to set the operating limits that keep a unit inside its design envelope and how to write the CCD that tells operations what to do when it drifts. It has 18 modules, 12 study volumes and 26 templates to keep, with a foundation module for both process-trained and inspection-trained engineers. It leads to an EIM Professional Certificate, awarded after an 80-question exam and a practical capstone (70% to pass). It is EIM training, not an API credential. See the programme
EIM's live Asset Integrity Management course also covers IOWs within a 16-session programme on AIM; check the course page for the next batch. For operators, EIM's asset integrity services include IOW development.
Frequently asked questions
What is the difference between an IOW and an operating limit?
All IOWs are operating limits, but not all operating limits are IOWs. An IOW is a limit whose exceedance affects equipment integrity, not just product quality or throughput.
How many IOWs should a unit have?
As few as truly matter. Industry practice favours a short list of well-justified limits, especially critical ones, over a long list nobody can act on.
What is the difference between a critical and a standard IOW?
Critical IOWs guard against rapid damage, typically within hours to days, and need immediate predefined action. Standard IOWs guard against damage over weeks to months and allow a set response time.
Which API document covers IOWs?
API RP 584, Integrity Operating Windows, second edition (2021). Corrosion control documents are covered in API RP 970.
Do IOWs replace inspection?
No. IOWs reduce the chance of damage and flag when it may have occurred; inspection confirms the condition of the equipment.
Sources
- API RP 584, Integrity Operating Windows, 2nd edition (December 2021). Cited, not quoted.
- API RP 970, Corrosion Control Documents. Cited, not quoted.
- Inspectioneering: Integration of integrity operating windows into process safety management
- Becht: So, you've got IOWs. What's next?
- All checked 7 October 2026.
