Emerging Skills Program
Integrity Operating Windows (IOW) & Corrosion Control Documents (CCD)
Set the operating limits that keep a unit inside its design envelope, and write the corrosion control document that tells operations what to do when it drifts. Eighteen modules, twelve volumes and twenty-six templates you keep.
Why this matters
The problem this solves
Most loss-of-containment events are not caused by a mechanism nobody had heard of. They are caused by a known mechanism running faster than anyone expected, because a process condition moved and nobody connected that movement to metal loss until the inspection report arrived — or until the leak did.
Inspection plans are built on what degradation has already done. They are far less effective at catching what it is about to do when feed sulfur creeps up, overhead pH drifts down, wash water rate is trimmed to save cost, or a fouled exchanger quietly pushes the next shell into the sulfidation range. That gap between process reality and inspection assumption is the space Integrity Operating Windows and Corrosion Control Documents were created to close.
The two documents do different jobs. A Corrosion Control Document is the unit's degradation knowledge base — what the metallurgy is, what can attack it, where, and how that is monitored and controlled. An Integrity Operating Window is the live control on top of it: the specific process limit that keeps degradation predictable, with a defined response when the limit is breached. A CCD without IOWs is a reference nobody acts on. IOWs without a CCD are limits nobody can technically defend.
This programme teaches both together, as a single work process, because that is how they function in a real plant. It also teaches the part most training skips entirely — what you actually do at 02:00 when the parameter has been out of window for six hours and operations is asking whether they need to slow the unit.
How it works
Two documents, one control loop
A Corrosion Control Document records what can damage the unit. An Integrity Operating Window is the live control sitting on top of it. Everything in the programme hangs off that distinction.
| Criterion | Integrity Operating Window | Corrosion Control Document |
|---|---|---|
| What it is | IOWA live process limit tied to a named damage mechanism, with the response defined before it is ever breached. | CCDThe unit’s degradation knowledge base — metallurgy, credible mechanisms, where they act, and how each is monitored and controlled. |
| What it answers | IOWIs the unit being run inside its envelope right now? | CCDWhat can damage this unit, where, and why? |
| What it controls | IOWOperating conditions: temperature, pH, chlorides, velocity, treat rate. | CCDDecisions: inspection scope, monitoring method, mitigation and RBI input. |
| Who owns it | IOWIntegrity sets and defends it. Operations run to it. | CCDIntegrity owns it. Process, inspection and materials feed it. |
| When it changes | IOWRarely — but every breach is an event, with a record. | CCDOn revision: after an MOC, a failure, a turnaround or a feed change. |
| Without the other | IOWLimits nobody can technically defend. | CCDA reference nobody acts on. |
What an operating window actually looks like
Not one number. A target range with graded limits either side, each carrying its own response and its own response time.
- Target range
- Where the unit should sit. Nothing to do but keep it there.
- Standard limit
- Degradation is moving. Engineering review and a planned response, on a stated timescale.
- Critical limit
- Immediate defined action. The response time is part of the limit, not a matter of judgement.
- Informational
- No immediate integrity consequence. Tracked because the trend matters, not the value.
And when the window is left
The part most training skips: what happens at 02:00, six hours into an excursion, when operations asks whether to slow the unit.
- 01
Breach
A limit is crossed, in the DCS, the historian, a laboratory result or a probe.
- 02
Assess
Duration, peak value and severity against the mechanism it was set for.
- 03
Respond
What operations do now, against a response defined before the event.
- 04
Review
Integrity assessment: has the corrosion rate changed, and does inspection scope change with it?
- 05
Close out
Record, CCD revision, RBI reassessment and MOC where the change is permanent.
Before you enrol
What you get, and what this is not
This programme is assessed and carries an EIM certificate. It is still not an industry credential, and that is worth being explicit about before you enrol rather than after.
What this programme gives you
- Twelve study volumes, over two hundred pages of technical content with more than thirty original diagrams
- Twenty-six working templates, including the CCD master template and the IOW excursion response matrix
- 300+ questions with explanations, plus 25 IOW exercises, 15 CCD exercises, 15 DMR cases and 10 major case studies
- A final examination and a practical IOW and CCD capstone
- EIM Professional Certificate in IOW & CCD on successful completion
- Access to every volume, template and reference sheet in the programme library for 1 year
What it does not
- Not an API, AMPP or CSWIP credential — no certifying body examines this subject
- Not preparation for a third-party certification exam
- Not a substitute for API 571 or API 580 if your employer requires one of those
- Not a software implementation — the documents are the deliverable, not a tool
- Not a source of limits to copy — see the note on numbers below
If you need a recognised credential, start at certification exam preparation.
What it covers
Eighteen modules
Content moves from foundation through intermediate to applied professional level. Filter to the track you care about, or open a module to see what you take away from it.
Where IOWs and CCDs sit inside asset integrity, mechanical integrity and process safety, and how an operating limit interrupts the pathway from process condition to loss of containment.
Reading PFDs and P&IDs through a degradation lens: streams, injection points, mixing points, dew points, contaminants and the conditions that create integrity threats.
The material-environment-stress-temperature-time relationship across general and localised corrosion, high-temperature damage, wet corrosion, cracking, embrittlement and mechanical damage.
Running a formal DMR: scope, disciplines, data requirements, corrosion loops, credible versus non-credible mechanisms, and documenting the outcome on a working worksheet.
What an IOW actually controls, how it links to a named damage mechanism, and how target range, standard limit and critical limit differ in intent and response time.
Temperature, pH, chlorides, sulfur, H₂S, hydrogen partial pressure, TAN, NH₄HS, water, velocity, injection and treatment rates, each mapped to mechanism, monitoring source and consequence.
Critical, standard and informational limits; how severity, response time and degradation kinetics drive categorisation; why arbitrary limits fail on both the conservative and the non-conservative side.
A sixteen-step development methodology from unit scope through mechanism identification, limit setting, monitoring, response definition, governance approval and periodic review.
Data sources from DCS and historian to laboratory and probes; the full excursion lifecycle from alarm through severity assessment to engineering review and close-out.
What a CCD is and is not, its relationship with corrosion loops, DMR, RBI, inspection and IOWs, plus ownership and revision control.
Building a CCD section by section: unit and process description, equipment population, metallurgy, loops, mechanisms, monitoring, mitigation, history and recommended actions.
Constructing defensible corrosion loops and inspection circuits, setting CML/TML strategy, and recognising the signature of poor circuitisation before it distorts your data.
How mechanism, damage rate, inspection effectiveness and confidence flow between the three programmes, and when an excursion genuinely warrants reassessment of a risk ranking or due date.
Applied walk-throughs of CDU, VDU, hydroprocessing, FCC, delayed coking, amine units, sour water strippers and sulfur recovery, unit by unit.
Integration with PSM, PHA, HAZOP, LOPA, bowtie and PSSR, and a decision tree for testing whether a proposed change requires IOW, CCD, RBI and inspection review.
Matching technique to mechanism — UT, PAUT, TOFD, profile RT, guided wave, PEC, thermography, coupons, probes and sampling — and understanding what each method cannot tell you.
Running the programme at enterprise level: policy, roles, technical authority, assurance, audit, document control, and a working KPI set with formulas and management interpretation.
Ten detailed investigations built from recognised refinery failure patterns, followed by a capstone in which you build an IOW set and CCD extract for an assigned unit.
Modules tagged Core are the heavyweight ones; the rest support and connect them.
The study library
Twelve volumes, not a slide deck
Over two hundred pages of technical learning content, with more than thirty original diagrams, process schematics, corrosion-loop maps, damage-mechanism graphics and IOW trend illustrations.
| Volume | Title | Coverage |
|---|---|---|
| Volume 1 | IOW, CCD & Corrosion Management Fundamentals | Modules 1–4 |
| Volume 2 | Integrity Operating Window Development & Management | Modules 5–9 |
| Volume 3 | Corrosion Control Document Development | Modules 10–12 |
| Volume 4 | IOW, CCD & RBI Integration | Modules 13–14 |
| Volume 5 | Process Safety, MOC, Inspection & Monitoring Integration | Modules 15–16 |
| Volume 6 | IOW / CCD Governance & Performance Management | Module 17 |
| Volume 7 | Practical Case Studies & Capstone Workbook | Module 18 |
| Volume 8 | IOW & CCD Visual Handbook | All modules |
| Volume 9 | Self-Paced Exercise Workbook | All modules |
| Volume 10 | Quick Reference Handbook | All modules |
| Volume 11 | Module Quizzes & Knowledge Checks | All modules |
| Volume 12 | Final Examination Preparation Guide | All modules |
Volume 8 — Visual Handbook
Damage morphology, process-unit maps, corrosion loops, IOW diagrams, excursion and DMR workflows, CCD architecture, and the RBI, MOC and inspection linkages, drawn as original teaching illustrations.
Volume 9 — Exercise Workbook
Twenty-five IOW exercises, fifteen CCD development exercises and fifteen DMR cases, each with a full worked solution and the reasoning behind it.
Volume 10 — Quick Reference Handbook
Condensed sheets for terminology, damage-mechanism checklists, parameter-to-mechanism mapping, excursion workflow, corrosion-loop development, RBI and MOC integration, monitoring selection, governance and KPIs. Designed to live on your desk.
Volume 11 — Quizzes & Knowledge Checks
Module-level checks that confirm you have absorbed each block before moving forward.
Volume 12 — Final Examination Preparation Guide
Structured revision, worked scenario walk-throughs and a full practice assessment.
What you keep
Twenty-six working templates
Training that ends when the last quiz closes has limited value. This is the practical residue of the course, and for many participants the single most-used deliverable.
- 01Damage Mechanism Review Worksheet
- 02Damage Mechanism Register
- 03Corrosion Loop Register
- 04IOW Register
- 05IOW Definition Sheet
- 06IOW Parameter Selection Sheet
- 07IOW Excursion Report
- 08IOW Excursion Assessment
- 09IOW Monthly Dashboard
- 10Chronic Excursion Tracker
- 11CCD Master Template
- 12CCD Review Checklist
- 13Corrosion Monitoring Plan
- 14Corrosion Probe Register
- 15Corrosion Coupon Register
- 16Inspection Feedback Sheet
- 17RBI–IOW Interface Sheet
- 18MOC–IOW Review Checklist
- 19MOC–CCD Review Checklist
- 20Unit Corrosion Management Plan
- 21Integrity Risk Escalation Form
- 22IOW Audit Checklist
- 23CCD Audit Checklist
- 24IOW KPI Dashboard
- 25CCD Revision Register
- 26Standards & Terminology Matrix
The CCD Master Template
Twenty-six controlled sections, from document control and unit description through corrosion loops, susceptible locations, historical degradation, IOW parameters, monitoring, mitigation, chemical treatment and RBI linkage, to lessons learned and revision history.
The IOW Excursion Response Matrix
Tag, unit, equipment, related mechanism, normal value, limit, excursion start and end, duration, peak value, immediate response, integrity assessment, inspection requirement, RBI, CCD and MOC impact, responsible owner, close-out date and final disposition — the record an auditor will ask for.
Practice
Exercises, cases and the question bank
Every question carries the correct answer, an explanation, and the reason each alternative is wrong — weighted roughly 30% foundation, 45% intermediate and 25% applied professional.
25+ IOW exercises
Practical
Each provides a unit, equipment, metallurgy, process conditions, chemistry, a normal and abnormal trend and inspection history. You decide whether an IOW is warranted, which parameter, which monitoring method, what the excursion means and what must be documented.
15+ CCD development exercises
Build it
Working from a simplified PFD, metallurgy, stream chemistry, equipment list and inspection history, you identify loops and mechanisms, select monitoring and inspection, define IOW candidates and populate the CCD sections.
15+ DMR cases
Judgement
You separate active from credible from non-credible mechanisms, justify location and metallurgical susceptibility, and state what evidence would confirm or discount each one.
10 major case studies
Real patterns
Crude overhead chloride and water management, sulfidation after a severity increase, NH₄HS corrosion in hydroprocessing, repeated temperature excursions, amine corrosion and cracking, feedstock change, RBI assumptions invalidated by chronic excursions, poorly defined corrosion loops, a CCD not updated after MOC, and a near loss of containment the process data showed long before inspection did.
Assessment
How you are assessed, and what you are awarded
| Stage | What it involves |
|---|---|
| Module knowledge checks | Untimed, unlimited and formative. Confirm each block before moving on. |
| Final examination | Eighty multiple-choice and scenario-based questions drawn across all eighteen modules. |
| Practical capstone | One comprehensive IOW and CCD case-study assessment in which you produce a defensible parameter set and CCD extract for an assigned unit. |
| Passing standard | 70%. |
| On success | EIM Professional Certificate in Integrity Operating Windows (IOW) & Corrosion Control Documents (CCD), issued by Excellence Integrity Management and suitable for submission as evidence of continuing professional development. |
Examination scheduling, attempt allowances, retakes and certificate administration are handled by EIM and confirmed at enrolment.
The return
What you gain, and what your facility gains
For you
- A discipline that is in short supply — IOW and CCD ownership sits at the intersection of corrosion, process and inspection, which is precisely why few engineers hold all three
- Credibility in the room: you can defend a limit on technical grounds to a process engineer, an operations manager and a technical authority
- A route into corrosion and integrity roles from inspection, maintenance or process positions
- A portable template library you will use for the rest of your career
- Documented continuing professional development, with a certificate for a competence file or a role application
For your facility
- Fewer surprises — degradation anticipated and controlled instead of discovered at turnaround
- Better inspection value: scope directed by process reality rather than by calendar, with RBI assumptions that reflect how the unit is actually run
- A defensible process safety position, with IOWs acting as degradation-control barriers and the excursion record as evidence the barrier was managed
- Reduced lost profit opportunity, where limits set on a technical basis release margin that excessive conservatism is currently giving away
- Corporate knowledge that survives staff turnover, captured in a CCD rather than in one engineer's memory
Who it's for
Two groups, neither diluted
Module 2 builds the process foundation inspection-trained engineers often lack, and Module 3 builds the metallurgical foundation process-trained engineers often lack, so neither group is left behind.
Already working in the field
Formalising what you do
Professionals in refinery, petrochemical, gas-processing and chemical environments who already work with inspection, corrosion or process data, and now need an auditable IOW and CCD programme that stands up to a technical authority review.
Moving into corrosion and integrity
A structured route in
Engineers with a solid grounding in inspection, corrosion, process or maintenance who have never personally developed an IOW register or written a CCD, and want a route into the discipline rather than learning it by osmosis.
Graduates and career changers
Equally welcome
There is no formal prerequisite. The programme builds its own foundation in Modules 1 to 3 and does not assume you arrive with corrosion expertise.
Typical participants
- Materials Engineers
- Corrosion Engineers
- Inspection Engineers
- Asset Integrity Engineers
- RBI Engineers
- Mechanical Integrity Engineers
- Corrosion Technologists
- Process Engineers
- Process Safety Engineers
- Reliability Engineers
- Maintenance Engineers
- Operations & Production Engineers
- Metallurgists
- Turnaround personnel
- Pressure Equipment Engineers
- Piping & Tank Engineers
- API Inspectors & Supervisors
- QA/QC Engineers
- Technical Authorities
- Integrity, Operations & Maintenance Managers
- EPC/EPCM engineers and consultants
The capability
The chain you should be able to reason through
The programme is built backwards from a single capability: walking into a unit review and working through this without prompting.
- 01What unit am I reviewing, and what equipment and materials are present?
- 02Which process streams contact that equipment, and which damage mechanisms are credible?
- 03Where is the damage most likely, and which process variables accelerate or suppress it?
- 04Which of those variables should become IOW parameters, and how will they be monitored?
- 05What limit is technically justified, and what happens when it is exceeded?
- 06What must operations do immediately, and what integrity assessment is required?
- 07Has the expected corrosion rate changed? Does RBI need reassessment? Does the CCD need revision?
- 08Was the change managed through MOC, and how is the issue documented and closed?
Outcomes
What you will be able to do
- Facilitate or contribute meaningfully to a formal Damage Mechanism Review for a process unit
- Construct corrosion loops and inspection circuits that hold together technically, and recognise circuitisation that will corrupt your corrosion-rate data
- Select IOW parameters that are controllable and genuinely indicative of the mechanism, rather than simply convenient to measure
- Distinguish an integrity operating window from a process operating limit, a safe operating limit, an alarm limit, a design limit and a quality limit
- Assign critical, standard and informational levels using a defensible risk-ranking basis
- Assess an excursion: duration, severity, mechanism impact, immediate control, inspection requirement, RBI implication and close-out
- Develop a Corrosion Control Document from unit description through to recommended actions and revision control
- Test a proposed process change through an MOC lens and identify which integrity documents it invalidates
- Build and interpret a programme-level KPI set that tells management whether the integrity envelope is actually being held
Choosing a format
Why self-paced, for this subject
IOW and CCD work is not a lecture topic. It is a series of judgement calls made against a real unit, which is why this runs as a working programme you keep rather than sessions you attend.
| Criterion | This programme | A scheduled live course | A recorded lecture series |
|---|---|---|---|
| When you start | This programmeThe day you enrol. All twelve volumes open at once. | A scheduled live courseOn the next cohort date. | A recorded lecture seriesImmediately. |
| When the unit needs you | This programmeYou stop, and pick it up where you left it. Nothing is missed. | A scheduled live courseYou miss that session. | A recorded lecture seriesYou scrub back through it later. |
| Lecture hours | This programmeNone. It is a reading and working programme, built around exercises. | A scheduled live courseScheduled sessions, typically across several days. | A recorded lecture seriesHours of video, at the pace the recording was made. |
| What you keep afterwards | This programmeTwelve volumes, twenty-six templates and a quick-reference handbook. | A scheduled live courseYour notes and a handout pack. | A recorded lecture seriesAccess for as long as the subscription runs. |
| Revising it in a year | This programmeOpen Volume 10 at the page you need. | A scheduled live courseYour own notes, if you can find them. | A recorded lecture seriesScrub the video again. |
| How it is assessed | This programmeAn eighty-question examination and a practical capstone. 70% to pass. | A scheduled live courseWhere the provider sets one. | A recorded lecture seriesUsually not assessed. |
None of this makes live training the wrong choice — EIM runs live cohorts and delivers this same subject in-house for teams. These are different formats with different costs, and for an engineer fitting study around a running unit, these are the lines that usually decide it.
How you learn
Self-paced does not mean passive
Every chapter follows the same architecture, so you always know where you are: why the topic matters, learning objectives, key terminology, the technical explanation, then the damage mechanism, process, materials, IOW, CCD, inspection, RBI and process safety implications, followed by a practical example, visual explanation, worked exercise, common mistakes, good industry practice, key takeaways, a knowledge check and references.
No physical attendance is required and there is no fixed schedule. All twelve volumes are available in full from the day you enrol, and access to every volume, template and reference sheet runs for 1 yearfrom that day.
Prompts placed throughout the text
- STOP & THINK
- IDENTIFY THE DAMAGE MECHANISM
- WHAT IS DRIVING THE DAMAGE?
- SELECT THE IOW PARAMETER
- IS THIS AN IOW?
- INTERPRET THE TREND
- WHAT DOES THIS EXCURSION MEAN?
- BUILD THE CORROSION LOOP
- UPDATE THE CCD
- DOES RBI NEED REVIEW?
- DOES THIS REQUIRE MOC?
- WHAT WOULD YOU INSPECT?
- WHAT SHOULD OPERATIONS DO?
- WHAT SHOULD BE ESCALATED?
- ENGINEERING CAUTION
- COMMON MISCONCEPTION
- LESSONS LEARNED
These are not decoration. They force the judgement call before the text gives you the answer, which is the only reliable way to build engineering judgement from a written programme.
Standards referenced
What the programme works from
Every technical position is traceable to a recognised standard, a peer-reviewed source or a published industry failure investigation. Editions are verified before publication.
| Standard | Title | Role in this course |
|---|---|---|
| API RP 584 | Integrity Operating Windows — Second Edition, December 2021 | Primary IOW framework |
| API RP 970 | Corrosion Control Document Systems — Second Edition, April 2023 | Primary CCD framework |
| API RP 571 | Damage Mechanisms Affecting Fixed Equipment in the Refining Industry | Mechanism reference |
| API RP 580 / 581 | Risk-Based Inspection, and Risk-Based Inspection Methodology | RBI integration |
| API 510 / 570 / 653 | Pressure Vessel, Piping and Tank inspection codes | Inspection interface |
| API RP 572 / 574 / 575 / 576 / 578 | Inspection practices for vessels, piping components, storage tanks, pressure-relieving devices, and alloy material verification | Inspection technique selection |
| API 579-1 / ASME FFS-1 | Fitness-For-Service | Assessing found damage |
| API RP 941 | Steels for Hydrogen Service at Elevated Temperatures and Pressures | HTHA limit basis |
| API 932 / 939 / 945 series | REAC corrosion control, sulfidation corrosion avoidance, and environmental cracking in amine units | Unit-specific guidance |
| AMPP / NACE, ISO, ASME | Corrosion standards, materials and construction codes | Supporting technical basis |
| CCPS, Energy Institute | Process safety and integrity management guidance | PSM integration |
A note on numbers
This programme will never hand you an IOW limit to copy. Chloride limits, NH₄HS concentrations, TAN thresholds, velocity ceilings, pH floors, temperature limits and corrosion rates all depend on licensor design, metallurgy, equipment condition, fluid chemistry, operating history and unit configuration. Wherever a figure appears for teaching purposes it is clearly marked as an illustrative training example, and the course states plainly that the applicable limit must be established through plant-specific engineering assessment. Any training that tells you otherwise is doing you a disservice.
Actual plant decisions on IOW limits, corrosion rates, materials, process chemistry, alarm limits, inspection, RBI, repair, continued operation, shutdown or process change must rest on applicable regulations, approved engineering practice, valid process data, equipment condition, qualified engineering assessment, process licensor input and technical authority approval. This course does not replace facility-specific engineering review.
For a team
Also delivered as a corporate package
FAQs
Questions people ask first
No. API RP 584 is a recommended practice, not a certification scheme, and API's Individual Certification Program has no exam for it. The competency is real and in demand; the third-party credential does not exist.
This programme awards the EIM Professional Certificate in IOW & CCD on passing the final examination and capstone. That is an EIM qualification and evidence of continuing professional development — it is not, and is not presented as, an API, AMPP or CSWIP credential.
There is no formal prerequisite. A working familiarity with process plant equipment and basic engineering principles is assumed.
Prior exposure to inspection, corrosion, process or maintenance work makes the applied modules land faster, but the programme builds its own foundation in Modules 1 to 3 and does not assume you arrive with corrosion expertise.
Yes, and the structure is deliberate about it. Module 2 builds the process foundation that inspection-trained engineers often lack, and Module 3 builds the metallurgical foundation that process-trained engineers often lack, so neither group is left behind.
No, though the two work well together. An IOW set is built from a damage mechanism review, which is also the foundation of RBI, so teams that have done RBI properly already have most of the input. Teams that have not can still build a working IOW set, and Module 13 covers the interface in both directions.
Deliberately not. Chloride limits, NH4HS concentrations, TAN thresholds, velocity ceilings, pH floors, temperature limits and corrosion rates all depend on licensor design, metallurgy, equipment condition, fluid chemistry, operating history and unit configuration.
Every figure used for teaching is marked as an illustrative example, and the programme teaches how a limit is derived so that yours can be established through plant-specific engineering assessment.
Yes. It is also delivered as a corporate package, with unit-specific case studies developed around your own facility, cohort progress reporting and optional facilitated review sessions.
Questions about this programme?
Tell us your role and what you are trying to fix, and we will point you at the right material — or tell you honestly if this is not the one you need.