Between 2011 and 2019 I audited operating limits at bp as a subject matter expert. The questions below are the ones I would now add for AI.
How does AI optimisation push a unit towards its limits?
A real-time optimiser or an AI model looks for margin. It raises throughput until a constraint binds, holds furnace outlet or reactor temperature at the top of its range, and trims wash water or chemical injection to save cost. Each move can also take a corrosion-related variable, such as pH, chloride, water dew point or velocity, towards the edge of its window. The unit then spends more time near its limits, where a small upset reaches them sooner. In advisory mode the operator can refuse a move. In closed loop the constraint set is the only thing standing between the optimiser and the limit.
Which limits must the optimiser respect?
Most operators run a hierarchy. Safe operating limits are the boundaries beyond which the process enters a hazard the safeguards are designed for. Integrity operating windows protect fixed equipment from degradation; API RP 584 gives a guide for classifying them, and summaries of it describe critical, standard and informational levels by how fast damage follows an exceedance. Normal operating limits sit inside both and define where the unit should run.
An optimiser that knows only the normal limits cannot see the others. The limits register and the optimiser’s constraint set should match line for line, with a named owner for the comparison.
What has to be managed?
- Constraints in the optimiser. Each relevant limit is in the constraint set, with the margin kept from it, and documented in the operating envelope.
- Who may change a constraint. Relaxing a constraint, adding a bias, or a vendor update that changes how constraints are handled is a change to operating limits. It goes through management of change, with the same authority that owns the limit itself.
- Alarms and response at each limit. Each level needs an alarm or alert and a defined operator response that still works when the optimiser is driving the unit.
- Exceedance tracking and reporting. Exceedances are recorded, investigated by severity, and reported, whether the move came from the operator or the optimiser.
- Inspection consequences. When an integrity operating window is exceeded, the inspection and corrosion specialists are told, and the inspection plan is reviewed.
What about models that recommend running outside a window?
A model can recommend or write a set point outside a window because the window is missing from its constraints, or because it learned from data that never reached that region. A model trained on years of operation inside a narrow window has no evidence about behaviour beyond it, yet it will still extrapolate. Its valid range should be defined, alarmed and checked before its moves are accepted. The Linmara case shows the same gap in a soft sensor. Where the optimiser writes set points directly, the ownership, fallback and update controls on AI in process control and the DCS also apply.
What changes when AI monitors the limits?
Exceedance analytics can check every tag against every limit continuously and find short or repeated excursions that daily reports miss. It also produces more exceedances to investigate, and the procedure has to say who reviews them and how quickly. If an analytics tool sets or adjusts the limits themselves, that is a change to the limits and goes through MOC.
This page is part of AI in process safety management.
To review your operating limits system before an optimiser goes live, start with an autonomous operations briefing.