THE INTELLIGENT REFINERY LEADERSHIP PROGRAMME
AI earns its place in a refinery one decision at a time.
20-Session Programme · 25 Minutes Per Day · Free · For leaders of Nigeria’s modular and mega refineries
WEEK 3 OF 4 · RELIABILITY, INTEGRITY, ENERGY AND SUPPLY · SESSIONS 11–15 · WORK AT YOUR OWN PACE
Reliability · Chapters 9 and 10SESSION 11
Asset Health, Maintenance and Integrity Evidence
Why This Matters
Week 3 moves from the plan to the equipment, the energy and the movements that decide whether the plan is executable. We start with reliability, because this is where AI proposals arrive most confidently: a model that predicts failure. I have sat in reviews where an alert was celebrated as a prevented failure when nobody could show what work followed, or whether the fault was ever found. Today you learn to judge a maintenance or integrity application by the response it makes possible, to read a reliability investment honestly, and to keep inspection evidence from being dissolved into a confidence score. Your company's equipment does not care how good the model is.
25-Minute Module
0:00 – 5:00
A warning is worth its response time
- Design a maintenance application around a decision and its response time: can the team verify the signal, plan the work and obtain an operating window.
- THE DOCTRINE
A prediction creates little value if the refinery cannot respond while an intervention is still useful.
- Start with the asset register: identifier, service, duty, criticality, configuration and work history. Similar names in the historian and maintenance system can refer to different assets or periods of service; settle that before any model is evaluated.
- Choose an actionable failure concern. A general claim to predict failure is difficult to test. A bounded application covers one equipment family and one set of symptoms within a known operating range, with the reliability engineer deciding which indicators matter and which other explanations (changed duty, instrument problems, recent maintenance) must be considered.
- An alert hours before an event helps little if the approved response takes several days; a very early, weakly specific signal creates a queue of unnecessary inspections. Judge timing against the actual work process.
Ask how many days the response takes before you ask how early the model warns.
5:00 – 10:00
Close the response chain
- Link a recommendation to a reviewable case, not an assumed work outcome: asset, evidence, uncertainty, operating context, proposed next assessment. A competent person decides between inspection, monitoring or work planning.
- Where work is approved, track the spare, crew, permit, isolation and production window. The application need not own every step, but its account should show whether the response occurred. A repeated alert nobody can act on may expose a procurement or resourcing problem.
- Close the case with findings: confirmed, a different explanation, or unresolved. If a part was replaced but the expected fault was not established, the alert is not automatically labelled correct.
- MODULAR REFINERY · THE WORKED CASE
- Modular refinery. One critical pump, an imported spare and a small crew. The spare's location and the one production window decide whether an early warning is usable at all.
INTEGRATED (MEGA) REFINERY · THE PARALLEL- Integrated (mega) refinery. Many equipment families, systems that name assets differently, and windows negotiated across units. Choose one family and make the window a tracked step in the case.
Honest outcomes are the only training data worth keeping. Unresolved is a legitimate answer.
10:00 – 16:00
The worked reliability investment
- All figures are assumptions. A monitoring programme costs $120,000 a year. One identified event has a 40% probability in the year without it, with a consequence of $900,000 lost contribution plus $100,000 incremental repair, $1,000,000 in total. Lost contribution already covers the affected production; do not add it again as lost sales revenue.
Line (assumed) Calculation Result Event probability without, then with, programme and response 40% to 15% 25 points Expected avoided consequence (0.40 − 0.15) × $1,000,000 $250,000 Less programme, planned responses, false alerts $250,000 − $120,000 − $50,000 − $20,000 $60,000 Sensitivity: probability falls only to 30% (0.40 − 0.30) × $1,000,000 = $100,000; $100,000 − $190,000 Negative $90,000 - The $60,000 is before tax, financing and excluded costs, and it depends on a material fall in probability. Ask what evidence supports the reduction and whether your response organisation can deliver it.
- THE DOCTRINE
An expected-value calculation does not justify accepting a safety exposure. Safety and integrity requirements remain separate decision conditions, and where incident history is sparse the uncertainty must stay visible.
- Validate it on missed events, false alerts, warning time and resulting work, against current condition monitoring. Use time-separated validation across operating modes, keep later maintenance findings out of the inputs, and record equipment replacements so they are not credited to the model.
When the case turns on one probability, the meeting should be about that probability.
16:00 – 21:00
Integrity evidence and the action register
- Integrity decisions need identifiable assets, suitable methods, competent assessment and traceable findings. The book cites the U.S. OSHA standard on mechanical integrity only as an international reference, not Nigerian law or proof of compliance; your refinery establishes its own requirements and technical basis.
- Preserve what the finding represents: location, method, date and equipment condition. One location cannot stand for a whole system. Keep original reports, and the approval of any corrected extraction. A model's interpretation is a separate record with its version, inputs and limitations.
- Ask a bounded question. A computer-vision feature is not a finding that equipment is fit for continued service, and a remaining-life trend on a short history can be highly sensitive to measurement error.
- Keep the action register honest. An assessment closes when competent review is accepted; a repair when approved work and verification are accepted. A work order issued or a document uploaded is not closure.
- A fictional review: a model recommends a longer inspection interval from a stable trend, but measurement locations changed halfway and service changed after a modification. Do not choose an intermediate interval. Record the discontinuity, keep the approved arrangements and refer it to the integrity authority.
Never present a model's confidence score as an integrity assurance statement.
21:00 – 25:00
Before you close the laptop
- Pick one equipment family in your company where a response can be funded and executed, and write its chain: alert, technical review, work planning, operating window, closure.
- Then find one integrity action open across several reviews and name the role authorised to resolve it.
- THE DOCTRINE
Make useful warning actionable, while refusing to count every alert as a prevented failure.
- That is Section 11 of your plan: one asset family, the failure concern, the response chain and the integrity evidence.
If you cannot name who closes the oldest open action, you have found your first finding.
Key Terms
Actionable failure concern
One bounded condition in one equipment family, with defined symptoms and operating range, recognised early enough for the approved response to be carried out.
Response chain
The tracked sequence from alert through technical review, work planning and operating window to closure with findings.
Time-separated validation
Testing a model on periods after those it learned from, so later maintenance findings cannot leak into its prediction inputs.
Closure criterion
The evidence that makes an integrity action complete, defined by the action itself, such as accepted repair and verification, not an issued work order.
Self-Check — Before You Submit
1. An application recommends a longer inspection interval from a stable trend. The original reports show measurement locations changed halfway, and service changed after a modification. Your integrity manager suggests a compromise interval. What do you do?
- A. Accept the compromise, because it balances the model against the existing plan
- B. Record the data discontinuity, keep the approved arrangements and refer the proposal to the appropriate integrity authority
- C. Accept the model's interval, because the trend is mathematically stable
- D. Ask the vendor to retrain the model on the full series and adopt the new answer
B. Record the data discontinuity, keep the approved arrangements and refer the proposal to the appropriate integrity authority — The series is not one consistent inspection basis, so neither the model's interval nor a midpoint is supported. A compromise splits the difference between evidence and an unsupported inference.
2. In the book's assumed reliability case, the programme costs $120,000, responses $50,000 and false alerts $20,000, against a $1,000,000 consequence. If the event probability falls only from 40% to 30%, what is the stated incremental result?
- A. Positive $60,000
- B. Positive $100,000
- C. Negative $90,000
- D. Negative $20,000
C. Negative $90,000 — The avoided consequence is (0.40 − 0.30) × $1,000,000 = $100,000, less $190,000 of costs, giving negative $90,000. The $100,000 option is the avoided consequence before the costs are taken off.
3. When is a repair action on the integrity register properly closed?
- A. When the approved work and the required verification have been accepted
- B. When a work order has been issued to maintenance
- C. When the contractor uploads a completion report
- D. When an email from the area supervisor says the job is done
A. When the approved work and the required verification have been accepted — Closure is defined by the action. A work order, an uploaded document or a favourable email is administrative activity, which must not masquerade as resolution.
Today’s Assignment
Write Section 11 of your plan: one asset family in your company, its actionable failure concern, the response chain and the integrity evidence behind it.
- Name one equipment family in your business where a response can be funded and executed, and state the failure concern in one bounded sentence.
- Map the chain from alert to closure, give the response time in days, and say whether a warning would arrive early enough.
- State when an application must withhold a recommendation, and how response completion would be reported alongside model performance.
- Trace one long-open integrity action to its finding, asset, required response and closure criterion; give the reason for delay and the role authorised to resolve it.
- The honest part: where does your company count an alert, a work order or an upload as a result?
- Not at a refinery? Use the refinery equipment decision your work touches most directly. Aim for 400 to 900 words; label figures as assumptions.
YOUR 90-DAY PLAN
Section 11 — One asset family: the failure concern, the response chain and the integrity evidence.
How this is marked — the rubric
| States one bounded failure concern for a named equipment family, with indicators and alternative explanations | 25 |
| Maps the full response chain with a response time and a judgement on whether warning would be early enough | 30 |
| Traces one long-open integrity action to finding, asset, closure criterion, reason for delay and an authorised role | 25 |
| Names one real place where the company counts activity as resolution | 20 |
| Total · pass mark 70 | 100 |
Submitting session 11
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 11, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.Capabilities Covered
Actionable failure concernsResponse-chain mappingExpected-value scrutinyIntegrity evidenceHonest closure
Reliability · Chapter 11SESSION 12
Turnaround Planning and Execution
Why This Matters
A turnaround concentrates into weeks the decisions your refinery normally spreads across months: scope, materials, specialist labour, access, inspection findings and restart. The money at stake is in the production window, and the window is where optimistic reporting does most damage. I have watched a turnaround report 95% procurement completion for days while one missing component prevented restart. Today you learn to make scope reviewable, to test readiness rather than percentage complete, to price an expediting decision honestly, and to treat restart as an acceptance decision. AI can test schedules and organise evidence. Your company still has to make the plan physically executable.
25-Minute Module
0:00 – 4:00
Start with the purpose of the shutdown
- Define the purpose of the shutdown and the approved scope before anything else. Then sort the work into three kinds: mandatory, condition-driven and economically discretionary.
- The sorting gives management a basis for resolving additions and protecting the work that must be completed. Without it, every late request competes on volume of argument.
- THE DOCTRINE
AI can help test schedules and organise evidence, but the turnaround plan must remain physically executable.
If you cannot say which items are mandatory, you cannot defend them when the window tightens.
4:00 – 9:00
Make the scope reviewable
- Every significant scope item identifies the asset, reason, required evidence, work package, owner and acceptance criterion, linked to drawings, specifications and inspection records under controlled revisions.
- An attractive summary is insufficient if the execution team cannot determine exactly what has been approved. AI document assistance can locate related reports and compare scope versions, but its output must identify the source and revision.
- An obsolete drawing retrieved confidently is a serious document-control failure. The application never replaces the controlled engineering package with a generated description.
- Run a scope-freeze process with a route for justified changes. Discovery is part of shutdown reality, but a late addition needs a decision on safety, technical necessity, resources and the production window.
Ask for the revision number before you ask for the summary.
9:00 – 14:00
Test readiness, not percentage complete
- A schedule that reports 95% procurement completion can hide the one component that prevents restart. Review critical materials by physical readiness, acceptance and location.
- A purchase order, a supplier promise and an item on site are three different states. Apply the same discipline to work packs, permits, access, specialist support and lifting arrangements, and show prerequisites and handover points.
- Where two activities need the same resource, the schedule must resolve the conflict rather than assume parallel execution. A planning assistant can find dependencies; responsible planners and engineers validate the important ones. The value is a real conflict found early enough to resolve, not a more elaborate visual schedule.
- MODULAR REFINERY · THE WORKED CASE
- Modular refinery. Narrow scope, but limited staffing and few specialists. Two jobs needing the same crew or lifting arrangement on the same day is the kind of conflict a percentage hides and a readiness register exposes.
INTEGRATED (MEGA) REFINERY · THE PARALLEL- Integrated (mega) refinery. Many scope items across several units and interfaces. A readiness register that isolates the items capable of extending the shutdown or preventing restart matters more than any overall percentage.
Percentage complete describes effort. Readiness describes whether you can restart.
14:00 – 19:00
The worked readiness decision
- The book's figures are teaching inputs. A critical item can be expedited for $45,000. Without expediting there is an assumed 50% probability of a three-day extension, and included lost contribution is assumed at $100,000 per day.
Assumption Expected avoided loss Less expediting Stated expected benefit Expediting removes the 50% probability 0.50 × 3 × $100,000 = $150,000 $45,000 $105,000 Expediting only reduces it from 50% to 30% (0.50 − 0.30) × 3 × $100,000 = $60,000 $45,000 $15,000 - The supplier's ability to deliver and the link between that item and restart are therefore the central assumptions. The comparison excludes tax, financing and other costs.
- THE DOCTRINE
Expediting is worth paying for only if the item genuinely controls the additional days. If another unresolved task would keep the refinery shut for the same period, it may create no immediate contribution benefit.
- So the first question to an expediting request is what else stands between this item and restart.
Money spent clearing a path that is blocked further down is still money spent.
19:00 – 25:00
Discovery, restart and your wrap
- Manage discovery work explicitly. Preserve the original plan, record new findings, and show the technical decision, effect on the critical path, materials and cost. Separate confirmed work from a range that depends on further inspection.
- Do not let a system reduce uncertainty by inventing a completion date. A useful forecast can be a conditional range with a next evidence milestone, so management can decide whether to secure contingency or defer a non-essential task. Daily reviews focus on the work that can change completion and readiness.
- Restart is an acceptance decision. A completed schedule is not permission to restart: the refinery needs its required checks, operating readiness and technical acceptance. The U.S. OSHA pre-startup safety review provisions are cited by the book only as an international reference for separating construction completion, procedures, training and hazard-review readiness; they do not replace the Nigerian facility's requirements.
- An application can assemble the readiness pack and flag missing items. Authorised people verify acceptance and keep the decision record, including handover evidence and outstanding restrictions.
- Before you close: list the five items in your next turnaround or major work that could extend the shutdown or block accepted restart, each with owner, evidence and contingency. That is Section 12 of your plan: our turnaround or major-work readiness test.
After the turnaround, ask which forecasts changed a decision and which merely described delay.
Key Terms
Scope freeze
The point after which turnaround scope changes only through a defined route that assesses safety, technical necessity, resources and the production window.
Readiness register
A list of the items that could extend a shutdown or prevent accepted restart, each with physical status, owner, evidence and contingency, used instead of one completion percentage.
Discovery work
Work found during execution, recorded against the preserved original plan with its technical decision, critical-path effect, materials and cost.
Restart acceptance
The authorised decision, on required checks, operating readiness and technical acceptance, that a unit may restart. A completed schedule does not grant it.
Self-Check — Before You Submit
1. Your turnaround dashboard shows procurement 95% complete. What should the readiness review establish?
- A. Whether the remaining 5% can be bought in the final week
- B. Whether the overall percentage is on the planned curve
- C. The vendor's confidence in the procurement forecast
- D. For each critical item, whether it is ordered, promised, on site and accepted, and where it is
D. For each critical item, whether it is ordered, promised, on site and accepted, and where it is — A purchase order, a supplier promise and an item on site are different states, and one missing component can prevent restart. Tracking the curve only tells you effort is on plan, not that the plant can restart.
2. A planner asks for $45,000 to expedite a critical valve to avoid an assumed three-day extension. You learn that a separate inspection finding, not yet resolved, would keep the unit shut for the same three days. What is the right response?
- A. Approve, because the book's worked example shows a $105,000 expected benefit
- B. Hold the decision until the controlling path is understood, because expediting this item alone may create no immediate contribution benefit
- C. Approve half the amount as a compromise
- D. Reject expediting on all turnarounds as poor value
B. Hold the decision until the controlling path is understood, because expediting this item alone may create no immediate contribution benefit — The worked figures assume the item genuinely controls the additional days. If another task controls the same period, the expected benefit does not arise. Quoting the example's $105,000 ignores the assumption on which it rests.
3. The contractor reports every scheduled activity complete and asks to restart. What happens next?
- A. Authorised people verify required checks, operating readiness and technical acceptance, and keep the decision record
- B. Restart, because schedule completion is the acceptance criterion
- C. Let the scheduling application approve restart once its pack shows no gaps
- D. Restart at reduced rate and complete checks afterwards
A. Authorised people verify required checks, operating readiness and technical acceptance, and keep the decision record — Restart is an acceptance decision, separate from construction completion. An application can assemble the pack and flag missing items, but it does not hold the authority to accept.
Today’s Assignment
Write Section 12 of your plan: a readiness test for your company's next turnaround or major maintenance window.
- State the purpose of the next shutdown or major work, and classify its main scope as mandatory, condition-driven or economically discretionary.
- List the items that could extend the shutdown or prevent accepted restart. For each, give its physical status (ordered, promised, on site, accepted), owner, evidence and contingency decision.
- Price one expediting or contingency decision as an expected-value comparison using your own assumed figures, clearly labelled, and say what else might control the same days.
- Describe how your business would decide restart: who accepts it, on what evidence, and what an application may assemble but not approve.
- The honest part: where did your last turnaround report percentage complete while readiness was unknown, and what did it cost?
- If you do not work at a refinery, apply this to the major-work window your work touches most directly. Aim for 400 to 900 words.
YOUR 90-DAY PLAN
Section 12 — Our turnaround or major-work readiness test.
How this is marked — the rubric
| Lists the items that could extend the shutdown or block restart, each with physical status, owner, evidence and contingency | 30 |
| Prices one expediting decision with labelled assumptions and tests whether the item controls the days | 25 |
| Separates schedule completion from restart acceptance and names the accepting role | 25 |
| Gives a specific, honest account of where percentage complete hid readiness last time | 20 |
| Total · pass mark 70 | 100 |
Submitting session 12
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 12, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.Capabilities Covered
Scope classificationReadiness testingExpediting decisionsDiscovery controlRestart acceptance
Process Safety · Chapter 12SESSION 13
Process Safety and Management of Change
Why This Matters
This is the session I would least like you to skip. An AI application can change a process without a single new pipe, valve or instrument, simply by changing what an operator notices, what a supervisor trusts at handover or what a planner does first. Most refineries already have process-safety and management-of-change arrangements. The risk is that an AI project is approved as software and never enters them. Today you learn to separate advice from protection, to treat the workflow as part of the change, and to keep existing authority intact. Nothing here asks your company to slow down. It asks you to know what you have changed.
25-Minute Module
0:00 – 4:00
A change with no new equipment
- An AI recommendation can change a process with no physical equipment added, by altering how operators recognise a condition, prioritise a response or rely on information.
- THE DOCTRINE
Assess an AI application's effect on operations through the refinery's existing process-safety and change-management arrangements, not around them.
- The U.S. OSHA process safety management standard, 29 CFR 1910.119, is the book's public reference here. It covers managing changes to process chemicals, technology, equipment and procedures, apart from specified replacement in kind, and addresses technical basis, safety effects, authorisation and updating relevant information.
- It is a U.S. comparative reference, not Nigerian law; your refinery applies its own legal and approved requirements.
If the project was approved as software, ask whether anyone has assessed it as a change.
4:00 – 9:00
Separate advice from protection
- A predictive application, a control system and a protective function have different purposes. A model that recognises an anomaly is not thereby a safety barrier; its availability, failure modes and validation differ from engineered protection.
Element Purpose What an AI application must not do to it Advisory or predictive application Observe and recommend for human review Be represented as a barrier Control system Run the process within approved limits Act on it outside approved engineering and change routes Protective function, including safety instrumented functions Independent engineered protection Touch, override, weaken or justify removing it - Document the boundary: what the application can observe and recommend, which human response it assumes, and what remains independent of it.
- THE DOCTRINE
If a proposal relies on a model to justify removing or weakening an existing protection, that is a materially different engineering and assurance decision.
- Generative systems need particular care with procedures. They may retrieve controlled material or draft for review, but never issue a new operating instruction because a user asked. Output keeps the source revision and says when the controlled collection does not support an answer.
Accuracy is not permission. A model that is right often is still not a protection layer.
9:00 – 14:00
The workflow is part of the change
- An application changes workload and attention. Frequent alerts compete with other demands; a supervisor may treat a favourable summary as confirmation; a planner may reorder work because a score looks authoritative.
- Assess this with the affected people: what users must verify, how disagreement is handled, how the established workflow survives an outage, and when to escalate. Training covers the application's limits.
- The change record holds model version, input sources, intended operating range, permissions and support arrangements. A vendor model update can be a meaningful change if it alters recommendations, explanations or access, so there must be a route to assess it before routine use.
- MODULAR REFINERY · THE WORKED CASE
- Modular refinery. A small shift team means one person may read the alert, judge it and act. Reliance builds quickly, so the fallback to the established workflow must be simple, practised and owned by a named supervisor.
INTEGRATED (MEGA) REFINERY · THE PARALLEL- Integrated (mega) refinery. Several applications across units, often with separate vendors and update cycles. The risk is an unassessed update reaching many consoles at once, so each update needs its own route through change assessment.
Watch what people do with the tool, not what the project description says they will do.
14:00 – 20:00
Authority, and a change that looked administrative
- Preserve the existing authority. The application may recommend an investigation. A competent engineer may assess it. Operations may authorise work within the approved system. The appropriate authority approves a change to the operating envelope or procedure. Each step carries a different evidential burden.
- An executive sponsor removes avoidable delay in that process without bypassing the technical decision. A promise of productivity gives no project team authority to reinterpret engineering limits. If the application needs a change in authority, that request goes openly in the approval pack.
- A fictional case: a supplier proposes an automated daily operating summary that reads selected trends and states that the refinery is operating normally. Operators begin relying on it during handover. It was approved as report automation; the workflow now assigns it a form of operating assurance.
- Examine actual use: which conditions it represents, which alarms, manual observations or abnormal modes it excludes, whether it detects invalid data, who reviews it. This is a scope issue, not formatting: governance reviews observed use, not only the project description. Expect narrower language, revised training and an instruction to consult the controlled operating record.
The most consequential change in your plant this year may arrive labelled as a report.
20:00 – 25:00
Your boundary, and Pop Quiz 3
- Before any application reaches operating personnel, have process safety and operations assess what behaviour it could change, record the protections and approvals that stay necessary, and test unavailable data, wrong recommendations and service failure in a controlled setting.
- THE DOCTRINE
The first successful deployment is one the refinery can use within its approved arrangements and can stop without losing control of the process.
- Measure whether users understand the boundary and whether the fallback works, and keep a route for reporting unsafe reliance or unexpected use.
- Write it down: Section 13 of your plan: the management-of-change boundary for our AI application.
- Pop Quiz 3 opens after this session: five questions, closed book, covering Sessions 11 to 13 on reliability, integrity, turnaround and process safety.
Ask one question of every AI proposal: can we switch it off tomorrow and still run the unit safely.
Key Terms
Management of change
The refinery's approved arrangement for assessing and authorising changes, including, as this session argues, the workflow an application alters.
Protective function
Engineered protection, such as a safety instrumented function, that is independent of advisory applications. No AI application touches it or is cited to justify weakening it outside a separate engineering and assurance decision.
Change record
The record of an application's model version, input sources, intended operating range, permissions and support arrangements, against which updates are assessed.
Observed use
How people actually rely on an application, reviewed alongside the project description because reliance can exceed approved scope.
Self-Check — Before You Submit
1. Operators now use an automated daily summary, approved as report automation, as their check that the unit is normal at shift handover. What is the right response?
- A. Add a disclaimer to the bottom of the summary and continue
- B. Withdraw all reporting automation across the refinery
- C. Treat it as a scope issue: examine actual use and exclusions, narrow the language, revise training and direct users to the controlled operating record
- D. Leave it in place, because operators have found it useful
C. Treat it as a scope issue: examine actual use and exclusions, narrow the language, revise training and direct users to the controlled operating record — The workflow has given the tool a form of operating assurance, a change in scope. A disclaimer treats it as formatting; withdrawing everything abandons useful work instead of governing it.
2. A project team argues that their anomaly model caught every upset in a year of trials, so an existing protective trip can be retired. How is this handled?
- A. As a materially different engineering and assurance decision through the refinery's change arrangements, with the model treated as advice, not protection
- B. Approve, because the model's track record is better than the trip's
- C. Approve on a trial basis for one month
- D. Let the vendor certify the model as a safety barrier
A. As a materially different engineering and assurance decision through the refinery's change arrangements, with the model treated as advice, not protection — An advisory model's availability, failure modes and validation differ from engineered protection. A good detection record is accuracy, not permission, so a trial or vendor certificate cannot substitute for the full assessment.
3. Your vendor pushes a model update that changes the wording and ranking of maintenance recommendations. Is this a change requiring assessment?
- A. No, because no physical equipment is affected
- B. Only if the vendor says so
- C. No, provided the old version is archived
- D. Yes, because an update that alters recommendations, explanations or access can be a meaningful change and needs a route before routine use
D. Yes, because an update that alters recommendations, explanations or access can be a meaningful change and needs a route before routine use — Changes can arise without new equipment by altering what people prioritise. Archiving the old version helps reproduce history but does not assess the new behaviour reaching users.
Today’s Assignment
Write Section 13 of your plan: the management-of-change boundary for the AI application your company is considering or already using.
- Name the application (or the one most likely to be proposed in your business) and the operating decision it influences.
- Document the boundary: what it can observe and recommend, the human response it assumes, and the protections and approvals that remain independent of it.
- Write the decision-rights chain for its recommendations: who recommends, who assesses, who authorises work, who approves an envelope or procedure change.
- List the change record (model version, input sources, intended operating range, permissions, support) and how a vendor update would be assessed.
- Describe your fallback for unavailable data, wrong output or service failure, and how unsafe reliance is reported.
- The honest part: where has a tool in your company already gained more influence than it was approved for? If you do not work at a refinery, apply this to the refinery application your work touches most directly. Aim for 400 to 900 words.
YOUR 90-DAY PLAN
Section 13 — The management-of-change boundary for our AI application.
How this is marked — the rubric
| Documents what the application observes and recommends and names the protections and approvals that remain independent of it | 30 |
| Sets out a decision-rights chain with roles and the evidential step each holds | 25 |
| Specifies the change record, an update-assessment route and a tested fallback | 25 |
| Identifies one honest case of a tool exceeding its approved influence | 20 |
| Total · pass mark 70 | 100 |
Submitting session 13
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 13, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.ASSESSMENT NOW OPEN
Pop Quiz 3 — Reliability and Process Safety opens now. Sit it before you start the next session — it is how you find out whether the doctrine landed, and the practice papers may be resat as often as you like.
Sit Pop Quiz 3 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.Capabilities Covered
Advice versus protectionWorkflow change assessmentDecision rightsObserved-use reviewSafe fallback
Energy · Chapters 13 and 14SESSION 14
Utilities, Energy, Hydrogen and Fuel Gas
Why This Matters
Your refinery can have every process unit available and still miss its plan because power, steam, cooling water, instrument air or an agreed fuel supply is not there. Where your configuration includes hydrogen and fuel gas, those shared streams decide which unit gets to run its opportunity. These are the constraints most often hidden behind a production target, and the place where energy savings are most often claimed and least often verified. Today you learn to draw the utility boundary, compare like with like, read an assumed energy calculation honestly, and allocate a shared resource on the feasible refinery result. If your plant has no hydrogen system, say so; the reasoning still applies.
25-Minute Module
0:00 – 5:00
Establish the utility boundary
- A utility described as available needs a quantity, quality, delivery period and owner, seen before additional throughput is approved.
- Begin with your own utility balance: sources, consumers, meters, unmetered allocations. Separate purchased from generated electricity and purchased fuel from refinery streams used as fuel, and record internal transfers so energy is not counted twice.
- THE DOCTRINE
A generating set awaiting maintenance is a different constraint from a fuel delivery awaiting payment. The remedy for one is a work decision; for the other it may be a treasury decision.
- Verify the site's actual supply arrangements, backup, fuel stocks, maintenance condition and recent interruptions, rather than general statements about national power reliability.
- The U.S. DOE refining bandwidth study is a macro-scale sector study with defined boundaries that excludes the cost of achieving savings. Use it as background for investigation, never as site evidence or a return to copy into a business case.
Ask who owns each utility and for how many days it can support the plan.
5:00 – 11:00
Compare like with like: the assumed energy calculation
- A lower fuel bill may reflect reduced production; better energy intensity may reflect a different feedstock or mix. Record consumption with its denominator, time window and operating modes, including start-ups, shutdowns and idle periods.
Line (assumed teaching case) Figure Tonnes processed, comparable campaign 10,000 Baseline included energy 30,000 GJ, or 3.0 GJ per tonne After intervention, same output, quality and conditions 28,500 GJ Reduction 1,500 GJ, or 5 percent Gross included cost reduction at $8 per GJ $12,000 Less added included campaign cost $12,000 − $4,000 = $8,000 before excluded items - The example assumes the reduction is physically achieved and the marginal cost is actually avoidable. A fixed supply charge does not disappear because the site consumes less.
- If the campaign also processes a different feedstock, report the observed difference first and the attributed benefit separately. Precise meter readings do not make an attribution precise.
- THE DOCTRINE
A favourable predicted energy result does not justify a set-point change outside the established operating envelope. The executive authorises the investigation; the technical authority assesses the intervention.
Two numbers in every energy review: what changed, and how much of it we caused.
11:00 – 15:00
Maintain the response capacity
- An energy alert names its expected response. For a possible steam loss: who investigates, when, and how the finding is recorded. If action needs a shutdown window, it belongs in that planning cycle.
- Daily repetition of the same alert does not create another daily saving.
- Include the cost of sustaining measurement: meter repairs, data review and technical support are part of the programme.
- MODULAR REFINERY · THE WORKED CASE
- Modular refinery. A controlled daily utility balance, with owned meters and an agreed fuel position, may deliver useful discipline long before any optimisation platform is justified.
INTEGRATED (MEGA) REFINERY · THE PARALLEL- Integrated (mega) refinery. Many consumers on a shared steam, power and fuel network may need a shared model of the utility network, with one boundary so internal transfers are not double counted.
An alert nobody can act on until the next turnaround is a planning input, not a daily saving.
15:00 – 21:00
Hydrogen and fuel gas as shared constraints
- MODULAR REFINERY · THE WORKED CASE
- Modular refinery. A modular refinery may have no hydrogen system at all, and its fuel-gas arrangements may be simple. Begin with the actual design and records; a model built around an imagined configuration cannot support a dependable choice. Where there is no hydrogen, apply this allocation reasoning to the shared utility that does bind.
INTEGRATED (MEGA) REFINERY · THE PARALLEL- Integrated (mega) refinery. Hydrogen may be generated on site, recovered, purchased and consumed across units, and fuel gas links process streams to utilities. A local unit opportunity may need hydrogen another unit also needs, so the network is a shared constraint in the production plan.
- Put availability and quality together: quantity, quality, pressure basis, period and measurement status for each shared stream. Separate forecast demand from approved commitment, in one common campaign record.
Option (assumed; 100 usable units available) Resource used Stated contribution A alone 60 units $50,000 B alone 50 units $45,000 A and B together 110 units Infeasible B plus compatible option C 50 units, leaving 50 for C $45,000 + $15,000 = $60,000 - Do not pick A for its higher contribution, or B for its contribution per unit, without examining other feasible uses, minimum commitments, product obligations and switching costs. With no other use, A is higher; with C, B plus C gives $60,000. This is allocation reasoning, not a hydrogen-network design.
- Fuel gas: never claim higher product revenue while omitting the replacement fuel cost of diverting the same stream. Authority: the model names the binding constraint, never quietly relaxes a quality, pressure or operating restriction, and has a controlled fallback for source loss and abnormal modes.
An attractive combination that violates a physical constraint is not a recommendation.
21:00 – 25:00
Before you close the laptop
- Choose one recurring utility constraint, energy variance or shared-resource decision in your refinery.
- Put the proposed physical action, its cost and its approval route beside any analytical recommendation, and name the response owner.
- Write down how the value would be verified at the next review: did the action occur, did consumption change, was the financial consequence realised. That is Section 14 of your plan: our shared-utility constraint and how its value would be verified.
You should be able to defend the result without the supplier's dashboard open.
Key Terms
Utility boundary
The defined set of utility sources, consumers, meters, unmetered allocations and internal transfers over which energy is counted once.
Comparable baseline
A reference consumption on the same denominator, time window and operating modes, so that a change in production, feedstock or mix is not reported as a saving.
Shared constraint
A resource such as hydrogen, fuel gas, steam or power that several units need, which must be allocated for the feasible refinery result rather than each unit's local gain.
Feasible allocation
A combination of uses that respects available quantity, quality, pressure and engineering limits, valued across one financial boundary.
Self-Check — Before You Submit
1. In the book's assumed case, an intervention cuts energy from 30,000 GJ to 28,500 GJ at $8 per GJ and adds $4,000 of included campaign cost. What is the stated incremental result before excluded items?
- A. $12,000
- B. $8,000
- C. $1,500
- D. $16,000
B. $8,000 — 1,500 GJ × $8 = $12,000 gross, less $4,000 added cost, gives $8,000. The $12,000 option forgets the added cost, and the result still assumes the marginal cost is truly avoidable.
2. Of 100 available units, option A uses 60 for $50,000; B uses 50 for $45,000; a compatible option C could use the remaining 50 for $15,000. What should the review conclude under these assumptions?
- A. Choose A, because it has the higher individual contribution
- B. Choose B, because its contribution per unit is higher
- C. Run A and B together to capture $95,000
- D. B plus C gives $60,000 and beats A, subject to engineering confirming the quantities and constraints
D. B plus C gives $60,000 and beats A, subject to engineering confirming the quantities and constraints — The comparison is between feasible combinations, not individual options. A and B need 110 units and cannot run together; choosing B on its per-unit ratio alone reaches the right answer for the wrong reason.
3. A consultant cites the U.S. DOE refining bandwidth study to claim your plant can save a set percentage of energy, and proposes putting that figure in the business case. How should you treat it?
- A. As background for investigation; it is a sector study with defined boundaries that excludes the cost of achieving savings, not evidence about your site
- B. As a conservative project return
- C. As a regulatory benchmark the plant must meet
- D. As valid once adjusted for naira exchange rates
A. As background for investigation; it is a sector study with defined boundaries that excludes the cost of achieving savings, not evidence about your site — The study is macro-scale and excludes implementation costs: neither site evidence nor a requirement. Converting currency does not turn a sector estimate into a site forecast.
Today’s Assignment
Write Section 14 of your plan: one shared-utility constraint in your company and how the value of addressing it would be verified.
- Name one recurring utility constraint, energy variance or shared-resource decision in your business. If your refinery has no hydrogen system, say so and choose the utility that does bind.
- Draw its boundary: sources, consumers, meters, unmetered allocations and internal transfers, with the owner and the period each source can support the plan.
- State the comparable baseline: denominator, time window and operating modes, and how start-ups and idle periods are treated.
- Set out the proposed physical action, its cost, its approval route and the response owner. Where units compete, compare the feasible combinations using your own figures, labelled as assumptions.
- The honest part: what energy or utility saving has your company reported that would not survive a change of feedstock, throughput or mix? If you do not work at a refinery, apply this to the shared-resource decision your work touches most directly. Aim for 400 to 900 words.
YOUR 90-DAY PLAN
Section 14 — Our shared-utility constraint and how its value would be verified.
How this is marked — the rubric
| Defines the utility boundary with sources, consumers, meters, owners and support periods | 25 |
| States a comparable baseline and separates observed change from attributed benefit | 25 |
| Puts a physical action, cost, approval route and owner beside the recommendation, with a feasible-combination comparison where relevant | 30 |
| Names one reported saving that would not survive a change of operating conditions | 20 |
| Total · pass mark 70 | 100 |
Submitting session 14
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 14, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.Capabilities Covered
Utility boundariesLike-for-like energy comparisonAttribution disciplineShared-resource allocationConfiguration honesty
Supply · Chapters 15 and 16SESSION 15
Laboratory Release, Inventory and Custody Transfer
Why This Matters
Product in a tank is not product for sale, and a tank figure is not an invoice. Between the last process unit and your bank account sit the laboratory, the release authority, the measurement team, the terminal or transporter, the customer and finance. Each can hold product, quantity or cash. A dashboard that counts all tank stock as deliverable can overstate your company's commercial position for weeks. Today you learn to preserve sample identity, find the actual release delay, keep quality predictions as advice, protect the measurement basis, reconcile before explaining, and connect inventory to cash. This closes Week 3, and it closes the gap between what your refinery makes and what it collects.
25-Minute Module
0:00 – 5:00
Preserve the sample identity
- Know what has been sampled and tested, which results are valid, and who may release the material.
- Connect each sample to its tank, batch, movement, campaign and sampling time, and show its status: awaiting analysis, preliminary, reviewed, superseded or released.
- A result can be technically correct but unsuitable if it belongs to material before a later movement or blend. Updating a tank quantity must not silently make an old quality result look current.
- A spreadsheet change that reconnects a test to another batch has commercial consequences. Laboratory, operations and document control need one recorded correction route.
- THE DOCTRINE
A prediction of quality does not replace a required test, and a generated report does not itself authorise release.
Ask of every result on the release screen: which material, sampled when, and is it still that material.
5:00 – 10:00
Find the actual release delay
- Split elapsed time into request, collection, receipt, analysis, review and release, plus waiting for an authorised response. The longest stage may be transport, an instrument or an unresolved discrepancy, not analysis.
- Ask whether an intervention changes laboratory capacity or only sends a faster notification. A message announcing a completed test creates little value if release still waits for an unavailable approver.
Assumed holding-time case Figure Product held two extra days 2,000 tonnes Value tied up at $700 per tonne $1,400,000 Two days at 15% simple, 365-day year approximately $1,151 - That is not automatically the value of faster release. If the customer would have collected later anyway, cash is not accelerated. If the tank delays another campaign the consequence may be larger, but value it separately and check for overlap before adding effects.
- Predictions are defined advice. State what a model covers and when it withholds. A generated summary keeps source, units, method and status, and never turns a preliminary reading into a certificate or fills a missing result with a plausible number.
Report the time saved and the money saved on separate lines. They are different claims.
10:00 – 15:00
Measurement basis and the movement chain
- Operating tank levels, accounting inventory, transferred and certified commercial quantities can have different bases and approvals; not everything labelled stock is interchangeable.
- OIML R 117-1:2019 addresses requirements for dynamic measuring systems for liquids other than water. The book cites it as an international recommendation, not a substitute for applicable Nigerian requirements or the parties' agreed contractual measurement arrangements.
- THE DOCTRINE
Do not instruct a model to adjust a commercial quantity to make a balance close. A reconciliation estimate and an authorised transfer record have different functions.
- A movement crossing midnight can look like a loss; a temperature-corrected quantity compared with an uncorrected one creates another. Check definitions before assigning a cause.
- Build the chain: nomination, movement, measurement, acknowledgement, inventory update, commercial document, with identifiers a reviewer can follow. An internal dashboard cannot create an external acknowledgement.
- MODULAR REFINERY · THE WORKED CASE
- Modular refinery. One campaign record links crude receipt, laboratory, production, tanks and collection. A batch on hold in one of few tanks can stop the next campaign, so sample identity and release timing are campaign decisions.
INTEGRATED (MEGA) REFINERY · THE PARALLEL- Integrated (mega) refinery. LIMS, tank management, terminals and invoicing each hold an identifier. The movement chain fails at the hand-offs, so one shared movement identifier and one correction route matter more than another dashboard.
Before anyone says loss, ask whether both numbers are on the same basis and in the same period.
15:00 – 20:00
Reconcile before explaining, then follow the cash
- The book's teaching reconciliation, on an agreed common basis, with every figure assumed:
Line Tonnes Opening stock 5,000 Plus receipts / less dispatches +2,000 / −1,800 Expected closing 5,200 Measured closing 5,150 Unexplained difference (indicative exposure 50 × $700 = $35,000) 50 If 40 tonnes belong to a dispatch booked next period 10 - The $35,000 is not a confirmed loss. Check timing, unrecorded movements, internal transfers, measurement status and basis. An application may rank causes; the responsible team confirms and approves any correction, keeping original entry, revision, reason and authorisation.
- Connect inventory to cash. Separate physical stock from product available for collection: quality holds, contractual allocations and unconfirmed movements do not support an invoice.
- A shorter invoicing delay is not more product. If faster reconciliation accelerates collection, verify the cash dates; if it finds an omitted invoice, check whether the revenue was already accrued before claiming new revenue.
Quietly changing history to clear a dashboard exception destroys the evidence the programme was meant to improve.
20:00 – 25:00
Your release-to-cash chain, and Week 3 wrap
- Follow one recent batch in your refinery from sampling to collection and cash. Mark each stage with its elapsed time, and the one point where it loses time or quantity.
- Name a joint owner from operations and finance, with the measurement specialist responsible for technical evidence. That is Section 15 of your plan: the release-to-cash chain for one product, and where it loses time or quantity.
- This week added an asset family, a readiness test, a change boundary, a utility constraint and a release-to-cash chain. Week 4 turns to spares, data, security, value and the 90 days.
- Practice Exam 3 opens after this session: fifteen questions covering Sessions 11 to 15. Pass mark is 70.
A refinery has gained intelligence when it can explain where the material went and act on the consequence.
Key Terms
Release status
The recorded state of a result (awaiting analysis, preliminary, reviewed, superseded or released), which tells everyone what the material may be used for.
Measurement basis
The instruments, correction basis, calibration evidence, time window and uncertainty behind a quantity, which must match before two quantities are compared.
Movement chain
The linked record from nomination through movement, measurement, acknowledgement and inventory update to the commercial document.
Indicative exposure
The value of an unexplained quantity difference before investigation. It is not a confirmed loss until timing, movements, transfers and measurement basis have been checked.
Self-Check — Before You Submit
1. In the assumed holding-time case, 2,000 tonnes worth $700 a tonne wait two extra days. Which statement is correct?
- A. Two days' financing is about $1,151, and that is the value of faster release
- B. Two days' financing is about $1,400,000
- C. Two days' financing is about $1,151, but it is not automatically the value of faster release
- D. Nothing, because tank stock is already counted as inventory
C. Two days' financing is about $1,151, but it is not automatically the value of faster release — $1,400,000 × 15% × 2 / 365 is approximately $1,151. It becomes value only if cash actually moves earlier; if the customer would have collected later anyway, nothing is accelerated.
2. Month end shows a 50-tonne unexplained difference, an indicative exposure of $35,000. Finance proposes writing it off today. What do you require first?
- A. Checks of timing, unrecorded movements, internal transfers, measurement status and the basis of every quantity, with any correction approved and the original entry kept
- B. An application adjustment of the closing stock so the balance closes
- C. Write-off now and investigate next month
- D. A higher product value so the exposure is not understated
A. Checks of timing, unrecorded movements, internal transfers, measurement status and the basis of every quantity, with any correction approved and the original entry kept — The difference is not yet a confirmed loss; in the book's case, 40 tonnes booked in the next period reduces it to 10. Adjusting the balance to close removes the very evidence needed to explain it.
3. The tank needed for the next campaign holds a batch a quality model predicts is on specification. The commercial head asks to release it now. What do you do?
- A. Release on the prediction, because the model has been accurate
- B. Release half the batch on the prediction and hold the rest
- C. Ask the laboratory to issue a certificate from the model estimate
- D. Use the urgency to prioritise the laboratory queue and approver, but release only on the required tests and authorised release
D. Use the urgency to prioritise the laboratory queue and approver, but release only on the required tests and authorised release — Urgency raises priority but removes no testing or approval requirement, and a prediction never releases product. A certificate drawn from a model estimate turns advice into a false record.
Today’s Assignment
Write Section 15 of your plan: the release-to-cash chain for one product in your company, and where it loses time or quantity.
- Choose one recent batch of one product in your business and trace its identity chain from sample to tank, movement and campaign, with release status at each point.
- Break the elapsed time into sample request, collection, receipt, analysis, review, release, collection and cash, and identify the longest stage and one avoidable delay management can remove.
- Set out the movement chain and measurement basis for that product's dispatch, and describe one recurring discrepancy, its joint owner from operations and finance, and its correction route.
- State separately the operational measure and the financial measure you would use to verify any improvement, labelling any figures as assumptions.
- The honest part: where does your company today count physical stock as product available for sale? If you do not work at a refinery, apply this to the release, inventory or custody-transfer decision your work touches most directly. Aim for 400 to 900 words.
YOUR 90-DAY PLAN
Section 15 — The release-to-cash chain for one product, and where it loses time or quantity.
How this is marked — the rubric
| Traces one batch's identity chain with release status, and separates physical stock from product available to customers | 25 |
| Breaks elapsed time into stages and names one avoidable delay with an owner | 25 |
| Defines the movement chain, measurement basis, a joint owner and a correction route that keeps the original record | 30 |
| Separates operational and financial measures and names one honest overstatement | 20 |
| Total · pass mark 70 | 100 |
Submitting session 15
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 15, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.ASSESSMENT NOW OPEN
Practice Exam 3 — Reliability, Energy and Supply opens now. Sit it before you start the next session — it is how you find out whether the doctrine landed, and the practice papers may be resat as often as you like.
Sit Practice Exam 3 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.Capabilities Covered
Sample identityRelease-delay diagnosisMeasurement basisInventory reconciliationInventory-to-cash