A bounded maintenance analytics pilot with engineering review

Topics: oil and gas predictive maintenance pilot, reviewed maintenance analytics, predictive maintenance acceptance, oil gas analytics pilot

Why unconstrained predictive maintenance pilots collapse in plant operations

Across upstream offshore platforms, gas processing terminals, and refinery hydrocrackers, maintenance analytics programs frequently stall between proof-of-concept and operational adoption. A data science team extracts two years of historian telemetry and Enterprise Asset Management (EAM) work orders, trains a multivariate anomaly detector on historical bearing failures, and reports high retrospective recall. Yet within six weeks of connecting the model to live plant feeds, reliability engineers stop opening the advisory dashboard.

The failure is rarely mathematical; it is architectural and procedural. First, unconstrained pilots attempt to score dozens of heterogeneous equipment classes simultaneously without verifying whether the underlying tags pass basic completeness, timestamp alignment, and operating-state checks (see Condition monitoring data: check completeness, alignment and context). Second, most commercial analytics pipelines force a binary prediction (NORMAL vs ANOMALY) on every evaluation window, even when a centrifugal compressor is ramping through surge-test recycling or when a resistance temperature detector (RTD) is exhibiting open-circuit drift. Third, connecting an unvalidated analytical score directly to automated SAP PM or Maximo notification creation floods the maintenance planning backlog with unverified alerts, destroying planner trust.

To evaluate whether maintenance analytics delivers genuine diagnostic lift above existing deterministic DCS high-high alarms and static vibration thresholds, engineering leadership must structure a bounded shadow pilot. The pilot restricts scope to one well-instrumented asset family, enforces explicit abstention when input quality or operating envelope conditions are violated, measures performance against pre-agreed baseline metrics over a fixed evaluation window, and requires documented reliability engineer review before any maintenance action is initiated.

Takeaway: The shadow pilot never writes directly to production EAM or DCS environments; every advisory must pass an explicit operating-envelope abstention gate and human reliability triage.

Defining the bounded pilot scope and system boundary

A defensible maintenance analytics pilot starts by locking down a narrow, homogeneous equipment scope and a read-only system boundary in accordance with NIST SP 800-82 Rev. 3 industrial control system segmentation principles and OISD technical standards Rotating Equipment inspection and reliability guidelines:

1. Single Asset Family Selection: Select one critical equipment class with standardized instrumentation across multiple identical or near-identical trains—for example, 12 multistage centrifugal gas export compressors (COMP-EXP-01A through 12B) across three processing platforms, or 16 high-pressure crude charge pumps. Avoid mixing reciprocating compressors, fin-fan coolers, and heat exchangers in the same initial pilot.
2. Read-Only Sandbox Isolation: The analytics environment connects exclusively to an enterprise DMZ historian mirror and a daily read-only replica of EAM work order and equipment hierarchy tables (IFLOT, EQUI, QMEL, AUFK). The pilot service principal holds zero write permissions (INSERT, UPDATE, or BAPI execution rights) against production SAP PM, IBM Maximo, or L3/L2 process control networks.
3. Explicit Comparison Against Existing Rules: For every evaluation window, the shadow log records both the analytics model output and the status of existing deterministic DCS/CMS threshold rules. An analytical alert that fires four hours after a standard high-vibration alarm (> 7.1 mm/s RMS) has already notified the control room provides zero incremental operational value and must be scored as REDUNDANT_WITH_EXISTING_RULE, not claimed as an analytics success.

Baseline measurement protocol before pilot evaluation

Before a single shadow advisory is evaluated, the Reliability Authority and Data Team must establish a frozen historical baseline using a representative labelled sample spanning both routine steady-state operation and known exception events (startups, load swings, sensor faults, and confirmed mechanical degradations).

Specifically, the baseline protocol requires:

• Explicit Denominator and Time Window: Define the exact asset count, evaluation cadence, and historical lookback window—for example, 12 centrifugal compressor trains evaluated at 1-hour tumbling windows over a 90-day baseline period (2,160 hours x 12 trains = 25,920 train-evaluation hours).
• Labelled Event Inventory: Reconcile every historical maintenance notification, strip-down inspection report, and sensor calibration ticket during that 90-day baseline window so that true mechanical degradations are separated from instrumentation defects (aligned with ISO 14224:2016 equipment reliability and maintenance data taxonomy).
• Pre-Agreed Numeric Acceptance Targets: All numeric pass/fail thresholds must be signed off by the Reliability Authority before shadow evaluation begins—never adjusted retroactively to match observed model outputs.

Illustrative example (hypothetical scenario): 60-day shadow run on 12 compressor trains

Illustrative scenario notice: All site volumes, defect counts, error rates, engineering hours, and INR (₹) figures below are hypothetical scenario assumptions constructed to demonstrate the control math and workflow gating. Any time or cost reductions represent modeled process/capacity estimates under these assumptions, not achieved client benchmark savings or guaranteed cash realization.

Consider a 60-day (1,440-hour) live shadow pilot across 12 centrifugal gas export compressor trains (12 x 1,440 = 17,280 total train-evaluation hours):

• During the 60-day window, the upstream data-quality and operating-envelope gate inspects all 17,280 train-evaluation hours:
  • 1,140 train-hours occur during planned turbine shutdowns, purge cycles, or startup ramp-ups (OPERATING_STATE != STEADY_STATE_LOAD).
  • 588 train-hours exhibit upstream telemetry quality failures (frozen edge gateway buffer or RTD open-circuit fault flagged by the condition-monitoring quality gate).
  • The pipeline explicitly abstains on these 1,140 + 588 = 1,728 train-hours, yielding an Abstention Rate of 1,728 / 17,280 = 10.00% (within the pre-agreed ceiling of <= 15.0%).
• Across the remaining 15,552 valid steady-state train-hours (90.00% coverage), the shadow model evaluates multi-tag bearing temperature and shaft-orbit residuals over a 6-hour persistence filter and emits 40 discrete candidate advisories to the reliability engineer review queue:
  • 22 advisories are verified by the Lead Rotating Equipment Engineer as genuine early mechanical or lube-oil cooler degradations not yet flagged by existing static DCS alarms (ACCEPTED_NOVEL_FINDING).
  • 8 advisories correspond to known degradations that already had an open EAM notification or active static alarm prior to the shadow advisory (ALREADY_KNOWN_IN_EAM).
  • 10 advisories are rejected by the reviewer as unmodelled process molecular-weight shifts or ambient rain-cooling effects (REJECTED_PROCESS_NOISE).
• Actionable Precision (Reviewer Acceptance Rate): Computing novel accepted findings plus valid known findings over total emitted advisories gives (22 + 8) / 40 = 30 / 40 = 75.0% overall precision, while Novel Diagnostic Precision (excluding already-known issues) is 22 / (22 + 10) = 22 / 32 = 68.75%.
• Reviewer Workload Burden: 40 advisories / 60 days = 0.67 advisories per day (4.67 advisories per week), requiring 4.67 x 15 minutes = 70.0 minutes per week of reliability engineer review time—well below the pre-agreed human review cap of 120 minutes per week.

Takeaway: Separating ALREADY_KNOWN_IN_EAM from ACCEPTED_NOVEL_FINDING prevents analytics teams from taking credit for faults that deterministic DCS alarms or operator rounds had already identified.

Technical implementation: shadow advisory and abstention record schema

Every evaluation window in the shadow pilot must write an immutable provenance record linking the input telemetry window hash, operating-envelope check, model version, and engineering review disposition:

{
  "shadow_advisory_id": "SHDW-O040-2026-0031",
  "pilot_id": "PILOT-COMP-EXP-2026Q4",
  "functional_location": "PLAT-A-COMP-EXP-04A",
  "equipment_id": "100084921",
  "evaluation_window": {
    "window_start_utc": "2026-10-18T06:00:00Z",
    "window_end_utc": "2026-10-18T12:00:00Z",
    "input_telemetry_sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
  },
  "envelope_and_dq_check": {
    "dq_gate_status": "PASS",
    "operating_state": "STEADY_STATE_LOAD",
    "suction_pressure_barg": 64.2,
    "training_envelope_min_barg": 52.0,
    "training_envelope_max_barg": 75.0,
    "abstention_flag": false,
    "abstention_reason": null
  },
  "model_inference": {
    "model_id": "M-COMP-BRG-RESIDUAL-V2.1",
    "predicted_residual_degc": 6.8,
    "threshold_degc": 4.5,
    "persistence_hours_exceeded": 6.0,
    "static_dcs_alarm_active": false,
    "open_eam_notification_exists": false,
    "advisory_state": "PENDING_ENGINEERING_REVIEW"
  },
  "engineering_review": {
    "reviewer_id": "REL-ENG-4402",
    "reviewer_role": "Lead Rotating Equipment Engineer",
    "reviewed_at_utc": "2026-10-18T14:20:00Z",
    "disposition": "ACCEPTED_NOVEL_FINDING",
    "manual_eam_notification_created": "10099412",
    "review_notes": "Confirmed thrust bearing drain temperature divergence against lube oil header; scheduled oil sample and duplex filter changeover."
  }
}

Hard stop, quarantine, and recovery governance

Because the pilot operates under strict operational governance, any violation of the boundary triggers an immediate automated or human stop:

1. Immediate Stop Conditions:
   • Any attempt by a pilot script or user session to execute a write call against production EAM or OT systems (ACCESS_SCOPE_VIOLATION).
   • Any advisory emitted without a verifiable input_telemetry_sha256 hash, model_id, or upstream DQ status (MISSING_PROVENANCE).
   • Rolling 7-day abstention rate exceeding 25.0% due to uncalibrated envelope boundaries or historian replication lag.
   • Weekly false-discovery rate (REJECTED_PROCESS_NOISE / (ACCEPTED_NOVEL_FINDING + REJECTED_PROCESS_NOISE)) exceeding 40.0% for two consecutive weeks.
2. Quarantine and Recovery Procedure:
   • Revoke the pilot service account's read token on the DMZ historian replica and freeze the shadow advisory queue.
   • Quarantine failed inference records in an isolated audit table while preserving the raw input telemetry snapshots.
   • Plant reliability surveillance continues uninterrupted via existing deterministic DCS alarms and EAM preventive schedules (since production workflows were never modified).
   • Replay or resume the shadow pipeline only after the Data Team and Reliability Authority sign off on a root-cause remediation record.

Acceptance tests and operational readiness thresholds

Summary and next actions

1. Lock the pilot scope to a single rotating asset family: Select 10 to 16 identical or near-identical compressor or pump trains and provision read-only access to the DMZ historian mirror and EAM replica with zero production write privileges.
2. Freeze the 90-day baseline and numeric acceptance targets: Document the denominator (train-hours), reconcile historical maintenance notifications against instrumentation faults, and sign off on abstention, novel precision, and reviewer-hour thresholds before starting shadow runs.
3. Deploy the operating-envelope and DQ abstention gate: Configure the pipeline to emit ABSTAIN_OUT_OF_SCOPE whenever upstream telemetry fails data-quality checks or the equipment operates outside steady-state load boundaries.
4. Enforce three-way engineering review classification: Require the Reliability Authority to classify every shadow advisory as ACCEPTED_NOVEL_FINDING, ALREADY_KNOWN_IN_EAM, or REJECTED_PROCESS_NOISE before any manual EAM notification is raised.