# Corlinda: an AI-supported deferral and a cold box failure Corlinda is an illustrative case, not a real incident. It draws on operational patterns seen across several facilities. A predictive maintenance model performs exactly as designed, every procedure is followed, and a cryogenic heat exchanger fails six months after the model supports deferring a mercury absorber changeout. All names of companies, sites, equipment and people in this case are invented. Any resemblance to a real organisation, site or event is coincidental. ## What happened? Corlinda Energy, a mid-sized operator, runs a two-train gas processing facility. Mercury absorbers protect the brazed aluminium cold boxes downstream, where gas is cooled to minus 55 °C. Rising inlet mercury had shortened the absorber changeout cycle, and each changeout meant ten days offline, confined space entry and hazardous waste with nowhere to go. Corlinda's in-house predictive maintenance model had earned trust on rotating equipment by predicting two bearing failures. The company extended it to the absorbers and cold boxes. The model recommended deferring the Train 1 changeout; the train restarted without incident. Later that year it recommended the same deferral on Train 2, with 92 per cent confidence. The discipline engineer, the inspection engineer and the maintenance review board all agreed. Six months after restart, an amalgamated brazed joint in the Train 2 cold box cracked. The release found an ignition source 250 metres downwind, and the blast damaged buildings across the site. No one was killed. ## What did the model see, and what did it miss? The model monitored bed performance: inlet and outlet mercury, saturation, pressure drop and temperature. Its assessment of the bed was correct. The bed had months of life left. It held no data on the cold box. Mercury amalgamation of brazed joints had no example in its training data. Its reference data came from another basin, where continuous analysers made a zero reading mean mercury absent. At this facility, periodic sampling made a zero mean mercury below the detection limit, so unmeasured. The model treated both zeros the same. No inspection method could reach the brazed joints, and the human reviewers worked from the model's data. The organisation read an accurate assessment of the bed as assurance of the mercury risk. Nobody owned the risk the model could not see. [Diagram: Corlinda: the model covered the absorber beds. The failure developed in the cold box, outside its view.] ## What would M-OPS OMI have asked? M-OPS OMI works through the requirements Corlinda already had. Management of change existed, but extending a model to new equipment did not trigger it: that requirement needed modifying. The risk assessment of the deferral covered the bed, while the consequence ran downstream to the cold box. The inspection programme could not detect the degradation, so no barrier for the cold box worked independently of the model: the cold box risk needed a separate assessment and a named owner. A new element was needed for the model's operating envelope, the equipment and degradation mechanisms it was validated for, so that its extension to the cold boxes was visible before it was used. The deferral might still have gone ahead, with the cold box risk visible and owned before the decision rather than after the explosion. If one of your models is about to inform a decision like this, [contact me](https://www.maestria-ops.com/contact/).