Insight: Integration of RTO and MPC in the Hydrogen Network of a Petr

About the Authors and This Research

This paper was co-authored by three Spanish researchers specializing in advanced process control. Lead author C. Prada holds an h-index of 21 with 1,634 cumulative citations, establishing significant academic standing in process optimization and control systems engineering. Co-author D. Sarabia holds an h-index of 14 with 635 citations, contributing deep expertise in industrial system optimization. G. Gutiérrez participated in the real-world engineering implementation and validation within an operational refinery setting.

What makes this paper particularly valuable is its grounding in operational reality. The research was not conducted in a laboratory but within an actual, functioning petroleum refinery encompassing 18 interconnected plants—all subject to genuine operating constraints. This real-world validation makes the findings transferable to other complex systems, including enterprise business continuity frameworks. The paper was published in the Processes journal (MDPI) and indexed on arXiv, combining academic rigor with open-access availability. Its 20 citations since 2017 reflect sustained relevance in the process engineering control community.

Core Findings: Three Layers of Industrial Resilience

The central challenge addressed in this research is how to optimally distribute hydrogen across an 18-plant refinery network without disrupting operations. Traditional industrial control systems treat optimization (determining "what to do") and execution (determining "how to do it") as separate, sequential processes. This separation creates decision latency and execution gaps—precisely the conditions under which complex systems fail.

The research team's solution integrates three layers: first, data reconciliation to clean and validate real-time sensor data from across all 18 plants; second, a real-time optimizer that calculates the globally optimal hydrogen generation and redistribution strategy using validated data; and third, a Model Predictive Control system that translates those optimal strategies into actionable control sequences for each plant's local controllers, updated continuously in a rolling horizon fashion.

Finding 1: Data Quality Is Not a Detail—It Is the Foundation

The research demonstrates that without data reconciliation as a mandatory precursor step, sensor noise and measurement errors cause the RTO system to generate infeasible or counterproductive optimization strategies. Across a network of 18 plants, flow rates, pressures, and hydrogen purity levels at each node must be validated for cross-consistency before entering any optimization calculation. The practical implication: a system optimizing on corrupted inputs produces outputs that worsen performance rather than improve it.

Finding 2: Predictive Control Bridges the Gap Between Strategy and Execution

The RTO layer produces a static optimal solution based on current conditions—but industrial operating conditions are never static. MPC's value lies in its rolling horizon mechanism: at each control cycle, it recalculates the optimal execution path based on the latest state of the system, ensuring that the RTO's strategic directive is smoothly realized in a dynamically changing environment. The integrated architecture delivered measurable improvements in hydrocarbon throughput to treatment plants while reducing overall hydrogen consumption—demonstrating that strategy and dynamic execution, when properly integrated, achieve outcomes neither could accomplish independently.

Finding 3: System-Level Optimization Outperforms Localized Optimization

With 18 interdependent plants, the locally optimal decision for any single plant is frequently not the globally optimal decision for the network. The RTO/MPC architecture enforces system-level coordination, preventing the "locally optimal, globally suboptimal" failure mode. This finding resonates directly with CISA's January 14, 2026 publication of its Secure Connectivity Principles for Operational Technology—which similarly emphasizes that OT security and resilience cannot be achieved through isolated, plant-by-plant measures but requires integrated, network-level design.

Implications for Taiwan's Business Continuity Management Practice

The three-layer architecture of this engineering study—data verification, optimization, dynamic execution—maps with striking precision onto the requirements of ISO 22301:2019 Business Continuity Management Systems. Taiwan enterprises building or upgrading their BCM frameworks can extract three actionable insights.

Implication 1: BIA Data Must Be Validated Before Driving RTO/RPO Targets

The data reconciliation step in the refinery study is the equivalent of rigorous Business Impact Analysis (BIA) data validation in BCM. Many Taiwanese enterprises set their Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) based on single-source BIA interview results, without cross-validation across departments. When a disruption event occurs, these unvalidated targets prove unachievable—not because recovery capabilities are insufficient, but because the targets were built on inconsistent assumptions. ISO 22301 Clause 8.2 requires BIA to account for financial, regulatory, and reputational impacts across all business functions. A structured cross-departmental data validation process should precede any RTO/RPO target-setting exercise.

Implication 2: BCP Should Function as a Dynamic Response Mechanism, Not a Static Document

MPC's rolling horizon mechanism—recalculating the optimal execution path at every decision point rather than following a fixed predetermined sequence—is the engineering equivalent of a truly adaptive Business Continuity Plan. Most Taiwanese enterprises maintain BCPs as static documents updated annually or only when triggered by audits. ISO 22301 Clause 8.4 requires business continuity procedures to address the prioritization of objectives and tasks during a disruption. A well-designed BCP should specify tiered activation procedures for different disruption scenarios, enabling the organization to dynamically adjust its response as the situation evolves—not mechanically execute a script written for a different scenario.

Implication 3: Cross-Functional Dependency Mapping Is Non-Negotiable for Complex Organizations

The refinery study's 18-plant hydrogen network required integrated optimization precisely because each plant's operations affected and depended on every other. Taiwanese enterprises with multiple business units, cloud and on-premise IT systems, and OT environments face analogous interdependency challenges. ISO 22301 explicitly requires organizations to identify interdependencies between business activities and the resources that support them. Mapping these dependencies—particularly at the intersection of IT and OT systems—is increasingly urgent in light of CISA's 2026 OT security principles, which emphasize connectivity security as a resilience prerequisite.

How Winners Consulting Services Co. Ltd. Supports Taiwan Enterprises

積穗科研股份有限公司（Winners Consulting Services Co. Ltd.）helps Taiwan enterprises implement ISO 22301-aligned Business Continuity Management systems, establish evidence-based RTO/RPO targets, conduct rigorous Business Impact Analysis (BIA), and design dynamic BCP response mechanisms. Drawing on the integrated optimization logic demonstrated in this paper, we recommend the following specific actions:

1. BIA Data Validation Workshop: Before formalizing any RTO/RPO targets, conduct a structured cross-departmental BIA data validation session. Reconcile inputs from business unit owners, IT, finance, and compliance teams to identify inconsistencies. This prevents the foundational error of building an ISO 22301 BCM framework on unverified assumptions—the exact pitfall the refinery study's data reconciliation step was designed to eliminate.
2. Dynamic BCP Architecture Design: Transition your Business Continuity Plan from a static annual document to a scenario-driven, tiered response architecture. Design activation thresholds, decision criteria, and adaptive procedures for multiple disruption scenarios. This enables your organization to function with the dynamic responsiveness of an MPC system rather than a fixed script.
3. IT/OT Dependency Mapping and CISA Alignment: Integrate CISA's January 2026 Secure Connectivity Principles for OT into your BCM framework. Map the interdependencies between your IT systems and operational technology environments, identify single points of failure, and design recovery strategies that address the full system—not isolated components.

Frequently Asked Questions

How does the RTO/MPC integration architecture in this refinery study apply to ISO 22301 Business Continuity Management?

The connection is structural, not metaphorical. Both systems require validated input data before optimization can occur (data reconciliation in the refinery = BIA data validation in BCM), both set targets based on system-wide optimal analysis (RTO optimal hydrogen strategy = ISO 22301 RTO/RPO targets), and both require dynamic execution mechanisms to achieve those targets in real-world conditions (MPC rolling control = adaptive BCP response procedures). The refinery study's key finding—that a 18-plant network requires integrated system-level optimization, not plant-by-plant local optimization—directly parallels ISO 22301's requirement to map interdependencies across all business functions before designing recovery strategies.

What is the most common mistake Taiwanese enterprises make when conducting BIA for ISO 22301?

The most common mistake is treating BIA as a one-time questionnaire exercise rather than a structured data validation process. Organizations typically collect RTO/RPO estimates from individual department heads without cross-validating these inputs for consistency. The result is RTO targets that are either unachievably optimistic (set by IT teams without business input) or unnecessarily conservative (set by business teams without understanding actual recovery capabilities). ISO 22301 Clause 8.2 requires BIA to identify impacts across financial, legal, regulatory, and reputational dimensions, and to map interdependencies between business activities. A properly designed BIA process should involve at least three rounds of cross-functional validation before any targets are finalized.

What does ISO 22301 certification actually require, and how long does the process take for a Taiwanese enterprise?

ISO 22301:2019 requires organizations to establish, implement, maintain, and continually improve a Business Continuity Management System (BCMS) covering: organizational context analysis, leadership commitment and policy, risk assessment and BIA, business continuity strategy and plans (BCP), exercising and testing, and performance evaluation. For a medium-sized Taiwanese enterprise (200 to 1,000 employees), the full implementation-to-certification timeline typically runs 7 to 12 months. The first 3 months focus on gap analysis and BIA execution; the middle 3 to 4 months address framework design, documentation, and BCP development; the final 2 to 3 months cover exercise testing, internal audit, and certification audit preparation. Organizations with mature existing risk management practices may compress this timeline.

What level of investment does ISO 22301 BCM implementation require, and how should Taiwanese enterprises measure the return?

For a medium-sized Taiwanese enterprise, the investment components typically include consulting fees, internal dedicated BCM coordinator resources (minimum one part-time or full-time position), exercise and testing costs, and any required tooling. Return should be measured across three dimensions: compliance value (meeting requirements from financial regulators, government procurement bodies, or enterprise clients, avoiding penalties or contract disqualification); operational value (reduced mean time to recovery and documented reduction in disruption losses); and commercial value (ISO 22301 certification as a demonstrable resilience credential in competitive bidding). CISA's 2026 OT Secure Connectivity Principles publication is also raising the compliance bar for supply chain participants in critical infrastructure sectors, making BCM certification increasingly relevant to contract eligibility.

Why should Taiwanese enterprises engage Winners Consulting Services Co. Ltd. for BCM and ISO 22301 implementation?

Winners Consulting Services Co. Ltd. (積穗科研股份有限公司) provides end-to-end ISO 22301 implementation support, from initial gap analysis and BIA design through BCP development, exercise facilitation, and certification audit preparation. Our consulting approach combines engineering systems thinking with management framework expertise, enabling us to translate complex cross-departmental interdependencies into actionable, auditable BCM documentation—rather than generic templates that fail under real scrutiny. We offer a complimentary BCM framework diagnostic to help enterprises understand their current gaps and prioritize actions before committing resources. Whether you are building a BCM system for the first time or upgrading an existing framework to meet current regulatory requirements including CISA's 2026 OT security principles, we design solutions calibrated to Taiwan's specific regulatory environment and enterprise context.

積穗科研股份有限公司（Winners Consulting Services Co. Ltd.）は、2017年に発表され20回の引用実績を持つ石油精製工学の研究論文が、台湾企業のISO 22301業務継続管理（BCM）フレームワーク設計に対して、予想を超える実践的示唆を提供していることを確認しました。18のプラントから成る水素分配ネットワークにおけるリアルタイム最適化器（RTO）とモデル予測制御（MPC）の統合事例は、複雑システムの回復力は静的な計画書ではなく、データ検証・最適化意思決定・動態的実行の継続的ループによってのみ実現できることを実証しています。