Back to Basics
An Engineer's Guide to
Management of Change
R. WAYNE GARLAND
EASTMAN CHEMICAL Co.
e small town of Flixborough, England, has become
11 known for the fatal explosion that occurred there in
974 at a caprolactum production plant owned by
Nypro, a joint venture of Dutch State Mines and the British
National Coal Board. The explosion took place in a part of
the plant that involved the oxidation of cyclohexane to cyclo-
hexanone in a series of six reactors. According to Ref. 1:
On Mar. 27, 1974, a crack was detected on Reactor
No. 5. A maintenance engineer recommended complete
closure for three weeks. The maintenance manager, whose
role had been carried out for several months by the head of
the laboratory while a company reorganization was pending,
instead proposed dismantling Reactor No. 5 and connect-
ing Reactors No. 4 and No. 6. He suggested doing this with
a 20-in.-dia. (500-mm) temporary connection using piping
bellows units supported on a structure made :fi·om conven-
tional construction industry scaffolding. On May 29, a leak
forced the plant to shut down. During restart on June 1, the
temporary piping ruptured at the bellows, releasing 30 tons
of cyclohexane in 30 seconds. A vapor cloud 200m across
and 100m high formed and was ignited by a furnace. The
investigation concluded that the rupture of the temporary
piping was due to excessive fatigue of the bellows, which
were only designed to work in compression-expansion, and
not with transverse loads.
The Nypro incident illustrates the importance of a good
management of change (MOC) process, one that requires
This article is based on a paper presented at the American Instib..ite of
Chemical Engineers 2011 Spring Meeting and 7th Global Congress on
Process Safety, Chicago, n.,, Mar. 13-17, 201 LA webcast of the presenta-
tion is available through ChernE on Demand at http//apps.aiche.org/
chemeondemandihome.aspx (search for"Garland MOC")
Copyright© 2012 American Institute of Chemical Engineers (AIChE)
Using a formal change procedure promotes
safe operations and prevents
injuries and deaths, and it will also
favorably impact the bottom line.
the review and approval of proposed changes by persons
with the appropriate expertise. This is especially impottant
for processes that contain a large inventory of flammable or
toxic chemicals at high temperature and pressure. Had the
team conducted an MOC procedure, it would have discov-
ered the problem with this short-tenn fix and the explosion
might not have occurred.
TESTYOUR KNOWLEDGE
1. According to the PSM regulation's definition of
change, which of the following is considered a change?
A 1\dding a new control valve
B. Relocating an electrical outlet or light fixture in an
office area
C. Modifying an operating procedure to correct
misspelled words
D. An emergency action in response to an accidental
discharye, which is discontinued immediately upon
termination of the erneryency
E. Replacing a worn-out valve with a new, essentially
identical valve that meets the same specifications
2. Which of the following is usually not considered a
change?
A Temporarily bypassing an interlock
B. Using a different schedule of pipe in a pipeline
than is called for in the current piping specification
for that service
C. Adding a new nozzle to a tank
D. Changing a temperature target or alarm limit
within the range defined in a standard operating
procedure or control strategy
E. Adding a new step to an operating procedure
Ans~rs appear at the end of the article (p. 53).
CEP March 2012 www.aiche.org/cep 49
Back to Basics

Table 1. Many serious accidents at chemical facilities occurred in the years before the PSM regulation was implemented.
Year of Location of Resulting Resulting
Incident Incident Plant Operator/Owner Incident Details Deaths Injuries
1974 Flixborough, Nypro Temporary piping ruptured, releasing 28 89
England cyclohexane, which was ignited by a
furnace.
1976 Seveso, Italy lcmesa Chemical Co. A bursting disc ruptured, leading to the 0 -200
release of chemicals, including trichloro-
isocyanuric acid (TCCA), which is highly
toxic.
1984 Mexico City, PEMEX LPG Terminal A ruptured pipe released liquefied -600 -7,000
Mexico petroleum gas (LPG), which led to a fire
and series of explosions
1984 Bhopal, India Union Carbide India. Ltd. A large volume of water was introduced -2,000 -100,000
into a tank of methyl isocyanate (MIG),
causing a chemical reaction that forced a
relief valve to open and allowed MIG gas
to leak.
1985 Institute, VW Union Carbide A release of methylene chloride and 0 135
aldicarb oxide occured.

1988 Norca, LA Royal Dutch Shell, PLC An elbow at the depropanizer column 5 23
piping system in a fluid catalytic crack-
ing (FCC) unit failed, causing the release
of C3 hydrocarbons, which ignited and
caused the FCC unit to explode
1988 Henderson, NV Pacific Engineering Sparks from a welder's torch ignited 2 350
Production Co. ammonium perchlorate, the facility's
of Nevada (PEPCON) main product, which led to a series of
explosions

1989 Richmond, CA Chevron A weld on a line carrying hydrogen failed, 0 9

causing a high-pressure hydrogen fire
and a subsequent reactor failure.
1989 Pasadena. TX Phillips Petroleum Co. A series of explosions and fires erupted at 24 132
a petrochemical plant when a seal on an
ethylene loop reactor blew out, releasing
ethylen e-i sobu tane
1990 Channelview, TX Arco Chemical Co. A wastewater treatment tank in the utility 17 0
area of the petrochemical plant exploded
The company concluded that excessive
oxygen in the vapor space of the storage
tank led to the explosion
1990 Cincinnati, OH BASF A flammable solvent used to clean a reac- 2 41
tion vessel vented into the coatings plant
and ignited, causing a fire and explosion

1991 Lake Charles, LA PPG Industries Superheated oil was routed to an 6 8

undetected layer of water, resulting in
a steam explosion
1991 Sterlington, LA IMC Fertilizer An explosion occured at a nitroparaffin 8 128
plant, followed by a series of small fires.

1991 Charleston, SC Albright and Wilson During the mixing of chemicals to make a 9 33
Americas flame retardant used in textiles, an explo-
sion and fire occured. This was a reactive
chemistry incident caused by ingredient
contamination and loss of cooling

SO www.aiche.org/cep March 2012 CEP Copyright© 2012 American Institute of Chemical Engineers (AIChE)
 Table 11ists major process safety incidents that occurred
in the years following the Flixborough incident. In an effort
to ensure safe and healthy workplaces, in 1992 the U.S.
Occupational Safety and Health Administration (OSHA)
promulgated the Process Safety Management of Highly
Hazardous Chemicals regulation (2). The PSM rule, as it is
commonly called, mandates (among other things) a pro-
cess hazard analysis (PHA), written operating procedures,
employee training, prestartup safety reviews, and evaluation
of mechanical integrity (MI) of critical equipment. It also
requires manufacturers to conduct a management of change
(MOC) procedure before making certain changes. A change
is defined under the PSM regulation as any alteration (except
for replacements-in-kind) to process matetials, processing
conditions, equipment, maintenance materials, procedures,
utilities, facilities, control systems, etc.
This article introduces the central elements ofMOC,
including approvals, safety reviews, notifications, training,
and process safety information (PSI) updates, discusses the
role that MOC plays in safe plant opet·ation, and explains the
potential consequences of not using MOC.
learning from Sam Shortcut
The value ofMOC can be illustrated tlu·ough the story of
the fictional character Sam Shortcut, a staff process engi-
neet·. Sam is assigned a project related to the manufacture
of a new product The only facility change needed is to
altet· some piping and a control valve to ret·oute a conveyor
system to an existing product storage bin (Bin 99) that is not
cutTently in service. Sam wondet·s- what could be simp let·?
He is already overloaded with a long list of urgent projects
and does not see the need to use the MOC procedure, which
he views as unnecessary papetWork, for such a simple
project
Sam bypasses the MOC procedure and gets the alteration
done by going directly to the area mechanics and electri-
cians. He is proud of his efficiency (Figure 1)- until he
starts getting calls about the product bin:
• The material transfer operator cannot get product to go
to Bin99.
Determine Design the Start
Need for Action
----+ Change ----+ Construction
I
+ documentation. A good MOC procedure (Figure 2) typically
End Put into
----+
Construction Service
.&. Figure 1. sam Shortcut followed the simple project workflow shown in
this chart without MOC.
Copyright© 2012 American Institute of Chemical Engineers (AIChE)
• The area operations manager has a quality problem
because matet·ial was transfetTed to the wrong product bin.
• An operator for an upstream unit returns from a
vacation and uses the old targets for the process variables
because he was unaware of the changed targets for the new
product
• The area operations manager is upset again. There
has been an accidental discharge because the primary level
sensor on the product bin failed and there was no backup
device.
• The shift team manager is concerned about the relief
valve on Bin 99 opening frequently (ie., cycling) and pos-
sibly releasing inert gas into the production area.
• The pressure vessel inspector becomes aware of the
change and believes that state codes for pressure vessels
could apply. He asks Sam if the bin is rated for the new
operating pressure and if the relief device is set cotTectly.
• The environmental coordinator becomes aware of the
frequent relief valve opening and is concerned that it could
be a violation of the environmental petmit
• To make matters worse, Sam comes to work Monday
moming and receives a call :fi·om a control system mechanic
(i.e., the electrician). It seems that there was a problem
in matetial transfet· that shut down production ovet· the
weekend. Electricians troubleshooting the problem could not
locate the source of the problem because the electrical draw-
ing was not up-to-date and did not reflect the changes made
around Bin 99.
Sam now realizes that by not using MOC he may have
saved some time up-fi·ont, but he is spending more time
in the long run to deal with issues that were not addressed
before the changes wet-e made. In addition, Sam did not real-
ize the significant safety and environmental implications of
such a minor process change, or the importance of notifYing
those impacted by the change prior to startup. As a result,
Sam acquires the unfortunate nickname "Bin 99 Engineet·."
The primary reason for MOC is to ensure that changes
to a manufacturing process are made safely. Howevet·, as
the story of Sam Shortcut illustrates, it also makes good
business sense. Potential business implications include
equipment downtime and lost production, inefficient use of
manpowet·, and, in the worst case, a process safety incident
with property damage, personal injuries, and fatalities.
The MOC workflow
MOC is a procedure for safely changing facilities and/or
includes all of the following steps.
Origination. The first step is putting the change request
in writing. This should include a description of the change,
the technical basis for the change, the potential impact on
safety, and required PSI updates. This step is usually done
CEP March 2012 www.abhe.org/cep 51
Back to Basics
Determine Determine if Complete MOC
Need for Action MOC is Needed Form
Start End
Construction Construction
Conduct Put into
PSSR Service
r Figure 2. MOC adds several elements to the
Close MOC project workflow shown in Figure i. A good MOC
procedure has numerous steps to address all safety change. For example, safety personnel
concerns and help prevent incidents.
by the operations staff engineer or the person in charge of
the project
Approvals and reviews. In the second step, management
and technical experts (e.g., engineeting and safety person-
nel) evaluate the change with respect to their own area of
expertise. They may do this individually or as a group. If an
approver has any questions or concerns, he or she should
communicate with the originator to resolve them. Approvers
can also request additional safety reviews or other analyses
that they deem necessary.
Engineering design fu this step, engineers of the
appropriate discipline (e.g., chemical, mechanical, electrical,
civil, etc.) complete the detailed engineering of the change.
Opet·ations and safety staff usually approve the final design
technical drawings.
Execution During this step, construction pet·sonnel and
engineering staff make the facility design changes. Any
procedural updates and process-control software changes are
also completed.
Field verification, notification, and training. This step
is part of the pre-startup safety review (PSSR) and involves
critical activities that should be completed prior to putting
the change into service. Field vetification is an inspection to
ensure that what was done in the field matches the speci-
fications in the engineering design package. Notification
involves informing all affected persons and departments that
the change is about to occur. Training by a knowledgeable
instructor is conducted (as needed) for all pet·sonnel who
will be operating the process after the change has
been made.
Startup. Startup is the actual introduction of the change
and coordination of all associated activities. This is the first
time the process is operated with the change.
Completion ofPSI. It is essential to keep all process
safety information updated because it is the foundation for
the entire process safety management program. PSI includes
52 www.aiche.org/cep March 2012 CEP
engineering drawings, piping and
instrumentation diagrams (P&IDs),
equipment design information, material
safety data sheets (MSDS), mechanical
integrity inspection schedules, emer-
gency shutdown test procedures, and
operating procedures, among others. It is
important to identifY the people who are
responsible for updating each portion of
the PSI (e.g., operators, engineers, safety
inspectors, etc.).
The MOC worldlow establishes
a set of checks and balances for the
many individuals involved in a process
concems may require additional safe-
guards not included in the originator's change request. A
design engineer may conclude that the change is not feasible
as originally proposed, but that an alternative technology
would work.
How MOC fits into the overall safety program
The safety program of a chemical manufacturing facil-
ity typically consists of process hazard analyses (PHAs),
a mechanical integrity (MI) program, personnel training,
opetating procedures, PSSRs, PSI, incident prevention, and
MOC. MOC plays a central role in this program because:
• it provides updates to PSI
• it identifies when a PSSR is needed
• it ensures that employees are trained to carry out new
procedures
• it adds new equipment to mechanical integrity test and
inspection schedules
• its documentation is reviewed once evety five years (as
required by the PSM rule) during the revalidation ofPHAs,
ensuring process-to-PHA consistency.
The bottom line is that MOC helps prevent incidents.
Types of changes subject to MOC
Sevet·al types of changes must be managed by the MOC
procedure.
Facility chcmges. Facility changes include any modifica-
tions made to the equipment within a facility. For a piping
system, this may include replacing carbon steel pipe with
stainless steel, replacing 2-in. pipe with 3-in. pipe, replacing
150-lb flanges with 300-lb flanges, adding tracing or insula-
tion, substantially changing the pipe routing, tying the piping
into anothet· line, or anything that changes the pipe class on a
P&ID. Other facility changes include replacing a centrifugal
pump with a diaphragm pump, re-tubing a heat exchanget·
with a different gauge tubing or material of construction,
replacing a motor with one having a different horsepowet·,
Copyright© 2012 American Institute of Chemical Engineers (AIChE)
replacing a flowmeter with one of a different type, add-
ing a new pressure gage, changing gasket types, changing
machine settings (if not covered in operating procedures),
replacing a pump impeller with a larger one, etc.
Control system changes. This categoty includes changes
to the programming or control logic, changes to who has
access to the logic, resetting interlock timers, bypassing
any circuit element or protective device, or changes to an
alarm point that takes it outside of the safety or quality limits
specified in the operating procedure.
Information system changes. This includes changes to
raw material specifications that result in replacing a chemi-
cal with a different grade, or replacing a chemical with the
same grade fi·om a different vendor if the new vendor is
not quality approved. A few other examples of information
system changes are modifications to control strategies, spare
parts listings, maintenance procedures, equipment/instru-
mentation specifications, and environmental information.
Procedural changes. This categoty includes any changes
to previously established safety, quality, or operating limits
in the operating procedure.
Changes may be pennanent or temporary. If a temporaty
change is made, it must be tracked and properly reversed.
Companies should also have a procedure to handle emer-
gency changes, which are those that must be made quickly
during off-hours (e.g., nights, weekends, and holidays)
when the regular MOC approvers may not be available. For
example, approval could be obtained verbally rather than in
writing (as long as it is properly documented), or approval
could be obtained from authorized on-call personnel rather
than the regular approvers.
Keys for successful MOC
Here are a few tips to facilitate the success ofMOC.
• Individuals who could possibly use the MOC procedure
(e.g., originators, approvers, and those who complete critical
tasks such as engineering design) should be trained on it
• Change should be managed, not just documented. A
good management system includes more than just filing
paperwork (hard copy or electronic) to document changes. It
includes processes to ensure that MOC requests are written
when appropriate and then processed properly in compli-
ance with company procedures. It should also ensure that
temporary MOCs are reversed at the proper time. This can
be accomplished by methods such as audits and regular
status reports.
• Roles in the MOC procedure- who is responsible for
each step and the expectations associated with the step-
must be clear.
• Management must set expectations that the MOC
procedure will be followed by everyone.
• Communication is extremely important to the success
Copyright© 2012 American Institute of Chemical Engineers (AIChE)
ofMOC. Everyone involved in the MOC procedure must
comnn.micate with each othet:
• MOC should be audited regularly - at least annually.
The audit should review both the management system and
the individual alterations made under MOC. The primary
questions in an audit are whethet· MOC requests are being
written at the appropriate times and whether the company
procedure is being followed after an MOC request is writ-
ten, including proper use of safety reviews and updating of
PSI. Some examples of major red flags are: work ordet·s for
modifications without accompanying MOC requests; action
items from safety reviews that are not completed; startup of
a change before all PSSR items are complete; and closing of
MOCs before all PSI updates are made.
Many of these tips are related to the company organi-
zation and culture. Refet·ence 3 is a good source for more
information on management of change. mil
LITERATURE CITED
1. Atherton, J., and F. Gi~ "Incidents That Define Process Safety,"
Center for Chemical Process Safety (CCPS), New York, NY, and
John Wiley & Sons, Inc., Hoboken, NJ, pp. 202-205 (2008)
2. U.S. Occupational Safety and Health Administration," Stan-
dard for Hazardous Materials- Process Safety Management of
Highly Hazardous Chemicals," 29 CFR 1910.119.
3. Center for Chemical Process Safety," Guidelines for Man-
agement of Change for Process Safety," American Institute of
Chemical Engineers, New York, NY (2008)
fURTHER READING
Sanders, R. E., "Chemical Process Safety: Learning from Case
Histories," Elsevier Butterworth-Heinemann, Burlington, MA
(2005)
R. WAYNE GARLAND, is a technical associate in the Corporate Health,
Safety, Environment and Security Div. at Eastman Chemical Co. (P.O.
Box 511, Bldg. 54D, l<ingsport, TN 37662; Phone: (423) 229-5518;
Email: wgarland@eastman.com), a Fortune 500 manufacturer of
chemicals, plastics, and fibers. He has more than 32 years of process
engineering experience, including 22 years in process develop-
ment and manufacturing of polymers and cellulose esters and 10
years in process safety. He earned his BS and MS degrees from the
Univ. of l<entucky, both in chemical engineering, and is a registered
professional engineer in Tennessee. He is a long-standing member of
AIChE and has been active in the Center for Chemical Process Safety,
including membership on the Technical Steering Committee. He has
13 current and pending publications, many of which are in the process
safety field.
·pasn aq p1n04s 801AJ ua4J'SJIWIIDUIJBJado aJBS pai\oJddB-aJd aLU
JO apiSJnO SIJB4J aniBi\ B OJ pa5UB4~ OUiaq SIJUIOdJaS a4J JI'Jai\aMOH .80[1\J
JOJ paau a4JJnOLUIM a5UBJ JB4J UI4JIM pa5UB4~ aq UB~ S)UIOdJaS SSa~OJd
'aJnpa~OJd DUIJBJado pJBpUB)S B Ul paUIJap aJB SJIWII DUijBJado aJBS JI'O ·0
.8QIAJ OJ pafqns JOU aJB SUOIJ~B klua5JaWa UIB)Ja~
JO 'sa5UB4~ jBUOJipa 'SBaJB a~IJJO OJ SUOIJBJaJIV. pUI)[-UI-JUaWa~BidaJ
JOU aJB JBLil sassa~oJd 5uunJ~BJnUBW OJ suoqBJaJIB sJai\o~ 801AJ ·v ·~
alipaiMOU)I JnO}.JS8! OJ SJaMSU'rj
CEP March 2012 www.aiche.org/cep 53