Back to Basics

An Engineers Guide to
Management of Change
R. Wayne Garland
Eastman Chemical Co.

Using a formal change procedure promotes

safe operations and prevents
injuries and deaths, and it will also
favorably impact the bottom line.

he small town of Flixborough, England, has become

known for the fatal explosion that occurred there in
1974 at a caprolactum production plant owned by
Nypro, a joint venture of Dutch State Mines and the British
National Coal Board. The explosion took place in a part of
the plant that involved the oxidation of cyclohexane to cyclohexanone in a series of six reactors. According to Ref. 1:
On Mar. 27, 1974, a crack was detected on Reactor
No. 5. A maintenance engineer recommended complete
closure for three weeks. The maintenance manager, whose
role had been carried out for several months by the head of
the laboratory while a company reorganization was pending,
instead proposed dismantling Reactor No. 5 and connecting Reactors No. 4 and No. 6. He suggested doing this with
a 20-in.-dia. (500-mm) temporary connection using piping
bellows units supported on a structure made from conventional construction industry scaffolding. On May 29, a leak
forced the plant to shut down. During restart on June 1, the
temporary piping ruptured at the bellows, releasing 30 tons
of cyclohexane in 30 seconds. A vapor cloud 200 m across
and 100 m high formed and was ignited by a furnace. The
investigation concluded that the rupture of the temporary
piping was due to excessive fatigue of the bellows, which
were only designed to work in compression-expansion, and
not with transverse loads.
The Nypro incident illustrates the importance of a good
management of change (MOC) process, one that requires
This article is based on a paper presented at the American Institute of
Chemical Engineers 2011 Spring Meeting and 7th Global Congress on
Process Safety, Chicago, IL, Mar. 1317, 2011. A webcast of the presentation is available through ChemE on Demand at http://apps.aiche.org/
chemeondemand/home.aspx (search for Garland MOC).

Copyright 2012 American Institute of Chemical Engineers (AIChE)

the review and approval of proposed changes by persons

with the appropriate expertise. This is especially important
for processes that contain a large inventory of flammable or
toxic chemicals at high temperature and pressure. Had the
team conducted an MOC procedure, it would have discovered the problem with this short-term fix and the explosion
might not have occurred.

Test Your Knowledge

1. According to the PSM regulations definition of
change, which of the following is considered a change?
A. Adding a new control valve
B. Relocating an electrical outlet or light fixture in an
office area
C. Modifying an operating procedure to correct
misspelled words
D. An emergency action in response to an accidental
discharge, which is discontinued immediately upon
termination of the emergency
E. Replacing a worn-out valve with a new, essentially
identical valve that meets the same specifications
2. Which of the following is usually not considered a
change?
A. Temporarily bypassing an interlock
B. Using a different schedule of pipe in a pipeline
than is called for in the current piping specification
for that service
C. Adding a new nozzle to a tank
D. Changing a temperature target or alarm limit
within the range defined in a standard operating
procedure or control strategy
E. Adding a new step to an operating procedure
Answers appear at the end of the article (p. 53).

CEP March 2012 www.aiche.org/cep

49

Back to Basics

Table 1. Many serious accidents at chemical facilities occurred in the years before the PSM regulation was implemented.
Year of
Incident

Location of
Incident

Resulting
Deaths

Resulting
Injuries

1974

Flixborough,
England

Nypro

Temporary piping ruptured, releasing

cyclohexane, which was ignited by a
furnace.

28

89

1976

Seveso, Italy

Icmesa Chemical Co.

A bursting disc ruptured, leading to the

release of chemicals, including trichloro
isocyanuric acid (TCCA), which is highly
toxic.

~200

1984

Mexico City,
Mexico

PEMEX LPG Terminal

A ruptured pipe released liquefied

petroleum gas (LPG), which led to a fire
and series of explosions.

~600

~7,000

1984

Bhopal, India

Union Carbide India, Ltd.

A large volume of water was introduced

into a tank of methyl isocyanate (MIC),
causing a chemical reaction that forced a
relief valve to open and allowed MIC gas
to leak.

~2,000

~100,000

1985

Institute, WV

Union Carbide

A release of methylene chloride and

aldicarb oxide occured.

135

1988

Norca, LA

Royal Dutch Shell, PLC

An elbow at the depropanizer column

piping system in a fluid catalytic crack
ing (FCC) unit failed, causing the release
of C3 hydrocarbons, which ignited and
caused the FCC unit to explode.

23

1988

Henderson, NV

Pacific Engineering
Production Co.
of Nevada (PEPCON)

Sparks from a welders torch ignited

ammonium perchlorate, the facilitys
main product, which led to a series of
explosions.

350

1989

Richmond, CA

Chevron

A weld on a line carrying hydrogen failed,

causing a high-pressure hydrogen fire
and a subsequent reactor failure.

1989

Pasadena, TX

Phillips Petroleum Co.

A series of explosions and fires erupted at

a petrochemical plant when a seal on an
ethylene loop reactor blew out, releasing
ethylene-isobutane.

24

132

1990

Channelview, TX

Arco Chemical Co.

A wastewater treatment tank in the utility

area of the petrochemical plant exploded.
The company concluded that excessive
oxygen in the vapor space of the storage
tank led to the explosion.

17

1990

Cincinnati, OH

BASF

A flammable solvent used to clean a reac

tion vessel vented into the coatings plant
and ignited, causing a fire and explosion.

41

1991

Lake Charles, LA

CITGO

Superheated oil was routed to an

undetected layer of water, resulting in
a steam explosion.

1991

Sterlington, LA

IMC Fertilizer

An explosion occured at a nitroparaffin

plant, followed by a series of small fires.

128

1991

Charleston, SC

Albright and Wilson

Americas

During the mixing of chemicals to make a

flame retardant used in textiles, an explo
sion and fire occured. This was a reactive
chemistry incident caused by ingredient
contamination and loss of cooling.

33

50

Plant Operator/Owner

www.aiche.org/cep March 2012 CEP

Incident Details

Copyright 2012 American Institute of Chemical Engineers (AIChE)

 Table 1 lists major process safety incidents that occurred

in the years following the Flixborough incident. In an effort
to ensure safe and healthy workplaces, in 1992 the U.S.
Occupational Safety and Health Administration (OSHA)
promulgated the Process Safety Management of Highly
Hazardous Chemicals regulation (2). The PSM rule, as it is
commonly called, mandates (among other things) a process hazard analysis (PHA), written operating procedures,
employee training, prestartup safety reviews, and evaluation
of mechanical integrity (MI) of critical equipment. It also
requires manufacturers to conduct a management of change
(MOC) procedure before making certain changes. A change
is defined under the PSM regulation as any alteration (except
for replacements-in-kind) to process materials, processing
conditions, equipment, maintenance materials, procedures,
utilities, facilities, control systems, etc.
This article introduces the central elements of MOC,
including approvals, safety reviews, notifications, training,
and process safety information (PSI) updates, discusses the
role that MOC plays in safe plant operation, and explains the
potential consequences of not using MOC.

Learning from Sam Shortcut

The value of MOC can be illustrated through the story of
the fictional character Sam Shortcut, a staff process engineer. Sam is assigned a project related to the manufacture
of a new product. The only facility change needed is to
alter some piping and a control valve to reroute a conveyor
system to an existing product storage bin (Bin 99) that is not
currently in service. Sam wonders what could be simpler?
He is already overloaded with a long list of urgent projects
and does not see the need to use the MOC procedure, which
he views as unnecessary paperwork, for such a simple
project.
Sam bypasses the MOC procedure and gets the alteration
done by going directly to the area mechanics and electricians. He is proud of his efficiency (Figure 1) until he
starts getting calls about the product bin:
The material transfer operator cannot get product to go
to Bin 99.
Determine
Need for Action

Design the
Change

End
Construction

Start
Construction

Put into
Service

p Figure 1. Sam Shortcut followed the simple project workflow shown in

this chart without MOC.

Copyright 2012 American Institute of Chemical Engineers (AIChE)

The area operations manager has a quality problem

because material was transferred to the wrong product bin.
An operator for an upstream unit returns from a
vacation and uses the old targets for the process variables
because he was unaware of the changed targets for the new
product.
The area operations manager is upset again. There
has been an accidental discharge because the primary level
sensor on the product bin failed and there was no backup
device.
The shift team manager is concerned about the relief
valve on Bin 99 opening frequently (i.e., cycling) and possibly releasing inert gas into the production area.
The pressure vessel inspector becomes aware of the
change and believes that state codes for pressure vessels
could apply. He asks Sam if the bin is rated for the new
operating pressure and if the relief device is set correctly.
The environmental coordinator becomes aware of the
frequent relief valve opening and is concerned that it could
be a violation of the environmental permit.
To make matters worse, Sam comes to work Monday
morning and receives a call from a control system mechanic
(i.e., the electrician). It seems that there was a problem
in material transfer that shut down production over the
weekend. Electricians troubleshooting the problem could not
locate the source of the problem because the electrical drawing was not up-to-date and did not reflect the changes made
around Bin 99.
Sam now realizes that by not using MOC he may have
saved some time up-front, but he is spending more time
in the long run to deal with issues that were not addressed
before the changes were made. In addition, Sam did not realize the significant safety and environmental implications of
such a minor process change, or the importance of notifying
those impacted by the change prior to startup. As a result,
Sam acquires the unfortunate nickname Bin 99 Engineer.
The primary reason for MOC is to ensure that changes
to a manufacturing process are made safely. However, as
the story of Sam Shortcut illustrates, it also makes good
business sense. Potential business implications include
equipment downtime and lost production, inefficient use of
manpower, and, in the worst case, a process safety incident
with property damage, personal injuries, and fatalities.

The MOC workflow

MOC is a procedure for safely changing facilities and/or
documentation. A good MOC procedure (Figure 2) typically
includes all of the following steps.
Origination. The first step is putting the change request
in writing. This should include a description of the change,
the technical basis for the change, the potential impact on
safety, and required PSI updates. This step is usually done
CEP March 2012 www.aiche.org/cep

51

Back to Basics

engineering drawings, piping and

instrumentation diagrams (P&IDs),
equipment design information, material
safety data sheets (MSDS), mechanical
integrity inspection schedules, emerDesign the
Start
End
Validate
gency shutdown test procedures, and
Change
Construction
Construction
Construction
operating procedures, among others. It is
important to identify the people who are
responsible for updating each portion of
Manage
Train
Put into
Conduct
the PSI (e.g., operators, engineers, safety
Temporary MOC
Employees
Service
PSSR
inspectors, etc.).
The MOC workflow establishes
a set of checks and balances for the
z Figure 2. MOC adds several elements to the
Update PSI
project workflow shown in Figure 1. A good MOC
many individuals involved in a process
Close MOC
Information
procedure has numerous steps to address all safety change. For example, safety personnel
concerns and help prevent incidents.
concerns may require additional safeby the operations staff engineer or the person in charge of
guards not included in the originators change request. A
the project.
design engineer may conclude that the change is not feasible
Approvals and reviews. In the second step, management
as originally proposed, but that an alternative technology
and technical experts (e.g., engineering and safety personwould work.
nel) evaluate the change with respect to their own area of
How MOC fits into the overall safety program
expertise. They may do this individually or as a group. If an
approver has any questions or concerns, he or she should
The safety program of a chemical manufacturing facilcommunicate with the originator to resolve them. Approvers
ity typically consists of process hazard analyses (PHAs),
can also request additional safety reviews or other analyses
a mechanical integrity (MI) program, personnel training,
that they deem necessary.
operating procedures, PSSRs, PSI, incident prevention, and
Engineering design. In this step, engineers of the
MOC. MOC plays a central role in this program because:
appropriate discipline (e.g., chemical, mechanical, electrical,
it provides updates to PSI
civil, etc.) complete the detailed engineering of the change.
it identifies when a PSSR is needed
Operations and safety staff usually approve the final design
it ensures that employees are trained to carry out new
technical drawings.
procedures
Execution. During this step, construction personnel and
it adds new equipment to mechanical integrity test and
engineering staff make the facility design changes. Any
inspection schedules
procedural updates and process-control software changes are
its documentation is reviewed once every five years (as
also completed.
required by the PSM rule) during the revalidation of PHAs,
Field verification, notification, and training. This step
ensuring process-to-PHA consistency.
is part of the pre-startup safety review (PSSR) and involves
The bottom line is that MOC helps prevent incidents.
critical activities that should be completed prior to putting
Types of changes subject to MOC
the change into service. Field verification is an inspection to
ensure that what was done in the field matches the speciSeveral types of changes must be managed by the MOC
fications in the engineering design package. Notification
procedure.
involves informing all affected persons and departments that
Facility changes. Facility changes include any modificathe change is about to occur. Training by a knowledgeable
tions made to the equipment within a facility. For a piping
instructor is conducted (as needed) for all personnel who
system, this may include replacing carbon steel pipe with
will be operating the process after the change has
stainless steel, replacing 2-in. pipe with 3-in. pipe, replacing
been made.
150-lb flanges with 300-lb flanges, adding tracing or insulaStartup. Startup is the actual introduction of the change
tion, substantially changing the pipe routing, tying the piping
and coordination of all associated activities. This is the first
into another line, or anything that changes the pipe class on a
time the process is operated with the change.
P&ID. Other facility changes include replacing a centrifugal
Completion of PSI. It is essential to keep all process
pump with a diaphragm pump, re-tubing a heat exchanger
safety information updated because it is the foundation for
with a different gauge tubing or material of construction,
the entire process safety management program. PSI includes
replacing a motor with one having a different horsepower,
Determine
Need for Action

52

www.aiche.org/cep

Determine if
MOC is Needed

March 2012

CEP

Complete MOC
Form

Get Approval
of MOC

Copyright 2012 American Institute of Chemical Engineers (AIChE)

Keys for successful MOC

Here are a few tips to facilitate the success of MOC.
Individuals who could possibly use the MOC procedure
(e.g., originators, approvers, and those who complete critical
tasks such as engineering design) should be trained on it.
Change should be managed, not just documented. A
good management system includes more than just filing
paperwork (hard copy or electronic) to document changes. It
includes processes to ensure that MOC requests are written
when appropriate and then processed properly in compliance with company procedures. It should also ensure that
temporary MOCs are reversed at the proper time. This can
be accomplished by methods such as audits and regular
status reports.
Roles in the MOC procedure who is responsible for
each step and the expectations associated with the step
must be clear.
Management must set expectations that the MOC
procedure will be followed by everyone.
Communication is extremely important to the success
Copyright 2012 American Institute of Chemical Engineers (AIChE)

of MOC. Everyone involved in the MOC procedure must

communicate with each other.
MOC should be audited regularly at least annually.
The audit should review both the management system and
the individual alterations made under MOC. The primary
questions in an audit are whether MOC requests are being
written at the appropriate times and whether the company
procedure is being followed after an MOC request is written, including proper use of safety reviews and updating of
PSI. Some examples of major red flags are: work orders for
modifications without accompanying MOC requests; action
items from safety reviews that are not completed; startup of
a change before all PSSR items are complete; and closing of
MOCs before all PSI updates are made.
Many of these tips are related to the company organization and culture. Reference 3 is a good source for more
CEP
information on management of change.

Literature Cited
1.
2.
3.

Atherton, J., and F. Gil, Incidents That Define Process Safety,

Center for Chemical Process Safety (CCPS), New York, NY, and
John Wiley & Sons, Inc., Hoboken, NJ, pp. 202205 (2008).
U.S. Occupational Safety and Health Administration, Standard for Hazardous Materials Process Safety Management of
Highly Hazardous Chemicals, 29 CFR 1910.119.
Center for Chemical Process Safety, Guidelines for Management of Change for Process Safety, American Institute of
Chemical Engineers, New York, NY (2008).

Further Reading
Sanders, R. E., Chemical Process Safety: Learning from Case
Histories, Elsevier Butterworth-Heinemann, Burlington, MA
(2005).

R. Wayne GaRLand, is a technical associate in the Corporate Health,

Safety, Environment and Security Div. at Eastman Chemical Co. (P.O.
Box 511, Bldg. 54D, Kingsport, TN 37662; Phone: (423) 229-5518;
Email: wgarland@eastman.com), a Fortune 500 manufacturer of
chemicals, plastics, and fibers. He has more than 32 years of process
engineering experience, including 22 years in process development and manufacturing of polymers and cellulose esters and 10
years in process safety. He earned his BS and MS degrees from the
Univ. of Kentucky, both in chemical engineering, and is a registered
professional engineer in Tennessee. He is a long-standing member of
AIChE and has been active in the Center for Chemical Process Safety,
including membership on the Technical Steering Committee. He has
13 current and pending publications, many of which are in the process
safety field.

Answers to Test Your Knowledge

1. A. MOC covers alterations to manufacturing processes that are not
replacement-in-kind. Alterations to office areas, editorial changes, or
certain emergency actions are not subject to MOC.
2. D. If safe operating limits are defined in a standard operating procedure,
process setpoints can be changed within that range without the need for
MOC. However, if the setpoint is being changed to a value that is outside of
the pre-approved safe operating limits, then MOC should be used.

replacing a flowmeter with one of a different type, adding a new pressure gage, changing gasket types, changing
machine settings (if not covered in operating procedures),
replacing a pump impeller with a larger one, etc.
Control system changes. This category includes changes
to the programming or control logic, changes to who has
access to the logic, resetting interlock timers, bypassing
any circuit element or protective device, or changes to an
alarm point that takes it outside of the safety or quality limits
specified in the operating procedure.
Information system changes. This includes changes to
raw material specifications that result in replacing a chemical with a different grade, or replacing a chemical with the
same grade from a different vendor if the new vendor is
not quality approved. A few other examples of information
system changes are modifications to control strategies, spare
parts listings, maintenance procedures, equipment/instrumentation specifications, and environmental information.
Procedural changes. This category includes any changes
to previously established safety, quality, or operating limits
in the operating procedure.
Changes may be permanent or temporary. If a temporary
change is made, it must be tracked and properly reversed.
Companies should also have a procedure to handle emergency changes, which are those that must be made quickly
during off-hours (e.g., nights, weekends, and holidays)
when the regular MOC approvers may not be available. For
example, approval could be obtained verbally rather than in
writing (as long as it is properly documented), or approval
could be obtained from authorized on-call personnel rather
than the regular approvers.

CEP

March 2012 www.aiche.org/cep

53