article review

Safety ManagementSafety Management

O

Management of Change

A key to safety—not just process safety By Mark D. Hansen and Gerald W. Gammel

www.asse.org OCTOBER 2008 PROFESSIONAL SAFETY 41

ON NOV. 25, 1998, a fire at the Equilon Enterprises oil refinery delayed coking unit in Anacortes, WA, caused six fatalities. A loss of electric power and steam supply approximately 37 hours before the fire had resulted in abnormal process conditions (CSB, 2001).

The investigation revealed that personnel had expected a tarry mass to drain from the drum. [A drum is a tower or vessel in which materials are processed, heated or stored. Coke drums can be very large (e.g., 120 ft tall with a 29 ft diameter) and typi- cally stand several stories high.] The supervisor had directed that the drum be opened with a minimum number of people present. In response to concerns that the limited flow of steam might not sufficiently strip all the toxic compounds from the tar inside the vessel, workers removing the bolts on the drum heads were required to wear self-contained breathing appa- ratuses. The top head was unbolted and lifted from the drum. The bottom head was also unbolted and held in place by a hydraulic dolly. The operator then activated a release mechanism to lower the dolly.

Witnesses reported hearing a whooshing sound and seeing a white cloud of vapor emanate from the bottom of the drum. The hot petroleum vapor burst into flames. The process supervisor, an operator and the four contract personnel assisting were caught in the fire and died (CSB, 2001). After the incident, Equilon relocated the controls for the hydraulic dolly to allow workers to position themselves far- ther from a drum when opening it (CSB).

Lessons Learned Why examine this accident? Because it illustrates

the need for management of change (MOC). MOC is critical to process safety—and it is a concept that if well implemented could likely prevent incidents in many other industries as well. Many industries would benefit from establishing policies to manage deviations from normal operations. Systematic methods for managing change are sometimes applied to physical alterations, such as those that occur when an interlock is bypassed, new equip- ment is added or a replacement is “not in kind.”

For an MOC system to function effectively, field

personnel must know how to recognize which devia- tions are significant enough to trigger further review. Thus, operating procedures must include well-de- fined limits for process variables for all common tasks. Once on-site personnel are trained on MOC policy and are knowledgeable about normal limits for process variables, they can make informed judgments regarding when to apply the MOC system.

Once a deviation is identified that triggers the MOC system, management must gather the right people and resources to review the situation. A mul- tidisciplinary team may be required to thoroughly identify potential hazards, develop protective meas- ures and propose a course of action.

The Equilon incident could have been avoided had the change been managed by a team experi- enced in hands-on operations, safety procedures and engineering calculations. Written procedures for cooling and emptying partially filled drums, as rec- ommended by an investigation team in 1996, may also have reduced the likelihood of this incident.

The Potential for Severe Injuries Manuele (2003), referring to Petersen (1998), notes

that “studies in recent years suggest that severe injuries are fairly predictable in certain situations. Some of these situations involve:

•unusual, nonroutine work; •nonproduction activities; •sources of high energy; •certain construction situa-

tions.” These are just a starting

point. A long list could be made that would more exten- sively specify the areas where severity is predictable. Man- uele (2003) continues:

Data, not yet published and provided by Franklin Mirer, director of the Health and Safety Department at the International Union-UAW, is in concert with Petersen’s

Abstract: Management of change (MOC) is critical to process safety—and it is a concept that if well implemented could likely prevent incidents in many other industries as well. Many industries would bene- fit from establishing policies to manage deviations from normal operations. This article defines key change concepts and examines several key elements of an effective MOC process.

Mark D. Hansen, P.E., CSP, CPEA, CPE, is vice president, environmental and safety, for Range Resources Corp., Ft. Worth, TX. A former ASSE president, he has more than 26 years’ experi- ence in the field and holds a B.S. in Psychology and a M.S. in Industrial Engineering, specializing in safety, both from Texas A&M University. An ASSE Fellow, Hansen is a professional member of ASSE’s Fort Worth Chapter and a member of the Society’s Engineering, Risk Management and Transportation practice specialties.

Gerald W. Gammel, CSP, CHMM, OHST, is safety and training director for Dixie Chemical Co., Pasadena, TX. He has 34 years’ experience in the specialty chemical manufacturing industry and is a professional member of ASSE’s Gulf Coast Chapter.

041_50_HansenFeature_1008:Layout 1 9/12/2008 9:19 AM Page 41

42 PROFESSIONAL SAFETY OCTOBER 2008 www.asse.org

of change in its PSM standard—29 CFR 1910.119 (OSHA, l992). The standard requires that an employ- er establish and implement written procedures to manage changes (except for replacements in kind) to process chemicals, technology, equipment and proce- dures, and changes to facilities that affect a covered process. In addition, the standard requires that the procedures shall ensure that the following considera- tions are addressed prior to any change:

1) the technical basis for the proposed change; 2) impact of change on safety and health; 3) modifications to operating procedures; 4) necessary time period for the change; 5) authorization requirements for the proposed

change. Under the standard, employees involved in oper-

ating a process, and maintenance and contract employees whose job tasks will be affected by a change in the process are to be informed of, and trained in, the change prior to start-up of the process or affected part of the process. The standard also states that “if a change covered by this paragraph results in a change in the process safety information required by paragraph (d) of this section, such infor- mation shall be updated accordingly.” It further states, “If a change covered by this paragraph results in a change in the operating procedures or practices required by paragraph (f) of this section, such proce- dures or practices shall be updated accordingly.”

Center for Chemical Process Safety (CCPS, 1989) offers this guidance regarding MOC:

In any operation, situations will arise that were not foreseen when the operating proce- dures were developed. At such times, person-

observations. The data indicate that severe injury accidents occur disproportionately in unusual and nonroutine work, in nonproduc- tion activities and where high sources of ener- gy are present. During the 18 years prior to Jan. 1, 2002, the data show that skilled trades people—who represent about 20% of the UAW work population of about 700,000— make up 40 to 50% of the fatalities. These indi- viduals include maintenance personnel, millwrights, electricians, steamfitters and tin- smiths; they rarely engage in repetitive and routine work, nor do they engage in produc- tion work. Total hours worked by the UAW population over this period is in the billions, which represents a sound statistical base; these data have significance. The potential for severe injuries to occur during

nonroutine activities is being recognized by some in industry. According to Manuele (2003), the safety director of one chemical company reported that when the system is running, the risks are lower; when the system must be opened for maintenance or equipment fails or a chemical release occurs, severity potential is greatly increased. A safety direc- tor for a heavy electrical equipment manufacturer says that severe injuries in his company rarely occur during routine production operations.

Management of Change Defined OSHA has made three things about process safety

management (PSM) clear: Write what you do, do what you write and, if no written records were made, it never happened. The agency defines management

Figure 1Figure 1 Management of Change

041_50_HansenFeature_1008:Layout 1 9/12/2008 9:19 AM Page 42

www.asse.org OCTOBER 2008 PROFESSIONAL SAFETY 43

non-PSM companies document lessons learned, yet because they lack an effective management system, the controls are typically lacking.

PSM companies that continue to incorporate MOC best practices and systems in their processes are able to achieve continuous PHA revalidation, which offers measurable cost reductions and safety benefits (CCPS, 2000). Where non-PSM facilities are not required to perform PHAs, clearly these analyses provide the basis for engineering design for safety. Failing that, an MOC program provides a control mechanism to pro-

nel may want to conduct operations in a way that differs from, or contradicts, the process technology or the standard operating proce- dures. To ensure that these deviations from normal practice do not create unacceptable risks, it is important to have a variance proce- dure, or to have incorporated the same means of control into other management systems. The variance procedure will require review of the planned deviation and acceptance of the risks it poses. The variance procedure should require the explanation of the deviation planned; the reasons it is necessary; the safety, health and environ- mental considerations; con- trol measures to be taken; and duration of the vari- ance. Variances should re- quire the approval by a suitable level of manage- ment, based on the process risks involved.

Effective MOC Programs As noted, an effective MOC

process can help prevent accidents. Numerous investi- gations have identified weak- nesses in the MOC process as a root cause of process safety incidents (CSB, 2001). CSB has also stressed the need for non- PSM companies to adopt a sys- tematic MOC process.

Following the completion of initial process hazard analyses (PHAs), a systematic MOC methodology (Figure 1) serves as the principal PSM system to ensure that risk levels associat- ed with process modifications are addressed properly. This ensures that changes do not bypass or otherwise render the safety controls useless.

Non-PSM companies (e.g., automobile parts, consumer products) that have various manufacturing processes could benefit from an MOC program to ensure that changes to the process do not render safety controls and safety critical con- trols ineffective. Such a program would also reduce equipment failure as a result of factors such as incompatible materials and technologies, and ensure that operating procedures are updat- ed for equipment operators. In the author’s experience, some

Examples of Temporary Changes Requiring an MOC

•Changes in materials of construction •Change in raw materials or feedstocks •Replacement equipment, machinery and piping that differ from the original design

specifications •Addition or removal of process equipment or piping such as adding block valves or

flowmeters •Changes in physical layout that may affect employee escape paths •Change in product recipe or the introduction of new products •Temporary electrical equipment or connections •Removal or decommissioning of equipment, alarms and safety systems •New projects that involve tie-ins of equipment modifications of units already operating •Projects to increase throughput or accommodate different feedstocks or products

including differing catalysts •Equipment changes including the installation of new equipment and modifications of

equipment already in use •An alternative supply of process materials, catalysts or reactants, possibly through tem-

porary drums or tanks in the plant •Changes resulting from process hazard analyses, safety reviews before start-ups, and acci-

dent or incident investigation recommendations •Modification of the process or equipment that causes changes in the relief requirements

including capacity, trip points or venting routes •Changes in the process or mechanical design •Change in process chemicals or chemistry •Introduction of new or different process additives (e.g., corrosive control agents,

antifoulants, antifoam agents) •Major equipment replacement by a manufacturer that did not make the original

equipment •Change in equipment design •Temporary piping connections or hoses •Change in piping and equipment specifications •Change in operating or maintenance procedures •Change in process control or conditions including changing control ranges of tempera-

ture and pressure instruments to exceed defined standard operating limits •Change in equipment service or maintenance routine (e.g., the introduction of reliabili-

ty centered maintenance such as pumps) •Change in metallurgy of a piping system •Change in electrical service •Adding or removing insulation on a major scale •Installation or changes in structural members supporting covered processes •Changing the method or controls scheme of an instrument loop •Changing or bypassing (“jumping”) alarms, permissive switches or trips •Change in warehousing procedures, indexing and storage conditions •Change in operating discipline such as a computer programming change

Note. From “Documentation—The Key to MOC,” by M.M.R. Eastman and J.R. Sawers, 1998, Chemical Processing.

041_50_HansenFeature_1008:Layout 1 9/12/2008 9:19 AM Page 43

44 PROFESSIONAL SAFETY OCTOBER 2008 www.asse.org

turnaround and other project management soft- ware—should also be included.

Many PSM companies reshape their MOC pro- grams based on past experiences and current best practices. In addition, the author knows of some refineries that adhere to PSM requirements even for process units not regulated by that standard. Clearly, while many may struggle to address issues that affect overall program objectives and effectiveness, they benefit from the disciplined approach to change.

It’s All in the Details While implementing MOC is, in principle, a posi-

tive control process, companies often overlook the details. As a result, the process has some inherent pit- falls (CCPS, 1989; 1992; 1994; 1995; 1996). The same is true (or worse) for PSM companies that have no dis- ciplined approach to managing change. Factors that are often overlooked include the following:

•Inadequate definition of a change: What is replacement in kind?

•Resolution of temporary changes: Do we want to extend the duration of the change, return the process to original condition or make the change permanent?

•Managing emergency changes: How do we ensure that all requirements of normal changes are satisfied?

•Procedural changes: Do we require a prestart- up safety review?

•Tracking/closure of action items: How do we verify that action items have been completed and meet the intent of the recommendation?

•Communication of the change: How do we achieve this and maintain adequate documentation?

•Prestart-up safety review: How do we decide when one is needed?

•Updating process safety information (PSI): How do we manage updating to ensure MOC action items are closed out in a timely manner?

•PHA interface: How do we revalidate an exist- ing PHA for each MOC?

MOC Implementation Issues Let’s take a closer look at each of the overlooked

factors.

Inadequate Definition of a Change A common shortfall of many MOC programs is

an inadequate and inconsistent methodology in identifying changes that should be captured by the MOC process (CCPS, 1989, 1995). According to CCPS (2000), in general, all process and changes except replacements in kind should be associated with an MOC, although some latitude can be exer- cised regarding the specific methodologies and the level of reviews required.

Care should be taken to ensure that even seeming- ly minor issues, such as personnel changes in key positions or changing set points of instruments, are captured to ensure that requisite safety and reliability levels are maintained. As noted, MOC should be initi- ated when a process is altered or when the mechanical

vide a disciplined engineering process to manage the documentation and system operations.

Documentation Is Key According to Eastman and Sawers (1998),

“Document control and training are critical to the MOC process.” All affected personnel must be in- formed by memo, through formal training or by other appropriate methods. Inform purchasing depart- ments and stores to ensure new or replacement parts are ordered and that no costly mishaps occur through less-than-up-to-date inventory control.

A good approach for this effort is to have the per- son requesting the change complete a request for change to policies or procedures. This would nor- mally be the employee responsible for job documen- tation, the draftsperson or the project engineer who owns a particular document. The request is then sent to the area superintendent who will approve it and verify that the training required for MOC is sched- uled and conducted; affected documents have been updated; and appropriate operations, maintenance, purchasing, stores and other personnel have been notified of the changes.

Affected documents may include operations job documents, such as job analyses, training plans (basic and job-specific), standard operating procedures and skill demonstrations. General-purpose reference doc- uments might include standard operating conditions and limits (SOCLs), pressure-relief devices, lubrica- tion manuals and others. Similarly, maintenance craft documents, such as job analyses, training plans (basic and craft-specific), standard maintenance procedures and skill demonstrations are included, as are general- purpose reference documents, such as technical data sheets, spare parts lists, manufacturers’ manuals and corresponding documents for contractors. In most cases, site policy manuals, reference documents and software—including safety, process safety manage- ment, environmental (with the risk management plan), employee, purchasing, warehouse, MSDS, qual- ity, maintenance scheduling, training scheduling,

Examples of Changes to Facilities & Processes Requiring an MOC

•Structural changes to a unit or facility including changes in access roads, manways, ladders or stairs

•Changes to pressure-relief devices such as adjusting valve set- tings or relieving capacity

•Any replacement of equipment or components, piping, instru- ments or electrical components that is not an in-kind replacement

•Nonroutine changes to instrumentation, control loops or comput- er programs such as changing the range of transmitters or control- valve failure positions

•Any change in safety alarm settings, interlocks, process or equip- ment trips, or in the testing or calibration frequency or standards of those devices

•All temporary facilities and connections including pipe clamps, temporary pipe, hoses, temporary utility connections and temporary electrical equipment or connections

•Changes to fire protection, emergency response or other safety systems Note. From “Documentation—The Key to MOC,” by M.M.R. Eastman and J.R. Sawers, 1998, Chemical Processing.

041_50_HansenFeature_1008:Layout 1 9/12/2008 9:19 AM Page 44

www.asse.org OCTOBER 2008 PROFESSIONAL SAFETY 45

same issues. The key difference is that they do not store the large quantities of highly flammable liquids that trigger the PSM and MOC requirements.

Technology is another type of change that should be tracked. Such changes occur when equipment is

design is modified. It may also result from changes in feedstocks, catalysts, product specifications, by-prod- ucts or waste, design inventories, instrumentation and control systems, or materials of construction (CCPS, 1994). Non-PSM companies experience many of the

Figure 3Figure 3 MOC Form

041_50_HansenFeature_1008:Layout 1 9/12/2008 9:19 AM Page 45

46 PROFESSIONAL SAFETY OCTOBER 2008 www.asse.org

down of a process unit in an emergency. That type of change needs to stay in accordance with emergency procedures and protocols, and is documented in appropriate log books, returning the process to its original state as soon as practical (OSHA, 1992).

An ideal MOC policy should allow for variances to handle special cases or circumstances. Preventive maintenance and related inspections and tests includ- ing repairs are also exempt, as are recalibration of instruments; in-kind or equivalent replacement of insulation, instrumentation or equipment; cleaning of exchangers, piping or other equipment; bypassing interlocks, trips and alarms; trips bypassed during normal operations to blowdown transmitters; trips bypassed for weekly checks; and nuisance alarms bypassed when equipment is down for maintenance.

For non-PSM companies, technology is often a huge driver. Companies are market-driven and must respond quickly to market conditions. As a result, details of system parameters may be missed, creating the potential for an incident. As the number of changes grows, corporate memory can evaporate. When software is added to the mix, being able to remember what changes took place 1 month ago, much less 1 year ago, is challenging—and is often made more so by frequent personnel changes.

Temporary Changes Documentation, closure and communication of

temporary changes are often cited as major quality issues in MOC programs (CCPS, 1989; 1995). Examples of temporary changes requiring an MOC are discussed in the sidebar on p. 43. Common issues include the following:

•authorized period expires without removing or making the change permanent;

•change is made permanent, but is not reflected in the P&IDs and other process safety information;

•change is improperly or incompletely removed. Non-PSM companies experience similar tempo-

rary changes, such as the interim use of a hose in place of failed piping to allow the process to be brought to a safe stopping point to make the necessary repairs. Another example of a temporary change is the need to accept a raw material from an unapproved supplier because the normal supplier has experienced a busi- ness interruption and cannot provide the material.

Emergency Changes Due to their nature, emergency changes are often

extended special privileges in the MOC process (CCPS, 1992; 1995). These privileges allow personnel to perform emergency field changes and modifica- tions using a less-rigorous process than normal changes. However, these field changes often are not brought into the mainstream MOC process even after the emergency situation has been addressed. Consequently, a change that may be temporary often inadvertently becomes permanent (Ozog & Stickles, 2003). As one of Murphy’s laws states, “Nothing is more permanent than that which is marked tempo- rary and nothing is more temporary than that which is marked permanent.”

altered or new equipment, such as process equip- ment piping, electrical or control system alarms, instrumentation and control schemes, are added. Changes in technology also occur when the process is modified or the relief requirements are changed, including modifications in relief points, capacity or other corrective actions. These changes can result in increased throughput, operation at higher tempera- tures or pressures, increased size of equipment, or the addition of equipment that might contribute to higher capacity relief requirements. Installation or removal of bypass connections around equipment that is normally in service is a change in technology under MOC requirements (Eastman & Sawers, 1998).

Changes in facilities are also changes in technolo- gy as defined in 29 CFR 1910.119. A change in a facil- ity would not necessarily appear on a process and instrumentation diagram (P&ID). These changes can occur in equipment configuration; materials of construction; installation of temporary facilities; temporarily bypassing or disabling equipment, in- cluding electrical jumpers; and operating a control valve with the handjack engaged.

Changes in technology also include any new administrative controls, document controls and training. In addition, projects to increase plant throughput or accommodate different feedstocks or products are also considered under this definition.

Significant changes in operating conditions also constitute changes in technology. These can include alterations to pressures, temperatures, flow rates, equipment operating speeds or process conditions outside the engineering maximum-minimum limits set in the SOCLs or manufacturer’s specifications.

Changes in process chemicals are also construed as changes in technology. Examples include intro- duction of new process additives, new process mate- rials, and new catalysts or reactants in covered processes such as corrosion control agents, antifoulants and antifoam agents.

What is exempt? Certain routine changes do not require MOC procedures under the OSHA standard. One example is a change of set point within the administrative limits of an SOCL. Administrative limits demarcate the range where control room oper- ators are allowed to make changes (OSHA, 1992).

Changes of the engineering MOC limits are con- sidered management of change items, which include replacement of equipment that is replacement in kind or changes made to allow for the safe shut-

Written MOC Process Following is an example of how a management of change process

would be written as part of an overall management system. 1.1 The health, safety, security, environmental, technical and other

impacts of temporary and permanent changes are formally assessed, managed, documented and approved.

1.2 Changes in legal and regulatory requirements, technical codes, and knowledge of health and environmental effects, are tracked and appropriate changes implemented.

1.3 Effects of change on the workforce/organization, including training requirements, are assessed and managed.

1.4 The impact on product quality of changes in manufacturing processes is assessed, associated hazards are evaluated and risks are controlled.

1.5 The original scope and duration of temporary changes are not exceeded without review and approval.

041_50_HansenFeature_1008:Layout 1 9/12/2008 9:19 AM Page 46

www.asse.org OCTOBER 2008 PROFESSIONAL SAFETY 47

especially in a marketplace where speed is of the essence, training often takes a backseat.

Prestart-Up Safety Review Although the PSM standard does not require a

PSSR for every MOC item (such as those that do not entail any PSI changes), it is not uncommon to encounter situations where there is no record of a PSSR even though it is required (CCPS, 1992; 1994; 1995). Often, this may be due to a lack of adequate documentation or a formal approval process prior to start-up. While this is required for PSM companies, even an informal process would prove wise for a non-PSM company seeking to ensure that change is managed.

Updating PSI Updating relevant PSI is the litmus test of an

effective and systematic MOC process (CCPS, 1992; 1994; 1995). Most companies attach redlined copies of the relevant PSI (such as procedures, P&IDs, loop diagrams) to the respective MOC forms that serve as guidelines to update the master/controlled copies. However, a random field audit of completed MOCs in an operating facility may reveal that the PSI in many cases has not been updated and is not reflec- tive of the field conditions (Ozog & Stickles, 2003). This can lead to the conclusion that many companies are struggling to identify procedures and work processes which ensure that an MOC program cap- tures PSI updates in their entirety.

PHA Issues An MOC for a major modification and/or change

involving inherently hazardous materials requires a formal PHA using an accepted methodology such as hazard and operability analysis (HAZOP) or fault- tree analysis (CCPS, 1992; 1994; 1995). The sidebar on p. 44 identifies changes to processes and facilities requiring an MOC.

However, many MOC programs do not provide clear guidance on when a PHA may be beneficial or required. Consequently, there may be a tendency to bypass a PHA in the interest of cost/schedule even though one may be required.

Another inherent inefficiency occurs when a PHA associated with a particular MOC item is conducted without integrating the information with the then- current PHA documentation (Ozog & Stickles, 2003). By not doing so, the operating facility is ignoring the revalidation aspect of the overall PHA. This will like- ly result in a longer, more costly PHA revalidation effort at the next 5-year cycle because at that time the operating facility will need to review and incorporate all MOCs into the PHA, thereby incurring redundant cost and schedule demands. Non-PSM companies experience many of the same changes and would do well to follow some kind of procedure to manage them. The example checklist presented in Figure 3 (p. 45) could serve as a starting point.

Administering MOC Adminstering the MOC process can be accom-

plished using a low-tech, paper-driven process

Non-PSM companies also experience emergency changes. If not incorporated into the system, the documentation does not follow and the information and knowledge are not captured.

Procedural Changes Although 29 CFR 1910.119 specifically mentions

“modifications to operating procedures” as falling under MOC requirements, many companies do not review procedural changes through an MOC process (CCPS, 1992; 1994). Confusion typically stems from the wording of the prestart-up safety review (PSSR) element, which for example states, “A PSSR is not required if there is no change in the PSI” (Ozog & Stickles, 2003). Since procedures are not included in the definition of PSI, companies often think that a PSSR is not required for a change that only affects procedures. However, this reasoning clearly does not exempt procedural changes from being managed via the MOC process (Ozog & Stickles).

Non-PSM companies also experience procedural changes—perhaps even more often than PSM-com- panies. The question is whether the documented procedures are changed and maintained or whether the company relies on key personnel to pass on knowledge rather than document and update it when things changes.

Tracking/Closeout of Action Items PSM audits often cite companies for lacking an

efficient mechanism for tracking and closing out assigned action items (CCPS, 1992; 1994). A typical MOC will involve multiple departments and per- sonnel, each with an assigned responsibility. Often, a single individual may have hundreds of assigned action items related to MOCs, PHAs, audits and similar activities. Under such circumstances, it may be that MOC items remain active simply because the assigned individuals have not documented the closeout stage (Ozog & Stickles, 2003). Over time, with no tracking system, the facility accumulates a large MOC backlog—or worse, loses track of open MOCs. According to some sources, it is not uncom- mon for a medium-sized processing facility to have more than 1,000 open MOCs because of an ineffi- cient tracking mechanism (Ozog & Stickles).

Even with a documented process, it is a challenge to keep current. In the author’s experience conduc- ing PSM-related audits and inspections, lack of fol- low-up and closure with corrective actions and action items is a problem.

MOC-Initiated Training An MOC process often indicates the need for

additional training (CCPS, 1994). The following issues are common concerns:

•lack of documentation regarding the training date and participants;

•commencing operations covered by the MOC process before conducting the required training.

How often does training ensue after big changes occur in the system, especially for non-PSM compa- nies? Without a disciplined approach to change,

041_50_HansenFeature_1008:Layout 1 9/12/2008 9:19 AM Page 47

48 PROFESSIONAL SAFETY OCTOBER 2008 www.asse.org

management systems, while others use sys- tems that conform to available guidelines. . . . There is widespread agreement that the use of management systems can improve organiza- tional performance, including performance in the occupational health and safety arena.

OSHA’s Voluntary Protection Programs re- ly on management system principles and has reported success in improving occupational health and safety performance among partici- pating companies. In addition, the American Chemistry Council reports success in improv- ing environmental performance of participat- ing organizations. The major professional health and safety organizations are also on record in support of management systems as effective tools for improving health and safety performance, as well as for contributing to the overall success of the business. Finally, the fact that many organizations in the U.S. and abroad are implementing management sys- tems in occupational health and safety is evi- dence that these systems add value to their businesses. Management systems require an MOC process

because it is good business to manage change prop- erly (Manuele, 2006). The sidebar on p. 46 is an example of how such an element would be written for a management system.

requiring signatures and reviews by various parties or it can also be accomplished by using MOC soft- ware. According to Eastman and Sawers (1998), MOC software should “monitor the creation, notifi- cation, distribution, tracking and reporting of approvals and tasks that must be completed for the change item.” It should also track not-in-kind equip- ment changes, procedure changes and changes to documents not in the document management sys- tem, such as check requests and travel vouchers. A preferred software package should include a func- tion that allows managers and workers to be notified via e-mail regarding the need to approve or take other actions.

Integrating With Management Systems Occupational safety and health management sys-

tems are evolving and becoming more prevalent (Manuele, 2006). ANSI/AIHA Z10-2005 states:

Quality, environmental and occupational health and safety management systems are used by many organizations in the U.S. and around the world. Quality and environmental systems are frequently in conformance to international voluntary consensus standards, or they share many basic concepts and princi- ples with them. . . . Many organizations oper- ate their own occupational health and safety

MOC: A Risk Reduction Tool for Every SH&E Toolkit By Vickie L. Chapman

Management of Change (MOC) is theuniversally adaptable analysis process that emerged from OSHA’s Proc- ess Safety Management standard (29 CFR 1910.119 in 1992) and EPA’s Risk Manage- ment Program (40 CFR 68.75 in 1994). MOC is a proactive process for reducing the risk of an incident associated with changes to machinery, equipment, processes and other activities.

Under an MOC structure, any changes made to a process—whether it is a new product/process or a not-in-kind replacement or upgrade to existing equipment and/or process—must under- go multistage reviews. What results is a systematic, comprehensive review that is designed to reduce or eliminate opportu- nities for failures such as permit misses, bad design installation, incomplete/in- adequate rollout of the change, or equip- ment failure up to and including loss of property or life.

Making Changes: Three Examples Process X uses a 300-gallon per minute

(gpm) centrifugal pump to move a chem- ical from tank Z into the process reactor. The pump fails. The site has another 300 gpm pump in storage. Fairly simple— install the pump and move on because the substitution in this case is a replace- ment-in-kind (300 gpm = 300 gpm).

Imagine the same situation, but this

time, the only substitute pump available is rated 200 gpm—and it will take 1 week for a new 300 gpm model to arrive. Be- cause of the difference in pumping capac- ity, the installation of the 200 gpm pump, even temporarily, cannot be considered a replacement in kind. Additional consider- ation is needed regarding the risk in- volved with such a substitution. How will it affect the process? Will it starve the process downstream in the reactor and cause an upset or runaway reaction? Upstream, will it cause tank Z to over- pressurize or overflow?

Now consider a more difficult sce- nario. The engineering and technology department has been asked to invent and install a state-of-the-art combination ver- tical extrusion furnace flame tempering machine. Nothing else in industry is available against which to benchmark this machine. How much cooling water will it use? What type of waste will it generate? What permits are required? How many operators will be needed and at what skill level? How does the site imagine all possible scenarios and items needed for this new apparatus?

MOC Structure An MOC program provides a struc-

tured manner by which to address the concerns that would arise in these scenar- ios. The program revolves around three

key components: 1) a written program detailing the step-by-step elements—from purpose to auditing effectiveness; 2) MOC generation form that acts as the router document, ensuring inclusion of all rele- vant parties to the change process; and 3) a checklist that articulates matters for consideration involving the change. Written Program

The written program outlines the scope of the program in detail. Sections include: purpose; definition of change/ modification as it relates to MOC; respon- sibility; MOC process details; installation phase; temporary/expedited MOCs; doc- ument retention; training requirements; annual program auditing; personnel and organizational changes; MOC forms (and the order of their use).

MOC Generation Form The MOC generation form generally

has three parts: Part 1 requires the change initiator (e.g., engineer, operations manag- er) to document relevant descriptive infor- mation about the change. This includes details such as the place and the process where the change is located; the origina- tor; the type of installation (temporary or permanent); equipment name; MOC title and tracking number; affected documents; and a narrative section where the origina- tor details the reason for the MOC.

Part 2 of the form is a section for col-

041_50_HansenFeature_1008:Layout 1 9/12/2008 9:19 AM Page 48

www.asse.org OCTOBER 2008 PROFESSIONAL SAFETY 49

Guidelines for technical management of chemical process safety. New York: American Institute of Chemical Engineers (AIChE).

CCPS. (1991). Plant guidelines for technical management of chem- ical process safety. New York: AIChE.

CCPS. (1992). Guidelines for auditing process safety management systems. New York: AIChE.

CCPS. (1994). Guidelines for implementing process safety manage- ment systems. New York: Wiley-AIChE.

CCPS. (1995). Guidelines for safe process operations and mainte- nance. New York: Wiley-AIChE.

CCPS. (1996). Guidelines for integrating process safety management, environment, safety, health and quality. New York: Wiley-AIChE.

CCPS. (2000). Fundamentals of process safety. New York: AIChE. Crowl, D.A. & Louvar, J.F. (2001). Chemical process safety:

Fundamentals with applications (2nd ed.). Upper Saddle River, NJ: Prentice Hall.

Eastman, M. & Sawers, J.R. (1998). Documentation: The key to MOC. Chemical Processing.

Manuele, F. (2003, Feb.). Severe injury potential: Addressing an often-overlooked safety management element. Professional Safety, 48(2), 26-31.

Manuele, F. (2006, Feb.) ANSI/AIHA Z10-2005: The new benchmark for safety management systems. Professional Safety, 51(2), 25-33.

OSHA. (1992). Process safety of highly hazardous chemicals (29 CFR 1910.119). Washington, DC: U.S. Department of Labor, Author.

Ozog, H. & Stickles, R.P. (2003). Management of change or change of management? (White paper). Salem, NH: ioMosiac.

Petersen, D. (1998). Safety management (2nd ed.) Des Plaines, IL: ASSE.

Shrivastava, P. (1987). Bhopal: Anatomy of a crisis. Cambridge, MA: Ballinger Publishing.

U.S. Chemical Safety and Hazard Investigation Board (CSB). (2001, Aug. 20). Management of change (Safety Bulletin No. 2001- 04-SB). Washington, DC: Author.

Conclusion The overall quality and effectiveness of MOC

programs in the process industries can be improved. Most gaps in existing MOC programs fall into three categories: lack of well-defined workflow, documen- tation and information management capabilities (CCPS, 1996). Implementation of software systems can help companies better define workflow require- ments and be both more efficient and effective in instituting MOC programs that drive measurable cost and safety benefits to the facility.

Many lessons learned within the process indus- tries could benefit non-PSM-covered companies. Just because companies do not meet the chemical thresholds does not mean they do not have similar implementation problems. In fact, these problems could be worse because the data are not collected to identify them. Non-PSM-covered companies are as prone (and perhaps more) to have poorly defined workflow, inadequate documentation and poor information management capabilities.

It has been said that there are three states of intel- ligence: Knowing what you know; knowing what you don’t know and not knowing what you don’t know. From an MOC standpoint, not knowing what you don’t know can have devastating and perhaps catastrophic results. !

References Center for Chemical Process Safety (CCPS). (1989).

lecting signatures of those who attend the design package review meeting. Parties that should be active in this meet- ing include: operating technicians, main- tenance, quality, SH&E, engineering, technology and others.

Part 3 of the form is section for col- lecting signatures of those involved in a final walk-through inspection of the changes made. This inspection should ensure that the equipment is in a condi- tion to be safely started and operated. At a minimum, final signatures should include the MOC originator, operating technician and the department manager.

MOC Checklist The third document is the MOC

checklist (see p. 50). It helps those involved recognize all possible items to be considered concerning the change. Subelements of the checklist include operations, health (industrial hygiene), training, process controls, maintenance, process analysis, environmental, engi- neering and safety. Each subelement con- tains bullet points to be considered regarding the change. As projects are completed, the checklist should be improved to make it more robust and comprehensive.

The MOC Process in Practice Identifying the need for a change is

the first step. The MOC initiator general- ly is the management leader tasked with making the change happen. The initiator completes Part 1 of the MOC generation

form and creates a package of materials that explain the change project. The ini- tiator then schedules a design review meeting with all applicable team mem- bers (e.g., maintenance, SH&E, technolo- gy, operations leaders, technicians) and provides each with a copy of the MOC project package.

At the meeting, participants ask ques- tions and review relevant project draw- ings and documents. Participants also collectively work through the MOC checklist in order to openly discuss, con- sider and capture any tasks related to making the proposed change. The check- list may be in a paper checkbox form, but an electronic spreadsheet expedites the process and helps the team easily provide descriptive action details, identi- fy action owners and list target comple- tion dates.

After the meeting, personnel sign off on the MOC generation form to acknowledge their participation in the review process. Team members then work to address and complete assigned action items. Once these are completed, the initiator is notified.

Once all action items are completed and the change is in place, the initiator schedules the final walkdown inspection. The team assesses the completed change to ensure that all items are in place and that the equipment and/or process is ready to be placed into service. All par- ties participating in this inspection sign off on the MOC generation form. Copies

of completed MOC forms and the project package should be filed in the initiator’s office, as well as in the SH&E and engi- neering department offices. These records will be used when auditing the program’s effectiveness and robustness.

The duration of the MOC review process varies depending on the breadth, width and depth of the change—which can range from a small change (e.g., pump, blower, valve changeout, on-site equipment move) to the introduction of expensive process equipment. The MOC program should differentiate flexibility for small process changes (e.g., a process temperature increase from 300 to 400 ºF), conducted under controlled conditions (e.g., research and development experi- mentation). Lastly, the program should address a temporary/expedited MOC strategy for emergency situations.

The MOC process is not a matter of conducting a review simply as a regula- tory requirement. The real payoff from this process is reduced risk and fewer incidents. The MOC process takes time to work through, but it is time well spent. !

Vickie Chapman is a professional member of ASSE’s Northern Ohio Chapter. She has more than 20 years’ experience in the SH&E and security fields. Chapman holds an M.S. in Occupational Health and Safety Management from the University of Findlay.

041_50_HansenFeature_1008:Layout 1 9/12/2008 9:19 AM Page 49

MOC Sample Checklist ❏ All ❏ N/A Operations ❏ Y ❏ N/A Technician review ❏ Y ❏ N/A Manpower (+/-) ❏ Y ❏ N/A Startup services ❏ Y ❏ N/A Painting ❏ Y ❏ N/A Labeling (pipes and valves, etc., for purpose

and content) ❏ Y ❏ N/A Accessibility (e.g., need a ladder?) ❏ Y ❏ N/A Success (keep running) or failure (shutdown)

criteria ❏ All ❏ N/A Training ❏ Y ❏ N/A MPIs changed (job instructions) ❏ Y ❏ N/A Emergency procedures ❏ Y ❏ N/A Training materials (new/existing) ❏ Y ❏ N/A Training time ❏ Y ❏ N/A Maintenance inclusion ❏ Y ❏ N/A Operations inclusions ❏ Y ❏ N/A Other training overlap (cranes, PPE) ❏ All ❏ N/A Maintenance ❏ Y ❏ N/A Maintenance accessibility ❏ Y ❏ N/A Equipment compatibility ❏ Y ❏ N/A Drawings/prints/documentation ❏ Y ❏ N/A Isolation ❏ Y ❏ N/A Procedures ❏ Y ❏ N/A PM program and equipment and tools ❏ Y ❏ N/A Spare parts ❏ Y ❏ N/A Critical equipment ❏ Y ❏ N/A Excavating and trenching ❏ Y ❏ N/A Hot work ❏ Y ❏ N/A Mechanical integrity ❏ Y ❏ N/A Inspection and testing criteria ❏ All ❏ N/A Process controls ❏ Y ❏ N/A Critical instrument involved? ❏ Y ❏ N/A Calibrations ❏ Y ❏ N/A Input/output additions or deletions ❏ Y ❏ N/A Sequence program change? ❏ Y ❏ N/A Instrument change? (range, type, etc.) ❏ Y ❏ N/A New/modified interlocks? ❏ Y ❏ N/A Variable changes (timers, recipes, alarms?) ❏ Y ❏ N/A Determine control feasibility ❏ Y ❏ N/A New/modified control strategy ❏ Y ❏ N/A Statistical process control ❏ Y ❏ N/A PM program ❏ All ❏ N/A Process analysis ❏ Y ❏ N/A System layout ❏ Y ❏ N/A Corrosive/erosive ❏ Y ❏ N/A Pressure (relief/containment) ❏ Y ❏ N/A MEPT (maximum expected pressure and

temp) ❏ Y ❏ N/A Reactivity ❏ Y ❏ N/A Utilities (Any demand changes?) ❏ Y ❏ N/A Backup power required? ❏ Y ❏ N/A Process stability? ❏ Y ❏ N/A Block flow diagram ❏ Y ❏ N/A Fail-safe conditions (equipment/valves) ❏ Y ❏ N/A Equipment tagging ❏ All ❏ N/A Engineering ❏ Y ❏ N/A Codes/standards referenced? ❏ Y ❏ N/A Civil/structural (building changes) ❏ Y ❏ N/A Stress ❏ Y ❏ N/A Material compatibility understood ❏ Y ❏ N/A Insulation ❏ Y ❏ N/A Best practices ❏ Y ❏ N/A Electrical class ❏ Y ❏ N/A Pipe/equipment supports ❏ Y ❏ N/A Inerting supports

❏ Y ❏ N/A Regulation forms (U1, etc.) ❏ Y ❏ N/A Standards (new codes/specs) ❏ Y ❏ N/A Process flow diagram ❏ Y ❏ N/A Baseline integrity inspection ❏ Y ❏ N/A Piping and instrumentation diagram ❏ Y ❏ N/A Electrical line diagram ❏ Y ❏ N/A Material balance ❏ Y ❏ N/A Energy balance ❏ Y ❏ N/A FMEA ❏ All ❏ N/A Safety ❏ Y ❏ N/A Fire protection (sprinkler, extinguisher) ❏ Y ❏ N/A Explosivity/inerting ❏ Y ❏ N/A FM compliance (insurance underwriter) ❏ Y ❏ N/A Compressed gases and storage ❏ Y ❏ N/A Carseal ❏ Y ❏ N/A Hot/cold surfaces/insulation ❏ Y ❏ N/A Grounding/bonding/earthing ❏ Y ❏ N/A Energy isolation points and LOTO ❏ Y ❏ N/A Eyewash/safety shower ❏ Y ❏ N/A Laser light ❏ Y ❏ N/A Job safety analysis ❏ Y ❏ N/A Personal protective equipment ❏ Y ❏ N/A Contractor safety and health review ❏ Y ❏ N/A Hazard analysis ❏ Y ❏ N/A Occupancy changes ❏ Y ❏ N/A Potable water ❏ Y ❏ N/A Means of egress ❏ Y ❏ N/A Confined spaces ❏ Y ❏ N/A Walking/working surfaces ❏ Y ❏ N/A Machine guarding ❏ Y ❏ N/A Hazardous materials ❏ Y ❏ N/A Safety labeling/warning (signs, pipes, color

coding) ❏ Y ❏ N/A Fall protection ❏ Y ❏ N/A Hot work (welding, cutting, brazing) ❏ Y ❏ N/A Hand and power tools ❏ Y ❏ N/A Emergency equipment (SCAT pack, stop but-

tons, etc.) ❏ All ❏ N/A Health (IH) ❏ Y ❏ N/A Noise (85 dB) ❏ Y ❏ N/A Fumes/ventilation ❏ Y ❏ N/A Ergonomics and positioning of people ❏ Y ❏ N/A Material introduction/compatibility ❏ Y ❏ N/A HazCom-MSDS and labeling ❏ Y ❏ N/A Toxicity ❏ Y ❏ N/A Working environment (hot, cold) ❏ Y ❏ N/A Laboratory safety ❏ Y ❏ N/A PPE assessment ❏ All ❏ N/A Environmental ❏ Y ❏ N/A Operating permits: air/water/waste

(new/modified) ❏ Y ❏ N/A Emission controls ❏ Y ❏ N/A Waste minimization ❏ Y ❏ N/A Waste type/quantity ❏ Y ❏ N/A Waste characteristics (any change) ❏ Y ❏ N/A Emission point change ❏ Y ❏ N/A Water demand change ❏ Y ❏ N/A Tank change usage ❏ Y ❏ N/A SARA 311, 312, 313 ❏ Y ❏ N/A Containment/spill prevention ❏ Y ❏ N/A SPCC change? ❏ Y ❏ N/A Change in fugitive emission points (LDAR) ❏ Y ❏ N/A RMP change ❏ Y ❏ N/A HVAC systems (CFCs, ozone depleting) ❏ Y ❏ N/A Waste water impact reviewed ❏ Y ❏ N/A Chemical control/restricted chemicals ❏ Y ❏ N/A Review storm water permit

50 PROFESSIONAL SAFETY OCTOBER 2008 www.asse.org

041_50_HansenFeature_1008:Layout 1 9/12/2008 9:19 AM Page 50