1.4 Management of Change (MOC)

Management of Change (MOC) is one of the most critical elements of any Process Safety Management (PSM) framework. High-hazard chemical, refining, and manufacturing facilities operate within tightly defined engineering and operational parameters. Uncontrolled, unreviewed, or unauthorized modifications to equipment, operating boundaries, process chemistry, software, or personnel represent a primary root cause of catastrophic industrial accidents.

Scope and Categories of Change

An effective MOC system must address all modifications that deviate from the established Basis of Safety or Design Envelope. Changes typically fall into four distinct categories:

1. Physical / Technical Modifications

Includes alterations to process hardware, piping, instrumentation, materials of construction, or physical plant layout. Examples include:

• Replacing a stainless steel pipe section with carbon steel.
• Modifying a valve control loop, interlock logic, or programmable logic controller (PLC) code.
• Adding a bypass line around a heat exchanger or filter.

2. Operational / Process Condition Modifications

Includes changes to operating limits, process chemistry, or feedstock specifications. Examples include:

• Increasing reactor operating temperature or pressure beyond design limits.
• Introducing a new chemical additive or changing feedstock supplier specifications.
• Altering batch processing cycle times or column throughput rates.

3. Temporary Modifications

Includes short-term physical or operational changes implemented to accommodate maintenance, equipment failure, or operational troubleshooting. Examples include:

• Installing a temporary spool piece or jumper wire to bypass an instrument interlock.
• Operating with a temporary diesel pump while a primary electric fire pump is repaired.
• Temporary structural scaffolding or temporary piping runs.
• Critical Control: Temporary changes pose extreme major hazard risks because they are frequently forgotten and left in place indefinitely. Every temporary MOC must have a strict expiration date, a formal risk assessment, and a mandatory decommissioning procedure.

4. Organizational Modifications (Organizational MOC / OMOC)

Includes changes to staffing levels, shift structures, reporting lines, or contractor usage that impact safety-critical roles. Examples include:

• Reducing control room operator staffing levels from three operators to two.
• Outsourcing safety-critical instrument maintenance to an external contractor.
• Merging the roles of Operations Supervisor and Maintenance Lead.

The Step-by-Step MOC Lifecycle Procedure

To ensure comprehensive evaluation, every proposed change must progress through a formal, documented, multi-stage lifecycle prior to implementation:

1. Identification and Proposal: The change is formally documented, defining its justification, detailed scope, whether it is permanent or temporary, and its expected duration.
2. Hazard Identification & Risk Assessment: A formal risk assessment appropriate to the complexity of the change (e.g., HAZOP, What-If analysis, FMEA) is conducted by a multidisciplinary team to identify potential hazards introduced by the modification.
3. Multidisciplinary Technical Review & Authorization: Competent specialists from engineering, operations, maintenance, safety, and metallurgy review the risk assessment and provide formal written sign-off.
4. Documentation Update and Training: Prior to commissioning, all affected technical documentation must be updated, including Process & Instrumentation Diagrams (P&IDs), Cause & Effect matrices, Operating Manuals, Safe Operating Limits (SOL), and alarm registers. All affected operators and maintenance personnel must be trained on the change.
5. Pre-Startup Safety Review (PSSR): A physical site check and hardware audit conducted immediately before introducing hazardous materials to verify that construction matches design, inspections are complete, operating procedures are updated, and training is finished.
6. Implementation and Close-Out: The change is commissioned. For temporary changes, the expiration date is tracked in a central register, ensuring prompt removal and restoration to the original baseline state.

Historical Lessons: MOC Failures in Major Disasters

Flixborough (1974): Failure of Temporary MOC

The explosion at Flixborough remains the classic textbook example of a catastrophic failure of temporary MOC. Following the discovery of a crack in Reactor 5, engineers removed the reactor and installed a temporary 20-inch dog-leg bypass pipe to connect Reactor 4 directly to Reactor 6.

• MOC Defects: No mechanical engineering design calculations were performed; no structural support was provided for the expansion bellows; no engineering drawings were produced; no hydraulic pressure test was conducted; and no formal MOC process existed. Under operating pressure, the unsupported bellows squirmed and ruptured, releasing 40 tonnes of cyclohexane.

BP Texas City (2005): Organizational and Technical MOC Breakdown

The investigation into the Texas City disaster revealed widespread MOC failures:

• Procedural Deviation: The startup procedure for the raffinate splitter column had been modified informally over years without technical review or MOC evaluation, allowing operators to run the column with liquid levels far above instrument range.
• Siting of Trailers: Temporary contractor trailers were placed within 150 feet of the hazardous ISOM blowdown stack without an MOC facility siting evaluation. When the stack geysered liquid hydrocarbons, the explosion crushed the unarmored trailers, causing all 15 fatalities.