Contents
Most process incidents do not start with a bad design. They start with a good design that was changed. A faster addition to gain capacity, a cheaper solvent, a temporary pipe to keep running during a repair: each looks small, and each can remove a safeguard that someone added for a reason.
Management of change, or MOC, is the procedure that catches this. Before a change is made, someone who understands the design checks what it affects. MOC is an element of process safety management standards, including CSA Z767 in Canada and the OSHA process safety management rule in the United States.
Post 1 and Post 2 built up the safeguards on one reactor and its feed heater. This post shows how quickly a change could undo them, and how a small plant can run MOC without a large safety department.
What counts as a change
The key test is whether the replacement is in kind: identical to what it replaces, or a different item that meets the same specification. A replacement in kind needs no MOC. Everything else does.
Table 1. Change or replacement in kind?
| Situation | Needs MOC? | Why |
|---|---|---|
| Gasket replaced with the same specification | No | Replacement in kind |
| Pump replaced with the same model | No | Replacement in kind |
| Pump replaced with a larger model | Yes | Higher flow can exceed what the reactor can cool |
| Addition time shortened | Yes | Changes the heat release rate and the accumulation |
| Solvent from a new supplier, same specification | Usually no | Check the specification covers the properties that matter |
| Different solvent | Yes | Changes the boiling point, MTT in Post 1 |
| Alarm or trip set point changed | Yes | The safeguard no longer acts where the HAZOP assumed |
| Trip bypassed to keep running | Yes | Removes a safeguard, even if only for a shift |
| Temporary hose or pipe | Yes | Temporary changes need the same review, plus an end date |
Worked example 1: a faster addition
The plant from the scale-up series runs 1,000 batches a year on an eight-hour cycle that includes a three-hour addition. Sales want more product. Cutting the addition to two hours shortens the cycle to 7 hours and gives about 1,143 batches a year, 14% more output without new equipment.
The MOC review starts from the design numbers. The reaction releases 1.5 GJ per batch. Spread over the addition time, that gives the average heat the jacket must remove.
Table 2. What the review finds for a two-hour addition
| Check | Three hours (current) | Two hours (proposed) | Source |
|---|---|---|---|
| Average heat release | 139 kW | 208 kW | 1.5 GJ over the addition time |
| Jacket capacity | 154 kW | 154 kW | Scale-up Part 1 |
| Temperature control | Holds 60 °C | Batch temperature rises | Heat release above capacity |
| Accumulation | 20% | Higher; needs new calorimetry | Faster feed, same reaction rate |
| High flow trip (HAZOP action 7) | Set for three hours | Would have to be raised | Removes a safeguard |
The change is not safe as proposed. The review does not have to end with a refusal, though. It can point to options that are: a larger cooling capacity, a lower coolant temperature, or a second reactor. Each of those is a change with its own MOC.
Worked example 2: a cheaper solvent
Purchasing finds a solvent that does the same job at a lower price, but it boils at 95 °C instead of 110 °C. The process chemistry is unchanged.
In Post 1, the boiling point is MTT. At normal accumulation the MTSR is 75 °C, still below 95 °C. But the margin to boiling falls from 35 K to 20 K, and the accumulation at which a cooling failure would reach boiling drops from 67% to 47%. A cold-feed event, the case found in Post 2, now reaches boiling sooner. The condenser, the vent and the solvent recovery design all assumed the old boiling point.
Nothing in this change looks like engineering, which is why it is easy to miss. That is the case for routing purchasing changes to raw materials through the MOC screen.
The MOC procedure
A small plant does not need a HAZOP for every change. Scale the review to the risk.
Table 3. Review level by type of change
| Type of change | Example | Review |
|---|---|---|
| Low risk | A new instrument of a different make with the same range and function | Checklist, signed by the process engineer |
| Medium risk | New alarm set point, different raw material supplier | "What if" review with an engineer and an operator |
| High risk | Faster addition, new solvent, bypass of a trip | HAZOP of the affected nodes, approved by the plant manager |
A one-page MOC form
Table 4. Fields on a one-page MOC form
| Field | What to record |
|---|---|
| Description | What will change, where, and why |
| Permanent or temporary | For a temporary change, the date it must be removed |
| Screen result | Replacement in kind, or the risk level for review |
| Effects checked | Process conditions, safeguards, relief, materials, operating procedures, environment |
| Review and findings | Who reviewed it, the method used and the actions |
| Approval | Name, role and date |
| Documents to update | P&IDs, procedures, alarm and trip lists, training records |
| Pre-start-up check | Installed as approved, people trained, documents updated |
| Closed | Name and date |
Five ways MOC fails in practice
- Temporary becomes permanent. A temporary change has no end date, so it is never reviewed again.
- Small changes add up. Each change passes on its own, and together they remove the margin. Review the history of the unit, not only the latest request.
- Drawings fall behind. The plant no longer matches the P&ID, and the next HAZOP studies a plant that does not exist.
- Purchasing and staffing changes skip the screen. A new supplier or a reduced crew can change the hazard as much as new pipework.
- The operators are not told. A change is only complete when the people running the plant know what is different.
Takeaway. Screen every change, and scale the review to the risk. In the example, a two-hour addition would add 14% capacity but push the heat release to 208 kW against a jacket that can remove 154 kW.
The reaction, temperatures and equipment in this series are an illustrative example. The calculations are screening estimates. They do not replace calorimetry testing, a formal hazard study or a design by a qualified engineer.
