Management of Change: Non-Initiated Change
We continue our discussion to do with Management of Change (MOC). Previous posts in this series are:
Types of Change
If change is to be managed properly, it is necessary to understand the types of change that are typically made on a facility — each will require its own response. Changes can be categorized as follows:
Initiated change;
Non-initiated change;
Temporary change;
Emergency change; and
Administrative and organizational change.
In this post we look at Non-Initiated Change.
Non-Initiated Change
Some changes are ‘non-initiated’, i.e., they are not the consequence of an explicit action. Corrosion is a common example of this type of change; a vessel or a pipe may be gradually losing wall thickness due to corrosion without anyone knowing until the item fails catastrophically.
Increasing production rates can also lead to non-initiated change; as management gradually sets ever higher target values, the facility, its equipment and its people are pushed to their limits: flows, temperatures and pressures are all increased. Even if no specific safe limit is exceeded, the increased severity of operating conditions could lead to a failure.
Non-initiated changes are difficult to control with the Management of Change program because no one knows about them until an it is too late. Instead, changes of this type are controlled by other elements of the risk management program such as asset integrity, process hazards analysis and incident investigation.
Non-initiated changes can be Overt or Covert.
An overt non-initiated change is one that is known about, and whose consequences can be mitigated before an accident actually takes place. For example, if a key variable such as a reactor temperature or a tank level is moving outside the safe range, but is being carefully monitored by an operator then the change is overt. There is time to propose a modification to the system so that appropriate action can be taken.
A covert change is one that is not anticipated, and that comes as a surprise. For example, if a vessel is gradually corroding and no one knew that the corrosion was taking place until the vessel failed catastrophically, then the change was covert. Covert changes can be particularly hazardous because there may be no warning that a catastrophic incident is about to happen until it ‘announces itself’ ¾ possibly in the form of a serious accident. Furthermore, it is difficult to put safeguards in place because this type of incident is fundamentally unpredictable.
Changes to passive safety systems such as the firewater and flare headers can lead to covert safety problems. As additional operating equipment is installed these safety systems can become overloaded. There are no indications that they have become overloaded until they are called upon to operate.
Some covert failures are not anticipated because they are unusual. For example, one chemical plant used a series of large, liquid-filled reactors. A noble metal compound catalyst, which was in solution, was fed continuously into the reactors. Over a period of years some of noble metal came out of solution, and slowly formed a gradually growing metal lining on the inside walls of the reactors. The process and economic consequences of this problem had been analyzed and accepted. However, no one had considered the civil and structural engineering implications of this uncontrolled change: the fact that the reactors were slowly getting heavier, and possibly overloading their foundations.
Covert change sometimes occurs in the form of a ripple effect through utility systems. If a facility has multiple operating areas, each of which is connected to a common utility system, each area may make properly controlled changes to its own operation, but may not realize that it is having a system effect. An example of a ripple effect change that can occur in a utility system is shown in the sketch.
Area 500 generates steam, which flows to the steam header. Area 200 imports steam from the header. The process in Area 500 is modified such that a more corrosive chemical is used. The change is reviewed with the Area 500 MOC system, and is approved. However, if a heat exchanger tube in Area 500 fails, the corrosive chemical could enter the steam header, whence it will flow into Area 200, possibly leading to serious equipment damage.
