management of change of chemical process control systems

MANAGEMENTOFCHANGEOFCHEMICALPROCESSCONTROLSYSTEMSPAPERH15MANAGEMENTOFCHANGEOFCHEMICALPROCESSCONTROLSYSTEMSABSTRACTMANAGEMENTOFCHANGEMOCHASBEENRECOMMENDEDTOBEANIMPORTANTPARTOFCHEMICALPROCESSSAFETYSINCETHEBRITISHINQUIRYBOARDSINVESTIGATIONREPORTOFTHE1974FLIXBOROUGHUKINCIDENT1THEUSAOCCUPATIONALSAFETYANDHEALTHADMINISTRATIONOSHAREGULATIONFORMALIZEDMOCASONEOFTHE14ELEMENTSOFITSPROCESSSAFETYMANAGEMENTREGULATIONIN19992HOWEVER,MOSTFACILITIESFOCUSEDTHEIRMOCPROGRAMONEQUIPMENTCHANGES,PARTICULARLYCHANGESTHATWOULDCHANGETHEPIDSOREQUIPMENTSPECIFICATIONSPROCEDURALCHANGES,ORGANIZATIONALCHANGESANDCOMPUTERCONTROLSYSTEMCHANGESARENOTUNIVERSALLYCONSIDEREDWITHINTHESCOPEOFTHEMOCPROGRAMEVENTHOUGHFORMALMOCISALSOAPARTOFTHEISO9000ANDISO14000GLOBALMANAGEMENTSTANDARDS,THENEEDFORCONTROLLINGCHANGESTOPLANTCOMPUTERSOFTWAREISNOTGENERALLYACKNOWLEDGEDSEVERALRECENTINCIDENTS,INWHICHADEGRADEDCONTROLSYSTEMHASBEENIDENTIFIEDASONEOFTHECONTRIBUTINGFACTORS,MOSTNOTABLYASALARMFLOODSORBYPASSEDSAFEGUARDS,HAVEPUTTHESPOTLIGHTONTHENEEDTOMAINTAINTHECONTROLSYSTEMEFFECTIVENESSTHEGAININGRECOGNITIONOFTHEFUNCTIONALSAFETYINSTRUMENTEDSYSTEMSTANDARDS,ISA8401ANDISO61511,WITHMOCASAPARTOFITSSAFETYLIFECYCLECONCEPT,HASHELPEDTHEABNORMALSITUATIONMANAGEMENTCONSORTIUM,THEWORKOFTHEBRITISHHEALTHANDSAFETYEXECUTIVEONALARMMANAGEMENTANDTHERECOMMENDATIONOFSCADASYSTEMASSESSMENTBYTHEUSAOFFICEPIPELINESAFETYAREAMONGTHEPOSITIVEINDICATORSTHATREGULATORSANDSAFETYPROFESSIONALSAREATTEMPTINGTOADDSOFTWARECHANGESTOTHEVERYIMPORTANTMOCPROGRAMKEYWORDSMANAGEMENTOFCHANGE,MOC,SCADA,DCS,SIS,OSHA,ABNORMALSITUATIONMANAGEMENT,ALARMMANAGEMENTINTRODUCTIONMANAGEMENTOFCHANGEMOCPROCEDURESWEREFIRSTFORMALIZEDINTHEFLEDGLINGNUCLEARPOWERINDUSTRYWEST,1992ANDQUICKLYSPREADTOTHEDEFENSEINDUSTRYMILSTD973SEVERALDIFFERENTNAMESWEREUSEDTODESCRIBEMOC,INCLUDINGCONCURRENTENGINEERING,PROCESSCHANGECONTROL,ANDCONFIGURATIONMANAGEMENTMOCPROCEDURESHAVERECEIVEDINCREASEDATTENTIONDUETOTHEINTRODUCTIONOFREQUIREMENTSWITHINTHENEWOSHAANDEPAPROCESSSAFETYMANAGEMENTREGULATIONSOSHA1992EPA,1998INTHEUSATHEMORERECENTISO9000QUALITYINITIATIVESISO9000HAVEPROVIDEDFURTHERSIGNIFICANCETOTHENEEDFORPROCESSCHANGECONTROLMANAGEMENTHOWEVER,MANYFIRMSAPPLIEDMOCONLYTOEQUIPMENTANDFIELDOPERATIONALPROCEDURECHANGESTHEINTENTOFALLMOCSTANDARDSANDREGULATIONSCLEARLYINCLUDESPROCESSCONTROLSYSTEMSMOCSPARKEDBYCATASTROPHICINCIDENTSABSENCEOFMANAGEMENTCONTROLOVERPROCESSCHANGESHASRESULTEDINSEVERALCATASTROPHICFAILURESONEOFTHEFIRSTCATASTROPHICINCIDENTSTOHAVEIDENTIFIEDMOCASAROOTCAUSEWASTHEFLIXBOROUGHACCIDENTIN1974THEUKROYALCOMMISSIONFLIXBOROUGH,1975RECOMMENDEDTHATCHEMICALPLANTSINSTITUTEMOCPROCEDURESTOAVOIDSUCHDEVASTATINGACCIDENTSALMOSTEVERYMAJORINCIDENTCANBELINKEDTOACHANGETHATWASNOTSUBJECTEDTOAPROPERSAFETYREVIEWASREQUIREDBYMOCSANDERS,1993KLETZ,1988FOLLOWINGTHEBHOPALINCIDENT,THEFORMATIONOFTHECENTERFORCHEMICALPROCESSSAFETYBYTHEAMERICANINSTITUTEOFCHEMICALENGINEERSAICHELEADEVENTUALLYTOTHEPUBLICATIONOFTHEMAJORPRINCIPLESOFPROCESSSAFETY,INCLUDINGMOCTHEAICHEDEFINITIONAICHE1992OFMOCISATEMPORARYORPERMANENTSUBSTITUTION,ALTERATION,REPLACEMENTNOTINKIND,MODIFICATIONBYADDITIONORDELETIONOFCRITICALPROCESSEQUIPMENT,APPLICABLECODES,PROCESSCONTROL,CATALYSTSORCHEMICALS,FEEDSTOCKS,OPERATINGLIMITS,MECHANICALPROCEDURES,ELECTRICALPROCEDURES,SAFETYPROCEDURES,EMERGENCYRESPONSEEQUIPMENTFROMTHEPRESENTCONFIGURATIONOFTHECRITICALPROCESSEQUIPMENT,PROCEDURES,OROPERATINGLIMITSINTHEAFTERMATHOFTHE1989PHILLIPSPOLYETHYLENEPLANTDISASTER,OSHAPUBLISHEDTHEPROCESSSAFETYMANAGEMENTREGULATIONWITHTHEFOLLOWINGEXCERPTDEFININGMOCIN29CFR1910119SECTIONLTHEEMPLOYERSHALLESTABLISHANDIMPLEMENTWRITTENPROCEDURESTOMANAGECHANGESEXCEPTFORREPLACEMENTSINKINDTOPROCESSCHEMICALS,TECHNOLOGY,EQUIPMENT,ANDPROCEDURESAND,CHANGESTOFACILITIESTHATAFFECTACOVEREDPROCESSTHEPROCEDURESSHALLASSURETHATTHEFOLLOWINGCONSIDERATIONSAREADDRESSEDPRIORTOANYCHANGEITHETECHNICALBASISFORTHEPROPOSEDCHANGEIIIMPACTOFCHANGEONSAFETYANDHEALTHIIIMODIFICATIONSTOOPERATINGPROCEDURESIVNECESSARYTIMEPERIODFORTHECHANGEANDVAUTHORIZATIONREQUIREMENTSFORTHEPROPOSEDCHANGEEMPLOYEESINVOLVEDINOPERATINGAPROCESSANDMAINTENANCECONTRACTEMPLOYEESWHOSEJOBTASKSWILLBEAFFECTEDBYACHANGEINTHEPROCESSSHALLBEINFORMEDOF,ANDTRAINEDIN,THECHANGEPRIORTOSTARTUPOFTHEPROCESSORAFFECTEDPARTOFTHEPROCESSIFACHANGECOVEREDBYTHISPARAGRAPHRESULTSINACHANGEINTHEPROCESSSAFETYINFORMATIONREQUIREDBYPARAGRAPHD,SUCHINFORMATIONSHALLBEUPDATEDACCORDINGLYIFACHANGECOVEREDBYTHISPARAGRAPHRESULTSINACHANGEINTHEOPERATINGPROCEDURESORPRACTICESREQUIREDBYPARAGRAPHF,SUCHPROCEDURESORPRACTICESSHALLBEUPDATEDACCORDINGLYTHETENETSOFQUALITYMANAGEMENTALSOCONTAINAMANAGEMENTELEMENTESSENTIALLYIDENTICALINPHILOSOPHYASTHEPROCESSSAFETYMOCSECTION88OFTHEISO9004ANSI/ASQCQ94ISO9000ISENTITLED“DESIGNCHANGECONTROLCONFIGURATIONMANAGEMENT”SECTION116ISENTITLED“PROCESSCHANGECONTROL”THEREFORE,THETOTALQUALITYMANAGEMENTINITIATIVEHASACHANGEMANAGEMENTREQUIREMENTEXTREMELYSIMILARTOTHEMOCPRINCIPLESDEFINEDHEREINTHEFIRSTSPECIFICMENTIONOFMOCCONCEPTSINTHEPETROLEUMPRODUCTIONSAFETYANDLOSSPREVENTIONLITERATUREWASTHEAPIRECOMMENDEDPRACTICE,MANAGEMENTOFPROCESSHAZARDSAPI1990THECULLENREPORTCULLEN1988RECOMMENDATIONSLEDTOBRITISHREGULATIONSINTHENORTHSEATHATALSOINCLUDEDMOCREQUIREMENTSMOCAPPLIESTOCONTROLSYSTEMSNOTETHATPARAGRAPH4OFTHEOSHAREGULATIONABOVELINKSMOCTO“PROCESSSAFETYINFORMATION”,WHICHINTURNMENTIONSSAFETYSYSTEMSANDCONTROLSYSTEMSHENCE,OSHAINCLUDESTHEENTIRECONTROLSYSTEMWITHINTHEJURISDICTIONOFPROCESSSAFETYREGULATIONSMANYOSHAOFFICIALINTERPRETATIONLETTERSALSOREINFORCEVIEWPOINTTHEAICHEDEFINITIONABOVECLEARLYDEFINESPROCESSCONTROLWITHINTHEAREASTOBEWITHINMOCCONTROLPROCEDURESTHESAFETYINSTRUMENTEDSYSTEMSSISSTANDARDS,SUCHASISA84ANDIEC61511AICHE1993ISA1996IEC61511DEFINEASAFETYLIFECYCLECONCEPTFORSAFETYCONTROLSYSTEMCOMPONENTSINWHICHMOCISHIGHLIGHTEDMANYOTHERRECENTLYUPDATEDORREVISEDSTANDARDSCROSSREFERENCETHENEEDFORMOCTHEEUROPEANATEXRULESONHAZARDOUSAREACLASSIFICATIONAREBUTONEEXAMPLETHEUSOFFICEOFPIPELINESAFETYISSUEDANADVISORYTHATSTRONGLYSUGGESTSPIPELINESCADASYSTEMSBESUBJECTEDTOMOCPROCEDURESTHISRECOMMENDATIONRESULTEDFROMTHEANALYSISOFTHEBILLINGHAMPIPELINECATASTROPHICACCIDENT,WHICHLISTEDREDUCEDCONTROLSYSTEMRESPONSETIMEASAROOTCAUSEOFTHEINCIDENTTHEREFORE,MOCMUSTBEAPPLIEDTOALLCHANGESINTHEPROCESSCONTROLSYSTEMELEMENTSOFPROCESSCONTROLSYSTEMSSOMEOFTHEMAJORELEMENTSOFATYPICALMODERNPROCESSCONTROLSYSTEMSINCLUDEHARDWAREFIELDINSTRUMENTATIONDATAHIGHWAYLOGICSOLVERSCOMPUTERS,ELECTRONICDEVICESPOWERSUPPLIESSOFTWAREOPERATINGSYSTEMDCS/SCVADA/PLCSYSTEMSOFTWAREAPPLICATIONSOFTWAREALARMSYSTEMAPPLYINGMOCTOHARDWARECHANGESISSIMILARTOTHEEQUIVALENTPRACTICESFORCHANGESTOOTHERPROCESSEQUIPMENTTHREEAREASHAVEPROVEDTOBEMOREDIFFICULTTOBRINGWITHINMOCJURISDICTIONCONFIGURATIONLIMITVALUESOPERATINGSYSTEMSCHANGESTOTHEPROCESSCONTROLCONFIGURATION,SUCHASADDINGALARMS,APPEARSTOBEABENIGNCHANGE,HOWEVER,THECUMULATIVEEFFECTOFADDINGTOOMANYALARMSCANCAUSEALARMFLOODSCHANGESTOLIMITVALUES,EVENTEMPORARYCHANGES,CANLEADTOSAFETYPROBLEMSSEVERALINCIDENTSHAVEBEENATTRIBUTEDTOTEMPORARYCHANGESTHATHAVENOTBEENRESTOREDTOTHEIRORIGINALINTERLOCKLIMITVALUESCHANGESTOOPERATINGSYSTEMSAREEVENMORECHALLENGING,SINCEMINORSOFTWAREPATCHES,LARGERSYSTEMUPGRADES,OREVENMAJORVERSIONUPGRADESAREPOSSIBLETHEONLYWAYTOBESURETHATNOIMPACTONTHECONTROLSYSTEMHASBEENMADEISTOCONDUCTANOTHERSITEACCEPTANCETESTPLANFORCONTROLSYSTEMSCHANGEWHILEPROCESSEQUIPMENTISTYPICALLYDESIGNEDFORA2030YEARPROJECTLIFE,SCADA,SISANDDCSSYSTEMSAREMORELIKELYTOBEREPLACEDORSERIOUSLYUPGRADEDONA10YEARCYCLEORLESSTHEREFORE,MAJORFUTURECHANGEOUTOFTHECONTROLSYSTEMMUSTALSOBECONSIDEREDINTHEORIGINALPROJECTPLANWHEREAS,FORWARDTHINKINGPROJECTDESIGNERSPLANNEDFORFUTURECHANGEOUTBYSPECIFYINGPOWERSUPPLIESWITHADDITIONALPARALLELLOADCAPABILITY,JUNCTIONBOXESWITHLARGESPARECAPACITY,PLCSWITHADDITIONALSPARECONTACTCAPABILITY,ANDTELEMETRYWITHADDITIONALFREQUENCYPAIRS,THEEVOLVINGEXPANSIONOFOPERATIONSOVERTHEYEARSSOMETIMESSCAVENGESTHECHANGEOUTCAPABILITYIFTHEORIGINALPROJECTDOCUMENTATIONHASIDENTIFIEDTHESPARECAPACITYASRESERVEDFORFUTURECHANGEOUT,THENTHEMANAGEMENTOFCHANGESYSTEMSHOULDKEEPOPERATIONSMANAGEMENTAWAREOFENCROACHMENTSONTHENEXTCONTROLSYSTEMUPGRADEPROJECTDIGITALBABELINHISLETTERTOTHEEDITOROFTHEISAINTECHMONTHLYMAGAZINE,INTERNATIONALLYNOTEDCONTROLSYSTEMAUTHORBELALIPTAKLIPTAK,2004WARNEDOFTHESAFETYIMPLICATIONSOFTHECHAOTICSTATEOFTHECURRENTLY8DIFFERENTDIGITALDATAHIGHWAYSWITHTHECONCOMITANTPROBLEMSOFMESSAGETRANSLATIONHEALSODEPLOREDTHECONTROLSYSTEMVENDORPRACTICEOFNOTINCLUDINGTESTEDWORKINGCONTROLSOFTWARE,LEAVINGTHEUSERSTOSELECTAMONGMANYINDEPENDENTSOFTWARESUPPLIERSAPPLYINGMOCLESSONSLEARNEDTOPROCESSCONTROLTHEMOSTIMPORTANTLESSONLEARNEDINAPPLYINGMOCPROCEDURESINTHEEARLIEREXPERIENCESWASTOCATEGORIZEFACILITIESINTOSAFETYCRITICALANDNONSAFETYCRITICALSYSTEMSIFNONSAFETYCRITICALEQUIPMENTARESUBJECTEDTOSAFETYREVIEWATTHELEVELOFDETAILREQUIREDBYSAFETYCRITICALITEMS,THENTHEMOCSYSTEMBOGSDOWNINITSOWNPAPERWORKWHILETHISMAYWORKFORPROCESSAREASTHATARENOTSAFETYCRITICALORINSTRUMENTLOOPSTHATARECONTROLLINGNONHAZARDOUSSYSTEMS,THEREMAYBEMANYCONTROLSUBSYSTEMSDATAHIGHWAY,OPERATINGSYSTEMS,ETCWHICHCOMINGLESAFETYANDNONSAFETYCRITICALSYSTEMSITISINTERESTINGTONOTETHATEACHRECOMMENDEDPRACTICEORREGULATIONDELEGATESTHELEVELOFSAFETYREVIEWDETAILTOTHEAPPLICABLEFACILITYMANAGEMENTWHILESOMEOFTHEMANAGEMENTPRACTICESESPOUSEDINTHERECENTMOCSTANDARDSHAVELONGBEENPRACTICEDBYMANYFIRMS,ITISTHEFORMALIZATIONOFMOCANDTHEABILITYTOAUDITTHEPROGRAMTHATISRELATIVELYNEWTOTHEPETROLEUMANDCHEMICALINDUSTRYTHISTRANSLATESINTOPAPERWORK/DOCUMENTATIONOFCHANGESAPPLIEDTOTHECONTROLSYSTEMOPERATORSANDENGINEERSCONCLUSIONSMANAGEMENTOFCHANGEISREQUIREDTOMAINTAINTHESAFETYINTEGRITYOFTHECHEMICALPROCESSFACILITYADMINISTRATIONOFACOSTEFFECTIVEMANAGEMENTOFCHANGEPROGRAMREQUIRESCAREFULPLANNINGSINCETHEBRUNTOFMANAGEMENTOFCHANGEOPERATIONALEFFECTIVENESSISDEPENDENTONTHEFIRSTANDSECONDLINEPROCESSSUPERVISORS,ASIMPLEMANAGEMENTOFCHANGEPROCEDURALWORKFLOWANDADOCUMENTMANAGEMENTSYSTEMAREPRACTICALNECESSITIESFURTHERMORE,VARIOUSSCREENINGTECHNIQUESHAVEBEENUSEDTOOPTIMIZESCARCETECHNICALRESOURCES,PARTICULARLYBYALLOWINGSMALLHAZARD/LOWRISKCHANGESTOBEANALYZEDANDAUTHORIZEDWITHOUTTHENEEDFORUNNECESSARYREDTAPEFREQUENTVERIFICATIONOFACTUALPRACTICEISPARTICULARLYCRITICALUNTILMANAGEMENTOFCHANGEBECOMESPARTOFTHECORPORATECULTUREACKNOWLEDGMENTSTHEAUTHORSWOULDLIKETOTHANKOURCOLLEAGUESFORTHEMANYDISCUSSIONSANDPROJECTS,WHICHASSISTEDINTHEEVOLUTIONOFTHEIDEASANDCONCEPTSPRESENTEDHEREINBIBLIOGRAPHYPROCESSSAFETYMANAGEMENTOFHIGHLYHAZARDOUSCHEMICALEXPLOSIVESANDBLASTINGAGENTSFINALRULE,29CFRPART1910,DEPARTMENTOFLABOR,OCCUPATIONALSAFETYANDHEALTHADMINISTRATION,WASHINGTON,DC,FEBRUARY24,1992,FEDERALREGISTER,VOLUME57,NO36THEFLIXBOROUGHCYCLOHEXANEDISASTER,HERMAJESTYSSTATIONERYOFFICE,LONDON,1975TAKLETZ,PLANTOPERATIONSPROGRESS,VOL5,3,AMERICANINSTITUTEOFCHEMICALENGINEERS,JULY1986,P136PLANTGUIDELINESFORTECHNICALMANAGEMENTOFCHEMICALPROCESSSAFETY,CENTERFORCHEMICALPROCESSSAFETYOFTHEAMERICANINSTITUTEOFCHEMICALENGINEERS,NEWYORK,1992ISO9000,QUALITYMANAGEMENTOFINDUSTRIALFACILITIES,LONDON,UK,LATESTEDITIONREVIEWSAFETYQUESTIONSINTHENUCLEARPOWERINDUSTRY,10CFR5059,DEPARTMENTOFENERGY,NUCLEARREGULATORYCOMMISSION,WASHINGTON,DCMILITARYSTANDARD973,CONFIGURATIONMANAGEMENTATGOVERNMENTFACILITIES,MILSTD973,DEPARTMENTOFDEFENSE,WASHINGTON,DCRISKMANAGEMENTPROGRAMSFORCHEMICALACCIDENTALRELEASEPREVENTION,TITLE40CFRPART68SECTION6836PREVENTIONPROGRAMMANAGEMENTOFCHANGE,ENVIRONMENTALPROTECTIONADMINISTRATION,WASHINGTON,DCRECOMMENDEDPRACTICESFORDEVELOPMENTOFASAFETYANDENVIRONMENTALPROGRAMFOROUTERCONTINENTALSHELFOCSOPERATIONSANDFACILITIES,APIRECOMMENDEDPRACTICE75,AMERICANPETROLEUMINSTITUTE,WASHINGTONDCLATESTE