WorkflowHSE, Process Safety & OT Security

Management of Change

Management of change software that reads a plant change outward, so the process safety engineer sees what it reaches before the checklist.

See the demo Book a demo

Follow one reboiler change from the read to Rev B ↓

The problem

A management of change form routes, and nobody reads across the records

A reviewer gets the form and a checklist. Which hazard scenarios, relief cases, alarm settings, procedures and training the change reaches is left for each person to dig out alone, and one item is easy to miss.

The hazard that matters usually sits in an assumption. A scenario written when the loop had no valves still reads that way after valves go in, and nobody searches for a sentence they do not know exists.

Some changes never get a record at all: a bypass, an alarm set point, an inspection interval, a set of thickness points. Temporary changes go in with no firm end date, or run past the one they had.

Built forProcess safety engineersProcess engineersRelief engineersOperations superintendentsInternal auditors

The Problem Today

Change forms route for signature, while reviewers hunt alone for what each change touches in hazard and relief files.

49%: of offshore audits listed a change gap in one regulator's review published
5: things the rule says must be addressed before a covered change published

Searched by hand today

Hazards
Relief
Drawings
Procedures

Hidden assumptionsA line in an old study quietly stops being true
Temporary changes stayTime limits go undefined or get ignored

The Solution

Read from the change outwardHazard studies, relief files, drawings, alarms, procedures and training
Rings show what it reachesEach item touched on one picture, with its source page
Undone assumptions firstItems that rely on what the change takes away rise to the top
Reviewers by what it touchesThe people who own those records review it, instead of a fixed list

Built-in controls

Agents never say a change is safe
Owner, checker and approver: three people
What agents could not check blocks the step

What You Get

The relief question reaches the right engineer while the change is still a drawing.

Evidence without a binderEach step and reason exports as one file
Temporary changes on a clockAgents warn before the end date; only people extend
Bulk rulings you can defendLike-for-like work packs ruled from an opened sample, signed twice

One change, record by record

A management of change for two reboiler valves, read before the checklist

A process engineer wants block valves on one of the debutanizer's two reboilers, so it can be cleaned while the other keeps the column running. This is the management of change process on that request, screen by screen.

demoRefinery, staff and numbers here are all sample data.

0107:12
Rev A read in 4 min 12 s: 41 documents, 2,318 pages
Process safety engineer
The design package came out last week, so the agents read Rev A this morning. A plan comes first, then the hazard study, the relief file, drawings and alarms, procedures and training. The relief line turns amber as it lands. The last line hands the change to her, since no agent can approve or hold it.
02After the read
21 items touched, and 7 rest on what the change undoes
Process safety engineer
Six sectors spread from the change, and three rings say how far out each item sits. Seven are amber and four are dashed because they could not be checked; the panel lists the amber ones first, each with its page. Before she answers a single checklist question, she knows where to start.
03First item
Page 4 of the relief file: RV-2214 is the only device on the circuit
Process safety engineer
She opens the relief file at the page the agent read. The highlighted line says RV-2214 is the only relief device on this circuit, set at 215 psig, with no isolation between the protected equipment and the device. The new valves would be exactly that isolation. Her confirm and not-touched buttons stay locked until she has opened the page herself.
04Second item
Scenario 8.03 still says there are no valves in the reboiler loop
Process safety engineer
The hazard study credits RV-2214 for a blocked reboiler outlet with steam on, and records that the loop has no valves. That sentence stays true in the study after the valves go in, and nobody searches for a line they do not know is there. Scenarios 8.07 and 8.11 lean on the same open path, and each waits for her written conclusion.
05Same morning
A hold for one stated reason: a relief path is affected
Process safety engineer
She approves nothing and rejects nothing yet. She holds the change, picks the reason, and adds a relief review by the relief engineer on a 10 working day clock. Reviews, approval and hand-off now wait; only the work that settles the hold goes on. The owner cannot hold, check or approve his own change, so the call is hers.
06The next week
Three relief records opened, one path traced, nothing sized
Relief systems engineer
He has to open all three relief records himself before he can rule. The trace runs from the reboiler's process side through the new 12-inch valve and the vapor return to C-2205 and RV-2214, and the agent says it found that one path and sized nothing. His ruling: E-2209A needs its own relief valve, resting on page 4, with his reason.
07The day after
Rev A can no longer be approved, held or not
Process safety engineer
She opens the same three records before her agreement can count, then agrees with the ruling. His reason reached her word for word, flagged as not compared, because a box cannot judge whether a sentence is true; her reading is the check. Two banners now sit on the change: her hold, and the checked ruling, which says the owner must issue Rev B.
08Rev B issued
Rev B adds RV-2221, spades and bleed points, and 25 items wait again
Process engineer, change owner
The owner issues Rev B with relief valve RV-2221, and bleed points and spade positions on both lines. A second read finds 25 items touched, with new ones for the spades, the flare load and a test plan. Those 7 flagged assumptions stay first. Open questions go back too, since any answer was about the older design.
09The catch
Caught on a drawing, 315 days before installation
Process safety engineer
Rev A sits beside Rev B: the reboiler's only relief path ran through the new valves, and now it has a valve of its own. Seven assumptions found, one relief valve drawn in but not sized or approved, no valve bought. Still with people are 25 items, the hazard review, the relief sizing and the approver. Nothing on this change is approved.

Four lines in the records that the new valves quietly make untrue

Each is a sentence in a study or relief file, found by reading outward.

Scenario 8.03 credits RV-2214 through an open loop

Steam on, outlet blocked, RV-2214 as the safeguard, and no valves in the reboiler loop.

RV-2214 is the only device on the circuit

It is set at 215 psig at the top of C-2205. E-2209A has none of its own, and PAH-2215 alarms at 190 psig, below that set pressure.

Steam at 600 psig against a 300 psig process side

The internal failure case relieves through the vapor return, the line the new 12-inch valve sits on.

Scenario 8.14 assumes the loop is shut down

Blinding was studied with the column down. Cleaning one reboiler while the other runs is not covered.

demoSample data, from the working solution.

Rev A and Rev B of the reboiler change, side by side

The same change before and after the relief ruling.

On the record	Rev A, as raised	Rev B, after the ruling
Items touched	21	25
Could not check	4	4, back with a person
Nodes on the ripple	25	29
Relief for E-2209A	Only through the new valves, to RV-2214	Its own valve, RV-2221, not yet sized
Isolation for cleaning	An 8-inch valve on the inlet, a 12-inch on the vapor return	Bleed points and spade positions on both lines
Where it stands	Cannot be approved against its records	On hold, with nothing approved

demoSample data, from the working solution. No valve has been bought. Relief sizing, the flare study owner's answer and the hazard review are still owed.

Around the change

Six more management of change process safety screens from the same refinery

The change log, the review list, the clocks and the approver's desk. Select a screen to see it full size.

Open change list: 642 open, counts by stage, 47 past due, each change with its due date — **Open changes**642 open by stage and 47 past due, each with whoever has it next.

Table of touched items: hazard scenarios, relief records, alarms and drawings with source pages — **What it touches, as rows**The same items as rows, with source page, the agent's sample confidence and status.

MOC review screen: what stops approval, and six reviews chosen by what the change touches — **What stops approval**Reviewers picked by what the change touches, under a plain list of what still blocks approval.

Raise screen: a temporary hose described in plain words, beside a drafted change record — **Raising a change**The owner says it in plain words; the agent asks for the area and reason and drafts the record. Submitting is his.

Temporary MOC list: emergency changes on a 72-hour clock, then temporary changes by end date — **Temporary and emergency clocks**126 temporary changes open, 3 past their date and on hold. Emergencies get a full review within 72 hours.

Approval screen: five considerations to open, with five left for the superintendent — **The approver's own five**Approval counts only the superintendent's own opens of the five considerations.

demoSample data, from the working solution.

Who holds, who rules on relief, and who approves a plant change

Owner, checker and approver are three different people on each change, and an agent signs nothing.

Process engineer, change owner

Sees: What his change reaches, ring by ring, and what the agents could not check
Signs: Raises and revises the change; cannot hold, check or approve his own

Process safety engineer

Sees: The amber items first, each with the page it rests on
Signs: Rules it a change, holds it, checks the relief ruling and records the hazard review

Relief systems engineer

Sees: The relief records he opened himself, and the traced path
Signs: The relief ruling and the sizing basis; nobody else answers a relief record

Operations superintendent

Sees: The five considerations, built only from what people recorded
Signs: Approves, or sends it back to review, after opening each consideration herself

Internal auditor

Sees: Who decided, when, and what they had open at the time
Signs: Nothing; reads the trail and exports the evidence file

The agents

One reader per kind of record, and none of them has a vote

Each hands what it found to a named person.

Change intake

Asks the owner in plain words and drafts the five things the record must cover.

Never submits a change for a person
Never says a change is safe

Change screener

Compares a request with the design specification and proposes replacement in kind, a change, or cannot tell.

Never rules on a request

Hazard reader

Finds the scenarios and safeguards a change touches, and flags those that assume what it undoes.

Never calls a change safe or unsafe

Relief reader

Traces relief paths and relief cases from the changed equipment to its devices.

Never sizes a device
Never rules on relief

Drawing and alarm reader

Finds the drawings, lines, data sheets and alarm settings a change reaches.

Never changes a setting
Never drops an unreadable record from the list

Procedure and training reader

Finds procedure steps and training modules, contract crews included.

Never edits a procedure
Never marks training done

Reviewer picker

Proposes reviewers by what the change touches, under the site rule, and tracks their clocks.

Never signs for a reviewer

Temporary clock

Watches the end dates of temporary changes and warns ahead of each date and again at the end.

Never extends a temporary change

Calls on a plant change that carry a person's name

Each of these carries a signature on the change record.

Whether a change is safeNo agent says it. The agents list what a change reaches and what they could not check, with the pages behind each.

Relief rulings and sizingOnly the relief engineer answers relief records and signs a sizing basis. No set pressure is offered by the agents or the assistant.

Holds and their releaseThe checker or the superintendent holds. Release takes a second person who reads the exact words and opens the record.

Marking an item not touchedIt takes a written reason and a second name, who opens the page and reads the words before it stands.

Extending a temporary changeThe clock warns and stops there. One extension, asked by the owner, re-read by the checker and signed by the superintendent.

Questions about management of change software, from the process safety desk

What is management of change software for process safety?

Management of change software holds each plant change from request to close. This one also reads the change against the hazard study, relief file, drawings, alarms, procedures and training, and draws what it reaches, each item with its page. The owner raises, the process safety engineer checks and can hold, the relief engineer rules on relief, and the superintendent approves.

What must a management of change procedure cover before a change?

Five things: the technical basis, the impact on safety and health, changes to operating procedures, the time period, and who authorizes it. The draft comes from the owner's plain words; the approver's copy reports only what people recorded.

How is a replacement in kind told apart from a change?

A replacement in kind meets the design specification. The screener compares the two and proposes in kind, a change, or cannot tell. The ruling is a person's, with a reason that a second person reads after opening the request, and a line that differs from the specification cannot be ruled in kind.

How does it hold a temporary MOC to its end date?

Each temporary change runs on its own clock. The clock warns ahead of the date and at the end, and a change past its date goes on hold. One extension is allowed, asked and checked by two different people and signed by the superintendent; beyond that it needs a new record.

Can the agents tell us a change is safe?

No. They list what the change reaches, what rests on something it undoes, and what they could not check. They cannot approve, hold, release or rule, and relief or protection questions go to a named person.

What happens when the owner issues a revision?

The agents read the new revision, and what it changed goes back to a person, including answers given about the older design. A hazard review held on the old revision does not cover the new one.

What does an internal auditor get?

A trail nobody can edit, listing who or what acted, when, and why, plus an evidence file that holds the state of the record at the moment it was exported.

HSE, Process Safety & OT Security

Bring one change
your reviewers already signed.

We will read it against your own hazard study and relief file and show what it reaches.

Book a demo Browse solutions

Management of Change

A management of change form routes, and nobody reads across the records

The Problem Today

The Solution

What You Get

A management of change for two reboiler valves, read before the checklist

Rev A read in 4 min 12 s: 41 documents, 2,318 pages

21 items touched, and 7 rest on what the change undoes

Page 4 of the relief file: RV-2214 is the only device on the circuit

Scenario 8.03 still says there are no valves in the reboiler loop

A hold for one stated reason: a relief path is affected

Three relief records opened, one path traced, nothing sized

Rev A can no longer be approved, held or not

Rev B adds RV-2221, spades and bleed points, and 25 items wait again

Caught on a drawing, 315 days before installation