The replacement chemical-transfer pump bolts to the existing base, the coupling lines up, and production wants it running before the next shift. There's one complication: the replacement has higher capacity. The maintenance planner sees a straightforward installation; the process engineer sees a possible change in minimum flow, seal loading, and overpressure exposure.
A management of change system is the written control that decides whether that swap, or a similar reliability modification, may proceed. Its value isn't the signature page. Its value is ensuring that the installed equipment, operating limits, maintenance instructions, and condition-monitoring results agree.
Table of Contents
- Which Plant Changes Need a Formal MOC
- How to Run Each Change From Request to Closeout
- How to Rank Risk and Set the Approval Level
- How to Connect MOC Records to the CMMS
- Failure Modes That Let Bad Changes Through
- Industry Checklist for Process-Plant Reliability Teams
- Scorecard and Self-Check That Prove Field Control
Which Plant Changes Need a Formal MOC
Under OSHA's Process Safety Management compliance directive, MOC is required before implementing changes to process chemicals, technology, equipment, procedures, or facilities affecting a process covered by 29 CFR 1910.119, except replacements in kind, which retain the same design and specifications.
That distinction matters under downtime pressure. Physical interchangeability doesn't establish technical equivalence. A pump can fit the foundation while changing the conditions that keep the process safe.
Screen the work before scheduling it
The following screen applies a conservative plant reliability boundary. For organizational, software, and maintenance changes, the trigger is their effect on the covered process, its safeguards, or work execution.
MOC screen versus replacement in kind
| Change | Formal MOC | Why | Plant example |
|---|---|---|---|
| Same-spec seal kit | No, replacement in kind | Form, fit, function, materials, and performance unchanged | Original-equipment mechanical seal, same faces and alloy |
| Higher-capacity pump | Yes | Minimum flow, seal load, and relief demand change | Chemical-transfer centrifugal pump on the same base |
| Alloy or material change | Yes | Corrosion, seal compatibility, or strength changes | Impeller upgraded to a different alloy |
| Lubricant substitution | Yes | Film thickness and additive package change | Pump-drive gearbox oil changed from mineral to synthetic grade |
| Alarm, trip, or operating limit | Yes | Safeguard or validated envelope moves | High-vibration alarm raised to stop nuisance trips |
| VFD retrofit | Yes | Speed, cooling, bypass, and trip logic change | Fixed-speed pump motor converted to a variable-frequency drive |
| Temporary bypass or interim repair | Yes | A safeguard or design feature is removed temporarily | Seal-flush low-flow interlock bypassed for a weekend |
| Firmware, DCS, or CMMS logic | Yes | Work generation or protective logic can disappear | Preventive-maintenance work order for a hose no longer auto-generates |
| Staffing, rounds, or PM interval | Yes | Organizational or inspection change | Critical-pump rounds cut from every shift to daily |
A variable-frequency drive (VFD) controls motor speed by changing electrical frequency. A distributed control system (DCS) manages process controls; a computerized maintenance management system (CMMS) manages asset records and maintenance work. Preventive maintenance (PM) means scheduled work intended to prevent failure or detect deterioration.
Define what the record must establish
The MOC record needs a technical basis, safety and health effect, operating-procedure changes, temporary duration where applicable, and authorization requirements. These fields should explain an engineering decision, not merely describe the purchase.
For the higher-capacity pump, engineering must evaluate the minimum-flow shift, seal loading, relief demand, and overpressure risk. Minimum flow is the lowest flow at which the pump can operate acceptably; relief demand is the discharge capacity needed from overpressure protection.
Before work-order release, the package should contain revised pump curves, piping and instrumentation diagrams (P&IDs), alarm settings, inspection plans, spare-parts records, and asset criticality. Criticality ranks the consequence of equipment failure.
Release rule: An in-scope work-list row stays on hold until an MOC number exists.
How to Run Each Change From Request to Closeout
A coordinator needs a single path with clear hold points, not separate engineering and maintenance approval trails. The Center for Chemical Process Safety's MOC guidance emphasizes risk evaluation, communication, training, document updates, and disciplined treatment of emergency changes.
Follow a controlled authorization path
Screen the proposal. Compare planned modifications and operational deviations with the trigger list. Remove equivalent replacements from the formal MOC path, but retain the screening rationale. An existing approval only covers work within its documented scope.
Define the technical basis, scope, affected asset identifiers, temporary or permanent status, and duration. The description must distinguish the proposed state from the existing state clearly enough for a different engineer to verify it.
Match the hazard review to consequence. A checklist can suit a narrow procedural edit that doesn't alter limits. Failure modes and effects analysis (FMEA), which examines how components fail and the resulting effects, suits equipment-duty changes. For the pump rerate, the team should examine blocked discharge, low-flow operation, and seal failure. Hazard and operability analysis (HAZOP) examines process deviations; layer of protection analysis (LOPA) evaluates independent safeguards; fault-tree analysis traces combinations of failures leading to an unwanted event.
Specify safeguards and acceptance requirements. Include interlocks, which automatically prevent unsafe actions; alarms; pressure-relief capacity; operating limits; inspection requirements; and contingency actions. Reviewers must identify shifts in seal compatibility, bearing load, lubrication, vibration limits, and protective settings rather than assuming existing protections remain adequate.
Obtain authorization before installation. The approval level follows consequence and reversibility. The covered-process minimums include the technical basis, safety and health impacts, procedure changes, timing, and authorization before implementation. A purchase approval isn't installation authorization.
Revise procedures, drawings, process-safety information, maintenance plans, spare-parts data, and CMMS records. For the pump, the approved curve must agree with the selected impeller, driver, operating range, and maintenance job plan. Linked work-order management keeps these prerequisites attached to the installation rather than buried in an engineering folder.
Train affected personnel before startup. Operators, maintainers, contractors, and emergency personnel need the information relevant to their actions. A changed task needs instruction and a practical check of understanding, not just an emailed drawing.
Complete the pre-startup review. The reviewer checks completed prerequisites, test evidence, outstanding actions, and readiness for operation. Any unresolved startup-critical item blocks release.
Verify and close. Field personnel confirm the installation, documentation, and follow-up actions. Temporary controls must be removed or formally extended through an authorized review. For the chemical-transfer pump, the installed equipment must match the revised curve, P&ID, and job plan, or the MOC stays open.
Pilot the workflow before expanding it
A practical rollout starts with a critical pump service and reviewer training on the trigger list. As a proposed rollout gate, expansion to other critical rotating equipment follows two consecutive MOCs closed without overdue temporary changes.
That gate tests whether the workflow can reach the field. Expanding an untested form across the plant only spreads its omissions.
How to Rank Risk and Set the Approval Level
For a pump change made under outage pressure, the approval path should turn on the consequence of failure and the difficulty of reversing the work. Signature count tells you little; the authorizer's competence and authority, and the quality of the review, determine whether the risk is understood.
Use the plant's process-specific requirements alongside this decision framework. A risk-priority-number method can help rank equipment issues by severity, occurrence, and detectability. Keep severe consequences visible rather than allowing an averaged or multiplied score to obscure them.
Match authority to consequence
Risk class and who may authorize
| Risk class | Typical change | Review method | Authorizer | Required before startup |
|---|---|---|---|---|
| Low | Procedure wording that doesn't change a limit or failure mode | Checklist screen | Area supervisor | Crew informed |
| Medium | Lubricant, spare specification, or PM-interval change | FMEA or simplified hazard review | Reliability lead and operations | Training done and CMMS plan updated |
| High | Pump rerate, relief, interlock, SIF, or control strategy | HAZOP, LOPA, or fault tree | Plant manager or process-safety authority | Pre-startup review and updated process-safety information |
| Emergency or temporary | Bypass, interim repair, or deviation under outage pressure | Same method as underlying risk, short form | Duty manager, then formal close by risk-class authorizer | Named expiration owner, removal date, and restart check |
A safety-instrumented function (SIF) uses sensors, logic, and final devices to move a process to a safe state. Changes to these functions call for specialist review, even when the physical work is small.
Make temporary changes expire deliberately
OSHA's process-safety guidance on managing change covers duration, technical basis, safety and health impacts, authorization, affected procedures, inspection and testing, training, and pre-startup checks. A temporary change needs a clear end point and an accountable owner.
For a proposed weekend seal-flush interlock bypass, name the operations supervisor as expiration owner and record the removal date and maximum permitted duration. Define what operators will monitor, such as flush flow, pressure, seal leakage, and bearing condition, and set stop criteria that require shutdown or escalation. Before normal operation resumes, function-test the interlock.
The risk review must determine whether operation during the bypass is acceptable and specify the conditions for stopping. An overdue alert should reach both the owner and the risk-class authorizer before the temporary arrangement becomes routine. A workflow automation agency can help implement cross-system alerts; the plant retains engineering authority.
A short emergency form can reduce administrative delay while preserving the technical review required by the risk. Final reconciliation must align the P&ID, CMMS asset record, spare-parts data, and operating procedure with the installed configuration. Classify the change by consequence, then carry its controls into field execution and condition monitoring so the plant can assess whether the change improved reliability.
How to Connect MOC Records to the CMMS
The MOC is finished only when work execution changes. A technician opening the next maintenance order should receive the approved configuration without needing to find the engineer who authorized it.
An analysis of 2,596 findings from 243 audits identified incomplete scope, particularly infrastructure and equipment changes, and delayed implementation as recurring weaknesses; 41% of process-safety findings in that set were major, as summarized in the audit evidence accompanying OSHA's process-safety management resource. Those figures describe audit findings, not the failure probability of an individual plant.
Establish the VFD retrofit baseline
For the chemical-transfer pump's VFD retrofit, baseline measurements should include vibration, infrared temperature, oil condition, and motor-current signature. Motor-current signature analysis examines current patterns for signs of electrical or mechanical problems; infrared thermography identifies surface-temperature patterns.
Measurements need operating context: flow, suction and discharge pressure, motor load, and speed. Comparing loaded fixed-speed operation with an unloaded variable-speed run would produce a misleading reliability conclusion.
Before installation, engineering should establish acceptance limits for overall vibration, bearing temperature, minimum speed, and motor cooling. The MOC must also describe acceleration time, bypass operation, trip logic, and restart behavior. Limits should come from the equipment design and validated operating requirements, not generic numbers copied into every job.
Give each action a controlled destination
| Approved action | Record or work object | Evidence of completion |
|---|---|---|
| Change motor and drive configuration | CMMS asset record | Installed model and approved parameter revision |
| Revise maintainable components | Bill of materials, the asset's parts list | Correct bearings, cooling components, and spares |
| Change maintenance instructions | Job plan | Applicable lubrication specification and VFD parameters |
| Add operating-condition checks | Condition-monitoring route | Measurement points, operating state, and acceptance limits |
| Revise alarms and permissives | Linked alarm-rationalization and test records | Documented alarm purpose and functional-test results |
| Change operator or technician actions | Linked training record | Attendance and competency-check evidence |
Alarm rationalization establishes why an alarm exists and what response it requires. A permissive is a condition that must be satisfied before equipment can start or continue a defined action.
Good CMMS asset management connects these records through the asset identifier and MOC number, even when drawings and training reside in separate controlled systems. The next PM must use the revised lubrication requirements, where changed, and approved VFD settings rather than the obsolete fixed-speed sheet.
Operators and technicians need training before return to service, with attendance or competency checks retained. The revised route should include safe functional verification of vibration trips, permissives, and setpoints under an approved test procedure.
After startup, the first route is compared with the baseline at comparable operating conditions. An unacceptable reading or a drawing that still shows the old motor starter keeps the MOC open. Another approval layer won't repair a form that never reaches the job plan.
Failure Modes That Let Bad Changes Through
A capital-project-only MOC procedure misses changes made during abnormal operation, maintenance recovery, and software administration. These omissions matter as much to critical compressors and motors as to the chemical-transfer pump.
Match each investigated pattern to a control
The Chemical Safety Board's MOC bulletin and incident guidance draws on the 1998 Equilon Anacortes delayed-coker fire that killed six workers and the CONDEA Vista reactor explosion that injured four, while subsequent investigations at DuPont Belle in 2010 and BP Texas City in 2005 exposed instrumentation, maintenance-software, temporary-change, organizational-change, competency, and monitoring weaknesses.
Abnormal operation treated as ordinary work. The Equilon and CONDEA Vista lessons support a deviation trigger, not just an engineered-project trigger. The corrective control is a documented safe-operating-limit check whenever personnel propose operating outside established conditions.
A protective component or software edit escapes review. At DuPont Belle, the gaps included incomplete review of rupture-disc burst sensors and no MOC after maintenance-software changes stopped generation of a necessary phosgene flex-hose work order; an incident caused a fatality. A rupture disc is a pressure-relief device, and its burst sensor indicates activation. The practical control is to screen instrumentation and CMMS configuration changes, then verify that the required work order still generates.
Temporary and organizational changes lack competent ownership. The BP Texas City investigation identified poorly defined MOC boundaries and weak application rigor. A written temporary-change risk class, trained reviewers, and overdue-change monitoring address the mechanism more directly than another signature box.
Challenge the quiet equivalence assumption
Reliability teams also need root cause failure analysis to examine whether a recent modification changed the failure mechanism. Otherwise, repeated bearing or seal replacements can conceal an unresolved duty change.
The quieter MOC failure is marking a different pump, alloy, firmware load, or lubricant as replacement in kind. A proper equivalence check compares form, fit, function, materials, performance, and protective logic before that box is selected.
Physical fit is an installation fact. Technical equivalence is an engineering conclusion.
Industry Checklist for Process-Plant Reliability Teams
Refineries, chemical plants, and industrial refrigeration facilities need equipment-specific screening questions. A generic question about safety impact rarely prompts a planner to examine compressor surge or motor cooling at reduced speed.
Screen by equipment class
Centrifugal pumps. Does the change move the minimum-flow point, increase seal-face loading or flush pressure, or reduce cavitation margin? Cavitation occurs when local pressure allows vapor bubbles to form and collapse, potentially damaging the impeller. The screen should compare the proposed duty with the pump curve and available suction conditions.
Compressors. Does a rerate change surge margin, discharge temperature, or lubricating-oil supply pressure? Surge is unstable flow that can produce damaging pressure and thrust reversals. Reviewers should examine the operating map and protective-control response.
Motors and VFDs. Does the change increase winding temperature at low speed, introduce bearing-current exposure, or alter the trip curve? Drive switching can create electrical stresses, including bearing currents, while reduced shaft speed can reduce cooling from a shaft-mounted fan.
Gearboxes. Does a lubricant or ratio change alter oil-film thickness, operating temperature, or sump level? Oil analysis, temperature measurements, and inspection of the lubrication arrangement should support the decision.
Instrumentation and controls. Does a setpoint, interlock, or firmware change remove protection or hide a condition signal? The reviewer needs to examine the complete cause-and-effect sequence, not only the edited parameter.
CMMS and staffing. Does a configuration change stop work-order generation, or does a reduced round lengthen the detection gap for degradation? The detection gap is the time during which deterioration can progress between observations.
Retain the screening rationale
A yes routes the proposal to the risk class matching its consequence. Every no needs a recorded reason supported by the relevant drawing, specification, operating map, or work-generation test.
That rationale allows a later reviewer to distinguish a considered exclusion from a missed question. Unsupported blank fields aren't evidence of unchanged risk.
Scorecard and Self-Check That Prove Field Control
Measure whether controls reached operating equipment, not how quickly records closed. A record marked complete has little value if a bypass remains active or a technician still follows an obsolete job plan.
The Chemical Safety Board's process-safety recommendations address multidisciplinary review, written communication, training, and periodic auditing. A useful scorecard checks whether those controls reached the field.
Count evidence and escalate exceptions
Review these measures monthly. Escalate startup-critical exceptions as soon as they arise.
MOC field-control scorecard
| Measure | What to count | Escalate when |
|---|---|---|
| Deviation trigger detection | Deviations and variances opened as MOCs, not only capital jobs | A bypass or limit change has no MOC number |
| Technical and hazard review | Share of MOCs with the required review method attached | High-risk work has a checklist only |
| Controls verified before startup | Interlocks, alarms, relief provisions, and limits checked through appropriate tests and verification | Any unverified trip or alarm on a critical asset |
| Training before authorization | Affected operators, maintainers, and contractors trained before startup authorization | Startup proceeds with training still open |
| Document and CMMS match | Procedures, P&IDs, spares, and job plans matching the installation | A technician would follow the old parameter |
| Overdue temporary MOCs | Changes past their removal date or missing an expiration owner | Any overdue temporary change |
| Post-implementation review | Reviews completed after the defined run-in window | Early failure or near miss has no review |
| Repeat failures linked to change | Failures or near misses tied to a prior MOC | The same asset fails again within the review window |
A missing procedure revision or unresolved action affecting a critical asset also warrants immediate escalation. The responsible authority decides whether operation can continue, sets interim controls where justified, and assigns corrective action. These decisions should be documented alongside the field-control evidence and longer-term reliability results.
After changes to motors, VFDs, gearboxes, pumps, compressors, or control logic, record checks of vibration trips, permissives, setpoints, lubrication specifications, and condition-monitoring routes. Choose test methods that do not create an unsafe process condition while confirming a protective function.
Maintenance reliability metrics such as MTBF, MTTR, and OEE can help track time between failures and repair duration. Use them with startup-readiness records to assess whether the change improved reliability and whether its controls reached the equipment.
Run a focused self-check
Review the last five changes to critical rotating equipment over one week. This is a proposed management test, not a regulatory threshold or published benchmark.
For each sampled change, check:
- Work execution. The current job plan and spare-parts record match the installed asset.
- Startup readiness. Training evidence shows affected personnel were prepared before operation.
- Measured condition. A post-change reading is compared with the pre-change baseline under suitable operating conditions.
- Temporary changes. Confirm their status against the plant's established MOC requirements.
As a conservative self-check rule, two or more failed checks across the five sampled changes indicate that management should address the failed handoffs, rather than focus on faster closeout.
Forge Reliability offers a free reliability assessment to check whether MOC, asset criticality, and condition monitoring align for pumps, compressors, motors, gearboxes, and VFDs. Plant teams can arrange the assessment through Forge Reliability and bring five sample MOCs, the overdue-temporary list, and a P&ID that may not match the field.
