Flixborough 50 Years On: How Management of Change Failures Contributed to the Disaster

Richard Mundy reflects on the Court of Inquiry’s findings relating to what we now call management of change (MOC), a concept that was not widely appreciated in 1974, and discusses modern MOC good practices and common pitfalls

THE excerpt above is an extract from the official Court of Inquiry report for the Flixborough disaster. A temporary bypass pipe had been installed because a reactor vessel had developed a crack. The Court of Inquiry found a prior small leak had been dealt with for a period by diluting it with cooling water sprayed onto the outside of the reactor shell. The cooling water had been treated with an additive, making it nitrate-rich and leading to nitrate stress corrosion cracking the shell.

What these events illustrate is the importance of recognising change. The use of temporary equipment like hoses, portable pump skids, and portable leak-testing packages has given rise to many industrial incidents since Flixborough – the Bhopal chemical leak in 1984 which involved a modified cleaning plan and temporary water hose, being a prime example. It is all too often the case that MOC is seen as predominantly an engineering activity and changes that are not engineering-led are neglected. Awareness of change management requirements needs to be widespread across functions including engineering, site operations, and maintenance.

If the use of cooling water had been subject to an MOC process, is it even certain the potential for the additive to cause stress corrosion cracking would have been spotted? This points us to another key facet of effective MOC: the importance of broad multidiscipline review. This change may have needed team risk assessment and/or change review including both a chemist (with an understanding of the water chemistry) and an integrity engineer (with an understanding of potential corrosion mechanisms) to identify the cracking threat.

The day after the leaking crack was found in Reactor 5, a meeting of plant management was convened. At this meeting, it was decided to remove the reactor and to install a bypass pipe in its place, despite this option’s feasibility and risks not having been fully assessed and the cause of the crack not being understood.

This points us to a common mistake in the application of management of change: a failure to fully study the problem and all potential solutions at the start of the change process. This can lead to a poor option being executed. For example, an inherently safer design may exist. Alternatively, if the problems with the chosen option are identified and a different option is then selected, it results in delays as the change management process is restarted.

The modification at Flixborough went through no formal design or testing process. Underlying any technical management of change process there needs to be competent people applying safe engineering practices. Furthermore, the organisation needs enough depth of competence that the MOC process can apply sufficient technical review of the change that has been proposed.

The change also needs to be well documented to allow it to be thoroughly risk-assessed, reviewed, and executed. Now, this is normally achieved via a description of the change, “marked-up” controlled documents showing all aspects of the change, and associated supporting documents (eg calculations).

Good MOC systems also include the ability to track associated actions to closure. At one stage at Flixborough, pipe supports were proposed that may have prevented the failure of the bypass. These were not installed. Instead, only a few scaffold poles were left to support the piping’s weight. If an effective MOC process had been in place, the lack of pipe supports in the initial design may have been noticed at a risk assessment or by a change reviewer and an action put in place to ensure pipe supports were added to the design prior to implementation.

For the first few weeks of operation after the modification, the bypass pipe held. It is thought that then, on 1 June during plant startup, the bypass was subjected to more severe conditions than it had experienced previously. It is not known with certainty what caused this because the records in the control room were destroyed and the most potentially informative witnesses were killed.

It is known that the 1 June startup deviated from the startup procedure due to a shortage of utility nitrogen. It is also known that some technicians had adopted a different startup method from the one proceduralised.

Any change in how a plant is operated, particularly during high-risk transient periods like startup, needs careful management. This can be challenging. For example, there may be a reason why the procedure is difficult to conform with, like Flixborough’s nitrogen shortage. If this reason is not anticipated, the decision on whether to deviate from the procedure may have to be made with urgency and without every potentially relevant member of staff available to review the decision. For example, plants often run continuously 24/7 without full engineering support available to cover night shifts and weekends.

Some operating organisations, therefore, have a process whereby changes can be executed on an “emergency” basis in a streamlined way, then being subject to a fuller assessment at the first opportunity. For such a process to work safely, enough competence is needed continuously while the plant is running to make decisions on the permissibility of change. This streamlined emergency process must still include core aspects of the normal MOC process.

The Court of Inquiry draws our attention to how a change in personnel may explain why the Flixborough plant’s engineering team oversaw an inadequate modification, which ultimately resulted in the loss of primary containment.

Management of change should not just be about technical changes. A thorough MOC process should also be applied to organisational changes, including changes in personnel. Management of organisational change is still not consistently applied today across the industry. It can be hard to manage given that staff members can leave at any time and not all aspects of competency are easy to measure. It is also difficult to assess the risk posed by organisational changes in comparison to some other types of change.

Other aspects of some of today’s successful MOC processes include:

• use of a computerised change database to enforce stage “gates” within the process, to ensure that only people with the right competence can sign their consent to the change and to allow easier administration of the system (eg by keeping all associated documents together)
• appointment of people responsible for upkeep of the database, providing day-to-day oversight. At large sites, this may be a full-time MOC administrator. At smaller sites, this may be a responsibility held as part of a wider role
• enforcement of high-quality risk assessment on the finalised change design, performed by teams with an appropriate diversity of technical specialisms and plant experience, with enough independence from the proposer(s) of the change, using an appropriate methodology (eg HAZOP for complex process changes)
• involvement of the right parties, typically including both engineering expertise and those with more direct plant-facing roles
• an organisational culture where change proposers welcome challenge from others, including their changes’ risk assessment teams and technical reviewers, seeing this as an opportunity to improve the change design and to learn for the future
• an organisational culture where signatories in the MOC process take their gatekeeping role as a serious responsibility, rather than as a bureaucratic exercise
• the level of management tasked with approving or rejecting a change is commensurate with the level of residual risk associated with the change
• steps to communicate the change to all necessary stakeholders, potentially including associated training
• tracking of the “due dates” of temporary changes, to ensure that changes intended (and risk-assessed) only for short-term operation do not become normalised for the long-term
• tracking of close-out of permanent changes to ensure that all activities associated with the change (eg update of documents with back-drafted revisions, procurement of spares) are completed in a timely way
• management attention to applicable key performance indicators (KPIs), for example:
  – number of temporary changes in place
  – number of temporary changes in place beyond their “due date”
  – number of permanent changes still “open” six months beyond change implementation
• regular audits to check the quality of MOCs and conformance to the MOC procedure

Finally, a tension in all MOC processes is the need to balance a high level of rigour with the need to keep the process efficient. If the process cannot be conducted efficiently, it may lead to delay in implementing safety improvements or may lead to people attempting to bypass the process.

---

Disclaimer: This article is provided for guidance alone. Expert engineering advice should be sought before application.

---

This article is the latest instalment of the Safety & Loss Prevention SIG’s series marking the 50th anniversary of the Flixborough disaster.

References

1. Flixborough Court of Inquiry report: http://tinyurl.com/zca95huv
2. Nylon Years – a graphic novel about Flixborough: http://tinyurl.com/yx7427sr
3. The Energy Institute’s guidance on MOC: http://tinyurl.com/4wuxa45m
4. The Energy Institute’s guidance on managing organisational change: http://tinyurl.com/vv55ea7v
5. A summary of key MOC principles from the Center for Chemical Process Safety: http://tinyurl.com/y9634kyt