What are Creeping Changes?

What are Creeping Changes?

Creeping change is the accumulation of small changes which often go unnoticed, which can add up to a significant change, but because they are gradual in nature, no hazard identification study or risk assessment has been performed. They are gradual, unseen and not planned, and because of this can be difficult to monitor. (For example, the increase in the number of fuel leaks on the Nimrod aircraft that exploded over Afghanistan was not noticed as these were considered low risk (Haddon-Cave QC, 2009)).

Creeping changes are a safety risk that has only relatively recently been highlighted as a significant issue by UK HSE.

A series of two papers [1, 2] published at Hazard Safety Symposium by Richard J. Goff, Jill Wilday and Justin Holroyd from Health and Safety Laboratory, in Buxton UK bring a new approach in dealing with creeping changes in ageing facilities. Their findings and conclusions are much applicable in the fertilizer industry.

Types of creeping change

Creeping changes can occur in many different forms and problems often occur when these changes interact and/or are cumulative. Creeping changes are relevant across a wide range of disciplines including (but not limited to) process safety, mechanical engineering, electrical control and instrumentation (EC&I) and human factors. Some examples of types of creeping change are:

  1. Ageing (including degradation and obsolescence);
  2. Process changes;
  3. Equipment/infrastructure changes;
  4. Management/ownership changes;
  5. Workforce change/loss of skills;
  6. Operational Risk Assessments (ORAs)
  7. Management of Changes (MOCs); and
  8. Culture changes.

Creeping Changes in Major Accidents

Creeping changes have been identified as a contributory factor in many major accidents, including the Nimrod loss, Texas City, the Space Shuttle Columbia and the Kings Cross fire.

Types of creeping change

There is a broad spectrum of changes that could be classified as creeping changes and some of them are discussed in this section. However, it is not an exhaustive list and other types of creeping changes can clearly occur. Typically, creeping changes occur at the interface between process safety, mechanical engineering and human factors. Problems often arise when many types of change occur simultaneously because of the difficulty in assessing their interactions.

Identifying different types of creeping change was the subject of one of the interactive sessions at workshops run by the authors for industrial delegates.

Some of the creeping changes and issues identified crossover from one category to another, demonstrating how multiple changes can interact.

There was clear acknowledgement from the delegates of the insidious and widespread nature of creeping change and how it pervaded a wide range of critical aspects of asset integrity management (AIM). Delegates recognised that attention moves over time, and gradual deteriorations/ changes often do not get identified until too late unless there has been a clear anticipation of the need for proactive action to seek out such indications.

The “continuous change” culture exacerbates this, so a strong message from the interactive sessions was that proactively identifying these issues at an early stage is essential.

It was recognised that areas which lack clear performance standards are particularly vulnerable to creeping changes, which then may be ignored or not identified.

Examples provided included instances where “pass” criteria were subjective or where there were no clear control or corrosion limits.

The following are based on discussions in the interactive sessions during the workshops.


Creeping or gradual degradation often goes un-noticed because the operating personnel are busy dealing with short-term asset integrity problems, often there are no systematic studies/audits being performed that could identify creeping change. There may be a lack of planned maintenance in some situations; a deferral culture as opposed to preventative maintenance.

Temporary repairs/patches or workarounds have a lifetime associated with them, and are meant to be short term fixes; however these can sometimes become long term in nature. It is a common failure to not regularly review if equipment is fit for purpose and understand the condition of the asset.

There can be failures to update technology, companies keep repairing equipment until they can no longer get spares or get someone who can repair the equipment. Some companies are starting to consider these issues as part of obsolescence studies but not necessarily for all systems and equipment. Obsolescence issues, especially when there is a gradual deterioration of vendor support or spares availability, often do not become apparent until there is a breakdown. Control systems are particularly vulnerable as electronic circuit boards cannot be replaced. The loop diagrams often do not reflect the control system in place; this may be due to the drawing not being updated to reflect any changes that have been made.

Changes by manufacturers are not always effectively communicated to users until they require spare parts or replacement equipment. Issues occur when like-for-like replacements or spares cannot be obtained. In many situations this can be mitigated by service level agreements, but the organisation must proactively address this. Often a supplier is no longer in business, therefore, planning is required to anticipate future issues. New technology is often ignored; the company should consider replacing obsolete equipment, where possible, with newer technology. This would not only help to resolve the obsolescence issues but also provide a degree of future proofing and enhanced performance.

Positive feedback about the industry’s ability to respond to obsolescence included a number of examples where initial lack of replacement parts etc. was resolved by re-manufacture of identical parts.

Process changes

Process changes can be either chemical or physical and could result in increased degradation rates. Chemical changes include, for example increases in hydrogen sulphide, whereas physical changes most often reported were changes in the temperature and pressure. The hazard associated with some physical changes, such as reducing pressure, may not always be obvious, but these changes can have unintended effects such as deposition of material or stagnant areas due to the reduced flow. The effect of this could be increased if combined with other changes such as material degradation due to age.

Changes in produced fluids over time need to be monitored and relevant action taken to change process parameters so alarms and safety systems still work as required. However this is not always the case. Process systems are sometimes bypassed due to difficulty to manage/operate because of changes in operating conditions and/or lack of suitably skilled personnel to maintain and run them.

The significance of ancillary process systems, or parts of the process which were traditionally considered as “low priority”, could be easily overlooked, and only realised when their deterioration assumed critical importance. Examples of this phenomenon included the failure of cooling water filtration systems causing significant production outages, and pipeline deadleg corrosion. Delegates considered that a good mechanism for ensuring that such issues were identified was the use of appropriate HAZID techniques focusing on the consequence of creeping change across all the process plant.

Equipment/infrastructure changes (including structural and civil engineering)

Lack of corrosion limits in guidance is a major problem, partly because there is a culture of accepting this as something that occurs, so it is a low priority issue and does not get dealt with.

There is similar poor prioritisation regarding the condition of some items of critical equipment if it is not something that is being dealt with.

Management/ownership changes

Changes of operator or installation ownership are events which increase the probability of creeping change going unnoticed because of the potential for losing infrastructure information and intelligence due to changes in personnel or systems. Delegates highlighted that the churn in operators/owners was leading to a significant vulnerability on the UK Continental Shelf (UKCS). Conversely, though, there was an acknowledgement that a “fresh pair of eyes” was often a way in which creeping deterioration could be identified.

“Silo” organisations are problematic, leading to little or no sharing of knowledge from one part of the organisation to another. Alignment, communication and understanding of shared objectives and goals between parts of the organisation do not always happen. There can be a tendency not to check other operators for good practice, and also may not consult engineers/technicians on the plant. This has caused issues between management and technical authorities (TAs) who have different focuses, management objectives tend to be short term issues such as profitability rather that longer term issues such as Aging and Life Extension that the TA would manage.

Workforce changes/loss of skills

A host of workforce factors associated with creeping changes were identified, which are just as significant as more infrastructure-linked factors. For instance, issues of delayering the workforce, increased use of contractors and the changing demographics with more inexperienced workers is leading to a loss of knowledge in the older systems as workers leave the industry.

Personnel turnover leads to a loss of experience and asset history, and this has been recognised as a major issue both offshore and onshore. Reorganisation / delayering can lead to a reduction in Aging and Life Extension issues being addressed as knowledge of the problems and focus upon them can be lost. The right people are not always in the right place to keep on top of the work that needs to be done, leading to jobs being left undone and workarounds and other temporary measures being left in place. There can be an over reliance on Safe Systems of Work (SSOWs) instead of the competence of the workforce (which would be inherently safer).


Operational risk assessments (ORAs) are put in place while safety barriers are down which is often related to creeping change. ORAs are sometimes used in lieu of repair because of obsolescence problems. There can be an impact on production dependant on the barrier(s) that are down, and if an SCE barrier is down on any production critical system or equipment then production is stopped until a fix is implemented.

Depending on the scale of the incident or other issue, multiple ORAs may be in place to cover multiple barriers being down, associated with significant creeping change. Interlinked ORAs / long term isolations (LTIs) may be in place due to a failure arising from an incident caused by creeping change. The cumulative effect of these can be hard to assess.

ORAs used as a means of managing a backlog is a problem, where the cumulative effect can be that a number of barriers are potentially not fit for purpose and temporary repairs become effectively semi-permanent. Lack of action/close out of ORAs can occur where they are in place for a significant time due to issues such as lack of maintenance resource, spare parts or relevant skilled personnel, or a lack of perceived urgency now that a fix is in place, indicating a lack of rigorous follow up.

Multiple management of change (MOC) processes have the potential to cause creeping changes by interacting with each other, or interacting with other creeping changes, if the effects of the change are not carefully examined during the MOC process.


There were strong views during the workshops that creeping changes were more of an issue in organisations which had a “deferral culture”. Where this happens, short term/quick fix AIM decisions ignore the cumulative effects of, for instance, the extensive use of temporary repairs or ORAs. A strong Technical Authority (TA), able to take a long-term view to counter-balance more production orientated short-termism, was considered vitally important here.

One particular issue that was raised was deluge systems blocking over time, and because no investigation is performed personnel are ignorant of the root cause of the blockage. The system is repaired and quickly becomes blocked again. This is a recurring theme and does not apply solely to deluge systems. It is vitally important to learn lessons of previous failures rather than just fixing the problems to prevent them from recurring.

Atypical events

Many creeping changes can be readily identified as being potential safety issues (or otherwise) when given sufficient attention. Atypical events, however, are those for which there is insufficient knowledge to understand the safety issues that they pose. The Buncefield incident was an atypical event in the sense that before it occurred common understanding within the process safety community was that a vapour cloud explosion (VCE) could not occur in the absence of semi-confinement or congestion. Atypical events could therefore be associated with a sub-set of creeping changes for which the change is allowed and believed to be non-hazardous because of lack of knowledge.

Identification of atypical events requires focussed internet/ literature searches alongside hazard identification. The DyPASI hazard identification technique (Paltrinieri, 2013, 2014) was specifically developed for that purpose.

Fertilizer industry creeping changes site examples

The examples in this section are taken from various fertilizer plant sites.

Figure 1 shows a FD fan motor fins touching base frame

Figure 2 shows a wrong bolt installed on support

Figure 3 and 4 shows a strainer crack

       Figure 3, and 4 shows a strainer crack

Figure 5 shows a misalignment support

Figure 6 and 7 shows piping lack of supports

Figure 6 and 7 shows piping lack of supports


Creeping change is an important issue in almost all industrial activities and its identification and elimination is key to ensuring safety and to maintain production efficiency. It was highlighted by the UK HSE inspection programme as an important issue to address when managing ageing assets. Creeping changes can have potentially catastrophic effects on both major hazard safety and production.

Creeping change covers a range of issues in equipment integrity, production conditions, human factors and organisational culture. Creeping changes are those changes that occur gradually and slip under the radar of processes to identify and manage hazards.

Acknowledgements & Disclaimer

Funding by the Health and Safety Laboratory under its Investment Research Programme is gratefully acknowledged. HSL’s experience was gained through analysis of KP4 inspection results for HSE. Any opinions and/or conclusions expressed, are those of the authors and do not necessarily reflect HSE policy.


  1. Richard J. Goff, Jill Wilday and Justin Holroyd Health and Safety Laboratory, Buxton, UK, Creeping Changes
  2. Richard J. Goff and Justin Holroyd, Health and Safety Laboratory, Buxton, SK17 9JN, UK, Development of a Creeping Change HAZID Methodology
  3. Chambers, C. (2015), Data trending to support Aging and Life Extension (ALE) in the United Kingdom Continental Shelf (UKCS) Oil and Gas industry, IChemE Hazards 25 Symposium, Edinburgh
  4. The Columbia Accident Investigation Board (CAIB) (2003), Report Volume 1, Washington, D.C.: National Aeronautics and Space Administration and the Government Printing Office
  5. Drennan, (1992), Transforming Company Culture, London: McGaw Hill
  6. Fennell, D. (1998), Investigation into the King’s Cross Underground Fire, London: The Stationary Office
  7. Hadden-Cave, C. (2009), An Independent Review into the Broader Issues Surrounding the Loss of the RAF Nimrod MR2
  8. Arcraft XV230 in Afghanistan in 2006, London: The Stationary Office
  9. Hopkins, A. (2009), Failure to Learn: The BP Texas City Refinery Disaster
  10. HSE (2005), Inspectors Toolkit: Human Factors in the Management of Major Accident Hazards https://www.hse.gov.uk/humanfactors/topics/toolkit.pdf (accessed 09/01/2015)
  11. HSE (2007), Key Programme 3 (KP4): Asset Integrity Programme https://www.hse.gov.uk/offshore/kp3.pdf (accessed 09/01/2015)
  12. HSE (2014), Key Programme 4 (KP4): Ageing and Life Extension Programme https://www.hse.gov.uk/offshore/ageing/kp4-report.pdf (accessed 09/01/2015)
  13. Lekka, C. (2011), High Reliability Organisations: A Review of the Literature, HSE RR899
  14. Mellor, N., Wilday, J., Lunt, J., Holroyd, J. (2015), High reliability organising principles and mindful leadership, IChemE Hazards 25 Symposium, Edinburgh
  15. Paltrinieri, N., Tugnoli, A., Buston, J., Wardman, M., Cozzani, V. (2013). Dynamic Procedure for Atypical Scenarios Identification (DyPASI): a new systematic HAZID tool. J. Loss Prev. Process Ind. 26 (4), 683–695.
  16. Paltrinieri, N., Wilday, J., Wardman, M., Cozzani, V. (2014), Surface installations intended for Carbon Capture and Sequestration: Atypical accident scenarios and their identification, Process Safety and Environmental Protection, 92 (2014), 93-107
  17. Sugden, C., Roberts, K., Preston, M. (2013), Measuring the Safety Climate in Organisations: Reduce Injuries and Costs Through Cultural Change, Available from https://www.hsl.gov.uk/products/safety-climate-tool/free-white-papers- (accessed 09/01/2015)
  18. Weick, K.E., Sutcliffe, K.M. (2007), Managing the Unexpected: Resilient Performance in an Age of Uncertainty, Second Edition, San Francisco: Jossey-Bass
Share this on:

[user_registration_form id=”41351″]