Pre-Startup Safety Review: What Must Be Closed Before Hydrocarbon Introduction

The Last Gate Before Hydrocarbons

The moment a new or modified process system receives hydrocarbons, its risk changes completely. Construction defects that were inconvenient during water testing become leak paths. An incorrect valve line-up becomes trapped pressure or an unavailable relief route. An instrument loop that was "tested" by forcing a signal at the cabinet becomes an unproven shutdown function when the real transmitter and final valve are called upon.

The Pre-Startup Safety Review (PSSR) is the formal decision gate between those two states. It asks whether the facility, the operating organisation, and the evidence supporting both are ready for the defined hazardous inventory to cross the boundary.

It is not another construction walkdown. It is not mechanical completion with a different cover sheet. It is not a meeting where every discipline reports a percentage complete and management decides that 98% sounds close enough. A competent PSSR connects the final as-built plant to the design basis, hazard studies, operating procedures, training, commissioning records, and emergency arrangements, then makes a defensible go or no-go decision.

The key principle is simple:

Hydrocarbon introduction must not proceed while an open item weakens a credited barrier, challenges primary containment, creates an unassessed change, prevents safe operation or emergency response, or makes a governing readiness requirement untrue.

That does not mean every paint defect and dossier-indexing item must be complete. It means the project must distinguish residual work from startup risk with considerably more discipline than an A/B/C label in a punch-list database.

What a PSSR Is Required to Confirm

The governing requirement depends on the facility and jurisdiction. For a process covered by the US OSHA Process Safety Management rule, 29 CFR 1910.119(i) requires a pre-startup safety review for new facilities and for modifications significant enough to require a change in process safety information. Before highly hazardous chemicals are introduced, the review confirms four broad conditions:

1. Construction and equipment conform to design specifications.
2. Safety, operating, maintenance, and emergency procedures are adequate and in place.
3. For a new facility, the process hazard analysis has been performed and its recommendations have been resolved or implemented; for a modified facility, management-of-change requirements have been met.
4. Training for each employee involved in operating the process has been completed.

US offshore facilities subject to BSEE's SEMS rules have a related safety and environmental review requirement under 30 CFR 250.1917, drawing on the management-system principles of API RP 75. Other countries use different regulatory structures: an accepted safety case, operating consent, safety-critical-element verification, major-hazard regulation, operator standards, or a combination of these.

The terminology is less important than the governing basis. OSHA PSM does not apply automatically to every upstream installation, and API RP 75 is not law everywhere. The PSSR plan should identify the applicable legislation, permits, approved safety case or SEMS, operator procedures, project specifications, and adopted standards before the checklist is built.

Where IEC 61511 is adopted, its installation, commissioning, validation, and functional-safety-assessment requirements provide essential evidence for the Safety Instrumented System (SIS). IEC 61511 does not replace the whole-plant PSSR; it establishes whether the installed safety instrumented functions meet their own lifecycle requirements before hazards are introduced.

Define the Boundary and the Trigger

"Before first hydrocarbon" sounds clear until the project tries to apply it.

On a greenfield facility, the boundary may be the production inlet ESD valve and the trigger may be opening the upstream isolation for the first time. On a brownfield modification, the host plant is already live: the PSSR boundary may be a new separator package, a tie-in spool, or the downstream side of an isolation blind. Fuel gas may already be present in a utility system while the main process remains hydrocarbon-free.

The PSSR procedure should therefore state:

• The exact physical systems and commissioning boundaries covered by the review
• The hazardous material whose introduction is being authorised
• The valve, blind, spectacle plate, or operating step that constitutes introduction
• Which adjacent live systems and simultaneous operations affect the decision
• Who has authority to approve the review and who has authority to execute the line-up
• How long the approval remains valid if startup is delayed or the plant configuration changes

This boundary prevents two common failures: completing the review after a small amount of hydrocarbon has already been admitted "for testing," and approving a package in isolation when its relief, drain, power, control, or emergency interfaces are not ready.

Gate 1: Process and Mechanical Integrity

Mechanical completion certificates are inputs to the PSSR, not proof that the system is ready. The review must establish that the field installation is the plant described by the current approved documents and that its containment has been demonstrated.

The evidence normally includes:

• A field walkdown against current P&IDs, line lists, equipment datasheets, and approved redlines
• Correct materials, pressure classes, gaskets, bolting, valve orientation, supports, vessel internals, and equipment tags
• Accepted pressure tests, leak tests, NDE, flange-management records, and final reinstatement records
• Removal of test blinds, temporary strainers where required, shipping braces, construction caps, and temporary hoses not approved for startup
• Correctly routed vents, drains, sample points, closed-drain connections, and temporary connections
• Cleaning, flushing, drying, and inerting results meeting the project acceptance criteria
• Rotating equipment alignment, lubrication, guarding, permissives, and vendor commissioning requirements
• Stable startup utilities, including electrical power, UPS, instrument air, nitrogen, cooling, drains, and chemical injection where required

This is where the handover dossier and the physical plant must agree. A signed test pack cannot close a field discrepancy, and a successful walkdown cannot substitute for a missing pressure-test record. Both the condition and its traceable evidence matter.

The pre-commissioning sequence of flushing, drying, and nitrogen purging deserves particular attention. A system that met its dew-point or oxygen criterion yesterday may no longer meet it after a flange was opened, a dead leg was connected, or the nitrogen blanket was lost. PSSR checks the as-left condition, not merely the existence of an earlier certificate.

Gate 2: Relief, Shutdown, and Detection Systems

Hydrocarbon should not enter a system until its protective paths are available in their final configuration. The PSSR team should work from the hazard studies and design basis to identify the safeguards that make startup acceptable, then verify each one in the field and in the records.

Relief and Disposal

For pressure protection, confirm that:

• Each PSV or rupture disc has the correct tag, set pressure, capacity, materials, orientation, and certification
• Inlet and outlet isolations are in their required secured position
• No test blind, closed valve, temporary spool, or unassessed restriction blocks the relief path
• Thermal relief paths are complete on liquid-full blocked sections
• The as-built flare or vent network remains consistent with the relief study and allowable backpressure
• Flare knockout, purge, pilot, ignition, and monitoring systems are available where the design requires them
• Depressurisation valves, restriction orifices, and sequences have been functionally verified

An installed PSV is not an available safeguard if its outlet valve is shut or the flare pilot system required by the design is unavailable. The PSSR has to verify the complete protection path described in the pressure-relief and flare-system basis, not just the tagged device.

ESD, SIS, and Fire and Gas

Protective functions should be tested end to end: from the real initiating device, through the installed logic and field wiring, to the actual final element. The evidence should confirm:

• Approved cause-and-effect matrices and Safety Requirements Specifications (SRS)
• Instrument ranges, units, setpoints, voting, alarm priorities, and fail states
• Sensor calibration and loop checks
• Shutdown-valve travel, fail position, stroke time, and tight shutoff where credited
• ESD effects on equipment, isolation, blowdown, HVAC, ignition sources, deluge, and alarms
• Fire and gas detector coverage, voting, annunciation, and executive actions
• Essential power and UPS performance
• Software revision, backups, access control, and reset/restart behaviour
• A cleared override, inhibit, jumper, and bypass register

For safety instrumented functions, FAT or logic simulation alone is not enough. It may prove the application program while bypassing the transmitter, solenoid, actuator, and valve that must work during the real demand. IEC 61511 validation should show that the installed function meets the SRS; the required functional safety assessment is a separate lifecycle decision. The SIS proof-testing principles apply from day one: test scope, response time, and as-found condition matter more than a box marked "tested."

Gate 3: Electrical, Fire Protection, and Emergency Readiness

Startup pressure tends to focus attention on the process train while the systems that control escalation remain unfinished. A production separator may be ready to hold pressure while gas detection is inhibited, temporary construction power remains in a Zone 1 area, or the firewater ring main is isolated for tie-in work. That is not startup readiness.

Electrical and hazardous-area evidence should include the current classification drawings, equipment certificates and markings, correct glands and seals, enclosure integrity, earthing and bonding, protection tests, emergency power, and the initial Ex inspection required by the adopted scheme. Temporary equipment must either be removed or explicitly suitable and controlled for the classified location. The installation needs to match the assumptions behind the electrical area classification, not merely carry Ex labels.

Emergency readiness should be practical, not documentary. Confirm that:

• Firewater, deluge, extinguishers, gas detection, alarms, and emergency communications are available
• Escape routes, muster points, lighting, evacuation craft or transport, and access control reflect the startup configuration
• Spill response, H2S response, rescue, first aid, and medical arrangements are implementable
• The control room and field teams know who can initiate ESD, stop the startup, and declare an emergency
• External contacts and mutual-aid arrangements are current where required
• Construction and commissioning simultaneous operations do not obstruct response or introduce unmanaged ignition sources

A drill does not have to be repeated before every startup unless the governing procedure requires it, but the emergency plan must have been validated and must still represent the facility and people present on the day.

Gate 4: Procedures, People, and Handover

The plant can be mechanically complete and still not be operable. Before hydrocarbon introduction, the operations team needs controlled instructions that match the as-built plant and a shift organisation capable of executing them.

The procedure set should cover initial line-up, inert-gas displacement, rate and pressure limits, hold points, normal startup, normal and emergency shutdown, abnormal conditions, sampling and draining, overrides, simultaneous operations, and communication between field and control room. Critical procedures should be walked through at the panel and in the field. A generic procedure that uses obsolete tag numbers or asks an operator to open an inaccessible valve is an engineering defect, not a document-formatting issue.

Training should be role-specific and completed before the individuals operate the process. Attendance records alone are weak evidence. Operators and maintainers should demonstrate that they understand:

• Process and chemical hazards, including H2S where applicable
• The startup sequence, operating envelope, and hold points
• Alarms, trips, ESD, depressurisation, and fire and gas actions
• Changes made since HAZOP or since their earlier training
• Temporary arrangements and authorised overrides
• Emergency actions and communication routes

Finally, custody must be unambiguous. Operations should accept the live-system boundary, current P&IDs, valve line-up, isolations, permits, overrides, temporary modifications, maintenance due dates, outstanding work, and residual risks. The commissioning and startup sequence only works when each stage has a real handover gate; signatures applied without transferred knowledge do not create one.

HAZOP Actions and Management of Change

"All HAZOP actions closed" is commonly written as a PSSR condition, but it can conceal two opposite errors. One project marks actions closed administratively to protect the startup date. Another delays startup for a recommendation that has been technically resolved by an approved alternative and does not require physical work.

The correct test is whether each recommendation has been resolved or implemented in accordance with the governing requirement, and whether every safeguard or action required for startup is physically in place and verified.

A recommendation may be resolved by implementing the original action, adopting an engineered alternative that addresses the risk, or documenting a competent technical justification for rejection where the governing process permits it. Assigning an owner and a future due date is not resolution. If the action establishes a credited safeguard, closes a loss-of-containment risk, or enables emergency response, it is a no-go item until the required protection exists.

The same discipline applies to late change. Field-routed pipe, altered trip logic, revised setpoints, temporary hoses, disabled detectors, changed startup conditions, and vendor software revisions all require management-of-change screening. Where MOC applies, the technical basis, risk review, authorisation, document updates, and affected-person training must be complete before startup. Retrospective paperwork after first hydrocarbon is not change control.

This is why the PSSR should reconcile the final plant against the HAZOP action register, MOC register, design-deviation register, software-change log, and as-built redlines together. Reviewing them as separate lists misses their interfaces.

What Can Remain on the Punch List?

A PSSR is not necessarily a zero-punch gate. It is a zero-uncontrolled-startup-risk gate. A residual item may remain only when all of the following are true:

1. It does not breach legislation, permit conditions, the approved safety case, or an explicit project hard gate.
2. It does not impair containment, ignition control, relief, shutdown, detection, fire protection, evacuation, or another credited barrier.
3. It does not invalidate the HAZOP, LOPA, relief basis, SRS, area classification, operating envelope, or emergency plan.
4. The as-left condition is within the approved design basis or has passed the required deviation and MOC process.
5. Startup, foreseeable upset, shutdown, and emergency response remain safe, including the combined effect of other open items.
6. The item has a documented owner, interim control where needed, completion date, and accountable approval.
7. The evidence needed to support the startup decision is available now, even if final dossier formatting can follow.

These examples are not automatic classifications. A missing handrail paint coat may be minor; a missing fireproofing coat is not. Final CAD drafting may wait only if the approved redline is already the controlled operating document. The PSSR team must assess the actual function, location, and cumulative effect rather than trust the punch category assigned by construction.

Worked Example: The Trip That Was Too Slow

Consider a brownfield early-production facility adding a sour-service three-phase separator. Feed is available at approximately 70 barg, the separator MAWP is 85 barg, and the project has adopted IEC 61511. The LOPA credits a high-high-pressure SIF that must detect pressure at its specified setpoint and close the inlet shutdown valve within 10 seconds. A PSV provides separate mechanical protection to the existing flare system.

The PSSR confirms:

• Pressure and leak tests are accepted and all final joints are reinstated
• Materials and bolting are traceable for sour service
• The PSV certificate, isolation positions, and flare capacity are correct
• Fire and gas executive actions have passed their tests
• Startup and emergency procedures are controlled
• Operators have completed training and field walkthroughs

During the final end-to-end SIF test, however, the shutdown valve takes 18 seconds to close. The transmitter, logic solver, and solenoid respond correctly; a restricted actuator exhaust slows the final element.

Decision: no-go. The installed SIF does not meet its SRS, so it cannot receive the risk-reduction credit used in the LOPA. Starting at 50% throughput does not fix the problem: gas blow-by and overpressure can still be driven by upstream pressure, and a local operator watching the gauge is neither independent nor demonstrated to act within the required response time.

The actuator restriction is corrected. Three repeat tests close the valve in 7–8 seconds from real pressure stimulus, the validation report is updated, the bypass register is confirmed clear, and the functional safety assessment identifies no startup blocker.

Decision: go, subject to the approved ramp-up procedure. The residual punches are handrail coating, final vendor-dossier indexing, and native-CAD incorporation of a redline already issued as the controlled P&ID. None affects containment, safeguards, operator information, or emergency response.

The example captures the purpose of PSSR. The review did not certify the whole facility as "safe." It found a specific mismatch between the safety case and the installed plant, prevented the hazardous inventory from being introduced, verified the correction, and then authorised startup against defined conditions.

How to Run the Review

The review works best as a planned process rather than a single meeting at the end of commissioning:

1. Define the basis and boundary early. Build the PSSR requirements register during commissioning planning, not the night before first hydrocarbon.
2. Assign evidence owners. Each criterion needs a named discipline, an acceptance record, and a due date aligned with the startup sequence.
3. Pre-screen the dossier. Do not use the final review to discover that test packs are unindexed or a validation report has never been issued.
4. Walk the plant with the documents. Include operations, commissioning, process, mechanical, EC&I, and safety personnel who can challenge both the field condition and the evidence.
5. Test the startup-critical barriers. Witness or review traceable end-to-end results for the functions the hazard analysis credits.
6. Reconcile actions and changes. HAZOP, MOC, overrides, deviations, redlines, and punch items must describe one consistent as-left plant.
7. Record go, conditional go, or no-go. Conditions should be explicit, time-bound, and within the authority of the approvers. A condition cannot waive a legal requirement or substitute monitoring for a missing engineered safeguard without a valid risk assessment and approval route.
8. Control the period after approval. Freeze the configuration, manage any new change, maintain nitrogen and isolations, and repeat affected checks if startup is delayed or the plant state changes.

The signatories vary by operator, but the decision normally needs accountable operations, project or commissioning, engineering, and process-safety authority. Contractor completion signatures support the evidence; the operator who accepts the risk and controls the live plant should own the final authorisation.

Common PSSR Failures

• Reviewing percentages instead of evidence. "Commissioning 98% complete" says nothing about whether the missing 2% is paint or the firewater pumps.
• Treating mechanical completion as readiness. Mechanical completion does not prove procedures, training, control logic, emergency response, or system interfaces.
• Testing only at the cabinet. Forcing a PLC input does not validate the transmitter, field wiring, solenoid, actuator, valve travel, or process response.
• Leaving commissioning overrides active. A bypassed trip or inhibited detector has zero protective value, regardless of why the override was installed.
• Using reduced throughput as a universal safeguard. Many overpressure and loss-of-containment scenarios are driven by upstream pressure or inventory, not normal flow rate.
• Accepting uncontrolled redlines. If operators cannot identify the current line-up and trip logic from controlled information, the plant is not ready.
• Closing actions by due date. A future date does not resolve the current risk.
• Ignoring the cumulative punch list. Five individually minor utility, access, lighting, and communication defects can combine into an unsafe emergency response.
• Running PSSR after introduction. Once the hazardous material has crossed the defined boundary, the review has missed the decision it exists to govern.

Conclusion

A good PSSR turns a mass of completion records into one defensible operating decision. It confirms that the plant in the field matches the design basis, that containment and protective systems have been proven, that changes and hazard-study actions are controlled, and that trained people can start, stop, and respond to the facility they actually have.

The standard is not paperwork perfection and it is not zero cosmetic punches. The standard is that no open item makes the startup case false, weakens a required barrier, or leaves the organisation unable to control the first hazardous inventory. Hold that line and first hydrocarbon becomes a managed transition. Relax it, and the startup team becomes the final uncredited safeguard against every defect the project carried across the boundary.

FEEC supports commissioning planning, PSSR facilitation, startup procedures, and independent readiness reviews for new and modified oil and gas facilities. Talk to a principal about commissioning and startup readiness.