botminds.aiRequest a demo
WorkflowHSE, Process Safety & OT Security

Pre-Startup Safety Review

Pre-startup safety review software that tests each tick against its record, then calls each named person for go or no-go.

See the demoBook a demo
Follow the day from 04:12 to 14:20 ↓
The problem

A pre-startup safety review tick says yes, and the record behind it stays shut

A tick shows that someone said yes. It does not show that the record agrees. A class being held gets ticked, but the law counts each employee. A certificate being on file gets ticked, but the number on it may be wrong.

Opening the proof takes hours nobody has at that moment. The clock is running, the crew is in, and the same generic checklist comes out for each change.

Built forProcess safety leadsOperations managersCommissioning leadsTraining coordinatorsInternal auditors

The Problem Today

A review is a wall of ticks signed under startup pressure, and a tick never shows the proof behind it.

4
things the law says a review must confirm before startup published
Each
employee running the process must be trained first published

Checked by hand today

  • Drawings
  • Certs
  • Training
  • Actions
  • Proof in many placesDrawings, certificates and rosters sit apart
  • The clock leans on one leadPressure peaks while the crew stands waiting

The Solution

  1. Checklist from the changeLines that do not apply dropped; one added per new tag and drawing
  2. Every tick testedAgents open the record behind each tick and compare it with the design
  3. Backed, tick only or failedOnly an opened record backs an item, and a retest can fail
  4. Named people call goEach owner says go or no-go; only that person can undo a no-go

Built-in controls

  • Agents never say go; only named people do
  • Relief, training and escape items never wait
  • The person who prepares never signs

What You Get

Startup happens on evidence, and what is wrong comes out while it is still cheap to fix.

  • Every call on one recordName, time and reason for each go or no-go
  • Carried items stay on a clockWhat waits has an owner, a date and a chaser
  • Evidence ready for auditOne download holds every item, its record and its checker
One day, by the clock

04:12 to 14:20: one pre-startup safety review, hour by hour

A third inlet filter separator is going into a sour gas unit, and the train is due back at 06:00. Here is that day, on the working screens.

demoThe plant, the crew and the figures are sample data.

  1. 0104:12

    Under two hours to startup, and all 86 items ticked

    Pre-startup review lead

    The roll call opens on a dark band: a countdown, 86 tick marks by station, and below them the five stations in calling order. The startup crew comes on at 05:00, so the roll cannot open before then. That leaves time to test the ticks, which at this hour rarely happens.

  2. 02From the change

    A PSSR checklist that started as 92 template lines

    Checklist builder

    The checklist builder took the site template, dropped 54 lines with a reason for each, kept 38 and added 48 for the new tags, drawings and procedures in this change. That makes 86 items, each naming the record that should back it. A line tied to a rule stays, and the sum across the top can be checked by anyone.

  3. 0304:19

    By 04:19, six ticks have no record and three fail against theirs

    Pre-startup review lead

    Agents open 80 records in seven systems. Back come 77 backed, 6 tick only and 3 failed. Backed means the record agrees with the approved value, and most of those 77 are read by no person. The log on the right shows the plan, each hand-off and each finding with its citation. By hand this reading takes about nine hours, on our estimate.

  4. 0404:19

    Roster 14, class record 11

    Training coordinator

    The training checker reads names, crew by crew. Two operators on the startup crew have no record: one moved over after the last class and one was on leave that week. A third, on the night crew, was on light duty. The coordinator can see at a glance who, why, and that a make-up class has to be the same three hours as the first.

  5. 0504:19

    The redline nobody raised a change for

    Commissioning lead

    The drawing shows it in red: a 1-inch drain added in the field, past the dump valve, into the flash drum line. Open, it could pass about 27,900 lb/h against a relief rated at 4,120, and the earlier relief check missed it. Beside the drawing, the table of approved against built values flags the relief valve as well.

  6. 0605:08

    One no-go, and the roll stops where it stands

    Commissioning lead

    The lead calls the roll at 05:05. Construction answers first, and answers no-go, in typed words. Four stations now read waiting, not called. They cannot be skipped and the clock cannot call for them. The running log keeps the exchange, and the next step on the screen moves to the startup authority.

  7. 0705:12

    The owners’ sum rules out noon, so startup moves to 14:00

    Operations manager

    A go is not open to the manager while a no-go stands. The manager’s final call sets out the owners’ estimates for the valve job, the drain and the class, then a choice of 14:00 or 18:00, with a typed reason. Noon is missing from the list, since the class cannot finish before 12:30. So the crew gets a time that someone worked out.

  8. 08Morning

    The first bench sheet comes back at 1,488, and stays rejected

    Inspection lead

    Pulling the valve under a line break permit reopens what stood on it: joints, purge, seal, permit and schedule. The first bench sheet is outside the 1,397 to 1,483 band, so the item stays failed. A second sheet at 1,436 passes and goes to the process safety engineer, because the person who brings a record cannot check it.

  9. 0913:20

    The record is read, then go is signed for 14:00

    Operations manager

    Five stations call go between 13:02 and 13:14, each with its own reason, and the lead marks the review ready. The record shows both no-gos from the morning, each carried item and its signers, and the count nobody usually writes down: a person read 23 backed items and only the agent read the other 61. It ends at 84 backed and 2 after startup.

14:00, and no earlier: the owners’ own sum

After the second no-go the screen adds up what each owner says the fixes will take. The class cannot end before 12:30, so noon is not offered.

WorkOwner’s estimatePlan
Valve job on the site bench5.75 to 7.25 h05:40 to 11:55
Drain: change, relief check, blind, spool test, line-up3 to 4 h05:50 to 09:10
Class, same three hours, after the new line-up3 h09:30 to 12:30
Second-person checks, second roll, read the record40 min12:40 to 13:20

demoSample data, from the working solution. The earliest go is about 13:20, so 14:00 leaves 40 minutes.

Around the review

What the rest of the PSSR team works from

Six more screens from the same review and the ones around it. Open one to read it at full size.

Must fix or can waitAlmost nothing can wait. The two items that could each need a typed reason, an owner, a date, a second signature and the startup authority.
Carried past startupWhat waited keeps a clock until a record closes it and a second person agrees. An overdue item stops the go at that plant.
Audit trailEach tick, test, call and setting in order, with the person or agent on each line. Nothing can be edited; the evidence pack holds each item and its record.
SettingsThe lead proposes and the startup authority signs. Relaxing a rule takes a second signature and only applies to the next review.
All reviewsAbout 640 reviews a year across three sites, with batches of like-for-like short reviews that two people sample before close.
What needs a reviewEach incoming change with the form the agent proposes. A person rules, and a ruling below the agent’s form takes a second signature.

demoSample data, from the working solution.

Who calls go or no-go, and what each one reads first

Any no-go stops the roll, and only the person who called it can call again. The agents have no vote.

Pre-startup review lead
Sees
Each item marked backed, tick only or failed, with its record
Signs
Prepares the review and calls the roll, with no signature of its own
Commissioning lead
Sees
What was built against what was approved: redlines, certificates, datasheets
Signs
Go or no-go for construction items
Training coordinator
Sees
The roster against the training record, name by name
Signs
Go or no-go for training items, with someone else checking each fix
Process safety engineer
Sees
Hazard actions and change conditions
Signs
The second signature on any moved item or rule
Operations manager
Sees
The full record, which must be opened before the go button appears
Signs
The final call, and any new startup time
The agents

Seven agents read the records, and none may call go

Each has one job and a limit it cannot pass.

Change reader

Reads each approved change and proposes long form, short form or none.

  • Never rules a change safe
Checklist builder

Drops and adds lines from the change, with a reason for each.

  • Never drops a line tied to a rule
Claim tester

Opens each record and marks the item backed, tick only or failed.

  • Never marks backed without an opened record
  • Never calls go
Built against design

Compares redlines, certificates and datasheets with what was approved.

  • Never accepts a difference
Training checker

Reads the roster against training records, by name.

  • Never marks anyone trained
Action chaser

Follows open actions and proposes must fix or can wait.

  • Never proposes waiting for locked kinds
Record clerk

Writes the record from what people called, and runs the follow-up clocks.

  • Never writes a call for a person

What the agents leave to people at a plant startup

Seven agents read and compare. These calls stay with named people.

No agent says goThe claim tester marks items. Only a person on the roll calls go or no-go, and any no-go stops the roll.
A change is never ruled safeThe change reader proposes long form, short form or none. The review lead rules.
Backed needs an opened recordAn item cannot be marked backed from a tick. Where no record exists, it stays open and the review stays held.
Nobody is marked trained by softwareThe training checker reads the roster against the records by name, then hands the gaps to the training coordinator.
Locked items have no way to waitRelief, training, pressure tests, hazard actions, drawings, escape routes and flow paths must be fixed before gas in.

Seven systems behind one pre-startup safety review

Each one is read only. An item counts as backed only when its record has been opened.

Change recordsThe approved change and its attachments
DocumentsDrawings, redlines and datasheets
CommissioningTest records and turnover sheets
MaintenanceCertificates and test records for the equipment
Hazard studiesHazard study actions
TrainingTraining records, name by name
Shift rosterWho is on shift for the startup

What process safety leads ask about a pre-startup safety review

What is a pre-startup safety review?

A pre-startup safety review, or PSSR, is the last check before gas or chemicals enter a new or changed process. This solution reads the change, builds the checklist from it and opens the record behind each tick. Each named person then calls go or no-go, and the operations manager makes the final call.

What must a PSSR checklist confirm before startup?

Four things: construction matches the design; safety, operating, maintenance and emergency procedures are in place and adequate; hazard analysis or change requirements are met; and each employee’s training is complete. Here the checklist is built from the change itself, so lines that do not apply drop out, with a reason, and one is added per new tag and drawing.

What happens at startup time if nobody has said go?

Nothing starts by default. The review shows as held, and only the startup authority can set a new time. A go can be withdrawn by anyone on the roll until the board logs gas in.

Can the rules change during a review?

They cannot relax during one. The lead proposes a change and the startup authority signs it. Relaxing a rule takes the process safety engineer as well and applies to the next review only. What must be fixed first, and who can overrule a no-go, are locked.

What does tick only mean on a PSSR?

The item was ticked, and the agents found no record behind it. In the sample, a scaffold sign-off, hanger travel stops and a temporary strainer come back this way. The owner brings the record, or for the few items allowed to wait, a typed reason, a second signature and the startup authority’s agreement.

How does this fit with management of change?

The review starts from the approved change. The change reader proposes long form, short form or none, and a person rules on it. A new change raised during the review, such as one for a field-added drain, reopens the items that stood on the old drawing.

What if a system of record goes down during a review?

In the sample, taking the training system offline stops the training items, blocks any go and withdraws one that stands. Nothing is marked backed while its source cannot be read.

Do people still read the records?

Some of them, and the record says which. The lead opens a sample of backed items and agrees to each. Each fix has a named second person. The go record states how many items a person read and how many only the agent read, so nobody assumes more checking than happened.

HSE, Process Safety & OT Security

Other process safety solutions

All 10 solutions →
Major Accident Hazard Reporting

Sentences with owners, and numbers open to the records behind them.

1-min demoSafety Case Management

Claims re-tested against current records each night, so drift shows up the next morning.

1-min demoBarrier Management

Every barrier shows what its records say, with the sentence that proves it.

1-min demo

Try it on a change
you already closed.

We’ll walk you through the record behind each tick, using your own change and its evidence.

Book a demoBrowse solutions