Commissioning Risk Why Finished Construction Is Not Yet a Safe Operating Facility
A newly built facility can look deceptively complete. The steel is up, cables are pulled, valves are tagged, scaffolds are coming down, and turnover packs are moving through the system. Yet from an HSE standpoint, this is often when the risk picture becomes less stable, not more.
Commissioning and start-up move a project from static construction into dynamic operation. Systems that were inert yesterday may be energized today. A line that held air or nitrogen during testing may soon contain hydrocarbons, steam, acid, caustic, or process chemicals. Rotating equipment begins to move. Electrical systems carry fault energy. Control logic and interlocks shift from drawings to real behavior. Temporary bypasses, construction punch items, and incomplete documentation still exist, often beside operators who are learning a new plant under schedule pressure.
This is why “construction complete” is not the same as “safe to operate.” The gap between those two states has contributed to serious events across high-risk industries. Official investigations by bodies such as the U.S. Chemical Safety and Hazard Investigation Board, OSHA, UK HSE, and others repeatedly show that start-up, maintenance return-to-service, and abnormal operating phases can expose weaknesses that remain hidden during normal project execution.
Commissioning risk deserves its own management discipline. It sits across project controls, engineering, operations, maintenance, process safety, contractor management, electrical safety, control of work, emergency response, and leadership decision-making. Treating it as a paperwork handover problem misses the point.
Commissioning Changes the Hazard Profile Faster Than Many Systems Can Track
Construction risk is often visible. People work at height, lift heavy components, cut, weld, excavate, and install equipment. Control measures tend to be task-based and familiar: lift plans, hot work permits, confined space controls, scaffold tags, excavation permits, and isolation certificates.
Commissioning risk is different. It is not always visible and it changes quickly.
A system may pass through several risk states in a single shift:
Project State | Typical Assumption | Actual HSE Concern |
Mechanically complete | Construction is finished | Punch-list items, missing guards, open drains, incomplete labeling, unverified torque, and temporary supports may remain |
Pre-commissioning | The system is still low risk | Pressure testing, flushing, chemical cleaning, pneumatic energy, and temporary hoses can create high stored-energy exposure |
Energization | Equipment is ready for power | Electrical fault energy, unexpected start-up, control logic errors, and incomplete isolation boundaries become critical |
Introduction of process media | Operations has control | Hydrocarbon, chemical, thermal, pressure, and toxic exposure risks become active, sometimes while construction continues nearby |
Start-up and ramp-up | The plant is operating | Alarms, trips, procedures, staffing, competence, and emergency response are tested under real conditions |
During construction, the boundary between “live” and “not live” is often simple. During commissioning, that boundary becomes fluid. One skid may be hydrotested. The adjacent pipe rack may be energized. A downstream vessel may be under nitrogen. A nearby contractor may still be grinding structural steel. Field crews can walk from a construction environment into an operating environment without crossing a fence line or realizing that controls have changed.
This is where conventional HSE systems can lag. A permit-to-work system may still be organized around work packages, while commissioning is organized around systems and sub-systems. A project schedule may show percent complete, while the risk profile depends on system status, isolation configuration, energy state, chemical state, and control authority. A dashboard may show low injury rates, while the facility is moving into its first exposure to major accident hazards.
The professional interpretation is clear: commissioning is a transition risk problem. It requires live configuration control, not just compliance with construction HSE routines.
Finished Construction Can Still Hide Major Accident Conditions
The belief that most risk declines after construction is only partly true. Personal injury exposure from high-volume construction work may reduce as headcount falls. At the same time, major accident potential can rise sharply as hazardous energy and process inventories enter the plant.
Several investigation findings support this view.
The CSB investigation of the 2005 BP Texas City refinery explosion identified start-up of the raffinate splitter as the immediate operating context. The investigation described overfilling, loss of containment from the blowdown system, alarm and instrumentation problems, trailer siting, and deeper organizational and process safety weaknesses. The event was not a simple “operator error” story. It showed how start-up conditions can place heavy demands on procedures, instrumentation, supervision, equipment design, and organizational learning.
The Buncefield fuel depot explosion in the United Kingdom was not a commissioning event, but official investigation findings are highly relevant to start-up and filling operations. The incident involved loss of containment during tank filling, failure of high-level protection, overfill, vapor cloud formation, and ignition. The broader lesson applies directly to commissioning: when hazardous inventory is introduced, assumptions about instrumentation, alarms, independent protection layers, and operator response must be verified before the operation, not after.
Investigations into chemical, refining, offshore, rail, aviation, and energy events frequently identify degraded handover, inadequate procedures, poor shift communication, unrecognized temporary configurations, and incomplete operational readiness. These are not soft issues. They are engineering and management system issues that affect barriers.
Commissioning concentrates several high-consequence conditions into a compressed period:
Live hydrocarbons or process chemicals
Lines, vessels, pumps, drains, vents, and relief systems move from clean construction status to hazardous inventory status. Even small leaks can create flammable, toxic, corrosive, or oxygen-deficient atmospheres.
Pressure and stored energy
Hydrotesting, pneumatic testing, leak testing, steam blowing, nitrogen purging, and first pressurization can expose weaknesses in flanges, blinds, hoses, temporary fittings, and supports.
Electrical power
New switchgear, motor control centers, transformers, UPS systems, battery rooms, temporary feeds, and backfeeds create arc flash, shock, and unexpected start-up risks. NFPA 70E and OSHA electrical safety expectations become central, not secondary.
Rotating equipment
Pumps, compressors, fans, turbines, conveyors, winches, and drives introduce mechanical movement, vibration, overspeed, lubrication failures, coupling hazards, and guarding issues.
Chemical introduction
Chemical cleaning, catalyst loading, process chemical transfer, dosing systems, and first fills may involve unfamiliar materials, incompatible residues, and temporary storage arrangements.
Temporary systems
Temporary bypasses, jumpers, hoses, generators, test panels, scaffolds, blinds, vents, drains, and control overrides may be necessary. They also increase configuration complexity and can outlive their intended use.
Incomplete punch-list work
A punch item that seems minor during construction can become safety critical after energization. Missing labels, incomplete insulation, damaged cable glands, uncalibrated transmitters, open drains, missing valve handles, and unfinished supports may no longer be minor once the system is live.
This is the trap: construction completion often measures installation, while safe operation requires verified barrier function.
Rapidly Changing Risk Boundaries Need Clear Ownership
Commissioning creates one of the most difficult control-of-work questions in high-risk operations: who owns the system right now?
During construction, the project team and contractors usually control access and work planning. During operations, the asset team controls plant status, isolations, permits, procedures, and abnormal operations. Commissioning sits between those worlds. Ownership may shift by system, sub-system, area, voltage level, pressure boundary, or operating mode.
That creates predictable weak points.
Handover Can Become Administrative Rather Than Operational
System handover should confirm more than document completion. It should establish operational control, hazard status, isolation status, temporary equipment status, punch-list risk, drawing status, and emergency response readiness.
A turnover dossier may be complete while field reality is not. For example:
The piping test pack is signed off, but a drain valve remains open.
The motor has passed insulation resistance testing, but the driven equipment guards are missing.
Instrument loop checks are complete, but alarm rationalization or setpoint verification remains unresolved.
The red-line drawings exist in a folder, but field crews are still using an earlier revision.
A relief path exists in design, but a spectacle blind remains in the wrong position.
The practical risk is not bad paperwork. The risk is that the organization begins operating from a version of the plant that does not match the plant in the field.
API systems completion guidance, CCPS commissioning and pre-startup safety review guidance, and process safety management frameworks all point toward the same principle: safe start-up requires verified readiness of equipment, procedures, people, and safeguards.
Control of Work Must Follow the Energy State
Permit-to-work systems are often strained during commissioning because work fronts overlap. Construction crews want access to finish punch-list items. Commissioning teams need to energize and test. Operations needs stable conditions for first fills and start-up. Vendors need to troubleshoot packages. Inspectors need to verify completion.
A permit that was acceptable yesterday may be unacceptable today because the system changed state overnight.
Control of work during commissioning should answer, in real time:
Which systems are energized?
Which areas contain live process fluids, hydrocarbons, hazardous chemicals, or pressure?
Which isolations are construction isolations and which are operational isolations?
Which temporary bypasses, defeats, jumpers, or overrides are active?
Which permits conflict with commissioning activities?
Which work fronts must stop before energization, leak testing, flushing, chemical introduction, or start-up?
Who has authority to approve work on or near a live commissioning system?
UK HSE guidance on permit-to-work systems and industry control-of-work practices emphasize clear authorization, communication, isolation, and monitoring. During commissioning, these elements need extra discipline because the status of the plant changes faster than normal operations.
SIMOPS Becomes More Than a Coordination Meeting
Simultaneous operations are not unusual in construction. They become more serious during commissioning because the consequences of interference increase.
Common SIMOPS conflicts include:
Hot work near newly introduced hydrocarbons
Electrical energization while mechanical work continues in the same area
Pressure testing near access routes or occupied work zones
Nitrogen purging near open excavations or enclosed modules
Chemical cleaning beside routine construction activity
Rotating equipment runs while guards, barriers, or exclusion zones are not fully established
Crane lifts near live electrical systems or pressurized lines
Instrument troubleshooting while operations relies on those instruments for start-up decisions
A mature SIMOPS process does more than collect work permits on a board. It identifies incompatible operations, defines exclusion zones, controls sequencing, sets stop points, and assigns decision authority.
The key leadership question is simple: if two safe activities become unsafe when performed together, who is accountable for seeing that before the work starts?
PSSR and Operational Readiness Are Not Box-Ticking Exercises
OSHA’s Process Safety Management standard requires a pre-startup safety review for new facilities and for modified facilities when the modification is significant enough to require a change in process safety information. EPA’s Risk Management Program contains related prevention program expectations for covered processes. The exact legal trigger depends on the facility and jurisdiction, but from a professional standpoint the logic is broader: before introducing hazardous energy or inventory, the organization should verify that critical safeguards and operating conditions are ready.
PSSR is one of the most valuable tools in commissioning, but only when it is treated as a field-based risk control, not a clerical milestone.
A serious PSSR should test readiness across several areas.
Equipment and Safeguards Must Be Verified in the Field
This includes more than confirming that equipment was installed. It means verifying that systems needed for safe operation function as intended.
Examples include:
Relief valves, rupture disks, vents, drains, flare or vent paths, and disposal routes
Safety instrumented functions, trips, alarms, interlocks, shutdown valves, and permissives
Fire and gas detection, emergency shutdown interfaces, deluge, extinguishing systems, and access routes
Electrical protection, grounding, bonding, classification requirements, and arc flash controls
Mechanical guards, couplings, lubrication systems, seal systems, cooling water, and vibration monitoring
Pressure ratings, line blinds, spectacle blind positions, valve lineups, and correct gasket materials
Ventilation, gas testing points, sample points, and emergency eyewash or shower coverage
Functional safety practice, including IEC 61511 for safety instrumented systems, reinforces the need to prove safety functions through the lifecycle. A loop check is not the same as a validated protective function under realistic demand conditions.
Procedures Must Match Commissioning Reality
Commissioning procedures often contain temporary steps that will not exist in normal operations. That is not inherently a problem. The problem arises when temporary procedures are unclear, uncontrolled, or disconnected from the actual plant state.
Effective procedures should define:
Preconditions for starting the activity
Required system status and isolations
Required utilities, safeguards, and communications
Hold points and approval authority
Limits for pressure, temperature, flow, vibration, oxygen content, lower explosive limit readings, or chemical concentration
Criteria for stopping the activity
Abnormal condition response
Handover requirements between shifts, teams, and control rooms
Experienced teams know that procedures can fail when they are written for ideal plant conditions. Human factors research, including work by James Reason and later resilience engineering scholars, shows that people adapt procedures to match real work conditions. During commissioning, that adaptation can be useful or dangerous. The difference depends on whether the organization sees the gap, manages it, and updates the procedure before informal practice becomes the real control.
Competency Must Match the Commissioning Task
Competency during commissioning is not only job title or years of experience. A capable operator from an existing asset may still be unfamiliar with a new control system, a vendor package, a different cause-and-effect matrix, or a temporary start-up configuration. A construction supervisor may be excellent at installation work but not trained to understand live process hazards in the same area.
Commissioning competency should consider:
Familiarity with the system and its current status
Understanding of temporary configurations and bypasses
Ability to recognize abnormal conditions during first operation
Knowledge of emergency response actions
Authority to stop or pause the activity
Interface competence between contractors, vendors, commissioning engineers, and operations
This is where leadership often underestimates risk. They assume competence transfers automatically from construction or operations into commissioning. It does not always transfer without system-specific preparation.
Warning Signs That the Facility Is Being Treated as Safer Than It Is
Commissioning failures rarely announce themselves as major system breakdowns at first. They show up as weak signals, small mismatches, and repeated workarounds.
Leaders should pay close attention when these conditions appear:
Mechanical completion is being used as permission to introduce hazards without a separate readiness review.
Punch-list items are classified as minor without assessing their post-energization consequence.
Red-line drawings lag behind field changes, or more than one drawing revision is in active use.
Operations, construction, vendors, and commissioning teams disagree on who owns a system.
Temporary bypasses, overrides, hoses, jumpers, or blinds lack an owner and removal date.
Permit issuers cannot clearly describe which systems are live.
Area maps or status boards do not match field conditions.
Night shift or weekend work includes first-time energization or hazardous fluid introduction without the same technical support available on days.
Production or schedule language begins to replace readiness language.
PSSR findings are closed administratively without field verification.
Operators are trained on normal operating procedures but not commissioning procedures or abnormal start-up scenarios.
Simultaneous work is approved because each activity is safe in isolation, even though their combined risk has not been assessed.
None of these signals proves that an incident is imminent. They show that the organization’s mental model may be drifting away from the plant’s actual condition.
High-risk industries have learned this lesson repeatedly through major accident investigations. The plant does not care whether the schedule says the work is complete. It responds to physical conditions: energy, containment, control, compatibility, and human interaction with complex systems.
Practical Controls That Reduce Commissioning Risk
Commissioning risk can be managed. The methods are well known, but they require discipline and authority. The following practices are not substitutes for engineering judgment or regulatory compliance. They are practical controls that experienced organizations use to keep the risk boundary visible.
Build a System-Based Handover Process
Handover should be organized around systems and sub-systems, not only contracts or construction work packs. Each system should have a defined status, owner, boundary, and permitted work condition.
Good handover records answer:
What exactly is being handed over?
What remains incomplete?
Which incomplete items are safety critical before energization or hazardous introduction?
Which isolations, blinds, supports, scaffolds, or temporary systems remain?
Which drawings, line lists, cause-and-effect charts, and procedures are current?
Who controls future work on the system?
What must happen before the next risk state?
The best handovers include field walkdowns with construction, commissioning, operations, maintenance, and HSE representatives. Paper cannot replace walking the system.
Use Stage Gates Based on Hazard Introduction
A single “ready for start-up” gate is too blunt for complex facilities. Use stage gates tied to meaningful risk changes.
Examples include:
Ready for electrical energization
Ready for pressure testing
Ready for chemical cleaning
Ready for hydrocarbon introduction
Ready for rotating equipment run
Ready for first fire or first heat
Ready for integrated start-up
Ready for steady-state operation
Each gate should have defined acceptance criteria, required approvers, required field verification, and stop-work authority. This helps prevent a common failure mode where readiness is assumed because the previous activity succeeded.
Control Energization as a High-Risk Change
Electrical energization can turn a construction site into an operating facility in seconds. Commissioning plans should include strict control of electrical boundaries, switching authority, lockout and tagout, arc flash controls, signage, barriers, temporary feeds, backfeed prevention, and communication.
Energization plans should be treated as critical work plans. They should define the equipment affected, the sequence, competent persons, exclusion areas, emergency arrangements, test requirements, and conditions that require stopping. OSHA electrical safety requirements and NFPA 70E practices provide recognized expectations for controlling electrical hazards, but site-specific configuration is what makes them effective.
Manage Temporary Systems Like Engineered Systems
Temporary systems deserve formal design, review, inspection, and removal control. This includes temporary hoses, generators, jumpers, blinds, scaffolds supporting commissioning access, control logic changes, drains, vents, and bypasses.
A temporary system register should identify:
Purpose
Owner
Design basis or approval basis
Limits of use
Inspection or testing requirements
Interaction with permanent safeguards
Expiration or removal trigger
Required field marking
Temporary does not mean low risk. In commissioning, temporary often means less familiar, less documented, and more likely to be misunderstood.
Keep Red-Line Drawings Current and Available
Red-line drawings are not a documentation nicety during commissioning. They are a frontline risk control. Field changes affect isolation planning, lineups, lockout, emergency response, process safety information, and operator understanding.
Drawing control should prevent crews from working from outdated documents. Where digital systems are used, field access and revision status must be reliable. Where paper systems are used, the master set and controlled copies need careful management.
If the drawing does not match the plant, the isolation plan may not match the hazard.
Treat Start-Up as Abnormal Operation Until Proven Otherwise
New facilities do not begin life as stable assets. They begin as systems with unproven interactions. Alarm rates, instrument reliability, control loop tuning, equipment vibration, drains, vents, chemical quality, contamination, and operator workload may all differ from expectations.
Operational readiness should include staffing, maintenance support, vendor support, emergency response coverage, spare parts, abnormal procedure training, shift handover discipline, and criteria for backing out of start-up. It should also include what the organization will do when early operation reveals design or construction issues.
A safe start-up plan contains permission to pause.
Leadership Questions Before Declaring Safe to Operate
Senior leaders do not need to personally verify every flange, loop, or drawing. They do need to ask questions that reveal whether the commissioning organization is controlling risk or assuming readiness.
Before moving from construction complete to safe to operate, leaders should ask:
What hazardous energy or inventory will be introduced next, and what boundary changes with it?
If the answer is vague, the organization is not ready for the next state.
Who owns the system at this moment?
Ownership should be clear by system, area, and activity. Shared ownership without clear authority is a warning sign.
Which punch-list items could become safety critical after energization or hazardous introduction?
Punch-list classification should be based on operational consequence, not construction convenience.
What temporary systems, overrides, bypasses, jumpers, blinds, and hoses are still in place?
Each should have an owner, purpose, approval basis, and removal trigger.
Do field conditions match the drawings and procedures being used?
If not, work should pause until the discrepancy is understood and controlled.
What work must stop before the next commissioning step?
SIMOPS control should identify incompatible activities, not simply record ongoing work.
Have safeguards been functionally tested, or only installed and inspected?
A protective device that exists but does not perform is not a barrier.
Are operators and supervisors trained for the commissioning procedure, not only normal operation?
Start-up tasks often involve temporary actions, abnormal lineups, and higher cognitive workload.
What conditions require stopping, depressurizing, de-energizing, or backing out?
A good plan defines failure criteria before pressure, power, or hydrocarbons are introduced.
10. Is emergency response ready for the current plant state?
Response plans must reflect live hazards, access restrictions, muster points, rescue capability, and communication routes.
11. Are night shift and weekend activities receiving the same technical and leadership support?
Commissioning risk does not reduce after hours.
12. What would convince us that we are wrong about readiness?
This question helps reveal assumptions before the plant tests them.
These questions are effective because they focus on physical risk, organizational control, and decision quality. They also make it harder for schedule pressure to hide behind completion metrics.
Professional Takeaway
Commissioning is not the closing chapter of construction. It is the first real test of the facility as an operating system.
The risk boundary moves as power, pressure, motion, chemicals, hydrocarbons, and control authority enter the plant. Field conditions change faster than documents, permits, and assumptions can keep up unless the organization deliberately controls the transition.
A facility is not safe to operate because it is mechanically complete. It becomes safe to operate when its hazards are understood, its safeguards are verified, its temporary conditions are controlled, its people are prepared, and its leaders are willing to stop before the plant teaches the lesson the hard way.
Professional References and Further Reading
OSHA, Process Safety Management of Highly Hazardous Chemicals, 29 CFR 1910.119, including pre-startup safety review requirements.
U.S. EPA, Risk Management Program Rule, 40 CFR Part 68, for covered chemical accident prevention programs.
Center for Chemical Process Safety, Guidelines for Performing Effective Pre-Startup Safety Reviews and related process safety guidance.
U.S. Chemical Safety and Hazard Investigation Board, BP Texas City Refinery Explosion and Fire Investigation Report.
UK Health and Safety Executive, Guidance on Permit-to-Work Systems and major hazard control publications.
Energy Institute, Human Factors Briefing Notes and safety critical task guidance for major hazard industries.
International Association of Oil and Gas Producers, Operating Management System Framework and process safety guidance.
IEC 61511, Functional Safety for the Process Industry Sector, for safety instrumented systems lifecycle expectations.
