SIX WEEKS BEFORE STARTUP:
A FUNCTIONAL SAFETY ASSESSMENT ON AN LNG PROJECT

On a capital project of this structure, the safety lifecycle is executed by four organizations and the evidence ends up living wherever each organization filed it. The hazard analysis sat with the operator. The SIL determination sat partly with the operator and partly with the EPC contractor. Device certification and failure data sat with the vendor. Logic configuration, factory acceptance testing and site acceptance testing records sat with the integrator. Each party held a coherent set of records for its own scope and nobody held a continuous chain across the lifecycle.

That fragmentation creates a specific problem at the pre-startup assessment, which is not an engineering review but a demonstration of lifecycle completeness. The assessor has to confirm that the hazards identified at the start are addressed by the functions specified in the middle and verified by the testing at the end, with traceability between them. A gap anywhere in that chain cannot be closed by any one organization, because none of them can see the whole chain.

The timeline made the work unusual. Six weeks before commissioning, the remedy for a finding cannot be an engineering change in most cases. It has to be either documentation that already exists and has not been collected, or a defensible operating restriction carried into startup and resolved later. Distinguishing those two categories quickly was the central task, because an assessment that produced a long undifferentiated finding list at that point in a project is unusable.

Arista Cyber ran the assessment to triage findings by what could actually be done in the time available, consolidating evidence across all four organizations into a single traceable chain.

The functional safety assessment was completed before commissioning and the train started up on schedule. The operator holds a consolidated safety case covering the full lifecycle, with traceability from each identified hazard through to the test record demonstrating the corresponding function works.

The triage step was what made the timeline achievable. The large majority of findings were documentation gaps: evidence that existed inside one of the four organizations and had simply never been transferred to the operator. Those closed by collection rather than by engineering, which is fast. A smaller set were verification gaps, where a calculation or a test record was genuinely absent and had to be produced, which was achievable in the window because the underlying engineering was sound. Only a handful were engineering items, and those became documented operating restrictions carried into startup with named owners and dates rather than open questions.

The consolidation has a value that outlasts the project. Contractors demobilize after commissioning, and the window in which their records can be obtained closes with them. An operator that reaches its first regulatory inspection or its first safety-related incident holding a complete lifecycle evidence package is in a materially different position from one that must request records from an EPC contractor years later. The operator also now has the baseline against which future modifications are assessed, which means the next management of change starts from a documented position rather than reconstructing one.