A Bypassed Protection Is a Changed Risk

A temporary bypass has an operational meaning

A trip is bypassed so maintenance can proceed. Production stays steady, the control room remains quiet, and the job appears routine. Yet the plant is now operating with a different protection arrangement. The safeguard that would normally respond to a particular hazardous condition may be unavailable when that condition develops.

This is the central message of Process Safety Lesson 2: a bypass changes risk even when it does not change production. Temporary does not mean insignificant. The team must understand what protection has been removed, what exposure remains, and what conditions make continued operation acceptable. A calm shift provides no substitute for that assessment.

Identify the function, not just the equipment tag

A bypass, override or inhibition can affect different parts of a protection system. Depending on the design, it may suppress an input, prevent a protective action, or disable a response. These terms are not interchangeable across installations. Start with the approved cause-and-effect information and equipment documentation to establish exactly what the proposed change will do.

Ask which hazardous scenario the affected function addresses. Does it stop an inflow, isolate equipment, detect a release, or initiate another protective response? Confirm the scope: one channel, one function, or several connected functions. A register entry that says only 'instrument under maintenance' leaves the incoming team without the information needed to judge the operating consequences.

Hypothetical example: a separator level trip

Imagine a separator whose independent high-high liquid level trip is bypassed while a fault is investigated. Its normal level controller continues working, so the displayed level stays within the usual range. If a subsequent failure causes the level to rise, the bypassed trip cannot provide its intended response.

This is an illustrative scenario, not a report of an event at Bonga or another installation. The consequences and remaining safeguards depend on the actual design and hazard assessment. Its purpose is to separate two questions: is the process currently controlled, and is the required protection available if control fails?

An operator may propose watching the level more closely. That suggestion needs assessment, not automatic acceptance. A person must detect the deviation, recognise its significance and intervene within the available time. Workload, alarm presentation, communications and access to a suitable intervention all influence whether the response is credible.

Assess the change before applying the bypass

Use the site's approved impairment and change-control arrangements before altering protection. The review should establish the affected hazard, the technical reason, remaining safeguards, applicable operating restrictions and responsibility for restoration. Include operations and the competent technical personnel required by the local procedure.

HSE's control-system guidance identifies authorisation, security, recording, monitoring, review and reset requirements as elements of override management. OSHA's management-of-change provisions address technical basis, safety impacts, procedure changes, duration and authorisation for covered US processes. These are reference principles; their legal applicability differs by jurisdiction. Follow the requirements governing your installation.

A work permit does not, by itself, demonstrate that operating with reduced protection is acceptable. Confirm how the permit, impairment approval and any management-of-change review connect. If the risk assessment cannot justify continued operation within defined conditions, the affected operation must be restricted or stopped through the authorised process.

Make temporary controls specific and credible

'Monitor closely' gives little guidance about what must happen. An approved temporary arrangement should identify the parameter or condition to monitor, who monitors it, the required frequency or continuity, and the response to an abnormal condition. Any operating limit must be clear enough for the shift to recognise when it has been reached.

Additional measures might include a reduced operating envelope, limits on simultaneous activities, or other independently effective safeguards. Suitability is installation-specific. Do not assume that another alarm, a second measurement, or extra staffing provides equivalent risk reduction. Shared dependencies and the time available for action require competent review.

The restrictions must also be practical. If they depend on a dedicated person, confirm that person remains available throughout the exposure. If another task removes that resource, reassess before continuing. A control described in an approval but absent in the field cannot support the operating decision.

Keep ownership visible across every shift

An impairment can outlast the maintenance task or the shift that approved it. Hand over the function affected, the reason, the approval status, operating restrictions, review deadline and restoration owner. Ask the incoming operator to explain what would change during an upset; this exposes gaps that a signature alone may miss.

Reconcile the authorised register with the actual system indication and maintenance status. Investigate discrepancies rather than assuming one record is correct. Review overdue entries and repeated extensions. A bypass that becomes familiar still requires the same attention to its operational significance.

Reassessment triggers include an additional safeguard failure, a change in operating conditions, unavailable temporary controls, or a delay beyond the approved duration. Escalate through the designated route and follow the site's requirements for restricting or stopping operation. Do not extend the arrangement informally because nothing adverse has happened.

Restoration requires evidence

A completed repair does not necessarily mean a restored protective function. Temporary settings, inhibits or associated restrictions may remain. Follow the approved return-to-service process to remove the authorised bypass, complete the required functional checks and confirm the equipment meets its acceptance criteria.

Record the evidence, communicate the confirmed status and close the impairment through the responsible authority. Testing itself must be planned so it does not create uncontrolled exposure. Where restoration cannot be confirmed, keep the impairment visible and retain the applicable restrictions. An administrative closure cannot restore a missing safeguard.

A practical conversation for today's shift

Select one active impairment and ask: what protection is unavailable, which hazard does it address, what makes current operation acceptable, and who will verify restoration? Use actual approved records and resolve missing information with the responsible supervisor.

Discussion starter: If the initiating failure happened now, could we explain precisely how the plant would be protected with this bypass in place?

Daily action: Trace one bypass from authorisation through temporary controls, handover and restoration planning. This article provides general learning; operational decisions require approved site procedures and competent assessment.