Many serious incidents involved a safety function that was bypassed or overridden. The calculation assumes the function is in service; every hour in bypass is an hour without it.
Types
- Maintenance override: one channel or the whole function inhibited for testing or repair.
- Start-up override (inhibit): a trip that would act during start-up (low flow, low pressure) inhibited until conditions are normal.
- Operational bypass: physically bypassing a final element (bypass valve around a shutdown valve).
Rules that work
- Bypass only under a written authorisation, with the person responsible named.
- Limit the duration and make the system remove start-up overrides automatically (by time or by condition).
- Show every active bypass in the control room and in shift handover.
- Define compensating measures before the bypass: an operator watching an independent indication, a reduced throughput, a stopped feed.
- Bypass one channel at a time in redundant groups, leaving the function active with degraded voting.
- Record and review bypass hours; include them in the periodic review of the SIF.
In the SRS
State who may bypass, how, for how long, with which indication and compensating measures, and how start-up overrides are removed. First Out AI has separate fields for "Bypass and override" and "Start-up overrides" and writes them into the SRS and the proof test preparation.
Lessons from incidents
See the knowledge articles on the Formosa Plastics (2004) and Bayer CropScience (2008) investigations, where interlocks were overridden.
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.