botminds.aiRequest a demo
SystemProduction Operations & Oil Sands

Safety System Bypass Management

Safety system bypass management that compares your bypass register with the control system twice a shift, and puts a named person on every key.

See the demoBook a demo
Follow the night from 02:08 to 02:52 ↓
The problem

The bypass register and the panel are two lists nobody compares

The register says what was agreed. The control system says what is actually out. At handover the off-going operator reads the register to the on-coming one, and both glance at the panel's bypass page. A maintenance bypass set at an engineering station shows on neither, so it is never handed over.

Long-standing bypasses get renewed by signature without anyone reopening the reason. The register is audited by hand every couple of weeks, and by then the job a bypass was set for has often closed. The cost of being wrong is a trip that does not trip.

Built forInstallation managersControl room operatorsInstrument techniciansProcess safety auditors

The Problem Today

The bypass register and the control system drift apart, so a trip can sit out for days with nobody watching it.

3
reasons a rule allows a bypass: startup, maintenance, testing published
5
platforms in one regulator's review; some not recording fully published

Kept by hand today

  • Requests
  • Registers
  • Handovers
  • Panel looks
  • Hidden at the stationSet at a workstation, it can miss the panel list
  • Renewed, never rereadLong-standing bypasses ride through handover after handover

The Solution

  1. Each bypass a keyEach one hangs by site and zone, with the person who watches it
  2. Checked against the panelTwice a shift, each live device on the control system matched to a key
  3. Mismatch to a personThe likely job is cited and the supervisor asked, on a clock
  4. Removed on factReading checked first, removed, then shown out of bypass by the next read

Built-in controls

  • Agents never apply or clear a bypass
  • No bypass without a named person watching it
  • Long-standing keys need a weekly second signature

What You Get

Managers can show, shift by shift, that what is out was agreed, is watched and is on its way back.

  • Fewest out at onceRequests read against what is already out on the machine
  • Handover that holdsSign-out waits until each key is accepted by name
  • Evidence on requestChecks, signatures and removals in one export
One night shift, by the clock

Safety system bypass management on the first night the panel is read

The platform's read-only control system feed joined the shift check the evening before. At 02:10 it is compared with the bypass register for the first time.

demoThe platforms, the crew, the tags and the readings are invented for this sample.

  1. 0102:08

    47 keys on the register, 49 bypasses live on the control system

    Control room operator

    The key cabinet hangs each active bypass as a key, one board per installation and one rail per zone. A key shows the device, what it does, who watches it and how long it has been out. The header already shows two more live than keys. Nobody can say which two from the register alone.

  2. 0202:10

    A hatched key appears on the compression rail with no monitor

    Control room operator

    The check reads 31,400 devices on six installations and matches each live function to a key. On this platform, two trips are out with no key at all: the low and high pressure trips on one transmitter, both from a single maintenance bypass set at an engineering station. Out 11 d 4 h, across 22 handovers. Nobody saw it.

  3. 0302:11

    The job it was set for closed eleven days ago, with no bypass line

    Night production supervisor

    The agent links the likely job and cites it: the transmitter was replaced like for like and loop checked, the work order completed and its permit closed. No bypass entry is referenced on the order. The agent puts its confidence in the job at 92% and asks the night supervisor, who can still walk down and look, to answer by 02:40.

  4. 0402:19

    The supervisor answers in his own words, and nobody pretends to read them

    Night production supervisor

    He picks the job is finished and writes what he knows: changed and loop checked under the closed work order, nothing needs the bypass now. His sentence is marked as not compared, for a person to read; agents do not judge free text. From here the installation manager has until 03:10 to decide.

  5. 0502:27

    Hold it with a named monitor, or order the maintenance bypass off

    Offshore installation manager

    The order buttons stay off until she opens the record. It lays out what the control system shows: both functions out, where and when they were set, the closed permit, and three trips out on the same compressor where the rule allows one. Holding needs an open job on the transmitter, so she orders removal with the code job closed, not needed.

  6. 0602:38

    Gauge 340, feed 338: 2 psi apart, inside the 6 psi tolerance

    Instrument technician

    Before the bypass comes off she reads the local gauge, so taking it off does not trip the compressor. The screen shows the sum, 0.3% of span, and that both readings sit inside the 170 to 405 psig trip band. It says what it compared and stops there: taking it off is her call at the station.

  7. 0702:52

    Out of bypass at 02:52, 42 minutes after the find

    Instrument technician

    She removes both functions at the engineering station at 02:46. The next read shows both out of bypass, a record of the bypass and not a proof of the trips. The key is registered as found, not registered, removed, and closed. A process safety event opens for the technical authority, and a follow-up goes onshore: show station bypasses on the operator page.

  8. 0802:52

    47 keys, 47 live, and a header that says only one transmitter was re-read

    Offshore installation manager

    Register and control system agree again. Its header claims no more than happened: only the one transmitter was re-read, the last full read was at 02:10 and the next is at 05:30. On the cabinet, the event stays open until the technical authority closes it.

  9. 09At any time

    The night on one trail: the read, the answer, the order and the removal

    Process safety auditor

    The trail reads the night in order: the full read, the mismatch, the cited job, the supervisor's answer, the order, the reading, the removal, the event and the follow-up. The auditor can filter by installation and person, and export exactly the lines on screen. Nothing on the trail can be edited, and the auditor can change nothing.

Where the 340 psig reading sits between the two trips it feeds

One transmitter feeds a low and a high pressure trip on the compressor's suction scrubber. These are the numbers the technician reads before taking the bypass off.

PointValueWhat it means here
Low pressure trip170 psigTrips the compressor below this
Operating pressure340 psigNormal suction pressure
High pressure trip405 psigTrips the compressor above this; the job did not need it bypassed
Relief valve set450 psigThe vessel's design pressure
Feed against local gauge338 against 3402 psi apart, 0.3% of a 0 to 600 psig span
Reading tolerance6 psi1% of span; a bigger gap fails the reading and goes to the manager

demoSample data, from the working solution. A maintenance bypass on the transmitter took out both trips, though the job needed only the low one.

Around the cabinet

The bypass register, by machine, by age and by rule

What the technical authority, the installation manager and the auditor open when the night is over.

Fewest outTrips out on one machine and gas detectors out in one module. A new request is refused where it would break either limit.
Check historyFour checks a day on each installation since it joined: 2,618 this year and 32 mismatches found, each settled with a time.
Long-standing keys36 keys under 72 hours, 6 to a week, 4 to a month, 1 past it. The weekly renewal stays locked until the drawn sample is opened.
One key, in fullA high temperature trip out while a thermocouple is replaced: the reason, the job, the monitor, and what the crew watches by hand meanwhile.
The installation manager's queueEach item opens before it can be signed, with the time it must be decided by. Other installations' items are shown read only.
RulesMost rules are locked, among them the allowed reasons, the named monitor and agents never clearing a bypass. The two that can change need a proposer and the technical authority.

demoSample data, from the working solution.

Applying, holding and clearing a bypass stay with the crew

The agents read the panel, compare and ask. These stay with people on the installation and onshore.

No agent clears a bypassThe panel reader only reads a read-only feed. A technician takes a bypass off at the station.
No key without a watcherEach key names a monitor, and the approver can never be the monitor.
A found bypass needs a decisionThe installation manager orders it off or holds it. Holding needs an open job on that device and the technical authority's countersignature.
Free text goes to a second personAn answer, a reason or a piece of evidence is marked as not compared, and reaches a second person word for word.
Long-standing means a second namePast a week the technical authority signs, and past a month a temporary change is on file as well.

Who raises, approves, watches and removes a bypass

Each role reads something different first.

Control room operator
Sees
The cabinet and the keys he watches
Signs
Raises a request and applies an approved one at the panel
Night production supervisor
Sees
Each mismatch with its likely job and cited records
Signs
Answers in his own words while he can still look
Offshore installation manager
Sees
The full record, opened before any order button works
Signs
Approves first, extends within limits, and settles each mismatch
Instrument technician
Sees
The feed against the local gauge, and the trip band
Signs
Takes the bypass off at the station when the reading checks
Onshore technical authority
Sees
Long-standing keys, process safety events and proposed rule changes
Signs
The second signature past a week, on holding a found bypass, and on settings

Six records the reconciler reads before it asks anyone

All read only. Nothing is written back to the control system feed.

Control system feedEach bypass, inhibit, override and maintenance bypass, by device and function
Bypass registerKeys, monitors, approvals and their clocks
Maintenance systemWork orders on the device, open or closed
Permit to workThe permit behind the job, and whether it names a bypass
Shift logWhat the crew wrote when the device misbehaved
Cause and effect chartsWhat each trip does, from the document system

What installation managers ask about safety system bypass management

What is safety system bypass management?

Safety system bypass management is how a site controls trips, detectors and shutdown valves taken out of service on purpose, for startup, maintenance or testing. Here each bypass is a key with a named monitor, and agents compare the register with a read-only feed of the control system at each check.

Our safety system already logs its bypasses. What does this add?

The safety system's own bypass and override management records what is out. This compares that record with the register people agreed, device by device, names each mismatch, links the likely job and asks the right person. It does not apply or clear anything.

Does it cover inhibits and overrides, and maintenance bypasses set at an engineering station?

Yes. The feed reads bypasses, inhibits, overrides and maintenance bypasses by function, so a bypass set at a station that does not reach the operator's summary page still shows up as a key with no monitor.

What stops one person approving and watching the same bypass?

The approver cannot also be the monitor, nobody approves their own request, and an installation manager's own request goes to the onshore technical authority.

What happens at shift handover?

Each key is listed for the on-coming monitor, who accepts it after opening it or refuses it with a reason. The off-going sign-out is held until no key still names the person leaving.

Does it keep interlock bypasses to the fewest at once?

It checks each request against what is already out on the same machine, vessel and zone, flags a maintenance bypass that takes more functions than the job needs, and refuses a reason the rule does not allow, such as a nuisance trip.

Is the removal proof that the trip works?

No. The read after removal shows the function out of bypass. It is a record of the bypass, and the screens say so.

Production Operations & Oil Sands

Other production operations solutions

All 8 solutions →
Operating Procedure Management

Procedures that match the plant, and a yearly signature that says what was read.

1-min demoTailings Management Reporting

Tables tied to their surveys and read as an outsider would, before they go public.

1-min demoTailings Dam Safety

Findings pinned to their place on the dike, and the ones that keep coming back raised by name.

1-min demo

Bring last month's register
and a panel export.

We will compare them device by device and show you which bypasses have no key and which keys have no bypass.

Book a demoBrowse solutions