ModulesBypass ControlWork Control
Every defeated protection, on a clock.One bypass record, from the request to the check that it works again.
For operations, instrument and process safety teams: trips, interlocks, safety alarms and machine guards defeated for a test, a repair or a start-up go into one register, with one clock, a named approver and the measures that stand in while the protection is down.
- First applied
- 18 Nov 2026 · 13:10
- Limit
- 18 Nov 2026 · 21:10
- Reading
- Within limit · 5 h left
| Compensation | Owner | State |
|---|---|---|
| Operator reads LI-201 locally every 30 min and logs it | Ana Ribeiro | Check due 16:30 |
| Inflow to T-201 limited to one pump | Ana Ribeiro | In place |
- Nearby work
- PTW-2026-0142 · Hot work on T-201 · Active
- Barrier
- SIF-201 · Out of service while active
One bypass, three states. Switch the state: nothing is retyped. An example bypass; the fields are the product’s, the values illustrative.
Where it connects
On the same record: Permit to Work, Management of Change, Shift Handover and 38 more modules in one workspace.
Method note
One signature or two? It depends on what else is down.
Bypass procedures differ most on who approves, and when a second person must sign.
Leandro · Founder, UProcess
Some plants let a shift supervisor approve any bypass, because speed matters at 3 a.m. Others ask for a second, senior signature whenever the protection is critical or the bypass outlives the shift. Both are defensible. What neither can defend is a second bypass on the same equipment that nobody connected to the first.
So the company chooses when a second approval applies, and one rule stays fixed.
- One approverA named site approver who is not the requester. The default for routine test bypasses.
- Two when it mattersA senior approver too when the protection is critical, the bypass crosses a shift change, or another bypass is live on the same tag, scenario or threat line. Each rule can be switched off.
- Always two to extendThe one extension always needs a senior approver. This rule cannot be switched off.
Where Bypass Control usually breaks
Four places a bypass goes wrong, and what the record does about each.
A defeat that leaves no trace.
At a PVC plant an operator overrode a valve interlock with an emergency air hose and opened a reactor that was still running. Five workers died. The board found the override could be used without any physical control.
Source: U.S. Chemical Safety Board, Formosa Plastics
In UProcess Every live bypass shows on the board, sets the barrier element to Out of service or Impaired, and appears in the risk context of every permit on the same tag.
Where BYP-2026-0007 shows while active
The start-up bypass everyone knows about.
At a pesticide unit, a safety interlock was bypassed during a rushed restart, as had been done in previous operations with managers’ knowledge. The runaway that followed killed two workers.
Source: U.S. Chemical Safety Board, Bayer CropScience
In UProcess Each reason carries its own limit, and the clock runs from the first application without restarting. One extension, then restore or propose an MOC temporary change.
BYP-2026-0012 · XV-305 start-up permissive
- First applied
- 16 Nov 2026 · 06:00
- Limit
- one shift · 18:00
- Extended once
- to 17 Nov 06:00 · Sofia Rossi
- Past limit by 5 h
- 17 Nov 11:00
- MOC-2026-0041
- in review
The clock never restarts. After the one extension: restore, or propose an MOC temporary change.
Authority to bypass, without the knowledge.
At a sterilisation plant a maintenance supervisor authorised technicians to skip a critical safety step without understanding the process hazards. Four employees were injured in the explosion.
Source: U.S. Chemical Safety Board, Sterigenics
In UProcess Approvers are named per site as approver and senior approver, never the requester. Approval needs at least one compensatory measure, and an overdue check reads Compensation not in place.
Approve · BYP-2026-0007
Second approval needed: the protection is safety critical
- Requested by
- Carlos Mendes
- First approval
- Daniel Kim · Approver
- Second approval
- Sofia Rossi · Senior approver
- Compensation
- 2 measures · 1 periodic, every 30 min
Shown when a periodic check is overdue or says the measure is not in place
A failed instrument is a bypass nobody approved.
At a fuel terminal the tank’s level transmitter was out of service and the gauging was poorly maintained, so filling ran on estimates. The tank overflowed and the vapour cloud exploded.
Source: U.S. Chemical Safety Board, Caribbean Petroleum
In UProcess A protection found failed is recorded with the reason Failed test, awaiting repair. It gets the same clock, compensation and MOC path as a deliberate bypass.
BYP-2026-0014 · LT-409 level transmitter
- Reason
- Failed test, awaiting repair
- Opened from
- Barrier Management · Record as unavailable
- Extent
- Partly degraded
- Reading
- Within limit · 61 h left
Same clock, compensation and MOC path as a deliberate bypass.
Bypass BYP-2026-0007Target LSHH-201 · SIF-201Reason Proof test · limit 8 h
| Time | Step | By | Signature |
|---|---|---|---|
| 18 Nov 12:20 | Requested | Carlos Mendes | Confirmed |
| 18 Nov 12:41 | First approval | Daniel Kim | Confirmed |
| 18 Nov 12:55 | Second approval | Sofia Rossi | Confirmed |
| 18 Nov 13:10 | Applied · marking placed at the point | Carlos Mendes | Confirmed |
| 18 Nov 16:28 | Compensation check · in place | Ana Ribeiro | Confirmed |
| 18 Nov 18:58 | Restored | Carlos Mendes | Confirmed |
| 18 Nov 19:20 | Return-to-service check · Pass | Daniel Kim | Confirmed |
Closed · total 5 h 48 min
The record an auditor asks for.
A bypass is closed by a check that the protection works again, not by someone remembering to remove a jumper.
- Every bypass with its target, extent, reason, kind and the limit it ran against.
- Each approval, application, extension and restoration, signed and confirmed on the device.
- Every compensatory measure with its periodic checks and who made them.
- The return-to-service check, pass or fail, and the MOC that covered it past the limit.
What’s in a bypass
- Target
- One barrier element, one machine safeguard, or a protection not yet in the register, named in words. Fully defeated or partly degraded.
- Reason and kind
- Company lists from a starting library: proof test, repair, failed test awaiting repair, start-up beyond the designed override, machine setup or jam clearing. Inhibit, override, force, jumper, mute and more.
- Clock
- A limit per reason, 72 h by default. It runs from the first application and never restarts. One extension by a senior approver.
- Compensation
- At least one measure to approve, with an owner and a check interval. Removing a measure needs the approver.
- Closing
- Restored, then a return-to-service check. A failed check keeps the bypass active as Failed test, awaiting repair, on the same clock.
Questions
What happens when a bypass passes its limit?
Nothing changes by itself: the protection is still defeated, and the record says Past limit. The next step is to restore it or propose an MOC temporary change, which covers it until the reversion date.
Can a bypass be recorded after the fact?
Yes. Record applied now is never refused, and approval is due before the next shift change. Until then it reads Applied without approval.
Who can see what is bypassed?
Anyone with Bypass Control, Barrier Management or Permit to Work access at the site sees the live bypasses.
Can a mistaken record be deleted?
No. A senior approver voids it with a reason. It stays in the history and stops affecting barrier status.