Bypass Under Commercial Pressure
At a specialty-chemicals site, the SIL 2 reactor high-temperature trip has been bypassed for 11 days under a temporary management-of-change (MOC) record while a fouled thermowell is replaced. The operations manager wants to keep producing because the campaign is worth EUR 2.4 million and the next maintenance window is six weeks away. The bypass is logged, but the shift supervisor argues that the independent high-high alarm is 'as good as the trip'. The functional safety assessment is due in four months, and the assessor has requested the bypass procedure, proof-test records and competence matrix. The instrument technician who performed the last proof test used a 4-20 mA loop calibrator but did not test the logic solver output to the shutdown valve; the record still says 'passed'. Two of the four proof-test records for the loop are missing signatures. The company holds an ISO 9001 certificate and an FSM system certificate, but has never performed a safety-culture assessment. The engineering manager asks whether the bypass can continue until the thermowell is replaced and what to do about the records.
1. Can the bypass continue? State the decision and the conditions you would impose.
Read the worked answer
No, not on the current basis. A bypass is a safety-critical MOC and cannot be authorized by production value or by the operations manager alone. The independent high-high alarm cannot be credited until it is proven independent of the bypassed trip; if it shares the thermowell, transmitter or impulse line, it fails the independence criterion and provides no additional protection. Even if independent, an alarm is not equivalent to a trip because it relies on operator response, which needs a validated response time, clear procedure and competence. If the trip is the only protection against reactor over-temperature, production should stop until the thermowell is replaced.
If continued operation is contemplated, I would require: a documented risk assessment of the bypass; a maximum duration, typically hours to a few days, not six weeks; authorization by the operations manager and the functional safety manager; an independent high-high trip or alarm with a separate sensor and proof of independence; continuous operator monitoring with defined response; reduced feed or inventory; daily functional checks; shift handover records; and a defined abort criterion. The bypass register and alarm suppression must be updated, and the assessor must be informed. Commercial pressure is not a valid risk-reduction argument.
2. What do the proof-test records indicate, and what corrective and reporting actions follow?
Read the worked answer
The proof test is invalid. A proof test must exercise the complete safety function from sensor through logic solver to final element, including the shutdown valve stroke and the logic solver output. A 4-20 mA loop check alone does not demonstrate that the valve will close or that the logic solver will de-energize the output. Recording 'passed' is therefore a false record, and missing signatures break traceability and independent verification. The claimed PFD for the loop is not supported for the interval covered by that test.
Corrective actions: quarantine the affected proof-test records; re-test the complete loop with an independent witness; review all safety functions tested by the same technician and with the same procedure; assess technician competence and re-train; correct the procedure to include final-element and logic-solver verification; report the event as a nonconformance under the FSM system; notify the assessor; and review the MOC and bypass records for similar weaknesses. Do not retrospectively sign the records. The issue is a systematic FSM failure, not merely an administrative gap, and it should be investigated for production-pressure and normalization-of-deviance contributors.
3. If the assessor asks for evidence of safety culture, what would you present and what gaps remain?
Read the worked answer
I would present objective evidence: the bypass procedure and register, including duration, authorization and compensating measures; proof-test compliance and exception reports; the competence matrix and training records; MOC records for safety functions; incident and near-miss reports; audit findings and management-review minutes; and any just-culture or reporting policy. I would also present the FSM plan showing how safety-critical decisions are escalated and how independence of the assessment is maintained.
The gap is that no safety-culture assessment has been performed. A certificate and an ISO 9001 system do not demonstrate safety culture. The 11-day bypass, the false 'passed' record and the missing signatures are indicators of production pressure, weak record integrity and insufficient challenge. I would recommend a safety-culture assessment covering reporting, just culture, management commitment, resource allocation and MOC discipline, followed by a measurable action plan. Until then, the assessor should see the issue as an open finding, not as a documentation problem.