Skip to main content
    QHSEtech
    All templatesCompliance · 3 pages · Updated 20 October 2026

    Safety Device Bypass and Impairment Record Template

    Three-page record of ONE temporary bypass, override, inhibit or impairment of a safety-critical device in a process or industrial setting (an interlock, trip, alarm, relief or detection device, fire protection system or machine guard interlock): the device and its tag, the hazard it protects against and the protection that stays, why it must be bypassed and the alternatives considered, a temporary risk assessment, compensating measures, the request and an authorisation by someone independent of the requester, start, planned end and the maximum duration your own procedure allows, a route to management of change for long or repeated bypasses, shift handover, a restoration check with a function test, the actual end, any event, learning and sign-off. It is not a permit to work, not a management of change record and not authority to override a manufacturer's or legal requirement. The form supplies no time limit or risk scale.

    What's inside

    Page 1: the device, the hazard and the reason

    1. The device and the record: record reference, site or unit, related permit to work number, date and time raised, the device tag or ID, description and location, manufacturer or loop drawing reference, the kind of device (interlock or trip, alarm, relief or vent device, gas, fire or level detection, fire protection system, machine guard interlock, emergency shutdown, other), what is being done to it (bypass, override, inhibit or impairment) and how it is applied and shown to others
    2. The hazard and the protection that stays: the hazard it protects against and the worst credible outcome, and the other independent protection that stays in service
    3. Why it must be bypassed: the reason (maintenance or testing, fault, nuisance or spurious trips, start-up or shutdown, other) in detail, and the alternatives considered and why they were not used
    4. Temporary risk assessment: what could go wrong while the device is out, the risk before and after the measures on your own scale, and whether the authoriser accepts the residual risk

    Page 2: the measures, the decision and the clock

    1. Compensating measures: extra supervision, manual checks, an isolated section, reduced throughput, an exclusion zone, a standby person, with who does each, when it is in place and who checked, and the stop conditions
    2. Request and authorisation: who requested, who authorised (a person with authority who is independent of the requester), the authority level your procedure requires and the conditions set
    3. Timing and limit: start, planned end, the maximum duration your own procedure allows (the form supplies none), whether the planned end is inside it and earlier bypasses of the same device
    4. Longer or repeated bypass: route to management of change: whether it was sent, the reference, and an extension log where each extension is a new authorisation
    5. Shift handover and who is told: whether the operator was told at shift handover, who else was told, and a line for each handover while the bypass is in place

    Page 3: putting it back, learning and sign-off

    1. Restoration check: restored at, by whom, the jumper, forced value, key or tag removed, the function tested after restoration (method, result, who, when), measures stood down, independent check and the next test of the device
    2. Actual end and event during the bypass: actual end, actual duration, whether it was inside the maximum, and any demand, alarm, trip, near miss or incident
    3. Learning: whether the device should be less prone to nuisance trips or alarms, whether the process or procedure should change so the bypass is not needed, and an action list
    4. Sign-off: requester, authoriser, restoration tester and the area owner or reviewer, and where the record is kept

    The section titles, the device kinds and the tick options are ours, to change.

    What requires or shapes this record

    No source opened for this page prescribes a bypass form, and this record does not say that any law requires one. The sources set related duties. In the US, the process safety standard (29 CFR 1910.119), where it applies, treats alarms, interlocks, relief and vent devices and emergency shutdown systems as equipment to be inspected, tested and kept in order, and asks for management of change; its nonmandatory appendix says temporary changes need a time limit. HSE guidance in Great Britain says companies should set out how overrides of safety-related systems are assessed, authorised and controlled and that each one should be justified by risk assessment, and that the need to bypass safety systems during maintenance should be minimised. In Great Britain the work equipment regulations say guards and protection devices must not be easily bypassed or disabled. Which rules apply depends on your country, your industry and the equipment. A completed form shows that a decision was recorded; it does not show compliance with any of them and does not replace the maker's instructions. This page is general information, not legal advice.

    • 29 CFR 1910.119(f), (j) and (l) and nonmandatory Appendix C, Process safety management of highly hazardous chemicals (US OSHA; text read through the eCFR, current to 16 October 2026); 40 CFR 68.73 and 68.75 (US EPA)

      A US rule that applies only to processes within its scope (listed chemicals at or above threshold quantities, and certain flammable gases and liquids). Where it applies, paragraph (j)(1) lists relief and vent systems and devices, emergency shutdown systems and controls, including monitoring devices, sensors, alarms and interlocks, among the equipment whose integrity must be maintained. Inspections and tests must follow good engineering practice, at a frequency consistent with the manufacturer's recommendations and good engineering practice and more often if experience says so, and each one is documented with its date, who did it, the equipment identifier, what was done and the result ((j)(4)). Deficiencies outside acceptable limits must be corrected before further use, or in a safe and timely manner once the necessary means are taken to assure safe operation ((j)(5)). Operating procedures must cover temporary operations and safety systems and their functions ((f)(1)). Management of change (paragraph (l)) covers changes, other than replacement in kind, to chemicals, technology, equipment and procedures, and must address the technical basis, the impact on safety and health, changes to operating procedures, the necessary time period and the authorisation requirements. The nonmandatory Appendix C is a compliance guideline, not a requirement: it lists changes in alarms and interlocks among equipment changes, says temporary changes have caused catastrophes, that a time limit for them should be set and monitored because without control they tend to become permanent, that they are subject to management of change, and that management of change is used to return equipment to its original or designed condition at the end of a temporary change. The standard does not set a bypass form or a maximum duration. EPA's risk management rule has near-identical wording in 40 CFR 68.73 (mechanical integrity) and 68.75 (management of change). The standard's own text is not reproduced here.

    • HSE, HSG253, The safe isolation of plant and equipment (second edition 2006, free web version), paragraphs 143 and 144

      HSE guidance for Great Britain on isolating process plant for intrusive work. Paragraph 143 says that where other parts of the plant can affect an isolation, operation of the relevant systems should be prevented as part of the isolation procedure, and the effect of that inhibition should be understood and communicated to all parties operating the plant before the isolation is installed. Paragraph 144 says company standards should set out arrangements for assessing, authorising and controlling overrides to safety-related systems such as emergency shutdown systems during isolation activities, that each override and any additional safety measures needed while those systems are shut down should be justified by risk assessment, and that fire and gas detection and emergency shutdown systems should not be disabled simply to prevent spurious shutdowns, because that could have wider implications. It gives inhibiting a fire-fighting system that would endanger people in a confined space as an example where inhibition may be appropriate. The guidance also stresses communication at shift handover, says that on most plants handover is part of the permit-to-work system or shift logbooks, and says independent checking of reinstatement is needed where failing to reopen a valve after instrument work might defeat a safety-related function and not show itself. It covers isolations, not every bypass, and does not give a form or a maximum duration. The form's sections 4 to 7, 9 and 10 follow these ideas in our own wording.

    • HSE, HSG238, Out of control: why control systems go wrong and how to prevent failure (second edition 2003, free web version), paragraph 27 and the interlock incident

      HSE guidance for Great Britain on control system failures. Paragraph 27 says the designer should strive to minimise the need to bypass or override safety systems during maintenance, and that if this is unavoidable the maintenance procedures should set out how an equivalent level of safety is achieved, for example by temporary barriers and a permit-to-work system, and how fault recording and analysis are done and reviewed by the appropriate level of management. It also describes an incident in which a software interlock was overridden by a modification authorised as a temporary plant modification because it was the quickest way to allow maintenance; the guidance's comment says three separate changes to protective systems had been made at different times and none had been properly controlled or validated. That is why the form asks for alternatives considered and the learning section asks whether the process or the device should change. It dates from 2003, so check what has changed, and it does not set a form or a time limit.

    • Provision and Use of Work Equipment Regulations 1998 (SI 1998/2306), regulation 11(3)

      Regulation 11 covers dangerous parts of machinery in Great Britain. Paragraph (3) says that guards and protection devices must be suitable, of good construction, maintained in efficient working order, must not give rise to increased risk and must not be easily bypassed or disabled, and must allow fitting, replacing and maintenance work, restricting access to the area where the work is, and if possible without dismantling the guard or protection device. It is the reason for the machine guard interlock kind on the form and for the question whether a bypass can be avoided by a safer way to do the task. It says nothing about a record of a temporary bypass, and rules elsewhere differ.

    Each source checked on 20 October 2026. Not legal advice; check the text in force for your site.

    Field by field

    The record is for one bypass of one device, from the decision to the restoration check. The device kinds, the tick options and the section titles are ours: change them to fit your plant. The form supplies no maximum duration, no risk scale and no authority levels; write the ones your own procedure sets, and keep them the same from one record to the next so that records can be compared. If a manufacturer's instruction or a legal requirement says the device must stay in service, the form is not a way round it.

    Device tag or ID
    Why: A bypass belongs to one device, so the tag or ID in your drawings and control system ties the record to it and lets you count earlier bypasses of the same device.
    Common mistake: Describing the device by what it does ("the tank alarm") so two devices can be confused or the history of one cannot be found.
    The hazard it protects against
    Why: Says what the device is there to prevent and the worst credible outcome if it is needed and does not act, which is what the authoriser weighs against the reason for the bypass. The other independent protection that stays is listed beside it.
    Common mistake: Listing a layer that is not independent of the bypassed device, or one nobody has checked is working.
    Why it must be bypassed, and the alternatives considered
    Why: A reason alone invites a bypass of convenience. HSG238 says the need to bypass or override safety systems during maintenance should be minimised, so the form asks what else was considered: running with it in service, repairing it, isolating or stopping, a temporary equivalent, or waiting for a planned shutdown.
    Common mistake: Writing the reason ("it keeps tripping") and leaving the alternatives blank.
    Temporary risk assessment
    Why: HSG253 says overrides of safety-related systems, and the extra safety measures while they are out, should be justified by risk assessment. The form asks for scenarios, the risk before and after the measures on your own scale, and whether the authoriser accepts what is left.
    Common mistake: Rating only the risk of the job and not the risk of the missing protection.
    Compensating measures
    Why: A bypassed device leaves a gap that something else must hold: extra supervision, manual checks at set intervals, an isolated section, reduced throughput, an exclusion zone or a standby person. HSG238 says an equivalent level of safety should be set out, for example with temporary barriers and a permit to work.
    Common mistake: Naming a measure with no owner, frequency or limit, so it is promised and not done.
    Requested by
    Why: Records who asked, and when. The requester knows why the bypass is wanted and is the person least placed to judge it alone.
    Common mistake: A team name or a blank, so nobody can be asked about it later.
    Authorised by
    Why: HSG253 says company standards should set out how overrides are authorised and controlled. This form's own rule is that the authoriser is a person with the authority your procedure requires who is independent of the requester, and the form asks for a Yes or No on that.
    Common mistake: The requester, or someone who reports to the requester and benefits from the bypass, signing as the authoriser.
    Start (date, time)
    Why: The clock starts when the device goes out of service, not when the form is signed, so the start time is what the maximum duration is measured from.
    Common mistake: Writing the time the form was filled in, so the real duration is understated.
    Planned end (date, time)
    Why: A bypass without an end is a permanent change. The 29 CFR 1910.119 appendix says temporary changes should have a time limit that is monitored because without control they tend to become permanent.
    Common mistake: "Until the part arrives" or "end of job", which cannot be checked on a given day.
    Maximum duration allowed by your own procedure
    Why: The form supplies no limit, because the right one depends on the device, the hazard and your own rules. Write the figure and the clause that sets it, and say whether the planned end is inside it.
    Common mistake: Leaving it blank or copying a number from another site without checking that your own procedure sets it.
    Longer or repeated bypass
    Why: A bypass that is long, repeated or open-ended is a change to the process safeguards. Where management of change applies, it is the process for that; 29 CFR 1910.119(l) includes the necessary time period and authorisation requirements. Each extension on the form is a new decision.
    Common mistake: Renewing the same record again and again instead of routing it to management of change.
    Operator told at shift handover?
    Why: HSG253 stresses communication at shift handover and says that on most plants handover is part of the permit-to-work system or shift logbooks. A device that is out of service is easy to lose at a change of shift, so each handover has a line.
    Common mistake: Telling the shift that started the bypass and not the shifts that follow.
    Function tested after restoration
    Why: Removing the jumper or the flag does not show the device works. HSG253 says independent checking of reinstatement is needed where a failure to restore might defeat a safety-related function and not show itself. The test method, result, who and when are recorded.
    Common mistake: Closing the record on the word of the person who removed the bypass, with no test of the function.
    Actual end (date, time)
    Why: Gives the real duration and shows whether it stayed inside the maximum, which is the figure to look at when reviewing how often and how long this device is out.
    Common mistake: Closing the record on the planned end without recording when the device was really restored.
    Event during the bypass
    Why: Records whether the device was needed while it was out (a demand, alarm, trip, near miss or incident) and what the measures did. That is the evidence on whether the measures worked.
    Common mistake: Leaving it blank because nothing went wrong, so a quiet bypass and an unchecked one look the same.
    Learning: should the device be less prone to nuisance trips or alarms
    Why: HSG253 says detection and shutdown systems should not be disabled simply to prevent spurious shutdowns. If a device is bypassed because it trips without cause, the fix is to the device or the process. The learning section asks whether the device or the process should change so the bypass is not needed again.
    Common mistake: Treating the bypass as the fix, so the same device is bypassed next month.
    Sign-off
    Why: Shows who requested, who authorised, who tested the restoration and who reviewed and closed the record, and where it is kept.
    Common mistake: Closing the record without the tester's signature.

    Worked example

    IllustrativeA bypass of a high-high level trip on an invented storage tank (invented site, people, tags and figures)

    SectionEntry
    1 The deviceLSHH-204, a high-high level switch that closes the inlet valve on day tank T-204. Kind: interlock or trip. Impairment: the switch is stuck in its normal position and a replacement is on order. Applied by a labelled key switch at the panel and a display flag.
    2 The hazard and the protection that staysOverfilling the tank and a spill to the bund. The independent high level alarm LAH-204 on a separate transmitter stays in service and was tested on the day. The bund stays in place.
    3 Why, and the alternativesThe tank is needed for a delivery. Considered and not used: stopping the transfers (the plant would stop), a temporary switch (none in stock) and waiting for the part (about 36 hours). Chosen: bypass for up to 36 hours with fill limited by procedure to 75 per cent.
    4 and 5 Risk and measuresWithout measures the risk is rated high on the site's own matrix, with the measures medium, and the authoriser accepts it. Measures: an operator at the tank for every transfer, a manual level reading every 15 minutes, one transfer per shift, and a stop condition that the transfer stops at the high level alarm.
    6 and 7 Request, authorisation, timingRequested by the shift supervisor on Tuesday at 09:00 and authorised by the operations manager, who is not in the supervisor's line for this decision. Planned end Wednesday 21:00, which is 36 hours from the start. The site procedure sets a maximum of 48 hours, so the planned end is inside it. No earlier bypass of this device.
    9 HandoverThe operator was told at each of the four handovers (Tuesday 15:00 and 23:00, Wednesday 07:00 and 15:00), and the status was entered in the handover log each time.
    10 and 11 Restoration, actual endNew switch fitted Wednesday 15:30. At 17:00 an instrument technician raised the level to the trip point and the inlet valve closed. Operations witnessed the test, the key switch and flag were removed, and the operator was told. Actual end 17:30, which is 32 hours 30 minutes, inside the maximum.
    Event and learningAt 02:10 on Wednesday the high level alarm sounded at 80 per cent during a transfer and the operator stopped it within a minute. One 15-minute reading had been missed because the gauge was hard to read in the dark. Actions: improve the lighting at the gauge (maintenance, two weeks) and review whether the switch type suits this duty (instrument engineer, one month).

    The figures, limits and ratings are invented to show the method and are not recommendations. Your maximum duration, risk scale and measures come from your own procedure and your own risk assessment.

    When a spreadsheet stops being enough

    A paper form or a spreadsheet works for a few bypasses on one site with one person who watches the clock. It stops working when many devices and shifts are involved, when a bypass runs past its planned end and nobody sees it until it is found, when the same device is bypassed again and again and the count is kept in nobody's head, and when the operator on the next shift needs to see what is out of service without asking.

    A software record can show every open bypass in one list with its planned end and its maximum, make the status visible at shift handover, keep the independent authorisation and each extension as a history that cannot be edited silently, link the bypass to the permit to work and to the management of change record, and show the device's bypass history. Ask what happens when the planned end passes without a restoration check, and whether a bypass can be closed without the function test. The list below applies the process safety management rule used by the guide. Nothing in it shows that a product holds a bypass record, so test it with one of your own.

    Same rule for every product: tagged “Process Safety”, “Barrier Management”, “Risk Management”, “Risk Assessment”, “Control of Work”, “Permit to Work” or “Asset Integrity”, with a sourced process safety (PHA, barrier or management-of-change) capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 23 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.