Functional safety technical resource
What Is SIS Bypass Management?
Safety instrumented system (SIS) bypass management is the controlled process for authorizing, assessing, indicating, monitoring, recording, and removing a temporary condition that prevents all or part of a safety instrumented function from acting. A bypass creates an impairment that must be visible and time-limited, with defined compensating measures and restoration checks. It is not merely a software command, and it should not become an undocumented substitute for repair or design change.
Technical resource from Mangan Safety Instrumented Systems (Mangan SIS)
What counts as a bypass or impairment
A bypass can inhibit an input, suppress logic, force a value, block an output, isolate a final element, remove a channel, or otherwise prevent the defined safety action. Maintenance overrides, startup permissives, test modes, and physical isolation can create equivalent impairment even when the interface uses a different label. The control process should follow the functional effect, not only the name of the command or switch.
Authorization and compensating measures
Before activation, identify the affected SIF, hazard scenario, remaining protection layers, operating mode, expected duration, process restrictions, and accountable approvers. Compensating measures must be specific, feasible, communicated, and monitored; examples can include reduced operating limits, additional surveillance, alternate protection, or delaying the work. The choice requires a site-specific risk review and should not be presented as restoring the bypassed SIF.
Indication, time control, and verified restoration
The bypass state should be clearly indicated to operations and maintenance personnel, entered in a controlled log, associated with an expiration or review time, and included in shift handover. Restoration should confirm the bypass is removed, configuration is correct, the affected function is available, required testing is complete, alarms are normal, and responsible personnel have closed the record. A cleared screen indication alone may not prove field restoration.
Temporary impairment versus permanent change
A temporary bypass should have a defined purpose and end point. Repeated renewal, long duration, changed operating intent, altered trip logic, or permanent hardware isolation can signal a modification rather than temporary work. The facility should apply its management-of-change process when scope crosses that boundary and update the SRS, logic, drawings, procedures, calculations, testing, training, and validation as applicable.
Mangan SIS project context
Apply Bypass Management to documented SIS decisions
Apply bypass management to software inhibits, maintenance overrides, trip suppressions, channel removals, forced signals, physical isolations, and test modes that impair a SIF. Integrate the process with work permits, operating procedures, alarm management, proof testing, shift handover, deficiency tracking, management of change, and post-maintenance testing. The controls should cover sensors, logic, outputs, utilities, and final elements.
Sources and scope
Use the source type that fits the decision
Standards
IEC 61511 governs SIS operation, maintenance, modification, and the maintenance of specified functional safety. Bypass controls must support those lifecycle requirements and the SRS; the standard context does not make a bypass safe merely because it is authorized.
Guidance
IEC 61511-2 provides application guidance for the specification, design, installation, operation, and maintenance of SIFs and related SIS. ISA process-sector implementation guidance can further support lifecycle procedures. Guidance must be adapted to the site's actual hazards, interfaces, staffing, and authority structure.
Regulation
For processes covered by OSHA 29 CFR 1910.119, bypass activity can engage operating-procedure, mechanical-integrity, training, deficiency-correction, and management-of-change requirements depending on the work. OSHA PSM does not provide one universal bypass workflow, and applicability must be evaluated for the specific facility and change.
Mangan recommendation
Mangan SIS recommends one auditable bypass process with unique identification, SIF and hazard reference, risk review, named approval, start and expiration times, compensating measures, visible status, shift communication, restoration testing, and closure evidence. Escalate extensions and recurring bypasses for engineering and MOC review.
Primary references
- IEC 61511-2:2016 — process-sector SIS application guidance (International standard guidance)
- IEC 61511-1:2016 — SIS operation, maintenance, and modification requirements (International standard)
- OSHA 29 CFR 1910.119 — Process Safety Management (U.S. regulation)
Common questions
Clarifying Bypass Management
Is a bypass the same as turning off an alarm?
Not necessarily. A bypass prevents all or part of a safety function from acting; alarm suppression affects annunciation. One action can involve both, but the functional effect and separate controls should be identified.
Can compensating measures replace the bypassed SIF?
They can reduce exposure during a controlled impairment but should not be described as automatically restoring the same independence, integrity, or response as the unavailable SIF. Their adequacy is scenario-specific.
When does a bypass require management of change?
Apply the site's approved MOC criteria. Changed design intent, logic, hardware, operating limits, procedures, duration, or repeated extension can indicate a modification rather than a short, preplanned temporary impairment.
Managing an impaired safety function?
Strengthen bypass authorization, compensating measures, and verified restoration.
Downloadable term reference
Download: Bypass Management - Functional Safety Glossary PDF
Save or share this term-specific reference, including the answer-first definition, engineering review considerations, and primary-source references.
Download the Bypass Management PDF