SIS Bypass and Override in the Field: IEC 61511 Rules That Prevent Accidents

How to defeat a safety trip without defeating the protection that keeps people alive.

A Necessary Evil, Not a Routine

Safety systems cut risk. They trip units to a safe state. However, some trips block maintenance or startup. A faulty transmitter can shut a healthy plant. In those cases, engineers bypass the signal. A bypass interrupts the safety function on purpose. Done well, it protects both production and people. Done badly, it removes your last layer of defense. IEC 61511 defines the rules. This guide turns those rules into field practice. It uses HIMA and Schneider Triconex examples. Read it before you ever move a bypass switch.

Bypass, Override, Inhibit — Say It Precisely

People mix these terms. The standard separates them. A bypass blocks the logical effect of a signal. It still shows the input and alarm to the operator. The final element stays in its normal state. An inhibit, or disable, cuts the signal path. It leaves the broken side in an unknown state. That ambiguity can create conflicts. An override, or force, does more. It cuts the path and sets a chosen value. Therefore, override is usually safer than plain inhibit. You know exactly what the logic sees. Choose the action that leaves no mystery.

Never Cut the Wire to the Safety Solver

Here is a rule many crews break. During a bypass, keep the signal wired to the safety system. Continue to monitor it. Keep alarming it. Only the trip effect should be blocked. If you disconnect the input, you lose visibility. You also lose the return-to-service record. First, leave the field device connected. Second, let the logic solver hold the output normal. HART diagnostics remain live and useful. Watch the PV, the loop current, and the device status. A silent wire can hide a real fault.

Clause 16.2.4 — The Gate Before Any Bypass

IEC 61511 restricts bypass during continued operation. You may run with a bypassed device only when conditions are met. A hazard analysis must confirm adequate risk reduction. Compensating measures must be in place first. Operating procedures must exist and be followed. A compensating measure replaces the lost protection. It may be redundant equipment or an administrative control. Moreover, define hard limits up front. Set the maximum bypass duration. Set allowed process ranges during the window. The operator must know what to do before, during, and after. Review these rules regularly, not once a year.

Bypass Handling Inside HIMA and Triconex

Modern safety PLCs manage bypass as a tracked state. On a HIMA safety controller, trip bypass is applied per channel. The system latches a first-out record for later analysis. On a Schneider Triconex logic solver, a bypassed input is masked for voting. In a 2oo3 voting group, one bypassed input lowers redundancy. The trip margin then shrinks toward 1oo2 behavior. Therefore, never bypass more than the SIL target allows. Confirm the diagnostic coverage stays acceptable. Log every forced or bypassed tag to the historian. Enable a permanent bypass alarm at the HMI. A forgotten bypass is an accident with a timer.

1. Approve a written hazard analysis and bypass permit.
2. Put the compensating measure in service first.
3. Bypass the single channel or masked input in the solver.
4. Confirm the input still monitors and alarms.
5. Start the duration countdown and the operator watch.
6. Remove the bypass, then test and restore the function.

Conclusion & Action Advice

A bypass is a temporary, supervised exception. Treat it that way every time. Prefer override over bare inhibit so the logic state stays clear. Keep the field signal wired and alarming. Honor the clause 16.2.4 gate before you act. Set duration limits and compensating measures in writing. Watch how your HIMA or Triconex solver tracks each bypass. Then close every bypass the same shift you opened it. Discipline here is the difference between a saved run and a lost plant.

Author: Jianhua Liu is an industrial automation engineer with over 10 years of experience in PLC, DCS, and control systems.