Audit: BY-07 · Interlock / permissive bypass log
Window: 90 days
Finding class: Temporary bypasses without restore proof
Format: Log audit. Not a policy PDF.
Extract (anonymized rows)
| When | Tag / permissive | Reason | Expiry | Restore signed? | | --- | --- | --- | --- | --- | | D−88 | LAHH-221 force | “transmitter noisy†| blank | No | | D−61 | XV-19 open permissive | packing change | “this week†| No | | D−40 | ESD trip bypass | false trip hunt | blank | No | | D−12 | Same LAHH-221 | “still noisy†| blank | No | | D−3 | Batch complete bit force | MES lag | shift end | No |
Pattern: blank expiry + verbal week = permanent.
If expiry is blank, the bypass is already infrastructure.
Walkdown correlation
LAHH-221 still forced. Field transmitter dirty, not replaced. Operations learned to run with the force. New hires never saw the real trip.
XV-19 permissive still active three turnarounds later. “Packing change†completed on D−60.
Audit rules written in red
- No bypass without numeric expiry (datetime).
- Expiry auto-escalates to shift manager if unrestored.
- Same tag twice in 90 days → defect + MoC, not another force.
- MES / batch forces treated as safety-adjacent if they hide incomplete states.
- Photo of restored wiring / de-forced HMI required to close the row.
A yellow force icon is not a maintenance plan.
Counts
- Open bypasses at audit: 11
- Past “this week†language: 7
- Same-tag repeats: 4
- Restore signatures on file: 2
Adjacent fences
Near-miss permit forms own job authorization theater. SIS lifecycle owns proof tests. Passive OT inventory owns asset naming. BY-07 owns bypass hygiene as a living log. Do not digitize the binder and keep blank expiries.
Close
Temporary is a timer. Without a timer, the plant has redesigned itself in the log—and called it operations.