BSEE: Bypassed safety device deficiencies and noncompliance

Members of the Bureau of Safety and Environmental Enforcement (BSEE) Gulf of America Region (GOAR) identified a potential risk associated with bypassed safety devices and inconsistent interpretation of regulations after multiple incidents of noncompliance were issued associated with the operator’s failure to comply with 30 CFR 250.869 and 30 CFR 250.870 in 2025.

The BSEE Performance-Based Risk Inspection (PBRI) covered five assets (all production platforms) in the GOAR, which five separate operators operated.

What BSEE’s PBRI found:

• Multiple facilities and operators had internal policies to flag/tag temporarily out-of-service safety devices and track bypasses; however, inspections revealed that facility personnel were not adequately documenting these bypasses electronically or in hard copy.
• BSEE inspection teams observed several facilities’ data historians to be nonoperational. A data historian is a software application that collects, stores, and retrieves time-series data from various sources, allowing operators to analyze historical data related to alarms, control actions, and other operational events.
• BSEE found that operators commonly utilized a “maintenance bypass” whenever they needed a bypass. A “maintenance bypass” offers more robustness than a standard bypass. With a standard bypass, an operator can choose a specific function to bypass for a particular device. In contrast, a “maintenance bypass” stops the device from triggering the safety system across the entire 4-20 mA range and beyond, even if the device experiences a fault or loses power.
• “Maintenance bypasses” are popular because operators can use the same bypass function for startup, maintenance, and testing, thereby preventing nuisance trips. However, during startup, a “maintenance bypass” may be selected for a pressure transmitter that provides both pressure safety high (PSH) and pressure safety low (PSL) functions. In this case, the PSH and PSL are disabled, rather than just bypassing the PSL. BSEE has found that in some startup situations, it is unnecessary to bypass the PSH. In these cases, this practice fails to meet the “minimum” number of devices that can be bypassed according to 30 CFR 250.869, which increases operational risk by disabling primary pressure protection.
•  BSEE found that some platforms had actions entitled “group bypass selectors.” This option bypasses several devices at once and is useful for some applicable operations. In most scenarios, control room operators and their competency were the only barrier to ensuring the minimum number of devices in bypass. For example, the operator did not have a preset list of minimum bypasses that are needed for common operations on the facility.
• BSEE found that some operators kept devices in bypass for longer durations. Operators cited nuisance trips and alarms, such as sea state and weather, for reasons associated with bypasses for extended periods on sumps and emergency shutdown devices (ESDs) at the boat landing. One operator had examples of allowable bypasses extending for 12 hours and only requiring a conversation with a control room operator and the offshore installation manager.
• During the inspection, multiple operators indicated that they were allowed to place devices in bypass for “repair” and “troubleshooting.” Multiple operators had different interpretations of 30 CFR 250.869A, which states, “Surface or subsurface safety devices must not be bypassed or blocked out of service unless they are temporarily out of service for startup, maintenance, or testing.” Specifically, “maintenance” was not well defined within operator procedures.
• Multiple operators had safety system bypass procedures requiring certain personnel to review adherence to the operator’s procedure by conducting an audit. The audit’s results and actions were also required to be documented and shared with relevant personnel. Unfortunately, the operator did not provide audits of this nature or scope were not provided by the operator for the subject facilities to BSEE during the PBRI.
• BSEE found one instance where an operator had mistakenly bypassed the entire safety system while the facility was producing. In this case, a project team altered ladder logic to bypass groups of devices that were needed for the construction process while the facility was offline. However, when the facility went back online, these ladder logic changes were not reverted, and entire groups of devices were unknowingly in bypass.