Override Discipline: Keeping Temporary Bypasses Temporary at UK Permitted Sites

Temporary overrides are a normal part of operating a regulated site. A bag filter may need to be bypassed while a failed differential-pressure sensor is replaced; an interlock may be suspended for a controlled test; a continuous emissions monitoring system (CEMS) may be placed in maintenance mode during calibration. The operational need is real. The regulatory risk lies in the gap between the intention behind the override and the evidence that it remained temporary.

In permit terms, an override is rarely neutral. It may alter the performance of abatement equipment, change the basis on which compliance is demonstrated, or remove a layer of protection that the permit assumes is present. UK regulators do not generally object to controlled overrides where the operator can show that the change was assessed, authorised, monitored and reversed. They are more likely to challenge an override that exists only in the memory of the shift team, or one that has been left in place because nobody owns the close-out.

Define the boundary between an override and a modification

The first control is definitional. An override is a time-bound, reversible change to the configured state of plant, control logic or monitoring, authorised for a specific purpose and period. It is not a workaround for a persistent fault, and it is not a substitute for a permit variation. Where the underlying need is enduring, the correct route is management of change (MOC) and, where required, a variation application. Treating a permanent change as a series of rolling temporary overrides is a common failure mode, and it is difficult to defend during inspection because the pattern is visible in the log.

Operators should therefore define which changes fall within the override protocol. Typical examples include bypassing abatement plant, forcing a control valve or damper position, inhibiting an alarm or interlock, placing a monitoring system in maintenance or calibration mode, and using manual sampling in place of an automated compliance determination. The protocol should also cover software forced values and temporary changes to alarm setpoints, because these are often omitted from paper-based bypass logs.

Authorise before the event, not after it

A credible override system has a named authoriser and a clear escalation route. The authorisation should be proportionate to risk: a short calibration override on a non-critical instrument may sit with the shift manager, while a bypass of abatement plant or a safety-critical interlock should require environmental and engineering review. The authorisation record should identify the equipment tag, the permit reference and the specific condition or monitoring obligation affected. It should state the reason, the expected duration, the compensatory measures and the conditions under which the override must be removed.

Where the override affects a permitted emission point or a monitoring obligation, the operator should consider whether the regulator needs to be notified. Permit conditions and enforcement guidance vary, so the decision should be recorded even when the conclusion is that no notification is required. A short note explaining the reasoning is more useful during inspection than an assumption that notification was unnecessary.

Build a log that can survive scrutiny

A bypass log is only as good as its weakest entry. The register should be contemporaneous, uniquely numbered and difficult to alter without trace. At a minimum, each entry should capture the override identifier, the date and time it was applied, the person who applied it, the authoriser, the plant or system affected, the permit reference, the reason, the risk assessment reference, the compensatory monitoring put in place, the expected removal time, the actual removal time and the close-out sign-off. Where an override is extended, the extension should be a separate, authorised entry rather than an amended end date.

Regulators increasingly look beyond the log itself. They may compare the register with alarm history, historian trends, work orders, calibration records and operator interviews. Consistency across those sources matters. An entry that records a two-hour bypass while the historian shows a forced value for three weeks is not a record-keeping weakness; it is evidence of a control failure.

Compensatory measures must be real and recorded

An override that removes a compliance control should be matched by an alternative means of assurance. For abatement plant, that may mean increased manual monitoring, reduced throughput, alternative treatment or enhanced visual inspection. For monitoring systems, it may mean backup sampling or using a validated alternative method. The measure should be specified before the override begins, and the results should be retained with the override record. A generic statement that “operational checks will continue” is unlikely to satisfy an inspector who asks what was checked, by whom and how often.

Close-out is the test of the system

The most revealing part of any override record is the close-out. The operator should be able to show that the plant or system was restored to its permitted configuration, that any forced values were removed, that alarms and interlocks were reinstated and tested, and that monitoring data returned to normal. Where restoration was delayed, the record should explain why and what additional controls were applied. A close-out that consists only of a signature and a date is a missed opportunity to demonstrate control.

The drift from temporary to permanent

The classic failure mode is gradual. An override is applied for a planned repair; the repair is delayed; the override is extended; the shift team becomes accustomed to the altered configuration; the close-out is forgotten. Months later, the override appears as normal operating practice. The permit may not have changed, but the site is no longer operating the plant that the permit describes. This drift is often accompanied by alarm fatigue, suppressed diagnostics and a decline in the quality of monitoring data.

Preventing drift requires more than a log. It requires a periodic review of open overrides, a maximum duration after which senior sign-off is mandatory, and a reconciliation between the override register and the maintenance backlog. It also requires a culture in which operators are comfortable challenging an override that has lost its original justification. The regulator’s question is simple: can you show that this bypass was temporary, controlled and closed? The answer should be found in the evidence, not in recollection.

Inspection readiness

Before an inspection, operators should sample several overrides, including at least one that was extended and one that affected a permitted emission point. For each, the file should trace a clear line from authorisation to application, monitoring, restoration and review. The operator interviews should match the record. The historian and alarm data should corroborate the timeline. Where gaps exist, they should be addressed before the regulator finds them. A well-run override system does not eliminate operational risk, but it converts an informal workaround into a documented, auditable control — which is precisely what a permit holder needs when a temporary bypass is tested against the permanent standard of the permit.