Interlock bypass: release, risks and control

Short answer

An interlock bypass, or override, allows a device to be operated even though the logic gives no permissive. It exists because a damaged auxiliary contact, a lost communication link or a commissioning stage can block a legitimate operation. It is also the origin of many switching accidents, so it must be restricted by key or permit, alarmed in SCADA, logged with time and person responsible, and accompanied by a visual check of the real state of the devices.

What an interlock bypass is

An interlock withdraws the switching permissive when its conditions are not met. The bypass, also called release or override, is the mechanism that allows operation even though the logic gives no permissive. It can be a key-operated selector switch in the bay cabinet, a password or a user level in the controller interface, or a parameter of the remote command.

In IEC 61850-7-2, the control service carries a Check attribute with two bits: one requests the interlock check and the other the synchrocheck. A client that sends the command without requesting the interlock check is, in practice, performing a bypass. The server configuration must therefore decide whether it accepts that kind of command and from which level.

Mechanical interlocks have their equivalent too: a removed latch, a key lock with a copy or a forced mechanism. They leave no alarm and no record, which makes them the hardest to detect during an inspection. Any bypass policy must cover both types, logic and mechanical.

Why it exists

Interlocks depend on signals: auxiliary contacts, double-point positions, GOOSE messages between bays. When a signal fails, the interlock does the right thing, which is to block. But that can leave without control a bay the operator needs to switch. The typical cases are:

Damaged or misadjusted auxiliary contact, leaving a disconnector in an intermediate or invalid position.
Loss of communication with another bay, when the station interlock waits for a GOOSE message that does not arrive.
Commissioning or extension, when the logic is not yet complete or new devices are not yet integrated.
Emergency, when restoring service requires an operation that the logic, designed for normal operation, does not allow for.

In all those cases the failure is in the signal, not in the device. The risk is that the operator does not know that for certain.

Risks

When an interlock is bypassed, the barrier against the classic switching errors disappears:

Opening or closing a disconnector under load, with the resulting arc and the possibility that it turns into a bus fault.
Closing an earthing switch onto an energized section.
Energizing a section with an earth applied.
Paralleling two sources without a synchronism check.

Typical incidents do not happen because someone wants to defeat an interlock, but because it is bypassed to solve a specific problem and a different device is operated, or because the bypass stays active after the job and the next operation is no longer protected. In MV switchgear the equivalent is a mechanical interlock forced to rack out a truck in an emergency and never repaired.

What good practice requires

Utilities with good operating discipline treat the bypass as an exceptional operation with its own procedure. In general terms:

Physical or logic restriction. A single key in custody, a specific user level or a permit from the control center. Never a keyless selector within anyone’s reach.
Minimum scope. Bypass a single device, not the whole bay or station.
Standing alarm. While the bypass is active, an alarm in SCADA and on the local interface that cannot be acknowledged and forgotten.
Logging. Start and end of the bypass with time, device and person responsible in the sequence-of-events record.
Visual check. Before each operation, verify in the yard the real state of the devices the permissive depended on, and the absence of voltage when earth is going to be applied.
Limited time. Remove the bypass at the end and review the cause that made it necessary.
Fix the cause. A damaged contact or a GOOSE message that does not arrive is repaired; the bypass is not left as the solution.

Before bypassing an interlock

Is the cause of the block identified as a signal failure and not a real condition?
- NoDo not bypass: the interlock may be protecting against a real error
- YesIs there authorization under the utility's procedure?
  - NoDo not bypass
  - YesHas the real state of the devices the permissive depended on been checked on site?
    - NoCheck before switching
    - YesBypass only that device, operate, remove the bypass and log it

Installation and operation standards such as IEC 61936-1 and EN 50110-1 require interlocks and safe switching procedures, but they do not detail how a bypass must be controlled. Each utility defines that in its operating rules, and it is part of the control system design.

What can be done in the design

Many bypasses can be avoided with good design:

Supervised double-point positions, with a discrepancy alarm that says which device has the problem.
Clear rejection messages that state which condition is missing, not just that the command was rejected.
GOOSE supervision with an alarm per bay, so the loss of a message is seen before it blocks an operation.
A defined degraded mode, stating which operations remain allowed when the station level is lost.
Bypass per device rather than per bay, with automatic alarm and logging.

How it is tested

During commissioning it is verified that the bypass can only be activated with the intended key or permit, that it raises the alarm and the event in the log, that it affects only the intended device and that the interlock acts again once it is removed. It is also tested that the server rejects remote commands without an interlock check when the philosophy does not allow them. The rest of the plan is in the guide on interlocking tests.

We help you close the risk

Our team reviews the interlocking logic, rejection messages, GOOSE supervision and bypass configuration in bay controllers of the main brands, in medium, high and extra-high voltage substations and in industry. See remote relay configuration and secondary engineering, or contact us.

References

IEC 61850-7-2, Basic information and communication structure – Abstract communication service interface, control service and Check attribute.
IEC 61850-7-4, logical nodes CILO and CSWI.
IEC 61936-1:2021, Power installations exceeding 1 kV AC, 6.2.16 (interlocking).
EN 50110-1, Operation of electrical installations.
National Grid, TS 3.01.01 (RES), Substation Interlocking Schemes, issue 1, 2018.

Frequently asked questions

Is it acceptable to have an interlock bypass key?

It is common and often necessary, because without it a failed auxiliary contact or communication link can leave a bay immobilized. What is not acceptable is uncontrolled use: it must require authorization, be alarmed and logged, and be part of the utility's written procedure.

What must be checked before switching with the interlock bypassed?

The real state of every device the permissive depended on, by visual inspection in the yard or at the panel: that the breaker is actually open, that the earthing switches are where they are believed to be, and that there is no voltage where earth is going to be applied. The bypass removes the logic protection, so the check has to replace it.

Is a bypass from SCADA safer than a key in the cabinet?

Not by itself. From SCADA the operator cannot see the device, so everything depends on the signals, which are exactly what may be failing. That is why many utilities only allow the bypass at bay level or in the yard, with the operator in front of the equipment.