Interlock Bypass and Reset Governance

Interlocks sometimes must be bypassed for maintenance; doing so safely requires authority, a second person, a scope, a time limit, and an audit record.

The most dangerous routine action

Maintenance and commissioning occasionally require bypassing an interlock — energizing a subsystem with a normally-required permissive forced. This is the single most dangerous routine action in the plant, because it removes a protection on purpose. Kronos governs it tightly: a bypass is an authorized, scoped, time-limited, two-person, fully-logged exception, never a casual toggle.

Bypass request requirements

• Authority: only the safety authority can approve a bypass (see authority levels).
• Two-person: a second qualified person independently confirms scope and conditions.
• Scoped: the bypass names exactly which interlock, on which subsystem, for which task.
• Time-boxed: it auto-expires; it cannot be left forced indefinitely.
• Logged: who, why, when, expiry, and machine state, for the audit trail.

def bypass_permit(approver_level, second_person, scope, now, expiry):
    return (approver_level >= 3           # safety authority
            and second_person             # two-person rule
            and scope is not None         # explicit scope
            and now < expiry)             # not expired

def auto_restore(now, expiry, active_bypasses):
    # expired bypasses are force-restored, not merely warned about
    return [b for b in active_bypasses if now < b.expiry]

Bypasses auto-restore on expiry rather than waiting for someone to remember, and the system refuses to enter normal operating modes while any safety-relevant bypass is active. A reset after a trip follows the same discipline: deliberate, authorized, and only after the trip's cause is understood — never an automatic clear that would hide a recurring fault.

Auto-expiry is the quiet workhorse of the scheme: because every bypass carries a hard expiry and the plant refuses normal operating modes while a safety-relevant bypass is active, the common failure of a forgotten forced permissive simply cannot persist into operation. Combined with the two-person rule and the audit record, this turns interlock bypass from an informal, error-prone practice into a bounded, reviewable exception whose scope and lifetime are known to everyone at all times.

This governance is what keeps the hardwired interlock matrix trustworthy in practice, not just in principle. Every bypass and reset is evidence in the safety case, and the authority model comes from authority levels.