What SCADA interlocking does not replace

YTCC checks commands before they reach the field: it refuses a switching operation that breaks a topological interlock rule, asks for confirmation before every write to the field, can require a reason and a second user, and runs switching programs only through the same checks. These functions reduce operator error. They are not protection and not a safety function: they do not replace the protection relays, the electrical and mechanical interlocks of the switchgear, or a safety instrumented system (SIS).

What the SCADA checks do

Function	What it prevents	Page
Topological interlocking	A command that would, for example, close onto an earthed section, open a disconnector under load or parallel two networks	Topological interlocking
Command confirmation, reason and second user	A value sent by mistake or without a second look	Commands and confirmation
Refused commands	A command without permission, without communication, to a signal in manual or simulated mode, or one that arrives late	Commands and confirmation
Switching programs	A sequence run in the wrong order or without approval	Switching programs
Responsibility zones	Two operators controlling the same part of the plant at the same time	Responsibility zones

All of these act on commands that pass through YTCC. They decide whether YTCC sends a command; they cannot stop anything that happens in the field without a command from YTCC.

What they depend on

The SCADA checks are only as good as the information YTCC has:

• Positions and measurements from the field. The interlock calculates the network from the switch positions and measurements that the drivers deliver. A wrongly wired or wrongly bound position contact gives a wrong result without any warning. A position with bad quality is treated as unknown, and no command is possible except opening a breaker.
• Communication. Without communication no command is sent, and a command is not stored to be sent later. The SCADA checks therefore cannot act at all while a station is cut off.
• The project configuration. The rule levels, the symbols on the diagram, the voltage levels and the sources are engineering data. A rule set to Do not check, a missing connection on the diagram or a source that is not defined changes what is checked.
• Time. A command passes through the browser, the server, the driver and the network before it reaches the device. YTCC refuses a command that is more than 2 seconds old when it reaches the driver, but it is not a real-time system. A reaction that must happen within a fixed time belongs in the field.

What stays in the field

YTCC does not see or stop:

• operations made locally at the switchgear, at a local control panel or by a protection relay;
• a device that moves by itself, for example after a trip or a mechanical failure;
• states for which there is no signal in the project;
• synchronism: check it with the synchrocheck relay of the switchgear. Joining different networks is Locked by default because paralleling two unsynchronised networks is dangerous.

The protection that must work in these cases is the protection relays, the electrical and mechanical interlocks in the switchgear, and the safety functions of the plant. For a process plant the same applies to the safety instrumented system and to the interlocks programmed in the controllers: a software interlock in a server script is a convenience for the operator, not a safety function.

Overrides are a decision, not a fault

An interlock rule at Unlockable can be overridden for one command by an authorised user, with a reason and, by default, a second user's approval. YTCC records who overrode which rule and why; the responsibility for the switching operation lies with the person who overrides it. A project in which an override must never be possible sets the rule to Locked.

Good to know

• YTCC is not a safety instrumented system and has no safety integrity level (SIL). Do not count a YTCC interlock or a YTCC alarm as a layer of protection in a safety assessment.
• The switching programs do not replace the switching instructions and the work permit procedure of the plant.