It is pretty normal to have to over-ride instrumented trips and interlocks during testing, so you've possibly done quite well to eliminate most of your instances. Two things to beware of: 1) Making sure there isn't a 'demand' on the system while it's locked out - if production continues during the maintenance task that may be an issue? Obviously, minimising the time the system is locked out is also key if this is the case. 2) Making sure that the system is truly 'unlocked' when the maintenance/testing is finished. That was one cause of Buncefield, where the hi-level trip didn't work. Having a formal 'restore to normal working' checklist, and possibly a second person checking the work may help? If your system is pretty sophisticated and operating continuously, you may need to look at the required reliability (SIL) in order to set the testing frequency. But if planned shutdowns are quite common, then sometimes you can do the necessary testing of the interlock as part of the shutting down process.

I think you need to give consideration to the potential risks. We used to use interlock overrides all the time during the setup of production lines or when trying to identify a fault. We never used any form of permit or booking in out process as it would take to long and the irsks where very low when operating the equipment overridden. you need to consider the potential risks overriding a 40 tonne hydraulic press is going to have more risks that a machine rotating over slowly. Phil