An interlocked guard trades reliability for access: it lets people in without tools, and in exchange it depends on a device continuing to work and on nobody wanting to get past it.

What the interlock actually does

Opening the guard sends a signal that removes the hazard, either by stopping the machine or by preventing it from starting. Where the machine takes time to stop, a plain interlock is not enough on its own, because the guard can be opened while dangerous motion continues. That case needs guard locking, which holds the guard shut until the machine has actually reached a safe state rather than until it has been told to stop.

Defeat is a design problem, not a discipline problem

Interlocks get defeated in the same handful of ways everywhere: a spare actuator key taped into the switch, a magnet held against a sensor, a cable-tied plunger, a switch unbolted and left dangling. People do this because the guard is in the way of something they need to do, and treating it purely as a compliance failure misses the reason. The standards approach it as a design question — make defeat difficult, and remove the incentive.

Making defeat difficult

Coded actuators that only work with their own matched device, mounting that hides the fixings once installed, sensors that check for a plausible sequence rather than a single steady signal, and devices that fault rather than fail silently when tampered with all raise the effort required. None of this matters if the guard interrupts a task that has to be done twenty times a shift, which is why the more useful question is usually why people want it open.

The interlock is only as good as its circuit

A switch is one part of a safety function that runs from the device through the control system to whatever removes the power or motion. The reliability required of that whole chain is determined by the risk, which is what performance levels express. A high-integrity switch wired into a single ordinary relay is a high-integrity switch in a low-integrity function, and the assessment applies to the function rather than to any component in it.

They need proving, not assuming

Interlocks fail quietly: a switch drifts out of alignment, a contact welds closed, a cable chafes, a door sags on its hinges until the actuator no longer seats properly. None of these announce themselves during normal running, because normal running is exactly when the interlock is not being asked to do anything. Functional testing on a defined schedule is what finds them, and it means opening the guard and confirming the machine actually stops.

For the device requirements, see EN ISO 14119, and for the reliability of the whole safety function see ISO 13849.

Related standards

The standards below set the design requirements, classification and test methods behind the safeguards and equipment referenced in this note.

• EN ISO 14119 — Interlocking Devices Associated With Guards
• EN ISO 14120 — Guards: Design and Construction
• ISO 13849 — Safety-Related Parts of Control Systems

Frequently asked questions