Machine Guard Interlocks: ISO 14119 Types, Selection and Checks

Key takeaways

• An interlocking device makes a movable guard enforceable: guard open means the hazardous function stops and cannot start. Guard locking also holds the guard closed until the hazard is over, run-down included.
• ISO 14119 defines four device types: type 1 mechanical uncoded, type 2 mechanical coded (the tongue switch), type 3 non-contact uncoded, type 4 non-contact coded (RFID).
• Defeat is the central in-service failure mode. The standard requires minimising the motivation to defeat: a guard that costs minutes on every jam will meet a cable tie and a spare actuator.
• Series wiring can hide faults. Daisy-chaining electromechanical interlocks into one safety relay invites fault masking when doors open in overlapping sequences, degrading the claimed diagnostic coverage.
• Interlocks fail silently between demands: a scheduled functional test of every guard, recorded per guard, keeps the safety function real rather than assumed.

What an interlock does, and what guard locking adds

This article covers the devices fitted to movable guards; for the guards themselves, see our guide to machine guarding.

An interlocking device ties guard position to the safety-related control system: opening the guard stops the hazardous function, and while it is open the function cannot start. Nothing in that definition holds the door shut.

That gap matters wherever the hazard outlasts the opening: a saw blade coasting down, a centrifuge spinning out. There, guard locking holds the guard closed until a time delay covering the worst-case run-down, or a standstill monitor, releases it.

An interlock covers the routine tasks it was designed around; it is not energy isolation. Anything more intrusive gets full lockout tagout.

The four ISO 14119 device types, in plain words

• Type 1, mechanical, uncoded: a position switch pressed by a cam on the door, or a hinge switch. Anything that pushes the plunger, a screwdriver included, imitates a closed guard.
• Type 2, mechanical, coded: the tongue switch: a shaped key actuator enters the switch head. The coding is the shape, so the spare actuator in the drawer is this type's known weakness.
• Type 3, non-contact, uncoded: a plain magnet and reed switch, or an inductive sensor. Tolerant of dirt and misalignment, defeated by any fridge magnet or washer.
• Type 4, non-contact, coded: RFID or coded magnet devices that respond only to their matching actuator, often only to one individually taught unit.

ISO 14119 also grades coding: low is 1 to 9 possible codes, medium 10 to 1,000, high more than 1,000. In plain words: how hard is the device to fool with something from a toolbox. The duties split as our piece on the EU Machinery Regulation 2023/1230 describes: the manufacturer integrates the devices, the user keeps them effective in service.

Defeat: the problem the standard was rewritten around

Interlocks rarely lie on their own; someone makes them lie. ISO 14119 treats defeat as a design problem: assess the foreseeable motivation to defeat each guard, then minimise it. The measures rank like this:

• Remove the motivation. If the task behind the door (jam clearing, size change, sampling) is made rare, faster, or possible without opening the guard, the reason to bridge disappears.
• Use high-coded devices where motivation remains, so a spare actuator or a magnet is no longer enough.
• Mount out of reach, hidden or behind obstruction, so presenting a substitute actuator is impractical.
• Fit actuators non-detachably: one-way screws, security fasteners or welding, so the actuator cannot migrate from the door to the switch head.

The ordering is the message: a plant that answers every defeat with a sterner toolbox talk, while the guard still costs two hours a shift, treats the symptom and preserves the cause.

Guard locking: decide what happens on power loss

• Spring-applied, power-released: a spring holds the bolt engaged; power releases it. On power loss the guard stays locked: the usual choice for run-down hazards: a power cut never hands anyone an open door onto a coasting blade.
• Power-applied (power to lock): power holds the bolt, so on power loss the lock releases. Wanted where trapping a person inside is the greater risk, and precisely wrong where the machine coasts through a power cut; a spring-applied device with an internal escape release usually resolves the conflict.

Prove the release condition against the worst-case run-down, and check the rated holding force against what a person can pull: a lock that yields to a tug is decoration.

Series chains and fault masking

Wiring several electromechanical interlocks in series into one safety relay is cheap and everywhere. The trap is fault masking: a neighbouring door opening and closing in an overlapping sequence can present the relay with a clean signal change while one device sits with a faulted contact, and the line keeps running with a dead safety contact asleep in the chain.

Masking degrades the achievable diagnostic coverage. ISO/TR 24119 gives the evaluation method, driven by chain length and door opening frequency; long chains of busy doors commonly evaluate to low or no coverage, capping the achievable performance level. The cures are structural: short chains, busy doors monitored individually on safety I/O, or electronic type 4 devices with self-monitored OSSD outputs, which cascade without masking.

Keeping interlocks honest in service

Three slow killers do most of the damage. Door sag makes the actuator enter the switch head at an angle and chews it until the door stops closing cleanly, which is how bridging starts. Worn actuators and broken flexible mounts cause intermittent stops that get blamed on the switch and answered with a cable tie. And untested functions rot quietly: an interlock only acts when the guard opens, so it can sit failed for months.

The countermeasure is a functional test of every interlocked guard on a schedule: open it, verify the stop and the start prevention; for locking, verify the hold and the release. Frequency is a risk assessment answer, commonly between monthly and annually per guard, the machine's validation and demand rate deciding, plus a periodic close look at alignment, fixings and actuators. Keep the schedule in the same preventive maintenance plan as the rest of the asset, and record who tested: this is named-competence work for your maintenance skills matrix.

In Fabrico, each guard's checks run as recurring PM tasks with a checklist, as-found and as-left condition is stored per asset, a failed check can trigger a follow-up task, and the history is there when an auditor asks what was tested and when. To see that on your own guard list, book a short demo.

A worked example with real numbers

A packaging line has 14 interlocked guards: 9 tongue switches (type 2) and 5 RFID devices (type 4). The site sets a quarterly functional test of every guard, batched with the line's PM day: 14 tests a quarter, 56 a year, roughly 10 minutes each including the record, about 9 hours of technician time a year. Each guard also gets an annual close inspection of alignment, fixings and actuator wear.

Year one findings:

• 2 sagged doors on the cartoner, actuators entering the switch heads at an angle and visibly worn. Hinges adjusted, actuators replaced: a cheap catch before either became an intermittent fault.
• 1 bridged tongue switch on the case packer: the spare actuator zip-tied into the switch head. Investigation, not blame, found the cause: that guard was opened about 11 times per shift to clear jams. Across 3 shifts that is 33 openings a day, and at roughly 4 minutes per stop-and-restart cycle, about 132 minutes of lost line time every day hanging on one door.

The fix came in two halves: the jam source, a worn guide rail, was corrected, cutting openings below 2 per shift, and the tongue switch was replaced with a high-coded RFID device mounted out of reach. The order matters. The defeat was a process symptom, and the zip tie was the messenger; fitting the RFID first with the jams untouched would only have bred a cleverer defeat.

Common mistakes

• Buying high-coded devices while leaving the motivation alone. Coding raises the effort to defeat; it does nothing about the reason.
• Treating a bridged interlock purely as a discipline case. A defeat is evidence about the task behind that guard. Ask what the door costs the operator per shift.
• Long uncontrolled series chains. Ten doors on one safety relay looks tidy and can quietly mask a faulted contact for months. Evaluate the chain or monitor doors individually.
• No functional test schedule. An interlock spends its life doing nothing; failures sleep until the one demand that counts.
• Forgetting guard locking where the hazard outlasts the opening. If anything coasts, spins down or stays hot after the stop command, position interlocking alone opens the door onto a live hazard.
• No per-guard records. "We check the guards" proves nothing about guard 7. One line per guard, per test, with the finding, is what stands up after an incident.

Frequently asked questions

What is the difference between an interlock and guard locking?

An interlock ties guard position to the machine: open the guard and the hazardous function stops and cannot start. Guard locking adds a physical hold: the guard stays closed until a time delay or standstill monitor confirms the hazard is over. Locking is needed wherever run-down or another persistent hazard outlasts the opening.

What are ISO 14119 type 1 to 4 devices?

Type 1: mechanical, uncoded (cam-operated position switch). Type 2: mechanical, coded (tongue switch). Type 3: non-contact, uncoded (plain magnet or inductive sensor). Type 4: non-contact, coded (RFID or coded magnet). Coding runs from low (1 to 9 codes) to high (more than 1,000); higher coding buys resistance to defeat.

Can interlocks be wired in series?

Yes, but chains of electromechanical devices are exposed to fault masking: overlapping door openings can hide a faulted contact from the safety relay, degrading diagnostic coverage. ISO/TR 24119 gives the evaluation method. Keep chains short, monitor busy doors individually, or cascade electronic devices with self-monitored outputs.

How often should guard interlocks be tested?

On a schedule your risk assessment and the machine's validation define, commonly between monthly and annually per guard, more often for high-demand doors. The test: open the guard, verify the stop and start prevention; for locking, the hold and release. What matters is that every guard is on the schedule and every test leaves a record.

What should we do when we find a defeated interlock?

Stop the machine and restore the safety function before it runs again; a bridged interlock means the guard is not a guard. Record the finding against that guard, then investigate the task behind the door: how often it opens, why, and what each opening costs. Fix that cause first, then decide whether a higher-coded device, relocated mounting or non-detachable actuator is also needed.