Safety Interlock Switch

What is a Safety Interlock Switch

A safety interlock switch is a position-sensing safety component that establishes a logical link between a movable guard and the hazardous functions of a machine. When the guard is closed, the switch closes its safety circuit and the machine is allowed to operate. When the guard opens, the switch opens that circuit, the control system removes power from the hazardous motion, and the machine stops. The word "safety" is not decoration: an interlock switch is engineered so that its failure modes are known, bounded, and credited in a quantitative risk reduction calculation, which is exactly what separates it from a generic limit switch or proximity sensor.

The defining behaviour is the stop command on guard opening. A simple position sensor reports a state, but a safety interlock device must guarantee that the stop is issued even when one of its own components has failed. Electromechanical switches achieve this through positive opening contacts that are forced apart by a rigid mechanical link. Non-contact RFID switches achieve it through redundant internal microprocessors that cross-check each other. In both cases the goal is the same: a single fault must not lead to the loss of the safety function, or at minimum must be detected before the next demand.

Two device families live under the same name. A plain interlocking device only monitors guard position. A guard locking device adds an actuator-retaining mechanism, a bolt or a magnet, that physically holds the guard shut and only releases it on command from the control system. The decision between them is not aesthetic. ISO 14119 makes guard locking mandatory whenever the machine run-down time after a stop command exceeds the time a person needs to reach the hazard zone after opening the guard. A press brake, a centrifuge, or a large robot can coast for seconds after the stop command, and a plain interlock would let the operator reach in while motion is still dangerous.

The standards landscape is layered. ISO 14119 is the Type-B2 standard specific to interlocking devices associated with guards, replacing the older EN 1088. It sits beneath ISO 12100, the Type-A standard for general risk assessment, and works alongside ISO 13849-1, which quantifies the performance level (PL) of the complete safety function, and IEC 62061, which expresses the same idea as a safety integrity level (SIL). The electrical and contact behaviour of mechanical switches is governed by IEC 60947-5-1, whose Annex K defines direct opening action. A correctly specified interlock satisfies all of these simultaneously.

Historically, guard interlocking grew out of the simple limit switch. Early machine guards used a cam pressing a roller plunger, which was trivially defeated by taping the plunger down. The tongue-operated switch, where a uniquely shaped actuator must enter the switch head, made casual defeat harder. The 2013 revision of ISO 14119 formalised the four-type classification and introduced explicit coding levels, and the rise of RFID sensing after the mid-2010s delivered high coding, where each reader is taught one unique transponder, finally making the spare-actuator defeat impractical. The 2024 edition of ISO 14119 added a fifth type, Type 5 trapped-key interlocking devices, by integrating ISO/TS 19837, and refined the guidance on combining devices and on fault exclusion while keeping the coding-level framework intact.

ISO 14119 Interlock Types

ISO 14119 sorts electrically sensed interlocking devices into four types using two questions: is the actuator sensed mechanically or without contact, and is the actuator coded or uncoded. These two axes produce the four types below, while the 2024 edition adds a separate Type 5 for mechanical trapped-key systems. The type drives both the defeat resistance and the mounting requirements, so naming the type correctly is the first concrete decision in any selection.

Type 1 devices are mechanically actuated with an uncoded actuator. The classic example is a position switch operated by a cam, a roller, or a hinge as the guard moves. They are robust and inexpensive, but the uncoded actuator means a person can defeat the switch with a screwdriver, a cable tie, or a duplicate cam. Because of this, ISO 14119 requires additional measures to minimise defeat when a Type 1 device is reasonably foreseeable to be bypassed, such as concealed mounting, status monitoring, or mechanical obstruction of access to the actuator.

Type 2 devices are mechanically actuated with a coded actuator. The dominant form is the tongue-operated switch, where a flat actuator shaped to match the switch head must be inserted before the contacts close. Because the actuator carries a profile that the head must accept, casual defeat is harder than with Type 1, though a determined person can still obtain a spare tongue. Trapped-key interlock systems, mechanically related to coded actuation, are classified in their own Type 5 in the 2024 edition: a key is released only when the machine is safe, and that same key is needed to open the guard, enforcing a sequence of operations.

Type 3 devices are non-contact with an uncoded actuator, typically an uncoded magnet sensed by a reed or magnetoresistive element. They tolerate door misalignment and washdown well and have no mechanical wear, but an uncoded magnet can be defeated with any equivalent magnet, so like Type 1 they require additional measures against foreseeable defeat. Type 4 devices are non-contact with a coded actuator, which in current practice means RFID. The reader recognises only the transponder identity it has been taught, giving the highest defeat resistance of the four types while retaining the alignment tolerance and wear-free operation of non-contact sensing.

The practical consequence of the type is the anti-defeat obligation. ISO 14119 introduces the concept of coding level, low, medium, or high, that quantifies how many distinct actuator codes a device family supports. Low coding offers 1 to 9 variations, medium coding offers 10 to 1000, and high coding offers more than 1000. A high-coded Type 4 RFID device that has been taught one unique transponder needs no additional defeat measures in most layouts, whereas a low-coded or uncoded device must be supplemented with mounting and monitoring measures from the standard. This is why a single RFID switch often replaces a tongue switch plus its anti-tamper hardware in a modern design.

Actuation Technologies and Coding

Inside the four ISO 14119 types sit several physical sensing technologies, each with its own accuracy, defeat resistance, environmental tolerance, and cost. The four mainstream families are tongue and plunger electromechanical, coded magnetic, RFID coded, and trapped-key. The table below compares their core engineering characteristics so the technology can be matched to the duty before a brand is chosen.

Tongue and plunger electromechanical switches use a forced mechanical link to drive normally closed contacts. Their safety credibility rests on positive opening operation per Annex K of IEC 60947-5-1, meaning the contacts are pried apart by a rigid non-resilient member as a direct result of actuator withdrawal, so the safety circuit opens even if a contact has welded. A switch with direct opening action carries the arrow-in-circle symbol and is credited with a B10d of 2,000,000 operations under EN 60947-5-1 Annex K, a number that flows directly into the ISO 13849-1 reliability calculation. The trade-off is mechanical wear, sensitivity to door misalignment, and the modest coding of a physical tongue.

Coded magnetic switches pair a coded permanent magnet with reed or magnetoresistive sensing in a sealed, often potted housing. They have no moving parts, tolerate significant door sag and misalignment, and survive high-pressure washdown, which makes them a favourite in food, beverage, and pharmaceutical lines. Under ISO 14119 they are classed as Type 4 non-contact coded but typically achieve only low-level coding, so they may still need supplementary defeat measures where bypass is foreseeable. Because the reed contacts can fail, these devices are almost always evaluated as redundant dual-channel pairs read by a safety relay or controller.

RFID coded switches are the modern reference for non-contact interlocking. A transponder in the actuator answers the reader over a short-range RF link, and the reader admits only the identity it has been taught. Devices such as the Schmersal RSS260 integrate dual monitoring microprocessors so that a single sensor reaches PLe per ISO 13849-1 and SIL3 per IEC 62061 without a second device. High-coded variants exceed 1000 code variations and resist the spare-actuator defeat outright. Many RFID series can be wired in series across many doors while still reporting per-door diagnostics over a serial line or IO-Link, which collapses wiring on machines with a dozen access points.

Trapped-key interlock systems use mechanical keys rather than electrical sensing to enforce a sequence. A key is locked into an isolator until the machine is made safe, then released so it can open a guard; the guard cannot be opened until the correct key, only obtainable after isolation, is present. Because they are purely mechanical, trapped-key systems suit large enclosures, distributed plant, and high-voltage areas where running safety-rated wiring to every access point is impractical, and they enforce a strict order of operations that electrical interlocks alone do not.

Guard Locking Force and Release Functions

When run-down time exceeds access time, a plain interlock is not enough and a guard locking device is required. The two questions that then dominate the datasheet are how the lock is driven, the locking principle, and how hard it can hold, the locking force. Both are safety-relevant and both are frequently misread, so this chapter treats them in detail before turning to the mandatory release functions.

The locking principle describes what happens to the bolt when power is lost. In the power-to-unlock principle, also called the closed-circuit current or mechanical guard locking principle, a spring drives and holds the bolt, and the solenoid is energised only to release it. A power failure therefore leaves the guard locked. This is the principle specified for personnel protection, because the dangerous machine cannot trap a person and the guard remains locked through a blackout until the control system deliberately commands release. In the power-to-lock principle, also called the open-circuit current or electrical guard locking principle, the solenoid must stay energised to keep the bolt extended, and a spring releases the lock when power is removed, so a power failure unlocks the guard. Power-to-lock is generally reserved for process protection, where an unexpected stop is more costly than the brief access risk.

The locking force is the second decisive parameter. Electromechanical bolt-style guard locks publish a rated holding force, often written FZh, that the device can resist before the bolt yields. Industrial bolt locks commonly fall in the range of roughly 1000 N to 2600 N: several EUCHNER STM models reach up to 2000 N and the STP up to 2500 N, while Schmersal AZM and Pilz PSENmlock families publish their own rated values per variant. ISO 14119 requires the rated holding force FZh to exceed the maximum foreseeable force F1max that a person, stored mechanical energy, or a falling guard could apply, with a margin. Magnetic locking RFID variants hold with far less force, on the order of tens to a few hundred newtons, and are intended only to keep a light door closed, not to physically restrain a person, so they must not be selected where the lock itself is the safeguard against access.

ISO 14119 also defines three release functions that a guard locking device may need. The escape release unlocks the guard from inside the safeguarded space without any auxiliary tool, so a person who becomes trapped can always get out; operating it must generate a stop command. The emergency release unlocks the guard from outside in an emergency, again without a special tool. The auxiliary release permits deliberate unlocking from outside, but only by using a tool or key, and is intended for maintenance and fault recovery rather than routine operation. Whether each release is required follows from the machine layout, in particular whether a person can be enclosed by the guard. These functions are not optional extras to be value-engineered away; an omitted escape release on a walk-in cell is a direct standard violation and a lock-in hazard.

Defeat resistance applies to locking devices as it does to plain interlocks. Mounting hardware that cannot be removed with standard tools, concealed fasteners, status monitoring of both the door and the bolt, and high coding all reduce the chance that the device is bypassed in a reasonably foreseeable manner. A guard lock that is easy to override with a coin or a cable tie provides a false sense of protection, which is precisely the failure mode the type and coding framework exists to prevent.

Key Specification Parameters

Reading an interlock datasheet means separating the safety-rated figures from the convenience figures. A switch may list two dozen parameters, but a manageable set drives the safety case and the selection: attained performance level and SIL, the reliability figure feeding them, the contact or output configuration, locking force and principle where applicable, environmental rating, and the release and diagnostic provisions. Each is explained below.

Performance level (PL) and SIL express the achievable risk reduction of the device within a safety function. The top tiers, PLe per ISO 13849-1 and SIL3 per IEC 62061, are achievable by a single RFID device with internal redundancy such as the Schmersal RSS260, or by a pair of redundant electromechanical switches read by a safety relay. The device datasheet states the maximum PL or SIL it can support; the actual PL of the whole function still depends on the switch, the logic, and the output actuator together, so the device figure is a ceiling, not a guarantee for the loop.

Reliability data underpins the PL and SIL claim. Electromechanical interlocks publish a B10d, the number of operations at which 10 percent of a population fails to danger; a positive-opening switch is credited with 2,000,000 operations under EN 60947-5-1 Annex K. Electronic and RFID devices instead publish a PFHd, the probability of a dangerous failure per hour, often in the range of about 1×10⁻⁹ to 5×10⁻⁹ for PLe-rated sensors, together with a mission time, commonly 20 years. These numbers, not the marketing tier label, are what the engineer enters into the calculation.

Contact and output configuration defines how the switch reports state. Electromechanical switches list normally closed safety contacts with direct opening action, often two channels, plus normally open auxiliary contacts for signalling, and separate contacts for door monitoring versus lock monitoring on a guard lock. RFID safety sensors instead provide two redundant OSSD (output signal switching device) outputs that are tested with short pulses for fault detection, plus a diagnostic output. The rated thermal current and utilisation category, for example AC-15 or DC-13 per IEC 60947-5-1, bound what the contacts may switch.

Other parameters worth decoding before purchase:

• Ingress protection: IP65, IP67, IP69, or IP69K. Washdown and food applications demand IP69K and a hygienic housing; an underrated enclosure admits moisture that corrodes contacts or fogs electronics.
• Operating temperature: commonly around -25 °C to +65 °C for RFID sensors and wider for rugged electromechanical units; outdoor and cold-store duty needs the low end verified.
• Coding level: low (1 to 9 variations), medium (10 to 1000), or high (more than 1000), which determines whether supplementary anti-defeat measures are needed.
• Locking force and principle: rated FZh holding force in newtons and power-to-lock or power-to-unlock behaviour, for guard locking variants only.
• Release functions: presence of escape, emergency, and auxiliary release, matched to whether a person can be enclosed.
• Diagnostics and wiring: series connection capability, IO-Link or serial diagnostics, and connector style (M12 or cable gland) that determine commissioning effort on multi-door machines.

One parameter that is easy to overlook is the minimum door radius for sliding or hinged guards, which determines whether a tongue can enter the head reliably. EUCHNER STM, for example, suits door radii down to a minimum of 300 mm; a tighter radius forces a different actuator or a non-contact device. Mismatched geometry causes nuisance trips that operators eventually defeat, which is how a correctly rated switch ends up bypassed in the field.

Selection Decision Factors

To turn the preceding five chapters into a chosen model, follow the decision sequence below. The order matters: most interlock mistakes come not from one wrong figure but from deciding the brand before the risk assessment has settled the type, the locking requirement, and the release functions. These steps can serve as a fixed RFQ template for any guarded access point.

1. Run risk assessment first: from ISO 12100 and ISO 13849-1, establish the required performance level (for example PLd or PLe) or SIL for the access point. This sets the floor for every later choice and cannot be inferred from the machine type alone.
2. Decide interlock versus guard locking: compare machine run-down time after the stop command with the time a person needs to reach the hazard after opening the guard. If run-down exceeds access time, guard locking is mandatory under ISO 14119; otherwise a plain interlock suffices.
3. Choose the ISO 14119 type and coding level: select Type 1 to 4 by actuation and coding, then set the coding level (low, medium, high) high enough that no separate anti-defeat measures are needed, or accept the supplementary measures the standard requires for lower coding.
4. Set the locking principle and force, if locking: choose power-to-unlock for personnel protection and power-to-lock only for process protection, then size the rated holding force FZh above the maximum foreseeable force F1max with margin.
5. Specify release functions: add escape release wherever a person can be enclosed, emergency release where outside emergency access is needed, and auxiliary release for maintenance, matching each to the cell layout rather than to a default option list.
6. Match environment and geometry: ingress protection (IP67 minimum outdoors, IP69K for washdown), operating temperature, hygienic housing for food, and minimum door radius or alignment tolerance for the guard kinematics.
7. Define electrical interface and diagnostics: dual NC positive-opening contacts read by a safety relay, or OSSD outputs to a safety controller; series wiring and IO-Link or serial diagnostics for multi-door machines; connector style and cable entry.
8. Confirm certification and ecosystem: CE marking, the relevant type examination, compatibility with the chosen safety controller family, and that the device datasheet states the PL, SIL, B10d, or PFHd actually used in the calculation.

One last commonly overlooked dimension is serviceability and defeat resistance in the installed life: whether mounting fasteners resist removal with standard tools, whether the actuator can be taught or retaught after a swap, whether spare actuators are controlled, and whether the supplier holds local stock. A high-coded RFID switch that is easy to re-teach without authorisation, or a bolt lock whose escape release is awkward, will be worked around by operators within months. EUCHNER, Schmersal, Pilz, Sick, Allen-Bradley Guardmaster, Omron, Pizzato, and Keyence all maintain documented type examinations and regional distribution, which makes them defensible choices for audited machine safety projects.