A safety interlock switch is a guard-monitoring device that only allows a machine to run when a door, hatch, or cover is closed, holding the machine in a stopped state when the guard is open [S5].
For upstream, midstream, and downstream oil and gas assets, switch selection is driven by four hard constraints: the guard risk level, the physical environment (corrosion, wash-down, explosive atmosphere), the desired lock behaviour during a stop, and the safety category the site safety system can accept [S1][S6].
Switch construction types and where each one fits
Three principal constructions are offered by the major suppliers: keyed (mechanical) interlock switches, non-contact (magnetic or coded) switches, and hybrid switches that combine a coded actuator with electronic monitoring [S3][S4].
A keyed switch uses a dedicated actuator that physically inserts into the switch body; the actuator rotates an internal cam that drives a normally closed (NC) contact, so the circuit is closed only when the correct key is present [S4][S5]. Eaton documents two latching principles on its keyed line: magnetic-force interlocking on the open-circuit principle, and spring-force interlocking on the closed-circuit principle [S4]. IDEC recommends spring-locked switches for large machining centres and other machinery with a high risk of mechanical hazard, where the door must stay locked until stored energy is safely dissipated [S5].
A non-contact switch replaces the mechanical key with a coded-magnet actuator, with the sensor mounted on the fixed frame and the magnet on the moving guard [S4]. This construction survives dirty and greasy environments, tolerates guard misalignment, and removes the wear path that mechanically defeats a keyed slot over time, which is why it is widely used on skids that see frequent wash-down or sand exposure [S4][S1].
Hybrid switches from suppliers such as KEYENCE add an electronic evaluation stage, packaging a non-contact actuator with on-board monitoring so the same SKU can feed a safety relay or a higher-level safety controller without external signal conditioning [S3].
ISO 13849-1 categories and the oil and gas risk picture
ISO 13849-1 defines five control-system reliability categories, B, 1, 2, 3, and 4, running from least to most reliable in the presence of a fault, and the chosen switch plus its wiring must be able to sustain the category the risk assessment demands [S8].
Banner Engineering notes that category 1 uses well-tried components and single-channel architecture, while category 3 requires a dual-channel design where a single fault does not lead to loss of the safety function and the fault is detected where reasonably practicable [S8]. Category 4, used on the most exposed guards, applies the same dual-channel test logic but demands that a single fault does not cause loss of the safety function even when accumulated faults are not detected [S8].
On a process skid in a hazardous area, the practical implication is that a single mechanical limit switch on one cable, the historical default, will not satisfy category 3 or 4 regardless of switch quality, and the switch must be paired with a second channel and a monitoring device, often a safety relay or a safety PLC, that performs the cross-fault check [S8][S1].
Explosive atmospheres: matching certification to the zoning
On any equipment installed inside a classified area, the switch and its cable entry must carry the IECEx or ATEX marking that matches the zone, and the certification dossier has to cover the full assembly rather than just the contact block [S1][S6].
For a typical well-pad or compressor-station guard, the marking usually requires Ex db (flameproof) or Ex tb (dust by enclosure) protection depending on whether the surrounding atmosphere is gas or dust dominated, and the ambient temperature range of the certificate, commonly a -20 to +60 °C band, must cover the local derating curve of the enclosure [S6]. Stainless or zinc-alloy heads with IP66 or IP67 sealing are the default choice where the switch is exposed to salt spray, hydrogen sulphide, or routine hose-down, and the certification must be checked at the part-number level rather than the series level because coating and gasket options can shift the marking [S1].
Where the switch body is mounted inside a non-classified cabinet but the actuator is on a guard that crosses the zone boundary, the certification scope must be reviewed so the active face of the switch, not just the wiring terminals, sits inside the certified envelope [S6].
Locking vs non-locking: matching the lock to the process state
A non-locking interlock only reports the open/closed status of the door, so the door can be pulled open at any time regardless of the machine state, and the safety logic in the controller is what enforces the stop [S5]. A locking interlock adds a mechanical or magnetic latch that keeps the door shut until the controller releases it, which is required whenever a stop alone is not enough to keep the hazard neutral.
IDEC segments locking switches into two sub-types: spring-locked devices, which hold the door closed under spring force and unlock only when power is applied, and solenoid-locked devices, which require continuous power to stay locked and release on power loss [S5]. The spring-locked (closed-circuit) principle is the default where loss of power must not release a pressurised or rotating machine, while the solenoid-locked (open-circuit) principle is the default where loss of power must allow the operator to escape, for example on a guard around a thermally hot vessel [S4][S5].
Selection here should be written into the site LOTO philosophy, because picking the wrong lock direction is one of the few switch-choices that can defeat a SIL-rated shutdown on paper while leaving it intact in the cabinet.
Comparison: keyed, non-contact, and hybrid on four decision criteria
For an oil and gas guard-door specification, the three switch families compare on the four criteria that drive most project approvals: tamper resistance, environmental tolerance, life-cycle cost, and integration with a category 3 or 4 safety chain [S1][S3][S4].
Keyed mechanical switches score highest on tamper resistance because the actuator geometry is unique and difficult to reproduce, but score lowest on environmental tolerance because the slot collects dust, salt, and ice that can jam the cam, and the moving parts set a finite mechanical life [S4][S5]. Non-contact coded-magnet switches reverse that profile: they tolerate dirty, greasy, and wet environments, have a long service life because there is no contact wear, but they are easier to defeat with a sufficiently powerful magnet unless the supplier adds a coded-magnet scheme [S3][S4]. Hybrid switches are the practical compromise: they keep the non-contact actuator and add an electronic evaluation stage, giving the tamper profile of a coded system with the diagnostic coverage expected by a category 3 chain, at a unit cost above either pure type [S3][S1].
For a typical midstream gas-compression skid, the dominant picks are a stainless keyed switch with Ex db marking for hot, dirty, and high-vibration cabinets, and a coded-magnet non-contact switch with IP67 sealing for hinged guards and removable covers that cycle many times per shift [S4][S6].
What interlock switches cannot do, and common failure modes
Safety interlock switches are guard-position devices, not presence-sensing devices, and they will not detect an operator who reaches through a closed guard or who bypasses the door entirely with a homemade key [S1][S5]. The override (defeat) prevention feature is a design intent, not a guarantee, and the practical protection comes from making the actuator unique, routing the wiring so it is hard to jumper at the terminals, and using a second switch or a coded magnet so a single bypass does not satisfy the safety logic [S5].
Failure modes that recur on operating sites include cam wear in high-cycle keyed switches, which lengthens the actuation travel and can cause the NC contact to fail to close; magnet degradation in non-contact switches exposed to sustained temperature above the actuator rating; and cable-entry corrosion on stainless-headed switches installed with standard cable glands in salt-spray zones, which is why a switch datasheet showing 316L stainless is not enough on its own and the gland must be specced to the same IP rating [S1][S4].
Mechanical guarding on rotating equipment is the most common adjacent risk, and the broader construction machinery and equipment family of standards addresses the guarding itself rather than the switch, so the two are typically spec'd together but against different documents.
Sourcing, documentation, and standards to put on the datasheet
A datasheet that survives an oil and gas project review should list, in this order, the ISO 13849-1 category the switch plus its wiring can sustain, the IECEx or ATEX marking with the gas group and temperature class, the IP rating, the actuator type and coding, the mechanical life in cycles, the ambient temperature range, and the recommended safety relay or controller family [S1][S2][S6].
Suppliers publish this data in different places: Rockwell Automation consolidates manuals and installation instructions for its Bulletin 440 and 442 lines on a single technical-documentation page [S2]; Eaton publishes the operating principles of magnetic and spring interlocking alongside its LS-Titan miniature IEC limit-switch line [S4]; IDEC publishes a 2025-dated engineering guide covering spring-lock, solenoid-lock, and override-prevention design (2025-08) [S5]; KEYENCE groups its locking, non-contact, and hybrid SKUs under one product page so the three options can be compared against the same risk scenario [S3]; WEG lists the switch family under its safety product catalog for direct cross-reference [S7].
For new builds, the watchpoint is that the safety category on the switch datasheet must be matched, not just the IEC 61508 SIL claim, because two devices with the same SIL figure can sit in different ISO 13849-1 categories, and the safety PLC programming is keyed to the category, not the SIL number, on most operating sites [S8]. Personal protective equipment is a separate decision and uses its own standards chain, so helmet and respirator picks such as helmet selection under EN 12492, EN 397, and ANSI Z89.1 and respirator selection for confined-space entry under APF and IDLH logic sit downstream of the interlock decision rather than upstream.
Trackable signals to watch over the next quarter: any IECEx certificate revision that reclassifies coded-magnet switches for higher gas groups, and any ISO 13849-1 revision that changes the diagnostic-coverage requirements for category 2 devices, which would shift the cost balance between dual-channel mechanical switches and single-channel non-contact switches on category 2 guards [S6][S8].
The underlying component specifications are covered under safety interlock switch, and oil seal.