Guard locking is mandatory whenever a person can reach a hazardous motion before that motion has come to rest, i.e. access time is shorter than stopping time, and ISO 14119 frames this as "safe guard locking for personnel protection" requiring conditional unlocking [S1][S2]. Where access time exceeds stopping time, a plain interlock without guard locking, or process-only locking on the open-circuit principle, is sufficient [S2][S5].
The decision is not a preference; it is a calculation of two time intervals, stopping/run-down time and operator access time, and the ratio of those two numbers dictates whether the guard must stay physically locked after a stop request, or whether opening the gate is enough to drop the hazard. ISO 14119 covers both cases and supplies four locking principles, four actuator coding levels, and a fault-tolerance rule tied to ISO 13849-1 performance level [S1][S2].
The Two Time Intervals That Drive the Decision
ISO 14119 ties the locking requirement to a single inequality: if access time is shorter than stopping time, the guard must be locked; if access time is longer, an interlock alone is allowed [S1][S2][S4]. IDEC restates the same rule as "if the overall system stopping performance is greater than or equal to access time, the interlocked guard does require a lock" [S4]. The "access time" is the time from opening the guard to the operator's hand, body, or tool reaching the hazard zone, and the "stopping time" is the worst-case run-down of the hazardous motion after a stop signal [S3][S7].
For practical designs, Pilz separates the two cases by the type of hazard: when access time is longer than stopping time, process guarding is enough, and an open-circuit current principle (energize-to-lock) is acceptable because unlocking at any time still produces a stop first [S2]. When access time is shorter, the standard demands conditional unlocking, which means the lock will not release until the safety control has confirmed that hazardous functions have ceased [S2][S5].
Safe Guard Locking vs Process Guarding: Comparison
The two cases differ on four criteria: triggering logic, locking principle, fault tolerance, and typical performance level. Process guarding uses unconditional unlocking (the operator can pull the lock at any moment, which itself sends the stop command), an open-circuit current (energize-to-lock) or purely electromagnetic lock, and a lower category of safety function, commonly PL c or below [S2][S5]. Safe guard locking for personnel protection uses conditional unlocking, a closed-circuit current (spring-applied, power-to-unlock) or bistable principle, and PL d or PL e depending on the architecture [S1][S2].
The reliability logic is also inverted. Open-circuit locking fails to a safe state on power loss, the gate opens, which is acceptable only because stopping time is short enough that the operator cannot reach the hazard while motion continues [S2][S5]. Closed-circuit (spring) locking fails to a safe state on power loss because the spring keeps the bolt engaged, so the operator cannot enter while the controller is dark, which is the required behavior when access time is short [S2][S5]. Bistable locking holds the last commanded state on power loss, useful where neither fail-open nor fail-closed is acceptable [S2][S5].
Four Locking Principles and Four Actuator Types
ISO 14119 organizes guard-locking devices by two orthogonal axes: the locking principle (1-4) and the actuator type (1-4, uncoded to RFID-coded) [S2][S5]. The four locking principles are: spring-applied/power-released (closed-circuit, fails locked on blackout); power-applied/spring-released (open-circuit, fails unlocked on blackout); power-applied/power-released (bistable, holds last state on blackout); and power-applied/power-off-released (open-circuit, electromagnet only, fails unlocked) [S5].
On the actuator side, Types 1 and 3 are uncoded, with Type 1 mechanical and Type 3 non-contact (inductive), and the standard requires additional manipulation-protection measures for those; Types 2 and 4 are coded, with Type 2 mechanical coded actuator and Type 4 RFID-coded actuator, which inherently resist defeat by simple tools [S2]. Coded actuators reduce the probability of bypass and typically raise the achievable performance level of the interlock function under ISO 13849-1, which is referenced from ISO 14119 for the safety-related parts of control systems [S1].
How to Calculate the Safety Distance
Once you know the times, ISO 13855 (referenced from ISO 14119) sets the minimum physical separation between the hazard and the guard, using the longer of the two times plus detection time, approach speed, and intrusion distance [S1][S7]. OMRON's selection guide repeats the rule that the stopping time of the hazardous motion is the parameter that sets the safety distance, not the operator's walking speed, because once the gate opens the controller has to assume worst-case [S3].
Dak Machine Safety restates the same approach: measure or calculate the worst-case run-down (including brake wear, hydraulic lag, and safety relay response), measure the access time from gate-open to reach, and compare; if run-down is the larger value, locking is mandatory, and the safety distance is set by the run-down time at the specified approach speed [S7]. This is why hydraulic presses, large rotating mixers, and high-inertia flywheels almost always end up on safe guard locking for personnel protection: their stopping run-down easily exceeds the half-second or so it takes a hand to clear the gate frame [S1][S2].
Selecting Devices and Common Failure Modes
For short stopping times (fractions of a second, typical of small electric servos with integrated STO), process-only locking on the open-circuit principle is often defensible; OMRON's D4JL line, for example, is positioned for guards where a stop command and gate release are acceptably simultaneous, but it must still be part of a validated safety function [S1]. For long stopping times (1-3 seconds or more, typical of hydraulic systems, large induction motors, or machines with mechanical brakes that take time to engage), spring-applied or bistable locks on the closed-circuit principle are the default, with dual-channel OSSD monitoring to detect cross-faults and shorts [S2][S5].
Two failure modes recur in the field. First, nuisance trips: a lock that drops out under vibration or door sag, which usually traces back to an under-rated holding force or a misaligned actuator, not a defective switch [S1]. Second, operator bypass: propping the door open or defeating the actuator, which the standard addresses by requiring coded actuators and, where coded actuators are not used, additional manipulation protection per ISO 14119 [S2]. A third, often missed, is legacy integration: adding a 24 V locking switch to a safety relay that was only designed for dry contacts, which can leave the lock function outside the safety integrity calculation, see the integration checklist in a typical managed vs unmanaged industrial Ethernet switch guide for the same general principle of keeping safety and non-safety on separate channels. Tamper resistance also has a PPE downstream side: even with a fully compliant locking system, operators still need the right impact-rated eye protection on the cell, which is the spec territory of a regional Z87 vs Z94.3 safety glasses comparison. For high-inertia machines, the same worst-case-stop logic that drives guard locking also drives the choice of a pressure transmitter range, because the hydraulic run-down itself is part of the stopping-time evidence the safety file must contain.
Standards, Sourcing, and Field Evidence
ISO 14119 is the Type-B2 standard cited for interlocking devices associated with guards, and it explicitly references ISO 13849-1 for the performance level (PL a through PL e) of the safety-related control function [S1][S2]. Pilz's lexicon, GT Engineering's chapter on the standard, and IDEC's Canadian explainer all converge on the same stopping-time vs access-time inequality and the same four locking principles, so the rule is not vendor-specific; it is a normative requirement [S2][S4][S5].
For traceability, the safety file for any guarded cell should record the measured stopping time (worst case, including brake wear allowance), the calculated access time, the ISO 14119 device type (1-4) and coding level (uncoded, coded, uniquely coded), the ISO 13849-1 PL achieved by the safety function, and the rationale for choosing process or personnel protection locking [S1][S2]. A practical field signal to watch is the shift of large hydraulic-cell rebuilds from open-circuit electromagnetic locks to spring-applied bistable locks, driven by the tightening of guard-locking expectations in OEM safety specifications throughout 2025 and 2026. A second signal is the rising use of RFID-coded Type 4 actuators on packaging and palletizer cells, where manipulation risk is high and the cost premium over Type 1 has fallen to roughly the same order of magnitude as a single locking assembly retrofit, which makes coded actuation the new default for new builds. Finally, any change in machine stop category (controlled stop per IEC 60204-1 versus uncontrolled stop) must trigger a re-calculation of the access vs stopping time comparison and a re-validation of the locking principle, because the stopping time on the right side of the inequality is the only number that actually matters to ISO 14119.
Component reference pages worth checking: time relay.