Power-to-lock guard locking is acceptable under ISO 14119 only in two narrow cases: the machine's stopping time is shorter than the operator's access time, and the residual risk after a power failure is acceptable, or the application is process protection only and personnel cannot reach a hazard before it ceases [S2][S3].
For personal protection on hazardous machinery, the spring-applied, power-to-release principle (also called "power-to-unlock" or "closed-circuit current") is the first choice because a blackout keeps the door locked instead of releasing it into a still-moving zone [S8].
The Two Tests That Decide Locking Type: Stopping Time vs Access Time
ISO 14119 frames the decision through the relationship between machine stopping performance and the time an operator needs to reach the hazard after the guard opens; if overall system stopping performance is greater than or equal to access time, the guard must lock, otherwise an unlocked interlock is sufficient [S4]. The standard is a Type-B2 standard covering interlocking devices associated with guards, including coded actuators and both electromechanical and electromagnetic guard-locking designs [S3][S5].
Once the rule "locking required" is triggered, ISO 14119 then asks a second question: what happens on loss of electrical power? For personnel protection, the standard favours designs where power loss leaves the guard in the locked state, because the hazardous machine function must not be operable until the guard is closed and locked and the guard must remain closed and locked until the hazard has been eliminated [S1]. This is the technical reason spring-applied / power-to-release devices dominate safeguarding circuits on high-inertia rotating equipment, presses, and robot cells.
Why Power-to-Lock Is Generally Rejected for Personal Protection
Power-to-lock (sometimes called "electrical guard locking" or open-circuit current principle) holds the bolt closed only while a coil is energised; if power fails, the door unlocks and a person can open it while the machine is still coasting down or has not been confirmed safe [S2]. On a high-inertia machine this is the worst case: the safety chain is interrupted exactly when the operator most needs protection, because stopping time of the hazardous function exceeds the time for the operator to open the guard and reach the hazard [S2][S3].
Schmersal's 2025 ISO 14119 guide is explicit on this point: for personal protection, guard locking devices based on the power-to-unlock principle are the first choice, and power-to-lock should be reserved for situations where the risk assessment can demonstrate that loss of the locking function on power failure does not expose anyone to a hazard [S8]. A related engineering paper reinforces that an unlock-on-power-loss design is incompatible with the standard's text unless the machine's stopping time is provably shorter than the access time, or the hazard is not personnel-related [S3].
The Four Locking Principles in One Comparison
ISO 14119 recognises four ways to hold a guard closed, and the choice between them is a function of failure-mode safety, not preference [S2]:
1. Spring-applied, power-ON released (mechanical guard locking, closed-circuit current): spring drives to the locked state; energising the solenoid unlocks. Loss of power = locked. This is the personal-protection default and the principle used by devices such as the OMRON D4JL and most Schmersal AZM families [S2][S3].
2. Power-ON applied, spring released (electrical guard locking, open-circuit current): solenoid drives to the locked state; spring pushes open on power loss. Loss of power = unlocked. Acceptable for process protection where stopping time is shorter than access time, or for guarding a non-hazardous process function [S2].
3. Power-ON applied, power-ON released (bistable): no spring; state changes only when power is applied. Treated as a closed-circuit principle because loss of power does not change state. Loss of power = holds last position, which is acceptable only if the last commanded position is the safe one [S2].
4. Power-ON applied, power-OFF released: electromagnet holds the door without a return spring. Loss of power = unlocked, functionally identical to principle 2 but without a mechanical spring. Same restrictions on personal-protection use apply [S2].
The matrix that matters is: principle 1 or 3 is acceptable for personnel protection if the safe state is "locked"; principle 2 or 4 is only acceptable where the risk assessment shows that an unlocked guard on power loss cannot expose a person to the hazard before the machine has stopped [S2][S8].
Process Protection vs Personnel Protection: The Boundary Case
Process protection is the legitimate home for power-to-lock. If the guard exists to prevent scrap, product contamination, or an unobservable machine state from being disturbed, and a person opening the guard during coast-down cannot reach a moving hazard, then power-to-lock is acceptable and even preferred because it is simpler, draws less current in the held state, and avoids the spring-return forces that complicate large or heavy doors [S3].
The 2025 Machinery Safety 101 series also flags a specific pitfall: operators have been injured on machines where the original risk assessment classified the guard as process-only, then a layout change, tooling change, or new operator station brought personnel inside what was assumed to be a non-hazardous access envelope. ISO 14119 requires the assessment be re-validated any time the access path, the hazard zone, or the stopping time changes, and the locking principle has to follow the new answer, not the old one [S3].
Failure Considerations: Tampering, Defeat, and Performance Level
Even when the locking principle is correct, ISO 14119 requires that the device resist defeat. Table 3 of the standard specifies additional measures against defeating interlocking devices depending on the level of coding (uncoded, uniquely coded, high-level coded) and the risk-reduction required; a power-to-lock device that can be defeated by a simple tool, magnet, or by wedging the bolt open is non-compliant regardless of the principle [S9].
Performance level is set in ISO 13849-1 and is referenced by ISO 14119 for the safety-related parts of the guard-locking function. Typical practice is PL d, category 3 minimum for personnel-protection guard locking, achieved through dual-channel monitoring of the actuator position and the locking element, with the locking state confirmed by a separate monitored contact that the safety relay reads in parallel with the door-monitor contact [S3]. Designers should not assume that a single switch contact plus a coil achieves PL d; the coil itself is not a monitored safety output, it is an actuator, and the locked state has to be sensed independently.
Acceptable Use Cases: A Decision Checklist
Pulling the threads together, power-to-lock is acceptable under ISO 14119 when every one of the following is true: the hazardous machine function stops faster than the operator can reach it after the guard opens, the residual risk on power loss has been documented as acceptable, no person can be inside the hazard zone during a coast-down, and the risk assessment is re-validated whenever the access path, hazard, or stopping time changes [S2][S3][S8].
Power-to-lock is not acceptable when personnel can reach a moving hazard before it has stopped, when the machine has high-inertia rotating or linear motion, when the safety-related control system is at PL d or above and the unlocked-on-power-loss condition is not part of the safety case, or when the guard also serves as a personnel barrier per ISO 14119's definition of safeguards [S1][S3][S8]. For a deeper read on the time-based decision itself, see the companion piece on stopping time vs access time per ISO 14119, and for the related actuator-side failure mode (defeat by simple tools or magnets) the counterfeit and tamper detection practice article covers field verification methods used on safety switches. Engineers building the safety relay side of the same circuit will also want to review the locking assembly and lock nut reference pages for the mechanical interface between the actuator tongue and the guard frame.
Track these signals over the next 12 months: any CEN/ISO maintenance amendment to EN ISO 14119:2025 that revises the stopping-time vs access-time wording, and any OEM safety-relay datasheet that explicitly publishes a power-to-lock variant rated for PL d, category 3, with a separately monitored locking state rather than relying on the coil drive alone [S6][S3].
Spec-level background on the components involved: power cable.