Safety Interlock Switch Types and Defeat Resistance
Short answer
- A standard limit switch wired into a safety circuit is not a safety-rated interlock.
- Safety interlocks need positive-opening (direct opening action) contacts, where a rigid linkage forces the contact open even if it has welded shut (ISO 14119).
- Tongue-actuated switches are robust and economical but a spare actuator key defeats them. Hinge switches remove the external key but need accurate door alignment. Basic magnetic reed switches offer low defeat resistance.
- Coded electronic non-contact switches read a code in the actuator to counter magnet defeat, and guard-locking switches keep a guard shut until a machine has stopped.
A guard interlock switch exists to keep a machine from running while a guard is open, or to keep the guard locked shut until the machine has safely stopped. The challenge is that a standard limit switch wired into a safety circuit is not a safety-rated interlock. A maintenance worker can tape the actuator down, the mechanism can fail to open the contact under fault, and a simple switch provides no protection against a guard being opened while a high-inertia drum is still spinning down. Selecting the right interlock family requires understanding the physical failure modes and the specific defeat mechanisms of each technology.
Positive-Opening (Direct Opening Action) Contacts
The fundamental difference between a general-purpose switch and a safety-rated switch is positive opening, defined in ISO 14119 as direct opening action. In a standard normally closed (NC) limit switch, the contact is held closed by spring pressure. When the actuator is released, the spring pushes the contact carrier back, and the NC contact opens. If that spring breaks, or if the contact welds shut due to an arc or overload, the switch mechanically returns to its resting position but the contact remains closed. The machine keeps running with the guard open.
A positively guided, direct opening contact uses a rigid mechanical linkage between the actuator and the contact carrier. When the guard opens and pulls the actuator, the actuator physically forces the NC contact open. It does not rely on a return spring to open the safety contact. If the contact is welded shut, the rigid actuator mechanism will shear it apart or stall the actuator, ensuring the safety circuit breaks. The switch may be destroyed in the process, but it fails to a safe state. This is why safety standards require positive-opening contacts for mechanical interlocks, and why you must verify the direct opening action symbol (a cam with an arrow) on the switch body, not just the contact logic.
Mechanical Tongue-Actuated and Hinge Switches
Tongue-actuated (or key-operated) switches are the most common and economical interlocks. A separate actuator key mounted on the guard door enters a slot in the switch body. Inside, the key pushes a mechanical cam that positively opens the NC contacts when the key is withdrawn. They are robust, easy to align, and highly resistant to dirt and coolants, making them suitable for harsh machine environments.
Their primary vulnerability is defeat resistance. A spare actuator key left in a maintenance toolbox defeats the switch entirely. An operator can open the guard, insert the spare key into the switch slot, and the machine runs as if the guard is closed. For this reason, tongue switches are best suited for lower-risk applications where access is infrequent, or where the hazard has a short stopping time. For higher-risk scenarios, you must use a coded actuator or move to a non-contact coded switch.
Hinge switches integrate the interlock mechanism directly into the door hinge pivot. The door rotation actuates the internal cam. This eliminates the external actuator key entirely, making it highly resistant to the spare-key defeat mechanism. However, they require precise door alignment during installation and are vulnerable to mechanical wear or damage if the door sags or is slammed, which can shear the internal mechanism.
Non-Contact Magnetic and RFID-Coded Switches
Non-contact switches use a magnetic or electronic sensing element rather than physical mechanical actuation. They are ideal for sliding guards, tough environments, and doors that require frequent washing. Basic magnetic reed switches use a magnet in the actuator to pull the reed contacts closed. They offer high tolerance to misalignment but provide low defeat resistance. A strong external magnet can trigger the switch from outside the guard, bypassing the safety circuit.
To counter magnetic defeat, electronic non-contact switches use coded actuators and RFID technology. The switch head contains a sensing coil that reads a specific code embedded in the actuator. ISO 14119 defines coding levels for these devices:
- Low coding: The actuator is coded at the factory, but the switch cannot distinguish between actuators of the same model. Any actuator of the same type will trigger it. Defeat resistance is moderate.
- Medium coding: The switch is taught to recognize one specific actuator during commissioning. It will not respond to a different actuator of the same model. Defeat resistance is high.
- High coding: The switch and actuator are uniquely paired at the factory and cannot be re-taught. Defeat resistance is very high, as a replacement requires ordering a new matched pair.
Coded non-contact switches solve the spare-key problem of mechanical tongue switches, but they introduce a different limitation. Because they use electronic sensing and solid-state outputs, they require a safety-rated controller to monitor the signal integrity and detect internal component faults. They must be wired into safety relays and controllers designed to handle dual-channel solid-state OSSD (Output Signal Switching Device) outputs, rather than simple mechanical contact inputs.
Guard-Locking Switches and Machine Run-Down Time
Monitoring a guard door is not enough if the machine has residual motion. A large flywheel, a high-inertia fan, or a spinning drum does not stop instantly when the motor stops. If the interlock only monitors the door position, an operator can open the guard immediately and walk into a hazard zone while the machine is still coasting. In these cases, you need a guard-locking interlock.
A guard-locking switch physically locks the door shut. The safety circuit monitors both the door position and the lock status. The lock is only released when the machine has reached a safe state (zero motion, or zero pressure). Guard-locking switches come in two fundamental operating modes:
- Spring-applied (power-to-unlock): The lock is engaged by a mechanical spring. Power must be applied to release the lock. If power is lost, the door remains locked. This is the fail-safe mode, preferred for most machines where the hazard is present whenever power is off.
- Power-applied (power-to-lock): Power is required to engage the lock. If power is lost, the lock releases. This is used for specific applications where personnel must be able to escape the safeguarded area during a power failure, such as large robotic cells or enclosed automated lines.
Selecting the wrong locking mode is a critical safety failure. A power-to-lock switch on a high-inertia lathe will release the door during a power outage, exposing the operator to a coasting chuck. You must calculate the machine stopping time (run-down time) and ensure the safety controller enforces a time delay or a standstill monitor before it commands the lock to release.
Series Connection Limits and Coded Devices
Wiring multiple mechanical interlocks in series (cascading) into a single safety relay input is a standard practice to save wiring and controller costs. However, series connection reduces the level of diagnostic coverage. If three switches are wired in series and one fails to open, the safety relay trips, but it cannot tell you which of the three guards is open. For basic mechanical switches, this is an accepted trade-off for lower-risk zones.
For coded non-contact switches, series connection is more complex. Many RFID-coded switches use an OSSD output that pulses at a high frequency to test for cross-faults and short circuits. If you wire standard OSSD outputs in series, the pulse testing can interfere with the downstream switch, causing false trips or masking faults. Some manufacturers allow limited series connection of their coded switches, but you must verify the exact configuration in the switch manual. Often, you must route each coded switch to a dedicated input on a safety controller or use a bus-based safety network (like CIP Safety or PROFIsafe) to maintain full diagnostics.
Qualified-Person Design and Sourcing
Designing a machine safety circuit is not a plug-and-play operation. Calculating stopping times, assessing defeat resistance levels, and selecting the correct locking mode requires a qualified safety engineer or controls engineer. Arc flash and live electrical work hazards are present when testing and commissioning these circuits. Only qualified personnel should perform this work, following lockout/tagout procedures. Manufacturers like IDEC provide extensive technical documentation on their safety interlock switches, but the final validation of the safety function, including the Performance Level (PL) or Safety Integrity Level (SIL), rests on the system designer.
If you need to source safety interlocks, coded actuators, or safety relays for a machine upgrade, KKM Industrial can help cross-reference the correct components for your specific application and coding requirements.
Related reading: Cable-Pull Safety Switches: Rope Pull Explained; Machine Guarding Walk-Through Checklist.
Need a quote on a specific part?
Request a QuoteFrequently asked questions
What is a positive-opening (direct opening action) safety contact?
It is a contact opened by a rigid mechanical linkage between the actuator and the contact carrier, rather than by a return spring. If the contact has welded shut, the rigid mechanism shears it apart or stalls the actuator, so the safety circuit still breaks. The switch may be destroyed, but it fails to a safe state. Check for the direct opening action symbol on the switch body.
Why can a spare key defeat a tongue-actuated interlock?
A tongue-actuated switch works when a separate actuator key enters a slot in the switch body. A spare key left in a toolbox can be inserted with the guard open, so the machine runs as if the guard were closed. For higher-risk applications use a coded actuator or a non-contact coded switch.
What is the difference between a standard limit switch and a safety interlock switch?
A standard normally closed limit switch relies on spring pressure to open the contact, so a broken spring or a welded contact can leave the circuit closed with the guard open. A safety interlock uses positive-opening contacts so the actuator itself forces the contact open.
How do coded non-contact interlock switches reduce defeat?
Basic magnetic reed switches can be triggered from outside the guard with a strong external magnet. Electronic non-contact switches use coded actuators and RFID, with a sensing coil that reads a specific code embedded in the actuator. ISO 14119 defines coding levels for these devices.