SiteIt's 2am. The palletiser keeps jamming at the layer forming table. Every jam means opening the gate, which stops the cell, then a reset and a restart. Ten minutes each time.
Somebody worked out years ago that a spare actuator, cable-tied into the switch head, lets the cell run with the gate open. Now the operators step in, pull the bad case and step out while the gantry keeps moving. Everyone on nights knows. Nobody on days says anything.
An interlock almost never fails on its own. Someone defeats it, usually for a reason that makes sense at 2am. The job is to find that reason and fix it.
What an interlock has to do
The code of practice for PUWER, L22, describes movable guards that open without tools. These are likely to need an interlocking device so that (L22, Appendix 1, paragraph 2):
- the dangerous functions can't run until the guard is closed
- opening the guard while they're running gives a stop instruction
- closing the guard lets them run, but doesn't start them by itself
Where the machine takes time to stop, the guard may need a locking device. That keeps it shut and locked "until any risk of injury from the hazardous machine functions has passed". A spindle running down or a robot finishing its move are the usual cases.
PUWER regulation 11 says guards and protection devices must "not be easily bypassed or disabled" (regulation 11). L22 goes further. The interlocking device must be designed and installed so that it's "difficult or impossible to bypass or defeat" (L22, Appendix 1, paragraph 19). For choosing and fitting them, it points to BS 14119*. Our post on the order of guards explains where interlocked guards sit in the hierarchy.
An interlock is a control
One thing your team must never mix up. L22 says interlocked guards and emergency stops "are not suitable as a means of isolation" (L22, paragraph 195).
Opening the gate stops the cell for the operator clearing a jam. For a fitter going in to change a gripper, the gate switch counts for nothing. Lock off at the isolator. See lock off, tag out, prove dead.
How they get defeated
These are the ones we see most. None of them is clever, and all of them work:
- a spare tongue actuator taped or tied into the switch head
- a magnet stuck on a non-coded magnetic switch
- a link wire across the safety contacts in the panel
- the guard taken off its hinges, leaving the switch made
- a maintenance or override selector left in the bypass position
- a forced input in the PLC that nobody removed
- a light curtain muted, or swung round so it can't see the opening
Some are deliberate. Some start as a fault-finding step and never get undone. Forcing a guard input while you're online to a PLC to fault-find is a real risk if the force stays in when you log off.
Why people do it
HSE's brief guide to PUWER is honest about this. It warns about safeguards that "may be inconvenient to use or easily overridden". Its advice is to find out why people are doing it and deal with the cause (INDG291).
L22 gives one common cause. If operators can't see the process, "there is a temptation for the operator to remove or disable guards or interlocks" (L22, Appendix 1, paragraph 27).
In our experience the cause is usually one of these. The machine jams too often. The restart takes too long. Or the switch has been faulty for weeks and the bypass was the only way to keep running. Each one is a maintenance problem before it's a discipline problem.
Back to the palletiser. The real fault is the jam at the layer table. Fix that, and the reason for the spare actuator goes away.
Bypassing for maintenance
Sometimes you do need to run with a guard open, for example to watch a fault happen. L22 accepts that bypassing can be needed "for a particular purpose such as maintenance". The risks "must be carefully assessed", and design should reduce them where possible (L22, Appendix 1, paragraph 20).
So treat it as planned work. Use the machine's own setting mode if it has one, such as reduced speed or hold-to-run. Brief it. Put the bypass on a permit to work and take it off before handover.
Closing the gate must not restart the machine
L22 says operators should not normally be able to restart kit just by resetting a protection device, "such as, for example, an interlock". The start control should also be needed (L22, paragraph 165). If shutting the gate sets your machine running, someone can be shut inside it. Check every cell where a person can get fully inside.
Test them, and expect them to fail
L22 says protection devices and interlocks should be checked, and "some form of functional check or test is desirable" (L22, Appendix 1, paragraph 13). Inspections under PUWER may include a functional test of interlocks (L22, paragraph 89). If a part fails, the system should fail safe as far as possible (L22, Appendix 1, paragraph 10).
A functional test is simple. With the machine running, open each guard and confirm it stops. Then confirm it won't start with the guard open. Log it.
The cost of the bridge at 2am
Here's our view. Interlock switches fail, and when they do it's often at night. The person on shift has two choices. Find the fault, which can mean a safety relay and a dual-channel circuit they don't know. Or put a link in and get the trailers out.
If the only engineer on nights can't fault-find a safety circuit, the link is coming. Plan for it. Hold spare switches and actuators for your critical cells, as part of your critical spares. Make sure someone on every shift can work through safety relays and light curtains, or knows who to call.
What to do on Monday
- Walk the site on a night shift. Look for spare actuators, magnets, tape and open bypass selectors.
- Ask operators which guard they'd most like gone. Then fix the fault that makes them open it.
- Add a functional test of every guard interlock to your planned maintenance.
- Stock spare interlock switches and actuators for your critical machines.
* L22's reference to BS 14119 for interlocking devices correct as of 22 October 2026. Check L22 on HSE's website and PUWER on legislation.gov.uk for the latest. Paragraph numbers refer to L22, fourth edition (2014, amended 2018).