What is an interlock?
An interlock is an automatic locking or blocking function that allows an action in a machine or process installation only when predefined conditions are met, and that prevents or aborts the action as soon as they no longer are. Interlocks are implemented as mechanical locks, as electrical circuits built from relays and contactors, or as logic in a PLC, DCS or safety PLC. They prevent human error, unsafe situations and damage to the installation, and they form a standard layer in both machine safety and process safety.
🧠 How does an interlock work?
An interlock checks whether certain conditions are met before an action may take place. If they are not, the action is blocked or aborted immediately. A few simple examples:
- A pump may only start if all valves are in the correct position
- An oven may only open once the temperature is below 50 °C
- A motor must not run while the machine cabinet is open
In practice, interlocks act at two moments:
- Start condition (permissive) - before a start, the logic checks that everything is in order, for example “lube oil pressure present” before a compressor starts
- Shutdown (trip) - during operation, the logic intervenes as soon as a condition is lost, for example a motor that stops when a guard is opened
Well-designed interlocks are fail-safe: they usually work on the de-energise-to-trip principle, so that loss of power or signal causes a trip. A broken wire, a lost power supply or a failed sensor then leads to the safe state (stop or block) rather than to a machine that keeps running unnoticed. After a trip, a deliberate reset by the operator is usually required; an interlock must never let a machine restart by itself.
🎯 What types of interlocks are there?
Interlocks can be classified by purpose (safety or process) and by implementation (mechanical, electrical or software).
| Type | Description | Example |
|---|---|---|
| Safety interlock | Protects people or the installation from a hazardous situation | Door switch on a robot cell |
| Process interlock | Ensures the correct process sequence or operating state | Fill the tank first, then heat |
| Mechanical interlock | Physical blocking of a component | Mechanical lock between two switches |
| Electrical interlock | Relay or contact circuit that prevents an action electrically | Auxiliary contacts in a reversing starter |
| Software interlock | Logical blocking in the control program | Interlock in ladder logic in a PLC |
| Trapped-key interlock | A key is only released once energy has been safely isolated | Access to a high-voltage room |
A classic example of an electrical interlock is the reversing starter of a motor. Its two contactors must never close at the same time, because the reverse contactor swaps two phases and simultaneous closing causes a phase-to-phase short circuit. They are therefore interlocked both mechanically and electrically, independently of what the PLC does.
🔄 What is the difference between an interlock, an alarm and an SIS?
An interlock intervenes automatically, whereas an alarm calls for human action. A SIS is the most rigorous form: a separate system for safety functions with a defined SIL.
| Characteristic | Alarm | Interlock in the basic control system | Safety function (SIS / safety PLC) |
|---|---|---|---|
| Action | Warns the operator | Blocks or shuts down | Brings the process or machine to the safe state |
| Intervention | Manual | Automatic | Automatic |
| Platform | HMI, SCADA | Standard PLC or DCS | Safety PLC, safety relay, SIS |
| Reliability requirement | Per alarm management | No certified level | SIL or Performance Level |
| Risk reduction in LOPA | Only with demonstrable operator response | Maximum factor 10 | Factor 10 to 100,000 (SIL 1–4) |
This distinction matters: a process interlock in the DCS is not a safety function in the sense of IEC 61511 or ISO 13849-1 unless it has been designed to those standards. A pre-trip alarm often warns the operator just before an interlock acts.
🔧 How are interlocks implemented technically?
| System | Role in interlocks |
|---|---|
| PLC | Holds process and machine interlocks in the program |
| SCADA / HMI | Visualises interlock status and shows which condition is missing |
| SIS (Safety Instrumented System) | Executes critical process safety functions with high reliability |
| DCS | Coordinates process interlocks across multiple units and sequences |
| Safety PLC / safety relay | Executes machine safety functions such as door and light curtain monitoring |
An important design rule: put interlock logic in the controller, never only in SCADA or the HMI. A block that exists only on the operator screen disappears as soon as someone sends a command another way or communication is lost. The screen should, however, show which condition is missing, so the operator does not have to guess why a pump will not start.
🧱 Which standards apply to interlocks?
| Standard | Scope | Key point for interlocks |
|---|---|---|
| ISO 12100 | Machinery risk assessment | Determines whether an interlocked guard is needed |
| ISO 14119 | Interlocking devices on guards | Types 1–5, coding, resistance to defeat |
| ISO 13849-1 | Safety-related parts of control systems | Required Performance Level (a–e) |
| IEC 62061 | Functional safety of machinery | Alternative using a SIL-based approach |
| IEC 60204-1 | Electrical equipment of machines | Requirements for protective interlocks and contrary motions |
| IEC 61511 / IEC 61508 | Process safety, functional safety | Safety functions in an SIS; limited credit for the basic control system |
ISO 14119 received a new edition in September 2024, replacing the 2013 version. Its classification now has five types: type 1 mechanical uncoded, type 2 mechanical coded, type 3 non-contact uncoded, type 4 non-contact coded (for example RFID) and the new type 5 for trapped-key interlocks. Coded actuators come in three coding levels: low (1–9 variations), medium (10–1,000) and high (more than 1,000). The higher the coding level, the harder it is to defeat a switch with a loose magnet or a spare actuator.
For machinery in the EU, these standards fall under the Machinery Directive, which will be replaced by the Machinery Regulation on 20 January 2027.
🏭 Where are interlocks used in practice?
| Situation | Interlock description |
|---|---|
| Running a centrifuge | Lid stays locked until the rotor has stopped; start only with the lid closed |
| Pumps in a CIP system | Only start when valve positions and levels are correct |
| Starting a burner | Only after proven airflow, completed pre-purge and gas valves proven closed |
| Rotating machine | Drive switches off as soon as the guard is opened |
| Robot cell | Door stays locked until the robot is at a safe standstill |
| Tank farm | Fill pump stops at high-high level to prevent overfilling |
In processes with control valves and multiple units, interlocks are often recorded in a cause-and-effect matrix: for each cause (sensor or condition) it lists which effects (valves closed, pumps off) must follow. That matrix is the basis for the FAT and the SAT.
🔐 How do you manage and secure interlocks?
Interlocks are only as reliable as the management around them. A practical approach:
- Derive from risk analysis - record every interlock based on a HAZOP, a LOPA or the machine’s risk assessment
- Design fail-safe - de-energise-to-trip, wire-break monitoring and a manual reset after a trip
- Put the interlock in the right place - safety functions in a safety PLC or SIS, process interlocks in the basic control system, never only in the HMI
- Test - test every interlock during the FAT and SAT, and periodically afterwards; for an SIS this is called a proof test
- Control bypasses - allow a bypass only with a written procedure, compensating measures, a time limit and registration, often tied to a work permit or lock-out tag-out
- Control changes - every modification to interlock logic goes through change management with a retest
Software interlocks also have a cyber dimension. Anyone with access to an engineering station can modify or disable interlock logic. The TRITON attack in 2017 on a Triconex safety system at a Saudi petrochemical plant showed that attackers do target safety logic. Asset owners therefore combine IEC 62443 measures, such as segmentation and access control, with cyber-informed engineering: the most critical interlocks are hardwired or mechanical, so that no network attack can bypass them.
❓ Frequently asked questions
Is an interlock the same as an emergency stop?
No. An emergency stop is operated manually by a person to stop a machine in an emergency. An interlock acts automatically based on conditions, such as a closed door or a correct valve position, without anyone having to press a button.
Can an interlock be implemented in a standard PLC?
Process interlocks and simple machine interlocks are often implemented in a standard PLC. A safety function with a required Performance Level or SIL needs a certified safety PLC, a safety relay or an SIS, because a standard PLC is not designed to ISO 13849-1 or IEC 61511.
What is a trapped-key interlock?
A trapped-key interlock is a mechanical system in which a key is only released after energy has been isolated, and that key is needed to open an access door. As long as the door is open, the key is trapped and the installation cannot be switched back on. Since its 2024 edition, ISO 14119 classifies trapped-key interlocks as type 5.
Why are interlocks bypassed?
Interlocks are bypassed to allow maintenance, calibration or the start-up of an installation, or sometimes because a faulty sensor is stopping production. An uncontrolled bypass is a well-known cause of accidents. Good management therefore requires a procedure, a time limit and compensating measures.
How much risk reduction does an interlock in the DCS provide?
Under IEC 61511, an interlock in the basic process control system may be credited in a LOPA with a risk reduction of at most a factor of 10, unless the system is designed to IEC 61511 or IEC 61508. More risk reduction requires a safety function in an SIS with an appropriate SIL.
📌 In summary
An interlock only allows an action when the conditions are right and intervenes automatically when they no longer are. Interlocks exist in mechanical, electrical and software form, ranging from simple process interlocks in a PLC to certified safety functions in an SIS. Standards such as ISO 14119, ISO 13849-1 and IEC 61511 govern how they are designed, and sound management of testing, bypasses and changes keeps them reliable.
An interlock is an automatic lock that prevents an installation from entering an unsafe or undesirable state, and it is only as reliable as its design, its testing and the management of its bypasses.