Last edit: 25/02/2024
The Standard considers an interlocking device, with or without locking, a SRP/CS (safety-related parts of control systems) of a machine or a subsystem of a safety-related control system (SCS as per IEC 62061) with the purpose of preventing dangerous situations.
As such, an interlock requires precise levels of performance (PL) or safety (SIL) with the respective periodic operational tests and CCF (Common Cause Failures) reduction methods.
The locking release functions must also comply with the PL or SIL.
The standard, then, deals with the logical connection methods of interlocks.
Where an interlocking system requires PL e in accordance with ISO 13849-1, a designated architecture of category 3 or 4 is required. Where SIL 3 in accordance with IEC 62061 is required, a minimum hardware fault tolerance (HFT) of 1 is required. These requirements can be achieved, for example, by implementing two Type 2 interlocking devices, or by using a single PL e device that displays the relevant category behaviour.
The machinery manufacturer should do an assessment of possible faults an interlock can be subject to.
For applications using interlocking devices with automatic monitoring to achieve the necessary diagnostic coverage (DC) for the required safety performance, a functional test can be carried out every time the device changes its state: that means at every access to the safeguarded area. However, if there is infrequent access, considerations of the frequency of access to the area should be done. Here the language from the standard:
[ISO 14119: 2024] 9.2.1 Assessment of faults
If, for detecting of a fault, a manual test (e.g.., opening of a guard) is necessary, but frequency of access to the safeguarded area is seldom, the following intervals shall be chosen:
- at least every 12 months for PL d with Category 3 or 2 (according to ISO 13849-1) or SIL 2 with HFT = 1 (according to IEC 62061).
- at least every 1 month for PL e (according to ISO 13849-1) or SIL 3 (according to IEC 62061).
The control system of the machine should demand these tests at the required intervals, for example by visual display unit or signal lamp. If implemented, the control system shall monitor the tests and stop the machine if the test is omitted or fails.