“Industrial Exception” Becomes Permanent in Ontario

The “Industrial Exception”

The “Industrial Exception” is a clause in the Ontario Professional Engineer’s Act that permits unlicensed people to do work normally reserved for licenced engineers. Ontario is the only Canadian Province or Territory to have this kind of exception.

Ontario Fall Economic Outlook

The Ontario Government committed to maintaining the “industrial exception” in the Professional Engineers Act in their Fall Economic Outlook and Fiscal Review (p.17), released on the 27th of November, 2015. This statement put an end, at least for the moment, to the discussions that started in September of 2010 when Professional Engineers Ontario (PEO) formed the “Repeal of Industrial Exception Task Force (RIETF)” and resulted in the announcement of the repeal in January of 2013. The transition period given to business was 90 days, in which time businesses were expected to conduct an internal audit and voluntarily report any violations to PEO. They would then be given another 12 months to rectify their situation, after which time they would be subject to penalties under the Professional Engineers Act.

Professional Engineers Ontario claimed to have involved more than 100 industry groups in the consultation process prior to proposing the repeal, and yet 25 groups, among them Canada’s largest industrial association the Canadian Manufacturers & Exporters, seemingly had no knowledge of the proposal until the repeal was quietly announced.

The backlash from industry groups and individual businesses resulted in the government deciding to abandon the repeal, which resulted in a press release from PEO expressing their shock and indignation in June of 2013. Nothing more was publicly announced until November of 2015, a two-year silence.

Engineers Canada Press Release

On the 30th of November 2015, Engineers Canada put out a press release regarding the “industrial exception” [1], spinning this decision as one that will negatively influence the safety of workers in Ontario, and somehow negatively impact licensed engineers in the Province. This is simply spin by Professional Engineers Ontario  and Engineers Canada. Both organizations are completely ignoring the huge potential impact revoking the exception could have on Ontario’s manufacturing sector while making overblown claims about the potential negative effects of making the exception permanent. I want to explore this a bit in this article, as it has a direct bearing on machinery safety in the Province.

Professional Engineers

In the Province of Ontario, Canada, where I live and where my practice is based, the engineering profession is regulated by the “Professional Engineers Act” (PEA) [2]. This act aims to regulate the profession and provides the authority needed for Professional Engineers Ontario to license practitioners. Only licenced engineers are authorized to practice professional engineering as defined in the PEA.

Certified Engineering Technologists and Technicians

If you are a technologist or a technician, you may choose to certify through the Ontario Association of Certified Engineering Technicians and Technologists (OACETT), however, this does not permit you to do any work defined as the “practice of professional engineering”. Certified Engineering Technologists and Technicians gain no legal benefit from certification, beyond the use of titles protected under the OACETT Act, 1998 [3].

Who is an “engineer”?

The PEA defines the “practice of professional engineering” as follows:

“practice of professional engineering” means any act of planning, designing, composing, evaluating, advising, reporting, directing or supervising that requires the application of engineering principles and concerns the safeguarding of life, health, property, economic interests, the public welfare or the environment, or the managing of any such act; (“exercice de la profession d’ingénieur”) [2]

This is a tremendously broad definition, especially in that it includes the management of the practice, as well as the other activities involved, and the safeguarding of “economic interests”, health, property, the public welfare, and the environment. It’s also worthwhile noting that there is no definition of “engineering principles”, so the lynchpin for the definition is itself undefined. If strictly applied, this definition would result in virtually every business in the province that designs or manufactures a product being legally required to employ a licensed professional engineer and hold a Certificate of Authorization!

It’s also important to know that the title “engineer” is protected in the Province [2]:

“professional engineer” means a person who holds a licence or a temporary licence; (“ingénieur”)

12. (1) No person shall engage in the practice of professional engineering or hold himself, herself or itself out as engaging in the practice of professional engineering unless the person is the holder of a licence, a temporary licence, a provisional licence or a limited licence.  R.S.O. 1990, c. P.28, s. 12 (1); 2001, c. 9, Sched. B, s. 11 (16).

12. (2) No person shall offer to the public or engage in the business of providing to the public services that are within the practice of professional engineering except under and in accordance with a certificate of authorization.  R.S.O. 1990, c. P.28, s. 12 (2).

12. (3) Subsections (1) and (2) do not apply to prevent a person,
(f) from using the title “engineer” or an abbreviation of that title in a manner that is authorized or required by an Act or regulation.  R.S.O. 1990, c. P.28, s. 12 (3); 2001, c. 9, Sched. B, s. 11 (17); 2010, c. 16, Sched. 2, s. 5 (18).

Regardless of your qualifications or experience, or your job responsibilities, you cannot use the term “engineer” without risking the wrath of PEO. PEO has significant powers under the PEA, and can take you to court or impose other penalties as described in the PEA.

I believe that a significant part of the problem with the PEA is the breadth of the definition of professional engineering, and the lack of clarity created by the undefined “application of engineering principles”. We could debate the definitions for hours, but instead, I want to focus on the impact that engineering has on manufacturing.

Industrial Exception

Ontario has an interesting exception built into the Professional Engineers Act, unofficially called the “industrial exception”. So, what is the “industrial exception”? This exception is laid out in clause 12.(3)(a) [2]:

(3) Subsections (1) and (2) do not apply to prevent a person,

(a) from doing an act that is within the practice of professional engineering in relation to machinery or equipment, other than equipment of a structural nature, for use in the facilities of the person’s employer in the production of products by the person’s employer;

The exemption permits unlicensed persons to do work covered by the definition of professional engineering if they are doing it for their employer on equipment owned and used by their employer for the work that employer does.

This situation allows employers to save money on wages by allowing lower paid workers to do work normally reserved for higher paid licenced professionals. The downside to this for employers is that you have no guarantee that the person doing the work is adequately qualified, and if anything goes wrong, they will be unlikely to carry insurance that could reduce the impact of any loss created.

The Industrial Exception does not permit unlicensed persons to conduct Pre-Start Health and Safety Reviews.

Based on this, a person can undertake any act governed by the PEA related to machinery or equipment, other than structural engineering, on behalf of their employer, as long as the equipment is owned by their employer and will be used in production by their employer. This opens up modifications and design of machinery and equipment to unlicensed persons, as long as the machinery or equipment is intended for production use by their employer. It does not permit unlicensed persons to design machinery or equipment and then sell that equipment to others. It also does not permit unlicensed persons to conduct Pre-Start Health and Safety Reviews. The existence of the industrial exemption is, in part, responsible for the existence of Ontario’s Pre-Start Health and Safety Review [4, Section 7].

Is there a problem?

Consider that the exemption has been part of the PEA since 1984. In that time, the workplace accident rates in Ontario have declined. Sixteen years later, in 2000, the “Pre-Start Health and Safety Review” was created, and a whole new line of business for engineers was created. Accident rates have continued to decline at about the same rate as they did prior to 2000. There is little evidence to show that the industrial exception had any significant effect on workplace safety in the time since its inception.

The exception creates NO barriers for licenced engineers.

The exception creates NO barriers for licenced engineers. The claims that the continuation of the exception creates a barrier to licenced engineers who want to move to Ontario and continue their practice is completely unsupported. The kinds of work that licenced engineers do is completely unaffected by the exception. The claim that the exception creates barriers for licenced engineers moving from Ontario to other Provinces and Territories is also unfounded, since Canadian engineering licences are transferable, and there may be MORE work in other provinces because the work done in Ontario under the exemption must be done by licenced engineers in other Provinces or Territories.

Eliminating the exemption would force hundreds of small and medium-sized employers to hire licenced professional engineers to conduct work that they may have been doing successfully for years. This would increase labour costs for these employers, assuming that they could actually find an engineer to hire. This would also displace all of the workers already doing the work. Employers might have to halt projects part way completed until they could hire a licenced professional engineer to oversee the completion of the project. In a letter dated 22-Feb-2013, Ian Howcroft, Vice President of Canadian Manufacturers and Exporters Ontario, said “…businesses that generate $270 billion in GDP and employ over 700,000 Ontarians, are writing to request that the implementation of the “Repeal of the Industrial Exception”, currently scheduled to be in force March 1st, 2013, be discontinued until a full regulatory impact analysis can be conducted.” This request was made because “…businesses have identified a number of issues that could have significant cost implications for businesses and negative consequences for the Ontario Economy.” This letter was undersigned by 24 other trade and business associations. Clearly, eliminating the “industrial exception” could have significant impacts on Ontario’s economy and workforce.

Unfortunately, both Engineers Canada and Professional Engineers Ontario are attempting to use fear, uncertainty, and doubt to persuade the general public that an imminent risk to life and health is being created by this 32-year-old legislation. If it was going to happen, the problem would have shown itself years ago. Claiming anything else is rediculous.


[1]     Engineers Canada, “Engineers Canada concerned Ontario government decision will negatively impact workplace health and safety”, (online). 2015. Available: https://www.engineerscanada.ca/news/engineers-canada-concerned-ontario-government-decision-will-negatively-impact-workplace-health. Accessed: 25-Feb-16.

[2]     Ontario. Legislative Assembly of Ontario, Professional Engineers Act, (R.S.O. 1990, c. P.28). Toronto. 1990. Available: https://www.ontario.ca/laws/statute/90p28.Accessed: 25-Feb-16.

[3]     Ontario. Legislative Assembly of Ontario, An Act respecting the Ontario Association of Certified Engineering Technicians and Technologists, Mr. Baird. (36:2 Bill PR25) Toronto. 1998. Available: http://www.ontla.on.ca/web/bills/bills_detail.do?locale=en&BillID=1800&isCurrent=false&ParlSessionID=36%3A2. Accessed: 25-Feb-16.

[4]    Ontario. Legislative Assembly of Ontario, Industrial Establishments. Ontario Regulation 851. Toronto. 1990. Available: https://www.ontario.ca/laws/regulation/900851. Accessed: 8-Mar-16.

Presence Sensing Devices – Reaching over sensing fields

This entry is part 2 of 2 in the series Guards and Guarding

I recently heard about an application question related to a light curtain where a small gap existed at the top of the sensing field, between the last beam in the field and the surrounding structure of the machine. There was some concern raised about the gap, and whether or not additional guarding might be needed to close the gap. To answer this question, we need to split it into a few smaller pieces that we can deal with using the tools in the standards.

The first piece to consider is the gap at the top of the sensing field. For this part of the analysis, I’m going to assume that the light curtain is a fixed barrier guard, and we’ll analyse the gap based on that idea.

The second piece of the puzzle is the placement of the light curtain, and we’ll look at that separately. Once we we understand the two pieces, we’ll put them together to see if there are any other issues that may need to be addressed.

The Application

For the purpose of this article, I’ve sketched up the following figures to illustrate the ideas in the article. These drawings don’t represent any actual robot cell or application. Note that the light curtain in the sketch is shown with zero safety distance to the robot envelope. This is NEVER permitted.

Cell Elevation View
Figure 1 – Cell Elevation View showing Gap above Light Curtain


Cell Plan View
Figure 2 – Cell Plan View

Analyzing The Gap

Light curtains are treated the same way that movable guards are treated, so the answer to this question starts with determining the size of the gap. I’m going to reference two sets of standards in answering this question: CSA and ISO.

Safety Distances for fingers reaching through an opening
Figure 3 – Finger-to-Knuckle Reaching through a Regular Opening [1, C.4]
Z432 Reaching Through Regular Openings
Figure 4 – Arm-up-to-Shoulder Reaching through Regular Opening [1, C.4]

Referenced Standards
CSA Z432 2004 [1] ISO 13857 2008 [2]
Table 3 – Minimum distance from hazard as a function of barrier opening size Table 4 – Reaching through Regular openings
Opening Size (e) Safety Distance (sr) Opening Size (e) Safety Distance (sr)

11.1– 16.0mm [0.376″–0.625″]

Slotted >= 89.0 mm [3.5″]Square >= 66 mm [2.6″] Slot 10 < e <=12Square/Round 10 < e <=12 >= 100 mm>= 80 mm
49.1–132.0 mm [1.876–5.000″] Slotted/Square <= 915.0 mm [36.0″] Slot/Square/Round 40 < e <= 120 mm <= 850 mm

The first thing to notice is that CSA and ISO use slightly different opening sizes (e) and safety distances (sr). These differences have their origin in slightly different anthropometric data used to develop the tables. In both cases, the maximum value for e defines the largest opening permitted without additional guarding.

Let’s look at the application to see if the gap between the top-most beam and the edge of the physical guard falls into the bands defined for e.

Cell Elevation Close Up
Figure 5 – Cell Elevation Close-Up

Based on the sketches of the application, we have a problem: The gap shown above the light curtain is right at the edge of the robot envelope, i.e., the danger zone. We are going to have to either, a) Move the fence back 915 mm to get the necessary safety distance or, b) close the gap off completely, either with hard guarding, or by extending the light curtain to close the gap.

Knowing the size of the gap, we can now decide if the gap should be reduced, or the light curtain moved or enlarged. Since light curtains run about $125/linear inch, adding an additional plate to reduce the size of the gap is likely the most cost effective choice. We also need to know the distance from the top-most beam of the light curtain to the hazard behind the guard. If that distance is less than 915/850 mm, then we have another problem, since the guarding is already too close to the hazard.

Analyzing the Light Curtain

The light curtain positioning is driven by the stopping performance of the machine. Again, let’s reference both CSA and ISO for the relevant calculations.

Referenced Standards
CSA Z432 2004 ISO 13855 2005 [3]
5.1 Overall system stopping performance
The overall system stopping performance comprises at least two phases.Thetwophasesare linked by Equation (1):

T = t1 + t2                             (1)

T is the overall system stopping performance;
t1 is the maximum time between the occurrence of the actuation of the safeguard and the output signal achieving the OFF-state;
t2 is the stopping time, which is the maximum time required to terminate the hazardous machine function after the output signal from the safeguard achieves the OFF-state. The response time of the control system of the machine shall be included in t2.

t1 and t2 are influenced by various factors, e.g. temperature, switching time of valves, ageing of components.

t1 and t2 are functions of the safeguard and the machine, respectively, and are determined by design and evaluated by measurement. The evaluation of these two values shall include the uncertainties resulting from the measurements, calculations and/or construction.

Clause 10.11 – Safeguarding device safety distanceThecalculationforminimum safe distance between a safeguarding device and the danger zone of a machine shall be as follows:

S = [K (Ts + Tc + Tr + Tbm)] + Dpf

Ds = minimum safe distance between the safeguarding device and the hazard

K = speed constant: 1.6 m/s (63 in/s) minimum, based on the movement being the hand/arm only and the body being stationary.
Note: A greater value may be required in specific applications and when body motion must also be considered.
Ts = worst stopping time of the machine/equipment

Tc = worst stopping time of the control system

Tr = response time of the safeguarding device, including its interface
Note: Tr for interlocked barrier may include a delay due to actuation. This delay may result in Tr being a deduct (negative value).

Note: Ts + Tc + Tr are usually measured by a stop-time measuring device if unknown.

Tbm = additional stopping time allowed by the brake monitor before it detects stop-time deterioration beyond the end users’ predetermined limits. (For part revolution presses only.)

Dpf = maximum travel towards the hazard within the presence-sensing safeguarding device’s (PSSD) field that may occur before a stop is signaled. Depth penetration factors will change depending on the type of device and application. See Figure 5 for specific values. (If applicable, based on the style of safety device.)

Clause 6.2.3 – Electro-sensitive protective equipment employing active opto-electronic protective devices with a sensor detection capability of ? 40 mm  in diameter Calculation

The minimum distance, S, in millimetres, from the detection zone to the hazard zone shall not be less than that calculated using Equation (2):

S = (K x T ) + C                             (2)


K = 2 000 mm/s;

C = 8 (d – 14), but not less than 0;

d is the sensor detection capability of the device, in millimetres (mm).

[Author’s Note – T comes from 5.1, above]


S = (2 000 x T ) + 8(d-14)               (3)

Equation (3) applies to all minimum distances of S up to and including 500 mm. The minimum value of S shall be 100 mm.

Where the values for S, calculated using Equation (3), exceed 500 mm, Equation (4) can be used. In this case, the minimum value of S shall be 500 mm.

S = (K x T ) + C                          (2)


K = 1 600 mm/s;

C = 8 (d – 14), but not less than 0;

d is the sensor detection capability of the device, in millimetres (mm).


S = (1 600 x T ) + 8(d – 14)

ISO 13855 Fig. 3 a) Normal Approach
Figure 6 – ISO 13855 Fig. 3 a) Normal Approach


1 hazard zone

2 detection zone

3 fixed guard

S minimum distance

a Direction of approach

The two calculation methods shown above are essentially the same, with the primary difference being the value of K, the “hand-speed constant”. ISO uses a higher value of K for light curtain installations where the field is vertical, or angled as low as 45º. If the calculated value of S is >500 mm, then the value of K is reduced to 1600 mm/s. Using the higher value of K for a North American installation is not wrong, and will result in a more conservative installation result. Use of 1 600 mm/s for machines going into international markets is wrong if S is <500 mm when calculated using 2 000 mm/s.

Let’s assume some values so we can do a representative calculation:

Stopping Time of the system (T) = 265 ms [0.265 s]

Light curtain resolution (d) = 30 mm [1.2″]

Calculating Dpf

Dpf = 8 x (d – 14) = 8 x (30 – 14) = 128

Using K = 2 000 mm/s

S = (2000 x 0.265) + 128 = 658 mm

Since applications where S > 500 mm can be recalculated using K = 1600 mm/s

S = (1 600 x 0.265) + 128 = 552 mm

So, from the above calculation we can see that the distance from the plane of the light curtain to the edge of the robot envelope (i.e., the danger zone) must be at least 552 mm [21.75″]. That distance is enough that some people might be able to stand between the light curtain field and the fixture in the cell, so we should probably add a horizontal light curtain to protect against that possibility. See Figure 7.

Figure 7 - Vertical Light Curtain with Horizontal segment
Figure 7 – Vertical Light Curtain with Horizontal segment [1, Fig. B.15 (c)]
Another alternative to adding a horizontal section is to slope the light curtain field, so that the plane of the light curtain is at 45 degrees above the horizontal, with the highest beam as far away from the hazard as possible. See Figure 8.

Figure 8 - Sloped light curtain installation [1, CSA Z432 Fig B.15 (c)]
Figure 8 – Sloped light curtain installation [1, CSA Z432 Fig B.15 (c)]
This type of installation avoids the need to replace the existing light curtain, as long as the field depth is enough to meet the calculated Ds.

The field could also be laid horizontally, with no vertical component. This will change the Dpf calculation as highlighted by the note in Figure 8. Dpf for a horizontal field is calculated using the following equation:

Dpf = 1 200 mm [48″]


S = (1 600 x 0.265) + 1200 = 1 624 mm

Note also that there is a height restriction placed on horizontal devices based on the object resolution as well, so the 0.3 m maximum height may not apply to an exclusively horizontal application. Note that ISO 13855 allows H a maximum value of 1 000 mm, rather than cutting the value off at 990 mm as done in CSA Z432. Using either the 14 mm or the 30 mm resolution curtains yields a minimum height of 0 mm and a maximum of 990 mm (CSA) or 1 000 mm (ISO). Note that the 3rd Edition of CSA Z432 is likely to harmonize these distances with the ISO calculations, eliminating these differences.

Also note that field heights where H > 300 mm may require additional safeguards in conjunction with the Presence-Sensing Safeguarding Device (PSSD) field.

Figure 8 - Calculating "H" [1, Fig. B.15 (g)]
Figure 8 – Calculating “H” [1, Fig. B.15 (g)]
Going back to our original vertical field installation, there is one more option that could be considered: Reduce the object resolution of the light curtain. If we go down to the smallest object resolution typically available, 14 mm , the calculation looks like this:

Dpf = 8 x (14-14) = 0

S = (2 000 x 0.265) + 0 = 530 mm

Since S > 500,

S = (1 600 x 0.265) + 0 = 424 mm [16.7″]

While we have substantially reduced the safety distance, it looks like we will still need the horizontal light curtain to ensure that no one can stand behind the curtain without being detected.

If the design of the machinery allows, it might be possible to reduce the stopping time of the machine. If you can reduce the stopping time, you will be able to shorten the safety distance required. Note that the safety distance can never go to zero, and can never be less than that determined by the object resolution applied to the reaching-through tables. In this case, a 14 mm opening results in an 89 mm [3.5″] minimum safety distance (CSA). Since the stopping time of the machine can never be zero, 89 mm works out to a stopping time of 44.5 ms using K=2 000 mm/s, or 55.6 ms if K= 1 600 mm/s. Very few machines can stop this quickly.

The calculated safety distance is about half of the safety distance required for the gap, at 915 mm. Clearly, closing the gap with the light curtain or hard guarding will be preferable to moving the fence away from the danger zone by 915 mm.

Here’s one more figure to help illustrate these ideas.

Z432 Figure B.14 a
Figure 9 – CSA Z432 Figure B.15 a)

Figure 9 shows the difference between the reaching-through or reaching-over light curtain applications. Notice that without a restricting guard above the curtain as we have in our example, the Dpf value goes out to 1 200 mm [48″], rather than the 915 mm value used in our example.

The lower figures show light fence applications, where two or three beams are used, rather than a full coverage light curtain.


Here are some of the more important considerations:
1) Is the field of the light curtain placed correctly, based on the stopping performance of the machine?
2) What is the object resolution of the sensing field? This dimension may be used to assess the size of the “openings” in the field if this becomes relevant.
3) What is the height of the lowest and highest beams or the edges of the sensing field?
4) What are the dimensions of the gap above the field of the curtain, and the distance from the opening to the closes hazard?


I’d like to acknowledge my colleague, Christian Bidner, who suggested the idea for this article based on a real-world application he had seen. Christian works for OMRON/STI in their Toronto office.


[1]     Safeguarding of Machinery. CSA Z432. Canadian Standards Association (CSA).  Toronto. 2004.

[2]     Safety of machinery – Safety distances to prevent hazard zones being reached by upper and lower limbs. ISO 13857.International Organization for Standardization (ISO). Geneva. 2008.

[3]     Safety of machinery – Positioning of safeguards with respect to the approach speeds of parts of the human body. ISo 13855. International Organization for Standardization (ISO). Geneva. 2010.

Digiprove sealCopyright secured by Digiprove © 2015
Acknowledgements: Figures from CSA Z432, Calculations f more...
Some Rights Reserved

Interlocking Devices: The Good, The Bad and the Ugly

This entry is part 1 of 2 in the series Guards and Guarding

Note: A shorter version of this article was published in the May-2012 edition of  Manufacturing Automation Magazine.

When designing safeguarding systems for machines, one of the basic building blocks is the movable guard. Movable guards can be doors, panels, gates or other physical barriers that can be opened without using tools. Every one of these guards needs to be interlocked with the machine control system so that the hazards covered by the guards will be effectively controlled when the guard is opened.

There are a number of important aspects to the design of movable guards. This article will focus on the selection of interlocking devices that are used with movable guards.

The Hierarchy of Controls

The Hierarchy of Controls as an inverted pyrimid.
Figure 1 – The Hierarchy of Controls

This article assumes that a risk assessment has been done as part of the design process. If you haven’t done a risk assessment first, start there, and then come back to this point in the process. You can find more  information on risk assessment methods in this post from 31-Jan-11. ISO 12100 [1] can also be used for guidance in this area.

The hierarchy of controls describes levels of controls that a machine designer can use to control the assessed risks. The hierarchy is defined in [1]. Designers are required to apply every level of the hierarchy in order, starting at the top. Each level is applied until the available measures are exhausted, or cannot be applied without destroying the purpose of the machine, allowing the designer to move to the next lower level.

Engineering controls are subdivided into a number of different sub-groups. Only movable guards are required to have interlocks. There are a number of similar types of guards that can be mistaken for movable guards, so let’s take a minute to look at a few important definitions.

Table 1 – Definitions

International [1] Canadian [2] USA [10]
3.27 guard physical barrier, designed as part of the machine to provide protection.NOTE 1 A guard may act either alone, in which case it is only effective when “closed” (for a movable guard) or “securely held in place” (for a fixed guard), or  in conjunction with an interlocking device with or without guard locking, in which case protection is ensured whatever the position of the guard.NOTE 2Depending on its construction, a guard may be described as, for example, casing, shield, cover, screen, door, enclosing guard.NOTE 3 The terms for types of guards are defined in 3.27.1 to 3.27.6. See also and ISO 14120 for types of guards and their requirements. Guard — a part of machinery specifically used to provide protection by means of a physical barrier. Depending on its construction, a guard may be called a casing, screen, door, enclosing guard, etc. 3.22 guard: A barrier that prevents exposure to an identified hazard.E3.22 Sometimes referred to as barrier guard.”
3.27.4 interlocking guard guard associated with an interlocking device so that, together with the control system of the machine, the following functions are performed:

  • the hazardous machine functions “covered” by the guard cannot operate until the guard is closed,
  • if the guard is opened while hazardous machine functions are operating, a stop command is given, and
  • when the guard is closed, the hazardous machine functions “covered” by the guard can operate (the closure of the guard does not by itself start the hazardous machine functions)

NOTE ISO 14119 gives detailed provisions.

Interlocked barrier guard — a fixed or movable guard attached and interlocked in such a manner that the machine tool will not cycle or will not continue to cycle unless the guard itself or its hinged or movable section encloses the hazardous area. 3.32 interlocked barrier guard: A barrier, or section of a barrier, interfaced with the machine control system in such a manner as to prevent inadvertent access to the hazard.
3.27.2 movable guard
guard which can be opened without the use of tools
Movable guard — a guard generally connected by mechanical means (e.g., hinges or slides) to the machine frame or an adjacent fixed element and that can be opened without the use of tools. The opening and closing of this type of guard may be powered. 3.37 movable barrier device: A safeguarding device arranged to enclose the hazard area before machine motion can be initiated.E3.37 There are two types of movable barrier devices:

  • Type A, which encloses the hazard area during the complete machine cycle;
  • Type B, which encloses the hazard area during the hazardous portion of the machine cycle.
3.28.1 interlocking device (interlock)mechanical, electrical or other type of device, the purpose of which is to prevent the operation of hazardous machine functions under specified conditions (generally as long as a guard is not closed) Interlocking device (interlock) — a mechanical, electrical, or other type of device, the purpose of which is to prevent the operation of machine elements under specified conditions (usually when the guard is not closed). No definition
3.27.5 interlocking guard with guard locking guard associated with an interlocking device and a guard locking device so that, together with the control system of the machine, the following functions are performed:

  • the hazardous machine functions “covered” by the guard cannot operate until the guard is closed and locked,
  • the guard remains closed and locked until the risk due to the hazardous machine functions “covered” by the guard has disappeared, and
  • when the guard is closed and locked, the hazardous machine functions “covered” by the guard can operate (the closure and locking of the guard do not by themselves start the hazardous machine functions)

NOTE ISO 14119 gives detailed provisions.

Guard locking device — a device that is designed to hold the guard closed and locked until the hazard has ceased. No definition

As you can see from the definitions, movable guards can be opened without the use of tools, and are generally fixed to the machine along one edge. Movable guards are always associated with an interlocking device. Guard selection is covered very well in ISO 14120 [11]. This standard contains a flowchart that is invaluable for selecting the appropriate style of guard for a given application.

5% Discount on ISO and IEC Standards with code: CC2012

Though much emphasis is placed on the correct selection of these interlocking devices, they represent a very small portion of the hierarchy. It is their widespread use that makes them so important when it comes to safety system design.

Electrical vs. Mechanical Interlocks

Mechanical Interlocking
Figure 2 – Mechanical Interlocking

Most modern machines use electrical interlocks because the machine is fitted with an electrical control system, but it is entirely possible to interlock the power to the prime movers using mechanical means. This doesn’t affect the portion of the hierarchy involved, but it may affect the control reliability analysis that you need to do.

Mechanical Interlocks

Figure 2, from ISO 14119 [7, Fig. H.1, H.2 ], shows one example of a mechanical interlock.  In this case, when cam 2 is rotated into the position shown in a), the guard cannot be opened. Once the hazardous condition behind the guard is effectively controlled, cam 2 rotates to the position in b), and the guard can be opened.

Arrangements that use the open guard to physically block operation of the controls can also be used in this way. See Figure 3 [7, Fig. C.1, C.2].

Mechanical Interlocking using control devices
Figure 3 – Mechanical Interlocking using machine control devices

Fluid Power Interlocks

Figure 4, from [7, Fig. K.2], shows an example of two fluid-power valves used in complementary mode on a single sliding gate.

Hydraulic interlock from ISO 14119
Figure 4 – Example of a fluid power interlock

In this example, fluid can flow from the pressure supply (the circle with the dot in it at the bottom of the diagram) through the two valves to the prime-mover, which could be a cylinder, or a motor or some other device when the guard is closed (position ‘a’). There could be an additional control valve following the interlock that would provide the normal control mode for the device.

When the guard is opened (position ‘b’), the two valve spools shift to the second position, the lower valve blocks the pressure supply, and the upper valve vents the pressure in the circuit, helping to prevent unexpected motion from trapped energy.

If the spring in the upper valve fails, the lower spool will be driven by the gate into a position that will still block the pressure supply and vent the trapped energy in the circuit.

5% Discount on ISO and IEC Standards with code: CC2012

Electrical Interlocks

By far the majority of interlocks used on machinery are electrical. Electrical interlocks offer ease of installation, flexibility in selection of interlocking devices, and complexity from simple to extremely complex. The architectural categories cover any technology, whether it is mechanical, fluidic, or electrical, so let’s have a look at architectures first.

Architecture Categories

Comparing ANSI, CSA, and ISO Control Reliability Categories
Figure 5 – Control Reliability Categories

In Canada, CSA Z432 [2] and CSA Z434 [3] provide four categories of control reliability: simple, single channel, single-channel monitored and control reliable. In the U.S., the categories are very similar, with some differences in the definition for control reliable (see RIA R15.06, 1999). In the EU, there are five levels of control reliability, defined as Performance Levels (PL) given in ISO 13849-1 [4]: PL a, b, c, d and e. Underpinning these levels are five architectural categories: B, 1, 2, 3 and 4. Figure 5 shows how these architectures line up.

To add to the confusion, IEC 62061 [5] is another international control reliability standard that could be used. This standard defines reliability in terms of Safety Integrity Levels (SILs). These SILs do not line up exactly with the PLs in [4], but they are similar. [5] is based on IEC 61508 [6], a well-respected control reliability standard used in the process industries. [5] is not well suited to applications involving hydraulic or pneumatic elements.

The orange arrow in Figure 5 highlights the fact that the definition in the CSA standards results in a more reliable system than the ANSI/RIA definition because the CSA definition requires TWO (2) separate physical switches on the guard to meet the requirement, while the ANSI/RIA definition only requires redundant circuits, but makes no requirement for redundant devices. Note that the arrow representing the ANSI/RIA Control reliability category falls below the ISO Category 3 arrow due to this same detail in the definition.

Note that Figure 5 does not address the question of PL’s or SIL’s and how they relate to each other. That is a topic for another article!

The North American architectures deal primarily with electrical or fluid-power controls, while the EU system can accommodate electrical, fluid-power and mechanical systems.

From the single-channel-monitored or Category 2 level up, the systems are required to have testing built-in, enabling the detection of failures in the system. The level of fault tolerance increases as the category increases.

Interlocking devices

Interlocking devices are the components that are used to create the interlock between the safeguarding device and the machine’s power and control systems. Interlocking systems can be purely mechanical, purely electrical or a combination of these.

Roller cam switch used as part of a complementary interlock
Photo 1 – Roller Cam Switch

Most machinery has an electrical/electronic control system, and these systems are the most common way that machine hazards are controlled. Switches and sensors connected to these systems are the most common types of interlocking devices.

Interlocking devices can be something as simple as a micro-switch or a reed switch, or as complex as a non-contact sensor with an electromagnetic locking device.

Images of interlocking devices used in this article are representative of some of the types and manufacturers available, but should not be taken as an endorsement of any particular make or type of device. There are lots of manufacturers and unique models that can fit any given application, and most manufacturers have similar devices available.

Photo 1 shows a safety-rated, direct-drive roller cam switch used as half of a complementary switch arrangement on a gate interlock. The integrator failed to cover the switches to prevent intentional defeat in this application.

Micro-Switch used for interlocking
Photo 2 – Micro-Switch used for interlocking

Photo 2 shows a ‘microswitch’ used for interlocking a machine cover panel that is normally held in place with fasteners, and so is a ‘fixed guard’ as long as the fasteners require a tool to remove. Fixed guards do not require interlocks under most circumstances. Some product family standards do require interlocks on fixed guards due to the nature of the hazards involved.

Microswitches are not safety-rated and are not recommended for use in this application. They are easily defeated and tend to fail to danger in my experience.

Requirements for interlocking devices are published in a number of standards, but the key ones for industrial machinery are ISO 14119 [7], [2], and ANSI B11.0 [8]. These standards define the electrical and mechanical requirements, and in some cases the testing requirements, that devices intended for safety applications must meet before they can be classified as safety components.
Download standards

Typical plastic-bodied interlocking device
Photo 3 – Schmersal AZ15 plastic interlock switch

These devices are also integral to the reliability of the control systems into which they are integrated. Interlock devices, on their own, cannot meet a reliability rating above ISO 13849-1 Category 1, or CSA Z432-04 Single Channel. To understand this, consider that the definitions for Category 2, 3 and 4 all require the ability for the system to monitor and detect failures, and in Categories 3 & 4, to prevent the loss of the safety function. Similar requirements exist in CSA and ANSI’s “single-channel-monitored,” and “control-reliable” categories. Unless the interlock device has a monitoring system integrated into the device, these categories cannot be achieved.

Guard Locking

Interlocking devices are often used in conjunction with  guard locking. There are a few reasons why a designer might want to lock a guard closed, but the most common one is a lack of safety distance. In some cases the guard may be locked closed to protect the process rather than the operator, or for other reasons.

Interlock Device with Guard Locking
Photo 4 – Interlocking Device with Guard Locking

Safety distance is the distance between the opening covered by the movable guard and the hazard. The minimum distance is determined using the safety distance calculations given in [2] and ISO 13855 [9]. This calculation uses a ‘hand-speed constant’, called K, to represent the theoretical speed that the average person can achieve when extending their hand straight forward when standing in front of the opening. In North America, K is usually 63 inches/second, or 1600 mm/s. Internationally and in the EU, there are two speeds, 2000 mm/s, used for an approach perpendicular to the plane of the guard, or 1600 mm/second for approaches at 45 degrees or less [9]. 2000 mm/s is used with movable guards, and is approximately equivalent to 79 inches/second. Using the International approach, if the value of Ds is greater than 500 mm when calculated using K = 2 000, then [9] permits the calculation to be done using K = 1 600 instead.

Using the stopping time of the machinery and K, the minimum safety distance can be calculated.

Eq. 1              Ds = K x Ts

Using Equation 1 [2], assume you have a machine that takes 250 ms to stop when the interlock is opened. Inserting the values into the equation gives you a minimum safety distance of:

Example 1             Ds = 63 in/s x 0.250 s = 15.75 inches

Example 2             Ds = 2000 mm/s x 0.250 s = 500 mm

As you can see, the International value of K gives a more conservative value, since 500 mm is approximately 20 inches.

Note that I have not included the ‘Penetration Factor’, Dpf in this calculation. This factor is used with presence sensing safeguarding devices like light curtains, fences, mats, two-hand controls, etc. This factor is not applicable to movable, interlocked guards.

Also important to consider is the amount the guard can be opened before activating the interlock. This will depend on many factors, but for simplicity, consider a hinged gate on an access point. If the guard uses two hinge-pin style switches, you may be able to open the gate a few inches before the switches rotate enough to detect the opening of the guard. In order to determine the opening size, you would slowly open the gate just to the point where the interlock is tripped, and then measure the width of the opening. Using the tables found in [2], [3], [10], or ISO 13857 [12], you can then determine how far the guard must be from the hazards behind it. If that distance is greater than what is available, you could remove one hinge-pin switch, and replace it with another type mounted on the post opposite the hinges. This could be a keyed interlock like Photo 3, or a non-contact device like Photo 5. This would reduce the opening width at the point of detection, and thereby reduce the safety distance behind the guard. But what if that is still not good enough?

If you have to install the guard closer to the hazard than the minimum safety distance, locking the guard closed and monitoring the stand-still of the machine allows you to ignore the safety distance requirement because the guard cannot be opened until the machinery is at a standstill, or in a safe state.

Guard locking devices can be mechanical, electromagnetic, or any other type that prevents the guard from opening. The guard locking device is only released when the machine has been made safe.

There are many types of safety-rated stand-still monitoring devices available now, and many variable-frequency drives and servo drive systems are available with safety-rated stand-still monitoring.

Environment, failure modes and fault exclusion

Every device has failure modes. The correct selection of the device starts with understanding the physical environment to which the device will be exposed. This means understanding the temperature, humidity, dust/abrasives exposure, chemical exposures, and mechanical shock and vibration exposures in the application. Selecting a delicate reed switch for use in a high-vibration, high-shock environment is a recipe for failure, just as selecting a mechanical switch in a dusty, damp, corrosive environment will also lead to premature failure.

Example of a non-contact interlocking device
Photo 5 – JOKAB EDEN Interlock System

Interlock device manufacturers have a variety of non-contact interlocking devices available today that use coded RF signals or RF ID technologies to ensure that the interlock cannot be defeated by simple measures, like taping a magnet to a reed switch. The Jokab EDEN system is one example of a system like this that also exhibits IP65 level resistance to moisture and dust. Note that systems like this include a safety monitoring device and the system as a whole can meet Control Reliable or Category 3 / 4 architectural requirements when a simple interlock switch could not.

The device standards do provide some guidance in making these selections, but it’s pretty general.

Fault Exclusion

Fault exclusion is another key concept that needs to be understood. Fault exclusion holds that failure modes that have an exceedingly low probability of occurring during the lifetime of the product can be excluded from consideration. This can apply to electrical or mechanical failures. Here’s the catch: Fault exclusion is not permitted under any North American standards at the moment. Designs based on the North American control reliability standards cannot take advantage of fault exclusions. Designs based on the International and EU standards can use fault exclusion, but be aware that significant documentation supporting the exclusion of each fault is needed.

Defeat resistance

Diagram showing one method of preventing interlock defeat.
Figure 6 – Preventing Defeat

The North American standards require that the devices chosen for safety-related interlocks be defeat-resistant, meaning they cannot be easily fooled with a cable-tie, a scrap of metal or a piece of tape.

Figure 6 [7, Fig. 10] shows a key-operated switch, like the Schmersal AZ15, installed with a cover that is intended to further guard against defeat. The key, sometimes called a ‘tongue’, used with the switch prevents defeat using a flat piece of metal or a knife blade. The cover prevents direct access to the interlocking device itself. Use of tamper-resistant hardware will further reduce the likelihood that someone can remove the key and insert it into the switch, bypassing the guard.

Inner-Tite tamper resistance fasteners
Photo 6 – Tamper-resistant fasteners

5% Discount on ISO and IEC Standards with code: CC2012

The International and EU standards do not require the devices to be inherently defeat resistant, which means that you can use “safety-rated” limit switches with roller-cam actuators, for example. However, as a designer, you are required to consider all reasonably foreseeable failure modes, and that includes intentional defeat. If the interlocking devices are easily accessible, then you must select defeat-resistant devices and install them with tamper-resistant hardware to cover these failure modes.

Photo 6 shows one type of tamper resistant fasteners made by Inner-Tite [13]. Photo 7 shows fasteners with uniquely keyed key ways made by Bryce Fastener [14], and Photo 8 shows more traditional tamperproof fasteners from the Tamperproof Screw Company [15]. Using fasteners like these will result in the highest level of security in a threaded fastener. There are many different designs available from a wide variety of manufacturers.

Bryce Key-Rex tamper-resistant fasteners
Photo 7 – Keyed Tamper-Resistant Fasteners
Tamper proof screws made by the Tamperproof Screw Company
Photo 8 – Tamper proof screws

Almost any interlocking device can be bypassed by a knowledgeable person using wire and the right tools. This type of defeat is not generally considered, as the degree of knowledge required is greater than that possessed by “normal” users.

How to select the right device

When selecting an interlocking device, start by looking at the environment in which the device will be located. Is it dry? Is it wet (i.e., with cutting fluid, oil, water, etc.)? Is it abrasive (dusty, sandy, chips, etc.)? Is it indoors or outdoors and subject to wide temperature variations?

Is there a product standard that defines the type of interlock you are designing? An example of this is the interlock types in ANSI B151.1 [4] for plastic injection moulding machines. There may be restrictions on the type of devices that are suitable based on the requirements in the standard.

Consider integration requirements with the controls. Is the interlock purely mechanical? Is it integrated with the electrical system? Do you require guard locking capability? Do you require defeat resistance? What about device monitoring or annunciation?

Once you can answer these questions, you will have narrowed down your selections considerably. The final question is: What brand is preferred? Go to your preferred supplier’s catalogues and make a selection that fits with the answers to the previous questions.

The next stage is to integrate the device(s) into the controls, using whichever control reliability standard you need to meet. That is the subject for a series of articles!


5% Discount on ISO and IEC Standards with code: CC2012

[1] Safety of machinery – General principles for design – Risk assessment and risk reduction, ISO Standard 12100, Edition 1, 2010

[2] Safeguarding of Machinery, CSA Standard Z432, 2004 (R2009)

Buy CSA Standards

[3] Industrial Robots and Robot Systems – General Safety Requirements, CSA Standard Z434, 2003 (R2008)

[4] Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design, ISO Standard 13849-1, 2006

[5] Safety of machinery – Functional safety of safety-related electrical, electronic and programmable electronic control systems, IEC Standard 62061, Edition 1, 2005

[6] Functional safety of electrical/electronic/programmable electronic safety-related systems (Seven Parts), IEC Standard 61508-X

[7] Safety of machinery — Interlocking devices associated with guards — Principles for design and selection, ISO Standard 14119, 1998

[8] American National Standard for Machines, General Safety Requirements Common to ANSI B11 Machines, ANSI Standard B11, 2008
Download ANSI standards

[9] Safety of machinery — Positioning of safeguards with respect to the approach speeds of parts of the human body, ISO 13855, 2010

[10] American National Standard for Machine Tools – Performance Criteria for Safeguarding, ANSI B11.19, 2003

[11] Safety of machinery — Guards — General requirements for the design and construction of fixed and movable guards, ISO 14120. 2002

[12] Safety of machinery – Safety distances to prevent hazard zones being reached by upper and lower limbs, ISO 13857. 2008.

[13] Inner-Tite Corp. home page. (2012). Available: http://www.inner-tite.com/

[14] Bryce Fastener, Inc. home page. (2012). Available: http://www.brycefastener.com/

[15] Tamperproof Screw Co., Inc., home page. (2013). Available: http://www.tamperproof.com