August 5, 2026 · Safeguarding
The perimeter fence around a robot cell is not the safeguard. The door in it is. Everything a risk assessment says about keeping people out of a cell during automatic operation depends on one component: the interlocking device on that door, and whether it can be defeated by anyone with a spare actuator and a reason to be in a hurry.
We audit a lot of West Michigan cells, and the interlock is where the gap between the drawing and the floor shows up fastest. The panel schematic says Type 2 tongue switch. The cell has a taped-down actuator zip-tied to the fence post. The risk assessment assumed a stop before reach. Nobody measured the stopping time.
ISO 14119:2024, Safety of machinery, Interlocking devices associated with guards, specifies the principles for the design and selection of interlocking devices and gives measures to minimize the possibility of defeat in a reasonably foreseeable manner. That last phrase is the whole standard in six words. It assumes a person will try to get in, and asks whether your device makes that easy.
ANSI/RIA R15.06 and ISO 10218-2 tell you a robot cell needs safeguarding and what performance the safety function must achieve. ISO 13849-1 tells you the architecture and Performance Level. ISO 14119 tells you what device to hang on the door and how to keep it honest. They are not competing standards, they are different layers of the same answer, which is the same relationship we mapped out in our guide to aligning ANSI R15.06, ISO 10218, and OSHA 1910.147.
ISO 14119 classifies interlocking devices by two questions: is the actuation mechanical or contactless, and is the actuator coded or uncoded.
| Type | Actuation and coding | Typical device | Defeat resistance |
|---|---|---|---|
| Type 1 | Mechanically actuated, uncoded actuator | Roller or plunger position switch | Low. Defeated with tape or a zip tie. |
| Type 2 | Mechanically actuated, coded actuator | Tongue or key-operated switch | Moderate. Spare tongues are easy to obtain. |
| Type 3 | Contactless, uncoded actuator | Plain magnetic proximity switch | Low. Any equivalent magnet works. |
| Type 4 | Contactless, coded actuator | RFID-coded non-contact switch | High, especially with individual coding. |
On a fenced cell where operators have any production reason to want in, Type 4 with high-level coding is the specification we recommend by default. It is not a large cost delta on a new build and it removes the easiest bypass path.
ISO 14119 defines three coding levels by how many unique actuator codes a device family supports. Low level coding means 1 to 9 variations. Medium level means 10 to 1000. High level means more than 1000 variations available.
The point of coding is uniqueness. A plain magnetic switch responds to any magnet of the right field, so a bypass costs a dollar. A high-level coded RFID device taught to one specific actuator responds to nothing else, so a bypass requires stealing the actuator off another door, which is both harder and visible.
Two practical notes. Individually coded devices must be taught during commissioning, and that teaching event should appear in your cell documentation, because an uncontrolled re-teach cycle quietly returns the door to a lower coding level. And a coded device installed with the actuator permanently fixed to the fence rather than to the door has been defeated on day one, which we still find more often than we would like.
An interlocking device without locking issues a stop command when the guard opens. A guard-locking device holds the door shut until the hazard has actually ceased, then releases.
The decision between them is arithmetic, not preference. Compare overall system stopping performance against the time it takes a person to open the door and reach the hazard. If access time is shorter than stopping time, the door has to stay locked. Robot cells fail this test constantly: a large payload arm decelerating under gravity, a spindle coasting, a servo axis holding a load, a conveyor that keeps indexing after the robot has stopped. If you have never measured the stop, you do not know which side of the line you are on.
Where locking is required, the release logic matters as much as the lock. Power-to-release fails open on a power loss, which can be the wrong behavior on a cell with stored energy. Power-to-lock holds through a power failure. Which one is correct comes out of the risk assessment, and it is one of the details we work through during a robotics safety gap analysis.
This is the failure mode that most often surprises maintenance teams, because the cell looks compliant and the paperwork says Performance Level d.
Mechanical interlock switches wired in series through a single safety input can hide faults from each other. With one door in the string already open, a developing fault on a different door in the same string may go undetected. The diagnostic coverage the circuit was rated for is not what the circuit is actually delivering, and the calculated Performance Level is optimistic. Machine builders and end users frequently series-wire switches without realizing they have reduced their safety coverage.
The remedies are straightforward: individually monitored inputs on each door, or devices that communicate serially with per-device diagnostics, or a safety controller that can distinguish the doors. On a three-door cell this is a modest wiring decision. On a twelve-door line it is the difference between a valid safety calculation and a fictional one. It also ties directly to the control architecture we cover in our notes on safety-rated robot cell controls and Performance Level.
ISO 14119 asks you to consider defeat in a reasonably foreseeable manner, which means asking why someone would want in and making the legitimate path easier than the illegitimate one.
That fourth point is the one worth dwelling on. Nearly every defeated interlock we find on a West Michigan floor traces back to a production task that the cell design never accounted for. The jam-clearing problem is the same one we described in detail for palletizer cell lockout.
An interlocking device, however well specified, is a production safeguard. It stops motion. It does not isolate energy, and the stop can be reset from the panel by anyone who did not see the person inside the cell.
OSHA 1910.147 servicing and maintenance work requires the energy-isolating device itself to be locked, with each authorized employee applying a personal lock. A Type 4 high-coded interlock with guard locking is excellent engineering and is not a substitute for a disconnect and a lock. The two systems answer different questions, and the boundary between them belongs in the written cell procedure, which is exactly what our robot cell LOTO procedures service produces.
The access-control placard at each door exists to make that boundary unambiguous to the person standing in front of it at 2 a.m., which is why we treat the placard and the interlock specification as one deliverable rather than two.
We inventory every guard door on your cells, classify the interlocking devices against ISO 14119, check the guard-locking arithmetic, and flag fault-masking exposure in the wiring. No cost, no obligation.
Request a Free Robotics Safety Gap AssessmentISO 14119:2024 is the machinery safety standard covering interlocking devices associated with guards. It specifies how to design and select the switch on a guard door and how to minimize the possibility of defeat in a reasonably foreseeable manner. It applies to any fixed perimeter guarding with a movable access door, which describes almost every fenced robot cell in West Michigan.
Type 1 is a mechanically actuated position switch with an uncoded actuator, such as a roller or plunger switch. Type 2 is mechanically actuated with a coded actuator, the classic tongue switch. Type 3 is contactless with an uncoded actuator, such as a plain magnetic switch. Type 4 is contactless with a coded actuator, which covers RFID-coded non-contact switches.
Coding level describes how many unique actuator codes a device family supports, which determines how hard it is to bypass with a spare actuator. Low level coding provides 1 to 9 code variations. Medium level provides 10 to 1000. High level provides more than 1000, which is typical of individually coded RFID devices that only accept the one actuator they were taught.
When the hazard does not stop before a person can reach it. If the robot cell stopping time plus system response time is longer than the time it takes someone to open the door and reach the hazard, the door must stay locked until motion has actually ceased. Cells with large payloads, long deceleration, coasting spindles, or gravity loads almost always need guard locking rather than simple interlocking.
No. An interlock is a safeguard for normal production operation. It stops motion when the door opens. It does not isolate energy, and it can be reset by anyone at the panel. OSHA 1910.147 servicing and maintenance requires the energy-isolating device itself to be locked out. Entering a cell on an interlock alone is one of the most common findings on our West Michigan audits.
Wiring several mechanical interlock switches in series can hide faults. When one door in the string is already open, a fault developing on another door in the same string may not be detected, so the diagnostic coverage the safety circuit was rated for is no longer real. ISO 14119 addresses this directly, and it is why individually monitored or serially communicating devices are preferred on multi-door cells.
Related reading: Light Curtains and Laser Scanners for Robot Cells, Fenceless Robot Cell Risk Assessments, Annual LOTO Audit.