Skip to content

Independent Interlock or Guard

Engineered safeguard — instantiates Conjunctive Path Assurance

Holds one gate on every hazardous route independently shut, so no conjunction of the other conditions can complete the path.

Every other mechanism in the set studies the conjunction; Independent Interlock or Guard prevents it. It is a dedicated control that keeps at least one edge on every route to the target held shut — de-energized, blocked, or fail-safe by default — so that however the other conditions happen to line up, one term of the AND stays unconditionally false and the route cannot complete. Its defining requirement is independence: the guard is worth counting as a separate layer only if it shares no power, no sensor, no logic, and ideally no technology or location with the barriers it backs up. An interlock that is truly independent converts assurance from statistical ("the coincidence is unlikely") to structural ("the coincidence cannot complete").

Example

A radiography bunker exposes film with a high-activity source, and the hazard is "source exposed and door open and a person inside." The console software checks the door, the operator follows a checklist, and a timer limits exposure — three barriers, all sharing the control system. The independent interlock is a hardwired door switch on a separate circuit that physically retracts the source the instant the door opens, with no dependence on the console at all. Even if the software, the checklist, and the timer fail together — a full conjunction that defeats every soft barrier — the interlock keeps the last gate shut and drives the source to its shielded safe state. Its guarantee holds precisely because it draws its power, its sensing, and its logic from somewhere the other three do not.

How it works

Identify the last-line edge on each route to the target, and place a guard that holds that edge broken by default. Then engineer the guard to be independent of the primary barriers — separate power supply, separate sensor, diverse technology, physical separation — so no single common fault can take out both it and what it backs up. Wire its trip to a defined safe state with a controlled recovery path. What distinguishes it from its siblings is that it does not detect or estimate the conjunction at all: it makes one term of every dangerous AND unconditionally false, so the analysis of the other terms becomes moot.

Tuning parameters

  • Independence and diversity depth — how thoroughly the interlock is separated from the barriers it backs — separate power, sensor, technology, location. More independence closes common-cause loopholes but costs money and complexity.
  • Fail-safe default — the state it drops to on any doubt. A well-chosen safe state is unconditionally safe; a poor one trades one hazard for another.
  • Trip threshold and hysteresis — how eagerly it trips. A hair-trigger interlock nuisance-trips and invites bypassing; a sluggish one lets the window open.
  • Bypass and override governance — whether and how it can be defeated for maintenance; every bypass is a re-introduced path and must be tightly controlled.
  • Recovery path — how the system is brought back after a trip; too hard a recovery tempts operators to defeat the guard, too easy a one normalizes nuisance trips.

When it helps, and when it misleads

Its strength is categorical: rather than showing the conjunction is unlikely, it makes one term of the AND-chain unconditionally false, so the route cannot complete however the other conditions align — the structural backstop behind all the probabilistic reasoning.

Its guarantee, however, is only as real as its independence. An interlock that quietly shares a power supply, a sensor, or a logic solver with the barriers it backs up collapses, under the right common fault, into a single point of failure — and worse, one the organization has credited as a separate layer.[1] Nuisance trips compound the danger, because they breed the bypasses and overrides that reopen the very path the guard was meant to close. The classic misuse is booking a non-independent interlock as defence in depth — claiming layers that one common fault erases at a stroke. The discipline is to establish independence explicitly, govern every bypass, and never credit an interlock whose diversity has not been shown.

How it implements the components

  • path_break_or_interlock_requirement — the interlock is the enforced break: the requirement that one gate on every route stays independently shut, realized in hardware or logic.
  • diversity_and_separation_plan — its independence is engineered through diversity and physical, electrical, and logical separation from the barriers it backs.
  • safe_state_and_recovery_path — on any challenge it drives the system to a defined safe state and provides the controlled path back.

It does not detect a developing conjunction — that live watch is Runtime Gate Co-Activation Monitor — nor verify that its own independence claim actually holds, which is the job of Common-Cause Dependency Audit.

Notes

Independence is the whole game, and this mechanism assumes it rather than proving it. That is why it pairs with Common-Cause Dependency Audit, which is what actually establishes that the interlock shares no hidden driver with the barriers it backs up. An interlock credited without that audit is a defence in depth on paper only.

References

[1] A common-cause failure defeats several nominally independent barriers through one shared driver — a common power feed, sensor, or environment. It is why an interlock counts as a distinct independent protection layer only when it is demonstrably diverse from and separated from the layers it supplements, the standard on which layer-of-protection reasoning rests. ↩