Safety Interlock¶
Automatic safety interlock — instantiates Invariant Guarding
Makes a hazardous action physically impossible unless every enabling safety condition is true, holding the system in a safe default state until they are.
A Safety Interlock makes a hazardous action mechanically or logically impossible while any enabling safety condition is absent. Its defining move is that the guard is wired into the action's own actuation path — the machine cannot cycle, the door cannot open, the current cannot flow — so the absence of a safe condition does not merely warn, it prevents, and the system rests in a safe default until every condition is simultaneously true. Unlike a check that inspects data or a decision, an interlock gates a physical or system transition at the moment of actuation, and it fails toward safety: lose the signal, and the hazardous action is denied.
Example¶
A metal-stamping shop runs a hydraulic press whose ram descends with enough force to sever a hand. The invariant: the ram must never descend while a hand could be inside the die. The interlock ties the ram-descend circuit to three enabling conditions — a light curtain across the die opening must be unbroken, the two palm buttons (spaced too far apart for one hand to hold both) must be pressed together, and the guard door must be closed. During a shift an operator reaches in to clear a misfeed; the light beam breaks, and the descend command is simply ignored — the ram holds at top-dead-center. The dangerous transition cannot occur: work stops safely rather than a hand being caught. Only when the operator steps clear, the beam re-establishes, and both palm buttons are deliberately pressed does the cycle become possible again.
How it works¶
- Enabling conditions ANDed into actuation. Each safety condition is a term in the logic that energizes the hazardous action; all must hold at once, often on redundant, monitored channels via a safety-rated controller.
- Fail-safe default. Loss of a signal de-energizes toward the safe state rather than the active one, so a broken sensor or cut wire denies the action.
- Continuous, not one-shot. The block holds for as long as any condition is unmet; there is no override in normal operation.
- Gates a transition, not a record. It sits on the physical/system action itself, which is what distinguishes it from data- and decision-level guards.
Tuning parameters¶
- Hard vs. soft interlock — physically impossible (hardwired) vs. software-inhibited but overridable. Hard interlocks are safest and least flexible; soft ones allow sanctioned maintenance access at the cost of a defeat path.
- Condition-set breadth — how many enabling conditions gate the action (door, presence, temperature, pressure). More conditions cover more hazards but produce more nuisance trips.
- Reset discipline — automatic reset when conditions clear vs. a deliberate manual reset. Manual reset prevents a surprise restart the instant a beam re-establishes.
- Channel redundancy / diversity — single vs. dual-channel monitored sensing. Higher redundancy raises the achievable safety-integrity level but adds cost and complexity.
When it helps, and when it misleads¶
Its strength is turning "operators must be careful" into a physical guarantee: harm is prevented at the actuation point, the earliest placement possible, embodying mistake-proofing so the unsafe transition cannot be made rather than merely being discouraged.[n1]
Its central failure mode is bypass normalization — interlock defeat. If the interlock trips too often or slows legitimate work, operators tape the switch, jumper the circuit, or prop the door, reintroducing exactly the hazard it guarded. The classic misuse is defeating an interlock to clear frequent jams faster, trading a rare catastrophic injury for routine convenience. The guarding discipline is to tune the condition set so legitimate work rarely trips it, log every defeat, and provide a sanctioned, scoped maintenance-access procedure so people are never forced into an unsanctioned bypass to get their job done.
How it implements the components¶
transition_scope— the interlock is pinned to a specific hazardous actuation (the press cycle), the exact transition that could break the invariant.guard_condition— the ANDed enabling conditions on the actuation path translate "no hand in the die" into a live, physical pass/deny test.violation_response_path— when a condition is absent the system holds in its safe default (ram up, circuit de-energized), blocking the action.
Its guard fires automatically on system state; it does not require an accountable second human (invariant_owner, audit_trace) the way a Two-Person Rule does, and it prevents the action rather than restoring a prior state via rollback_or_repair_policy (that's Rollback Transaction).
Related¶
- Instantiates: Invariant Guarding — the Safety Interlock is the physical, prevent-at-actuation realization of the archetype.
- Sibling mechanisms: Database Constraint · Invariant Test Suite · Contract Check · Policy Guardrail · Integrity Monitor · Rollback Transaction · Two-Person Rule
Editorial Notes¶
Form Classification¶
Form family: Control, Automation & Runtime
Rationale: Safety Interlock operates as a live operational control that automatically routes, enforces, adapts, or responds during execution because it makes a hazardous action physically impossible unless every enabling safety condition is true, holding the system in a safe default state until they are.
Independent corroboration: The frozen evidence defines Safety Interlock as 'Makes a hazardous action physically impossible unless every enabling safety condition is true, holding the system in a safe default state until they are', so its operative form is Control, Automation & Runtime.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Single lineage
Present-day reach: Multi-domain
Rationale: Physical impossibility of hazardous action until safety conditions hold is a canonical engineering interlock.
Related originating lineages:
- Systems Thinking & Cybernetics — Systems thinking, feedback control, and cybernetics supplies a parallel or contributing lineage for the mechanism's defining operation: makes a hazardous action physically impossible unless every enabling safety condition is true, holding the system in a safe default state until they are.
Review resolution: Both blind reviewers agree that engineering_design is the primary historical origin. Explicit reconciliation of alternate_origin_disagreement, domain_reach_disagreement starts from reviewer_a's mechanism-specific evidence: Physical impossibility of hazardous action until safety conditions hold is a canonical engineering interlock. Reviewer A proposed alternates=none, origin_mode=single_lineage, domain_reach=multi_domain, and encyclopedia_synthesis=false; reviewer B proposed alternates=systems_cybernetics, origin_mode=single_lineage, domain_reach=specialized, and encyclopedia_synthesis=false. The final record retains every independently supported alternate from either review (systems_cybernetics) without an arbitrary cap, selects origin_mode=single_lineage to represent the combined lineage evidence, and records domain_reach=multi_domain and encyclopedia_synthesis=false. Present-day transfer is recorded as reach and is not treated as proof of historical origin.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
Its nearest twin is the Two-Person Rule: both block a hazardous transition until an enabling condition is met. The one-sentence separation: a Safety Interlock's enabling condition is an automatic check on physical/system state, while a Two-Person Rule's enabling condition is a second independent human authorization.
[n1] Poka-yoke — Shigeo Shingo's term for mistake-proofing: designing a process or device so that the error is physically impossible or immediately obvious, rather than relying on human vigilance to avoid it. ↩