What are the three ways a machine guard can fail, and how is each one established?
A machine guard fails in one of three ways — it was never adequate for the hazard it faced, it was adequate and had been removed, or it was in place but its interlock had been made to report a state the machine was not in — and a photograph of the aftermath rarely tells them apart. Inadequacy is established by comparing the guard as built against the hazard it controls: opening size, reach distance, and the stopping performance behind the guard. Removal is established at the guard’s mounting, from fastener condition, thread wear and witness marks. Defeat is established at the interlock, and defeat is the most consequential of the three findings, because it means the machine ran while the guard was open.
The three machine guard failures also coexist. A guard that is awkward by design invites removal, and a guard removed often enough gets a bypass fitted so that removal stops interrupting the line.
What is a machine’s safety function designed to guarantee when a guard opens?
A machine’s safeguarding is a designed function with a specified reliability, not simply a barrier, and its design record states what the machine should have done when the guard opened, and with what tolerance for a single fault. ISO 12100 sets the risk assessment framework; ISO 13849 expresses, in performance levels, how far the safety-related parts of a control system are meant to be trusted. The ANSI B11 series carries the equivalent obligations in the United States — ANSI B11.0 for risk assessment and ANSI B11.19 for safeguarding performance criteria.
Where the installed guard interlock arrangement was single-channel, or its monitoring had been disabled, it no longer met the level the machine’s risk assessment called for.
What evidence does a bypassed guard interlock leave behind?
A bypassed guard interlock usually leaves a signature, because defeat is usually cheap and improvised, and improvisation leaves traces: a spare coded actuator taped inside the enclosure, a magnet resting against a reed switch, or a jumper across the interlock terminals in a wire gauge matching nothing else in the cabinet.
The bypass arrangement should be photographed before anything is disconnected; a jumper is more persuasive in place, with terminal numbers visible, than in an evidence bag. Wiring that departs from the machine’s own schematic is a clean finding: the schematic states what the machine builder intended, and the deviation states what somebody chose.
ISO 14119, which governs interlocking devices associated with guards, treats defeat as foreseeable behavior to be designed against. The question after a guard interlock bypass is therefore not only who fitted the jumper, but whether the safeguard made fitting one likely.
Can a machine’s safety controller show that a guard interlock was defeated?
A machine’s safety controller or safety relay can often show what a guard interlock reported, because an interlock is an input and inputs are visible to the control system. Safety controllers and safety relays often retain reported guard state, discrepancy faults between redundant channels, and reset events as diagnostics. A guard door logged as closed through a continuous production run, while its interlock actuator sat taped to a bracket, is not an ambiguous record.
The same safety controller data establishes how long a guard interlock bypass was in place, and a bypass fitted minutes before an injury implies something different about supervision than one in place for months.
Why do people bypass machine guard interlocks, and what does that say about the design?
Machine guard interlock bypasses are rarely acts of indifference; they cluster around tasks the safeguarding made difficult, such as clearing jams, threading material, adjusting a fixture, or observing a process that must run to be observed. When a guard is opened many times a shift and every opening costs a restart sequence, defeating the guard interlock becomes the path of least resistance.
That pattern of guard interlock bypasses is evidence about design and work organization, not only about an individual, which is why motivation belongs in the design record, and the pattern shows up in downtime and jam records.
How do you tell whether a machine guard that was in place was adequate?
Whether a machine guard was adequate is a reach-and-distance question, because a guard that is present can still be inadequate: fixed guards are assessed against opening size versus distance to the hazard, and against reach over, under, around and through the guard. The safe-distance tables in ISO 13857 and the criteria in ANSI B11.19 exist because intuition performs badly at judging guard adequacy. OSHA’s requirements at 29 CFR 1910.212 and 1910.219 set the regulatory floor.
The measurement of a fixed machine guard is straightforward and frequently never taken. Documenting the actual opening, distance and reach path converts an argument about guard adequacy into arithmetic against a published table.
How do light curtains and other presence-sensing devices fail?
Light curtains, mats, scanners and two-hand controls fail in their own ways because they depend on the machine’s stopping performance. The required safety distance for these devices is a function of the machine’s measured stopping time, and stopping time degrades as brakes, clutches and valves wear. A light curtain mounted at a correct distance on commissioning day can be too close years later without anything visibly changing.
Muting and blanking on presence-sensing devices are configurable and easily widened to stop nuisance trips; whether the configuration still matched the machine’s risk assessment is recoverable from the device parameters. Robot cells raise the perimeter and teach-mode questions that ANSI/RIA R15.06 covers.
What documents matter when investigating a defeated or removed machine guard?
The documents that matter around a machine guard are the ones that establish knowledge — guard complaints, work orders mentioning a jammed or removed guard, prior near misses, and internal audit findings — together with the machine builder’s manual and residual-risk information. A guard defeat documented beforehand and one nobody could have known about produce very different outcomes on identical facts. The builder’s manual and residual-risk information are the other half of the paper record around the hardware: what the manufacturer warned about, and what the employer did with the warning.
How are expert opinions on machine guard and interlock failures challenged?
Expert opinions on machine guard and interlock failures are predictably challenged on four grounds: that the bypass was fitted after the incident, that inadequacy is asserted rather than measured, that the control-system record was collected only after the machine had been cycled, and that the reconstruction assumes a body position no evidence supports.
Machine guard failure work that photographs the arrangement in place, measures rather than estimates, and separates what the machine’s controller proves from what it merely permits survives those challenges. A conclusion resting on one artifact does not.
This article is general technical orientation, not a failure analysis, an engineering opinion, or advice on any specific matter. Determining the cause of a particular incident requires hands-on examination by a credentialed expert.