Principles and Suitable Contexts
An interlock relates machine conditions to operating permission through components designed for the safety function. Images show external conditions but cannot verify sensing, contacts or redundant circuits. They can support observation only; they do not replace SIS, the interlock itself or its required functional testing.
An interlock links a condition to machine operation under its design: for example, a door-state device informs an appropriate circuit. A visibly closed door establishes appearance, not functioning locking or sensing. Separate that external state from what the circuit verifies, and never name an image result permission to run. These are different evidence categories even when their displayed indications happen to agree.
Safety components have fault-detection and response requirements that imagery does not prove. A camera can help list apparent discrepancies for responsible personnel to inspect, nothing more. Observations must not replace conditions belonging to a safety instrumented system, interlock or emergency shutdown system. Standards provide inspection questions and scope, not evidence that a general image system has achieved a safety rating.
Scroll the diagram horizontally to inspect all details.
Data and Preparation
Define only externally observable states, such as door open, closed or obscured. Use the machine risk assessment as context. Collect examples during authorised inspection procedures. Never remove, bypass or stimulate an interlock circuit to create images; the dataset must not require changing the protective function of the machine.
Responsible personnel should identify visible features and reporting terms bounded by evidence. Include door or cover references rather than cropping to a ready lamp alone. Installation must not obstruct authorised opening and closing or access to protective devices. Use existing inspection images or clearly labelled test examples, never scenes produced by modifying the actual machine. Lack of examples is a documented limitation, not an invitation to alter protection.
Register models and readable angles, including views that cannot show the locking point. Define unknown status during image loss and keep image-system permissions separate from circuit-modification permissions. Before use, independent reviewers should confirm that records describe external condition only and that users do not mistake successful recognition for a passed safety-function check or authorisation to start equipment.
Failure Cases and Limitations
A door can look closed while its locking mechanism is not engaged. Small gaps or modified devices may be invisible to the camera. A frozen image must become unknown. Images must not authorise machine starting or be used as evidence that bypassing an interlock would be safe.
Lighting or perspective can hide gaps and make different door positions look alike. Substituting a previous image during obstruction creates an unsupported current closed state. Retain the last capture time and make limitations visible without requiring a detail view. When imagery conflicts with site reports, refer it to responsible personnel; do not independently move, stimulate or operate equipment to resolve an observation problem.
Agreement between a door image and a ready lamp still does not establish contact, wiring or hazard-response performance. Common causes can leave several visible indications apparently normal together. Retain existing functional-test procedures rather than reducing them because a camera was added. Never remove, bypass or impair circuits to test a model, and never use visual output as justification that machine starting is permitted.
Evaluation Methods
Compare visible-state classification against a human reference, separately from functional circuit verification by qualified personnel. Include obscured views and ambiguous angles. Image-reading results do not establish SIL, a performance level (PL) or safety-standard certification, even if the external door state is classified correctly throughout the image dataset.
PL concerns safety-function design performance under its applicable framework; it is not a door-classification score. Reviewers should label only open, closed or visually unclear from the same images. Check appropriate rejection of undecidable angles. Do not directly use a ready circuit signal as the visual reference without separating both evidence types, since the test should identify what the image itself supports.
Acceptance should confirm that neither screens nor records use image states as machine-start permissives. Include stale and missing data using safely obtained recordings, and report false closed conclusions separately even if few. Qualified personnel still perform circuit verification under existing procedures. Image results do not demonstrate hazard removal, locking capability or interlock readiness, and cannot establish that bypassing protective equipment would be safe.
Review Checklist
- Limit conclusions to what the image shows.
- Never use images as a machine-start permissive.
- Retain existing interlock functional tests.
- Escalate discrepancies through a defined review process.
References and Further Reading
References explain principles, not product certification. Requirements from another jurisdiction do not automatically replace local requirements or the actual equipment manual.