Why Defeating an Interlock Is Never the Fix

Why this matters

A jumper across an interlock does not remove a requirement. The requirement was that the guard be closed before the machine turns, and it still is. What the jumper does is move that requirement off a switch that checks it at every single start and onto a person who checked it once, and who will not be standing there the next time somebody hits the button.

That is the whole argument, and it is worth having in one sentence, because the conversations where you need it are the ones where everybody is tired and the machine has to run.

Isolate before you investigate

If you have found a defeated interlock, the machine can currently run in a state its designer said it must not. Do not test theories on it while it is capable of starting.

Isolate at the energy isolating device and lock and tag it under 29 CFR 1910.147, which covers the rotating mass and the stored pressure both. On a compressed-air machine that means bleeding the receiver and the discharge piping to zero through a drain valve, watching it stop hissing, and confirming zero on a gauge that is on the isolated side rather than one a closed valve has cut off. Confirm zero rotor speed visually before any hand goes past a guard opening, because a large rotor coasts long after its power is gone.

Work inside the electrical enclosure is 29 CFR 1910.333(b)(2), not 1910.147, which excludes exposure to electrical hazards from work on conductors in electric utilization installations at (a)(1)(ii)(C). Prove dead using the live-dead-live sequence on a known source per NFPA 70E-2021, 120.5.

The call

A shop air compressor, complaint of a machine that would not build. The tech opened the starter enclosure to look at the control circuit and found a short length of wire across the two terminals that the belt-guard interlock lands on. The insulation on it was discoloured and stiff, which told him it had been there long enough to cook, and the interlock's own leads were still attached alongside it.

That changed the job. The load fault was still there and still needed doing, but a defeated guard interlock on a machine in daily use is a stop-work finding, not a note for the bottom of the ticket.

What the record said, and what it did not

The service history showed a belt tracking complaint 14 months earlier. The note on that visit read that the belt had been observed running and that tracking was acceptable. It did not say how the belt had been observed running with the guard off, because you cannot see a belt track through a closed guard. The jumper is the missing sentence.

There was no note recording the jumper's removal, for the good reason that it was never removed.

In the 14 months since, the machine had roughly 9 recorded service visits by 3 different techs. None of them recorded the jumper. That is not a failure of attention, it is a property of anonymous wire: none of those visits had any reason to open the starter enclosure, and a jumper inside a closed enclosure is invisible to everything except a task that happens to look there. A defeat that is not conspicuous is a defeat that survives, and the survival has nothing to do with how careful the people are.

What removing the jumper revealed

The jumper came out, the isolation came off, and the machine would not start at all.

The belt-guard switch had failed open. Corroded contacts, a wet shop, a switch mounted where it caught condensate off the guard. Nobody knew, and nobody could have known, because the jumper had been answering for it the whole time.

So the exposure was worse than "the guard interlock was bypassed for 14 months." For some unknown portion of those 14 months there was no working interlock at all, and the jumper had removed the one signal that would have told anybody, which is a machine that will not start. The failure of a de-energize-to-trip device is normally loud: it stops you. Jumper it and you have converted a loud failure into a silent one.

Two faults now, and only one of them was on the work order.

Where they hide

Since a defeat survives by being invisible, knowing the handful of places they live turns a discovery from luck into a check. None of these takes more than a few seconds when the enclosure is already open for something else.

Across the terminals a protective device lands on, which is what was found here, and which looks like a factory jumper unless you notice the device's own leads sitting alongside it. Inside the device itself, where its contacts have been shorted at the switch body rather than at the panel. A magnet, a zip tie, a cable tie or a wedge holding an actuator or a plunger in its made position, which is the most common defeat on a guard switch and leaves no electrical trace at all. A selector left in a bypass position, which is not strictly a defeat because it is a designed function, and which has the same effect. And in a controller, a forced input, an inhibited alarm, or a permissive commented out of a rung, none of which is visible from outside the cabinet and all of which show in the controller's own forced-point or override list.

That last one deserves a habit rather than a look: on any machine with a programmable controller, check the forced or overridden point list as routine, the same way you would check a filter. It takes seconds and it is the only place a software defeat is visible.

What the jumper actually did

Line it up against what people say a jumper does.

It did not "make the machine work." The machine already worked. It made the machine able to run in a condition the designer excluded.

It did not "buy time." Time is not what was consumed. What was consumed was the checking. The interlock checked the guard at every start, some thousands of starts over 14 months. The tech checked it once, correctly, on one afternoon, and then his single check stood in for all the rest of them.

It did not "only affect that one job." A defeat is a change to the machine's behaviour that persists until somebody undoes it, and by the time it hurts somebody the original justification is not attached to it. The person it eventually catches is not the person who put it in, does not know it is there, and is doing something completely reasonable.

The bounded version that is legitimate

Temporary defeat during a test is a real practice and pretending otherwise makes this article useless. You genuinely cannot observe belt tracking through a closed guard. What separates a legitimate temporary defeat from what was found in that enclosure is four things, and every one of them exists specifically to prevent the transfer described above.

It is attended continuously. The person who defeated it stays with the machine for the entire duration and controls access to the hazard area the whole time. The moment they walk away, the requirement has transferred to nobody.

It is conspicuous. A labelled test lead, a keyed bypass switch with an indicator, a tag hanging off the enclosure. Not an anonymous piece of wire that looks like part of the machine. If the next person to open that panel cannot tell in two seconds that a protection is defeated, it is not a temporary defeat.

It is time-boxed to a stated test. "While I watch the belt track" is a bounded purpose with an end. "Until we get the part" is not, because that has no end that anybody owns.

It is removed and the function proved before the machine returns to service, and the proof is written down. Not "removed." Proved. The jumper in this case would have failed that step immediately, because removing it would have exposed the dead switch on the same afternoon it happened rather than 14 months later.

Some protections do not get even that. An emergency stop, a light curtain doing its production job, a two-hand control, and a presence sensor on a machine that other people are operating are not candidates for a temporary defeat by a service tech, because their whole function is to protect somebody who is not you and whose behaviour you cannot control by standing there.

The arguments that come back

"It has to run tonight." Then there are three options and defeating the interlock is not among them. Fix the condition. Run under an attended manual procedure that keeps people out of the hazard area rather than removing the machine's ability to detect them, which is a different thing and often possible. Or shut it down. A machine that can only run with a protection defeated is a machine that is not fit to run, and putting that in writing is part of what the customer is paying for.

"The interlock is nuisance tripping." That is a claim about a condition, and it needs the same treatment any tripped protective device needs: establish what it saw before deciding it was wrong. The sibling article on establishing why a safety device opened is the procedure. What matters here is that "it nuisance trips" is the most common preamble to a jumper, and it is almost never established before the jumper goes in.

"Fine, I will just replace the switch." Replacing a correctly-operating device reaches the same end state as jumpering it, one step slower and with a part number on the invoice. If the switch is opening because the guard is genuinely not closing, or because it is mounted where water sits on it, a new switch does the same thing in a few months. The mounting problem in this case was real and a like-for-like replacement would have been back inside a year.

Proving the function before you leave

Removal is not the deliverable. Proof is, and it takes a few minutes on a visit that is already happening.

Run the machine unloaded, with everyone clear of the guard opening and the process owner told what is about to happen. Then plan for the test failing, because that is the case you are testing for: open the guard from clear of the nip and out of the plane of the belt or wheel, standing where a machine that does NOT stop cannot reach you, with a second person at the disconnect or the E-stop. Open the guard and confirm the machine stops. Close it, reset if the arrangement requires a reset, and confirm it starts. Then do the negative check that people skip: confirm it does not start with the guard open, because a switch can be wired so that it drops a running machine and still permits a start.

Write the date, the test, and the result. That record is what turns the next tech's discovery of a jumper into a two-minute question instead of a 14-month reconstruction.

References

• 29 CFR 1910.147 for control of hazardous energy, including isolation at an energy isolating device rather than at an interlock
• 29 CFR 1910.212 for general requirements for machine guarding
• 29 CFR 1910.333(b)(2) for de-energizing electrical circuits, and NFPA 70E-2021, 120.5 for verifying an electrically safe work condition
• See related: Interlocks and Why They Are Not Control; How to Establish Why a Safety Device Opened; A Customer Asks You to Disable a Safety Device, Decision Tree