CNC machine door interlock: jog with open doors, stop a running job

Short answer: wire a coded, dual-channel door switch through a safety relay with a manual reset button. Door closed and reset pressed, the machine may start. Door opened during a job, the relay drops spindle power in under 0.1 s and sends an abort to the controller, so the program ends instead of crashing on. Jog and probing stay available through a key-switched setup channel that caps jog at 25% of rapid and leaves the spindle dead. A controller script can mirror the door input for alarms; it cannot be the interlock, because a script carries no defined integrity and dies with the PC. Every number in the worked example is a hypothetical example for one benchtop mill; measure your own chain and rundown times before you commit the design.

What stops the job when the door opens mid-cut?

A dual-channel safety relay takes the door switch's two normally closed contacts, drops the spindle contactor and the axis-enable line as Stop Category 0 under IEC 60204-1, and does it in a chain you can measure at under 0.1 s.

Stop Category 0 means immediate power removal. IEC 60204-1 also defines Category 1, a controlled stop with power still available, then removal. Build Category 0 with a relay and a contactor when you want the simplest chain a retrofit can own. Choose Category 1 when the drive brakes the spindle faster than it coasts and you want the tool stopped sooner; the relay then interrupts the drive enable and the drive does the stopping.

Two more decisions belong here. The restart: with the door closed again, the machine stays stopped until someone presses the reset, so a job never resumes by itself. The abort: a monitor output from the relay lands on a controller input, and the software ends the program cleanly instead of losing its axes mid-move. Hardware stops the motion; software tidies up afterwards. A worked retrofit plan for exactly this chain is in the CNC door interlock retrofit plan, and the door interlock rules for enclosure doors covers what each door of a multi-door machine owes the function.

What parts make the chain fail safe?

You need a coded interlocking switch with two normally closed contacts, a dual-channel safety relay with manual reset, a spindle contactor with a linked auxiliary contact, and a key selector for the setup channel, all at 24 V DC.

ISO 14119 is the standard for interlocking devices associated with guards, and its central point for you is defeat resistance: a switch on a guard that anyone can reach has to be hard to fool, so pick a coded actuator, a shaped tongue or a coded magnetic target, rather than a plain roller plunger. The same standard covers guard locking, the device that holds a door shut until the machine is safe to open; it earns its place later. A single-contact reed switch wired straight to a controller input is a convenience circuit, not a safety function: nothing in that path carries a defined integrity.

Put the relay, the contactor and the terminals in the machine's control box; the CNC control box layout guide keeps the 24 V safety wiring clear of the power run. Where coolant and chips fly, the box itself stays a manufacturer-rated NEMA 4X / IP66 enclosure (rated by the manufacturer; not UL listed) with its door gasket in good shape. If the panel is being built toward an industrial control panel listing, the UL 50E and NEMA 250 listing guide explains what the listing side expects of the enclosure.

How do you wire it step by step?

Run both switch contacts on 24 V DC into the relay's two input channels, put the relay's safety outputs in series with the spindle contactor coil and the drive enable, and give the reset its own button so a closed door never restarts the machine by itself.

Lock the machine out and check for zero voltage at the contactor load side before you touch the wiring. Then work down the list:

1. Mount the switch on the frame and its coded actuator on the door, so the contacts open early in the travel, long before the gap admits a hand.
2. Wire both normally closed contacts to the two input channels at 24 V DC, and run the two channels in separate cable so one crushed sleeve cannot kill both.
3. Leave both channels intact; the relay cross-monitors them and flags a channel that opens on its own.
4. Take the relay's two safety outputs in series: one feeds the spindle contactor coil, the other feeds the drive's servo-enable input and the cycle-start supply.
5. Wire the relay's monitor output to a controller digital input; that line carries the abort and the alarm.
6. Fit the reset button outside the guarded zone with a clear view of the work zone, and wire it to the relay's reset terminal so manual reset is the only way back.
7. Add the key selector on a second 24 V line that arms setup mode, and wire its second contact to the controller so the software knows which mode is live.
8. Feed the spindle enable only from the relay's safety output, so an open door means a stopped spindle in every mode and tool setting happens on a still tool.
9. Give the safety chain its own wire numbers and tape a one-page drawing inside the control box door, so the next debug session does not jump it out.

How do you keep jog and probing alive with the door open?

A key selector arms a separate setup line: with the key turned, jog and probing draw their enable from the setup line instead of the door relay, the spindle stays dead because only the relay feeds it, and jog runs hold-to-run at 25% of rapid.

Opening a guard is one protection; in setup mode you lower the energy inside instead. Hold-to-run means an axis moves only while you hold the button and stops the instant you let go. Set the jog cap from what the machine could do to a hand at that speed; 25% of rapid is the worked-example value, and a heavy gantry may deserve 10%. Probing fits this mode without drama: a touch-triggered probe at the capped feed is a low-energy event, which is why probing is the reason most builders want setup mode at all.

Wiring-wise, the setup key contact becomes a second enable path for the axes, fed from its own 24 V line ahead of the door relay, and the selector's contacts keep the two paths exclusive. The door relay keeps its full job in setup mode: it still owns the spindle, and the cycle-start supply sits behind its output, so a G-code start with the door open dies in hardware first and software second. Selection of the selector switch and the relay is its own exercise; a page on choosing safety-rated selector switches and relays walks that part.

Can the controller script carry the interlock on its own?

No, a script carries no defined integrity, gets edited during debugging and dies with the PC, so treat it as the alarm layer and let the hardware chain do the stopping.

It still earns its keep as the second line. On controllers with a scripting system, the pattern is: watch the door input in the main loop and fire the emergency command when it flips while a job runs, then check the same input in the start event so a start attempt with the door open dies on the spot. One hobby CNC controller exposes this as _hw_input in a file called Expr.txt, with the door on input 7 read against mask 64, the stop issued as cmd('Machine.Emergency_Stop') and a #OnStart handler that returns nan() to abort the start. Read the state from the relay's monitor output rather than the raw switch contact, so software and hardware see the same relay and disagree only when something has actually failed. In the worked example the relay reacts in 0.03 s and the software follows with an alarm; neither number makes the script a safety part.

How do you test it and set the guard distance?

Measure the chain time from door movement to power off with a scope or the drive's fault log, measure the spindle rundown with a stopwatch, and compare both against how fast a hand can reach the tool.

Worked example, hypothetical until you replace each input with your own measurement. Benchtop mill, door edge 300 mm from the spindle nose, and the opening admits a hand rather than a whole body. Chain: the switch opens in 0.02 s, the relay reacts in 0.03 s from its datasheet, the contactor drops out in 0.04 s, so power is off at 0.02 + 0.03 + 0.04 = 0.09 s. Rundown: the spindle, cutting at 12,000 rpm, coasts to a stop in 2.6 s on your stopwatch, so the tool turns until 0.09 + 2.6 = 2.69 s after the door starts to move. ISO 13855's approach speeds are 2000 mm/s for a hand and 1600 mm/s for whole-body access, so at 2000 mm/s the hand covers 300 mm in 300 / 2000 = 0.15 s.

The hand wins by about 2.5 s, so plain interlocking is the wrong protection on this machine and the door has to stay shut while the spindle turns. Fit guard locking that releases when a speed monitor reads under 500 rpm, or brake the spindle below that same 500 rpm mark within 0.15 s of the door starting to move. A braked spindle motor or a lower cutting speed can flip the answer, so recompute both times on your machine before you choose.

Then run these checks with the guards in place and log the results:

• Start attempt with the door open: no spindle, no axes, no program.
• Door opened during a cut: power off within your measured chain time, job aborted, alarm on screen.
• Door closed again: the machine waits for the reset, every time.
• Key in setup: jog runs hold-to-run at the capped feed, probing works, and a G-code start still dies.
• A spare actuator held on the switch: start stays blocked, because the codes do not match.

Coded-interlock makers' ISO 14119 application notes call for a function test at least every month; the first two checks, logged, are that test. The door switch monitoring checks extend the set for monitored switches and diagnostics.

Which mistakes defeat the whole design?

Five mistakes come up again and again: a plain plunger switch taped open, one channel wired alone, automatic reset, jog enable tapped off the door relay, and no abort line to the controller.

Each has a fix you can apply in an afternoon:

• Plain plunger reachable while the door is shut: change to a coded tongue or coded magnetic switch, and bury the actuator side in the frame.
• One contact wired and the other jumpered for convenience: wire both; cross-monitoring exists to catch the channel that dies quietly.
• Automatic reset: choose manual reset, so a closing door never re-arms the machine under someone's hand.
• Jog enable hanging off the door relay's output: give setup mode its own key-switched enable path, or every door-open event kills the jog you wanted to keep.
• Controller told nothing: wire the monitor output to the abort input, or the software keeps a dead job alive after the hardware has stopped.

One wrong turn belongs to the specification stage: if the workflow truly needs the door open while the machine cuts, the fix is a machine-safety redesign around reduced-energy cutting, and a bigger switch solves nothing. Machines that already carry a door-mounted disconnect stack another rule set on top; the panel disconnect and door interlock rules for retrofits covers that combined chain.

Catalog dimensions to compare

Compare these catalog dimensions with your component layout. Open each enclosure for its rating, material and usable space, then check those specifications against your application.

Questions