Interlock — Pre-Start Enforcement Hardware

Overview

The Interlock is PreStartGo's hardware interlock — the device that makes a pre-start inspection physically matter. It holds a relay open in one of the machine's circuits until a completed, passing inspection sends it a cryptographically signed unlock command from the PreStartGo mobile app, over Bluetooth Low Energy.

The Interlock is wired into one circuit only, chosen at install: the starter-motor circuit, or the operator-presence (seat switch) circuit. It has no connection to any vehicle data bus — no CAN, no J1939, no OBD — and it cannot stop a running engine. It is a compliance enforcement tool, not a safety-rated isolation device.

Key specifications

Because the Interlock is BLE-only, nothing about a machine's live lock state is visible from the office — the phone standing next to the machine is the only thing that talks to it. Live location is a different product: see Tracker — Live Equipment Tracking.

Reading the status LED

The LED on the housing is the operator's entire local status readout. Colour carries the state; cadence carries the urgency.

Two reading rules worth memorising: green flashing means nothing is assigned, green solid means genuinely authorised; amber solid is deliberate, amber flashing is a fault.

The lock states, in plain terms

• Locked — the relay holds the interlocked circuit open. A signed unlock from a passing pre-start, or a Confirm against a still-valid one, releases it.
• Unlocked — a valid pre-start is in force. It lasts as long as the pre-start timer your admin sets in the console; when that runs out, the Interlock locks again immediately, with no grace period. On a starter-wired machine that only prevents the next start — a running engine is never affected.
• Operator expired — the operator has been away (key off, or out of the seat) longer than the operator timeout set in the console. If the pre-start is still valid, the operator taps Confirm and unlock in the app — not a whole new pre-start. With the timeout set to 0, the operator confirms after every key-off.
• Service mode — a supervisor or technician has deliberately suspended compliance enforcement for maintenance. It survives power cycles and never times out on its own; it ends only when someone explicitly exits it. See Using Service Mode for Repairs.
• Bypass — the emergency escape hatch: a ten-second hold of the device's button. Always time-limited, but recorded only on the device itself: PreStartGo never receives a record of it. See Emergency Bypass.
• Error — a hardware fault. The relay stays closed, so the machine can start; the device tries to recover itself every few minutes, and recovers immediately when a technician connects to it.

Fail-START, precisely

A dead, unpowered, or faulted Interlock leaves the machine exactly as if no Interlock were fitted. The relay's resting position completes the circuit, and that resting position is set by the board's hardware — not by firmware — so it holds during boot, after a crash, and with the unit fully unpowered.

This is called Fail-START, and it is the opposite of what "fail-safe" would mean here: a fault permits starting rather than preventing it. The design choice is deliberate — an interlock must never strand equipment in the field.

How unlocking works

The mobile app — not the server — talks to the Interlock. After a passing pre-start, or a Confirm against one that is still valid, the app sends a signed BLE unlock command carrying just three numbers: a pre-start reference, the time left on the pre-start timer, and the operator timeout. The Interlock never sees a checklist, a photo, or a defect — it enforces the outcome, and the platform keeps the evidence.

Both timers are set once, in the console — for the organisation, a group, a site or a single machine — and travel with every unlock, so the app and the Interlock always work to the same numbers. The Interlock keeps its own upper limits of 24 hours and 3 hours, and applies the shorter of what it is sent and its limit. The app shows the time the Interlock actually granted.

Every command is signed with HMAC-SHA256 using a per-organisation key that only reaches a phone after the platform's own authorisation checks pass. There is no BLE pairing or bonding; the application-layer signature is the security boundary. Replay is prevented with a per-device counter, and repeated bad signatures trigger a temporary lockout on the device.

BLE availability

An Interlock advertises over BLE whenever it has power, so a phone at the machine can always find it — there is no sleep to wake it from. Two things leave it unpowered:

• Ignition power — an Interlock fed from the ignition-switched circuit powers down with the key, so turn the key on before connecting.
• No supply — a dark LED means the unit has no power at all.

While connected, an Interlock accepts one phone at a time and disconnects automatically after five minutes.

Power draw

Locked is the energised relay position (that is what makes Fail-START work), so a parked, locked Interlock holds its relay coil on continuously. With an in-cab annunciator configured as well, standing draw is roughly 90 mA above the machine's own baseline.

Edge cases

• Power cycles. A registered Interlock boots locked after any power interruption — no unlock survives a power cycle, and the next start needs a fresh signed unlock from the app. If the last pre-start is still valid and has reached the platform, that unlock is a Confirm, carrying the time left; a pre-start that is still waiting to send from the phone means a new pre-start.
• Interlocks commissioned before the one pre-start timer update may still hold older limits of 11 hours and 15 minutes, and cap the timers at those until they are raised. Once that platform update is live, the updated app raises them to 24 hours and 3 hours the next time a supervisor or technician connects to the Interlock. The Devices page lists the Interlocks still on the older limits.
• Service mode across power cycles. The one exception: a unit in service mode boots back into service mode, deliberately, so a maintenance window is never silently ended by a battery disconnect.
• Second-hand units. A released unit can be re-commissioned by another organisation as a takeover: the previous organisation's evidence is wiped on the device before the new registration lands, and the relay stays locked throughout.
• No factory reset. There is no button-hold factory reset. Decommissioning a unit is done through the platform (release), or on the bench over BLE by a technician.

Troubleshooting

For anything the table doesn't cover, contact support with the device's D- serial from the label.