Machinery Safety 101

Trapped Key Interlocking

Many machine design­ers think of inter­locks as exclus­ively elec­tric­al devices; a switch is attached to a mov­able mech­an­ic­al guard, and the switch is con­nec­ted to the con­trol sys­tem. Trapped Key Inter­lock­ing is a way to inter­lock guards that is equally effect­ive, and often more appro­pri­ate in severe envir­on­ment­al conditions.

I’ve provided some use­ful defin­i­tions and links to addi­tion­al read­ing at the end of the article.

Trapped Key inter­lock­ing uses mech­an­ic­al inter­lock­ing devices to ensure that guards remain closed unless the machinery is stopped. [per­fect­pullquote align=“right” bordertop=“false” cite=”” link=”” col­or=”” class=”” size=“”]Mechanical inter­locks are robust, cap­able of with­stand­ing dirty, dusty, and wet conditions.[/perfectpullquote] Anoth­er sig­ni­fic­ant bene­fit of trapped key inter­lock­ing is the abil­ity of the inter­lock­ing devices to with­stand infre­quent use. Elec­tric­al inter­lock­ing devices can fail from lack of use, and these fail­ures might not be detec­ted by the auto­mat­ic dia­gnostics provided by the safety relay, con­trol­ler or safety PLC. ISO 14119 [1, 8.2] dis­cusses the need to phys­ic­ally test the oper­a­tion of rarely used inter­locks to ensure that the dia­gnostics can check the func­tion of the inter­lock­ing device.

What is “Trapped Key Interlocking”?

Trapped Key Inter­lock­ing, also called key trans­fer inter­lock­ing, is a sys­tem of mech­an­ic­al locks installed on gates, valves, etc. The sys­tem relies on the trans­fer of keys from a con­trol device to a lock that con­trols access into the danger zone of the machine. The dia­gram below, [1, Fig. B.3], shows the simplest form, where a lock­ing device is used to pre­vent the ener­giz­a­tion of a machine by lock­ing the sup­ply dis­con­nect­ing device.

The simplest form of a trapped key interlock [1, Fig. B.3]
The simplest form of a trapped key inter­lock [1, Fig. B.3]

Guards can also be inter­locked in this way, [1, Fig. B.5]. In this case, the lock­ing device is used to shut off power to the haz­ard­ous motions, and the key is removed from the con­trol device. The key is required to open the machine guard, where the key remains trapped until the guard is closed and locked. The key can then be returned to the con­trol device, and power restored to the machine to allow it to run.

Two line diagrams showing a simple trapped key interlock with one guard in the energized, access denied and de-energized, access permitted conditions.
Simple trapped-key inter­lock with one guard [1, Fig. B.5]

[per­fect­pullquote align=“left” bordertop=“false” cite=”” link=”” col­or=”” class=”” size=“”]The essen­tial fea­ture of the sys­tem is that the remov­able key is trapped either in the guard lock or in the switch lock.[/perfectpullquote]

The essen­tial fea­ture of the sys­tem is that the remov­able key is trapped either in the guard lock or the switch lock. The lock on the guard is arranged so that the key can only be released when the guard has been closed and locked. The key can then be trans­ferred from the guard to the switch lock. Turn­ing the key to the “ON” or “RUN” pos­i­tions traps the key so that it can­not be removed  (see [1, Fig. B.3] and [1, Fig. B.5]).

The oper­at­ing prin­ciple is:

  1. Turn the con­trol key from the run pos­i­tion to the stop pos­i­tion and remove it from the con­trol device lock.
  2. Take the con­trol key to the guard. Unlock the loc­al guard lock­ing device. As long as the guard is unlocked the key is trapped in the lock. Without that key, the machine can­’t run, so the machine is safe.
  3. Com­plete the work, close and lock the loc­al guard.
  4. Return the key to the con­trol device on the con­trol panel.
  5. Switch­ing the con­trol device to “RUN” will per­mit the machine to run again when star­ted with a sep­ar­ate start control.

Complex Access Control

The approach described pre­vi­ously works well for simple, single-point inter­lock­ing, but there are many more com­plex situ­ations where mech­an­ic­al inter­locks could be used. An addi­tion­al com­pon­ent, called a “key trans­fer block,” is used to provide an inter­me­di­ate loc­a­tion. Defined sequences of oper­a­tions, time delays, and mul­tiple access points can be con­trolled using this approach.

Block with multiple key locking cylinders used to permit controlled sequencing of access.
Trapped Key trans­fer block [3]
In a com­plex inter­lock­ing sys­tem, the con­trol key is trans­ferred from the con­trol switch lock (2 in [1, Fig. B.6] below) to an inter­me­di­ate key-trans­fer block (3 in [1, Fig. B.6] below). Turn­ing the con­trol key in this block releases one or more keys that then can be used to release access keys in a sec­ond­ary trans­fer block (4 in [1, Fig. B.6] below). Indi­vidu­al guards can then be unlocked, and safe access permitted.

Diagram showing trapped key interlocking with a key transfer block used to provide access to multiple access points.
Com­plex inter­lock­ing using trapped keys. [1, Fig. B.6]
This same approach can be used at the guards, where anoth­er key can be released when the guard is unlocked. This key can then be taken inside the safe­guarded space and used, for example, to release a robot teach pendant, or to enable robot teach­ing at reduced, “safe” speed.

Advantages and disadvantages

Simple to useCom­plex to ini­tially design
RobustNo fail­ure dia­gnostics in the field
No field wiringCost of components
No pro­gram­ming
Imper­vi­ous to weather 
Excel­lent in dusty conditions
Suit­able for low fre­quency-of-access applications
Rel­at­ively easy to expand
Suit­able for large systems
Can be designed to meet lock­out requirements
No field wir­ing cost
Advant­ages and dis­ad­vant­ages of trapped key inter­lock­ing systems.


Since the field inter­locks don’t have any elec­tric­al sens­ing in most sys­tems, it is pos­sible to have one of the field inter­lock­ing devices fail and have the fail­ure go unnoticed or ignored. This can be mit­ig­ated in at least two ways:

  1. Com­bine the mech­an­ic­al inter­lock with an elec­tric­al inter­lock­ing device. You will lose some of the oth­er advant­ages to the sys­tem by doing this, but if increased dia­gnostics are needed, an elec­tric­al inter­lock can help meet that requirement.
  2. Com­bine the field inter­lock­ing device with either an elec­tric­al dis­con­nect­ing means or a flu­id­ic sys­tem sup­ply valve so that power to the area is cut off when the guard is opened. Addi­tion­al dia­gnostics can be added to these meas­ures as well, allow­ing a design­er to meet high dia­gnost­ic requirements.

Final Thoughts

Trapped key inter­lock­ing sys­tems have many advant­ages, par­tic­u­larly in chal­len­ging envir­on­ment­al con­di­tions, and where low-fre­quency of access increases the risk of undetec­ted faults res­ult­ing in the loss of the safety func­tion when the inter­lock fails. Trapped key sys­tems have many oth­er advant­ages and rel­at­ively few dis­ad­vant­ages, but are not used as fre­quently as elec­tric­al inter­lock­ing sys­tems because safety sys­tem design is often done by con­trols design­ers who are more likely to seek an elec­tric­al or electrical/software solu­tion before con­sid­er­ing “old-school” mech­an­ic­al solutions.

The next time you are design­ing an inter­lock­ing safety func­tion for a machine, con­sider using a trapped key system.


All defin­i­tions from [1] unless oth­er­wise noted.

inter­lock­ing device
mech­an­ic­al, elec­tric­al or oth­er type of device, the pur­pose of which is to pre­vent the oper­a­tion of haz­ard­ous machine func­tions under spe­cified con­di­tions (gen­er­ally as long as a guard is not closed)
Note 1 to entry: See Fig­ure 1 and Table 1.
[SOURCE: ISO 12100:2010, 3.28.1.]
inter­lock­ing guard
guard asso­ci­ated with an inter­lock­ing device so that, togeth­er with the con­trol sys­tem of the machine, the fol­low­ing func­tions are performed:
  • the haz­ard­ous machine func­tions “covered” by the guard can­not oper­ate until the guard is closed;
  • if the guard is opened while haz­ard­ous machine func­tions are oper­at­ing, a stop com­mand is given;
  • when the guard is closed, the haz­ard­ous machine func­tions “covered” by the guard can oper­ate (the clos­ure of the guard does not by itself start the haz­ard­ous machine functions)
    Note 1 to entry: An inter­lock­ing guard can contain/be equipped of one or more inter­lock­ing devices. These inter­lock­ing devices can also be of dif­fer­ent types.
[SOURCE: ISO 12100:2010, 3.27.4.]
guard lock­ing device
device inten­ded to lock a guard in the closed pos­i­tion and linked to the con­trol system
inter­lock­ing guard with guard locking
guard asso­ci­ated with an inter­lock­ing device and a guard lock­ing device so that, togeth­er with the con­trol sys­tem of the machine, the fol­low­ing func­tions are performed:
  • the haz­ard­ous machine func­tions “covered” by the guard can­not oper­ate until the guard is closed and locked;
  • the guard remains closed and locked until the risk due to the haz­ard­ous machine func­tions “covered” by the guard has dis­ap­peared, and
  • when the guard is closed and locked, the haz­ard­ous machine func­tions “covered” by the guard can oper­ate (the clos­ure and lock­ing of the guard do not by them­selves start the haz­ard­ous machine functions)

[SOURCE: ISO 12100:2010, 3.27.5.]

imple­ment such as a key or wrench designed to oper­ate a fastener
Note 1 to entry: An impro­vised imple­ment such as a coin or a nail file can­not be con­sidered as a tool.
[SOURCE: ISO 14120:2002, 3.9.]
power inter­lock­ing
  1. inter­lock­ing which dir­ectly inter­rupts the energy sup­ply to the machine actu­at­ors or dis­con­nects mov­ing parts from the machine actuators
    Note 1 to entry: Resump­tion of the energy sup­ply is only pos­sible with the guard in the closed and locked pos­i­tion. “Dir­ectly” means that, unlike con­trol inter­lock­ing, the con­trol sys­tem does not play any inter­me­di­ate role in the inter­lock­ing function.
    ISO 14119:2013
  2. inter­lock­ing which dir­ectly inter­rupts the energy sup­ply to the machine actu­at­ors or dis­con­nects mov­ing parts from the machine actuators
    [SOURCE: ISO 14119:2013, 3.31, mod­i­fied — The Note 1 to entry has been deleted.]
    ISO/TS 19837:2018(en), 3.15
trapped key inter­lock­ing system
sys­tem ful­filling safety function(s) or part of safety function(s) and com­pris­ing of at least two trapped key inter­lock­ing devices which work togeth­er through the trans­fer of a key
ISO/TS 19837:2018(en), 3.1
trapped key inter­lock­ing device
device, part of a trapped key inter­lock­ing sys­tem, which ful­fils a func­tion by trap­ping or releas­ing a key in a giv­en system
ISO/TS 19837:2018(en), 3.3
access lock
trapped key inter­lock­ing device used to lock mov­able guards
Note 1 to entry: Access locks can also be used for lock­ing in pos­i­tion of objects oth­er than guards, e.g. isol­at­ors, valves or barriers.
ISO/TS 19837:2018(en), 3.5
per­son­nel key
key which is released from a trapped key inter­lock­ing device (typ­ic­ally a access lock used in con­junc­tion with whole body access) and retained by a per­son to pre­vent a haz­ard­ous situ­ation, e.g. unex­pec­ted start-up.
ISO/TS 19837:2018(en), 3.13
con­trol interlocking
func­tion which allows access to haz­ard­ous machine func­tions if the energy sup­ply is inter­rup­ted using indir­ect means
Note 1 to entry: Examples of indir­ect means can include a com­bin­a­tion of relay mod­ules, stand­still mon­it­or­ing devices, PLCs or oth­er con­trol devices/systems.
ISO/TS 19837:2018(en), 3.14

Further Reading

Rock­well Auto­ma­tion: Pal­let­izer Func­tion­al Safety with relay and con­fig­ur­able relay solution.


[1]     Safety of machinery — Inter­lock­ing devices asso­ci­ated with guards — Prin­ciples for design and selec­tion. ISO 14119. 2013.

[2]     Safety of machinery— Trapped key inter­lock­ing devices— Prin­ciples for design and selec­tion. ISO/TS 19837. 2018.

[3]     “Trapped key inter­lock­ing”,, 2018. [Online]. Avail­able: [Accessed: 12- Jun- 2018].


My thanks to read­er Vinay­deep Alvarez for the ques­tions that led me to write this article.

6 thoughts on “Trapped Key Interlocking

  1. … to pur­sue on pre­vi­ous thoughts

    Again, most safety sensors/systems do detect the pas­sage of/transition of a human through some access way. They do not acu­ally detect the “pres­ence of a human” inside a dan­ger­ous area. And this is a con­cern for lar­ger dan­ger­ous areas where a work­er can phys­ic­ally stand there (robot­ic cells for instance, but many oth­er cases as well) while someone would reset the zone. The bur­den is put onto the work­er out­side the zone and reset­ting the zone to ensure the zone is safe from humans and safe for oper­a­tion. OSHA teams don’t like very much rely­ing on humans for that.

    Again, there are very few strategies that allows the actu­al detec­tion of a human bee­ing and pre­vent arm­ing the safety func­tions and auto­mat­ic oper­a­tion of an equip­ment. The laser scan­ners can be some­time used for that, but they are expens­ive and com­plex. You may need to com­bine them with door inter­locks if the dan­ger­ous zone con­fig­ur­a­tion changes a lot dur­ing the equip­ment move­ments and there are often a num­ber of corners where a human can hide.

    1. Philibert,

      Thanks for shar­ing your thoughts on this. With regard to the use of trapped-key sys­tems for LOTO, or as part of a LOTO pro­ced­ure, one key thing to remem­ber is that the devices used must be energy isol­at­ing devices in order to meet most LOTO legis­la­tion and stand­ards (ref. e.g., ANSI Z244.1, 29CFR1910.147, CSA Z460,O.Reg. 851, § 42, 75, 76, and Que­bec chapter S‑2.1, r. 13, §188, ISO 14118, etc.) So, in cases where the lock­ing sys­tem acts dir­ectly upon the dis­con­nect­ing means, as in the first example in the art­icle, then the trapped key sys­tem can be used for LOTO. If the sys­tem looks more like example 2 or 3, then it’s unlikely that the sys­tem can be used for LOTO since the con­trol switch is prob­ably not an energy isol­a­tion device like a dis­con­nect­ing means. It depends entirely on how the sys­tem is executed.

      With respect to pre­ven­tion of star­tup with a per­son trapped inside, the only real way to ensure that this can­’t hap­pen is the per­son­al key as you describe it. If the work­er is required to remove and carry the key with them into the machine, then there is no pos­sib­il­ity of the guards being closed and the machine being restar­ted with someone inside. The sys­tems of work must be designed to facil­it­ate this pro­ced­ure. This also elim­in­ates the need for emer­gency escape pro­vi­sions, how­ever, there may be con­di­tions that require these pro­vi­sions. The risk assess­ment should address this require­ment. Quot­ing from ISO/TS 19837:2018:

      6.10 Access control
      6.10.1 Escape release
      Use of a per­son­nel key nor­mally removes the need for an escape release. How­ever when an access lock
      has an escape release it shall com­ply with ISO 14119:2013, In par­tic­u­lar, the unlock­ing shall
      gen­er­ate a stop com­mand which is maintained.

      6.10.2 Emer­gency release
      When an access lock has an emer­gency release it shall com­ply with ISO 14119:2013, In particular,
      the unlock­ing shall gen­er­ate a stop com­mand which is maintained.

      6.10.3 Aux­il­i­ary release
      When an access lock has an aux­il­i­ary release it shall com­ply with ISO 14119:2013, In particular,
      the unlock­ing shall gen­er­ate a stop com­mand which is maintained.”

      You can see that there are require­ments in ISO 14119 that deal with the require­ments for emer­gency egress from a locked enclos­ure, but the first sen­tence in 6.10.1 is important.

      Reli­ance on people to do the right thing is part of safety. It is not pos­sible to engin­eer out every pos­sible scen­ario, nor should we be try­ing to do this. At some point, people, with the appro­pri­ate back­ground and train­ing, will have to do some work in con­junc­tion with our designs. We have to trust that they will fol­low instruc­tions, even though we know there is a pos­sib­il­ity that they may not.

  2. A con­cern that we often receive from indus­tri­al cus­tom­ers is: “What pre­vents someone to close and lock the access door behind the work­er and trap him inside the dan­ger­ous zone?” and the dis­cus­sion goes down­hill from there. This applies to all gate inter­locks sys­tems (elec­tric­al or not) where as the oper­a­tion people wants to avoid per­form­ing Lock-out Tag-out pro­cesses so that they can work faster and effi­ciently, while still remain­ing safe. And in the end, the only way to guar­an­tee this is some kind of LoTo oper­a­tion where the work­er has HIS key on himself.

    In your example, someone would be able to put a lock on the sup­ply dis­con­nect, thus pre­vent­ing the above issue or trap­ping someone inside. There­fore, the trapped key “in itself” does not replace a LoTo oper­a­tion, it only ensures that power is removed BEFORE provid­ing access but does not guar­an­tee that power will remain removed DURING the works. It serves more as a remind­er and a stop-point, which in itself is a good thing.

    One way to work around this is hav­ing anoth­er trapped key at the door, whereby using the key from the dis­con­nect on the door inter­lock would release a 2nd key at the door inter­lock, which the work­er would put in his pock­et. And the door wont lock and release the 1st key unless the 2nd key is back in. This actu­ally avoids the use of LoTo locks.

    It does not solve the case of mul­tiple work­ers in the zone, unless the door sys­tem releases mul­tiple keys and each work­er gets his key. It does not ensure either that the work­er will indeed pock­et the key at all… which is a con­cern of the Plant OSHA and man­age­ment teams. It does not solve the “escape release” situ­ation from the dan­ger­ous zone either, unless you have a spe­cial lock which does always per­mit oper­a­tion from the inside to mat­ter what key is present and requires the pres­ence of a key to “reset” the inside handle to locked position.

    We see this “trapped by” someone else as a grow­ing con­cern amongst our cus­tom­ers as well as the “depend only on your­self for your own safety” philo­sophy. Some­how, the mar­ket­place does not have a lot of eco­nom­ic­al options for hand­ling these con­cerns. Nor does the Machine Safety stand­ards do cov­er this case of bee­ing trapped. I would really appre­ci­ate your thoughts on some­thing like this.

  3. I think there may be a typo regard­ing ref­er­ences to an ISO stand­ard. You men­tion ISO 14118, how­ever, I think you meant ISO 14119.

    1. Nath­an – good catch, and thank you! 🙂 The title was cor­rect but I slipped the last digit by one. In any case, the ISO/TS men­tioned is of more use as it addresses the spe­cif­ic require­ments related to design­ing these systems.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.