Many machine designers think interlocks are exclusively electrical devices; a movable mechanical guard is fitted with an electrical interlocking device, and the interlocking device is connected to the control system. Trapped Key Interlocking is an equally effective way to interlock guards that is often more appropriate in severe environmental conditions or where the guard is infrequently opened.
I’ve provided some helpful definitions and links to additional reading at the end of the article.
Trapped Key interlocking uses mechanical interlocking devices to ensure that guards remain closed unless the machinery is stopped. Mechanical interlocking devices are robust and capable of withstanding dirty, dusty, and wet conditions.
Mechanical interlocking devices are robust and capable of withstanding dirty, dusty, and wet conditions.
Another significant benefit of trapped key interlocking is the ability of the interlocking devices to withstand infrequent use. Electrical interlocking devices can fail from lack of use, and these failures might not be detected by the automatic diagnostics provided by the safety relay, controller or safety PLC. ISO 14119 [1, 8.2] discusses the need to physically test the operation of rarely used interlocks to ensure that the diagnostics can check the function of the interlocking device.
What is “Trapped Key Interlocking”?
Trapped Key Interlocking, also called key-transfer interlocking, is a system of mechanical locks installed on gates, valves, etc. The system relies on the transfer of keys from a control device to a lock that controls access into the machine’s danger zone. The diagram below [1, Fig. B.3] shows the simplest form, where a locking device is used to prevent the energization of a machine by locking the supply disconnecting device.
![The simplest form of a trapped key interlock [1, Fig. B.3]](https://machinerysafety101.com/wp-content/uploads/2017/09/ISO-14119-Fig-B3.png)
Guards can also be interlocked using a similar approach as shown in [1, Fig. B.5]. In this case, the locking device shuts off power to the hazardous motions, and the key is removed from the control device. The key is required to open the machine guard, where the key remains trapped until the guard is closed and locked. When the need for access to the machine’s danger zone ends, the worker can return the key to the control device and power restored to the machine to allow it to run.
The essential feature of the system is that the removable key is trapped either in the guard lock or in the switch lock.
The essential feature of the system is that the removable key is trapped either in the guard lock or the switch lock. The guard is designed so that the key on the mechanical interlocking device can only be removed when the guard is closed and locked. When the need to have the guard open passes, the worker can transfer the key from the guard to the switch lock. Turning the key to the “ON” or “RUN” positions traps the key so that it cannot be removed (see [1, Fig. B.3] and [1, Fig. B.5]).
The operating principle is:
- Turn the control key from the run to the stop position and remove it from the control device lock.
- Take the control key to the guard. Unlock the local guard locking device. The key is trapped in the lock as long as the guard is unlocked. The machine can’t run without that key, so the machine is kept in a safe state.
- Complete the work, close and lock the local guard.
- Return the key to the control device on the control panel.
- Switching the control device to “RUN” will permit the machine to run again when started with a separate start control.
Complex Access Control
The approach described previously works well for simple, single-point interlocking, but there are many more complex situations where mechanical interlocks could be used. An additional component, called a “key transfer block,” is used to provide an intermediate location. Defined sequences of operations, time delays, and multiple access points can be controlled using this approach.
In a complex interlocking system, the control key is transferred from the control switch lock (2 in [1, Fig. B.6] below) to an intermediate key-transfer block (3 in [1, Fig. B.6] below). Turning the control key in this block releases one or more keys that then can be used to release access keys in a secondary transfer block (4 in [1, Fig. B.6] below). Individual guards can then be unlocked (5 and 6 in [1, Fig. B.6] below), and safe access permitted.
This same approach can be used at the guards, where another key can be released when the guard is unlocked. This key can then be taken inside the safeguarded space and used, for example, to release a robot teach pendant or to enable robot teaching at a reduced, “safe” speed.
Advantages and disadvantages
| Advantages | Disadvantages |
|---|---|
| Simple to use | Complex to initially design |
| Robust | No failure diagnostics in the field |
| No field wiring | Cost of components |
| No programming | |
| Impervious to weather | |
| Excellent in dusty conditions | |
| Suitable for low frequency-of-access applications | |
| Relatively easy to expand | |
| Suitable for large systems | |
| Can be designed to meet lockout requirements | |
| No field wiring cost |
Diagnostics
Since the field interlocks don’t have any electrical sensing in most systems, it is possible to have one of the field interlocking devices fail and have the failure go unnoticed or ignored. The reliability of a trapped-key system can be Increased in at least two ways:
- Combine the mechanical interlock with an electrical interlocking device. The electrical interlocking device will give you increased diagnostic coverage. You will lose some of the other advantages of the system, like the field wiring cost reduction and the robustness in harsh conditions.
- Combine the mechanical field interlocking device with either an electrical disconnecting means or a fluidic system supply valve so that power to the area is cut off when the guard is opened. Adding an electrical interlocking device will give you better diagnostic coverage, allowing the system to meet high diagnostic requirements.
Final Thoughts
Trapped-key interlocking systems have many advantages, particularly in challenging environmental conditions, and where low-frequency of access increases the risk of undetected faults resulting in the loss of the safety function when the interlock fails. Trapped-key systems have many other advantages and relatively few disadvantages. Still, electrical interlocking systems are much more common because safety system design is usually the responsibility of control designers, who are more likely to seek an electrical or electrical/software solution before considering “old-school” mechanical solutions.
The next time you are designing an interlocking safety function for a machine, consider using a trapped key system.
Definitions
All definitions from [1] unless otherwise noted.
- interlocking device
- interlock
- mechanical, electrical or other type of device, the purpose of which is to prevent the operation of hazardous machine functions under specified conditions (generally as long as a guard is not closed)
- Note 1 to entry: See Figure 1 and Table 1.
- [SOURCE: ISO 12100:2010, 3.28.1.]
- interlocking guard
- guard associated with an interlocking device so that, together with the control system of the machine, the following functions are performed:
- the hazardous machine functions ?covered? by the guard cannot operate until the guard is closed;
- if the guard is opened while hazardous machine functions are operating, a stop command is given;
- when the guard is closed, the hazardous machine functions ?covered? by the guard can operate (the closure of the guard does not by itself start the hazardous machine functions)
Note 1 to entry: An interlocking guard can contain/be equipped of one or more interlocking devices. These interlocking devices can also be of different types.
- [SOURCE: ISO 12100:2010, 3.27.4.]
- guard locking device
- device intended to lock a guard in the closed position and linked to the control system
- interlocking guard with guard locking
- guard associated with an interlocking device and a guard locking device so that, together with the control system of the machine, the following functions are performed:
- the hazardous machine functions ?covered? by the guard cannot operate until the guard is closed and locked;
- the guard remains closed and locked until the risk due to the hazardous machine functions ?covered? by the guard has disappeared, and
- when the guard is closed and locked, the hazardous machine functions ?covered? by the guard can operate (the closure and locking of the guard do not by themselves start the hazardous machine functions)
[SOURCE: ISO 12100:2010, 3.27.5.]
- tool
- implement such as a key or wrench designed to operate a fastener
Note 1 to entry: An improvised implement such as a coin or a nail file cannot be considered as a tool. - [SOURCE: ISO 14120:2002, 3.9.]
- power interlocking
- interlocking which directly interrupts the energy supply to the machine actuators or disconnects moving parts from the machine actuators
Note 1 to entry: Resumption of the energy supply is only possible with the guard in the closed and locked position. ?Directly? means that, unlike control interlocking, the control system does not play any intermediate role in the interlocking function.
ISO 14119:2013 - interlocking which directly interrupts the energy supply to the machine actuators or disconnects moving parts from the machine actuators
[SOURCE: ISO 14119:2013, 3.31, modified ? The Note 1 to entry has been deleted.]
ISO/TS 19837:2018(en), 3.15
- trapped key interlocking system
- system fulfilling safety function(s) or part of safety function(s) and comprising of at least two trapped key interlocking devices which work together through the transfer of a key
- ISO/TS 19837:2018(en), 3.1
- trapped key interlocking device
- device, part of a trapped key interlocking system, which fulfils a function by trapping or releasing a key in a given system
- ISO/TS 19837:2018(en), 3.3
- access lock
- trapped key interlocking device used to lock movable guards
Note 1 to entry: Access locks can also be used for locking in position of objects other than guards, e.g. isolators, valves or barriers. - ISO/TS 19837:2018(en), 3.5
- personnel key
- key which is released from a trapped key interlocking device (typically a access lock used in conjunction with whole body access) and retained by a person to prevent a hazardous situation, e.g. unexpected start-up.
- ISO/TS 19837:2018(en), 3.13
- control interlocking
- function which allows access to hazardous machine functions if the energy supply is interrupted using indirect means
Note 1 to entry: Examples of indirect means can include a combination of relay modules, standstill monitoring devices, PLCs or other control devices/systems. - ISO/TS 19837:2018(en), 3.14
Further Reading
References
[1] Safety of machinery — Interlocking devices associated with guards — Principles for design and selection, ISO 14119. 2013.
[2] Safety of machinery — Trapped key interlocking devices — Principles for design and selection, ISO/TS 19837. 2018.
[3] “Trapped key interlocking”, en.wikipedia.org, 2018. [Online]. Available: https://en.wikipedia.org/wiki/Trapped_key_interlocking. [Accessed: 12- Jun- 2018].
Acknowledgements
My thanks to reader Vinaydeep Alvarez for the questions that led me to write this article.
© 2018 – 2022, Compliance inSight Consulting Inc. 
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
… to pursue on previous thoughts
Again, most safety sensors/systems do detect the passage of/transition of a human through some access way. They do not acually detect the “presence of a human” inside a dangerous area. And this is a concern for larger dangerous areas where a worker can physically stand there (robotic cells for instance, but many other cases as well) while someone would reset the zone. The burden is put onto the worker outside the zone and resetting the zone to ensure the zone is safe from humans and safe for operation. OSHA teams don’t like very much relying on humans for that.
Again, there are very few strategies that allows the actual detection of a human beeing and prevent arming the safety functions and automatic operation of an equipment. The laser scanners can be sometime used for that, but they are expensive and complex. You may need to combine them with door interlocks if the dangerous zone configuration changes a lot during the equipment movements and there are often a number of corners where a human can hide.
Philibert,
Thanks for sharing your thoughts on this. With regard to the use of trapped-key systems for LOTO, or as part of a LOTO procedure, one key thing to remember is that the devices used must be energy isolating devices in order to meet most LOTO legislation and standards (ref. e.g., ANSI Z244.1, 29CFR1910.147, CSA Z460,O.Reg. 851, ? 42, 75, 76, and Quebec chapter S-2.1, r. 13, ?188, ISO 14118, etc.) So, in cases where the locking system acts directly upon the disconnecting means, as in the first example in the article, then the trapped key system can be used for LOTO. If the system looks more like example 2 or 3, then it’s unlikely that the system can be used for LOTO since the control switch is probably not an energy isolation device like a disconnecting means. It depends entirely on how the system is executed.
With respect to prevention of startup with a person trapped inside, the only real way to ensure that this can’t happen is the personal key as you describe it. If the worker is required to remove and carry the key with them into the machine, then there is no possibility of the guards being closed and the machine being restarted with someone inside. The systems of work must be designed to facilitate this procedure. This also eliminates the need for emergency escape provisions, however, there may be conditions that require these provisions. The risk assessment should address this requirement. Quoting from ISO/TS 19837:2018:
“6.10 Access control
6.10.1 Escape release
Use of a personnel key normally removes the need for an escape release. However when an access lock
has an escape release it shall comply with ISO 14119:2013, 5.7.5.2. In particular, the unlocking shall
generate a stop command which is maintained.
6.10.2 Emergency release
When an access lock has an emergency release it shall comply with ISO 14119:2013, 5.7.5.3. In particular,
the unlocking shall generate a stop command which is maintained.
6.10.3 Auxiliary release
When an access lock has an auxiliary release it shall comply with ISO 14119:2013, 5.7.5.4. In particular,
the unlocking shall generate a stop command which is maintained.”
You can see that there are requirements in ISO 14119 that deal with the requirements for emergency egress from a locked enclosure, but the first sentence in 6.10.1 is important.
Reliance on people to do the right thing is part of safety. It is not possible to engineer out every possible scenario, nor should we be trying to do this. At some point, people, with the appropriate background and training, will have to do some work in conjunction with our designs. We have to trust that they will follow instructions, even though we know there is a possibility that they may not.
A concern that we often receive from industrial customers is: “What prevents someone to close and lock the access door behind the worker and trap him inside the dangerous zone?” and the discussion goes downhill from there. This applies to all gate interlocks systems (electrical or not) where as the operation people wants to avoid performing Lock-out Tag-out processes so that they can work faster and efficiently, while still remaining safe. And in the end, the only way to guarantee this is some kind of LoTo operation where the worker has HIS key on himself.
In your example, someone would be able to put a lock on the supply disconnect, thus preventing the above issue or trapping someone inside. Therefore, the trapped key “in itself” does not replace a LoTo operation, it only ensures that power is removed BEFORE providing access but does not guarantee that power will remain removed DURING the works. It serves more as a reminder and a stop-point, which in itself is a good thing.
One way to work around this is having another trapped key at the door, whereby using the key from the disconnect on the door interlock would release a 2nd key at the door interlock, which the worker would put in his pocket. And the door wont lock and release the 1st key unless the 2nd key is back in. This actually avoids the use of LoTo locks.
It does not solve the case of multiple workers in the zone, unless the door system releases multiple keys and each worker gets his key. It does not ensure either that the worker will indeed pocket the key at all… which is a concern of the Plant OSHA and management teams. It does not solve the “escape release” situation from the dangerous zone either, unless you have a special lock which does always permit operation from the inside to matter what key is present and requires the presence of a key to “reset” the inside handle to locked position.
We see this “trapped by” someone else as a growing concern amongst our customers as well as the “depend only on yourself for your own safety” philosophy. Somehow, the marketplace does not have a lot of economical options for handling these concerns. Nor does the Machine Safety standards do cover this case of beeing trapped. I would really appreciate your thoughts on something like this.
I think there may be a typo regarding references to an ISO standard. You mention ISO 14118, however, I think you meant ISO 14119.
Nathan – good catch, and thank you! 🙂 The title was correct but I slipped the last digit by one. In any case, the ISO/TS mentioned is of more use as it addresses the specific requirements related to designing these systems.