Trapped Key Interlocking

This is a trapped key interlock on the door of an electrical switchgear cabinet. To open the door the key must be inserted and turned to withdraw a bolt that holds the door closed. With the bolt withdrawn, the key is held in the lock. The upstream switching device is held open by another interlock using the same key; since the key can only be in one of the two locks, it prevents accidentally closing the upstream switch while the cabinet is open for maintenance. The interlock is attached to the door with one-way screws to discourage casual removal of the lock, which would defeat the system.
This entry is part 3 of 7 in the series Guards and Guard­ing

Many machine design­ers think of inter­locks as exclu­sive­ly elec­tri­cal devices; a switch is attached to a mov­able mechan­i­cal guard, and the switch is con­nect­ed to the con­trol sys­tem. Trapped Key Inter­lock­ing is a way to inter­lock guards that is equal­ly effec­tive, and often more appro­pri­ate in dif­fi­cult envi­ron­men­tal con­di­tions.

I’ve pro­vid­ed some use­ful def­i­n­i­tions and links to addi­tion­al read­ing at the end of the arti­cle.

Trapped Key inter­lock­ing uses mechan­i­cal inter­lock­ing devices to ensure that guards remain closed unless the machin­ery is stopped.

Mechanical interlocks are robust, capable of withstanding dirty, dusty, and wet conditions.

Anoth­er sig­nif­i­cant ben­e­fit of trapped key inter­lock­ing is the abil­i­ty of the inter­lock­ing devices to with­stand infre­quent use. Elec­tri­cal inter­lock­ing devices can fail from lack of use, and these fail­ures might not be detect­ed by the auto­mat­ic diag­nos­tics pro­vid­ed by the safe­ty relay, con­troller or safe­ty PLC. ISO 14119 [1, 8.2] dis­cuss­es the need to phys­i­cal­ly test the oper­a­tion of rarely used inter­locks to ensure that the diag­nos­tics can check the func­tion of the inter­lock­ing device.

What is “Trapped Key Interlocking”?

Trapped Key Inter­lock­ing, also called key trans­fer inter­lock­ing, is a sys­tem of mechan­i­cal locks installed on gates, valves, etc. The sys­tem relies on the trans­fer of keys from a con­trol device to a lock that con­trols access into the dan­ger zone of the machine. The dia­gram below, [1, Fig. B.3], shows the sim­plest form, where a lock­ing device is used to pre­vent the ener­giza­tion of a machine by lock­ing the sup­ply dis­con­nect­ing device.

The simplest form of a trapped key interlock [1, Fig. B.3]
The sim­plest form of a trapped key inter­lock [1, Fig. B.3]

Guards can also be inter­locked in this way, [1, Fig. B.5]. In this case, the lock­ing device is used to shut off pow­er to the haz­ardous motions, and the key is removed from the con­trol device. The key is required to open the machine guard, where the key remains trapped until the guard is closed and locked. The key can then be returned to the con­trol device, and pow­er restored to the machine to allow it to run.

Two line diagrams showing a simple trapped key interlock with one guard in the energized, access denied and de-energized, access permitted conditions.
Sim­ple trapped-key inter­lock with one guard [1, Fig. B.5]

The essential feature of the system is that the removable key is trapped either in the guard lock or in the switch lock.

The essen­tial fea­ture of the sys­tem is that the remov­able key is trapped either in the guard lock or in the switch lock. The lock on the guard is arranged so that the key can be released only when the guard has been closed and locked. This allows trans­fer of the key from the guard to the switch lock. Clos­ing the switch traps the key so that it can­not be removed while the switch is in the ON posi­tion (see [1, Fig. B.3] and [1, Fig. B.5]).

The oper­at­ing prin­ci­ple is:

  1. Turn the con­trol key from the run posi­tion to the stop posi­tion and remove it from the con­trol device lock.
  2. Take the con­trol key to the guard. Unlock the local guard lock­ing device. As long as the guard is unlocked the key is trapped in the lock. With­out that key the machine can’t run, so the machine is safe.
  3. Com­plete the work, close and lock the local guard.
  4. Return the key to the con­trol device on the con­trol pan­el.
  5. Switch­ing the con­trol device to “RUN” will per­mit the machine to run again when start­ed with a sep­a­rate start con­trol.

Complex Access Control

The approach described pre­vi­ous­ly works well for sim­ple, sin­gle-point inter­lock­ing, but there are many more com­plex sit­u­a­tions where mechan­i­cal inter­locks could be used. An addi­tion­al com­po­nent, called a “key trans­fer block,” is used to pro­vide an inter­me­di­ate loca­tion. Defined sequences of oper­a­tions, time delays, and mul­ti­ple access points can be con­trolled using this approach. 

Block with multiple key locking cylinders used to permit controlled sequencing of access.
Trapped Key trans­fer block [3]
In a com­plex inter­lock­ing sys­tem, the con­trol key is trans­ferred from the con­trol switch lock (2 in [1, Fig. B.6] below) to an inter­me­di­ate key-trans­fer block (3 in [1, Fig. B.6] below). Turn­ing the con­trol key in this block releas­es one or more keys that then can be used to release access keys in a sec­ondary trans­fer block (4 in [1, Fig. B.6] below). Indi­vid­ual guards can then be unlocked and safe access per­mit­ted.

Diagram showing trapped key interlocking with a key transfer block used to provide access to multiple access points.
Com­plex inter­lock­ing using trapped keys. [1, Fig. B.6]
This same approach can be used at the guards, where anoth­er key can be released when the guard is unlocked. This key can then be tak­en inside the safe­guard­ed space and used, for exam­ple, to release a robot teach pen­dant, or to enable robot teach­ing at reduced, “safe” speed.

Advantages and disadvantages

Advan­tagesDis­ad­van­tages
Sim­ple to useCom­plex to ini­tial­ly design
RobustNo fail­ure diag­nos­tics in the field
No field wiringCost of com­po­nents
No pro­gram­ming
Imper­vi­ous to weath­er
Excel­lent in dusty con­di­tions
Suit­able for low fre­quen­cy-of-access appli­ca­tions
Rel­a­tive­ly easy to expand
Suit­able for large sys­tems
Can be designed to meet lock­out require­ments
No field wiring cost
Advan­tages and dis­ad­van­tages of trapped key inter­lock­ing sys­tems.

Diagnostics

Since the field inter­locks don’t have any elec­tri­cal sens­ing in most sys­tems, it is pos­si­ble to have one of the field inter­lock­ing devices fail and have the fail­ure go unno­ticed or ignored. This can be mit­i­gat­ed in at least two ways:

  1. Com­bine the field mechan­i­cal inter­lock with an elec­tri­cal inter­lock­ing device. You will lose many of the oth­er advan­tages to the sys­tem by doing this, but if increased diag­nos­tics are need­ed, this can meet that require­ment.
  2. Com­bine the field inter­lock­ing device with either an elec­tri­cal dis­con­nect­ing means or a flu­idic sys­tem sup­ply valve so that pow­er to the area is cut off when the guard is opened. Addi­tion­al diag­nos­tics can be added to these mea­sures as well, allow­ing a design­er to meet high diag­nos­tic require­ments.

Final Thoughts

Trapped key inter­lock­ing sys­tems have many advan­tages, par­tic­u­lar­ly in chal­leng­ing envi­ron­men­tal con­di­tions, and where low-fre­quen­cy of access increas­es the risk of unde­tect­ed faults result­ing in the loss of the safe­ty func­tion when the inter­lock fails. Trapped key sys­tems have many oth­er advan­tages and rel­a­tive­ly few dis­ad­van­tages, but are not used as fre­quent­ly as elec­tri­cal inter­lock­ing sys­tems because safe­ty sys­tem design is often done by con­trols design­ers who are more like­ly to seek an elec­tri­cal or electrical/software solu­tion before con­sid­er­ing “old-school” mechan­i­cal solu­tions.

The next time you are design­ing an inter­lock­ing safe­ty func­tion for a machine, con­sid­er using a trapped key sys­tem.

Definitions

All def­i­n­i­tions from [1] unless oth­er­wise not­ed.

inter­lock­ing device
inter­lock
mechan­i­cal, elec­tri­cal or oth­er type of device, the pur­pose of which is to pre­vent the oper­a­tion of haz­ardous machine func­tions under spec­i­fied con­di­tions (gen­er­al­ly as long as a guard is not closed)
Note 1 to entry: See Fig­ure 1 and Table 1.
[SOURCE: ISO 12100:2010, 3.28.1.]
inter­lock­ing guard
guard asso­ci­at­ed with an inter­lock­ing device so that, togeth­er with the con­trol sys­tem of the machine, the fol­low­ing func­tions are per­formed:
  • the haz­ardous machine func­tions “cov­ered” by the guard can­not oper­ate until the guard is closed;
  • if the guard is opened while haz­ardous machine func­tions are oper­at­ing, a stop com­mand is giv­en;
  • when the guard is closed, the haz­ardous machine func­tions “cov­ered” by the guard can oper­ate (the clo­sure of the guard does not by itself start the haz­ardous machine func­tions)
    Note 1 to entry: An inter­lock­ing guard can contain/be equipped of one or more inter­lock­ing devices. These inter­lock­ing devices can also be of dif­fer­ent types.
[SOURCE: ISO 12100:2010, 3.27.4.]
guard lock­ing device
device intend­ed to lock a guard in the closed posi­tion and linked to the con­trol sys­tem
inter­lock­ing guard with guard lock­ing
guard asso­ci­at­ed with an inter­lock­ing device and a guard lock­ing device so that, togeth­er with the con­trol sys­tem of the machine, the fol­low­ing func­tions are per­formed:
  • the haz­ardous machine func­tions “cov­ered” by the guard can­not oper­ate until the guard is closed and locked;
  • the guard remains closed and locked until the risk due to the haz­ardous machine func­tions “cov­ered” by the guard has dis­ap­peared, and
  • when the guard is closed and locked, the haz­ardous machine func­tions “cov­ered” by the guard can oper­ate (the clo­sure and lock­ing of the guard do not by them­selves start the haz­ardous machine func­tions)

[SOURCE: ISO 12100:2010, 3.27.5.]

tool
imple­ment such as a key or wrench designed to oper­ate a fas­ten­er
Note 1 to entry: An impro­vised imple­ment such as a coin or a nail file can­not be con­sid­ered as a tool.
[SOURCE: ISO 14120:2002, 3.9.]
pow­er inter­lock­ing
  1. inter­lock­ing which direct­ly inter­rupts the ener­gy sup­ply to the machine actu­a­tors or dis­con­nects mov­ing parts from the machine actu­a­tors
    Note 1 to entry: Resump­tion of the ener­gy sup­ply is only pos­si­ble with the guard in the closed and locked posi­tion. “Direct­ly” means that, unlike con­trol inter­lock­ing, the con­trol sys­tem does not play any inter­me­di­ate role in the inter­lock­ing func­tion.
    ISO 14119:2013
  2. inter­lock­ing which direct­ly inter­rupts the ener­gy sup­ply to the machine actu­a­tors or dis­con­nects mov­ing parts from the machine actu­a­tors
    [SOURCE: ISO 14119:2013, 3.31, mod­i­fied — The Note 1 to entry has been delet­ed.]
    ISO/TS 19837:2018(en), 3.15
trapped key inter­lock­ing sys­tem
sys­tem ful­fill­ing safe­ty function(s) or part of safe­ty function(s) and com­pris­ing of at least two trapped key inter­lock­ing devices which work togeth­er through the trans­fer of a key
ISO/TS 19837:2018(en), 3.1
trapped key inter­lock­ing device
device, part of a trapped key inter­lock­ing sys­tem, which ful­fils a func­tion by trap­ping or releas­ing a key in a giv­en sys­tem
ISO/TS 19837:2018(en), 3.3
access lock
trapped key inter­lock­ing device used to lock mov­able guards
Note 1 to entry: Access locks can also be used for lock­ing in posi­tion of objects oth­er than guards, e.g. iso­la­tors, valves or bar­ri­ers.
ISO/TS 19837:2018(en), 3.5
per­son­nel key
key which is released from a trapped key inter­lock­ing device (typ­i­cal­ly a access lock used in con­junc­tion with whole body access) and retained by a per­son to pre­vent a haz­ardous sit­u­a­tion, e.g. unex­pect­ed start-up.
ISO/TS 19837:2018(en), 3.13
con­trol inter­lock­ing
func­tion which allows access to haz­ardous machine func­tions if the ener­gy sup­ply is inter­rupt­ed using indi­rect means
Note 1 to entry: Exam­ples of indi­rect means can include a com­bi­na­tion of relay mod­ules, stand­still mon­i­tor­ing devices, PLCs or oth­er con­trol devices/systems.
ISO/TS 19837:2018(en), 3.14

Further Reading

References

[1]     Safe­ty of machin­ery — Inter­lock­ing devices asso­ci­at­ed with guards — Prin­ci­ples for design and selec­tion. ISO 14119. 2013.

[2]     Safe­ty of machin­ery— Trapped key inter­lock­ing devices— Prin­ci­ples for design and selec­tion. ISO/TS 19837. 2018.

[3]     “Trapped key inter­lock­ing”, En.wikipedia.org, 2018. [Online]. Avail­able: https://en.wikipedia.org/wiki/Trapped_key_interlocking. [Accessed: 12- Jun- 2018].

Acknowledgements

My thanks to read­er Vinay­deep Alvarez for the ques­tions that led me to write this arti­cle.

Series Nav­i­ga­tionPres­ence Sens­ing Devices — Reach­ing over sens­ing fieldsISO 13857 — Safe­ty Distances”>Canada Adopts ISO 13857 — Safe­ty Dis­tances

Author: Doug Nix

Doug Nix is Managing Director and Principal Consultant at Compliance InSight Consulting, Inc. (http://www.complianceinsight.ca) in Kitchener, Ontario, and is Lead Author and Senior Editor of the Machinery Safety 101 blog. Doug's work includes teaching machinery risk assessment techniques privately and through Conestoga College Institute of Technology and Advanced Learning in Kitchener, Ontario, as well as providing technical services and training programs to clients related to risk assessment, industrial machinery safety, safety-related control system integration and reliability, laser safety and regulatory conformity. For more see Doug's LinkedIn profile.