As machinery becomes larger and more automated, safe access for cleaning, inspection, maintenance and fault clearance becomes increasingly important. The challenge is greatest where operators can enter a guarded area completely, including robotic cells, packaging lines, conveyors, mixers and automated production systems.
Opening an interlocked guard may stop a machine, but stopping is not always the same as making the area safe. Hazardous movement can continue because of run-down time, gravity, stored pressure, heat or connected equipment. Someone outside the area could also restart the machine without realising a colleague remains inside.
A trapped-key system addresses these risks by creating a defined physical sequence between isolation, access and restart prevention.
How the system works
In a typical arrangement, a key is held in a machine-control or isolation unit while the equipment operates. To gain access, the operator stops the machine and moves the isolator to its safe position. Only then is the key released.
The key is transferred to the guard lock and turned to release the door. While the guard is open, it remains trapped in the access lock and cannot be returned to the isolator.
Where access to multiple doors is required at the same time, the released isolation key is inserted into a key exchange unit. This traps the isolation key and releases multiple access keys, with each key used to unlock a separate guard door. The isolation key cannot be removed from the exchange unit until every access key has been returned, confirming that all doors have been closed and secured.
The machine cannot be restored until all access keys have been returned, the isolation key is released and the sequence is reversed.
Protecting people inside a hazardous area
Where a person can enter a safeguarded space completely, door interlocking alone may be insufficient. The entrance could be closed by someone else and the system reset while the person remains inside.
A personnel-key arrangement provides additional protection. Before entering, each person removes an individual key from a key-exchange unit and keeps it with them. Removing any personnel key prevents the primary access or isolation key from being released.
The machinery cannot be returned to service until everyone has left and returned their key. Each person therefore retains a physical means of preventing restart.
Example shown below: M-HT-T-L-12-LT
Start with the risk assessment
A trapped-key system should not be selected simply because a machine has a guard door. The design must begin with a risk assessment covering hazards remaining after a normal stop, run-down time, stored energy, access points, personnel numbers, hidden areas, connected machinery, isolation requirements and emergency escape.
The sequence must address every relevant hazard. Disconnecting electrical power may not be enough if a raised component can fall or a pressurised system can still move. Stored energy may need to be released, restrained or separately isolated before the access key becomes available.
A key design decision is whether access requires a safety-related stop or complete energy isolation. For short interventions, a safety-control function may stop hazardous movement while leaving power available elsewhere. For cleaning, maintenance, blockage removal or direct contact with hazardous parts, physical isolation and dissipation of stored energy may be necessary.
A stop button or control-circuit switch should not automatically be treated as an isolating device. The trapped-key arrangement must support the protective measure identified by the risk assessment.
Managing run-down time
Some hazards do not stop immediately when power is removed. Mixers, centrifuges, fans and cutting equipment may continue moving for a significant period.
The access key should not be released merely because a stop signal has been generated. Standstill monitoring, a time-delay device or another verified method may be needed to confirm the hazard has reached a safe state.
Any delay should reflect actual stopping behaviour and allow for changes caused by wear, loading or component failure.
Designing against misuse
Safeguarding should reflect how the machine is actually used. Repeated bypassing may indicate that the access process is awkward or poorly matched to the task.
An effective installation should use uniquely coded keys, prevent key removal in unsafe conditions and protect locks from contamination, damage and misalignment.
Spare and replacement keys require strict control. An uncontrolled duplicate can undermine the entire sequence. Replacements should only be issued after the original key has been accounted for.
Multiple doors and linked equipment
Large systems may have several access points, multiple isolators or independently operating sections. Key-exchange units can create a controlled sequence in which isolation keys must be inserted before access or personnel keys are released.
Linked equipment must also be considered. Isolating one machine may not remove hazards from an upstream conveyor, downstream process, robot, automated vehicle or shared energy source.
Escape, reset and validation
Personnel must not become trapped inside the guarded area.
Closing the guard and returning the keys should not automatically restart hazardous movement. A deliberate reset should normally be required from a position where the operator can confirm the area is clear. Where visibility is limited, additional reset points, presence detection or a pre-start warning may be needed.
The complete system must then be commissioned and validated. Testing should confirm that keys are released only in the intended sequence, access is prevented until hazards are safe, personnel keys prevent restart, every access point is included and reset does not cause unexpected movement.
A trapped-key system is not simply a collection of locks. It is an engineered safety function linking isolation, access and restart prevention in a sequence people can understand. Supported by suitable risk assessment, correct energy control, key management, escape provisions, validation and training, it can provide safe personnel access without relying solely on procedures or compromising productivity.
