Trapped-key interlocks and electrical guard locking devices are two different engineering answers to the same functional safety question: how do you make sure a guard cannot be opened while a machine still has hazardous energy, and how do you make sure the machine cannot restart until the guard is closed again? The answer is rarely ideological; it is arithmetic, based on access frequency, environment, distance from the control panel, and the Performance Level or SIL the safety instrumented function has to meet [S3][S5].
ISO 14119, the normative reference for both technologies, was republished on 2024-09-09 and explicitly rolls in the trapped-key guidance formerly held in ISO/TR 24119:2015, which makes the two approaches directly comparable inside a single document [S3]. EN/ISO 13849-1 governs the safety integrity rating of either implementation, and a rotary or push-pull trapped-key system from a major catalogue is rated up to PLe / Category 3 [S5].
How a Trapped-Key System Actually Works
A trapped-key system enforces isolation through coded mechanical key transfer rather than electrical signals, with three defined actions: isolate hazardous energy, transfer or exchange sequenced keys, then access the hazard zone [S6]. The key is literally trapped either in the guard lock or in the control switch, and a release only happens when the previous condition has been met: the isolator is operated, the guard is closed, or a preceding station in the sequence is satisfied [S5].
For multi-guard machinery, an exchange box accommodates the equivalent number of access keys, and operators must follow a predetermined sequence to walk the current key to the next station; ordering a gate set larger than the actual number of gates is treated as a design error that compromises safety integrity, and spare keys are not available, so the sequence is enforced by the hardware itself [S5]. Mechanical interlocks of this style tolerate dirty, dusty, and wet conditions, and survive infrequent operation that would otherwise let electrical contacts seize or fail silently between proof tests [S3].
How Electrical Guard Locking Differs in Practice
Electrical guard locking, typically a solenoid-locking safety switch, holds the guard closed under spring force and releases it only when a safe-stop is confirmed, then monitors a safety-rated contact set wired to a safety relay, controller, or safety PLC. Its strength is continuous diagnostic coverage: the controller sees the contact state on every cycle and can flag a discrepancy, which is why ISO 14119 §8.2 requires physical proof testing of rarely used interlocks to defeat silent failures [S3].
That diagnostic surface is exactly what trapped-key cannot offer as natively, and what the recent revision of ISO 14119 addresses through explicit test procedures in Annex I and fault-exclusion rules for Type 5 trapped-key interlocks [S3]. In return, the electrical path requires rated cable runs, EMC-compatible routing, and a documented category architecture under EN/ISO 13849-1, which becomes painful when the guards are physically scattered across a large plant. Trapped-key eliminates the cost of running electrical wiring over long distances and is therefore cost-effective for multiple locks spread over a large area [S5].
Decision Criteria: Frequency, Environment, Distance, Diagnostics
Access frequency is the first cut: if a guard is opened dozens of times per shift, electrical guard locking pays for itself because the diagnostic channel is exercised continuously; if a guard is opened weekly or monthly, mechanical trapped-key interlocks remain reliable without a periodic proof test, and that gap between manual tests is the weak point ISO 14119 is trying to close [S3]. Environmental severity is the second cut: washdown, dust, paint spray, or explosive atmosphere all favour mechanical coded keys, while a clean, temperature-controlled panel build favours electrical locking with a safety interlock switch wired back to a locking assembly controller.
Distance and topology are the third cut: a 200 m run of guard doors across a substation or transformer yard is the canonical use case for Kirk-style trapped key interlocks on switchgear, because each successive operation has to be confirmed before the next key is released, with no reliance on long cable runs [S7]. The fourth cut is diagnostic depth: if your electrical automation stack already includes a safety PLC that can be polled and logged, electrical guard locking integrates directly; if the machine is a standalone skid with no controller, a trapped-key chain gives you the safety function without the electrical measurement overhead. A compact comparison:
Trapped-key: mechanical, no wiring, tolerates harsh and hygienic environments, weak on built-in diagnostics, rated up to PLe/Category 3 in catalogue configurations [S3][S5].
Electrical guard locking: continuous diagnostic coverage through a safety relay or PLC, requires rated wiring, higher integration cost over long distances, integrates with LV electrical control cabinets and standard safety I/O [S3].
Hybrid (solenoid-locking trapped key): combines a mechanical coded key with a solenoid that only releases under a defined control signal, available off the shelf and rated to the same PLe/Category 3 envelope [S5].
Standards Landscape and the 2024 ISO 14119 Revision
ISO 14119, third edition, was published on 2024-09-09 and incorporates the trapped-key content previously held in ISO/TR 24119:2015, so any new specification written after late 2024 should reference the consolidated standard rather than the technical report [S3]. The revision introduces a new definition set, a key transfer plan requirement, an updated Table 5 on motivation to defeat, Annex I test procedures, and explicit fault-exclusion clauses for Type 5 trapped-key interlocks and for guard locking devices where mechanical failure modes can be reasonably excluded [S3].
For transformer and switchgear applications, the de facto product family is the Kirk key interlock, a mechanical-coded system where a key is only released when the upstream disconnector or breaker is in the correct state, which is the same trapped-key physics described above applied to shaft key sequencing of isolation steps [S7]. Where interlocks must change state, the complementary article on IEC 60204-1 emergency stop categories is a useful reference for the stop-side of the safety function, and the photoelectric vs ionization smoke detector map shows the same frequency-versus-environment trade-off in a different safety domain.
Failure Modes Engineers Should Plan Around
Trapped-key failure modes are mechanical: a coded key can be forced with a tool, a lock barrel can fill with debris, a sequencing key can be lost, or a chain can be bypassed by a motivated operator, and Table 5 of ISO 14119:2024 is specifically structured to help designers defeat those bypass attempts at the design stage [S3]. Spare keys are not available from the manufacturer on purpose, so a lost key forces a documented re-keying exercise, which is a feature, not a bug, for a safety function [S5].
Electrical guard locking failure modes are contact-wear, welded contacts, cable damage, and silent logic faults, which is why the diagnostic channel and periodic proof test exist; a safety relay can mask a welded N/O contact for years until the next demand, and ISO 14119 §8.2 is the explicit response to that class of failure [S3]. The other classic failure is EMC: long cable runs through a Variable Frequency Drive environment can chatter guard-locking solenoids or inject faults into safety inputs, so the wiring topology and shielding have to be designed alongside the interlock choice, not after it.
Who Should Pick Trapped-Key, Who Should Pick Electrical
Trapped-key is the right pick for infrequently accessed hazards in harsh environments, for large physical footprints where wiring cost dominates, and for switchgear and transformer isolation sequences where the code is well established; it is the wrong pick when you need a logged, auditable, continuously-diagnosed safety instrumented function, or when the guard is opened many times per shift [S3][S5]. Electrical guard locking is the right pick for high-cycle access, for integration with a safety PLC, and for any application that needs proof-of-test records for compliance audits; it is the wrong pick when the environment defeats cabling, when the distance from the panel is too long to wire economically, or when there is no controller to host the diagnostic channel.
For the borderline case, solenoid-locking trapped key delivers both: the mechanical coded key plus a release that only happens when the safety control confirms the safe state, at the same PLe/Category 3 envelope as the purely mechanical version [S5]. That hybrid is the practical default for new machine builds where the team is split between operations, who want robustness, and EHS, who want a diagnostic record.
Selection Checklist Before Specifying
Confirm access frequency per shift, target safety integrity (PLe/Category 3 or Category 4 / SIL 3), environmental class (IP rating, washdown, explosive atmosphere), physical distance between guard and control panel, existing safety controller and its diagnostic channel, and any company policy on mechanical versus electrical interlocks, since each item shifts the trade-off [S3][S5]. For high-cycle clean cells, default to electrical guard locking integrated with the safety PLC; for outdoor switchgear, default to trapped-key or Kirk interlocks; for everything in between, default to solenoid-locking trapped-key and accept the small premium for the diagnostic interface.
Two trackable signals to watch: the 2024 ISO 14119 Annex I test procedures, which now drive a more rigorous proof-test regime for trapped-key installations and may push designers toward solenoid-locking variants; and the safety PLC vendors, who continue to add diagnostic depth that erodes one of the historical advantages of mechanical systems [S3].