ISO/TS 19837:2018

TECHNICAL ISO/TS
SPECIFICATION 19837
First edition
2018-03
Safety of machinery — Trapped key
interlocking devices — Principles for
design and selection
Sécurité des machines — Dispositifs de verrouillage à clé captive —
Principes de conception et sélection
Reference number
©
ISO 2018
© ISO 2018
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Fax: +41 22 749 09 47
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii © ISO 2018 – All rights reserved

Contents Page
Foreword .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms . 4
5 Operating principles and typical forms of trapped key interlocking system .5
5.1 General . 5
5.2 Functional decomposition of a trapped key interlocking system . 8
5.2.1 Isolation control . 9
5.2.2 Intermediate transfer .12
5.2.3 Access control .13
6 General requirements for the design of Trapped Key interlocking device .13
6.1 General .13
6.2 Device architecture and positive mechanical action .13
6.3 Endurance/Strength .14
6.3.1 General.14
6.3.2 Resistance to shock and vibration .14
6.3.3 Mechanical life .14
6.3.4 Rotary actuators for access locks .14
6.3.5 Key retention .15
6.4 Systematics .15
6.5 Safety FMEA/FTA .15
6.6 Validating Performance Level .15
6.7 Design to minimize defeat .16
6.7.1 General.16
6.7.2 Scheme design for ease of use .16
6.7.3 Coded actuators .16
6.7.4 Reproduction of keys .16
6.8 Clearances and creepage distances .17
6.9 Isolation control .17
6.9.1 General.17
6.9.2 Direct mechanical action (Power interlocking) .17
6.9.3 Solenoid controlled switch .17
6.10 Access control .17
6.10.1 Escape release .17
6.10.2 Emergency release .18
6.10.3 Auxiliary release . .18
7 System configuration .18
7.1 General .18
7.2 Key coding .18
7.3 Key transfer plan .19
7.4 System selection .19
7.4.1 General.19
7.4.2 Isolation control .19
7.4.3 Intermediate transfer .19
7.4.4 Access control .19
8 Information for use .19
Annex A (informative) Examples of trapped key interlock devices .20
Annex B (informative) FMEA analysis — Typical failure modes for consideration in trapped
key systems .26
Annex C (informative) Safety functions and validation in accordance with ISO 13849-1 and
ISO 13849-2 .27
Annex D (informative) Selection of trapped key interlocking devices .29
Bibliography .30
iv © ISO 2018 – All rights reserved

Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www .iso .org/ patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: www .iso .org/ iso/ foreword .html.
This document was prepared by Technical Committee ISO/TC 199, Safety of machinery.
TECHNICAL SPECIFICATION ISO/TS 19837:2018(E)
Safety of machinery — Trapped key interlocking devices —
Principles for design and selection
1 Scope
This document specifies principles for the design, selection and application of trapped key interlocking
devices and systems for machinery applications, independent of the type of energy used to control them
or that they control.
The requirements of this document apply to the safety related aspects of trapped key interlocking
devices and systems. ISO 14119 always applies unless an exception is given in this document.
This document is intended to be used in conjunction with ISO 14119.
This document does not provide testing requirements.
NOTE Documents addressing testing requirements can be found in the Bibliography.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO 14119:2013, Safety of machinery — Interlocking devices associated with guards — Principles for
design and selection
ISO 13849-1, Safety of machinery — Safety-related parts of control systems — Part 1: General principles
for design
ISO 13849-2, Safety of machinery — Safety-related parts of control systems — Part 2: Validation
IEC 60947-1:2008, Low-voltage switchgear and controlgear — Part 1: General rules
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at http:// www .electropedia .org/
3.1
trapped key interlocking system
system fulfilling safety function(s) or part of safety function(s) and comprising of at least two trapped
key interlocking devices which work together through the transfer of a key
3.2
key
element used to operate a trapped key interlocking device with matched coding
3.3
trapped key interlocking device
device, part of a trapped key interlocking system, which fulfils a function by trapping or releasing a key
in a given system
EXAMPLE Door locks, key operated switches, key exchange units.
3.4
bolt lock
trapped key interlocking device that extends a bolt to lock an object
EXAMPLE Disconnector switches, valves or sliding doors.
3.5
access lock
trapped key interlocking device used to lock movable guards
Note 1 to entry: Access locks can also be used for locking in position of objects other than guards, e.g. isolators,
valves or barriers.
3.6
timed delay device
trapped key interlocking device that releases a key after a pre-determined period of time has elapsed
3.7
key exchange device
trapped key interlocking device in which the insertion of one or more keys releases one or more keys
with a different coding, trapping the inserted keys
3.8
key operated switch
trapped key interlocking device comprising a switch which can only be operated by means of a key
3.9
solenoid-controlled switch
trapped key interlocking device comprising a key operated switch which can be mechanically locked by
the operation of a solenoid
3.10
valve lock
trapped key interlocking device used to lock a valve in the open position (locked open), in the closed
position (locked closed) or in both positions by different keys (LO/LC)
3.11
actuator
separate part of an access lock which transmits the state of the guard (closed or not closed) to the
actuating system
Note 1 to entry: Access locks can also be used for locking in position of objects other than guards, e.g. an isolator,
valve or barrier.
Note 2 to entry: A Key is not covered by this definition, see 3.1.2.
[SOURCE: ISO 14119:2013, 3.12, modified — “interlocking device” has been changed to “access lock”.]
3.12
switch-disconnector
switch which, in the open position, satisfies the isolating requirements specified for a disconnector
[SOURCE: IEC 60947-1:2007, 2.2.10]
2 © ISO 2018 – All rights reserved

3.13
personnel key
key which is released from a trapped key interlocking device (typically a access lock used in conjunction
with whole body access) and retained by a person to prevent a hazardous situation, e.g. unexpected
start-up
3.14
control interlocking
function which allows access to hazardous machine functions if the energy supply is interrupted using
indirect means
Note 1 to entry: Examples of indirect means can include a combination of relay modules, standstill monitoring
devices, PLCs or other control devices/systems.
3.15
power interlocking
interlocking which directly interrupts the energy supply to the machine actuators or disconnects
moving parts from the machine actuators
[SOURCE: ISO 14119:2013, 3.31, modified — The Note 1 to entry has been deleted.]
3.16
locked open
LO
valve locked by a trapped key interlocking device in the open position
3.17
locked closed
LC
valve locked by a trapped key interlocking device in the closed position
3.18
key transfer plan
drawing depicting the trapped key interlock system with its individual devices and the sequence(s) in
which they are to be operated
3.19
key trapped
key which is locked until an external input releases it
EXAMPLE A solenoid or the insertion of an actuator releases the trapped key.
3.20
key releasable
key which is not locked and so can be (turned and) removed at any time causing a change of state of
the device
EXAMPLE Change of state of the device releases or traps another key or changes contact state.
3.21
master key
key which can open multiple locks of different coding
3.22
isolation control
sub function of a trapped key interlocking system to achieve and maintain a safe state of power or
movement
3.23
intermediate transfer
sub function of a trapped key interlocking system that allows the transfer of keys between isolation
control and access control, subject to the designated conditions
3.24
access control
sub function of a trapped key interlocking system that controls the access to safeguarded areas or
access to machine operating modes and functions
3.25
category 3 behaviour
no single fault results in a loss of the safety function
Note 1 to entry: Category 3 behaviour is characterized by (see ISO 13849-1:2015, 6.2.6):
— continued performance of the safety function in the presence of a single fault;
— detection of some, but not all, faults;
— possible loss of the safety function due to accumulation of undetected faults.
3.26
category 4 behaviour
no accumulation of faults results in a loss of the
safety function
Note 1 to entry: Category 4 behaviour is characterized by (see ISO 13849-1:2015, 6.2.7):
— continued performance of the safety function in the presence of a single fault;
— detection of faults in time to prevent the loss of the safety function;
— the accumulation of undetected faults is taken into account;
— the consideration of an accumulation of two faults is sufficient (unless an accumulation of 3 or more faults is
foreseeable).
4 Symbols and abbreviated terms
o.r Symbol Function Definition
1 key 3.2
2 key path
3 key trapped 3.19
4 key releasable 3.20
5 key inserted and
removable
6 key removed
7 actuator locked
4 © ISO 2018 – All rights reserved

o.r Symbol Function Definition
8 actuator unlocked
9 actuator removed
10 timed delay function 3.6
NOTE The figures in this document show general function principles without claiming any PL or SIL for the
associated safety functions. Therefore the corresponding links between contacts are shown in dashed lines,
independently if the contacts used are mechanically linked, mirror, or normal auxiliary contacts.
5 Operating principles and typical forms of trapped key interlocking system
5.1 General
A trapped key interlocking system relies upon the transfer of key(s), e.g. between a key operated switch
and an access lock (see Figure 1).
Typically in trapped key interlocking systems the guard locking and the switching elements are
physically separated and functionally linked by the transfer of the key.
Keys shall be coded with the intention that they can fit only into the corresponding devices.
Trapped key interlocking systems shall ensure a sequence of operation for equipment to ensure safety
due to the following operating principles.
A designated safe state of the machinery results in the availability of a key. The following sequence
shows an example of a simple trapped key system using a key operated switch and an access lock:
— machine in operation (see Figure 1);
— operation of the key results in a stop command (see Figure 2);
— key in transfer between devices from switch to access lock (see Figure 3);
— the key is inserted to the access lock (see Figure 4);
— operation of the key in the access lock changes its state to unlocked (see Figure 5);
— removing the actuator from the access lock traps the key (see Figure 6).
To bring the machine back into operation the sequence shall be reversed.
EXAMPLE In key operated switches, removing the key results in a change of state of the contact(s) which
cannot be changed back until the key is reinserted. Typically this change of state initiates a stop command to the
machine. Once the key has been removed, it is used to unlock the access lock. Removal of the actuator by opening
the moveable guard results in the key becoming trapped.
NOTE
key operated switch access lock
key releasable, contacts closed (machine on) key removed, actuator locked
Figure 1 — Machine in operation
NOTE
key operated switch access lock
key inserted and removable, contacts opened key removed, actuator locked
Figure 2 — Operation of the key results in a stop command
NOTE
key operated switch access lock
key removed, contacts opened (machine off) key removed, actuator locked
key in transfer
Figure 3 — Key in transfer between devices from switch to access lock
NOTE
key operated switch access lock
key removed, contacts opened (machine off) key inserted and removable, actuator locked
Figure 4 — Key inserted to the access lock
6 © ISO 2018 – All rights reserved

NOTE
key operated switch access lock
key removed, contacts opened (machine off) key releasable, actuator unlocked
Figure 5 — Unlocked state by operation of the key in the access lock
NOTE
key operated switch access lock
key removed, contacts opened (machine off) key trapped, actuator removed
Figure 6 — Key trapped by removing the actuator from the access lock
Key coding shall prevent two or more devices unintentionally sharing the same key which can result in
a hazard.
For example, a key that shuts down and allows safe access into machine 2 cannot be used to access or
control machine 1 (see Figure 7).
Figure 7 — Key coding
5.2 Functional decomposition of a trapped key interlocking system
A typical trapped key interlocking system comprises three sub functions:
1) isolation control (for example: key operated switch). See 5.2.1.
2) intermediate transfer (for example: key exchange device). See 5.2.2.
3) access control (for example: access lock). See 5.2.3.
8 © ISO 2018 – All rights reserved

Key
1 isolation control
2 intermediate transfer
3 access control
4 key operated switch
5 key exchange device
6 access lock devices
Figure 8 — Sub functions of a typical trapped key interlocking system
5.2.1 Isolation control
5.2.1.1 General
This sub function of a trapped key interlocking system is to achieve and maintain a safe state of power
or movement. With the key removed the power and or movement is held in a safe state. Only when the
key is returned and put into a key releasable or key trapped position can power and or movement be
resumed. Examples of isolation control trapped key interlock devices include, bolt lock (operating on
a valve or isolator switch), key operated switch, solenoid controlled switch, valve lock or mechanical
movement prevention device linked to an access lock.
5.2.1.2 Isolation control through direct mechanical action (Power Interlocking)
In a trapped key power interlocking system the power supply shall be locked off directly by a trapped
key interlock. This is typically achieved through the use of a switch-disconnector in conjunction
with a bolt lock (see Figure 9) or through a key operated switch where the switching element is the
disconnector. Switch-disconnectors shall conform to the requirements of IEC 60947-3. The key can only
be removed from trapped key interlocking device once the power source has been isolated and locked
in the off position.
a) Supply connected, key trapped
b) Supply disconnected, key releasable
c) Supply disconnected and locked through bolt lock, key inserted and removable
d) Supply disconnected and locked through bolt lock, key removed
Figure 9 — Example of power interlocking sequence
5.2.1.3 Isolation control through non-direct mechanical action (Control Interlocking)
In a trapped key control interlocking system, the power supply is locked off indirectly by a trapped key
interlock via a control circuit (see Figure 10). Typically, switching elements controlled by the trapped
key interlock can be contactors or solenoid operated pneumatic valves. Because control is by indirect
means, monitoring is normally employed.
10 © ISO 2018 – All rights reserved

a) Supply connected, key releasable
b) Supply disconnected, key inserted and removable
c) Supply disconnected, key removed
Key
Q1 power contactor S2 reset device
Q2 power contactor K1 logic unit
S1 key operated switch
Figure 10 — Example of a control interlocking sequence
5.2.2 Intermediate transfer
This sub-function of a trapped key interlocking system allows the transfer of keys between Isolation
control and access cont
...