- A trapped key interlock enforces an operating sequence purely mechanically: each key is uniquely coded from a pool that typically exceeds 130,000 combinations, and it is only released when the valve has travelled to its full open or full closed position.
- ASME BPVC Section VIII (UG-135) and API 520 Part II only tolerate isolation valves beneath pressure relief devices where they are locked or interlocked so that the full certified relieving capacity remains available at all times.
- HSE guidance HSG253 treats proved isolation – double block and bleed with the bleed verified – as the benchmark for breaking containment on hazardous inventories, and a trapped key scheme is the cheapest way to make that sequence physically unavoidable.
Valve interlocks are the hardware answer to a stubbornly human problem: procedures get skipped. You can write the world’s finest operating instruction for a pig launcher or a relief valve changeover, laminate it, bolt it to the pipework and train every operator twice a year, and one wet Friday night shift somebody will still try to swing a closure door with 40 bar behind it. A trapped key interlock removes the option. The valve physically cannot move until the previous step in the sequence has been completed and proved, because the key that frees it is still trapped in the lock upstream.
The concept is old – James Harry Castell patented key interlocking for electrical switchgear in the 1920s, and the coded-key principle crossed into process pipework decades ago. What has changed is the expectation: post-Piper Alpha, regulators and insurers ask not whether a safe sequence exists on paper, but whether the plant physically permits an unsafe one. On PSV changeovers, pig traps and double block and bleed isolations, the honest answer without interlocks is almost always yes.
This guide covers how trapped key systems work at the valve, the classic applications – relief valve changeover, pig trap sequences and proved isolation – and the practical business of key schedules, retrofits and defeat prevention.
How Valve Interlocks Enforce a Sequence
Strip a trapped key valve interlock down and it is a coded lock body bolted to the valve’s operating mechanism. In the quarter-turn version, a housing fits over the ball or butterfly valve’s stem flats; in the multi-turn version, a bolt engages the gate or globe valve’s handwheel or rising stem. The lock has one or two key positions. With the valve locked open, the "open" key is free to remove and the "closed" key – if fitted – is trapped. Rotate the valve fully closed and the situation reverses: the closed key releases, the open key traps.
The critical detail is full travel. A properly built interlock will not release a key at 80 per cent of stroke; the bolt only clears when the stem reaches its mechanical stop. That single feature converts the key into a position-proving token. Whoever holds the "closed" key for valve V-101 holds mechanical proof that V-101 is fully closed, in a way that a padlock and chain never provides. Chains prove somebody visited the valve; trapped keys prove what position they left it in.
Sequences are then built by key exchange. Key A, released by closing the main process valve, is the only key that fits the vent valve’s lock; opening the vent releases key B, which is the only key that fits the drain; and so on down the chain. Where a step needs several conditions satisfied at once, a key exchange box takes in two or three "proof" keys and only then releases the single key for the next operation. The logic is Boolean, executed in hardened stainless steel, with no power supply, no software revision and no bypass switch.
Coding matters more than people expect. Reputable manufacturers machine key codes from six-figure combination pools and register a site’s codes so no duplicate is ever supplied to the same plant. Treat any interlock that accepts a neighbouring key as scrap – a miscoded lock is worse than no lock, because it certifies a position that has not been achieved.
PSV Changeover Interlocking: Keeping One Relief Path Always Open
The highest-consequence application is beneath pressure safety valves. Continuous processes cannot shut down every time a PSV needs bench testing, so duplicate relief valves are installed with isolation valves so that one PSV can be removed while its twin protects the system. The codes are blunt about the risk: ASME Section VIII UG-135 and Appendix M, and API 520 Part II, require that any interposed stop valve arrangement guarantees the full required relieving capacity is connected at all times. An operator who closes both inlet isolations has silently converted a protected vessel into an unprotected one, and history – from Grangemouth to a long list of smaller boiler incidents – shows it happens.
The trapped key solution is elegant. Each isolation valve under a PSV carries an interlock in which the key is trapped while the valve is open. To close the A-stream inlet valve, the operator must first insert a key that can only be obtained by locking the B-stream valves fully open. There is exactly one free key in the system, so at most one relief stream can ever be isolated. Add the outlet isolations (where relief discharges to a flare header) into the same exchange chain, and the interlock also enforces the correct order: outlet valves open before inlet valves, so a freshly reinstated PSV is never dead-headed against a closed outlet.
A dedicated three-way changeover valve – a single body with one inlet and two outlets feeding twin PSVs – achieves the same goal by geometry, since its internal plug cannot block both paths simultaneously. But changeover valves are expensive above DN100, introduce their own pressure drop that must be checked against the 3 per cent inlet loss rule in API 520, and still need locking against half-travel positions on some designs. On retrofits, interlocking the existing gate valves is usually a fifth of the cost of cutting in a changeover valve, which is why it remains the default fix flagged by insurance surveyors.
One field aside: insist the scheme includes the small-bore bleed between isolation valve and relief valve. Removing a PSV with trapped pressure behind a closed gate valve has injured more fitters than the headline both-valves-closed scenario ever has.
Pig Launchers and Receivers: The Door Must Come Last
Pig trap accidents are depressingly repetitive: a closure door is opened with pressure still inside, and the door or its swing bolt becomes a projectile. The Energy Institute’s pigging guidance and every operator’s procedures say the same thing – isolate, vent, drain, prove zero pressure, then open – and yet doors keep being pulled at pressure because a gauge was misread or a vent was blocked with wax.
A trapped key sequence for a launcher typically runs through five or six locks. Closing the mainline valve and the kicker valve releases their keys; those keys, via an exchange box, release the vent valve key; opening the vent releases the drain key; and only with vent and drain both proved open does the final key emerge – the one that fits the lock on the closure door itself. Door interlocks bolt to the band-lock or clamp-ring mechanism so the door cannot even begin to unswing until the key is inserted, and the key cannot be removed again until the door is fully re-secured.
Two refinements are worth specifying. First, a residual pressure check: better schemes interpose a key-operated needle valve immediately before the door key, so the operator physically cracks a telltale to atmosphere as part of the chain – wax and hydrate plugs can hold 20 bar behind a happily open vent valve. Second, sequence reversal: the interlock should force the door closed and vent shut before the kicker valve key can be recovered, so the trap cannot be lined up with the door merely hand-tight.
Receivers deserve the same rigour, plus one extra trap for the unwary: a pig sat against the closure with line pressure behind it. The sequence proves the trap vented, not the pipeline – so on gas duty the mainline isolation should be a double block and bleed arrangement in its own right.
Double Block and Bleed: Making Proved Isolation Unavoidable
HSG253, the HSE’s guidance on the safe isolation of plant, sets the hierarchy for breaking containment: positive isolation (spades, spectacle blinds, physical disconnection) at the top, proved double block and bleed below it, and single valve isolation acceptable only for low-hazard, short-duration work. Proved DBB means two block valves in series with an open bleed to a safe location between them, with the bleed observed to confirm the upstream valve is holding. It is the minimum sensible standard for hydrocarbon, steam above 17 bar g, and toxic service.
The failure mode is sequencing. Operators close block one, close block two, and never open the bleed – or open it, see a wisp, and shut it again, leaving the intervening cavity to repressurise against a passing valve. An interlocked DBB set forces the pattern: closing block valve one releases the key for block valve two; closing block valve two releases the key for the bleed; and the bleed valve’s lock traps its key in the open position, so the isolation certificate can only be hung with the bleed proved and locked open. The keys then sit in the permit office as tangible evidence of isolation status, which is exactly how HSG253 asks isolations to be controlled.
On monoflange and twin-seat DBB valves – single-body double block and bleed, common on instrument take-offs and metering skids – the same logic applies at smaller scale, and manufacturers offer compact interlocks for the paired needle heads. The cavity between two needle seats on a 414 bar wellhead take-off stores enough energy to deserve its bleed lock.
Mechanical vs Electronic Interlocks
Purely mechanical trapped key systems have three towering virtues: they need no power, they cannot be bypassed from a keyboard, and their failure modes are visible – a seized lock announces itself the moment someone tries the key. Their weaknesses are the mirror image: they know nothing about process conditions, they generate no event record beyond who holds which key, and long sequences become a walking exercise across the plant.
Electronic and electromechanical hybrids close those gaps. Solenoid-controlled key release units hold the first key in the chain until the control system grants permission – a flow switch proving the line is pigged clear, a pressure transmitter below 0.5 bar g, or a DCS operator’s explicit release. From that point the sequence continues mechanically, so the safety argument does not rest on the electronics; the solenoid stage is a permissive, not the interlock itself. Key cabinets with electronic monitoring log every key movement with a timestamp, which transforms audits and post-incident investigation.
Where an interlock function is claimed as a safety instrumented function with a SIL rating under IEC 61511, be careful with the boundaries. A trapped key chain is a mechanical safeguard assessed by exclusion of human error paths, not a SIF with a probability of failure on demand you can plug into a LOPA at SIL 2. Most practitioners credit a well-designed, well-audited trapped key scheme as a strong independent protection layer – commonly a risk reduction factor of 10 to 100 in LOPA terms – but the credit depends entirely on the key management discipline discussed below.
Designing a Key Schedule
The key schedule is the engineering document at the heart of any installation: a matrix listing every lock, its code, the valve or door it controls, the position that traps or frees each key, and the sequence logic connecting them. Writing one forces the questions that matter. What is the initiating condition – a key held in the permit office, or a solenoid release from the DCS? What state must the system return to, and does the reverse sequence re-trap every key? Can the plant get stuck half-sequenced if a valve fails mid-travel, and what is the recovery route?
Some hard-won rules. Keep sequences to eight steps or fewer where you can; beyond that operators batch the walking and the scheme breeds resentment. Never allow one key code to appear twice on the same site, and register the site’s code series with the manufacturer so future orders cannot collide. Decide the master key policy consciously: emergency override keys have legitimate uses (a launcher that must be vented during a fire), but every master key issued is a hole in the safety argument, so they belong in a break-glass box with an alarm contact, not in the shift supervisor’s drawer.
Spare keys are the classic defeat route. The disciplined arrangement is one working key per lock position in circulation, one sealed spare per code held by the engineering authority under signature, and no third copy in existence. When a working key is lost, the lock is recoded – not merely re-supplied – if the lost key could be loose on the plant.
Retrofitting Interlocks to Existing Valves
Almost every interlock scheme is a retrofit, and the good news is that modern interlocks are designed for it. Quarter-turn locks clamp to the valve’s ISO 5211 mounting pad or replace the standard lever entirely with an integrated locking lever; nothing touches the pressure envelope, so there is no intrusive work, no recertification of the valve body and usually no breaking of containment at all. Gearbox-operated butterfly and ball valves take a lock module between gearbox and handwheel. Rising-stem gate and globe valves are trickiest: the lock must accommodate the stem passing through it, so the manufacturer needs the stem diameter, rising height and handwheel details from a site survey.
The survey is not a formality: suppliers measure every tagged valve because patterns vary maddeningly – two nominally identical DN150 Class 300 gate valves from different foundries can need different lock castings. The survey also catches operability problems: valves so stiff they need a wheel key, levers that foul steelwork mid-swing, and actuated valves where the interlock must integrate with the actuator’s declutch mechanism rather than the handwheel.
Budget realistically: a single mechanical interlock runs from a few hundred pounds for a small quarter-turn unit to well over two thousand for a large multi-turn or door unit, plus survey, key schedule engineering and installation. Prioritise by consequence – PSV isolations and pig trap doors first, proved isolations on the highest-hazard inventories second, everything else as the budget allows.
Human Factors and Defeat Prevention
Every interlock engineer collects defeat stories: keys ground down to fit foreign locks, lock housings persuaded with a stilson, sequences short-circuited by the sealed spare set that was signed out "temporarily" in 2019 and never returned. The uncomfortable truth is that a trapped key system is only as strong as the site’s key discipline, and operators defeat interlocks for predictable reasons – the sequence is slower than the job seems to warrant, a lock has seized through neglect, or the scheme forces a walk the designer never made themselves.
Design against those motives. Lubricate and function-test every lock on a preventive routine – annually as a minimum, six-monthly in coastal or chemically aggressive atmospheres – because a seized lock is the most common trigger for authorised bypassing, and stainless lock bodies are worth the premium outdoors. Walk the sequence during design with the people who will run it, and time it: if the legitimate route takes 45 minutes and the illegitimate one takes five, redesign the key transfer points or add a satellite exchange box near the trap.
Then close the administrative loop. Key movements get logged; audits reconcile every key against the schedule quarterly; a defeated or damaged interlock is investigated like any other loss of a safety barrier, because that is precisely what it is. Sites that take LOPA credit for interlocks and then leave broken locks unrepaired for months are writing risk assessments with fiction in them.
Specifying a Scheme That Survives Contact With Operations
If you take one thing from this piece: interlocks are sequence engineering, not padlock procurement. Start from the hazardous sequence – the both-PSVs-isolated state, the door-at-pressure state, the unproved isolation – and design the key logic so that state is unreachable, then let the hardware list fall out of the key schedule. Involve the interlock manufacturer early, get the site survey done properly, and put as much effort into the key management procedure as into the stainless steel.
Done well, a trapped key scheme replaces the anxiety of remembering a sequence with the certainty of following the keys. Done badly – seized locks, loose spares, sequences designed from a desk – it becomes plant jewellery that everyone quietly works around. The difference is not the locks; it is the engineering around them.