Trapped Key Interlocking: Making the Unsafe Sequence Physically Impossible

Procedures can be skipped. Control circuits can fail or be jumpered. A properly engineered trapped key system does neither. Here's why every serious data center power design should have one, and what the common schemes look like.

The problem it solves

Most serious electrical incidents in mission-critical facilities aren't equipment failures. They're sequence failures: someone closed the tie breaker while both mains were in, opened a transformer door with the primary still energized, closed a maintenance bypass while the UPS was on inverter, or grounded a bus that was still live from a back-feed. Every one of those has a written procedure that says "don't." Every one of them still happens.

Data centers make this worse, not better. Double-ended substations, multiple utility feeds, generator plants, UPS systems with bypass paths, and behind-the-meter generation all mean there's more than one way for a conductor to become energized. The person doing the switching at 2 a.m. during an outage is often not the person who designed the system.

How trapped key interlocking works

The concept is simple and entirely mechanical. A key interlock is a lock with a bolt mounted on a piece of equipment: a breaker, a disconnect handle, a grounding switch, an enclosure door. The key and the bolt follow two rules:

• The key is trapped in the lock whenever the equipment is in its "unsafe to leave" state (typically a breaker closed or a door open).
• The key is released only when the equipment is put in its safe state and the bolt is thrown, physically locking it there (for example, a breaker locked open).

Because the released key is the only thing that can unlock the next device in line, the operator is forced through the correct sequence. You literally cannot hold the key that opens step 3 until steps 1 and 2 are done. Each system is coded so its keys fit only its own locks, and the number of keys in circulation is deliberately limited. Two keys and three breakers means only two of those breakers can ever be closed at the same time.

Why not just electrical interlocks?

Electrical interlocks (auxiliary contacts wired into close circuits) are useful and often used alongside key interlocks. But they depend on control power and on wiring that can be lifted, jumpered, or mis-terminated during a retrofit. They also do nothing to stop someone opening a door or manually operating a disconnect handle. A mechanical key system works with the gear de-energized, with the batteries dead, and with nobody watching.

Does it replace lockout/tagout?

No. Key interlocking enforces the switching sequence; it is not a substitute for an energy control program under OSHA 29 CFR 1910.147 and NFPA 70E, verification of absence of voltage, or appropriate PPE. Think of it as the layer that makes sure the gear is placed in the right state before LOTO is applied, and that it can't be put back into an unsafe configuration by mistake.

Why Kirk Key

When I specify key interlocks, I specify Kirk. The Kirk Key Interlock Company in Ohio has been the de facto standard for switchgear interlocking in North America for decades, and that matters in the field:

• OEM provisions are already there. Most switchgear, switchboard, and breaker manufacturers offer factory mounting provisions for Kirk interlocks, so locks are installed and tested at the factory instead of field-fabricated.
• Controlled key codes. Every Kirk system is assigned its own code and the scheme is documented. Replacement keys, expansions, and revisions years later stay consistent with the original design.
• A full product range. Bolt interlocks for breakers and switch handles (the familiar Type F and Type B), door and access interlocks, solenoid key release units (SKRUs) that release a key only on an electrical permissive, and time delay key release units for equipment that stores energy or needs run-down time.
• Built for the environment. Brass and stainless options, outdoor-rated housings, and protective covers for substation and generator yard applications.
• Familiarity. Operators, electricians, and commissioning agents recognize Kirk scheme drawings and the locked-open / locked-closed notation. That reduces mistakes.

Typical schemes

These are the arrangements I see most often in data center and industrial power systems. They're illustrative. Every real scheme should be engineered for the specific one-line, documented on a key scheme drawing, and verified at commissioning.

1. Main-tie-main (double-ended substation)

The workhorse of data center distribution. Two utility or transformer sources, two mains, and a normally open tie. The goal is to prevent paralleling two sources that are not designed to be paralleled, which can push fault duty past equipment ratings and drive circulating current between transformers.

1. To take Source 1 out for maintenance, open M1 and lock it open. Key A is released.
2. Carry key A to the tie breaker, unlock, and close the tie. Key A is now trapped in the tie. Bus 1 is fed from Source 2 through the tie.
3. M1 cannot be reclosed until the tie is opened and locked, freeing key A again. Two sources can never be paralleled through this gear.

Variation: where closed-transition (make-before-break) transfer is designed in, a solenoid key release unit with a sync-check permissive can allow momentary paralleling under controlled conditions.

2. Utility / generator non-parallel transfer

Used on manual transfer arrangements, generator docking stations, and portable or bridge-power tie-ins. It prevents connecting a generator to a bus that is still tied to the utility, which can back-feed the utility system and endanger line crews, or damage the generator through an out-of-phase closure.

1. Open the utility main and lock it open. Key A is released.
2. Insert key A in the generator main, unlock, and close. Key A is trapped while the generator is serving the bus.
3. Return to utility in reverse. At no point can both breakers be closed.

Why it matters: the NEC requires transfer equipment to prevent inadvertent interconnection of normal and alternate sources. A single-key scheme is one of the simplest and most robust ways to meet that on manually operated gear.

3. Transformer access (secondary → primary → door)

The classic personnel-protection sequence for unit substations and pad-mounted transformers. It guarantees the transformer is de-energized from both sides before anyone opens the enclosure, and, if the primary device is a non-load-break disconnect, that it is never opened under load.

1. Open the secondary main and lock it open. Key A is released. Opening the secondary first removes load and blocks back-feed from the LV side.
2. Insert key A in the primary switch interlock. Now the switch can be opened. Lock it open: key A becomes trapped and key B is released.
3. Use key B to unlock the transformer enclosure door. Key B stays trapped while the door is open, so the primary can't be reclosed.
4. Restore in reverse: close and lock the door to free B, use B to close the primary (releasing A), then A to close the secondary.

Add-ons: a grounding switch can be added between the primary switch and the door (one more key) so the transformer is grounded before access. In a double-ended substation, also interlock the tie so the LV bus can't back-feed through a closed tie.

4. UPS maintenance bypass (with solenoid key release)

This is the one most specific to data centers. Closing the maintenance bypass breaker (MBB) while the UPS output is on inverter, and not synchronized with the bypass source, can cause a severe out-of-phase fault and drop the critical load. The solenoid key release unit (SKRU) releases its key only when the UPS confirms it is on static bypass.

1. Transfer the UPS to static bypass. The UPS controls energize the SKRU.
2. Only now can key A be turned and removed from the SKRU.
3. Use key A to unlock and close the MBB. The load is now fed through both paths from the same source. Key A is trapped in the MBB.
4. Open the MIB and lock it open, releasing key B, which can be used to isolate the UPS module for maintenance.
5. Return in reverse, with the UPS still on static bypass: B back to the MIB to close it, open and lock the MBB to free A, return A to the SKRU, then transfer the UPS back to inverter.

Note: exact schemes vary by UPS manufacturer and topology (single module, parallel systems, external bypass cabinets, wraparound bypass). Coordinate the SKRU permissive wiring with the UPS OEM and have Kirk or the switchgear OEM produce the scheme drawing.

5. Capacitor bank / harmonic filter (time delay)

Capacitors hold a charge after they're disconnected. A time delay key release unit enforces the discharge interval before anyone can ground or open the enclosure. The same approach is used on large drives and other equipment with stored energy or rundown time.

1. Open the feeder breaker and lock it open, releasing key A.
2. Insert key A in the time delay key release unit and turn it. The timer starts; key B is released only after the set interval, which should exceed the bank's rated discharge time.
3. Use key B to close the grounding switch, releasing key C.
4. Key C unlocks the enclosure door. The bank is disconnected, discharged, and grounded before anyone can reach it.

Other places I like to see keys

Specifying it right

• Name the brand. Specify Kirk Key interlocks by name and require factory-installed locks on OEM mounting provisions wherever available.
• Require a key scheme drawing in the submittal, cross-referenced to the one-line, showing every lock, its key code, and its locked-open or locked-closed state.
• Coordinate across vendors. On a data center, the scheme often spans switchgear, transformers, UPS, and generator packages from different manufacturers. One party (usually the EOR or the switchgear OEM) has to own the whole scheme so the codes are consistent.
• Post the sequence at the gear. A laminated scheme diagram on the lineup makes the system self-explanatory to operators.
• Commission it. Walk every key through every step during functional testing, including the reverse sequence, and confirm no step can be skipped.
• Pick the right lock type. Bolt-type isolation interlocks are for locking switching devices. Use purpose-built access interlocks for doors and guarded areas.

How key systems get defeated (and how to prevent it)

• Spare keys. One extra key in a desk drawer defeats the entire scheme. Spares should be controlled by the facility's safety owner, not hung on a hook next to the gear.
• Undocumented changes. A feeder gets added, a tie gets reconfigured, and the key scheme isn't updated. Any one-line change should trigger a key scheme review.
• Removed or misaligned bolts. After maintenance, verify the bolt actually blocks the operating mechanism.
• Neglect. Locks that stick get "fixed" by leaving them unlocked. Follow the manufacturer's maintenance guidance (Kirk calls for dry graphite, not oil) and include the locks in the annual PM.