@Dogleg: It is not always required it will depend on the equipment you are trying to protect the staff from.
In my example there were 5 tanks where opening the lid cauld cause injury for example the product was either hot or caustic, even though the htch had a grid on it to stop access without having to use tools to remove the grids during production or CIP opening the lid could cause the personnell to be splashed with hot product or caustic solution. The trapped key system was put in a position so the operator or engineer had to walk to that location so by the time they had disabled the trapped keys, removed a key & walked back to the tank or what ever the natural process of things like pumps & high pressure tofjorg spray balls had naturally stoped & drained. it is common practice but this can be achieved by delay solenoid bolt type safety systems. the problem with those is the elecrical components on a vessel that is hot steamy & contains chemicals that are corrosive they do not last long. So with those types of conditions, the nature of more than one engineer on the plant it makes sense.
Sometimes multiple trapped keys are employed if the plant is segmented i.e. one part can be worked on while the other continues to run however, this will depend on the nature of how the plant works & the safety aspect. I have seen where a guy working on a batching vessel that was isolated the CIP set that fed the whole plant was some 50 metres away, the valves feeding that tank were isolated with a safety system i.e. Dumped air & electrical isolation seems fair, however, the CIP system was feeding another tank at the time, the isolation valves for the tank the guy was working on failed mechanically, it turned out that even though the system had double isolation valves one had already lost it's seal so was leaking, the other was ok but suddenly that seal failed. so although it seems that the system was compliant with the safety regs & the relevant risk assesments had been done the company decided that in the future the adoption of a stringent and common format was the way to go. One thing tht the adoption of a multiple trapped key system prevented is if engineers are working on plant it was not only the saftey interlocks put in place but human nature, I was involved in the discussion on how best to protect staff, one thing came up that was significant in the implementation of the saftey systems was a scenario where two engineers or more were working on a plant, one engineer removes the trapped key & put it in his pocket, he enters the plant, does his job, comes back out, thinks the other engineer or at least the head count is correct, replaces the key, switches on but there is still one guy in the tank.
There was a lot of discussion on that one some saying the correct procedure like the engineers sign the safety log so the procedure is that the key holder must check that engineers are finished & clear of the plant & so on, but human nature says that in an environment where pressure on staff is prevelent it can be easy to forget or even make the mistake of believing they have noted that all engineers on the list are clear of the plant.
Although all the procedures are followed accidents happen due to unforseen circumstances the adoption of this particular safety procedure was deemed to be the best that could be implemented & was to become a standard for two reasons, one of safety & the other for reduction of having a common spares policy, thus reducing costs & training in one adopted system rather than many.
