Interlocks and Permissives

The Core Idea

Permissives and interlocks are conditions that govern whether equipment may operate. A run request alone is not enough: the program must also check the conditions specified for starting and continuing to run.

What you will learn

Tell a start permissive from a running interlock by what each does to a machine that is already running.
Place a condition in a start/stop rung so that it only prevents a start, or also stops the machine.
Check every combination of permissive and interlock states, including a stopped machine that must not restart by itself.

Why it matters

These checks turn a simple Start command into a control decision that accounts for the condition of the machine and the equipment around it.

The problem

A pump draws water out of a tank through a suction valve.

Signal	Meaning
`START_PB`	TRUE while Start is pressed (momentary)
`STOP_PB`	TRUE while Stop is not pressed. The button is normally closed, so pressing it, or a broken wire, makes it FALSE
`SUCTION_OPEN`	TRUE while the suction valve is fully open (its open limit switch is made)
`LEVEL_OK`	TRUE while the tank level is above the low-level switch. FALSE at low level, or if the switch wire breaks
`PUMP_RUN`	TRUE runs the pump motor

The specification:

Start runs the pump and a seal-in keeps it running. Stop stops it. As with every Stop button on this site, the program uses a normally open contact on STOP_PB to permit running.
The pump may start only while the suction valve is open. In this plant the valve switch is a start check only: once the pump runs, the low-level switch protects it.
The pump must stop when the level falls below the low-level switch, and it must not restart by itself when the level recovers. Someone has to press Start again.

A condition that must be TRUE before a machine may start is a permissive. A condition that stops a running machine when it is lost is an interlock. An interlock also blocks a start, since a start would stop again at once.

In this lesson you operate the level switch by hand. A tank that fills and drains on its own will come in a later update.

These conditions protect the pump and the process. They are not safety functions. Emergency stops and other personnel safety functions belong to a separate safety system, such as safety relays or a safety-rated controller, not to ordinary programmable logic controller (PLC) logic.

This lesson builds on the seal-in from Start/Stop Seal-In Circuit.

Predict

The pump is running with the valve open and the level OK. First, someone closes the suction valve. Then the level falls below the low-level switch. Then the level recovers. What does the pump do after each of the three changes?

Try it

SUCTION OPEN and LEVEL OK are switches: click to change them; lit means the switch reports TRUE. Hold START and STOP for a moment, since the program reads inputs once every 100 ms scan.

With SUCTION OPEN off, press START. Nothing happens.
Turn SUCTION OPEN on and press START. The pump runs.
Turn SUCTION OPEN off. Watch the pump.
Turn LEVEL OK off. Then turn it back on. Watch the pump.
Press START with LEVEL OK off, then with it on.

Check your prediction

Closing the valve does not stop the running pump: the valve switch is a start permissive. Low level does stop it: the level switch is an interlock. When the level recovers, the pump stays off, because stopping it also opened its seal-in. It waits for a new Start press, and that press needs the valve open again.

Look closer

The whole program is one rung. Follow the power-flow highlighting as you change the switches.

The branch has two paths. The Start path has START_PB and SUCTION_OPEN in series. The seal-in path has a PUMP_RUN contact.
After the branch, normally open STOP_PB and LEVEL_OK contacts sit in series before the PUMP_RUN output coil.

While the pump starts, power flows through the Start path, so the valve must be open. Once PUMP_RUN is TRUE, power flows through the seal-in path instead, which does not pass through SUCTION_OPEN. The valve no longer matters. Every path does pass through LEVEL_OK, so the level is checked on every scan. When it opens, PUMP_RUN goes FALSE, its seal-in contact opens with it, and the level recovering cannot bring it back.

Where a condition sits decides what it does. On the Start path, it can only prevent a start. After the branch, it stops a running machine and also prevents a start.

Change it

In this practice program the valve contact sits after the branch. In the editor's tag list, set SUCTION_OPEN TRUE, then set START_PB TRUE and back to FALSE to press Start. With the pump running, set SUCTION_OPEN FALSE. The pump stops: the valve check has become an interlock, which the specification does not ask for. Move the contact so it only matters when starting, and repeat.

Show the guided change

Move the SUCTION_OPEN contact onto the Start path of the branch, in series with START_PB. Leave STOP_PB and LEVEL_OK after the branch. Start is still refused with the valve closed, but closing the valve no longer stops a running pump, because the seal-in path carries power around it.

Check yourself

Many centrifugal pumps are started against a closed discharge valve to keep the starting load low, and the discharge valve is opened once the pump runs. Add DISCHARGE_CLOSED (TRUE while the discharge valve is fully closed) to the pump:

The pump may start only while the suction valve is open and the discharge valve is closed. Both valve switches are start checks only.
Low level must stop the pump, and the pump must not restart by itself when the level recovers.
The normally closed Stop button stops it.

The challenge editor opens with the tags START_PB, STOP_PB, SUCTION_OPEN, DISCHARGE_CLOSED, LEVEL_OK, and PUMP_RUN, and no rungs. The checks try every combination of the three conditions and open the discharge valve after each start. Run them as often as you need.

Hint 1

Sort the conditions. Which ones only need to be TRUE to start? Which one must stop a running pump? What happens to the discharge valve right after a start?

Hint 2

Start checks go on the Start path inside the seal-in branch. Conditions that must stop the pump go after the branch, where every path passes through them.

Hint 3

Start path: START_PB, SUCTION_OPEN, DISCHARGE_CLOSED. Seal-in path: PUMP_RUN. After the branch: STOP_PB and LEVEL_OK, then the PUMP_RUN output coil.

Show the worked solution

One rung:

A branch. Top path: normally open contacts START_PB, SUCTION_OPEN, and DISCHARGE_CLOSED in series. Bottom path: a normally open PUMP_RUN contact.
After the branch, normally open contacts STOP_PB and LEVEL_OK in series.
An output coil PUMP_RUN.

Both valve switches are permissives, so they sit on the Start path. Once the pump runs, the seal-in path carries power around them, and opening the discharge valve does not stop it. If DISCHARGE_CLOSED sat after the branch, the pump would stop the moment its discharge valve opened. Low level is an interlock, so LEVEL_OK sits after the branch, where it breaks the seal-in and the pump waits for a new Start.

What happened and why

A permissive asks "may this machine start?" An interlock asks "may this machine keep running?" In a seal-in rung, the answer comes from position: a condition on the Start path is checked only while starting, because the seal-in path carries power around it afterwards. A condition after the branch is checked on every scan, so it stops the machine, and because it also drops the seal-in, the machine stays off until someone starts it again. That no-restart behavior matters: a pump that restarts on its own whenever a level switch flickers cycles on and off and surprises the operators.

Which conditions should also stop a running machine is a design decision, and it belongs in the specification. Here the suction valve switch is a start check only; another plant might also stop the pump if its suction valve closes. When you read a specification, sort each condition into "prevents a start" or "stops and prevents a start", then place it in the rung to match.

Common mistakes

A permissive after the seal-in branch. Cause: every condition placed in series with Stop. Symptom: closing the suction valve, or opening the discharge valve, stops a running pump. Fix: put start-only checks on the Start path.
An interlock only on the Start path. Cause: the level check placed next to Start. Symptom: the pump keeps running at low level, because the seal-in path bypasses the check. Fix: put the interlock after the branch.
An interlock that blocks only the output. Cause: a separate run memory that low level does not clear. Symptom: the pump restarts by itself when the level recovers. Fix: let the interlock break the seal-in.
A normally closed contact on the Stop input. Cause: matching the contact to the normally closed button. Symptom: the pump will not start, or starts only while Stop is held. Fix: STOP_PB is already TRUE when it is OK to run, so use a normally open contact.

Enable JavaScript to run the embedded simulator and complete the interactive exercises.