Interlocks and permissives

Three kinds of conditions

Show the operator which condition is missing — "Not ready" alone wastes time.

Implementation

(* Each condition TRUE = OK *)
StartPermissive := SuctionValveOpen AND NOT TankLevelLow AND NOT AnyTrip;
RunInterlock    := DownstreamRunning AND NOT EStopActive;
TripHH          := BearingTempHH OR (TripHH AND NOT ResetCmd);   (* latch *)

IF NOT RunCmd THEN                       (* starting: all permissives needed *)
    RunCmd := RunRequest AND StartPermissive AND RunInterlock;
ELSE                                     (* running: only running interlocks *)
    RunCmd := RunRequest AND RunInterlock;
END_IF;
RunCmd := RunCmd AND NOT TripHH;

Keep the conditions in one place (a matrix or one function per equipment), give every condition a number and an alarm text, and log the first-out cause when several trips arrive in the same scan.

Bypass / override

Bypasses for commissioning or maintenance must be: authorized (user level), indicated on the HMI, time-limited where possible and logged. Never bypass by forcing I/O in the online editor.

Process interlocks vs safety functions

Interlocks in the basic control PLC protect equipment and product. Protection of people and against major hazards belongs to a safety instrumented system (SIS) or safety PLC designed to IEC 61511 / IEC 62061 / ISO 13849, with its own sensors where required. Do not rely on the normal PLC program for a safety function. Use the Interlock Matrix Builder to document cause and effect.