A permissive is checked before starting and does not necessarily stop a running machine. An interlock is checked continuously and trips the machine when it fails. Build permissives as a chain of normally open contacts driving a Ready bit, build interlocks as latched trips with a deliberate reset, and always publish which condition is missing so the operator can see it.
- Permissive to start, interlock to keep running; the two need different logic and different reset behaviour.
- Latch a trip so it cannot clear itself before anyone sees it.
- A Ready bit without a reason bit forces the operator to phone maintenance to find out what is missing.
Permissive, Interlock and Trip
| Term | Checked | Effect when not satisfied | Example |
|---|---|---|---|
| Permissive | Before start | Start command refused | Guard door closed, downstream conveyor ready |
| Interlock | Continuously | Machine stops | Motor overload, loss of cooling |
| Trip | Continuously, latched | Machine stops and stays stopped | Emergency stop, high high temperature |
| Inhibit | During a defined state | Command ignored | Cannot open valve while pump running |
A pump that needs suction pressure before starting has a permissive. A pump that must stop if suction pressure is lost has an interlock. Often both apply to the same signal with different limits, and writing them as one condition is where machines start behaving unpredictably.
None of this replaces a safety system. Emergency stops, light curtains and guard locking belong in a safety relay or a fail-safe CPU with a certified architecture. PLC interlocks are process protection, not personnel protection, and the two must be designed separately.
Building the Permissive Chain
Write the permissive as a single rung of normally open contacts in series, ending in a Ready coil. Each contact is a condition that must be true.
- Guard doors closed and locked.
- No active trip present.
- Downstream equipment ready to receive.
- Air pressure and lubrication healthy.
- Mode selected and no manual override active.
Keeping them in one visible chain is the point. Going online, an engineer sees the whole start condition at a glance and the open contact is obvious. Splitting the same conditions across six networks with intermediate flags makes fault finding slower for no benefit.
Field wiring convention
Wire safety-relevant field contacts normally closed so that a broken wire produces the safe state. Then the PLC input is true in the healthy condition and a normally open contact in the program reads correctly. Getting this backwards means a cut cable leaves the machine believing everything is fine.
The same reasoning applies to the stop button in the basic start/stop circuit.
Interlocks, Latching and Reset Handling
An interlock is evaluated every scan while the machine runs. When it fails, the machine must stop and the reason must survive long enough to be read.
- Detect the condition and set a bit in the fault word.
- Latch the fault so it stays set even if the condition clears immediately.
- Drop the run command and stop the equipment.
- Record which fault was first, because a single trip usually causes several.
- Require a deliberate reset before the fault bits clear.
First-out detection
When a motor trips, its downstream equipment often trips too. Without first-out logic, five faults appear simultaneously and nobody knows which came first. Capture the first fault into a separate register at the moment of the trip and hold it until reset. It is a few lines of code that saves hours on site.
Reset that means something
A reset should clear latched faults only when the underlying conditions have actually cleared. An auto-reset that fires every scan hides the fault entirely, and the machine appears to stop for no reason.
Build safe machine logic properly
Practical Siemens sessions covering permissives, interlocks, fault handling and commissioning.
Publishing Status So the Operator Can Act
The logic is only half the job. If the machine will not start and the screen says nothing, an operator's only option is a phone call.
Publish three things to the HMI interface data block:
- Ready: a single bit summarising the permissive chain.
- NotReadyReason: an integer identifying the first missing permissive, mapped to text on the panel.
- FaultWord and FirstOut: the latched interlock bits and the fault that tripped first.
On the panel, map the reason integer through a text list so the operator reads "Waiting for guard door 2 closed" instead of a number. The configuration is covered in the HMI sequence status screen and the alarm side in HMI alarm configuration.
| Mistake | Consequence |
|---|---|
| Permissives and interlocks in one condition | Machine trips on conditions that should only block starting |
| Unlatched trips | Fault clears before anyone sees it |
| No first-out capture | Five faults, no idea which came first |
| Auto reset every scan | Faults invisible, machine stops for no visible reason |
| Ready bit with no reason | Every start refusal becomes a maintenance call |
Hands-On Lab: Build a Permissive Chain with First-Out Fault Capture
Hands-on- TIA Portal with an S7-1200 or S7-1500 CPU, or PLCSIM
- Simulated inputs for five permissive conditions and three trips
- Simulation only; do not test on live equipment
- Estimated time: 40 minutes
Build the permissive chain
Write five conditions in series driving a Ready bit in one network.
Add the not-ready reason
Write an integer identifying the first missing condition.
Add latched trips
Create three interlock conditions that set and latch bits in a fault word and drop the run command.
Add first-out capture
Store the first fault number at the moment of the trip and hold it until reset.
Add a reset
Write a reset that clears the fault word only when all conditions are healthy.
The machine refuses to start with a named reason, trips are latched with first-out identified, and reset only works once the plant is actually healthy.
Frequently asked questions
What is the difference between a permissive and an interlock?
A permissive is checked before starting and blocks the start command. An interlock is checked continuously and stops a running machine when it fails.
Should interlocks be programmed in the standard PLC or a safety controller?
Process interlocks belong in the standard PLC. Personnel protection such as emergency stop, guard locking and light curtains belongs in a safety relay or fail-safe CPU with a certified architecture.
Why latch a trip instead of letting it clear itself?
So the reason survives long enough to be read. An unlatched trip can appear and clear within one scan, leaving a machine that stopped for no visible reason.
What is first-out detection?
Capturing which fault occurred first when a single event causes several trips, so fault finding starts at the cause rather than the consequences.