The short answer
Interlocks and Permissives
A permissive is a condition that must be satisfied before equipment is allowed to start. An interlock is a condition that stops or prevents operation whenever it is present, including while running. Permissives are checked at the start transition; interlocks are checked continuously. Safety-rated protection belongs in hardwired circuits or a safety controller, not in standard PLC logic.
Key points
- Permissive: checked to allow a start. Interlock: enforced continuously.
- A permissive that is also enforced while running is really an interlock — decide which you mean.
- Every interlock needs a defined reset behavior: automatic, manual, or latched until acknowledged.
- Operators need to see which specific condition is blocking, not just a generic "not ready".
- Personnel safety functions must be hardwired or in a rated safety system.
The distinction that matters
Take a high service pump. A permissive might be that the suction valve is open and suction pressure is above minimum. Satisfy those and the operator may start the pump. An interlock might be that motor winding temperature is above limit, or the seal water flow switch has dropped out. Those stop the pump whenever they occur, whether it started ten seconds ago or has been running for six weeks.
| Permissive | Interlock | |
|---|---|---|
| Checked when | At the start request | Continuously |
| Effect | Blocks the start | Stops or prevents operation |
| Typical example | Suction valve open before pump start | High motor temperature |
| If it clears | Start is allowed | Equipment may restart, depending on reset design |
| Operator sees | "Cannot start: suction valve closed" | "Tripped: high motor temperature" |
Reset behavior is a design decision, not a detail
When an interlock clears, what should happen? Three answers are all defensible, and the wrong one for the application causes real problems.
- Automatic reset
- Equipment restarts as soon as the condition clears. Appropriate for conditions that are self-correcting and where restarting is harmless, such as a low suction pressure that recovers. Dangerous where an unexpected restart could injure someone or damage equipment.
- Manual reset
- The condition must clear and an operator must acknowledge before a restart is allowed. Appropriate for anything indicating a real fault: motor overload, seal failure, high vibration.
- Latched until investigated
- The trip is held and recorded even after the condition clears, so that an intermittent fault leaves evidence. Essential for chasing the fault that only happens at 3 a.m.
Tell the operator what is blocking
The most common complaint about interlock logic is not that it trips. It is that when equipment will not start, nobody can tell why. A single "Not Ready" bit is close to useless at 2 a.m.
Build the permissive chain so each condition has its own status bit, and expose a first-out or a list of unsatisfied conditions on the HMI. The cost is a few extra rungs. The benefit is that a technician who has never seen the plant can walk to the panel and read the answer.
Rung 1: Suction_Valve_Open --> Perm_1_Suction_Valve
Rung 2: Suction_Press > Min_Press --> Perm_2_Suction_Press
Rung 3: NOT Motor_Overload --> Perm_3_Overload_Clear
Rung 4: Control_Power_Healthy --> Perm_4_Ctrl_Power
Rung 5: Perm_1 AND Perm_2 AND Perm_3 AND Perm_4 --> Pump_Ready
The HMI shows all four bits. "Pump will not start" becomes a
two-second answer instead of a site visit.Where interlocks should live
- Personnel safety: hardwired safety circuit or a rated safety controller. Not standard PLC logic, and not an HMI button.
- Equipment protection where a controller failure would be costly: hardwired in series with the starter coil, and also read by the PLC for indication and alarming.
- Process interlocks: PLC logic is appropriate. Document them in the control narrative.
- Convenience and sequencing: PLC logic, clearly separated from protective interlocks so nobody deletes the wrong rung during a change.
Frequently asked questions
- Should interlocks be in the PLC or hardwired?
- Both, for different purposes. Anything protecting people must be hardwired or in a rated safety system. Process interlocks belong in the PLC where they can be documented, alarmed, and historized. Critical equipment protection is often done in both, with the hardwired circuit as the enforcement and the PLC providing indication.
- What is a first-out indication?
- A record of which condition tripped first when several trip nearly simultaneously. Without it, a trip that cascades leaves you looking at five alarms with no way to tell which was the cause and which were the consequences.
- Can a permissive be bypassed?
- Sometimes it must be, for maintenance or commissioning. If you build a bypass, it should require a deliberate action, be visible on the HMI while active, be alarmed, be logged, and ideally time out on its own. A silent permanent bypass is how interlocks quietly stop existing.
Related topics
- PermissivesThe conditions that must be true before a device may start: how permissives differ from interlocks and trips, the list a pump or feeder usually needs, coding them so the HMI can say why a start was refused, and the rules for time delays and bypasses.
- Ladder Logic FundamentalsRungs, contacts, coils, and the relay conventions the language inherited — plus the patterns you will meet in almost every industrial program.
- Alarms in the ControllerGenerating alarm conditions in the controller rather than in the graphics: why the PLC should own the alarm state, a standard alarm block with setpoints, deadband, and delays, equipment alarms, and packing alarm bits for SCADA.
- Control NarrativesWhat a control narrative is, what it must contain, how to write statements that can be tested, and how it drives programming, FAT, and the owner’s acceptance.
- Function Block DiagramThe graphical data-flow language of IEC 61131-3: how blocks, pins, and wires work, execution order, where FBD beats ladder and structured text, building reusable equipment blocks, and the habits that keep a diagram readable.
- Structured TextThe text language of IEC 61131-3: syntax, control structures, how it fits alongside ladder, the conventions that keep it readable for the next person, and the mistakes that make structured text a liability in a plant that troubleshoots online.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.