The short answer
Interlocks and Permissives
A permissive is a condition that must be satisfied before equipment is allowed to start. An interlock is a condition that stops or prevents operation whenever it is present, including while running. Permissives are checked at the start transition; interlocks are checked continuously. Safety-rated protection belongs in hardwired circuits or a safety controller, not in standard PLC logic.
Key points
- Permissive: checked to allow a start. Interlock: enforced continuously.
- A permissive that is also enforced while running is really an interlock — decide which you mean.
- Every interlock needs a defined reset behavior: automatic, manual, or latched until acknowledged.
- Operators need to see which specific condition is blocking, not just a generic "not ready".
- Personnel safety functions must be hardwired or in a rated safety system.
The distinction that matters
Take a high service pump. A permissive might be that the suction valve is open and suction pressure is above minimum. Satisfy those and the operator may start the pump. An interlock might be that motor winding temperature is above limit, or the seal water flow switch has dropped out. Those stop the pump whenever they occur, whether it started ten seconds ago or has been running for six weeks.
| Permissive | Interlock | |
|---|---|---|
| Checked when | At the start request | Continuously |
| Effect | Blocks the start | Stops or prevents operation |
| Typical example | Suction valve open before pump start | High motor temperature |
| If it clears | Start is allowed | Equipment may restart, depending on reset design |
| Operator sees | "Cannot start: suction valve closed" | "Tripped: high motor temperature" |
Reset behavior is a design decision, not a detail
When an interlock clears, what should happen? Three answers are all defensible, and the wrong one for the application causes real problems.
- Automatic reset
- Equipment restarts as soon as the condition clears. Appropriate for conditions that are self-correcting and where restarting is harmless, such as a low suction pressure that recovers. Dangerous where an unexpected restart could injure someone or damage equipment.
- Manual reset
- The condition must clear and an operator must acknowledge before a restart is allowed. Appropriate for anything indicating a real fault: motor overload, seal failure, high vibration.
- Latched until investigated
- The trip is held and recorded even after the condition clears, so that an intermittent fault leaves evidence. Essential for chasing the fault that only happens at 3 a.m.
Tell the operator what is blocking
The most common complaint about interlock logic is not that it trips. It is that when equipment will not start, nobody can tell why. A single "Not Ready" bit is close to useless at 2 a.m.
Build the permissive chain so each condition has its own status bit, and expose a first-out or a list of unsatisfied conditions on the HMI. The cost is a few extra rungs. The benefit is that a technician who has never seen the plant can walk to the panel and read the answer.
Rung 1: Suction_Valve_Open --> Perm_1_Suction_Valve
Rung 2: Suction_Press > Min_Press --> Perm_2_Suction_Press
Rung 3: NOT Motor_Overload --> Perm_3_Overload_Clear
Rung 4: Control_Power_Healthy --> Perm_4_Ctrl_Power
Rung 5: Perm_1 AND Perm_2 AND Perm_3 AND Perm_4 --> Pump_Ready
The HMI shows all four bits. "Pump will not start" becomes a
two-second answer instead of a site visit.Where interlocks should live
- Personnel safety: hardwired safety circuit or a rated safety controller. Not standard PLC logic, and not an HMI button.
- Equipment protection where a controller failure would be costly: hardwired in series with the starter coil, and also read by the PLC for indication and alarming.
- Process interlocks: PLC logic is appropriate. Document them in the control narrative.
- Convenience and sequencing: PLC logic, clearly separated from protective interlocks so nobody deletes the wrong rung during a change.
Frequently asked questions
- Should interlocks be in the PLC or hardwired?
- Both, for different purposes. Anything protecting people must be hardwired or in a rated safety system. Process interlocks belong in the PLC where they can be documented, alarmed, and historized. Critical equipment protection is often done in both, with the hardwired circuit as the enforcement and the PLC providing indication.
- What is a first-out indication?
- A record of which condition tripped first when several trip nearly simultaneously. Without it, a trip that cascades leaves you looking at five alarms with no way to tell which was the cause and which were the consequences.
- Can a permissive be bypassed?
- Sometimes it must be, for maintenance or commissioning. If you build a bypass, it should require a deliberate action, be visible on the HMI while active, be alarmed, be logged, and ideally time out on its own. A silent permanent bypass is how interlocks quietly stop existing.
Related topics
- PermissivesConditions that must be true before an action is allowed to start.
- Ladder Logic FundamentalsRungs, contacts, coils, and the relay conventions the language inherited — plus the patterns you will meet in almost every industrial program.
- AlarmsGenerating alarm conditions in the controller rather than in the graphics.
- Control NarrativesThe document that says what the system does, in the words the owner will hold you to.
- Function Block DiagramFunction Block Diagram — practical reference notes for controls engineers, integrators, and technicians working with programming.
- Structured TextStructured Text — practical reference notes for controls engineers, integrators, and technicians working with programming.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.