Permissives

Permissive, interlock, trip

The three words are used loosely in the field and precisely in a functional description. A permissive gates the start: if the wet well is below the low-level cutoff, the pump may not start. An interlock stops or prevents running as long as the condition exists: a seal-fail or a motor high-temperature signal stops a running pump and keeps it stopped. A trip is protection that works whether or not the controller is running: the motor overload relay, the emergency stop, the high-high level float that drops the starter coil. The distinction matters because the response differs. A permissive that goes false after the pump starts does not necessarily stop the pump; if it should, the condition also belongs in the interlock logic.

What a pump start usually needs

• Level: wet well or suction level above the low-level cutoff, with a deadband so the condition does not chatter.
• Drive or starter ready: no fault, control power present, the drive reporting ready, the starter not tripped.
• Selector: the hand-off-auto switch in AUTO for an automatic start; HAND starts bypass the automatic permissives by design and should still respect the trips.
• Valves: suction valve open by limit switch where one exists; discharge valve at the position the sequence expects.
• Anti-cycle: the minimum off time since the last stop has elapsed, and the starts-per-hour count is below the motor limit.
• Maintenance: no lockout tag in the system and no out-of-service flag on the HMI.
• Process: for a chemical feed pump, carrier water flow proven and the day tank not at low level.

Coding pattern

Each permissive is its own bit with a name that says what it is. The bits are combined into one ready bit, and the start command is accepted only while the ready bit is true. Nothing else in the program looks at the individual bits except the HMI, which displays them. This pattern is the same in ladder, structured text, and function block; the structured text version is the shortest to read.

// Pump 1 start permissives, one bit each
P1_Perm_Level  := LT_101_PV > P1_LowLevelCutoff + P1_LevelDeadband;
P1_Perm_Drive  := VFD1_Ready AND NOT VFD1_Faulted;
P1_Perm_Valve  := ZSO_101;                 // suction valve open limit
P1_Perm_Seal   := NOT P1_SealFail;
P1_Perm_MinOff := P1_MinOffTimer.Q;        // minimum off time elapsed
P1_Perm_Auto   := P1_HOA_Auto;
P1_Perm_Maint  := NOT P1_OutOfService;

// One ready bit; the HMI shows the individual bits
P1_Ready := P1_Perm_Level AND P1_Perm_Drive AND P1_Perm_Valve
            AND P1_Perm_Seal AND P1_Perm_MinOff AND P1_Perm_Auto AND P1_Perm_Maint;

// Start accepted only while ready; run interlocks are handled separately
IF P1_AutoStartRequest AND P1_Ready THEN
    P1_RunCmd := TRUE;
END_IF;

The level permissive uses the cutoff plus a deadband, so the pump can start only when the level is comfortably above the point where the interlock would stop it. Without that margin a pump starts, draws the level down through the cutoff on the first stroke, stops, and repeats.

Time delays

Some conditions are true almost all the time and false for a moment: a pressure switch that bounces as a valve opens, a drive ready contact that drops for a scan as the drive changes state, a level reading that dips for one sample. A permissive built directly on such a signal refuses starts for no reason the operator can see. Give those conditions an on-delay of a second or two before they count as true. Do not delay the conditions that protect equipment, and do not delay the trips at all.

On the HMI

The most useful thing a permissive list does is answer the question the operator asks at two in the morning: why will it not start. Put the list on the pump faceplate or a detail popup, one line per permissive with its current state, in the same words the functional description uses. The ready bit drives the start button availability. When a start is refused, the line that is false is the reason, and nobody needs to open the program.

Bypasses

A bypass lets a start proceed with a permissive false: a level bypass to pump a wet well down below the cutoff for cleaning, a valve position bypass when a limit switch has failed and the valve is verified open by hand. Bypasses exist because plants have to keep running, and they are dangerous because they get forgotten. Allow them only where the functional description names them, require a supervisor level login, alarm continuously while any bypass is active, log who set it and when, and clear them automatically on a time limit or on the next stop.