Motors and valves in practice: permissives, feedback and travel time

Permissive or interlock?

The two words get used interchangeably on site, and that is an expensive mistake. The difference is when each one is checked:

Mix them up and you get either a motor that drops out for no reason because a start permissive went away mid-run, or a safety interlock that is ignored because it was only checked at the start. The second one hurts people.

Run feedback, and why it needs a timeout

You commanded the pump. Did it run? A digital output means the PLC asked, not that the shaft turned. Proof of running is run feedback: a contactor auxiliary contact, a flow switch, or a status word from the drive.

The right structure is: commanded, waited a sensible time, no feedback, therefore failed to start.

FbkDly(IN := CmdRun AND NOT RunFbk, PT := T#3s);
IF FbkDly.Q THEN
  FailStart := TRUE;
END_IF;

Three seconds suits a contactor; a large star-delta motor may want 8 to 12. The same timer also catches loss of feedback while running, which is what happens when the overload trips with the run command still on.

Trip reset

A latched fault does not clear itself, and it does not clear from the start button. Reset clears the fault and does not start. One press to clear, a second press on start to run. That means whoever pressed reset looked at the machine before starting it, which is the whole point.

Valves: travel takes time

A valve is not a digital output. You command it and it begins to move, and moving takes one to thirty seconds depending on size and actuator.

• With position feedback: two limit switches, ZSO and ZSC. The timeout is the stated travel time plus margin, typically 1.5 times. No limit switch at the end means a "failed to open" fault.
• Without position feedback: do not pretend you know the position. Use a timer as an estimate and name the variable VlvAssumedOpen, not VlvOpen.
• Impossible states are faults: both limits made means a failed switch or a shorted wire. Neither limit made after the timeout means the valve stuck mid-travel. Those are two separate faults.

Local and remote

The local/remote selector is not decoration, it is the basis of maintenance work. In local, the field station has control, and the PLC must be prevented from starting the motor even if SCADA asks. Interlocks still apply: local grants start authority, never the right to defeat safety.

And remember: a safety stop never goes through the PLC. The mushroom button, the pull-cord and the safety relay are wired into the contactor circuit directly, or into a certified safety controller. The PLC reads that the stop is active so it can display and log it. It is not relied on to do the stopping.

The lamp tells the state

Three states from one lamp: off means stopped, flashing means commanded with no feedback yet, steady means confirmed running. A technician reads that from across the room.