Learn Automation with MINATA #64: Interlocks and Permissives — Permission to Start Against a Reason to Stop
Interlocks and Permissives: Permission to Start Against a Reason to Stop
A permissive and an interlock are both conditions, but they answer two different questions. Keeping them apart makes the logic testable, lets the HMI explain itself, and prevents one general "safety bit" being pressed into service for everything.
Two different questions
- A permissive answers: "May this start?" Air pressure sufficient, no panel fault, guard door closed. A permissive is checked before starting.
- An interlock answers: "While running, which condition must prevent or stop the action?" An interlock watches during operation and intervenes when the condition is lost.
The same signal can serve both roles, but the consequence differs: a permissive blocks a start, an interlock stops something already running.
List them per motion
For every hazardous motion, write down:
| Item | Content |
|---|
| Hazard | Trapped hand, collision, falling load |
| Condition before starting | Which permissives must be true |
| Condition to maintain | Which interlocks watch while running |
| Response if the condition is lost | Stop, hold, safe state |
| Recovery | What the operator does to run again |
Do not replace a risk assessment with software interlocks
Adding a row of interlocks to a PLC generally does not substitute for a properly rated safety function. Hazards to people are handled by safety devices and an architecture matched to the assessed PL or SIL. Interlocks in the ordinary PLC usually protect the process and the equipment — they complement the safety system, they do not replace it.
A worked engineering situation
A press station has the permissive "air pressure sufficient, guard closed, no fault" before Start is allowed. While running, an interlock watches the position sensor: if the part drifts outside the permitted zone, the pressing motion is blocked and the machine goes to its safe state, with the HMI naming the interlock that acted. Hazards to people remain protected by their own dedicated safety circuit.
The list of permissives and interlocks, and the responses, all follow the risk assessment and the applicable standards.
Common mistakes
- Merging permissives and interlocks into one general "safety bit".
- Checking conditions only at Start, with no monitoring while running.
- Replacing a safety function for people with an ordinary PLC interlock.
- An interlock acting while the HMI never says which condition was lost.
- No defined recovery after an interlock has stopped the machine.
Interlock and permissive checklist
- [ ] Permissives and interlocks are listed separately for each motion.
- [ ] Conditions are monitored while running, not only checked at Start.
- [ ] Hazards to people are covered by a rated safety function, not PLC logic alone.
- [ ] The HMI names the condition that was lost.
- [ ] The recovery path after an interlock stop is defined.
Separating permission from prohibition is what makes machine logic explainable. #65 goes into manual and automatic modes, and transferring between them without a bump.
Read more automation knowledge at MINATA: https://minatavn.com/en/blog/industrial-automation
Previous — #63: Sequential programming with SFC: https://minatavn.com/en/blog/automation-63-sequential-programming-sfc
Next — #65: Manual, automatic and bumpless transfer: https://minatavn.com/en/blog/automation-65-manual-auto-bumpless-transfer
View all MINATA technical articles