9.2 Discrete Control Logic, Sequencing, State Machines & Interlock Implementation

Discrete Control Logic, Sequencing, State Machines & Interlock Implementation

Discrete control logic governs binary industrial devices—such as motors, solenoid valves, pneumatic actuators, limit switches, and diverter gates—transitioning equipment through defined operating states. In Domain 4 (Development), a Certified Automation Professional must design discrete control structures that are deterministic, robust against unexpected power interruptions, and impervious to race conditions.

Ad-hoc, uncoordinated boolean programming produces "spaghetti logic" that is fragile, difficult to commission, and hazardous during abnormal operating situations. Industrial-grade discrete automation requires formal state machine architectures, rigorous interlock classification, fail-safe latching configurations, first-out trip detection, and digital signal conditioning.

---

Finite State Machine (FSM) Architecture in Industrial Logic

A Finite State Machine (FSM) is a mathematical behavioral model composed of a finite number of mutually exclusive states, transitions between those states, and actions. In programmable controllers, implementing an FSM prevents illegal operational states—such as attempting to open a discharge valve before an agitator has stopped or energizing a heater in an empty vessel.

Moore vs. Mealy State Machine Models

Automation engineers must distinguish between the two fundamental state machine topologies:

MOORE STATE MACHINE ARCHITECTURE (Output = g(State)):

           +-----------------+          +----------------+
Inputs --->| Next State      |--------->| Current State  |---+---> Outputs
           | Transition Logic|          | Register (S)   |   |
           +-----------------+          +----------------+   |
                   ^                            |            |
                   +----------------------------+------------+
                               Feedback

-----------------------------------------------------------------------

MEALY STATE MACHINE ARCHITECTURE (Output = g(State, Inputs)):

           +-----------------+          +----------------+
Inputs --+-| Next State      |--------->| Current State  |---+
       | | | Transition Logic|          | Register (S)   |   |
       | | +-----------------+          +----------------+   |
       | |         ^                            |            |
       | |         +----------------------------+            |
       | |                                                   |
       | +------------------\                                |
       |                     v                               |
       +----------------->[ Output Logic ]<------------------+
                                 |
                                 v
                              Outputs

Implementing State Machines in PLC Logic

There are two primary methods for implementing an FSM in modern industrial controllers:

1. Integer State Pointer (The State Register Approach): A single integer or enumerated tag (Current_State : INT) represents the active state. At each controller scan, a CASE statement (in Structured Text) or parallel equality rungs (in Ladder Diagram) evaluates the active state and its allowed transitions:

CASE Current_State OF
    10: (* State 10: IDLE *)
        Agitator_Run_Cmd := FALSE;
        Feed_Valve_Cmd   := FALSE;
        Drain_Valve_Cmd  := FALSE;
        IF Start_Pushbutton AND Permissives_Satisfied THEN
            Current_State := 20; (* Transition to FILLING *)
        END_IF;

    20: (* State 20: FILLING *)
        Agitator_Run_Cmd := FALSE;
        Feed_Valve_Cmd   := TRUE;
        Drain_Valve_Cmd  := FALSE;
        IF Vessel_Level >= Target_Fill_Level THEN
            Current_State := 30; (* Transition to HEATING *)
        ELSIF Abort_Command OR Emergency_Trip THEN
            Current_State := 99; (* Transition to FAULT HOLD *)
        END_IF;

    30: (* State 30: HEATING & AGITATING *)
        Agitator_Run_Cmd := TRUE;
        Feed_Valve_Cmd   := FALSE;
        Drain_Valve_Cmd  := FALSE;
        IF Temperature >= Setpoint_Temp AND Reaction_Timer.Q THEN
            Current_State := 40; (* Transition to DRAINING *)
        END_IF;

    40: (* State 40: DRAINING *)
        Agitator_Run_Cmd := FALSE;
        Feed_Valve_Cmd   := FALSE;
        Drain_Valve_Cmd  := TRUE;
        IF Vessel_Empty_Switch THEN
            Current_State := 10; (* Sequence Complete: Return to IDLE *)
        END_IF;

    99: (* State 99: FAULT HOLD *)
        Agitator_Run_Cmd := FALSE;
        Feed_Valve_Cmd   := FALSE;
        Drain_Valve_Cmd  := FALSE;
        Alarm_Siren      := TRUE;
        IF Fault_Reset_PB THEN
            Current_State := 10;
        END_IF;
END_CASE;

1. Bit-Shift and Drum Sequencers: Historically implemented using bit-shift registers (BSL/BSR) or mechanical drum sequencer emulators (SQO/SQI). While functional for simple fixed-step assembly indexing, drum sequencers are difficult to branch conditionally and lack the diagnostic transparency of integer state registers.

---

Industrial Interlock Categories & Hierarchy

Interlocks are software or hardware constraints that prevent equipment from operating in an unsafe, destructive, or unauthorized manner. A Certified Automation Professional must classify interlocks into their proper operational tiers:

INTERLOCK HIERARCHY:

   Highest Priority:  [ SAFETY INSTRUMENTED INTERLOCKS (SIS / SIL) ]  (Life & Environmental)
                             |
                      [ EQUIPMENT PROTECTION INTERLOCKS ]             (Asset Integrity)
                             |
                      [ RUNNING / OPERATIONAL INTERLOCKS ]            (Process Continuity)
                             |
   Lowest Priority:   [ START PERMISSIVES ]                           (Initial Lineup)

---

Latching and Unlatching Circuits: Seal-in vs. Set/Reset

A critical design decision in discrete ladder logic is choosing between seal-in circuits and Set/Reset (Latch/Unlatch) instructions.

CIRCUIT ARCHITECTURES AND POWER INTERRUPTION BEHAVIORS:

1. CLASSIC SEAL-IN CIRCUIT (Self-Dropping on Power Loss):
   Start_PB       Stop_PB      Overload_Trip
-----] [-----------]/[-------------]/[------------( ) Motor_Run
      |                                            |
      +----] [----+                                |
         Motor_Aux                                 |

--> Power Loss Behavior: Controller loses power -> Output de-energizes.
--> Power Restoration Behavior: Motor_Aux contact is open. Motor CANNOT restart.
    Requires a human operator to physically press Start_PB again.

-----------------------------------------------------------------------

2. SET / RESET COILS (Non-Volatile Retention Hazard):
   Start_PB       Permissives
-----] [-----------] [----------------------------(S) Motor_Run (Latch)

   Stop_PB
-----] [------------------------------------------(R) Motor_Run (Reset)

--> Power Loss Behavior: Controller loses power -> Motor_Run bit state is saved
    in battery-backed / non-volatile memory.
--> Power Restoration Behavior: If Motor_Run was latched TRUE when power dropped,
    the motor WILL IMMEDIATELY ENERGIZE on CPU reboot unless cleared by logic!

The Danger of Retentive Set/Reset Bits

In standard programmable automation controllers, user memory tables are non-volatile (backed by supercapacitors or lithium batteries). When an output is energized via a Set / Latch ((S) / OTL) instruction, the controller flags that internal memory bit as 1.

First-Scan Initialization (S:FS)

If Set/Reset instructions are required, the programmer must implement an unlatch routine executed exclusively on the first program scan using the system first-scan status bit (e.g., S:FS in Rockwell, FirstScan in IEC systems):

(* First-Scan Safety Initialization Routine *)
IF FirstScan THEN
    Motor_Run_Latched := FALSE;
    Heater_Bank_Latched := FALSE;
    System_Operating_Mode := 0; (* Force to Safe Idle *)
END_IF;

In contrast, a seal-in circuit uses the output's own physical or internal contact in parallel with the momentary start pushbutton. When the controller powers down, all outputs drop to 0. When power returns, the auxiliary seal-in contact is open, naturally requiring an operator to press the start button. For this reason, seal-in logic is the industrial baseline for motor controls.

---

Fail-Safe Philosophy: De-Energize to Trip vs. Energize to Trip

Field wiring topologies fundamentally dictate how logic must be programmed. The universal standard for safety-critical and high-reliability industrial control is De-Energize to Trip (Normally Closed).

FAIL-SAFE CONTACT WIRING (De-Energize to Trip):

    +24 VDC Power Supply
          |
          o
           \   Normally Closed (NC) Field Stop Contact (Held closed in normal operation)
            o
          |
          +---------> Physical PLC Input Module Channel (Reads TRUE / 24 VDC under normal run)

--> SCENARIO A: Field Wire Breaks or Terminal Loosens:
    Input drops to 0 VDC (FALSE) -> Logic evaluates as TRIP -> Motor Halts (FAIL-SAFE)

--> SCENARIO B: 24 VDC Control Power Supply Fails:
    Input drops to 0 VDC (FALSE) -> Logic evaluates as TRIP -> Motor Halts (FAIL-SAFE)

• De-Energize to Trip: Field switches (emergency stops, motor overloads, pressure high switches) are physically wired using Normally Closed (NC) contacts. In normal running conditions, continuous 24 VDC current flows through the circuit, and the PLC input bit is TRUE (1). If a field wire breaks, a terminal corrodes, or instrument power is lost, current drops to zero, the input bit becomes FALSE (0), and the PLC immediately executes a shutdown.
• Energize to Trip: Requires a field contact to close and conduct current to initiate a trip. If a wire breaks or power is lost, an emergency condition will go undetected because the circuit cannot deliver voltage to the PLC. Energize to trip is therefore avoided for most personnel-safety and critical shutdown functions. Where it is used (for example, some fire-and-gas or deluge functions in which a spurious trip is itself hazardous), IEC 61511 requires line monitoring and power-supply supervision so that a broken wire or lost power is detected and alarmed.

---

First-Out Alarm and Trip Trap Logic

In complex industrial systems—such as utility boilers, gas turbines, or multi-stage compressors—a shutdown rarely occurs in isolation. When a boiler trips on low drum water level, the sudden flame extinguish triggers immediate cascading trips: low steam pressure, high furnace draft pressure, boiler feed pump trip, and turbine trip—all occurring within 100 to 500 ms.

If the control system simply latches all active alarms, operators entering the control room are confronted with twenty simultaneous alarms and cannot identify what caused the outage.

Trip Trap Implementation

A First-Out Trip Trap locks out subsequent incoming faults the instant the primary initiating fault asserts:

(* First-Out Alarm Trap Logic in Structured Text *)
IF NOT Trip_Trap_Locked THEN
    IF Low_Lube_Oil_Pressure_Trip THEN
        First_Out_Fault_Code := 101; (* Low Lube Oil Pressure *)
        Trip_Trap_Locked := TRUE;
    ELSIF High_Bearing_Vibration_Trip THEN
        First_Out_Fault_Code := 102; (* High Bearing Vibration *)
        Trip_Trap_Locked := TRUE;
    ELSIF Motor_Overload_Trip THEN
        First_Out_Fault_Code := 103; (* Motor Electrical Overload *)
        Trip_Trap_Locked := TRUE;
    ELSIF Emergency_Stop_Trip THEN
        First_Out_Fault_Code := 104; (* E-Stop Actuated *)
        Trip_Trap_Locked := TRUE;
    END_IF;
END_IF;

(* Resetting the Trap *)
IF Master_Trip_Reset_PB AND NOT Emergency_Trip_Active THEN
    First_Out_Fault_Code := 0;
    Trip_Trap_Locked := FALSE;
END_IF;

By evaluating incoming faults in an exclusive branch protected by Trip_Trap_Locked, the control system captures the root-cause trip code (e.g., 101) and ignores the subsequent secondary cascade, eliminating diagnostic ambiguity.

---

Digital Signal Conditioning & Debounce Filtering

Mechanical contacts (pushbuttons, microswitches, float switches, relay armatures) do not make clean, instantaneous transitions. When mechanical switch contacts close, they physically bounce against each other for $2 \text{ to } 20 \text{ ms}$, producing a rapid train of electrical on-off square waves before settling.

MECHANICAL CONTACT BOUNCE VS. SOFTWARE DEBOUNCE FILTERING:

Raw Physical Contact:
         ___   _   _   _____________________________________
________/   \_/ \_/ \_/ (10 ms contact bounce)

PLC Input (Raw):
   00000 1 1 0 1 0 1 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

Filtered Software Output (TON Filter, T#50ms):
__________________________________+-------------------------
                                  |<-- 50 ms Stable High -->|

Software Conditioning Techniques

1. On-Delay Timer Debounce (TON): The raw digital input must remain continuously TRUE for a configured filter window ($T_{\text{debounce}}$, typically 20 to 100 ms) before the conditioned bit is asserted. If the signal bounces or chatters low for even one scan, the timer resets to zero.
2. Off-Delay Timer Anti-Chatter (TOF): Used on sensors that drop out intermittently (e.g., optical photoeyes sensing slotted or perforated cartons). Prevents downstream logic from cycling erratically.
3. Edge-Detection One-Shots (R_TRIG / F_TRIG): In IEC 61131-3, R_TRIG (Rising Edge Trigger) detects a 0-to-1 transition and outputs a boolean pulse lasting exactly one scan cycle. Essential for incrementing part counters, capturing first-out alarms, and latching operator toggle commands without multiple-trigger errors.

---

Realistic Industrial Scenario: Multi-Stage Centrifugal Compressor Interlocks

A chemical manufacturing plant operates a 2,500 hp multi-stage centrifugal feed gas compressor. The automation engineer designs the discrete control logic adhering to the following interlock matrix:

• Start Permissives: Before the lube oil pump and main drive motor can be energized, five permissive conditions must evaluate TRUE simultaneously: (1) Suction block valve open, (2) Discharge bypass recycle valve 100% open (unloaded start), (3) Seal gas buffer differential pressure $> 15 \text{ psid}$, (4) Compressor casing temperature $> 10^\circ\text{C}$ (freeze protection), and (5) Instrument air pressure $> 80 \text{ psig}$. If any permissive drops while the compressor is running, it does not trip the motor.
• Running Interlocks: Continuously monitored. If lube oil pressure drops below 18 psig for more than 500 ms, or if seal gas differential drops below 5 psid, the compressor motor trips immediately.
• Equipment Protection: Radial shaft vibration sensors on three stages. If vibration exceeds $3.0 \text{ mils}$, a warning alarm sounds. If vibration reaches $4.5 \text{ mils}$, a high-speed equipment protection trip shuts down the compressor within 50 ms.
• Latching Circuitry: The lube oil pump and compressor motor use ladder seal-in rungs. During a momentary 480 VAC plant power flicker, the motor contactor drops out. When utility power stabilizes, the seal-in is broken, ensuring the massive machine does not restart unattended.

---

Common Exam Traps

1. Confusing Permissives with Running Interlocks: An exam question will describe an auxiliary condition (e.g., "pre-lube reservoir heater verified warm"). The trap choice will trip the running compressor when the heater turns off during normal running. Remember: Permissives inhibit starting; running interlocks abort active operation.
2. Overlooking Non-Volatile Memory in Set/Reset Coils: Exam items often describe a facility reboot after a total electrical blackout where machinery unexpectedly restarts. The root cause tested is the use of retentive Set/Latch ((S)) instructions without a first-scan unlatch routine.
3. Selecting Energize-to-Trip for Critical Protection: Exam questions will present wiring schematics. Any choice recommending unsupervised normally open (NO) field contacts, where a broken wire silently prevents tripping, is a serious safety error.