Put all eight permissives in one series rung that decides the run, and add one diagnostic rung per input that writes a fault number to one register: 0 means no fault, 1 to 8 name the failed input. The HMI and SCADA read that register. Keep the register out of the run decision, and test the mapping with all eight inputs before the season starts.
Eight permissives have to be true before a 100 hp irrigation well starts, and any one of them going false has to stop it. The structure that does both jobs cleanly uses two kinds of rungs. One series rung decides the run. One diagnostic rung per input writes a fault number to a single register that the HMI and SCADA read. All eight permissives on one rung is not bad programming; the series rung is the right way to decide. What it cannot do is say which contact opened. That reporting job belongs to eight small diagnostic rungs and one register. This page builds them in order, works an example, and tests the mapping before the season starts.
One rung decides, one rung per input reports
A permissive is a contact that allows operation only while its physical condition is healthy; when the condition is lost, the contact opens and interrupts the circuit. Eight permissive contacts in series make an AND: the well-enable coil is on only while every contact conducts.
That rung decides well and reports nothing. When it drops you know at least one of eight conditions failed, and nothing more. Maintenance then traces the chain by hand or opens the project to find it.
Diagnostic rungs answer the question. Rung 1 writes a 1 to the fault register when input 1 is false. Rung 2 writes a 2 when input 2 is false and input 1 is true. Rung i writes i when input i is false and inputs 1 through i-1 are all true. When several permissives are down at once, the lowest number wins and the register never fights over its value. A tenth rung writes 0 when all eight are true, so 0 always means no fault. Control-system texts treat the permissive, the interlock and the fault as three separate configurations, and the split exists for exactly this reason; the page on configuring sequence permissives, interlocks and faults walks the same separation from the sequence-logic side.
Keep the register out of the enable rung. An enable condition of "register equals 0" reads neatly, but it reverses the failure direction. If a diagnostic rung or the write to the register fails, a 0 becomes permission to run with a permissive still false. With the series rung deciding the run, a register problem can only misreport a fault, never grant one. A PLC scan reads the inputs, solves the rungs and writes the outputs every cycle; a program of ten rungs solves in a few milliseconds. The register holds the new number by the end of the scan that saw the input fail.
What you need
- A written permissive list: each of the eight conditions (phase condition, valve position, control voltage and the rest), its input address, its healthy state, and its field wire label. Take addresses from your project and check each one against the cabinet wiring. Decide per input what "true" means, because a normally closed field contact often reads true in the healthy state. The sensor's name alone does not give you the polarity.
- One holding register for the fault number.
- An HMI message list with nine rows: row 0 for the healthy text, rows 1 to 8 for the fault texts, in the same order as your numbering.
- A SCADA point mapped to the same register.
- Short rung comments on all ten rungs, plus a printed I/O list in the cabinet whose line numbers match the fault numbers.
Build the rungs in this order
- Number the permissives 1 to 8 in a fixed order and put that order on the printed I/O list. Give the lowest numbers to the conditions your operators most need named first, because the lowest number wins a tie.
- Write the enable rung: eight permissive contacts in series driving the well-enable coil, plus the start, stop and seal-in contacts your motor circuit uses. The coil is on only while all eight are true.
- Write diagnostic rung 1: a contact that conducts when input 1 is false moves the value 1 into the fault register.
- Write diagnostic rungs 2 to 8 on the same pattern: rung i carries a qualification contact for each lower-numbered input. Rung 2 carries one (input 1 true) and rung 8 carries seven (inputs 1 to 7 true). Each rung moves its own number.
- Write the zero rung: all eight permissive contacts in series moving 0 into the register. No diagnostic rung can be true on that scan, so the two writes never conflict.
- Map the display side: a numeric object on the register, alarm text rows 1 to 8, and the SCADA point on the same word. Keep row numbers, register values and I/O list line numbers identical.
- Add first-out latching only if you must know which input tripped first: a second register or a set-dominant latch takes its number on the first diagnostic rung that fires and clears only from a reset that requires all eight permissives true plus an operator command. Leave the live register running for the banner and SCADA.
Example: the valve position switch opens with the pump running
Take a 100 hp well with the permissives numbered 1 phase condition, 2 control voltage, 3 discharge pressure, 4 valve position, 5 seal watertight, 6 motor temperature, 7 source level, 8 flow proved. The pump is running, the register reads 0, and the HMI poll is set at 250 ms.
Mid-cycle the valve limit switch opens. On the next scan the input bits read 1, 1, 1, 0, 1, 1, 1, 1.
- Enable rung: 1 AND 1 AND 1 AND 0 AND 1 AND 1 AND 1 AND 1 = 0. The well-enable coil drops, the starter coil follows it, and the contactor releases in tens of milliseconds once its coil voltage is gone.
- Rungs 1 to 3: their inputs are true, so none fires. Rung 4: input 4 false and inputs 1 to 3 true on this scan, so it moves 4 into the register. Rungs 5 to 8 are each blocked by the qualification contact on input 4. The register goes from 0 to 4.
- Zero rung: not all eight true, so it stays out.
- The HMI poll picks up the 4 within one 250 ms cycle and shows row 4, "VALVE POSITION NOT PROVED". The SCADA point reads 4.
Close the switch again and the next scan reads all ones; the zero rung moves 0 in, the enable coil pulls in, and the banner clears. If the phase monitor had dropped at the same instant, the register would read 1: rung 1 fires and rung 4 is blocked by its qualification contact on input 1. Both conditions still hold the series rung false; the single number shows the higher-priority one.
How to check it worked
Test with the pump stopped and the motor circuit safe to work on.
- Match the inputs to the field devices first: actuate each device where it is safe to do so, or open the field wire at its terminal and set the state you want, and confirm the PLC input bit changes with it. Do this for all eight before trusting any diagnostic rung, because one swapped or inverted input makes the register lie.
- Drop one permissive at a time and confirm the banner shows the matching row number: eight tests, one per input.
- Drop input 1 together with any other and confirm the lower number wins.
- Restore all eight and confirm the register returns to 0 and the enable coil is true again.
- Switch the HMI off, or unplug its communication link, and repeat one fault test: the register and the enable coil must behave identically with no screen attached, because the run decision reads inputs, not the display path.
If the numeric object stays blank while the register holds a number, the fault is in the display mapping, usually the tag address; HMI numeric display shows nothing: check the tag address first walks that check in order.
Choose the reporting behavior
| Behavior | What the register holds | Watch out for |
|---|---|---|
| Priority number, the build above | One live value from 0 to 8, lowest active number wins | A second active fault stays off the banner, and both still hold the enable rung false |
| A live bit or state per input | The full list of what is down right now | One tag and one screen line per input, and nothing says which tripped first |
| First-out latch | The number that tripped first, held until reset | Needs a written reset rule; keep the live list on a second screen |
For the live list, a status screen with one lamp per permissive reads fastest at the cabinet door; display 16 PLC input and output bits on one screen shows the layout. A first-out value needs a reset rule that holds from every path that can trigger it; run reset logic when an HMI pop-up closes by any path covers the same trap from the screen side.
Keep it understandable in your absence
Ten rungs with short comments beat five rungs with none. Comment the enable rung, every diagnostic rung ("valve position lost, writes 4"), and the zero rung. Keep tag names matching the I/O list. Keep the printed list and wire labels inside the cabinet door. A program a stranger reads in ten minutes is the target, and rung count is a poor measure of that.
If the office wants a wall board too, make it a notice screen for things that change slowly. The live fault number belongs on the HMI, and the shop-floor screens we build are playback screens, not a second interlock display.
Recommendation: For an eight-permissive well controller, build one series rung that decides the run, eight diagnostic rungs that write 1 to 8 into one fault register, and a zero rung that writes 0 while all eight are true, with the HMI message rows matching those numbers one for one. Add first-out latching only when you need the initiating fault, and reset it only after all eight permissives are true again.
The eight permissives above are process conditions. The 100 hp motor still needs overload, short-circuit and ground-fault protection in its motor-circuit hardware, as the electrical code in your jurisdiction requires. That protection lives in the starter and the branch circuit. A rung, an HMI banner or a SCADA point does not provide it. Where the stop also has to serve an emergency function, the two paths belong on separate drawings, and ESD interlocks and DCS permissives on a motor control diagram shows how the drawings keep them apart.
Questions
Can the fault register drive the enable rung instead?
It can, and a register equal to 0 is a compact enable condition. The failure direction is the problem: a diagnostic rung that never fires leaves 0 sitting in the register, and that 0 becomes permission to run with a permissive still false. If your reviewer requires this structure, force-test all eight diagnostic rungs at commissioning so you know each one writes, and repeat the test after any program edit.
What shows on the banner when two permissives fail at once?
With the priority scheme the lowest number wins: a false input 1 hides a simultaneous input 4 fault in the single-number register, while both conditions hold the series rung false and the pump stays stopped. If maintenance needs the full picture, put each permissive's live bit on a separate status screen, or add a first-out latch that freezes the number that tripped first until reset.
Where do the fault numbers come from?
You assign them. Zero for no fault works well because it is unambiguous at power-up and simple to test for. Number the permissives 1 to 8 in a fixed order on the printed I/O list, make the HMI message rows match that order exactly, and give SCADA the same register. Document each value's meaning next to the rungs that write it, and never reuse one number for two conditions.
Planning information, not legal or engineering advice. Rules differ by place: check codes and permits with your local authority and your licensed trades.