PLC State Machines, PackML, Interlocks and Fault Recovery in TwinCAT

Separate modes, states and process steps

A mode defines the permitted way of operating: production, manual, maintenance, setup or another site-specific mode. A machine state describes the lifecycle condition such as stopped, starting, execute, stopping, held or aborted. Process steps describe the detailed work performed inside an executing module.

Keeping these concepts separate avoids state explosions and makes permissions clear. Manual movement may reuse the same device function blocks as automatic production while applying different command sources and interlocks.

Permissives and interlocks need ownership

A permissive is a condition that must be true before an action begins. An interlock is a condition that can prevent or stop an action while it is running. Each should have a named owner, a clear polarity and an operator-readable reason. Do not hide critical permissions in long expressions repeated across several POUs.

Build an interlock summary structure for each module. The sequence asks the module whether it may start; the module reports which condition prevents it. This design supports both deterministic control and useful HMI diagnosis.

Design fault handling as a sequence

1. Detect and timestamp the initiating condition.
2. Move outputs and motion to the defined response state.
3. Latch the diagnostic information required to understand the event.
4. Prevent inappropriate commands while the fault remains active.
5. Verify reset conditions and acknowledge the event.
6. Return through a defined recovery path rather than jumping into the middle of production.

Where several faults follow one event, preserve the first-out cause. A cascade of secondary alarms should not hide the input, drive, pressure or communications event that initiated the stop.

Apply PackML at the right boundary

PackML is useful for consistent state naming, command semantics, production reporting and integration across machines. The machine state model can coordinate internal modules without forcing every valve, axis or sensor to implement the whole PackML state set.

Map site or line commands deliberately and document deviations. Define how held, suspended, stopped and aborted differ on the actual equipment, including energy state, retained material, restart conditions and operator actions.

Acceptance tests

• Invalid commands are rejected in every mode and state.
• A stop, hold and abort during each critical step produces the specified output state.
• Loss and restoration of an interlock cannot create an uncontrolled restart.
• Reset is impossible while the initiating condition remains active.
• First-out fault, event time and affected module are retained.
• Power cycle, PLC restart and communications recovery lead to a defined state.