Configuring Interlock, Protect, and Permit Inputs with Faceplate Reset on APL VlvL in SIMATIC PCS 7

In the SIMATIC PCS 7 Advanced Process Library (APL), configuring an automated shutdown valve (VlvL) to close on an alarm and remain locked until manually reset requires connecting the alarm logic to the Protect input (Protect / ProtAut), not the standard Interlock input. While an active Interlock forces the valve closed but permits automatic reopening the moment the interlock clears, an active Protect input forces the valve to its fail-safe position and latches the state. Even after the alarm condition vanishes, the valve cannot reopen until an operator clicks 'Reset' on the faceplate (RstOp) or a reset pulse is asserted via RstLi.

APL Interlock Architecture - Permit vs Interlock vs Protect

In process automation plants, configuring emergency isolation valves (such as production separator shutdown valves or feed cutoff valves) requires absolute certainty regarding how interlocks engage, release, and require operator intervention.

Engineers migrating to the SIMATIC PCS 7 Advanced Process Library (APL) frequently encounter confusion when configuring the VlvL (Valve Lean, FB 1899 or FB 1870) block. A common design requirement is: The valve must close when an alarm occurs, and when the alarm returns to normal, the valve must stay closed until an operator deliberately acknowledges and resets the interlock.

Connecting the trip signal to the block's Interlock input fails to meet this requirement because the valve reopens automatically as soon as the alarm condition clears. To implement proper latching shutdown behavior, engineers must understand the distinct roles of the three APL interlock inputs: Permit, Interlock, and Protect.

Why Interlock Auto-Clears While Protect Demands Reset

The APL interlock architecture defines three distinct operational constraints:

1. Permit (`Permit` / `PermAut`)

Function: Defines starting/opening permission.
Behavior: If Permit = 0, an idle valve cannot be opened. However, if the valve is already open and Permit drops to 0, the valve remains open. It provides permissive protection prior to actuation, but does not trip running equipment.

2. Interlock (`Intlock` / `IntlAut`)

Function: Operational process interlocking without latching.
Behavior: When Intlock = 0, the valve is driven immediately to its fail-safe neutral position (typically closed). However, as soon as process conditions normalize and Intlock returns to 1, the block evaluates active control signals. If automatic opening (OpenAut = 1) is still high, the valve immediately reopens without operator intervention.

3. Protect (`Protect` / `ProtAut`)

Function: Interlocking with mandatory reset (Safety/Equipment Protection).
Behavior: When Protect = 0, the valve is driven immediately to its fail-safe position. When process conditions normalize and Protect returns to 1, the block latches the trip state. The valve remains locked in the neutral position. The faceplate enables the Reset button. The valve will never reopen until an operator clicks Reset (RstOp) or logic asserts RstLi.

Comparison Table - APL Protection and Interlock Parameters

The following table details the functional characteristics and behavioral rules of APL interlock pins on VlvL and motor blocks.

Parameter NameFull DescriptionTripping Action When Signal = 0Behavior When Signal Returns to 1Reset RequirementTypical ApplicationPermitOperating PermissionPrevents valve opening; does not close if openValve can now be openedNo reset requiredPump suction valve open check, tank level permissiveIntlockOperational InterlockDrives valve immediately to fail-safe closedValve reopens automatically if OpenAut = 1No reset requiredRoutine process sequencing, pump discharge interlockProtectInterlocking with ResetDrives valve immediately to fail-safe closedValve remains latched in fail-safe positionMandatory Reset (RstOp / RstLi)Emergency shutdown (ESD), separator overpressure trip

Step-by-Step CFC Configuration for Emergency Shutdown Valves

To configure an APL VlvL block for an emergency shutdown valve with mandatory operator reset, execute the following procedure:

Build Interlock Logic Using Intlk02 or Intlk04:
* Do not connect raw boolean trip signals directly to the VlvL block. Use an APL interlock block such as Intlk02 (FB 1824) or Intlk04 (FB 1825).
* Connect process alarm contacts (e.g., High-High pressure, High level) to In01.Value, In02.Value.
* Configure input inversion or direct logic so that a healthy state outputs Out.Value = 1, and a tripped state outputs Out.Value = 0.
Connect Interlock Output to the Protect Pin:
* Interconnect the output of the interlock block (Intlk04.Out) to the Protect input of the VlvL block.
* Verify that the Signal Status propagates correctly (Out.ST connects to Protect.ST).
* Leave Intlock and Permit set to constant 1 with Signal Status 16#80 (Good) if not used for other process interlocks.
Configure APL Feature Bits for Reset Handling:
* Open the block properties of VlvL and inspect the Feature parameter (32-bit DWORD):
- Feature Bit 19: Reset protection / errors via faceplate. Set Feature.Bit19 = 1 to ensure the Reset button appears in the standard faceplate view.
- Feature Bit 30: Reset depending on operating mode. Set Feature.Bit30 = 0 to allow reset in any mode, or 1 if reset is restricted to Manual mode.
- Feature Bit 31: Resetting interlock logic. Ensure proper reset synchronization between Intlk04 and VlvL.
Verify Signal Status Byte (16#80):
* When testing logic with constants or unlinked inputs in CFC, ensure the input Signal Status (.ST) is explicitly configured to 16#80 (Good). An input with ST = 16#00 (Bad) will cause the block to interpret the input as faulted or ignored depending on feature settings.
Compile and Download:
* Execute CFC compile (Scope: Changes only) and download to the CPU in RUN mode.

Verification

Verify shutdown and reset behavior in S7-PLCSIM or online controller:

Verify Normal Valve Operation:
* With all interlocks healthy (Protect = 1), command the valve to open in Manual or Auto. Confirm valve opens (Ctrl = 1).
Trigger Trip Condition:
* Assert the alarm condition (Protect = 0).
* Verify that Ctrl drops immediately to 0 and the valve drives closed.
* Verify that the WinCC faceplate indicates Protection interlock active (padlock icon).
Clear Trip Condition:
* Clear the alarm condition so that Protect returns to 1.
* Verify that the valve does not reopen, and Ctrl remains 0.
* Verify that the Reset button appears on the WinCC faceplate.
Execute Reset:
* Click Reset on the faceplate.
* Confirm that the padlock icon clears. In Manual mode, the valve remains closed until commanded; in Auto mode (with OpenAut = 1), the valve cleanly transitions to Open.

Limitations and Operational Precautions

Signal Status Trap during Simulation: In PLCSIM, writing a boolean 0 or 1 to Protect.Value without updating Protect.ST to 16#80 causes the block to reject the signal as invalid. Always verify that .ST is set to 16#80.
External Reset Logic (RstLi): If field pushbutton panels must also reset the shutdown valve, connect a positive-edge pulse to RstLi.Value (along with RstLi.ST = 16#80).
Intlk04 Bypass Tracking: If using an Intlk04 block with maintenance bypasses enabled, ensure safety protocols govern who has permission to set bypasses, as bypassed inputs will not trip Protect.

Engineer FAQ

Why did the Reset button only appear during feedback errors in my test?

By default, actuator runtime feedback errors (e.g., valve failed to close within dynamic monitoring time) automatically trigger a reset requirement. Interlocks only demand a reset if connected to the 'Protect' input, not the 'Intlock' input.

Can I use an external RS flip-flop block instead of the Protect input?

While an external RS flip-flop can latch an interlock, doing so bypasses the built-in APL faceplate diagnostics. The operator will not see the standard APL protection padlock icon or native Reset button on the faceplate.

What is the difference between VlvL and VlvS in APL?

VlvL (Valve Lean) is designed for standard 2-way open/close valves with full interlock support. VlvS (Valve Small) is a highly simplified block designed for tight memory constraints with reduced interlock and messaging features.

Does Protect work the same way on motor blocks like MotL and MotSpdCL?

Yes. The Permit, Intlock, and Protect architecture is standardized across all APL control modules, including MotL, MotRevL, MotSpdCL, and VlvMotl.

Technical References

Related Tags

APL
VlvL
Interlock
Protect
Faceplates
Reset-Logic

Configuring Interlock, Protect, and Permit Inputs with Faceplate Reset on APL VlvL in SIMATIC PCS 7