PLC Startup Response

The purpose of the PLC startup response is to establish the proper control-program state when execution resumes after electrical power to the PLC has been restored, so recovery can proceed deliberately from the power-loss condition.

PLC startup is a program event regardless of why the controller stopped executing. Electrical power may have been lost to the complete machine, power may have been lost only to the PLC, or someone may have deliberately cycled PLC power. The control program cannot assume which of these conditions caused the startup.

The PLC Pro™ must therefore use startup itself to establish the proper control-program state. Most PLC platforms provide a First Scan indication or equivalent startup mechanism, and one can be created when one is not provided. This initialization must occur immediately as program execution begins and cannot depend on first detecting E-Stop Mode or another external machine condition.

One of the first startup actions is to reset Auto Mode, regardless of the condition that caused the PLC to restart. PLC startup must never restore automatic operation merely because Auto Mode was active before program execution stopped.

Startup must account for the relationship between the control-program state and the actual or defined physical state of the equipment. When power loss, E-Stop, or another de-energizing condition causes equipment to assume a known state, the PLC Pro must determine whether the corresponding requests and state indications should be cleared, retained, or deliberately re-established as recovery proceeds.

For example, suppose a spring-return cylinder retracts when its valve is de-energized. When the PLC starts again, the cylinder may be retracted even though an extend request existed before power was lost. If extending the cylinder during recovery could create a hazard or other unacceptable condition, that request needs to be removed. If returning the cylinder to its previous position is acceptable and intended, the program may instead allow that action when the required recovery conditions have been satisfied.

Other retained or latched states that can request or authorize equipment operation require the same deliberate evaluation. Sequence states, equipment requests, supporting-service requests, and similar remembered operating conditions must be reviewed to determine whether they should be cleared, retained, or re-established as part of startup and recovery.

After the control-program state has been initialized, the PLC Pro must establish the actual condition of the machine before relying on that condition during recovery. The program cannot assume that equipment reached or remained in its expected de-energized state while the PLC was not executing. Stored energy, continuing services, gravity, or other physical conditions may have changed the equipment state, and equipment may also have been moved, adjusted, or otherwise altered while power was unavailable. Field I/O, communications, drives, and other controlled resources may also not be available when program execution begins, so their status cannot be assumed merely because the PLC is running.

When startup follows restoration of power to the complete machine, the safety-related control system will normally establish the machine in its emergency-stop condition, and the PLC program will enter E-Stop Mode when that condition is detected. If only PLC power was cycled and E-Stop is not asserted, resetting Auto Mode during startup causes Manual Mode to be established by definition.

Supporting services may also require deliberate recovery. A hydraulic power unit, vacuum system, pump, or similar service may need to be restarted before normal equipment operation can resume. A retained or latched request for that service must not cause it to start unexpectedly when E-Stop is cleared or another required condition becomes available.

PLC startup does not restore the operating condition that existed before program execution stopped. After the proper control-program state has been established and the required machine conditions and resources are available, recovery proceeds through Manual Mode. Any subsequent request for Auto Mode is then handled through the normal Auto Mode entry requirements.

• Reconcile the control-program state with the actual physical state of the equipment before recovery proceeds.
• Reset Auto Mode during startup regardless of the condition that caused the PLC to restart.
• Use First Scan or equivalent startup logic to perform required initialization immediately as program execution begins.
• Pay particular attention to retained or latched states when reconciling control-program and equipment state.
• Verify that required I/O, communications, drives, and other controlled resources are available before recovery proceeds.
• Prevent retained supporting-service requests from causing unintended operation during recovery.
• Require any later request for Auto Mode to satisfy the normal Auto Mode entry requirements.