Implementing E-Stop and A+/A- Interlock in Siemens LOGO! 8

1. Overview

This reference documents how to implement a software emergency-stop (E-stop) and an A+/A- mutual-exclusion interlock in a Siemens LOGO! 8 controller using LOGO!Soft Comfort. The pattern is the classic one-direction-at-a-time permissive interlock, in which two outputs (A+ and A-) must never energise together. It is built around three ideas: a positively-driven hardware E-stop, a latched Run-Enable, and cross-coupled direction permits that prevent Q1 and Q5 from being high in the same scan.

The article separates two concepts that are frequently conflated in school and prototyping work:

• A hardware E-stop per ISO 13850 and IEC 60204-1 that physically breaks the power path to the actuators.
• A software E-stop / permissive interlock inside the LOGO! program that drops every output Q when the safety chain opens or when the controller detects a contradictory command (Q1 and Q5 both requested at once).

2. Prerequisites

Before opening LOGO!Soft Comfort, confirm the following hardware and software prerequisites.

Reference documents to keep open while building:

• Siemens LOGO! product page
• Siemens Industry Online Support (search for "LOGO!")
• ISO standards portal (for ISO 13850, ISO 13849-1)
• IEC standards portal (for IEC 60204-1, IEC 60947-5-1)
• ABB Emergency Stops and Pilot Devices

3. Safety Boundary: Hardware E-Stop vs. Software Permissive Interlock

ISO 13850 and IEC 60204-1 require the emergency-stop function to override all other commands, bring the machine to a defined safe state, and remain active until a manual reset is performed. The physical interruption is done by an E-stop device with at least one positive-opening NC contact (per IEC 60947-5-1, Annex K) wired in series with the contactor coils or the safety relay's input loop.

A LOGO! can supervise that chain (read the NC contact on an input, react to its opening, latch a fault, prevent re-start), but it cannot replace the chain. If the only thing standing between a moving axis and an operator is a transistor output of the LOGO!, the design does not meet category 1 or higher. Categories 3 and 4 require two-channel monitoring, cross-fault detection, and a certified safety relay such as a Sirius 3SK or a Pilz PNOZ, not a LOGO!.

Typical wiring topology for a category 1 / PL c arrangement:

The red wire carries the contactor-coil current; the E-stop NC opens it directly. The blue taps let the LOGO! see the same status on input I1 so the program can latch a fault flag (M2), drop Run-Enable (M1), and prevent a re-start until the reset pushbutton is pressed.

4. The A+/A- Mutual-Exclusion Problem

A common school assignment and a frequent real-world fault is the A+/A- interlock: two outputs (here Q1 = A+ forward, Q5 = A- reverse) must never be ON at the same time. If they are, two contactors in the same motor power stage close simultaneously and short the phase-to-phase or DC-bus through the motor windings. The user asked specifically how to interrupt all signals going to a Q when the conflict is detected.

The accepted pattern is:

1. Latch a Run-Enable flag with a Set/Reset flip-flop (SR in FBD).
2. Drive the Set input from the start pushbutton edge plus the E-stop OK and an overload-free condition.
3. Drive the Reset input from the E-stop, the overload, or a self-detected Q1 ∧ Q5 fault.
4. Cross-couple the direction permits: A+ = Enable ∧ Fwd ∧ ¬A- running; A- = Enable ∧ Rev ∧ ¬A+ running.
5. Read back the actual Q status, not the requested command, to defeat a welded-contact fault.

Read-back uses the LOGO! flag Ni (network input) or a real input wired to an auxiliary contact of the contactor. The latter is the only method that meets ISO 13849-1 PL c or higher, but for school work the read-back from the same output variable is acceptable and is what is implemented below.

5. Step-by-Step FBD Implementation in LOGO!Soft Comfort

Open LOGO!Soft Comfort, create a new project, select the base module (for example 6ED1052-1MD08-0BA1) and choose the FBD view. The complete network uses two SR flip-flops, three AND blocks, one OR, one Pulse Relay, two edge detectors, and two on-delay timers.

5.1 I/O Allocation

5.2 Building the E-Stop and Overload Health Bar

Drop a 4-input AND block (Constants/Connectors → &:4) or two cascaded 2-input ANDs. Wire I1 (E-stop) and I6 (overload) to its inputs. The output B001 is high only when both permissive conditions are met. Reserve the remaining two inputs for a thermal cutout and a guard interlock so the function block does not have to be re-drawn later. Do not invert the inputs: the NC contact drives a TRUE when the safety chain is closed.

5.3 Run-Enable Latch (M1)

Insert an SR flip-flop from the Flip-flop folder. The S input is driven by the start pulse, the R input by any fault condition, and the output goes to flag M1.

S logic. Place a Pulse Relay (mode = rising-edge triggered, no off-delay) and wire I2 to its trigger input. The relay converts the momentary pushbutton to a one-shot high pulse, defeating contact bounce and the held-button case. AND the pulse output with NOT(M_fault) so a start cannot re-latch a fault that has not been acknowledged.

R logic. OR together M_fault, NOT(B001), and the conflict detector output. Use a 4-input OR (B004). When any of those goes high the latch drops and stays dropped until S is re-pulsed AND the fault has been acknowledged.

5.4 Fault Latch (M2)

The fault latch distinguishes "fault present" from "fault acknowledged". Use a second SR flip-flop. The S input is the OR of the rising edge of NOT(I1), the rising edge of NOT(I6), and the rising edge of (Q1 ∧ Q5). Wrap each in an Edge-Triggered block so a static low input does not continuously re-set the latch.

The R input is the rising edge of I3 (reset pushbutton). Edge evaluation guarantees that the operator must press reset to clear the fault; tying I3 high does not bypass the latch, which matches ISO 13850 §4.4.3 on manual reset.

5.5 Cross-Coupled Direction Permits

For A+ (Q1) use a 3-input AND. Inputs are M1 (enable), I4 (forward command), and NOT(Q5). For A- (Q5) mirror the logic with I5 (reverse command) and NOT(Q1). Connect the AND outputs to Q1 and Q5 respectively.

This is the "all signals to a Q" interrupt: the moment Q5 goes high, the NOT(Q5) input to the A+ AND goes low, the AND collapses, Q1 drops within one LOGO! scan. The same happens in the opposite direction. The cross-coupling is the program-level equivalent of the mechanical electrical interlock that lives between two contactors in a reversing starter.

5.6 Conflict Detector

Drop a 2-input AND with Q1 and Q5. Even though the cross-coupling should prevent both from being high, welded-contact or scan-order edge cases can still produce a one-scan conflict. Wire the AND output to the edge-triggered input of the fault-latch S. This latches the fault, the latch resets M1, and both contactors drop within one LOGO! cycle (basic unit default scan ≈ 50 ms; configurable down to ≈ 10 ms on the fast-scan basic units).

6. Alternative: Ladder Diagram View

LOGO!Soft Comfort can render the same network as a ladder diagram. Convert with View → LAD. The rung structure is:

Rung 1:  | I1 ]--[ I6 ]-------------------------------( edge + TON -> B001 )
Rung 2:  | I2 ]--[edge]--[ /M_fault ]----------------( S of M1 latch )
Rung 3:  | M_fault ]--[ /I1 ]--[ /I6 ]--[ Q1∧Q5 ]----( R of M1 latch )
Rung 4:  | /I1 ]--[edge]---/
        + | /I6 ]--[edge]---OR--( S of M2 fault latch )
        + | Q1 ]---[ Q5 ]---[edge]/
Rung 5:  | I3 ]--[edge]-------------------------------( R of M2 fault latch )
Rung 6:  | M1 ]--[ I4 ]--[ /Q5 ]----------------------( Q1 )
Rung 7:  | M1 ]--[ I5 ]--[ /Q1 ]----------------------( Q5 )

LOGO!Soft Comfort evaluates rungs top-to-bottom each scan, so the order in which rungs 6 and 7 appear matters. Both Q1 and Q5 read back the output from the previous scan, so the cross-coupling is race-free even when both rungs are written in the same block. If the project uses the fast-scan setting, the maximum time between an unsafe combination forming and the program reacting is two scan cycles, well under the contactor dropout time of 20–30 ms.

7. Parameter Reference Table

8. Reset, Acknowledge, and Bounce Filtering

The E-stop pushbutton and the overload relay are both NC contacts that bounce for 5–20 ms on release. Insert a TON (on-delay) on I1 and I6 of 30–50 ms so the input is stable before the edge detector sees a transition. A 100 ms TON on the start input I2 prevents an over-eager operator from double-pulsing the start.

The reset pushbutton I3 must be edge-evaluated. If it is held high after a fault, the SR flip-flop would be permanently reset and the next fault would not latch. With a rising-edge trigger, the operator must release and re-press I3 to acknowledge a new fault, which matches ISO 13850 §4.4.3 on manual reset.

For retained flags (M1, M2) set the retention bit in the block properties. The retention only takes effect if the LOGO! has a battery option or the super-cap is charged. On a power cycle, M2 should power up in the latched state so the operator must re-acknowledge, not in the cleared state.

9. Verification and Commissioning

Commission the program in five deliberate steps, recording the result of each on a sign-off sheet.

1. Simulation in LOGO!Soft Comfort. Press F5 to start the simulator. Force I1 = 0 and confirm Q1 and Q5 stay low. Force I2 = 1 momentarily and confirm M1 latches, but no Q energises without I4 or I5. Force I4 and I5 simultaneously and confirm Q1 and Q5 never go high together; the M2 fault latches and M1 drops within one scan.
2. Online monitor with the real LOGO!. Connect via Ethernet, click Online → Start Online Test. The screen shows the live state of every input, output, flag and block. Verify the contactor pull-in and drop-out times visually with a voltmeter on the coil terminals.
3. Hardware E-stop actuation. With outputs idle, press the real E-stop. K1 and K2 must drop within the contactor dropout time (typically 20–30 ms). The LOGO! input I1 must read 0, M2 must be latched, and Q1 and Q5 must remain 0.
4. Reset sequence. Release the E-stop, observe I1 returns to 1. Press I3 once; M2 clears. Press I2; M1 latches. Press I4; Q1 energises within one scan. Release I4, press I5; Q5 energises only after Q1 drops.
5. Conflict forcing. With a software override, briefly force Q1 and Q5 to energise in the same scan by tying I4 and I5 high at the same instant. The M2 fault must latch and both outputs must drop within one cycle. Document the recovery procedure.

The sign-off sheet should capture: firmware version (read from LOGO! → Tools → Diagnostics → Device Info), program name, hash of the .lsc file, and the date. Archive the file under version control so any later modification is traceable.

10. Troubleshooting Matrix

11. Frequently Asked Questions