The Machine That Restarted by Itself: Control Circuit Logic, Not a Ghost
A packaging line that restarted itself after a power blip. The operator pressed stop, went to clear a jam, and the machine started cycling again while he was inside the guard. Nobody pressed start. The emergency stop worked. The stop button worked. But after a brief power dip, the PLC restarted and the machine resumed its cycle. This is a safety circuit design error.
What happened
The PLC’s program started the cycle automatically when the PLC powered up. The logic was: “if the start button is not pressed, and the cycle is enabled, start the next cycle.” After the power blip, the PLC rebooted. The cycle-enable relay was still held (it’s a latching relay that doesn’t drop out during a short power dip). The PLC saw “cycle enabled” and started the machine. The operator was inside the guard.
This is a classic safety hazard. The machine must not restart automatically after a power interruption. The operator must explicitly press start after any power loss.
The design rule
The PLC’s power-up routine must NOT start the cycle. On power-up, the PLC should be in a safe state: no outputs energized, no motion, waiting for an explicit start command. The operator must press start (or reset) to begin.
| Circuit design | After power blip | Safe? |
|---|---|---|
| Cycle enable relay latches through power dip | Machine restarts automatically | No |
| Cycle enable drops out on power loss | Machine waits for start | Yes |
| PLC outputs forced off on power-up | Machine safe, no motion | Yes |
| Reset button required after power loss | Operator must acknowledge | Yes |
What we changed
1. Drop the cycle enable on power loss. We added a control relay that drops out when the control power is lost. The PLC sees the relay as an input. On power-up, the relay is open. The PLC won’t start the cycle until the operator presses start, which energizes the relay.
2. PLC outputs off on power-up. We set the PLC’s power-up state to all outputs off. The servo enables, the valve solenoids, the motor starters — all off. The machine doesn’t move until the PLC explicitly turns them on, which requires the start command.
3. Reset button after any fault. After a power loss, a fault, or an e-stop, the operator must press the reset button before start is allowed. This forces an acknowledgment. The machine doesn’t silently resume.
The safety relay
For a production machine, the safety circuit (e-stop, guard interlock) should use a safety relay (not just a standard relay). The safety relay has redundant channels. If one channel welds, the other channel still opens the circuit. The safety relay also monitors itself — if an internal fault is detected, it won’t allow the machine to run.
The machine that restarted itself had a standard control relay, not a safety relay. We upgraded to a safety relay (dual-channel, forced-guided contacts). The e-stop and guard interlock now go through the safety relay. If the guard opens, the safety relay drops out. It requires a manual reset. The machine can’t restart until the operator acknowledges.
The power-up check
Every machine we build now has a power-up test: kill the power, restore it, and verify the machine doesn’t move. The operator must press reset, then start. This is part of the FAT (factory acceptance test). If the machine restarts automatically, it’s not shipped.
The safety rule: A machine must never restart automatically after a power interruption. The PLC must boot into a safe state (all outputs off). The cycle enable must drop out. The operator must press reset and start. Use a safety relay (dual-channel) for the e-stop and guard interlock. A machine that restarts on its own is a safety hazard, not a nuisance.
