What Is an Interlock?
Logic That Enforces Safe Conditions
An interlock is the automation system's way of saying no - or you must do this first. It is logic that prevents an unsafe or invalid action and forces protective action when conditions demand it. Interlocks are how a plant stops a compressor from starting without lube oil pressure, or trips a well on high pressure. This guide explains what interlocks are, the difference between permissives and trips, and how they relate to safety systems.
Interlock in one line: An interlock is control logic that blocks or forces an action based on process conditions to protect people and equipment - for example, preventing a pump from starting until suction pressure is adequate, or shutting a system down when a limit is exceeded.
Permissives and Trips
Interlocks come in two broad flavors. A permissive is a condition that must be true before an action is allowed - the system will not let you do something until it is safe. A compressor start permissive might require adequate lube-oil pressure, closed guards, and no active shutdowns; fail any and the start command is blocked. A trip (or protective interlock) forces action when a condition goes bad - high-high pressure, low-low level, high vibration - by shutting down equipment or closing valves to reach a safe state, regardless of what the operator commands.
Both are usually expressed as logic in the controller: combinations of discrete inputs (switches, status) and analog comparisons (a measurement crossing a limit) that enable or block outputs. Interlocks are why you cannot simply energize any output at will - the logic enforces the plant's safe operating envelope.
Interlocks and Safety Systems in Oil and Gas
Not all interlocks are equal. Ordinary process interlocks live in the standard control PLC and protect production or equipment. Safety interlocks that protect against hazards to people or major loss - part of a Safety Instrumented System (SIS) or Emergency Shutdown (ESD) system - are engineered to a higher standard, often on separate, certified safety controllers with a defined Safety Integrity Level, so a control-system fault cannot defeat them.
In oil and gas, interlocks and ESD logic are pervasive: high-pressure shut-in of a wellhead, level trips on separators and vessels, fire-and-gas actions, and pump and compressor protections. The intended interlock behavior is documented in the control narrative and verified during acceptance testing. SCADA typically monitors and annunciates interlock and trip status so operators can see what tripped and why, while the interlock logic itself executes in the local controller for speed and reliability - it must act in a fraction of a second and cannot depend on a network link.
Where Interlocks Are Documented
An interlock exists in three places at once: in a hazard study that justified it, in a document that specifies it, and in controller logic that implements it. The specification usually takes the form of a cause and effect matrix - causes down one axis, effects across the other, with a mark wherever a condition drives an action - supported by the control narrative that explains intent in prose. Together they are the contract the logic must honor, and acceptance testing walks that matrix row by row to prove the code matches.
The quiet failure mode is drift between the paper and the code. A trip setpoint changed during startup, a bypass added during a debottleneck, an effect quietly removed because it kept nuisance-tripping - each is a modification that must flow through management of change and back into the documents. When the matrix says one thing and the PLC does another, the next person to troubleshoot or modify the system inherits a trap. Treat the cause and effect matrix as a living document with the same revision discipline as the logic itself.
Bypassing an Interlock Without Losing Protection
Maintenance and testing sometimes require defeating an interlock - you cannot stroke-test a shutdown valve mid-run without inhibiting the trip it would otherwise cause. The discipline around an interlock bypass and override is what separates a controlled activity from an incident precursor: authorization at the level the site's procedures demand, a defined time limit, compensating measures that cover the hazard while protection is defeated, and an entry in the log that says who, what, and why. These decisions belong to qualified personnel following site procedures, not to whoever happens to be holding the laptop.
SCADA earns its keep here by making bypasses loud. An active bypass should be continuously annunciated, not acknowledged once and forgotten; an elapsed timer on the display keeps it visible across a long job, and the record of when it was applied and removed supports audits and incident reviews. The recurring pattern in near-miss reports is the forgotten bypass - applied legitimately, then left in place across a shift change. A standing agenda item at handover that reviews every active bypass is cheap insurance against that pattern.
Proof Testing and First-Out Capture
An interlock that has never tripped can fail silently: the solenoid sticks, the trip relay welds, the logic path has been inadvertently forced, and nothing reveals it until the day the interlock is demanded. Proof testing exposes those unrevealed failures by exercising the path deliberately - simulate or apply the initiating condition, watch the final element actually move, restore, and document as-found and as-left. Test intervals come from the site's safety requirements and the function's integrity target, and the test itself follows a permit and a written procedure under qualified supervision.
A workable field sequence:
- Obtain authorization and isolate the process per the permit.
- Announce the test so the trip alarm does not trigger a response.
- Drive or simulate the initiating condition at the sensor end where practical.
- Verify the logic acts and the final element reaches its safe state.
- Restore, clear inhibits, and confirm the interlock is fully back in service.
- Record results and any anomalies for the reliability file.
Frequently Asked Questions
What is the difference between a permissive and a trip interlock?
A permissive must be satisfied before an action is allowed - it blocks a start until conditions are safe. A trip forces protective action when a condition goes bad, such as shutting down equipment on a high-pressure or low-level limit, regardless of operator commands.
What is the difference between a process interlock and a safety interlock?
A process interlock lives in the standard control PLC and protects production or equipment. A safety interlock protects people against hazards and is engineered to a higher standard, often on a certified safety controller as part of an SIS or ESD system.
Does interlock logic run in the SCADA system?
No. Interlock logic executes in the local controller so it acts in a fraction of a second and works even during a network outage. SCADA monitors and annunciates interlock and trip status but does not enforce the interlock itself.
Who decides which interlocks are safety interlocks?
The hazard analysis process does. Studies such as a PHA or HAZOP identify the hazards, and layer-of-protection analysis allocates which protective functions must be implemented as safety instrumented functions with a defined integrity level. That classification drives where the logic lives and how it is tested - it is a design decision made by qualified people, not a field-level judgment call.
What should happen after an interlock trips?
The process goes to its safe state and stays there. A trip should latch, annunciate with first-out indication, and require a deliberate operator reset only after the cause is understood and cleared per site procedure. Automatic restart after a protective trip defeats the purpose of the interlock.
Automation services
Need help turning this into a working system?
Merobix integrates SCADA, programs Allen-Bradley and Siemens PLCs, and designs and fabricates industrial control panels.
Meeting requests are reviewed before confirmation.