Two things wear the labels normally-open and normally-closed, and mixing them up is one of the most persistent sources of inverted-logic bugs in control programming. One is the physical field device - a switch that is either open or closed in its resting state. The other is the ladder-logic instruction - the examine-on contact (XIC) and examine-off contact (XIO) - which tests a bit in memory. They are related but not the same, and fail-safe design depends on getting the interaction between the wired device and the logic instruction exactly right.
NO vs NC Contacts in one line: A normally-open or normally-closed contact can refer either to a physical field device's resting state or to a ladder instruction. The XIC (examine-if-closed) instruction passes power when its bit is true, and the XIO (examine-if-open) passes power when its bit is false. Correct design requires matching how a field device is wired to which instruction examines it.
A physical contact has a resting, de-energized state. A normally-open device sits open when nothing acts on it and closes when actuated; a normally-closed device sits closed at rest and opens when actuated. This is a hardware fact about the switch, pushbutton, or relay, describing what it does mechanically before any electricity or logic is involved. It says nothing, by itself, about what the PLC will do with the signal.
The ladder instruction is a separate thing entirely. An XIC, examine-if-closed, is a software contact that lets power flow through the rung when the bit it examines is true. An XIO, examine-if-open, lets power flow when the bit it examines is false. These instructions test the state of a bit in the input image, and that bit's value comes from whether the field wiring is energizing the input point or not. The instruction and the device are two independent choices, and the behavior you get depends on how you combine them.
This is where the confusion lives. Saying a rung has a normally-closed contact could mean the field device is a normally-closed switch, or it could mean the rung uses an XIO instruction, and the two do not have to agree. A normally-closed field switch feeding an input that is examined by an XIC produces very different logic than the same switch examined by an XIO. Keeping the two ideas distinct in your head - device wiring on one side, examine instruction on the other - is the whole skill, and blurring them is what generates the classic inverted-logic bug.
Fail-safe design for critical inputs almost always uses a normally-closed field device, wired so that the healthy, safe condition energizes the input. A level switch, a pressure switch, or an emergency shutdown contact is arranged to be closed and passing current when everything is normal. If the process reaches its dangerous condition the contact opens, but just as importantly, if the wire breaks, the device fails, or the loop loses power, the contact also goes open. A broken wire and a real trip look the same to the controller, which is exactly what you want for safety: any failure defaults to the tripped, safe state.
In the logic, that healthy-energized input is typically examined so that its true state means safe and permits operation. When the input drops - whether from a genuine trip or a fault - the permit is lost and the equipment shuts down. This pairing of a normally-closed, energized-when-healthy field device with logic that treats loss of signal as a trip is the essence of fail-safe input design. It is why so many shutdown and level inputs are wired normally-closed even though it feels backwards to newcomers who expect a switch to close when something bad happens.
The reason to be deliberate about which examine instruction reads that input is that choosing the wrong one silently inverts the meaning. If a normally-closed, healthy-energized input is examined with the instruction that expects the opposite polarity, the logic will read a healthy site as tripped or a real trip as healthy. On an ESD input or a level-switch input this is not a cosmetic bug - it can leave protection defeated or nuisance-trip a producing well. The fail-safe intent of the normally-closed wiring is only realized if the examine instruction is matched to it correctly.
Getting the device-versus-instruction relationship backwards is a top cause of inverted-logic faults, and these are especially dangerous on emergency shutdown and level-switch inputs because the failure is often silent. Everything looks fine on the bench, where a technician manually toggles a switch and watches a light, and the inversion only reveals itself when a real field condition arrives and the logic responds in the wrong direction. A high-level switch that is supposed to trip a well instead reads as normal, or a healthy site is reported as shut in - either way trust in the system erodes fast.
The subtlety is compounded when a signal passes through several stages, each of which can invert it: the field device's normally-open or normally-closed wiring, the examine instruction, and any not or complement operations in the code. Each inversion is easy to reason about alone, but stacked together they are easy to lose track of, and an even number of inversions cancels while an odd number flips the sense. Careful documentation of the intended true-means-safe or true-means-tripped convention for every critical input is the practical defense.
When these inputs feed a cloud SCADA platform, the polarity has to be right end to end or the remote picture will lie. If an operator watching a Merobix dashboard sees a shutdown input reporting healthy while the field is actually tripped, the inversion has propagated all the way to the screen, and remote decisions get made on false information. This is why commissioning a monitored site includes deliberately exercising each ESD and level input and confirming that a real trip in the field shows as a trip on the dashboard, closing the loop between how the device is wired, how the instruction examines it, and what the humans finally see.
XIC, examine-if-closed, is a ladder contact that passes power through the rung when the bit it examines is true. XIO, examine-if-open, passes power when the bit it examines is false. They test the state of a bit in memory, which for a field input comes from whether the wiring is energizing that input, so the two instructions give opposite results for the same input state.
Because a normally-closed switch wired to energize the input when healthy will also open, and drop the input, if the wire breaks or the device loses power. That means a fault and a real trip look identical to the controller, and both default to the safe, shutdown state. This fail-safe behavior is why emergency shutdown and level-switch inputs are commonly wired normally-closed even though it seems counterintuitive.
They usually come from mismatching the field device's normally-open or normally-closed wiring with the examine instruction reading it, or from stacking an odd number of inversions through wiring, instructions, and code. The logic then treats healthy as tripped or tripped as healthy. These bugs are dangerous on ESD and level inputs because they can pass a bench test yet fail silently until a real field condition arrives, so each critical input should be exercised end to end at commissioning.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.