When to use
When drawing or reviewing a contactor control diagram before it goes to the panel shop: direct-on-line start with seal-in, forward/reverse with electrical interlock, a dual-channel emergency stop through a safety relay with feedback from the contactors, or a process interlock with a maintenance bypass. It is also a bench for teaching and for testing what happens, click by click, when each pushbutton is pressed.
A control diagram is Boolean logic with memory
In a contactor control circuit, contacts in series form an AND, contacts in parallel form an OR, and an NC contact negates the state of whatever operates it. What makes relay logic harder than a truth table is the coil: when its own contact feeds it back, the circuit remembers. This tool models that literally. Devices have named terminals, wires go terminal to terminal, and every combination of signals is an explicit series or parallel block. Relays, safety relays and output devices hold state; blocks do not. The same seal-in written as PLC rungs is the ladder logic version of this circuit — two notations for one piece of Boolean logic.
The circuits checked here are the control side of the starters that live in a motor control centre: direct-on-line and forward/reverse starter drawers, whose power side is sized in MCC drawer sizing.
What the analysis returns
For each coil the tool writes the equation it reads from the drawing, such as
K1 = (S1 + K1) · ¬S0 · ¬EMG-01. It then sweeps every combination of inputs (up to
12 inputs), solves the coils by synchronous fixed-point iteration and marks the
combinations where the result depends on history. From that sweep come the
findings: an output that is always on, an output that is never reached, an input
that changes nothing, a combination with two stable states (race) or none
(oscillation). It also lists the effect of pressing each input alone, from rest.
Emergency stop, bypass and safety relay
The emergency stop must act through NC terminals; an NO wiring is an error. A key declared as bypass in parallel with the emergency is an error under ISO 13850 §4.1.1 — the function cannot be overridden. For a safety relay or safety PLC the tool checks that every input channel is wired, that Reset is wired, and that the NC contacts of the driven contactors return to Feedback. Devices in the output path but outside the loop are flagged, because a welded contact in them would go unnoticed at reset.
The bench
Besides the verdict, the diagram works as a test bench: click a pushbutton and the circuit energises from the state it is in, wire by wire. A pulse button closes and returns; a latching device toggles. It is the quickest way to see that releasing the emergency stop does not restart the motor.
What this tool does not cover
There is no time in the model: no timers, no off-delay, no contact transfer time. An interlocked reversing starter can pass here and still have a real overlap. The tool does not determine Performance Level (ISO 13849-1) or SIL (IEC 62061), and “no findings” means none of the implemented checks fired — not that the circuit was proved correct. It does not size contactors or cables either: the starters and their feeder breakers belong to the distribution panel sizing and MCC calculations, the control and power cables go into the cable list, and a 24 Vdc control circuit fed from a battery-backed supply is checked for voltage drop in DC cable sizing. For PLC programs with timers and counters, use the ladder logic simulator. When the starters are driven over a fieldbus instead of hard-wired pushbuttons, the network itself is sized in DeviceNet network sizing or PROFIBUS DP network sizing.
Formulas and fundamentals
SERIES = A · B · C · D | PARALLEL = A + B + C + D Combining signals is always explicit: a series block (2 to 4 inputs) is AND, a parallel block is OR. An input terminal accepts a single wire — two wires on one terminal is an error, not an implicit AND.
NO = state | NC = ¬state For a pushbutton, selector or field contact, "state" is actuated/not actuated. For a relay, safety relay or output device, it is the coil state. An emergency stop only has NC terminals (1 to 4).
K = (START + K) · ¬STOP The coil returns through its own NO contact. The tool flags it as "latched by seal-in": the same input combination admits two stable states, and the output depends on history.
K1 = (S1 + K1) · ¬S0 · ¬K2 | K2 = (S2 + K2) · ¬S0 · ¬K1 Each coil is blocked by the NC contact of the other. With S1 and S2 pressed together there are two coil states that hold, and which one wins depends on contact switching order — the tool reports it as a race (warning), not as an approval.
KS = In1 · In2 · (KS + Reset · Feedback) The input channels combine in AND, the device arms on Reset and holds internally. The feedback loop (external device monitoring) is checked at the moment of reset, not continuously: a welded contactor contact keeps the loop open and prevents re-arming. Feedback must come from NC contacts.
s(n+1) = f(inputs, s(n)); stable ⇔ s(n+1) = s(n) All coils read the same previous state in each step (up to 64 iterations). A combination has "memory" when solving from all coils off and from all coils on gives different results. If the iteration does not converge, the tool searches for any self-sustaining coil state: if one exists it is a race, if none exists it is an oscillation (error).
Standards & methods
- ISO 13850 §4.1.1 — the emergency stop function must not be overridden (bypass in parallel with the emergency is an error)
- ISO 13849-1 — Performance Level not determined (declared out of scope)
- IEC 62061 — SIL not determined (declared out of scope)
Typical reference values
| Quantity | Typical range | Note |
|---|---|---|
| Exhaustive sweep of input combinations | up to 12 inputs (4096 combinations) | above that the always-on, unreachable and no-effect checks are not stated |
| State table rows emitted | up to 8 inputs (256 rows) | — |
| Fixed-point iterations | 64 | — |
| Race × oscillation classification | up to 10 coils, first 128 non-converging combinations | — |
| Relay contacts | 0–4 NO + 0–4 NC (default 1 + 1) | — |
| Emergency stop terminals | 1–4 NC (default 2) | — |
| Safety relay / safety PLC | 1–4 input channels + Feedback + Reset; 0–4 NO and 0–4 NC outputs | — |
| Diagram limits | 200 devices · 400 wires | — |
Worked example
Direct-on-line start with seal-in and emergency stop
Inputs
- S1 — start pushbutton (pulse)
- NO into PAR-1 with K1 NO 1
- S0 — stop pushbutton (pulse)
- NC in series SER-1
- EMG-01 — emergency stop (latching)
- NC in series SER-1
- K1 — contactor
- 2 NO seal-in + motor M-01
- Sequence on the bench
- S1 → EMG-01 → S1 → release EMG-01 → S1 → S0 —
Results
- Coil equation
- K1 = (S1 + K1) · ¬S0 · ¬EMG-01 M-01 = K1
- Combinations swept
- 8 2³, all 8 stable, 0 races, 0 oscillations
- Combinations with memory
- 1 all released — K1 = 0 or K1 = 1
- After the S1 pulse
- K1 = 1, M-01 = 1 sealed
- EMG-01 operated, then S1 pressed
- K1 = 0, M-01 = 0 start blocked
- EMG-01 released
- M-01 = 0 no automatic restart
- Verdict
- OK 2 information notes, 0 warnings, 0 errors
The only combination with memory is the one with every button released — that row is the seal, and it is why a relay circuit cannot be described by a plain truth table. Operating EMG-01 opens SER-1, the coil drops and the seal is lost; releasing EMG-01 does not restart the motor, because the seal is no longer there to bring the coil back — a new S1 pulse is needed. The two notes are informative: "K1 latched by seal-in" and "EMG-01 emergency on NC".
Common mistakes
- Landing two wires on the same coil terminal and expecting an AND. The tool rejects it: combining signals requires a series or parallel block, so the drawing says what it does.
- Wiring the emergency stop through an NO terminal. The command must open the circuit when operated — a broken wire on an NO emergency leaves it without effect and nothing denounces the loss. It is an error.
- Putting a bypass key in parallel with the emergency stop. ISO 13850 §4.1.1 does not admit overriding the function: while the key is on, the parallel block is true by itself. Over the emergency it is an error; over an ordinary process condition it is a warning.
- Leaving the Feedback terminal of the safety relay free, or closing it with NO contacts. Without the NC loop a welded contact goes undetected and the reset is accepted with the load still energised.
- Feeding a coil through its own NC contact. There is no stable state — on the real panel the contact buzzes at the switching rate. The tool reports "no stable state" and fails the circuit.
- Reading "no findings" as proof. The analysis is structural: it walks the diagram, it does not simulate time. An interlocked reversing starter can pass here and still have a real overlap during contact transfer.
Frequently asked questions
What is a seal-in (holding) contact?
An NO auxiliary contact of the contactor itself, wired in parallel with the start button. Once the coil picks up, the contact keeps it energised after the button is released, until a series condition (stop, emergency, overload) opens the circuit. In Boolean form: K = (START + K) · ¬STOP.
Why does the tool warn about my interlocked forward/reverse starter?
Because with both start buttons pressed together the diagram admits two stable states — K1 alone or K2 alone — and which one wins depends on contact switching order. The interlock prevents both coils at once, but the drawing does not decide which. If that matters for safety, add a mechanical interlock or a timing device.
How does the tool check the safety relay feedback (EDM)?
It requires the NC contacts of the driven contactors to return to the Feedback terminal and checks the loop at the instant of reset. If a driven device is in the output path but outside the loop, it warns; if the loop is closed by NO contacts, it is an error.
Does it give the Performance Level or SIL of the circuit?
No. It checks logic. ISO 13849-1 Performance Level and IEC 62061 SIL depend on architecture, diagnostic coverage, component reliability and common-cause failures, which are outside the drawing. The memorial states that limit.
What is the difference between a race and an oscillation?
In both the synchronous iteration fails to converge. In a race at least one coil state holds itself and the winner depends on switching time (warning). In an oscillation no state holds — like a coil fed by its own NC contact — and the circuit is failed.
Glossary
- Seal-in
- Holding of a coil through its own NO contact in parallel with the start command.
- Interlock
- NC contact of one coil in series with another, so that both cannot be energised together.
- EDM
- External device monitoring — NC contacts of the driven contactors returned to the safety relay, checked at reset.
- Race
- Condition with more than one stable state, decided by contact switching order rather than by the drawing.
- Combinational loop
- Signal returning to itself through blocks only, with no coil to hold state; the drawing has no solution.
- Netlist
- List of devices and terminal-to-terminal wires that the tool evaluates.