Normally closed PLC stop input: XIC or XIO?

Use XIC(STOP_OK) when a physically normally-closed stop circuit makes the PLC input bit 1 in its healthy, released state and 0 when the button is pressed or the circuit opens. XIC and XIO test a bit; they do not describe the field device's mechanical contact. XIO(STOP_OK) is useful for an open-loop diagnostic, while XIO(STOP_REQUEST) can be correct only if STOP_REQUEST is a separate tag whose value is 1 when a stop is requested.

Scope and terminology

IEC 61131-3:2025 Edition 4 identifies Ladder Diagram (LD) as one of the graphical languages for programmable controllers. The IEC publication record establishes the current edition and scope; it does not define a project's field voltage, input-module behavior, tag naming, safety category, or restart policy.

This example assumes a conventional digital input circuit with these explicitly checked facts:

• the physical stop pushbutton has a normally-closed contact in the monitored circuit;
• current reaches the configured PLC input while the wiring is intact and the button is released;
• the input module reports that energized state as raw Boolean tag STOP_OK = 1;
• pressing Stop, losing the monitored control supply, or opening a conductor makes STOP_OK = 0;
• START_PB is 1 only while the momentary start request is active; and
• MOTOR_CMD is a non-retentive software command written by one OTE instruction in this example.

“Normally closed” describes the contact's unactuated mechanical state. XIC means the instruction passes rung continuity when its addressed bit is 1; XIO passes when the bit is 0. Rockwell's current XIO reference defines execution in terms of the data bit, not the field contact. Siemens makes the same separation in its S7-1200 Easy Book: contacts read bit state, coils write logic state, and its start/stop example combines a start condition, an inverted stop condition, a seal-in path, and a running coil.

Crosswalk the field state to the bit test

The instruction choice follows from the entire signal chain:

Under these assumptions, putting XIC(STOP_OK) in series with the run logic makes the run rung false for the last three conditions. The same XIO(STOP_OK) is appropriate on a separate diagnostic rung because that rung should become true when the healthy-loop bit becomes false.

This table is not universal I/O truth. A sourcing versus sinking arrangement, an input inversion setting, a remote-I/O adapter, a safety input block, or a derived software tag can change the value presented to the program. Measure the circuit and observe the online raw tag in both button states before choosing the instruction.

Worked seal-in equation

The first rung implements one Boolean state equation:

MOTOR_CMD(next) = STOP_OK
                AND (START_PB OR MOTOR_CMD(previous))

The stop permission is outside and in series with the parallel branch. That placement is an invariant: neither the momentary start path nor the seal-in path can bypass a false STOP_OK.

Starting from MOTOR_CMD = 0, evaluate five scans:

The seal-in holds after Start is released, drops on the first scan that sees STOP_OK = 0, and does not restart merely because the stop circuit returns healthy. This is the required result for the stated logic. Controller input filtering, task timing, I/O update timing, prescan behavior, remote-I/O failure handling, and the physical starter still require target-specific tests.

Reproducible Schematex source

ladder "N.C. stop input: raw-bit seal-in"
rung 0 "Non-retentive motor run command":
  XIC(STOP_OK, "Local:1:I.Data.1", name="N.C. stop loop healthy")
  parallel:
    branch:
      XIC(START_PB, "Local:1:I.Data.0", name="Momentary start")
    branch:
      XIC(MOTOR_CMD, "Local:2:O.Data.0", name="Seal-in status")
  OTE(MOTOR_CMD, "Local:2:O.Data.0", name="Motor starter command")
rung 1 "Stop-loop diagnostic":
  XIO(STOP_OK, "Local:1:I.Data.1", name="Stop loop open")
  OTE(STOP_LOOP_OPEN, name="Diagnostic only")

Schematex 1.0.13 strictly parsed and rendered this source on September 3, 2026. The SVG contains two rungs, one two-branch parallel block, three XIC instructions, one XIO, two OTE instructions, and no parse or render diagnostics. The Schematex ladder syntax reference documents these mnemonics, argument forms, and indentation rules.

The addresses are fictional Rockwell-style labels included to make the raw-input versus output-bit distinction visible. They are not an I/O assignment recommendation. A real program should normally seal around an internal run-request or proven state selected by the project's control philosophy, rather than copying an output address from an example.

When XIO on a stop tag is correct

XIO can be correct when the tag's software meaning is “stop requested.” For example, an input-mapping routine could deliberately derive:

STOP_REQUEST = NOT STOP_OK

Then the two permission tests are logically equivalent:

XIC(STOP_OK) = NOT XIC(STOP_REQUEST) = XIO(STOP_REQUEST)

The tag name must reveal which convention is in use. STOP_PB is ambiguous because it could mean “raw stop input energized,” “button physically pressed,” or “validated stop request.” Prefer polarity-bearing names such as STOP_OK, STOP_REQUEST, or STOP_LOOP_OPEN, and document any inversion once at the I/O boundary.

Do not infer instruction type from a ladder glyph that resembles a relay contact. A normally-closed field contact and an XIO instruction are different layers. The field contact controls the electrical signal; the instruction tests the resulting Boolean value.

Checks and invariants

1. Online-state check: released and healthy produces the documented raw value; pressed produces its complement.
2. Open-wire check: an authorized test of the monitored circuit makes the run permission false under the stated design.
3. Stop placement: STOP_OK is in series with the whole start/seal branch, not inside only one branch.
4. Seal test: a momentary Start changes MOTOR_CMD from 0 to 1; releasing Start alone does not drop it.
5. Stop test: changing STOP_OK to 0 drops MOTOR_CMD regardless of the seal contact.
6. No automatic restart: after STOP_OK returns to 1, MOTOR_CMD stays 0 until a new start request.
7. Single writer: only the intended output instruction writes MOTOR_CMD; otherwise program order may hide the reviewed equation.
8. Failure reaction: loss of local or remote I/O, bad quality, controller mode changes, and startup each have an explicitly tested response.
9. Naming: every negation or derived stop tag is defined at one boundary and is visible in cross-references.

Failure modes and review boundary

The most common error is choosing XIO merely because the pushbutton is physically N.C. If the raw bit is 1 when healthy, that choice makes the permission true when the monitored circuit is open—the opposite of the intended result. Other failures include placing the stop condition inside only the Start branch, using OTL/OTU retentive instructions without a fully reviewed unlatch path, writing the command in multiple rungs, relying on a vague tag name, or testing only the button press while ignoring broken-wire and communication-loss states.

A de-energizing response to one open circuit is useful, but it does not by itself make this a safety function. It does not detect every welded contact, short circuit, output fault, PLC fault, contactor fault, or stored-energy hazard. It also says nothing about required performance level, safety integrity level, stopping category, diagnostic coverage, reset behavior, or validation.

For servicing and maintenance in the United States, OSHA 29 CFR 1910.147 explicitly excludes pushbuttons, selector switches, and other control-circuit devices from the definition of an energy-isolating device. A stopped software command therefore does not replace required hazardous-energy isolation and verification.

Paste the source into the Schematex playground, rename the tags to expose their polarity, and fill the five-scan table from the real input mapping. Before accepting the rung, have the responsible reviewer witness button, conductor-open, I/O-fault, controller-restart, and no-automatic-restart tests on the target platform under the project's approved procedure.