PLC motor control — start-stop, jog, forward-reverse

PLC motor control is the workload that pays the bills. Conveyors, pumps, fans, mixers, agitators, extruders, hoists — almost every machine in a plant has at least one motor on it, and almost every PLC program has at least one rung that starts and stops a motor. The instructions are not difficult. The traps are in the safety chain, the interlocks, and the discipline of putting hardware-level protection where it belongs and software-level convenience where it belongs. This tutorial walks the patterns you will use every week — start-stop with seal-in, overload integration, the E-stop chain, jog logic, forward-reverse with interlocks, soft-stop sequencing for VFDs, auto / manual handling, and the real-world fault list — with worked ASCII rungs you can copy into the simulator.

One opinion stated outright. If you have ever seen a panel where the E-stop only goes through the PLC, you are looking at a future incident report. The PLC is not the safety device. The contactor coil power must drop on E-stop independent of any program logic. We will get to that in the third section, but it is the most important sentence on this page.

The simplest case — start-stop with seal-in

The starting point is the same seal-in rung covered in detail in /learn/latching. The structure is a momentary start button, a normally-closed stop button, and a parallel branch wrapping the start with the output's own NO contact.

   |   Start          Stop                          MotorRun
   |---| |--+-------|/|---------------------------( )---|
   |        |
   |   MotorRun
   |---| |--+

Wiring conventions matter as much as the rung. Stop buttons are wired NC at the field — at rest, the button is closed and the input is energised, the input bit reads 1. The program then reads the stop with a NO contact, which is true when the bit is 1. Pressing stop breaks the field circuit, the input bit drops to 0, the NO program contact goes false, the rung breaks, the latch drops. The reason for that convention is fail-safe behaviour. A cut wire to the stop button drops the input bit to 0 and stops the motor. A failed-open stop button stops the motor. The machine is safe under broken-wire failure. Wire your stops NC at the field. Always.

Start buttons are wired NO. At rest the button is open, the input bit reads 0. Press the button, the bit goes 1, the program NO contact passes, the rung makes, the seal-in branch latches. A cut wire to a start button means the start does not work, which is a nuisance but not a hazard. NO is the right choice for a start.

The rung above is the irreducible minimum. It will run a motor. It is also missing every protection feature a real machine needs. The rest of this tutorial is the protections you have to add before you wire it to a real contactor.

Adding overload protection

Every motor of any size has a thermal overload protection device sitting between the contactor and the motor. The classic device is a thermal overload relay — a bi-metal strip that bends as it heats, with current passing through a heater coil sized to the motor's full-load amps. If the motor pulls too much current for too long, the strip bends far enough to trip a mechanical mechanism, which opens an auxiliary contact. Modern equivalents are electronic — Allen-Bradley 193-EEC, Siemens 3RB22, ABB EF series — which use current transformers and a microcontroller to implement the same trip curve in firmware, plus communication to the PLC over IO-Link or similar.

The overload's auxiliary contact is the input the PLC reads. It is wired NC at the field, fail-safe convention same as a stop. The program reads it as a NO contact. At rest, the bit is 1 and the rung passes. On trip, the bit goes 0 and the rung breaks.

   |   Start    Overload    Stop                  MotorRun
   |---| |--+--| |--------|/|------------------( )---|
   |        |
   |   MotorRun
   |---| |--+

A field reality that catches new techs. Overload reset is mechanical. The trip mechanism on a thermal overload latches mechanically, and somebody has to walk to the panel and press the physical reset button on the overload itself before the motor will run again. There is no "OvloadReset" coil in the program that clears it. The PLC sees the overload status as an input but cannot clear the trip from software. That is deliberate — an overload trip means something is wrong with the motor or the load (bearing seizure, jammed conveyor, single-phase condition), and somebody needs to look at the machine before it tries again. Auto-reset of overloads on real plant is a footgun that bakes motors. Do not do it.

The overload contact goes in series with the seal-in, before the seal-in branch — same shape as the stop contact. A trip drops the latch and the motor stops. Releasing the trip (by pressing the mechanical reset on the overload) does not auto-restart the motor, because the seal-in is already gone — the operator has to press start again. That is the correct manual re-arm requirement.

Adding the E-stop — the hardware safety chain

This is the section that matters most. Get this wrong and people get hurt.

The E-stop is not a PLC input. Or rather, the E-stop is also a PLC input — for indication and for diagnostic purposes — but its primary function is to break the contactor coil power directly, in hardware, independent of any PLC scan or program. The E-stop is part of a hardware safety chain that wires from the safety supply through every E-stop button (in series, all NC) through any guard interlocks (also NC) to a safety relay or a safety PLC, and the output of that safety relay is what energises the contactor coil. If any link in the chain opens, the safety relay drops out, the contactor coil de-energises, the motor stops. The general-purpose PLC has no role in that path.

The PLC reads the E-stop status as an input — usually a separate auxiliary contact on the safety relay, or a dry contact wired in parallel with the safety chain — for HMI indication, fault logging, and to drop the program's "MotorRun" command bit. But the program's MotorRun bit going to 0 is not what stops the motor. The hardware safety chain is what stops the motor. The PLC bit going to 0 is informational, so the program knows what state the world is in.

The reason for this is simple. A general-purpose PLC is not a safety device. Its scan can hang. Its outputs can stick. Its firmware has bugs. None of those failure modes is acceptable for a stop function that has to work to prevent injury. The IEC 60204-1 standard for safety of machinery (see iec.ch/standards/iec-60204-1 and the broader IEC reference at iec.ch) requires that emergency stop functions achieve a defined safety integrity level, and a general-purpose PLC does not meet those requirements unless it is a certified safety PLC running certified safety code. Use a safety relay (Pilz PNOZ, Siemens 3SK, Allen-Bradley GuardLogix or simpler MSR series) or a certified safety PLC. The general-purpose PLC sits next to the safety system, monitoring and reporting, not in the safety path itself.

The rung in the program looks like this — the E-stop status is a contact in series with start, but the practical motor power is gated by the safety relay output upstream, not by this rung.

   |  EStopOK   Overload    Stop    Start                MotorRun
   |---| |-----| |---------|/|----+--| |--+-----------( )---|
   |                              |       |
   |                              |   MotorRun
   |                              +---| |--+

EStopOK is the input bit the PLC reads from the safety relay's monitoring output. When the safety chain is intact, EStopOK is 1 and the rung can pass. When the chain breaks, EStopOK goes 0, the rung drops MotorRun, and the HMI can show "E-Stop Active." But the contactor power is already gone at the hardware level. The PLC catching up is a side effect, not the safety mechanism. Get that mental model right and the rest of motor-control safety follows.

Jog logic

A jog button runs the motor only while the button is held — no seal-in. Jog is for setup, threading a conveyor, indexing a tool — the operator wants the motor to move a small distance under their direct control and stop the instant they release the button.

The simplest jog rung is a start without a seal-in.

   |   JogFwd   Overload                         MotorRun
   |---| |-----| |-------------------------( )---|

The trap is when jog and run share the same coil. If you write the jog rung above as a parallel branch on the run rung, you can get a state where the run is latched (seal-in holding it) and the operator presses jog — both rungs are now true, MotorRun is on, and the operator releases jog expecting the motor to stop. The motor does not stop, because the seal-in latch from the run rung is still holding. From the operator's perspective, the jog button is broken.

The fix is a Jog / Run mode selector — usually a maintained selector switch on the panel, or an HMI button that toggles a maintained mode bit. In Run mode, the run rung is enabled and the jog rung is disabled. In Jog mode, the run rung is disabled and the jog rung is enabled. The two modes are mutually exclusive permissives.

   |   RunMode  Start    Stop                       MotorRun
   |---| |-----| |----+-|/|---+-----------------( )---|
   |                  |       |
   |             MotorRun     |
   |              | |---+     |
   |
   |   JogMode  JogFwd                               MotorRun
   |---| |-----| |--------------------------------( )---|

Two rungs, two coils to the same MotorRun output is a problem on most platforms — last-rung-wins or duplicate-coil errors. The clean way is to write each rung's logic into an intermediate bit (RunCommand and JogCommand), then have a single output rung that combines them.

   RunCommand OR JogCommand → MotorRun

That arbitration rung is the only place MotorRun is written, which makes the program easier to reason about and easier to debug.

Forward-reverse with interlocks

A reversing motor uses two contactors — one for forward, one for reverse — wired so they swap two of the three phases between them. Energising both contactors at the same time creates a phase-to-phase short across the contactor block. This is loud, expensive, and on a large motor it will trip the upstream breaker hard. Sometimes it welds contacts shut. It must not happen.

There are two interlocks against it and you use both.

The mechanical interlock is a physical lever between the two contactors that prevents both from closing at the same time. Allen-Bradley, Siemens, Schneider, ABB all sell reversing contactor blocks that ship with this lever pre-installed. It is the primary protection. If the wiring is correct and the lever is fitted, simultaneous energisation is mechanically impossible regardless of what the PLC does.

The software interlock is a normally-closed contact of each direction's coil in series with the other direction's start logic. In ladder, FwdCoil's NC contact appears on the Reverse rung, and RevCoil's NC contact appears on the Forward rung. If Forward is on, the NC of Forward is open, the Reverse rung cannot make. And vice versa.

   |  FwdStart   RevCoil    Stop                  FwdCoil
   |---| |------|/|-------|/|------+-----------( )---|
   |                               |
   |   FwdCoil
   |---| |---+

   |  RevStart   FwdCoil    Stop                  RevCoil
   |---| |------|/|-------|/|------+-----------( )---|
   |                               |
   |   RevCoil
   |---| |---+

The software interlock is fast and clean and prevents wear-and-tear of the mechanical interlock taking hits. The mechanical interlock is the actual safety. Both. Every reversing starter. No exceptions.

A second hazard is plug-stop — slamming directly from forward to reverse without a stopped period in between. The mechanical stress on the motor and the load is severe. Some applications tolerate it (small fractional-horsepower motors driving low-inertia loads). Most do not. The convention is a direction-change time delay in software — when a stop is commanded from forward, hold a "direction-change blocked" state for several seconds (often 2–5 seconds depending on motor size and load inertia), only then allow reverse. A TON timer holding a permissive bit is the usual implementation.

Soft-stop sequencing for VFD-driven motors

When the motor is driven by a Variable Frequency Drive — PowerFlex 525, Siemens Sinamics G120, ABB ACS580 and similar — the stop logic changes. You do not just drop the run command. You command a deceleration ramp, wait for the drive to confirm zero speed, then drop the run.

The reason is mechanical. A direct drop of the run command on a VFD with significant rotating inertia will either coast (free spin until friction stops it) or fault on a DC bus overvoltage as the motor regenerates into the drive. Neither is what you want for a controlled stop. The correct sequence is to set a "stop ramp" bit on the drive, monitor the drive's "AtZeroSpeed" feedback, and only after that feedback goes true do you drop the actual run command.

A worked sequence using Sinamics G120 control words (the drive control profile is documented at support.industry.siemens.com for the G120 family):

1. Operator presses Stop.
2. PLC sets the "stop ramp" bit in the drive control word and clears the "run" bit.
3. The drive begins decelerating per its configured ramp time.
4. PLC waits, monitoring AtZeroSpeed feedback from the drive status word.
5. When AtZeroSpeed is true, the PLC drops any remaining enable bits and the drive contactor opens.

If AtZeroSpeed does not assert within a timeout (say 30 seconds — more than the configured ramp), the PLC raises a "Stop Failed" alarm and may command a coast-stop. Do not skip the timeout. A drive that fails to decelerate is a maintenance issue and you want it visible.

For a worked Allen-Bradley equivalent, the PowerFlex 525 reference manual at rockwellautomation.com covers the analogous control bits and status feedback — LogicCommand and LogicStatus words on PowerFlex carry the run, stop-ramp, and at-zero-speed equivalents.

Auto / manual mode handling

Most production machines have an Auto / Manual selector — a maintained switch (either a panel keyswitch or an HMI button) that gates which logic owns the outputs. In Auto, a recipe or sequence drives the motor commands. In Manual, individual operator controls — start, stop, jog, forward, reverse — drive them directly.

The discipline is that the same coil should not be written from both modes without an arbitration rung. A pattern that works.

Auto rungs → AutoMotorCommand
Manual rungs → ManualMotorCommand

(Auto AND AutoMotorCommand) OR (Manual AND ManualMotorCommand) → MotorRun

The mode selector is a permissive on each side. Only one can be true at a time. The combined rung is the single writer to MotorRun. The pattern scales — every motor in the plant uses the same Auto and Manual permissives, and adding a third mode (say Maintenance, where only specific personnel with a key can run the motor at reduced speed) is one more permissive and one more set of rungs without disturbing the existing pair.

The trap is mode change while the motor is running. If the operator switches from Auto to Manual mid-cycle, the AutoMotorCommand drops, the ManualMotorCommand is whatever it was (probably 0), so the motor stops. Sometimes that is what you want. Sometimes it is dangerous — a hoist mid-lift, a centrifuge mid-spin. The pattern in those cases is to gate the mode-switch itself behind a "machine stopped" permissive, so the operator cannot switch modes until the motor is at zero speed and confirmed stopped. Make that decision per machine, document it, and write the gating rung.

The real-world fault list

Five fault types that show up on every motor over a long-enough timeline.

Single-phasing. One of the three supply phases drops. The motor draws very high current on the remaining two phases trying to maintain torque, the overload trips, the contactor drops out. PLC indication is the overload-tripped input. Maintenance response is to check upstream fuses or breakers, then check the contactor's main contacts, then check the supply to the panel.

Brown-out. Voltage drops below the contactor's drop-out threshold. The contactor releases. When voltage recovers, the contactor stays open until the start command is re-issued (because the seal-in is gone). PLC indication is loss of the contactor's auxiliary feedback contact. Maintenance response is to investigate the supply event — utility issue, transformer loading, neighbouring large motor starting.

Overload trip. Motor pulled too much current for too long. Cause is usually a mechanical issue — bearing seizing, drive belt over-tightened, conveyor jammed. PLC indication is the overload-tripped input. Maintenance response is to inspect the load mechanically before resetting the overload.

Contactor weld. Main contacts welded shut from a high-current event (often a phase-to-phase short, sometimes from repeated heavy starts). Symptom is the motor will not stop on a stop command — the contactor coil drops but the welded contact keeps the motor energised. PLC indication is mismatch between the coil command bit and the contactor's auxiliary feedback (auxiliary says closed when the program says open). The PLC should detect this and raise a "Contactor Failed Closed" alarm. Maintenance response is to isolate the panel at the upstream breaker and replace the contactor.

Drive fault. Any of dozens of internal drive faults — overvoltage, undervoltage, ground fault, motor overload, IGBT overtemperature, encoder loss, comms loss. PLC indication is the drive's fault status word, which the PLC reads over the fieldbus. The fault code itself comes through and the HMI should display the human-readable description from the drive manual. Maintenance response depends on the code — most are documented in the drive manual with a recommended action.

The PLC's job for each of these is to detect, indicate, log, and refuse to restart until the fault is acknowledged and cleared. The maintenance technician's job is the physical investigation. The two roles are different and the program should not pretend a fault is cleared just because the input went away.

Practice it in the simulator

Open the simulator and load the start-stop preset. Wire it the way the first section of this tutorial shows — start, stop NC, seal-in. Confirm it runs the motor on start and stops the motor on stop. That is the irreducible minimum.

Then add overload protection. Toggle the overload input to simulate a trip. Confirm the motor drops. Confirm releasing the trip does not auto-restart — the start has to be pressed again. That is the seal-in doing its job.

Then add the E-stop input. Treat it as informational — the simulator does not have a hardware safety chain, but the program rung shape is still useful practice. Confirm the rung breaks on E-stop active and re-makes only on start press after E-stop releases.

Then build the forward-reverse pair with software interlocks. Toggle FwdStart and RevStart at the same scan and confirm only the first one to assert latches — the other is blocked by the interlock. Then add a TON-based direction-change delay and confirm the reverse cannot start until the delay has elapsed after a forward stop.

Then build the Auto / Manual arbitration pattern. Drive the AutoMotorCommand from a simple sequence (a TON cycling on and off), drive the ManualMotorCommand from a panel start, switch the mode bit and confirm only the active mode owns the motor.

That is a full afternoon of simulator practice and at the end of it the motor-control reflexes will be there. The next step after this is sequence logic — chaining motor commands with timers and state bits to run a full machine cycle, the topic of the next tutorial. Motor control is the building block. Build the reflex layer here first.