Seal-In Logic or OTL/OTU? Choosing PLC Memory Safely

A motor command that stays true after an operator releases the Start button can be built with a seal-in branch or with retentive set/reset instructions. The steady-state result may look identical on an HMI. The failure behavior, however, is not identical—and that difference matters during a restart, a fault, or an online edit.

The useful engineering question is therefore not “which instruction is better?” It is “where should state live, who is allowed to change it, and what conditions must remain dominant?”

Two ways to remember, two different contracts

A conventional seal-in rung uses an ordinary output instruction and a parallel contact from the commanded bit. In Logix terminology, an Output Energize instruction follows the rung condition every scan: a true rung writes the bit true and a false rung writes it false. The branch keeps the rung true after the momentary Start request disappears, but a Stop, fault, or permissive placed in series can break the path immediately.

An Output Latch instruction writes a bit true when its rung becomes true. The bit then remains true until an Output Unlatch instruction—or some other writer—clears it. Rockwell Automation’s bit-instruction reference distinguishes OTE as a scan-following output from OTL and OTU as retentive set and clear operations.

A set/reset pair separates the conditions that establish and clear a command. The diagram is retained from the original media illustration; source: Control.com.

The scan cycle decides which design is easier to trust

Seal-in logic exposes the dominant stop path

For a simple run request, the seal-in pattern keeps Start, Stop, overload, mode, and permissive conditions visible on one rung. When any series condition becomes false, the OTE is rewritten false during that scan. Maintenance technicians can usually follow the complete decision without searching several routines.

The pattern becomes difficult when many subsystems can start or stop the same state. Adding parallel branches indefinitely hides priority and makes online troubleshooting harder. At that point, a dedicated state machine is often clearer than either a giant seal-in rung or scattered latch instructions.

OTL and OTU separate events from state

Retentive instructions are useful when independent events must establish and clear a state: a sequence step, a completed handshake, an alarm acknowledgement, or a request that must survive the triggering pulse. The risk is ownership. If the same tag is written from several routines, task order and scan order can decide the final value.

A cross-reference showing one latch and one unlatch does not by itself prove safe behavior. The program also needs an explicit priority rule. If set and reset conditions can be true in the same scan, the engineer must document which result wins and verify that routine scheduling cannot change it unexpectedly.

Keep remembered state away from the physical output

A strong pattern is to remember an internal command or sequence state, then drive the physical output with a single OTE that is gated by current permissives. The remembered request may remain true, but the actuator command still drops when an overload, guard condition, process interlock, or operating mode removes permission.

This separation also improves diagnostics. Operators can see that a run request exists while a specific permissive is blocking motion. The same principle helps during controller commissioning; the Micro800 commissioning workflow explains why outputs should be proven under controlled conditions rather than inferred from an internal bit alone.

Safety functions require safety-rated hardware, validated logic, and a documented risk-reduction design. Neither a seal-in branch nor a normal OTL/OTU pair turns a standard PLC output into a safety function.

Restart behavior is a design requirement, not a surprise

Before choosing retentive logic, define what should happen after power loss, a controller mode change, a program download, or a communications interruption. A physical contactor will de-energize when power disappears, but a retained command may still be true when control resumes. Automatic restart may be acceptable for some continuous processes and unacceptable for personnel-accessible machinery.

Use a startup state that deliberately reconciles retained requests with current field conditions. Confirm feedback devices, clear stale handshakes, re-establish communications quality, and require a fresh operator action where the risk assessment calls for it.

Commissioning tests that reveal hidden defects

Test more than Start and Stop. Hold both requests true, remove one permissive at a time, force a fault during the transition between states, cycle controller modes, interrupt networked feedback, and verify what happens after power restoration. Watch the command bit, the final output rung, and the field feedback together.

One-shot behavior can also change a latch design. If an event is expected only once, verify its storage bit and scan timing. The related guide on Studio 5000 one-shot pulses and OTE behavior shows why a pulse that exists internally may never produce the field result an engineer expects.

Editorial view: single ownership beats instruction preference

For straightforward maintained commands, PLC ProTech favors a seal-in pattern because the stop path is visible and continuously evaluated. For sequence states and event memory, set/reset logic is appropriate when one routine owns the state, reset priority is explicit, and the physical output remains under a separate permissive-driven OTE.

The instruction choice is secondary. The decisive quality signal is whether another engineer can identify every writer, predict the state after an interruption, and prove that protective conditions dominate.

FAQ

Does an OTL instruction keep a real output energized during a power failure?

No. Loss of control power removes energy from the physical output circuit. The concern is that the retained command bit may still be true when the controller and output system return, depending on the controller, memory configuration, and startup logic.

Is a seal-in rung non-retentive?

The OTE follows its rung whenever the rung is scanned. A seal-in branch can maintain the rung during normal operation, but startup and prescan behavior are controller-specific. Engineers should verify the target platform instead of assuming identical behavior across PLC families.

Can the same tag be used by OTL, OTU, and OTE instructions?

Many PLCs allow multiple writers, but the result can depend on execution order and is difficult to troubleshoot. A safer design gives each state one owner and drives each physical output from one final command location.

When is set/reset logic the better choice?

It is useful for event memory, sequence steps, alarm acknowledgement, and handshakes that must persist beyond a one-scan trigger. The reset condition, startup policy, and fault response must be defined at the same time.

By PLC ProTech Editorial Team