1. Definition of Abnormal and Protective Control

Abnormal and Protective Control is the control domain that detects abnormal conditions when a machine deviates from normal operating conditions, evaluates their impact and severity, and restricts, interrupts, transitions, or recovers operation in order to prevent damage to equipment, processes, and products.

A machine does not always operate under normal conditions.

In actual operation, situations such as the following may occur:

• A device does not respond to a command.

• A function is not completed within the allowable time.

• Sensor signals contradict one another.

• A product becomes jammed or is fed twice.

• Motor load increases.

• Pressure or temperature leaves the normal range.

• Communication is lost.

• Electrical power or pneumatic supply is lost.

• Mechanical friction or backlash increases.

• Product quality exceeds the allowable limits.

Abnormal and Protective Control does more than simply display an alarm.

It must systematically determine:

• Which conditions should be classified as abnormal

• What range is affected by the abnormality

• Whether operation may continue

• Whether speed or output should be limited

• Which functions should be stopped first

• Which outputs must remain active

• Whether automatic recovery is possible

• Whether operator intervention is required

• What must be reverified before restart

The essence of abnormal response and protective control is therefore to design how the machine should behave after an abnormal condition occurs.

2. Position within the Control System

The abnormal-response flow of general machinery can be expressed as follows:

Function Execution → State Recognition → Abnormality Detection → Impact Evaluation → Protective Decision → Protective Action → Recovery → Revalidation

The role of each area is as follows:

Abnormal and Protective Control is positioned between standard function control and safety-related control.

It handles general process and equipment abnormalities, while conditions directly affecting personnel safety should be handled separately by Safety-Related Control.

3. Distinction Between Abnormality, Fault, and Hazard

3.1 Abnormal Condition

An abnormal condition is a state that deviates from normal operating conditions.

Examples:

• Pressure drop

• Temperature rise

• Increased position error

• Increased cycle time

• Delayed sensor response

An abnormality does not necessarily mean an immediate fault or hazard.

3.2 Fault

A fault is a condition in which the required function cannot be performed correctly or part of the equipment cannot maintain its intended state.

Examples:

• Motor does not operate

• Sensor wire break

• Valve stuck

• Brake does not operate

• Communication failure

• Loss of position information

3.3 Hazardous Condition

A hazardous condition is a state that may cause harm to personnel, equipment, or the surrounding environment.

Examples:

• A hazardous axis moves while the guard is open.

• A vertical axis may fall.

• Access is possible while a rotating element is still moving.

• Overpressure may cause component failure.

• High-temperature components are exposed.

Abnormalities and faults are handled by protective control, while hazardous conditions must be connected to Safety-Related Control.

4. Definition of Protection Targets

The purpose of protective control varies according to what must be protected.

4.1 Equipment Protection

Prevents damage to the machine and its components.

Examples:

• Motor overload prevention

• Axis collision prevention

• Overtravel prevention

• Bearing-overtemperature prevention

• Spindle stop when lubrication is insufficient

• Drive limitation when torque is exceeded

4.2 Process Protection

Maintains process stability and continuity.

Examples:

• Prevention of jam propagation

• Prevention of incorrect sequence execution

• Preservation of intermediate process states

• Prevention of abnormal transfer between upstream and downstream equipment

4.3 Product Protection

Prevents product damage and quality defects.

Examples:

• Prevention of excessive clamping force

• Overheating prevention

• Prevention of duplicate processing

• Prevention of incomplete products advancing to the next process

• Automatic rejection of defective products

4.4 Control System Protection

Prevents damage to control equipment and information.

Examples:

• Transition to a safe default state during communication failure

• Monitoring of program errors

• Protection of memory and parameters

• Data preservation during power abnormalities

• Blocking of invalid commands

4.5 Personnel Protection

Prevents hazards to personnel.

This area is related to general protective control, but safety functions requiring defined reliability and compliance should be implemented through Safety-Related Control.

5. Classification of Abnormality Causes

5.1 Signal and Sensor Abnormalities

• Sensor wire break

• Short circuit

• Stuck signal

• False detection caused by contamination

• Sensor displacement

• Abnormal analog value

• Communication-data error

5.2 Actuator Abnormalities

• Motor fails to start

• Servo alarm

• Inverter trip

• Cylinder does not complete

• Valve does not respond

• Brake does not operate

• Heater output abnormal

5.3 Mechanism Abnormalities

• Belt breakage

• Chain disengagement

• Loose coupling

• Gear damage

• Guide jamming

• Excessive friction

• Increased backlash

• Axis misalignment

5.4 Process Abnormalities

• Product not supplied

• Duplicate product

• Incorrect product orientation

• Positioning failure

• Clamping failure

• Incomplete processing

• Inspection failure

• Discharge failure

5.5 Energy-Supply Abnormalities

• Voltage drop

• Power loss

• Insufficient pneumatic pressure

• Insufficient hydraulic pressure

• Vacuum loss

• Insufficient cooling water

• Insufficient lubrication

5.6 Communication and System Abnormalities

• Network disconnection

• Response delay

• Missing node

• Data mismatch

• Controller stop

• Program-execution abnormality

• Parameter error

5.7 Environmental Abnormalities

• Excessive temperature

• Moisture

• Dust

• Cleaning-water ingress

• Vibration

• Electrical noise

6. Basic Structure of Abnormality Detection

Abnormality detection follows this flow:

Reference Definition → State Monitoring → Deviation Detection → Duration Verification → Cause Classification → Abnormality Confirmation

6.1 Reference Definition

Normal and allowable ranges are established.

Examples:

• Normal pressure

• Allowable position error

• Normal temperature

• Maximum motor load

• Maximum cycle time

6.2 State Monitoring

Relevant signals and state variables are continuously monitored.

6.3 Deviation Detection

The difference between the target or normal range and the actual value is detected.

6.4 Duration Verification

The system determines whether the condition is a momentary fluctuation or a sustained abnormality.

6.5 Cause Classification

Possible causes are classified as sensor, device, mechanism, or process abnormalities.

6.6 Abnormality Confirmation

When the required conditions and duration are satisfied, the abnormal condition is confirmed and passed to the protective-decision logic.

7. Abnormality Detection Methods

7.1 Threshold Detection

Determines whether a measured value has left the specified range.

Examples:

• Temperature exceeds the upper limit.

• Pressure falls below the lower limit.

• Torque exceeds the upper limit.

• Position error exceeds the allowable value.

7.2 Timeout Detection

Detects when a function is not completed within the specified time.

Examples:

• Cylinder forward movement not completed

• Product arrival delayed

• Servo fails to reach position

• Communication response delayed

7.3 Command–Response Mismatch Detection

Compares the issued command with the actual device response.

Examples:

• No rotation after a motor-start command

• No pressure change after a valve-ON command

• Brake feedback not confirmed after a brake-release command

7.4 State-Inconsistency Detection

Determines whether related states logically contradict one another.

Examples:

• Forward and reverse sensors ON simultaneously

• Door Open and Door Closed signals ON simultaneously

• Axis-stop state and detected speed occurring simultaneously

7.5 Trend Detection

Uses changing trends to identify early abnormalities.

Examples:

• Gradual increase in motor current

• Continuous rise in bearing temperature

• Increased cycle time

• Repeated increase in position error

• Increased pneumatic consumption

7.6 Model- or Relationship-Based Detection

Determines whether the relationship between related physical quantities is normal.

Examples:

• Heater output increases, but temperature does not rise.

• Motor current increases, but the axis does not move.

• The valve is closed, but pressure continues to increase.

8. Classification of Abnormality Severity

Not all abnormalities should be handled at the same level.

Severity should be determined according to:

• Whether the function can still be performed

• Impact on product quality

• Possibility of equipment damage

• Possibility of fault propagation

• Recoverability

• Risk to personnel

• Reliability of the state information

9. Fundamental Principles of Protective Decisions

Protective decisions should be based not merely on the fact that an abnormality occurred, but on what may be endangered by that abnormality.

The following questions should be reviewed:

• Can the current function continue?

• Is it safer to complete the current cycle?

• Is immediate stopping required?

• Can only the affected axis or function be stopped?

• Can operation continue if pressure, temperature, or load is reduced?

• Can the product be discharged safely?

• Must the current position be maintained?

• Must energy be isolated?

• Is automatic recovery possible?

• Is operator intervention required?

Protective control should not simply turn off all outputs in the same way for every abnormality.

It should select the minimum safe and reasonable response appropriate to the impact of the abnormality.

10. Types of Protective Actions

10.1 Output Correction

Automatically corrects a small deviation.

Examples:

• Speed adjustment

• Pressure adjustment

• Temperature-output adjustment

• Position correction

10.2 Function Restriction

Restricts certain functions or performance.

Examples:

• Maximum speed limitation

• Torque limitation

• Prohibition of certain axes

• Automatic operation prohibited

• Only low-speed manual operation permitted

10.3 Operation Hold

Temporarily holds the function until the required condition is restored.

Examples:

• Wait for downstream equipment to become Ready

• Wait for pneumatic pressure to recover

• Wait for temperature stabilization

10.4 Automatic Retry

Returns to a safe state and reexecutes the function a limited number of times.

10.5 Local Stop

Stops only the affected function or module.

Examples:

• Stop the feeding module

• Stop a specific axis

• Isolate the inspection module

10.6 Normal Stop

Stops after safely completing the current cycle or process.

10.7 Protective Stop

Stops operation and maintains a protective state to prevent equipment or process damage.

10.8 Safety Stop

Stops according to Safety-Related Control when a direct hazard to personnel or equipment exists.

11. Distinction Between Protective Stop and Safety Stop

Protective stop and safety stop have different purposes and implementation criteria.

Protective Stop

Its primary purpose is to prevent damage to equipment, processes, or products.

Examples:

• Motor overload

• Insufficient lubrication

• Product jam

• Excessive position error

• Abnormal machining load

It may be implemented using a standard PLC or controller.

Safety Stop

Its primary purpose is to limit risk to personnel or serious hazardous energy.

Examples:

• Safety door opening

• Light curtain interruption

• Emergency stop

• Risk of vertical-axis fall

• Excessive hazardous speed

A safety stop should be implemented using the required safety architecture, such as a safety PLC, safety relay, or safety drive function.

General protective control must not be treated as a safety function.

12. Evaluation of the Scope of Abnormality Impact

Abnormalities should be handled differently according to their scope of impact.

12.1 Single-Device Abnormality

Limited to a specific sensor, motor, cylinder, or valve.

Response:

• Stop the affected device

• Isolate the function

• Maintain other functions

12.2 Module Abnormality

Affects an entire functional module such as feeding, processing, inspection, or discharge.

Response:

• Stop the module

• Block upstream and downstream handshakes

• Restrict product movement

12.3 Machine-Wide Abnormality

Affects the controller, power supply, pneumatic supply, or safety state.

Response:

• Stop the entire machine

• Manage energy

• Prevent restart

12.4 Line Abnormality

Affects upstream and downstream equipment and the entire production line.

Response:

• Stop product transfer

• Propagate state information

• Perform synchronized line stop

• Manage restart sequence

13. Prevention of Abnormality Propagation

An abnormality in one area should not spread to other functions or devices.

Examples:

• Prohibit feeding the next product after a discharge failure.

• Do not immediately release the clamp after a machining-axis fault.

• Stop upstream feeding when downstream equipment stops.

• Prohibit uncontrolled execution of pneumatic functions when pressure is insufficient.

• Prevent additional products from entering when a jam occurs.

To prevent propagation, the following should be defined:

• Functions to block

• Functions to maintain

• States to transmit to upstream and downstream equipment

• Position in which the product should remain

• Whether energy should be maintained or removed

• Recovery sequence

14. Output Retention and Output Shutdown

Immediately turning every output OFF is not always safe when an abnormality occurs.

Outputs That May Need to Be Maintained

• Vertical-axis brake

• Product-drop-prevention clamp

• Cooling fan

• Lubrication pump

• Safety-door lock

• Vacuum holding

• Pressure-holding valve

Outputs That May Need to Be Disabled

• Hazardous-axis drive

• Additional product feeding

• Heating output

• Cutting and pressing operation

• Abnormal rotating element

• Energy supply to the faulted module

Protective actions should therefore clearly define:

• Outputs to disable

• Outputs to maintain

• Outputs to disable after a delay

• Outputs to maintain conditionally

• Outputs that require manual release

15. Restricted Operation and Degraded Mode

Not every abnormality requires an immediate complete stop.

In some cases, the machine may continue to operate with reduced performance.

Examples of Restricted Operation

• Reduced production speed

• Certain axes disabled

• Manual operation only

• Limited product types

• Reduced maximum torque

• Operator inspection required when automatic inspection is unavailable

• Time-limited operation when one of two redundant sensors fails

Restricted operation requires the following conditions:

• Is restricted operation safe?

• Can product quality still be guaranteed?

• Can the operator clearly recognize the condition?

• Is a time or production-quantity limit defined?

• Is a maintenance request generated automatically?

• Is automatic return to normal mode prevented?

16. Design of Automatic Retry

Some abnormalities can be recovered through automatic retry.

Examples:

• Product realignment

• Cylinder retraction and reextension

• Retransmission of a communication command

• Restart of a feeding device

• Sensor redetection

Automatic retry should define:

• Abnormalities for which retry is permitted

• Abnormalities for which retry is prohibited

• Safe position before retry

• Maximum retry count

• Waiting time between retries

• Restrictions during retry

• Stop level after repeated failure

• Retry-history recording

Automatic retry should be restricted for:

• Functions with possible personnel access

• Functions in which repetition increases product damage

• High-load pressing or cutting functions

• Functions with untrustworthy state information

• Functions in which mechanical jamming is suspected

17. Fault Isolation

The failed device or function should be separated from the rest of the system to prevent further impact.

Isolation Targets

• Electrical power

• Pneumatic supply

• Hydraulic supply

• Communication

• Product movement

• Function commands

• Upstream and downstream interfaces

Isolation Methods

• Output shutdown

• Valve closure

• Communication-node disable

• Transmission of Busy or Fault state

• Product-transfer prohibition

• Exclusion from function selection

After isolation, state information must be communicated clearly so that other modules do not receive incorrect Ready signals.

18. Diagnosis and Cause Classification

Good protective control does not stop at abnormality detection. It should narrow the range of possible causes.

For example, if a cylinder does not reach the forward-completion position, possible causes include:

• Insufficient pneumatic pressure

• Valve not operating

• Cylinder stuck

• Mechanical jam

• Sensor failure

• Sensor displacement

• Product interference

The following information may be used for diagnosis:

• Command-output state

• Valve feedback

• Pressure change

• Position sensors

• Operating time

• Previous-cycle data

• Motor or device load

• Operator confirmation information

The diagnostic result may be presented as a list of probable causes rather than a single confirmed cause.

19. Alarm Structure

An alarm should not be only a code and message. It should help the operator understand and correct the problem.

Information to Include in an Alarm

• Alarm code

• Location

• Function in which it occurred

• Abnormal state

• Probable cause

• Immediate required action

• Recovery condition

• Whether restart is permitted

• Related device

• Time of occurrence

• Number of repetitions

Alarm Message Examples

Inadequate:

• Cylinder Error

• Alarm 102

Appropriate:

• Clamp Cylinder Forward Timeout

• Required action: Check air pressure, product interference, and forward sensor

• Automatic operation cannot resume until clamp position is verified

20. Alarm Priority

When multiple alarms occur, the initial cause and subsequent consequences should be distinguished.

Example:

1. Insufficient pneumatic supply

2. Clamp forward failure

3. Machining start prohibited

4. Cycle-time exceeded

In this case, insufficient pneumatic pressure is the root cause.

Alarm priorities may be organized as follows:

• Root Cause Alarm

• Primary Fault

• Secondary Fault

• Process Consequence

• Informational Event

If every alarm is displayed at the same level, it becomes difficult for the operator to identify the actual cause.

21. Event and History Logging

To analyze abnormality causes, state information before and after the event should be recorded.

Information to Record

• Time of occurrence

• Operating mode

• Function being executed

• Immediately preceding command

• Related sensor states

• Main analog values

• Product information

• Recipe

• Retry count

• Operator action

• Recovery time

For important abnormalities, storing data from both before and after the event is effective.

22. Power Loss and Recovery

Power loss may make the machine state uncertain.

After power is restored, the following should be verified:

• Can the axis position be trusted?

• Has the product position changed?

• Were pneumatic or hydraulic states maintained?

• Was the clamp maintained?

• Is the brake normal?

• Can the previous process continue?

• Is homing required?

Automatic continuation of the previous operation after power recovery should generally be avoided.

The machine should transition to an Unknown or Recovery Required state and permit operation only after revalidation.

23. Response to Loss of Pneumatic or Hydraulic Supply

Loss of pneumatic or hydraulic pressure may cause a device to move unintentionally.

Items to review:

• Does the clamp release?

• Does a vertical axis fall?

• What is the default state of the valve?

• Does residual pressure remain?

• Does sudden movement occur when pressure returns?

• Must the position be verified before repressurization?

Required protective measures may include:

• Check valve

• Pilot-operated check valve

• Pressure-holding device

• Flow restriction

• Drop-prevention valve

• Restart prevention after pressure recovery

24. Response to Communication Failure

The state each device should maintain during communication failure must be defined.

Items to Review

• Should the last command be maintained?

• Should the output be turned OFF?

• Should the device enter a restricted state?

• Should local control continue?

• Should a Fault state be transmitted to the supervisory system?

The default behavior during communication failure may differ by device.

Examples:

• Conveyor performs a controlled stop.

• Clamp remains engaged.

• Heater output is limited.

• Product feeding stops.

• Brake engages.

25. Recovery Stages

Abnormality recovery should preferably proceed through the following stages:

1. Confirm the abnormality and protective action.

2. Confirm that hazardous energy has been limited.

3. Distinguish the root cause from secondary alarms.

4. Remove the cause of the abnormality.

5. Check related devices and sensors.

6. Verify product and tool positions.

7. Resolve incomplete functions.

8. Perform homing if required.

9. Recheck interlocks and protective conditions.

10. Confirm an intentional operator reset.

11. Return to the Ready state.

12. Permit automatic operation only after limited test operation.

Recovery is not simply the process of turning off an alarm bit.

26. Fundamental Principles of Reset

Reset does not remove the cause of an abnormality.

Reset initializes the state only after confirming:

• The cause of the abnormality has been removed.

• The protective action has ended correctly.

• Device positions have been verified.

• Safety conditions are satisfied.

• The machine is ready for restart.

Reset should not be permitted when:

• The abnormal signal is still present.

• Position state is uncertain.

• The hazardous area is being accessed.

• Brake state is uncertain.

• Communication recovery has not been confirmed.

• The recovery procedure has not been completed.

27. Restart Prevention

A machine must not restart automatically simply because an abnormality has been cleared or power has been restored.

Restart requires:

• Intentional operator action

• Confirmation of Ready state

• Verification of product condition

• Verification of device condition

• Verification of safety conditions

• Confirmation that upstream and downstream equipment are ready

Even if a previous output command remains, it must not execute until the restart conditions are satisfied.

28. Relationship with Control State Recognition and Decision

State Recognition and Decision recognizes and classifies abnormal states.

Abnormal and Protective Control uses those results to determine:

• Whether operation should continue

• Whether functions should be restricted

• Whether retry should be performed

• Which devices should stop

• Which outputs should remain active

• What recovery procedure should be followed

In other words:

State Recognition identifies the abnormality, and Protective Control protects the machine and process from its consequences.

29. Relationship with Control Function Execution

When an abnormality occurs during function execution, Protective Control changes or interrupts the execution.

Examples:

• Hold function execution

• Prohibit transition to the next step

• Cancel the current function

• Return to a safe position

• Perform automatic retry

• Transition to a fault state

Function Execution defines normal behavior, while Protective Control defines behavior when normal execution can no longer continue.

30. Relationship with Interlock Control

Interlocks prevent incorrect operation before an abnormality occurs.

Protective Control responds after an abnormality has already occurred or normal conditions have been lost.

Examples:

• Interlock: Prohibit clamp start when pneumatic pressure is insufficient.

• Protective control: If pneumatic pressure drops during clamping, stop processing and maintain the clamp state.

Interlock and protective control therefore have a preventive-response relationship.

31. Relationship with Safety-Related Control

When an abnormal state is connected to personnel risk or a serious hazard, Safety-Related Control takes priority.

Examples:

• General motor overload: protective stop

• Safety guard opens around a rotating element: safety stop

• Product jam: function stop

• Pressing while an operator enters the area: safety stop

The boundary between protective control and safety-related control should be defined through risk assessment.

32. Interface with Assembly

The performance of protective control depends on the actual assembly condition.

Required Assembly Information

• Sensor installation position

• Overtravel-stopper position

• Brake installation direction

• Pressure-switch setting

• Torque-limiter setting

• Cable and piping connections

• Cooling and lubrication piping

• Accessibility of protective devices

• Inspection points

Installation criteria and inspection methods should be provided so that assembly errors do not lead to protective-control malfunction.

33. Interface with Manufacturing

The same protective decisions and responses must be reproduced on every manufactured machine.

Parameters to Manage

• Warning threshold

• Stop threshold

• Hysteresis

• Timeout

• Retry count

• Limited speed

• Torque limit

• Pressure limit

• Temperature limit

• Recovery conditions

Manufacturing and Commissioning Tests

• Sensor-fault test

• Timeout test

• Overload test

• Pressure-drop test

• Communication-loss test

• Power-loss test

• Retry test

• Protective-stop test

• Recovery test

• Restart-prevention test

34. Major Design Deliverables

35. Review Questions for Abnormal and Protective Control

Abnormality Definition

• Are normal and abnormal ranges defined?

• Are abnormality, fault, and hazard distinguished?

• Is a timeout defined for every function?

• Is command–response mismatch detected?

Severity

• Has the scope of impact been evaluated?

• Are impacts on product, process, equipment, and personnel distinguished?

• Are protective stop and safety stop distinguished?

• Is state uncertainty reflected in the severity level?

Protective Action

• Are outputs to disable and outputs to maintain defined?

• Is local stopping possible?

• Can abnormality propagation be prevented?

• Are restricted-operation conditions clear?

Retry

• Are retry-permitted abnormalities clearly defined?

• Are the maximum retry count and waiting time defined?

• Is the response after repeated failure defined?

• Is retry restricted for hazardous functions?

Recovery

• Can the root cause be distinguished from subsequent faults?

• Is the actual state reverified before recovery?

• Is the need for homing defined?

• Are reset and restart conditions distinguished?

Assembly and Manufacturing

• Are installation criteria available for protective sensors and devices?

• Can thresholds and parameters be reproduced?

• Can every protective function be tested?

• Are power-loss, communication-loss, and pressure-loss tests included?

36. Conclusion

Abnormal and Protective Control is the control domain that detects abnormalities when the machine deviates from normal conditions, protects equipment, processes, and products according to their impact, and restores the machine to a verifiable state.

Its essence is not to create as many alarms as possible.

The important task is to clearly define:

• What should be classified as abnormal

• What the abnormality affects

• Whether operation may continue

• Which functions should be restricted or stopped

• Which outputs must remain active

• Whether automatic retry is permitted

• How the fault should be isolated

• How the root cause should be distinguished

• How the machine should recover and restart

Good abnormal response and protective control does not simply stop the machine after a fault occurs.

It evaluates the severity and scope of impact, restricts only the necessary functions, and prevents the abnormality from propagating to other devices and processes. It also reverifies the positions of the machine, product, tooling, and energy state after recovery so that operation does not resume in an incorrect condition or the same abnormality does not recur.

This allows Control Function Execution to stop predictably under abnormal conditions, enables Control State Recognition and Decision to provide reliable state information for protective decisions, and allows Safety-Related Control to take priority when an actual hazardous condition occurs.