A binary logic diagram draws an interlock as a network of logic elements, stating in plain language what each input and output represents and leaving the implementation entirely open. ISA-5.2, Binary Logic Diagrams for Process Operations, is the standard behind it. Issued in 1976 and reaffirmed in 1992, it gives the notation one property that keeps it in use, which is that the same drawing is valid whether the logic ends up in relays, a programmable controller, a safety system or pneumatics.
In short
- The diagram describes logic, not a controller. Hardware independence is the point of the standard and the reason a 1976 notation still appears on current projects.
- Inputs and outputs are written as process conditions in ordinary words, which is what makes the sheet readable by an operator who does not read ladder.
- Beyond AND, OR and NOT, the useful symbols are the count gate, the memory element and the two timers. Those three carry behaviour a matrix cannot express.
- Set and reset dominance on a memory element is load-bearing and easily lost in transcription. Check it before anything else on a legacy sheet.
- The interlock exists in three documents at once. Knowing what each form cannot hold is more useful than knowing what each one contains.
What the standard standardises
The scope is narrower than it first looks, and the narrowness is deliberate. ISA 5.2 covers binary operations, meaning signals that are true or false, on or off, present or absent. It does not cover analog computation, which is where SAMA and function block notation take over, and it does not prescribe how the logic is built.
That last exclusion is the value. A plant commissioned with relay logic, migrated to a programmable controller in the 1990s and moved to a safety system in the 2010s can carry the same binary logic diagram through all three, because the diagram never said how the AND was implemented. The implementation documents change every time. The logic document does not.
Inputs and outputs are stated as conditions rather than as tags alone. A well-drawn sheet reads
"discharge pressure above 12.5 bar" beside the input rather than PSH-1042 on its own, so the
drawing can be checked by someone who knows the process without a tag list in the other hand.
The symbol set
| Element | What it does | Read it as |
|---|---|---|
| AND | Output true only when every input is true | All of these conditions together |
| OR | Output true when any input is true | Any one of these conditions |
| NOT | Inverts the input | This condition is absent |
Qualified OR, n of m | Output true when at least n of m inputs are true | Two of these three transmitters agree |
| Memory | Latches true when set, holds until reset | Once tripped, stay tripped |
| Delay on initiation | Output true after the input has held true for the set time | Ignore anything shorter than this |
| Delay on termination | Output stays true for the set time after the input falls | Keep running for this long afterwards |
| Input | A process condition entering the logic | Stated in words beside the symbol |
| Output | An action leaving the logic | Stated in words beside the symbol |
The qualified OR is the one most often met and least often recognised. A two out of three arrangement on triplicated transmitters is drawn as a single qualified gate rather than as an expansion into three ANDs feeding an OR, and a reader who does not know the symbol will misread a voting arrangement as a simple any-of condition.
Timers and memory, the two that carry state
AND, OR and NOT are memoryless. Given the inputs, the output follows immediately and the past does not matter. The three remaining elements all carry state, and they are where most transcription errors live.
| Element | The detail that matters | What goes wrong when it is lost |
|---|---|---|
| Memory | Which input dominates when set and reset are both true | A latched trip becomes self-clearing, so the plant restarts on its own |
| Delay on initiation | The time value, and whether the timer resets on a momentary clear | Either nuisance trips return, or a real excursion is filtered out |
| Delay on termination | Whether the delay applies to the output or to a downstream permissive | A purge or run-on period ends early or never ends |
A diagram that shows a memory element without stating its dominance is incomplete, not concise. It is the single most useful thing to check when reviewing a sheet drawn by someone else.
A worked decode
Take a pump start permissive and read it element by element.
| Step | Element | Inputs | Output |
|---|---|---|---|
| 1 | Input | Suction valve fully open | True when the limit switch is made |
| 2 | Input | Suction pressure above minimum | True above the stated value |
| 3 | Delay on initiation, 5 s | Step 2 | True only after pressure has held for five seconds |
| 4 | Input | Motor not in local isolation | True when the isolator is in remote |
| 5 | AND | Steps 1, 3 and 4 | Start permissive available |
| 6 | Input | Operator start command | True on the command |
| 7 | AND | Steps 5 and 6 | Start request |
| 8 | Memory, reset dominant | Set from step 7, reset from the trip network | Pump run command |
| 9 | Delay on termination, 60 s | Step 8 | Seal flush stays energised for a minute after stop |
Three things are visible here that a matrix could not have shown. The five second delay at step 3 says a brief pressure dip is deliberately ignored, which is a design decision someone made and can be asked about. The reset dominance at step 8 says a trip beats a start command, which is the behaviour that keeps the pump stopped while a fault persists. The termination delay at step 9 says the seal flush outlives the pump, which is a protective behaviour with no corresponding cause.
The same interlock written as a cause and effect matrix would carry rows for the trip causes and columns for the stop actions, and would lose all three.
The same interlock, three documents
| Binary logic diagram | Cause and effect matrix | Control narrative | |
|---|---|---|---|
| Best at | Showing sequence, timing and latching | Showing breadth, many causes against many effects | Showing intent and the reason behind a decision |
| Cannot hold | More than a few dozen inputs on one readable sheet | Timers, latches, counts or any order of events | Anything that can be checked mechanically |
| Read by | Engineers configuring or reviewing the logic | Operations, safety reviews and commissioning | Everyone, including people outside the discipline |
| Fails by | Growing into an unreadable sheet | Silently omitting behaviour it cannot express | Drifting from the logic it describes |
| Governs when they disagree | Usually, for behaviour | Usually, for coverage | Rarely, but it explains which of the other two is wrong |
The practical rule that follows is to treat the three as one deliverable with three views rather than three documents. When a change lands, the question is not which one to update but which one the change is expressible in, because a change that only fits the logic diagram is precisely the change a matrix-only project will lose.
ISA 5.2 against the notations you are more likely to have seen
| Notation | Shape convention | Where you meet it |
|---|---|---|
| ISA 5.2 | Named function blocks, function written inside | Process industry interlock and sequencing sheets |
| IEC 60617-12 | Rectangular blocks with a qualifying symbol, plus older distinctive shapes | Electrical schematics and European projects |
| IEC 61131-3 function block diagram | Rectangular blocks, implementation-oriented | Inside the controller configuration itself |
| Ladder | Contacts and coils | Controller programs, and relay logic before them |
The migration trap is real. A binary logic diagram is deliberately implementation-free, and a function block diagram exported from a controller is deliberately implementation-specific. Treating the exported diagram as the logic document means the next migration starts from a description of the old controller rather than a description of the interlock, and the design decisions behind the timers and the dominance are gone.
What to check on a legacy sheet
Read the legend first, because gate shapes vary between the conventions above and a misread OR is a plausible mistake rather than an obvious one. Confirm every memory element states its dominance. Confirm every timer carries a value and a direction, since a timer symbol with no time beside it is a drawing that was never finished. Check that each input reads as a process condition and not as a bare tag, and where it is a bare tag, join it back to the instrument index before trusting it. Finally, take the sheet to the cause and effect matrix and confirm the two describe the same interlock, since the pair are maintained separately far more often than they are reconciled.
For the matrix form of the same information, see the cause and effect matrix. For the identification standard that names the tags these diagrams reference, see the ISA 5.1 instrument identification guide. For the shutdown systems these interlocks usually serve, see PSD and ESD compared.