I see two issues:
1) I don't think that the program shown in the OP is going to work as expected.
For example, consider the following sequence of events, starting will all tag values being 0 (Out_Interr contactor is open),and the timers not timing
1.1) The operator performs the first action on the HMI CHIUDERE (CLOSE) button
1.1.1) HMI_Ch will change to 1 (PLC Input scan); on the next PLC Program Scan:
1.1.1.1) Aux_Timer2 will start timing (Rung 2)
1.1.1.2) Aux_Timer2.DN will be (stay) 0 for up to 5 seconds of time
1.1.1.3) Aux_Timer2.EN will change from 0 to 1 (Rung 2)
1.1.1.4) Aux_Out_Ch will be latched to 1 because of Aux_Timer2.EN (Rung 2)
1.1.1.4.1) I.e. as long as HMI_Ch is 1
1.1.1.5) Out_Interr will be latched to 1 (Rung 3)
1.1.2) N.B. (Nota Bene) Out_Interr will continue to be latche on every following PLC Program Scan
1.1.2.1) as long as Aux_Out_Ch is 1, and
1.1.2.2) the timer is not done
1.1.3) Because Out_Interr is now 1, the physical contactor will close
1.2) After 1 second of time, and before Aux_Timer2 completes, the operator performs the second action on the HMI CHIUDERE (CLOSE) button
1.2.1) HMI_Ch will change to 0 (PLC Input scan); on the next PLC Program Scan:
1.2.1.1) Aux_Timer2 will stop timing and reset; (Rung 2)
1.2.1.1.1) Aux_Timer1.EN will become 0
1.2.1.1.2) Aux_Timer1.DN will never become 1
1.2.1.2) The Aux_Out_Ap value will stay at 1 because it was latched (Rung 2)
1.2.1.2.1) Even though Aux_Timer2.EN is 0
1.2.2) N.B. Out_Interr will continue to be latched to 1 on every following PLC Program Scan (Rung 3)
1.2.2.1) Because Aux_Out_Ch is 1, and
1.2.2.2) the timer will never complete (Rung 2)
1.2.3) Because Out_Interr remains 1 and Aux_Out_Ap is 0, the physical contactor stays closed
1.3) Sometime later the operator performs the first action on the HMI APRIRE (OPEN) button
1.3.1) HMI_Ap will change to 1 (PLC Input scan); on the next PLC Program Scan:
1.3.1.1) Aux_Timer1 will start timing (Rung 1)
1.3.1.1.2) Aux_Timer1.DN will be (stay) 0 for up to 5 seconds of time
1.3.1.1.3) Aux_Timer1.EN will change from 0 to 1 (Rung 1)
1.3.1.1.4) Aux_Out_Ap will be latched to 1 because of Aux_Timer1.EN (Rung 1)
1.3.1.1.4.2) I.e. as long as HMI_Ap is 1
1.3.1.1.5) Out_Interr will be unlatched to 0 on Rung 4
1.3.1.1.5.1) N.B. However Out_Interr is still being latched to 1 on Rung 3
1.3.1.1.5.1.1) Because Aux_Out_Ch is still 1 because it was latched on Rung 2 and never unlatched
1.3.2) N.B. this will continue happen on every PLC Program Scan as long as HMI_Ap is 1
1.3.3) The physical contactor will usually be opened on the PLC Output Scan, because the Aux_Out_Ch value is 0
1.3.3.1) N.B. However, if the PLC Output Scan interrupts the program Scan between Rung 3 and Rung 4,
1.3.3.2) Then the physical contactor will be closed
1.3.3.3) Because Out_Interr has a value of 1 between Rung 3 and Rung 4
1.3.3.4) And this could happen on every other scan
1.4) The operator does not perform the second action on the HMI APRIRE (OPEN) button for at least 5 seconds of time
1.4.1) Aux_Timer1 will complete, (Rung 1); on that same scan
1.4.1.1) the Aux_Timer1.EN value will remain 1 (Rung 1)
1.4.1.2) the Aux_Timer1.DN value will become 1 (Rung 1)
1.4.2) Aux_Out_Ap will be unlatched to 0 (Rung 1, lower branch)
1.4.3) Out_Interr will be latched to 1 on Rung 3, because Aux_Out_Ch will still be 1
1.4.4) Out_Interr will no longer be unlatched to 0 on Rung 4, because Aux_Out_Ap will remain 0
1.4.5) The physical contactor will be closed, and stay closed, because Out_Inter will stay 1
That is only one possible scenario. This is a case of "The only thing worse than a program not doing what you want, is when it does what you told it to do."
2) The desired behavior when the PLC goes down:
-if for same case the PLC goes down the contactor must not be modified.
[N.B. I would appreciate if someone with more experience would confirm what I am saying here (Update: @parky already confirmed this):]
I do not believe that desired behavior, to maintain contactor state if the PLC goes down, will happen in the current design, because the Out_Interr output will become 0 if the PLC mode is changed or the PLC is powered off, which will open the contactor. The latch on Out_Interr to 1 only retains, and returns to, its previous state when the PLC is comes back up, e.g. after a power (on => off => on) or mode (Run => Program => Run) cycle.
If it is desired to maintain the physical contactor state when the PLC goes down, there will need to be an external physical seal-in circuit e.g. see
http://www.contactandcoil.com/patterns-of-ladder-logic-programming/startstop-circuit/. That would also require two PLC outputs per contactor, because the external circuit cannot distinguish between the output becoming 0 from operator action vs. the PLC going down. That said, if there was a way to detect externally whether the PLC was up or down, there should be a way to wire some external logic to use only one PLC output to achieve the desired behavior.
to close => chiudere
to open => aprire
contactor => conttore
switch => interruttore
Caveat
The problem statement does not say whether the HMI command button is a toggle button or momentary button. I assumed it is a toggle button, that is, the operator performs one action to turn it on so its tag (HMI_Ap or HMI_Ch) value becomes a 1 in the PLC and stays that way, and they perform a second action to turn it off so its tag value becomes a 0 in the PLC. The second action may be identical to the first (e.g. press the same spot on the HMI) and it is only the ordering that determines if it puts a 1 or a 0 into the PLC tag value. It does not matter above if it is actually a momentary button (press and hold to put and keep a 1 in the PLC tag value; release to put and keep a 0 in the PLC tag value).