Best practices + example data
How we build industrial control panels: the pre-release design checklist, wiring conventions, safety circuit concepts, and layout rules we work to. Tables are labeled example / illustrative. Use them to compare bids and ask sharper questions, not as a site-specific design.
Every job
The review we run before a panel is released to build. It is the same list on a one-door machine panel and a multi-bay drive center. Items that do not apply get marked N/A with a reason, not skipped in silence.
Wiring
Wire colors, ferrules, duct fill, and separation of power, control, and safety circuits. These details decide whether a tech can trace a fault in minutes and whether VFD noise ends up on your analog and network signals.
| Circuit | Typical color (example) | Notes |
|---|---|---|
| AC or DC power (ungrounded) | Black | NFPA 79 default; phases identified by marking on the drawings |
| AC control (ungrounded) | Red | NFPA 79 default for AC control circuits |
| AC grounded conductor (neutral) | White / Gray | Identify if multi-wire |
| Ground / PE | Green / Green-Yellow | Continuous equipment grounding |
| DC control (ungrounded) | Blue | NFPA 79 default; plant standard may differ |
| DC control (grounded, 0 V) | White with blue stripe | NFPA 79 default; document on legend |
| Externally powered interlocks | Orange or Yellow | NFPA 79: circuits that stay energized when the panel disconnect is off |
| Safety circuits | Per plant standard | Identify by wire number and label; segregate in duct. Don’t use orange or yellow unless the circuit is externally powered |
| Wire # | From | To | Gauge | Color |
|---|---|---|---|---|
W101 | TB1-1 | VFD-1 L1 | 10 AWG | Black |
W210 | PLC DI0 | LS-101 NO | 16 AWG | Blue |
W401 | Safety relay S11 | E-stop CH1 | 16 AWG | Blue |
W402 | Safety relay S21 | E-stop CH2 | 16 AWG | Blue |
Safety
How e-stop circuits, safety relays, and safety PLCs fit together, and what Category and Performance Level (ISO 13849) mean on a machine. High-level framing only. Certified safety design needs risk assessment and qualified engineers. See also how we use AI on PLC projects.
Emergency stops are typically dual-channel, monitored, with a deliberate reset strategy. Machine cells and line zones often share a safety circuit topology defined by the risk assessment.
Keyence, Banner, and similar Type 4 light curtains protect access points on packing lines, robot cells, and sortation conveyors. Muting for legitimate material flow must be engineered, not improvised in standard PLC logic alone.
ISO 13849 Performance Levels (e.g. PLd/PLe) and Categories describe architecture and reliability. IEC 62061 expresses the same idea as SIL for machinery control systems. Match architecture to the required PL/SIL from the risk assessment.
Simple e-stop chains may use safety relays. Larger lines and cells with several curtains, gates, and sequenced restarts often justify a safety PLC or programmable safety controller with clear diagnostics on the HMI.
Organized by device type, with the models we design with from each brand. Open "Would you like to know more?" on any card for how that device works, how we wire it, and notes on each model. We make no partner or certification claims, and we specify whatever brand your plant already stocks.
Presence sensing
An invisible beam grid across an opening that stops the machine the instant someone reaches through, so operators can load parts and clear jams without a hard guard in the way.
Keyence
GL-R · GL-S · GL-V · SL-V
Banner
EZ-SCREEN LS · EZ-SCREEN LP
Allen-Bradley
GuardShield 450L-B · 450L-E
An emitter and receiver build a grid of infrared beams across an opening. A Type 4 curtain (IEC 61496-1/-2) checks itself continuously and switches off two redundant safety outputs (OSSDs) the moment a beam is blocked or it finds an internal fault. Resolution sets what it can detect: 14 mm for fingers, roughly 23–30 mm for hands, and larger for body or perimeter use. The mounting distance comes from ISO 13855, using the curtain's response time plus the machine's measured stopping time.
Guard doors
Switches that confirm a guard door is shut and, with guard locking, keep it shut until the motion behind it has actually stopped.
Keyence
GS-50 · GS-70 · GS-10 · GS-M
Banner
SI-LS42 · SI-RF
Allen-Bradley
440G-LZ · 440G-MZ · SensaGuard 440N
An interlock tells the safety system that a guard is closed. A guard-locking switch also holds the guard shut until the hazard is safe. There are two locking principles:
Coding (ISO 14119): low means the switch accepts any actuator of that type. High means it accepts only a taught, uniquely coded actuator (more than 1,000 possible codes), which makes it much harder to defeat with a spare actuator.
Area & vehicle protection
A laser that watches a floor area and stops or slows equipment when someone walks in. It suits robot cells, palletizers, and AGVs where a fence doesn't fit.
Keyence
SZ-V
Banner
SX5
Allen-Bradley
SafeZone 3 · SafeZone Mini
A scanner sweeps a laser across a wide fan and measures distance to build a 2-D picture of the floor. Anything entering the protective field turns the safety outputs off. Warning fields further out drive non-safety outputs, such as a horn or a slow-down. Fields are stored in sets (banks) that are switched by inputs, so an AGV can stretch its field as it speeds up, or a robot cell can shrink the field on the side the arm isn't working. Scanners are Type 3 devices under IEC 61496-3. The SZ-V and SafeZone are rated PL d, so a PL e function needs a different device.
Safety logic
The logic that decides when it's safe to run. It checks each e-stop, curtain, and door on two channels and refuses to reset if a contactor has failed.
Keyence
GC series · SC series
Banner
SC10-2 · SC26-2 · XS26-2
Allen-Bradley
Guardmaster 440R (DG, GLT) · 440C-CR30
Siemens
SIRIUS 3SK1 · 3SK2
A safety relay watches one safety function, such as a dual-channel e-stop or gate, using redundant force-guided relays. It detects faults between the two channels and won't allow a reset until its feedback loop proves the contactors have dropped out. A monitored manual reset means the reset button has to be pressed and released, so a jammed button can't restart the machine. Configurable controllers handle several functions and zones with drag-and-drop logic. Delayed outputs give a Stop Category 1: the drive ramps down first, then power is removed.
Plant-wide safety
One controller for both standard and safety logic, with safety I/O over the plant network. It suits multi-zone lines with many curtains, gates, and sequenced restarts.
Allen-Bradley
Compact GuardLogix 5380 · GuardLogix 5580
Siemens
S7-1500F · ET 200SP F-DI / F-DQ
One controller runs both the standard program and the safety program, but they are kept apart. Safety logic runs in its own certified task or runtime group, with its own tags and a signature that changes if anyone edits it. Standard logic can read safety data but can't write to it. Safety I/O, drives, and scanners talk over a safety protocol (CIP Safety or PROFIsafe) on the same Ethernet network as the standard I/O. This is the right fit for multi-zone lines and cells with many curtains, gates, and sequenced restarts.
Stopping the motor
Shuts off motor torque inside the drive, so a motor stops safely without contactors cycling on every stop. It is not a maintenance disconnect.
Allen-Bradley
PowerFlex 525 · PowerFlex 755
Siemens
SINAMICS G120
STO cuts the gate signals to the drive's output transistors, so the motor can't produce torque, without opening the power circuit. On its own that's a coast stop (Stop Category 0). Paired with a delayed output, it becomes a Stop Category 1. On many machine and line designs STO replaces the output contactors and allows faster, wear-free restarts.
STO is not a disconnect. The DC bus and motor leads can still be live. Electrical or mechanical work still needs lockout/tagout at the disconnect (OSHA 1910.147).
Emergency stop
Buttons and pull-cords along the line that anyone can hit to stop the hazard. They are built so a welded contact or a loose contact block can't keep the machine running.
Allen-Bradley
800F e-stops · 800F-X01S · Lifeline 5 (440E)
Banner
SSA-EB1PL lighted e-stops
Keyence
GS cascade
An e-stop has direct-opening (positive-opening) NC contacts: pushing the button forces them apart mechanically, even if they've welded. It latches in, and is released by twisting or pulling it out. Releasing it doesn't restart the machine; a separate reset is required. Along long machines or conveyors, pull-cord switches give an e-stop anywhere along the run.
Whatever the brand, the device is only one part of a safety function. Input, logic, and output (contactors, or STO on the VFD) all count toward the PL you actually achieve. Ratings above are the manufacturers' published figures; always confirm them against the current manual for the exact catalog number.
The references behind our safety and panel designs. Which ones apply to your machine comes out of the risk assessment.
Risk assessment & functional safety
Electrical equipment & stopping
Guards & protective devices
Machines, robots, conveyors & US regulation
PL measures how reliable a safety function is, expressed as the average probability of a dangerous failure per hour (PFHD). PL a is the lowest and PL e the highest.
| PL | PFHD (dangerous failures per hour) | Roughly |
|---|---|---|
| a | 10⁻⁵ to < 10⁻⁴ | Lowest risk reduction |
| b | 3 × 10⁻⁶ to < 10⁻⁵ | Low |
| c | 10⁻⁶ to < 3 × 10⁻⁶ | Medium (minimum for an e-stop per ISO 13850) |
| d | 10⁻⁷ to < 10⁻⁶ | High; common on guarded machine access |
| e | 10⁻⁸ to < 10⁻⁷ | Highest |
Required PL (PLr) comes from the risk graph in ISO 13849-1, which asks three questions about each hazard:
For example, S2 + F2 + P2 gives PLr e, and S1 + F1 + P1 gives PLr a. The PL you achieve is then calculated from four things: the Category (architecture), MTTFD (mean time to dangerous failure of each channel), DCavg (diagnostic coverage, meaning how many faults are detected), and CCF (measures against common-cause failures). The achieved PL must be at least the PLr.
The Category describes the architecture of the safety circuit: how many channels it has and what happens when a component fails.
| Category | What it means | On a fault | Typical machine use |
|---|---|---|---|
| B | Single channel built to basic safety principles | Safety function can be lost | Low-risk functions only; rarely the right answer for guarding |
| 1 | Single channel using well-tried components and principles | Can still be lost, but faults are less likely | A positive-opening guard switch on a low-risk cover |
| 2 | Single channel that is tested periodically | Loss is possible between tests; the test catches it | Type 2 light curtain with a start-up test on a low-energy transfer |
| 3 | Dual channel and single-fault tolerant | One fault doesn't lose the function; most faults are detected | Dual-channel e-stop and light curtain into a monitored safety relay |
| 4 | Dual channel with high diagnostics | Faults are detected in time; a build-up of faults still doesn't lose the function | Safety PLC or controller with OSSD inputs and monitored outputs, e.g. high-risk robot or palletizer cells |
SIL is the IEC way to rate the same thing. For high-demand or continuous machinery functions, it uses the same PFHD bands:
| SIL | PFHD (dangerous failures per hour) |
|---|---|
| SIL 1 | 10⁻⁶ to < 10⁻⁵ |
| SIL 2 | 10⁻⁷ to < 10⁻⁶ |
| SIL 3 | 10⁻⁸ to < 10⁻⁷ |
SIL 4 exists in IEC 61508 (and the process-industry standard IEC 61511) but is not used for machinery. IEC 62061 stops at SIL 3.
| PL (ISO 13849-1) | ≈ SIL (IEC 62061) |
|---|---|
| PL a | No SIL equivalent |
| PL b | SIL 1 |
| PL c | SIL 1 |
| PL d | SIL 2 |
| PL e | SIL 3 |
The comparison is approximate and based on the PFHD ranges. The two standards calculate differently, so pick one method per safety function and stay with it.
"CAT" means two different things. A Category (B, 1–4) in ISO 13849-1 describes circuit architecture. A Stop Category (0, 1, 2) in IEC 60204-1 and NFPA 79 describes how the machine stops:
A machine e-stop is often "Category 3, PLd" for the circuit and "Stop Category 0 or 1" for the stop. Both can be correct at the same time.
Device-by-device detail is in Safety hardware we design with above.
Take a guarded transfer section with an operator access opening, a light curtain across it, and e-stops along the line. A risk assessment for this setup may come out at PLr d. A common way to meet it is a Category 3 design:
Then the design is verified (PL calculation, e.g. with the IFA SISTEMA tool) and validated against ISO 13849-2 before sign-off.
Important: This section is general education, not engineering advice. Final required levels (PLr or SIL) come from your machine's risk assessment, and safety functions should be designed, verified, and validated by a qualified safety engineer.
Panel building
Layout and thermal decisions are cheap on paper. The same fixes after the panel is built mean new holes, added fans, or a bigger enclosure. These are the rules we check before a panel is released to the shop floor.
Keep VFDs and power supplies spaced for airflow; place heat-sensitive I/O away from drive exhaust.
Bond enclosure, DIN rail, and cable shields per manufacturer and NEC practice; single-point strategies for sensitive comms where specified.
Schematics, panel layout, BOM, wire list, PLC I/O map, SCCR worksheet, nameplate data, and FAT checklist.
| Signal type | Approx. count | Examples |
|---|---|---|
| Digital inputs | 48 | PE, photoeyes, zone full, VFD ready/fault |
| Digital outputs | 24 | Run commands, valves / solenoids, stack lights |
| Analog / specialty | 4 | Optional speed ref, scale |
| Safety I/O | 16 channels | E-stop dual channel, curtain OSSD, gate |
| Network devices | 8–12 | VFDs, IO-Link master, HMI, remote I/O |
