Functional Safety 101: How to Design Control Panels That Meet SIL and PL Requirements
Functional safety applies to electrical, electronic, and programmable electronic systems that perform safety functions. In conveyor and material handling applications, these systems detect hazardous conditions and place equipment into a defined safe state.
Control panel design must address:
- Hazard detection
- Safety-related inputs
- Safety logic
- Safety outputs
- Emergency-stop circuits
- Guard interlocks
- Drive safety functions
- Contactor feedback
- Panel wiring
- Fault monitoring
- Verification
- Validation
- Maintenance
Conveying Controls L.L.C. provides electrical control systems, comprehensive schematic drawings, panel control wiring, conveyor control wiring, PLC and HMI integration, procurement services, and FLA calculations for industrial applications.
FUNCTIONAL SAFETY TERMS
SAFETY FUNCTION
A safety function defines the action required to reduce a specific hazard.
Examples:
- Emergency-stop activation removes hazardous motion.
- Guard-door opening prevents conveyor operation.
- Light-curtain interruption stops equipment.
- Overspeed detection prevents continued movement.
- Drive fault detection removes torque-producing power.
- Pull-cord activation stops a conveyor zone.
Each safety function requires documented parameters:
- Hazard
- Initiating condition
- Required safe state
- Response time
- Reset method
- Restart conditions
- Operating modes
- Required SIL or PL
- Verification method
SAFE STATE
The safe state is the condition that prevents or limits the identified hazard.
Examples:
- Motor power removed
- Drive torque disabled
- Conveyor motion stopped
- Pneumatic energy isolated
- Automatic restart inhibited
- Hazardous zone placed under controlled stop
The safe state must correspond to the equipment, hazard, operating mode, and risk assessment.
SIL AND PL REQUIREMENTS
SIL
Safety Integrity Level, or SIL, is used within IEC 61508 and IEC 62061 methodologies.
Machinery applications commonly reference:
- SIL 1
- SIL 2
- SIL 3
SIL evaluation uses probability of dangerous failure per hour, commonly identified as PFHd. The calculated PFHd for the implemented safety function must meet the required range for the target SIL.
IEC 62061 addresses the functional safety of safety-related control systems used in machinery.
PL
Performance Level, or PL, is defined by ISO 13849-1 for safety-related parts of control systems.
PL categories include:
- PL a
- PL b
- PL c
- PL d
- PL e
PL evaluation includes:
- Category
- MTTFd
- DCavg
- Common-cause failure controls
- Architecture
- Component reliability
- Diagnostic capability
ISO 13849-1:2023 establishes a methodology for designing and integrating safety-related parts of control systems.
ISO 13849-2:2012 addresses validation through analysis and testing.
SIL AND PL SELECTION
SIL and PL use different methodologies. A project should identify the applicable standard and use that method consistently for each safety function.
Required values must come from a formal risk assessment. General examples do not establish the requirement for a specific machine:
- Emergency-stop function: possible PL d, PL e, or SIL 2 requirement
- Guard interlocking: possible PL d, PL e, or SIL 2 requirement
- Safe Torque Off integration: manufacturer-certified capability combined with system-level verification
- Conveyor pull-cord circuit: risk-based selection based on conveyor layout and exposure conditions
The control panel does not receive a SIL or PL designation independently from the safety function. The safety function, including input devices, logic, outputs, wiring, software, and application conditions, must be evaluated as a complete system.
CONTROL PANEL DESIGN WORKFLOW
1. DEFINE THE EQUIPMENT
Document the equipment under control.
Required information:
- Conveyor sections
- Motors and drives
- Transfer points
- Guarded areas
- Loading and unloading areas
- Operator stations
- Maintenance access points
- Automatic and manual modes
- Jog and setup functions
- Communication interfaces
- Upstream and downstream equipment
The equipment boundary must be defined before safety functions are assigned.
2. COMPLETE THE RISK ASSESSMENT
Identify hazards associated with:
- Unexpected conveyor movement
- Ingoing nip points
- Crushing
- Entanglement
- Stored energy
- Electrical exposure
- Pneumatic movement
- Uncontrolled restart
- Access during maintenance
- Communication loss
- Component failure
The risk assessment determines the required risk reduction and establishes the required PLr or target SIL for each safety function.
An emergency stop is a supplemental control function. It does not replace fixed guards, interlocked guards, presence-sensing devices, or other required machine guarding methods.
3. WRITE THE SAFETY REQUIREMENTS SPECIFICATION
The Safety Requirements Specification, or SRS, defines the design requirements for each safety function.
Include:
- Safety function name
- Hazard addressed
- Input device
- Logic device
- Output device
- Safe state
- Stop category
- Maximum response time
- Required PLr or SIL
- Reset conditions
- Restart conditions
- Fault response
- Diagnostic requirements
- Proof-test interval
- Validation procedure
The SRS provides the design basis for electrical schematics, panel wiring, PLC programming, component selection, and commissioning.
4. SELECT THE SAFETY ARCHITECTURE
Architecture must match the required safety performance.
Common arrangements include:
- Single-channel circuits
- Dual-channel circuits
- Monitored dual-channel circuits
- Safety relays
- Safety controllers
- Safety PLCs
- Drive-integrated safety functions
- Redundant contactors
- Feedback monitoring
Higher required performance generally requires fault tolerance, diagnostics, and protection against common-cause failures.
Component selection must use manufacturer data for:
- MTTFd
- B10d
- PFHd
- Diagnostic capability
- SIL capability
- PL capability
- Mission time
- Environmental limits
- Approved wiring configurations
Do not assign a component rating to the complete safety function without evaluating the complete input-to-output circuit.
5. DESIGN PANEL LAYOUT AND PANEL WIRING
Electrical control panels must support the safety architecture through physical arrangement and documented wiring.
Panel wiring practices include:
- Separate safety-related circuits from standard control circuits where required.
- Separate power conductors from low-level safety signals.
- Protect safety wiring from physical damage.
- Use appropriate terminal blocks.
- Provide redundant channels when required.
- Prevent unintended cross-connections.
- Identify safety terminals and devices.
- Maintain conductor and terminal references.
- Provide feedback wiring from monitored contactors.
- Use grounding and bonding practices appropriate to the system.
- Maintain access for inspection and testing.
- Provide wire duct capacity for future modifications.
- Protect circuits against short circuits and overcurrent.
- Coordinate disconnects, fuses, breakers, and SCCR requirements.
Safety-related wiring must be represented accurately in the schematic drawings. Drawings should show:
- Device references
- Terminal numbers
- Conductor numbers
- Channel identification
- Input and output addresses
- Feedback contacts
- Reset circuits
- Interlock circuits
- Power removal paths
- Drive safety connections
- Safety PLC or relay logic
Conveying Controls L.L.C. provides comprehensive schematic drawings for machine control wiring, conveyor control wiring, and panel control wiring.
6. INTEGRATE DRIVES AND MOTOR CIRCUITS
Conveyor applications frequently use variable frequency drives, motor starters, contactors, and overload protection.
The safety design must define:
- Drive stop method
- Safe Torque Off usage
- Controlled or uncontrolled stopping
- Motor contactor arrangement
- Contactor feedback
- Restart inhibit
- Brake control
- Stored mechanical energy
- Regenerative energy
- Response time
- Drive fault handling
Safe Torque Off disables torque production within the drive. It does not necessarily isolate all electrical energy. Disconnecting, isolation, lockout/tagout, and maintenance requirements must be addressed separately.
FLA calculations support conductor, overcurrent protection, disconnect, starter, and motor circuit specification. FLA calculations do not replace functional safety calculations.
VERIFICATION AND VALIDATION
VERIFICATION
Verification confirms that the design meets the documented requirements.
Verification activities include:
- Review the SRS.
- Confirm component ratings.
- Review electrical schematics.
- Check safety circuit architecture.
- Calculate PFHd or PL.
- Review MTTFd and DCavg data.
- Evaluate common-cause failure controls.
- Check response time.
- Confirm diagnostic coverage.
- Review software logic.
- Confirm stop-category implementation.
- Check reset and restart behavior.
For ISO 13849 applications, calculation tools such as SISTEMA can support PL evaluation. For IEC 62061 applications, PFHd calculations and manufacturer safety data support SIL verification.
VALIDATION
Validation confirms that the installed system performs the specified safety functions.
Validation testing should include:
- Emergency-stop activation
- Guard-door opening
- Light-curtain interruption
- Pull-cord activation
- Safety relay operation
- Safety PLC input and output behavior
- Contactor feedback
- Drive STO response
- Reset operation
- Restart prevention
- Power-loss response
- Wire-break detection
- Communication-loss response
- Manual, automatic, jog, and maintenance modes
- Response-time measurement
- Fault simulation where permitted
Validation records should identify:
- Test date
- Equipment identification
- Safety function
- Test method
- Expected result
- Actual result
- Deficiencies
- Corrective actions
- Approval
OPERATION AND MAINTENANCE
Functional safety continues after commissioning.
Required lifecycle controls include:
- Periodic safety-function testing
- Emergency-stop inspections
- Guard and interlock inspections
- Contact inspection
- Safety relay diagnostics
- Safety PLC diagnostic review
- Drive safety-function testing
- Schematic revision control
- Component replacement control
- Software change management
- Proof-test documentation
- Operator and maintenance training
Panel modifications require review against the original SRS. Changes to motors, drives, guarding, operating modes, safety devices, or control logic may require a new risk assessment and updated PL or SIL verification.
CONTROL PANEL DESIGN CHECKLIST
Use the following checklist before release:
- Equipment scope defined
- Operating modes documented
- Hazards identified
- Risk assessment completed
- Safety functions listed
- PLr or target SIL assigned
- SRS approved
- Safety architecture selected
- Components supported by manufacturer data
- Safety-related panel wiring documented
- Safety circuits separated and labeled
- Feedback monitoring included where required
- FLA calculations completed
- SCCR and overcurrent protection reviewed
- PLC and HMI interfaces defined
- Safety software reviewed
- PFHd or PL calculation completed
- Validation procedure prepared
- Functional tests completed
- Documentation released
- Maintenance schedule established
CONVEYING CONTROLS L.L.C. SUPPORT
Functional safety requires coordination between risk assessment, electrical control panels, panel wiring, industrial control systems, safety devices, drives, schematics, calculations, and validation records.
Conveying Controls L.L.C. supports industrial automation projects through:
- Full system concept and design
- Electrical control panel design
- Conveyor control wiring
- Machine control wiring
- Panel control wiring
- Comprehensive schematic drawings
- FLA calculations
- Procurement and specification services
- PLC-based control platforms
- HMI-based control platforms
- Project coordination
- End-to-end customer service
- Exclusive shipping for order protection
REVIEW. CALCULATE. VALIDATE.
© 2026 Conveying Controls L.L.C. All rights reserved.