How to Design a Pneumatic Circuit for Sequential Cylinder Operation

A pneumatic circuit for sequential cylinder operation should advance only after the preceding motion has reached a defined completion state. Start by writing the motion sequence, then assign one command, one completion signal, one timeout, and one fault response to every step. Valve selection comes after that logic is clear.

This guide uses the four-motion example A+ → B+ → B− → A−. The plus sign means extension and the minus sign means retraction. The same design method works for a fully pneumatic cascade circuit, an electropneumatic relay circuit, or a PLC-controlled valve manifold.

Sequential pneumatic cylinder circuit is a control system that commands two or more actuator motions in a defined order and verifies the permitted transition between steps. This worked example explains control design; it does not replace the machine-specific risk assessment, safety requirements specification, or validation required for a real installation.

Key Takeaways

• Write the sequence and state table before drawing valve symbols.
• Use end-position feedback for motion completion and timers for fault detection, not as universal substitutes for feedback.
• Cascade groups prevent opposing pilot signals in air-only circuits.
• Define air loss, power loss, stop, reset, and restart behavior separately.

How Do You Turn a Motion Requirement into a State Table?

ISO 4414:2010 covers pneumatic-system design, adjustment, continuous operation, maintenance, reliability, energy efficiency, and significant hazards. That scope makes a four-step state table more useful than a valve-only sketch: it records the command, physical completion evidence, timeout, and fault response for every motion (ISO 4414, 2010).

Begin with unambiguous motion notation:

• A+: cylinder A extends;
• A−: cylinder A retracts;
• B+: cylinder B extends;
• B−: cylinder B retracts.

For A+ → B+ → B− → A−, define the initial condition as both cylinders retracted. The cycle must not start merely because a start pushbutton is pressed. It should start only when the required initial sensors, pressure conditions, guards, and machine enables are valid.

Step	Commanded motion	Required completion evidence	Timeout action	Next step
0: ready	neither cylinder moves	A retracted, B retracted, cycle enable valid	inhibit start and identify missing condition	A+
1	A extends	A extended sensor valid	stop sequence, remove or hold commands as designed, alarm	B+
2	B extends	B extended sensor valid	stop sequence and alarm	B−
3	B retracts	B retracted sensor valid	stop sequence and alarm	A−
4	A retracts	A retracted sensor valid	stop sequence and alarm	ready or next cycle

“Stop sequence” still needs an engineered definition. Depending on the load and risk assessment, it may mean de-energize a monostable valve, hold a commanded state, vent a controlled zone, engage a mechanical restraint, or execute another validated response. Do not leave that choice to a generic fault message.

The state table should describe permission and proof separately. A command permits a motion; a sensor or qualified process condition proves that the step completed. Combining both meanings in one signal makes troubleshooting difficult and can allow a latched command to be mistaken for physical completion.

Choosing the Control Architecture Before the Valves

One current Festo pneumatic counter accepts a 10 ms count pulse but needs a 180 ms reset pulse, an 18:1 difference (Festo Learning Components, 2026). Timing and reset behaviour are component-specific, so choose the control architecture before copying a familiar valve circuit.

Architecture	Best fit	State ownership	Main limitation
Pure pneumatic cascade	hazardous or washdown areas where air-only control is justified; simple fixed sequence	reversing valves, group lines, memory elements	limited diagnostics and difficult recipe changes
Pneumatic stepper or sequencer	repeated step logic with defined pneumatic count/reset behaviour	stepper or preselect counter	pulse-width, reset, and pressure limits are model-specific
Relay electropneumatic	small machines with modest I/O and no software requirement	relay logic and valve coils	wiring grows rapidly as interlocks and diagnostics increase
PLC with solenoid valves	changing recipes, diagnostics, multiple modes, data capture, coordinated machines	PLC state machine	software, electrical, pneumatic, and safety boundaries must all be validated

Use one owner for the sequence state. A PLC and a pneumatic memory valve should not both latch the same motion unless their interaction, reset order, and loss response are deliberately specified. Otherwise, the machine may restart from whichever memory returns first.

Pure pneumatic cascade control remains useful when the sequence is short and fixed. It is not automatically more reliable than a PLC circuit. Reliability comes from valid pressure margins, unambiguous signals, controlled reset, accessible test points, and a known response to leakage or supply loss.

For the underlying AND, OR, memory, and timing functions, use the separate guide to pneumatic logic valves in control-system design. For valve-island layout and shared pressure zones, see building a reliable modular pneumatic circuit.

How Do Cascade Groups Prevent Signal Conflict?

Festo’s 2025 training catalogue identifies the cascade principle and sequential multi-cylinder cascade control by grouping method as distinct design topics (Festo Training Catalogue, 2025). Grouping prevents two opposing commands from reaching the same double-piloted valve at one time. This is its practical purpose.

For A+ → B+ → B− → A−, the minimum grouping is:

• Group 1: A+ → B+
• Group 2: B− → A−

The split occurs before B− because cylinder B would otherwise appear twice in one group with opposing motions. A group selector pressurizes only the active group line. The end signal from the last motion in Group 1 changes the selector to Group 2; the final Group 2 signal returns the circuit to its defined ready state.

Cascade group is a consecutive set of actuator motions arranged so that the same cylinder does not receive opposing commands within that group. Each group has one enabling pressure line, and the group-transfer element exhausts the old line before enabling the next one.

Each motion command should be the logical combination of two conditions:

1. the correct group line is pressurized; and
2. the preceding step’s completion valve or sensor is valid.

Do not call every group selector a “memory valve” without checking its actual construction. A bistable spool can retain its switching state, but it does not guarantee retained downstream pressure after supply loss. Leakage, exhaust paths, load forces, and valve centre conditions still determine what the actuators do.

Draw the inactive pilot path as carefully as the active path. Most cascade faults are not caused by a missing command; they are caused by a command that fails to exhaust. A blocked silencer, long control tube, leaking element, or incorrect port can leave residual pressure on the opposing pilot.

Which Valves, Sensors, and Signal Elements Belong in the Circuit?

SMC lists a 0.05 to 1.0 MPa operating range for one current shuttle and AND-valve family, a 20:1 pressure span that still does not define downstream pilot capacity or response time (SMC Shuttle Valve). Select each element by function and complete operating data.

Element	Function in a sequence	Selection fields that matter
Main directional valve	directs flow to extend or retract a cylinder	5/2 or justified 5/3 function, monostable or bistable state, pilot source, flow, pressure, exhaust, response
End-position sensor	proves that a piston reached the defined switching zone	sensing technology, repeatability, mounting, cable/connector, response, diagnostic coverage
Shuttle valve	performs OR selection between alternative pneumatic signals	minimum/maximum pressure, output flow, leakage, pressure drop, porting
Dual-pressure valve	produces an AND output from two valid pneumatic inputs	switching threshold, input balance, output capacity, reset behaviour
Group selector or memory element	enables one cascade group and disables another	set/reset pressure, retained state, exhaust path, supply-loss behaviour
Meter-out flow control	stabilizes cylinder speed by restricting exhaust	free-flow direction, adjustment range, required flow, mounting location
Timer or counter	delays, counts, supervises, or resets a step	pulse width, timing range, repeatability, reset pulse, pressure range
Pressure switch	proves pressure crossed a defined threshold	switching pressure, hysteresis, response time, proof-test method

A shuttle valve can select between two pneumatic input signals. It does not add their pressures, prove cylinder position, or provide sequence memory by itself.

A spring-return valve is not automatically fail-safe. Its de-energized state may be suitable for one horizontal unloaded cylinder and dangerous for a vertical load. Likewise, a double-solenoid or double-pilot valve retains a command state but may allow pressure to decay. Record the intended physical result, not a label such as “safe return.”

For main-spool pilot arrangements, read how pneumatic pilot-operated valves work. For stable speed, compare meter-in and meter-out flow control.

How Should Completion Feedback and Timeouts Work?

Parker offers continuous P8S cylinder sensors over 32 to 256 mm sensing lengths, while Festo’s cited pneumatic counter distinguishes 10 ms count and 180 ms reset pulses (Parker P8S; Festo Learning Components, 2026). Position, time, and reset are separate control variables.

Use an end-position sensor when the requirement is “the piston reached this location.” Use a pressure switch when the requirement is “this branch reached the specified pressure.” A pressure threshold can be useful for clamping confirmation, but it can also be reached when a cylinder stalls before the end of stroke. It is not a universal position sensor.

Completion feedback is the measured position or qualified process condition that permits the sequence controller to leave the current step. It is different from the output command and from the timer that detects failure to complete within the allowed window.

A timer should normally supervise the allowed motion window:

1. issue the motion command;
2. start the timeout;
3. advance immediately when valid completion feedback arrives;
4. stop or transition to the defined fault state if the timeout expires first;
5. record the command, feedback, pressure, and elapsed time for diagnosis.

Fixed time-only sequencing is acceptable only when the risk and process allow it and all load, pressure, temperature, flow, and mechanical variations remain inside a proven timing margin. Even then, a timer should not conceal a slow cylinder. Trend actual completion time so leakage, restriction, wear, and alignment changes become visible.

The guide to integrating feedback sensors with pneumatic actuators covers discrete and continuous sensing choices in more detail.

Flow, Pressure, and Exhaust Verification

ISO 6358-3:2014 calculates system-level steady-state flow characteristics from components and piping, including subsonic and choked flow (ISO 6358-3, confirmed 2025). A correct logic diagram can still miss its sequence if the final pilot or cylinder port lacks dynamic pressure during motion.

Check each step under its worst credible operating condition:

• cylinder bore, rod diameter, stroke, load, orientation, and target motion time;
• valve flow data at the stated upstream and downstream conditions;
• tubing inside diameter, length, fittings, and flow-control restriction;
• common manifold supply and exhaust paths;
• pilot-pressure requirement at the lowest expected supply pressure;
• overlap with clamps, blow-off, vacuum, or another actuator;
• silencer contamination and exhaust back pressure;
• maintenance jog and restart combinations that normal production may not use.

Measure pressure at the valve inlet and, when needed, at both cylinder ports during the sequence. A static regulator gauge can look normal while a shared supply restriction lowers pressure only during B+. Likewise, a blocked exhaust can slow B− even when its supply pressure is adequate.

Estimate each direction’s demand with the Cylinder Flow Requirement Calculator, then verify the assembled circuit dynamically. The calculator is a screening tool; it cannot model valve spool transients, cushioning, load changes, leakage, or every fitting.

For measurement placement and restriction diagnosis, use the pneumatic pressure-drop troubleshooting guide.

What Must Happen During Loss, Stop, and Restart?

ISO 13849-1:2023 applies to safety-related control systems using electrical, hydraulic, pneumatic, and mechanical technologies, but it does not specify the safety function or required PLr for a particular machine (ISO 13849-1, 2023). Sequence logic and safety logic therefore need an explicit, validated boundary.

Document these conditions separately:

Event	Design question	Acceptance evidence
loss of one feedback signal	does the active step time out without issuing the next command?	disconnect or suppress the signal under controlled conditions
loss of electrical power	what states do monostable and bistable valves assume or retain?	remove the designed electrical supplies and observe motion and pressure
loss of main air	can gravity, springs, or external forces move either cylinder?	isolate supply and record pressure decay and load movement
loss of pilot air	can the main spool shift, return, or remain between states?	remove the documented pilot source safely
emergency stop request	which safety function stops hazardous motion?	validate the complete function to its specification
normal stop	does the machine finish a step, pause, retract, or hold?	test every permitted stop point
reset	are all initial conditions checked before commands return?	force each missing-ready condition separately
supply restoration	can pressure rebuild cause an uncommanded cycle?	restore air and power in every credible order

An ordinary directional valve, AND gate, or software stop bit is not automatically a safety function. A safety exhaust valve may be part of the solution, but venting all air can also release a vertical load or remove clamping force. Mechanical restraints, monitored pressure, redundant channels, or controlled stopping may be required by the risk assessment.

OSHA 29 CFR 1910.147 identifies pneumatic energy as hazardous during servicing and requires potentially hazardous stored or residual energy to be relieved, disconnected, restrained, or otherwise made safe. It also states that pushbuttons and selector switches are not energy-isolating devices (OSHA 1910.147).

For the output-side design, see integrating safety exhaust valves into pneumatic machine guarding.

How Do You Commission and Troubleshoot the Sequence?

The 10 ms count pulse and 180 ms reset pulse in Festo’s pneumatic-counter data differ by 170 ms (Festo Learning Components, 2026). A slow manual demonstration can therefore pass while production pulses, exhaust delays, or reset timing still fail. Commission with measured signals.

Use this order:

1. Verify the machine against both schematics. Trace every electrical I/O point, pneumatic port, tube number, sensor position, valve normal state, pilot source, and exhaust.
2. Test the initial state. Confirm that each missing-ready condition blocks cycle start and reports the correct reason.
3. Jog one motion at a time. Measure dynamic supply and port pressure, stroke time, sensor transition, and valve response under real load.
4. Run the state table slowly. Observe command, feedback, timeout reset, and state transfer for every step.
5. Increase to production rate. Look for short pulses, residual pilot pressure, shared-flow pressure loss, sensor bounce, and exhaust back pressure.
6. Inject defined faults safely. Remove one sensor, lower supply pressure, block a permitted command, interrupt power, and test the documented response.
7. Test stop and restart paths. Stop at every step, restore power and air in credible orders, and verify that no uncommanded cycle begins.
8. Release a baseline. Save pressure traces, step times, timeout limits, settings, software revision, valve data, and accepted fault-test results.

Symptom	Measure first	Likely causes
next step never begins	previous completion input and active group/step	mispositioned sensor, missing pressure, wrong group line, broken conductor or tube
two opposing commands appear	both pilot ports or PLC outputs	cascade grouping error, residual pressure, duplicate state ownership, logic fault
motion completes manually but fails in auto	command and reset pulse widths	timer/counter limits, sensor bounce, scan logic, slow pilot exhaust
one direction is slow	both cylinder-port pressures during motion	meter-out setting, tube restriction, valve flow, load, exhaust back pressure
fault appears only when another actuator moves	valve-inlet and pilot pressure during overlap	shared supply drop, regulator capacity, manifold or exhaust restriction
machine restarts unexpectedly	retained state and ready-condition logic	bistable valve state, latched PLC step, automatic reset, pressure restoration

Troubleshoot from the last valid state, not from the cylinder that visibly stopped. If B+ never begins, first prove that A+ completion reached the state controller, that the controller transferred ownership, and that the B valve received a valid command. Replacing cylinder B before tracing those signals wastes time.

In our experience, the most useful sequence record places the commanded state, both pilot or coil signals, completion feedback, dynamic pressure, and timeout status on one timeline. That record quickly separates a logic-transfer fault from a valve, flow, sensor, or mechanical problem without relying on operator recollection.

Sequential Pneumatic Circuit FAQs

ISO 4414:2010 covers reliable pneumatic operation and significant hazards, while ISO 13849-1:2023 applies to safety-related pneumatic control technology without choosing a machine’s required safety function (ISO 4414; ISO 13849-1). These four answers keep sequence, timing, pressure, and safety claims separate.

Can a sequential pneumatic circuit use timers instead of position sensors?

Yes, but only when the process and risk assessment allow time-based progression and the full variation in pressure, flow, load, temperature, and mechanics remains inside a validated margin. For most machine sequences, position feedback should advance the state while a timer supervises the maximum permitted motion time and triggers a defined fault response.

When should I use cascade control instead of a PLC?

Use cascade control for a short, fixed air-only sequence when pneumatic logic is justified and staff can maintain its group, pressure, and reset behaviour. Choose a PLC when recipes, diagnostics, multiple operating modes, data capture, or coordinated equipment matter. Neither architecture is inherently safe or reliable without validation.

Can a pressure switch confirm that a cylinder reached the end of stroke?

Not universally. A pressure switch proves that its measurement point crossed a threshold. The same pressure may occur when the piston reaches a stop, contacts a workpiece, stalls early, or meets an obstruction. Use a position sensor when piston location is the requirement, and use pressure confirmation for a separately defined process condition.

Should an emergency stop dump all air from the sequence circuit?

Only when the machine’s safety specification requires that response and the resulting motion is safe. Venting can stop powered extension, but it can also release clamps or allow gravity-driven movement. The risk assessment must define the safety function, stored-energy treatment, load restraint, reset, monitoring, and validation requirements.

Sources and technical references

• ISO 4414:2010, Pneumatic fluid power systems and safety requirements
• ISO 13849-1:2023, Safety-related parts of control systems
• ISO 6358-3:2014, System flow-rate characteristics
• Festo Learning Components, pneumatic logic, timing, and counter data
• Festo Training Catalogue 2025, cascade and sequence-control training scope
• Parker P8S continuous cylinder-position sensors
• SMC Shuttle Valve specifications
• OSHA 29 CFR 1910.147, Control of Hazardous Energy