Engineering Illustrations & Drawings

318 labeled drawings across 40 subjects. Each thumbnail opens the full-size drawing with the All-Access pass.

Electrical Power & Calculations

221 drawings

Industrial Control & OT Cybersecurity

View drawing →

🔒 All-Access

Symbol Sheet: Overcurrent, Differential, Ground-Fault and Arc-Flash Relays, Surge Arresters and Fuses

🔒 All-Access

Power Triangle: Real, Reactive and Apparent Power

Monthly Electricity Bill: Time-of-Use Energy and Demand Charges

🔒 All-Access

Pull Box Sizing: Straight Pull and Angle Pull

Transformer Full-Load Current: 480 V and 208 V, 500 kVA to 10,000 kVA

UPS Architectures Compared: Parallel N+1 vs. 2N Independent Paths

View drawing →

🔒 All-Access

Time-Current Coordination and Arc-Flash Study Summary: ZSI Reduces 14.2 to 3.8 cal/cm²

🔒 All-Access

Residual Ground-Fault Relay: Three Phase CTs in Parallel (64G)

🔒 All-Access

Parallel Resonance: Capacitor Bank and Supply Transformer at 323 Hz

🔒 All-Access

Emergency Lighting: Battery Inverter, Panelboard and Exit Corridor

Data Center Design Summary Dashboard: Power Path, UPS and PUE

🔒 All-Access

Two-Transformer Substation with a Normally Open Bus Tie

🔒 All-Access

Industrial Plant One-Line with Fault Current at Each Location

A 13.8 kV, 500 MVA utility feeding a 1,000 kVA transformer to 480 V switchgear and an MCC, with fault currents of 20.2 kA at the transformer secondary, 20.1 kA at the switchgear and 19.1 kA at the MCC plus about 1.7 kA from motors, and a grounding electrode system.

View drawing →

Industrial Facilities & Cyber Risk

What an industrial facility looks like, how IT and OT priorities differ, and how a cyber event can become a physical consequence

4 drawings

🔒 All-Access

Industrial facility overview

A functional overview of an industrial facility with supervisory applications (engineering workstation, SCADA HMI, historian) and IT, industrial DMZ and OT interfaces behind two firewalls, above three examples: a treatment plant, an electric substation and a discrete manufacturing line, each with HMI, PLC, remote I/O, drives and field equipment.

View drawing →

🔒 All-Access

IT versus OT priorities

IT and OT environments side by side: an office network of workstations, laptops, email, application servers and cloud services, and a plant network of SCADA, HMI, engineering workstation, historian, two PLCs and field devices, each with its own priority order (confidentiality first for IT, safety and availability first for OT).

View drawing →

🔒 All-Access

Cyber consequence chain

A six-column chain from a single cyber event (malware, unauthorized access, denial of service, data manipulation) through loss of plant systems and loss of view or control to equipment damage, unsafe conditions, service interruption, environmental release and community impact, with safety systems and operator intervention shown as points where escalation can be stopped.

View drawing →

🔒 All-Access

Lifecycle ribbon

Redundancy topologies

🔒 All-Access

Unsafe remote dosing changes

🔒 All-Access

Defense-in-depth rings

Defense in depth as seven rings around a critical process: physical, endpoint, network, application, identity, monitoring and recovery, each with its purpose and marked as a preventive, detective or recovery function, with a note that layers share dependencies and no single layer guarantees blocking an attack.

View drawing →

Zones & Conduits

Security zones joined by controlled conduits in manufacturing and water treatment

3 drawings

🔒 All-Access

Two zones and a conduit

Two security zones, supervisory and control, joined by a single conduit with a firewall at its center. A rule table shows the source (HMI), destination (PLC), protocol (Modbus TCP on port 502), allowed operations (reads and approved writes), the firewall rule ID (FW-OT-021) and logging of permits and denies.

View drawing →

🔒 All-Access

Manufacturing zones and conduits

A manufacturing example with seven numbered conduits (C1 to C7) between zones: enterprise data to the DMZ over HTTPS, historian replication, MES to line HMIs over OPC UA, HMI to PLC with a vendor protocol, time-limited engineering access, a vendor VPN with MFA to a jump server, and a recorded RDP session to an engineering workstation.

View drawing →

🔒 All-Access

Water-treatment zones and conduits

A water treatment network architecture in five conduits: enterprise queries to a DMZ historian replica, vendor access through a jump host, remote RTU telemetry through an encrypted WAN to an MQTT broker (TCP 8883), SCADA HMI to a treatment process PLC behind a cell firewall, and an independent safety system with hardwired shutdown and a status-only gateway.

View drawing →

Industrial DMZ & Historian Design

Dual-firewall and three-legged DMZs, historian replication and jump server administration

3 drawings

Improved remote access: a vendor with an MFA token goes through a TLS-encrypted VPN gateway (Firewall A), a hardened jump host with approval workflow and session recording, and an allowlist-only Firewall B to one authorized HMI, with other OT assets unreachable and a traffic policy table (RDP or HTTPS allowed from the jump host, all else denied).

View drawing →

🔒 All-Access

Vendor access lifecycle

🔒 All-Access

Network-device hardening

A managed network switch hardened and annotated with nine numbered controls: placement on a management VLAN 99 (10.20.99.0/24) with approved admin hosts only, a dedicated management IP, unused ports administratively disabled, restricted management access, a physical port lock, and SNMPv3 authPriv, syslog over TLS, authenticated NTP and RADIUS services, plus a sealed local emergency account.

View drawing →

Wireless & IIoT

Industrial Wi-Fi design and securing IIoT edge gateways

2 drawings

🔒 All-Access

Industrial wireless

A plant wireless design with separate SSIDs and VLANs (PLANT-OPS 110 and PLANT-AGV 120 on WPA2/3-Enterprise 802.1X EAP-TLS, PLANT-GUEST 130 on a restricted internet-only path), access points trunked to a Layer 3 switch stack, a wireless LAN controller and RADIUS server behind an industrial firewall, and guest traffic denied to OT and management networks.

View drawing →

🔒 All-Access

IIoT before/after

An IIoT gateway design before and after. Before, a dual-homed edge gateway gives the cloud a two-way, uncontrolled path to the control network. After, the edge gateway sits in the OT zone and sends data over two separately controlled TLS sessions through Firewall B, an IDMZ message broker and Firewall A to the cloud service.

View drawing →

Identity, Access & Patching

Role and session separation, the account lifecycle, patch decisions and unpatchable assets

4 drawings

🔒 All-Access

Role/session separation

One person using three separate credentials (operator, engineer and administrator) in three isolated sessions, each with its own permissions over SCADA dashboards, control logic and configuration or accounts and platforms, with session isolation, separation of duties for approvals and key points about role separation.

View drawing →

🔒 All-Access

Account lifecycle

An account lifecycle in six stages (request, approval, provisioning, active access, periodic review, role change) with an immediate revocation path on termination, the sample record for each stage (request form, approval, provisioning ticket, review, role change and revocation records) and principles of least privilege and timely revocation.

View drawing →

🔒 All-Access

Patch decision flow

A patch decision flow in eight steps (identify, evaluate, vendor validate, test, schedule, backup, patch, verify) with a decision at each step, compensating controls for an unpatchable asset, rollback from an approved backup, rework and reschedule loops and a table of checks, data sources and outcomes per step.

View drawing →

🔒 All-Access

Unpatchable asset

Compensating controls around a legacy, unpatchable HMI on a dedicated VLAN 20, shown as concentric rings: isolation, a cell firewall allowing administration only from one admin jump host, application allowlisting, a USB lock and passive monitoring through a network tap, with a risk acceptance tag that expires 2026-12-31 and a planned upgrade.

View drawing →

Malware Protection & Backup

Controlled file transfer and a 3-2-1 backup and restore design

3 drawings

🔒 All-Access

Malware-protection layers

A file path from untrusted sources (USB drive, optical media, vendor email, internet download) through an isolated multi-engine scanning and quarantine zone, an IDMZ file transfer server and update repository, and a firewall to an engineering workstation that runs only allowlisted applications and on to a PLC, with suspect files kept in quarantine.

View drawing →

🔒 All-Access

3-2-1 backup

A 3-2-1 backup design for OT servers: a primary online copy, a second local offline tape copy and a third offsite encrypted immutable copy, with OT-initiated backup sessions through a gateway, restore testing on isolated spare hardware from copy 2 or 3, and a separate approved procedure for production restoration.

View drawing →

🔒 All-Access

Backup ecosystem

A central backup server in a DMZ collecting from PLCs, HMIs, SCADA and historian databases, virtual machines, switches, firewalls, relays, drives, recipes, keys and documents, with an offline vault using media rotation, sealed key recovery and a sample backup and restore test schedule with RTO and RPO targets.

View drawing →

Monitoring & Logging

Passive monitoring with SPAN and TAP, baselines and deviations, and one-way log collection

3 drawings

🔒 All-Access

Passive monitoring

Two ways to feed a passive monitoring sensor: a SPAN (port mirroring) configuration on a production switch and a passive network TAP, each sending receive-only capture traffic to a sensor whose separate management port reaches a monitoring console in the DMZ through a firewall, with notes on fail-open TAP behavior and capture loss.

View drawing →

🔒 All-Access

PLC normal/abnormal communications

A baseline of normal PLC communications (HMI, historian and an engineering workstation used only in an approved maintenance window) beside a deviation where an unknown peer connects to the PLC at an unexpected time, flagged as a departure from the baseline to investigate.

View drawing →

🔒 All-Access

Log collection

OT logs flowing from firewalls, switches, servers, a jump host, SCADA and historian systems and an OT network IDS into a log collector and a sender proxy inside the OT network, across a one-way hardware data diode with no reverse connection, to a DMZ receiver proxy, a SIEM and security analyst review, with the log protocols (syslog over TLS on TCP 6514, legacy UDP 514, vendor agent over TLS).

View drawing →

Incident Response

The response cycle and how an incident is coordinated across roles

2 drawings

🔒 All-Access

Incident response cycle

An eight-step incident response cycle (detect, validate, contain, maintain safe operations, investigate, recover, verify, lessons learned) arranged around a center of continuous safety and evidence preservation, with people, process, technology and security as the four supporting elements.

View drawing →

🔒 All-Access

Incident coordination

3 drawings

🔒 All-Access

Manual Pull Station Mounting Height and Clearance

Elevation, side and plan views of a manual box mounted 42 to 48 in. above the floor (top of the operable part) within 5 ft of an exit doorway, with a 4 in. maximum projection, a 30 in. by 48 in. clear floor space for approach, typical locations along the path of travel and the NFPA 72 and ADA references.

View drawing →

🔒 All-Access

Duct Smoke Detector Installation and Sampling Tube Geometry

A duct cutaway showing the sampling and return tubes in the airstream with airflow direction, a duct smoke detector with power, alarm and trouble LEDs, a remote test station, a 24 VDC supervised power supply, a Form C relay output to an air handler shutdown circuit, and tube placement at 1/6 to 1/3 of the duct height from the top and bottom.

View drawing →

🔒 All-Access

Strobe Placement and Candela Selection Concept

A conceptual guide relating room size and ceiling height to strobe candela (15 cd to 185 cd), with wall-mounted and ceiling-mounted spacing concepts in elevation and top views, the factors that affect strobe performance, a candela selection flow and a clear note that it is a concept chart and not a compliance table.

View drawing →

Inspection, Testing & Troubleshooting

Code editions, functional test signal flow and ground fault isolation

3 drawings

🔒 All-Access

Code Adoption Timeline and Retroactivity

An illustrative timeline from model code development and publication through adoption by three jurisdictions (A, B and C) at different dates and a future edition, with systems installed under the previous, then-adopted and future editions, and a note that inspection, testing and maintenance requirements generally follow the edition in effect at installation unless the Authority Having Jurisdiction mandates retroactive compliance.

View drawing →

🔒 All-Access

Functional Test Signal Flow from Device Activation to Inspector Verification

A six-column flow for five test types (smoke detector, manual pull station, waterflow switch, tamper switch and trouble condition) from device activation through panel processing, the expected annunciation (alarm, supervisory or trouble), expected outputs, inspector checks and recording of results, with a general test sequence and abbreviations.

View drawing →

🔒 All-Access

Ground Fault Isolation Flowchart for SLC and NAC Circuits

A flowchart for isolating a ground fault on a signaling line or notification appliance circuit: verify the indication, check whether it is still present, section the circuit at the panel, test the left and right sections, repeat the sectioning in halves until the fault is narrowed to a device or short length of wiring, then repair, retest and restore, with notes, tips and abbreviations.

View drawing →

Drawings & Design Process

Risers, reconstructed zone maps, the symbol legend and the design and construction process

4 drawings

🔒 All-Access

Multi-Family Residential Fire Alarm Riser Diagram: Four Floors on a Class B SLC Loop

A riser diagram for a four-story residential building with one Class B signaling line circuit leaving the control panel in the lobby and tapping each floor, showing the monitor modules, smoke detectors, manual pull station and control modules by device address (SLC-1-01 to SLC-1-44), the address ranges per floor, interface connections for sprinkler, elevator, HVAC and dampers, and how to read the diagram.

View drawing →

🔒 All-Access

Reconstructed Zone Map for a Conventional System with No Documentation

A before-and-after example of an inspector reconstructing a zone map for an undocumented conventional system: an unknown floor plan, then the same plan with 4 zones, 12 smoke detectors, heat detectors, manual pull stations and a bell marked, the panel discovery and zone identification steps, a zone device list and the documentation created.

View drawing →

🔒 All-Access

Standard Fire Alarm Drawing Symbol Legend

A legend of commonly used symbols on riser and floor plan drawings in seven groups (control equipment, initiating devices, notification appliances, control and monitor modules, duct devices, dampers and other control devices, miscellaneous), with the line types, common abbreviations, end-of-line device and general notes on color conventions.

View drawing →

🔒 All-Access

Fire Alarm Design and Construction Process Flow

A twelve-step flow in three phases (design and planning, procurement and construction, commissioning and acceptance) from needs analysis, system selection and device layout through permitting, installation and contractor pre-testing to handoff and acceptance testing, with the point where the inspector’s role begins and its six activities.

View drawing →