Banner ES-FA-6G User Manual

ES-UA-5A and ES-VA-5A E-Stop Safety Modules

0 122365 1

Model ES-UA-5A for 12-24V dc/115 ac operation; model ES-VA-5A for 12-24V dc/230 ac operation

Original Instructions

• Monitors emergency stop devices, such as palm buttons and rope/cable
pulls, and positive-opening safety switches used for guard/gate inter­locking

• The safety inputs can monitor:

• Hard/relay contacts in a dual-channel hookup using terminals S11­S12 and S21-S22, or

• A +24V dc source switched by hard/relay contacts in single-channel
hookup

• Four normally open output switching channels for connection to control­reliable power interrupt circuits and three auxiliary output channels

• Automatic reset or monitored manual reset

• Design complies with standards ANSI B11.19, UL991, ISO 13850
(EN418), and ISO 13849-1 (EN954-1) (Safety Category 4)

• For use in functional stop category 0 applications per ANSI NFPA 79
and IEC/EN60204-1

• 6 amp safety output contacts; 5 amp aux. output contacts

• Plug-in terminal blocks

Models Supply Voltage Outputs Output Rating

ES-UA-5A 12-24V dc or 115V ac 4 Normally open safety

1 Normally closed aux.

ES-VA-5A 12-24V dc or 230V ac

WARNING: Not a Stand-Alone Safeguarding Device
This Banner device is not a stand-alone point-of-operation guarding device, as defined by OSHA
regulations. It is necessary to install point-of-operation guarding devices, such as safety light screens
and/or hard guards, to protect personnel from hazardous machinery. Failure to install point-of-operation
guards on hazardous machinery can result in a dangerous condition which could lead to serious
injury or death.

2 Solid-state aux.

N.O. Safety Outputs: 6 A
N.C. Aux. Outputs: 5 A

SS Aux. Outputs: 100 mA

Important: Read This First

The user is responsible for satisfying all local, state, and national laws, rules, codes, and regulations relating to the use of this

product and its application. Banner Engineering Corp. has made every effort to provide complete application, installation, operation, and
maintenance instructions. Please direct any questions regarding the use or installation of this product to the factory applications depart­ment at the telephone numbers or address found at http://www.bannerengineering.com.

The user is responsible for making sure that all machine operators, maintenance personnel, electricians, and supervisors are thorough­ly familiar with and understand all instructions regarding the installation, maintenance, and use of this product, and with the machinery it
controls. The user and any personnel involved with the installation and use of this product must be thoroughly familiar with all applicable
standards, some of which are listed within the specifications. Banner Engineering Corp. makes no claim regarding a specific recommen­dation of any organization, the accuracy or effectiveness of any information provided, or the appropriateness of the provided information
for a specific application.

Applicable U.S. Standards

ANSI B11 Standards for Machine Tools Safety

P/N 122365 Rev. E 4/19/2013

S34 S32 S35

S11 S12 S21 S22

S31 S32 S33

A1 A2 B1 B2

Y30 Y31 Y32

13 14 23 24

Y35 51

52

33 34 43 44

ES-UA-5A and ES-VA-5A E-Stop Safety Modules

ANSI B11.19 Performance Criteria for Safeguarding

Contact: Safety Director, AMT – The Association for Manufacturing Technology, 7901 Westpark Drive, McLean, VA 22102, Tel.:
703-893-2900

ANSI NFPA 79 Electrical Standard for Industrial Machinery

Contact: National Fire Protection Association, 1 Batterymarch Park, P.O. Box 9101, Quincy, MA 02269-9101, Tel.: [phone]

ANSI/RIA R15.06 Safety Requirements for Industrial Robots and Robot Systems

Contact: Robotic Industries Association, 900 Victors Way, P.O. Box 3724, Ann Arbor, MI 48106, Tel.: [phone]

Applicable International Standards

ISO 12100-1 & -2 (EN 292-1 & -2) Safety of Machinery – Basic Concepts, General Principles for Design

IEC 60204-1 Electrical Equipment of Machines Part 1: General Requirements

IEC 61508 Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems

IEC 62061 Functional Safety of Safety-Related Electrical, Electronic and Programmable Control Systems

ISO 13849-1 (EN 954-1) Safety-Related Parts of Control Systems

ISO 13850 (EN 418) Emergency Stop Devices, Functional Aspects – Principles for Design

Contact: Global Engineering Documents, 15 Inverness Way East, Englewood, CO 80112-5704, Tel.: [phone]

Overview

An Emergency Stop Safety Module is used to increase the control re­liability of an emergency stop circuit. As shown in the hookup draw­ings, the models ES-UA-5A and ES-VA-5A E-Stop Safety Modules
(the Safety Modules) are designed to monitor a 1-channel or 2-chan­nel E-stop switch. A 2-channel E-stop switch has two electrically iso­lated contacts.

Figure 1. Features and Terminals

Safety Circuit Integrity and ISO 13849-1 (EN954-1) Safety Circuit Principles

Safety circuits involve the safety-related functions of a machine that minimize the level of risk of harm. These safety-related functions can
prevent initiation, or stop or remove a hazard. A failure of a safety-related function or its associated safety circuit may result in an in­creased risk of harm.

The integrity of a safety circuit depends on several factors, including fault tolerance, risk reduction, reliable and well-tried components,
well-tried safety principles, and other design considerations.

Depending on the level of risk associated with the machine or its operation, an appropriate level of safety circuit performance must be
incorporated. ANSI/RIA R15.06 Industrial Robots, ANSI B11 Machine Tools, OSHA 29CFR1910.217 Mechanical Power Presses, and
ISO 13849-1 (EN954-1) Safety-Related Parts of a Control System standards provide details of the safety performance levels.

Safety Circuit Integrity Levels

The safety circuits in International and European standards have been segmented into categories, depending on their ability to maintain
their integrity in the event of a failure. The most recognized standard that details safety circuit integrity levels is ISO 13849-1 (EN954-1),
which establishes five levels: Categories B, 1, 2, 3, and 4 (most strict).

2 www.bannerengineering.com - tel: [phone] P/N 122365 Rev. E

ES-UA-5A and ES-VA-5A E-Stop Safety Modules

In the United States, the typical level of safety circuit integrity is called control reliability. Control reliability typically incorporates redundant
control and self-checking circuitry and is relatively similar to ISO 13849-1 Categories 3 and 4 (see CSA Z432 and ANSI B11.19).

Perform a risk assessment to determine the appropriate category to make sure that the expected risk reduction is achieved to implement
the requirements described by ISO 13849-1. This risk assessment must also take into account the national regulations, such as U.S.
control reliability or European "C" level standards, to comply with the mandated minimum levels of performance.

WARNING: Safety Categories

The level of safety circuit integrity can be greatly affected by the design and installation of the safety devi­ces and the means of interfacing of those devices. A risk assessment must be performed to determine

the appropriate safety circuit integrity level or safety category as described by ISO 13849-1 (EN
954-1) to ensure the expected risk reduction is achieved and all relevant regulations and standards
are complied with.

Fault Exclusion

An important concept within the category requirements of ISO 13849-1 is the probability of the occurrence of the failure, which can be
decreased using the "fault exclusion" method. This method assumes that the possibility of certain well-defined failure(s) can be reduced
to a point where the resulting fault(s) can be disregarded.

Fault exclusion is a tool a designer can use during the development of the safety-related part of the control system and the risk assess­ment process. It allows the designer to eliminate the possibility of various failures and justify it through the risk assessment process to
meet the requirements of Categories 2, 3 or 4. See ISO 13849-1/-2 for further information.

Monitoring of Safety Devices

Requirements vary widely for the level of control reliability or safety category per ISO 13849-1 (EN954-1) in safety applications. While
Banner Engineering always recommends the highest level of safety in any application, it is the responsibility of the user to safely install,
operate and maintain each safety system and comply with all relevant laws and regulations.

Although only applications are listed, the Module can monitor a variety of devices as long as the input requirements are complied with
(see Electrical Installation and Specifications). The Safety Module does not have 500 ms simultaneity between inputs and thus cannot be
used for monitoring a two-hand control. In all cases, the safety performance (integrity) must reduce the risk from identified hazards as
determined by the machine's risk assessment.

WARNING: Emergency Stop Functions
Do not mute or bypass any Emergency Stop device. ANSI B11.19, ANSI NFPA79 and IEC/EN
60204-1 require that the Emergency Stop function remain active at all times.

Emergency Stop Push Buttons and Rope/Cable Pull Switches

The safety inputs can be interfaced with positive-opening switches to monitor an emergency-stop (E-stop) push button or rope/cable pull.
The switch must provide one or two contacts for safety which are closed when the switch is armed. Once activated, the E-stop switch
must open all its safety-rated contacts, and must require a deliberate action (such as twisting, pulling, or unlocking) to return to the
closed-contact, armed position. The switch must be a "positive-opening" (or direct-opening) type, as described by IEC 60947-5-1.

Standards ANSI NFPA 79, IEC/EN60204-1, and ISO 13850 specify additional emergency stop switch device requirements, including the
following:

• Emergency-stop push buttons shall be located at each operator control station and at other operating stations where emergency
shutdown is required.

• Stop and emergency-stop push buttons shall be continuously operable and readily accessible from all control and operating stations
where located. Do not mute or bypass E-stop buttons or rope/cable pulls.

• Actuators of emergency-stop devices shall be colored red. The background immediately around the device actuator shall be colored
yellow (where possible). The actuator of a push-button-operated device shall be of the palm or mushroom-head type.

• The emergency-stop actuator shall be a self-latching type.

For Rope/Cable Pull Installations Only:

• The wire rope should be easily accessible and visible along its entire length. Markers or flags may be fixed on the rope to increase its
visibility.

P/N 122365 Rev. E www.bannerengineering.com - tel: [phone]

• Mounting points, including support points, must be rigid.

• The rope should be free of friction at all supports. Pulleys are recommended.

Some applications may have additional requirements; comply with all relevant regulations. See the device manufacturer installation in­structions for complete information (such as SSA-EB..-.. p/n 111880, or RP-RM83F.. p/n 141245 data sheets).

ES-UA-5A and ES-VA-5A E-Stop Safety Modules

WARNING: Emergency Stop Functions
Do not mute or bypass any Emergency Stop device. ANSI B11.19, ANSI NFPA79 and IEC/EN
60204-1 require that the Emergency Stop function remain active at all times.

Interlocked Guards (Gates)

The safety inputs can be interfaced with positive-opening safety switches to monitor the position of an interlock guard or gate. Each
switch must provide electrically isolated contacts: at minimum, one normally closed (N.C.) contact from each individually mounted switch.
The contacts must be of "positive-opening" (direct-opening) design, as described by IEC60947- 5-1, with one or more normally closed
contacts rated for safety. In addition, the switches must be mounted in a "positive mode," to move/disengage the actuator from its home
position and open the normally closed contact when the guard opens.

In higher levels of safety performance, the design of a dual-channel coded magnetic switch typically uses complementary switching, in
which one channel is open and one channel is closed at all times. The inputs of the Safety Module do not support complementary

switching, and thus should not be used with coded magnetic safety switches.

The design and installation of the interlocked guard and the safety switches should comply with ANSI B11.19, ISO14119, and other
applicable standards. See the device manufacturer installation instructions for complete information (such as GM-FA-10J p/n 60998, SI­LS83/-LS100 p/n 59622, or SI-HG63 p/n 129465 datasheets).

Mechanical Installation

The Safety Module must be installed inside an enclosure.
It is not designed for exposed wiring. It is the user’s responsibility to house the Safety Module in an enclosure with NEMA 3 (IEC IP54)
rating, or better. The Safety Module mounts directly to standard 35 mm DIN rail.

Heat Dissipation Considerations: For reliable operation, ensure that the operating specifications are not exceeded. The enclosure must
provide adequate heat dissipation, so that the air closely surrounding the Module does not exceed the maximum operating temperature
stated in the Specifications. Methods to reduce heat build-up include venting, forced airflow (for example, exhaust fans), adequate enclo­sure exterior surface area, and spacing between modules and other sources of heat.

Electrical Installation

WARNING: Shock Hazard and Hazardous Energy
Always disconnect power from the safety system (for example, device, module, interfacing, etc.)
and the machine being controlled before making any connections or replacing any component.

Electrical installation and wiring must be made by Qualified Personnel and must comply with the relevant
electrical standards and wiring codes, such as the NEC (National Electrical Code), ANSI NFPA79, or IEC
60204-1, and all applicable local standards and codes.

Lockout/tagout procedures may be required. Refer to OSHA 29CFR1910.147, ANSI Z244-1, ISO
14118, or the appropriate standard for controlling hazardous energy.

It is not possible to give exact wiring instructions for a Safety Module that interfaces to a multitude of machine control configurations. The
following guidelines are general in nature.

The Safety Module has no delay function. Its output relay contacts open within 25 milliseconds after a safety input opens. This classifies
the Safety Module as a functional stop "Category 0" control, as defined by ANSI NFPA 79 and IEC/EN 60204-1.

The Safety Module is powered by either a 12-24V dc supply at 4W or an ac supply (115V ac, model ES-UA-5A, or 230V ac, model ES-
VA-5A) at 7VA. The safety inputs can be connected to:

• A +24V dc source that is switched by a hard/relay contact in single-channel hookup configuration, or

• Hard/relay contacts in a dual-channel hookup configuration using terminals S11-S12 and S21-S22.

4 www.bannerengineering.com - tel: [phone] P/N 122365 Rev. E

S12S22S11 S21

E-Stop E-Stop

ES-UA-5A and ES-VA-5A E-Stop Safety Modules

Safety Input Device Hookup Options

The operation of all dual-channel hookup options is concurrent, meaning that input channel 1 and input channel 2 must be in the same
state in both the STOP and RUN condition, but with no simultaneity (timing) requirement between the channels.

The dual-channel hookup configuration is able to detect certain failures and faults, such as short circuits, that could result in a loss of
the safety function. Once such a failure or fault is detected, the Safety Module will turn OFF (open) its safety outputs until the problem is
fixed. This circuit can meet ISO 13849-1 Category 2, 3, or 4 requirements, depending on the safety rating and the installation of the
safety input device. This circuit can detect a short circuit between channels or to another source of power, at a minimum, when the device
is actuated.

A single device with redundant outputs that can fail in such a manner to lose the safety function, such as a single safety interlocking
switch, can typically meet only a Category 2. See below for means to eliminate or minimize the possibility of failures and faults that could
result in the loss of the safety function(s).

The single-channel hookup configuration cannot detect short circuits to secondary sources of +24V dc or detect the loss of the switch­ing function of the safety input device (that is, it is not redundant) and thus this circuit typically can meet only ISO 13849-1 Category 2.

It is recommended that in all circumstances the installation of the Safety Module and its associated safety input devices are installed to
eliminate or minimize the possibility of failures and faults that could result in the loss of the safety function(s). Methods to eliminate or
minimize the possibility of these failures include, but are not limited to:

• Physically separating interconnecting control wires from each other and from secondary sources of power.

• Routing interconnecting control wires in separate conduit, runs, or channels.

• Locating all elements (modules, switches, and devices under control) within one control panel, adjacent to each other, and directly
connected with short wires.

• Properly installing multi-conductor cabling and multiple wires through strain-relief fittings. (Over-tightening of a strain-relief can cause
short circuits at that point.)

• Using positive-opening components as described by IEC 60947-5-1 that are installed and mounted in a positive mode.

• Periodically checking the functional integrity / safety function and training operators, maintenance personnel, and others associated
with the operation of the machine to recognize and immediately correct such failures.

If you have any questions about your intended use, please contact a Banner applications engineer.

Connection of Multiple Switches

Connect the poles of multiple switches, such as E-Stop switches, as shown in
the following hookup figures. The switches are shown in the "armed" position
with both contacts closed. Multiple switches connected to one Safety Module
must be series connected (see the warning, Multiple Switching Devices).

WARNING: Multiple Safety Devices
When two or more safety devices are used,
each device must be individually actuated,
causing a STOP or open-contact condition,
then reset/rearmed and the Safety Module
reset (if using manual reset mode). This al-

lows the monitoring circuits to check each de­vice and its wiring to detect faults. Failure to

test each device individually in this man­ner could result in undetected faults and
create an unsafe condition which could re­sult in serious injury or death.

NOTE: The minimum amount of time for the Module to detect a STOP condition is 15 milliseconds. This "recovery time" (OFF state) is
required for the internal integrity tests to complete, allowing a reliable reset to occur. A lockout may occur if the Module is cycled too
quickly. To clear the lockout, the inputs must be re-cycled, meeting the minimum recovery time requirements.

Figure 2. Series connection of multiple E-stop

switches

P/N 122365 Rev. E www.bannerengineering.com - tel: [phone]