Banner ES-FA-9AA, ES-FA-11AA Instruction Manual

ES-FA-9AA and ES-FA-11AA E-Stop Safety

60606

Module

Instruction Manual

Original Instructions

• Monitors emergency stop devices, such as palm buttons and rope/cable pulls,
and positive-opening safety switches used for guard/gate interlocking

• The safety inputs can monitor:

◦ A +24 V dc source switched by hard/relay contacts in single-channel

hookup, or

◦ Hard/relay contacts in a dual-channel hookup using terminals S11-

S12 and S21-S22

• The ES-FA-9AA has three normally open output switching channels for
connection to control-reliable power interrupt circuits

• The ES-FA-11AA has two normally open output switching channels for
connection to control-reliable power interrupt circuits and one normally
closed auxiliary output channel

• Automatic reset or monitored manual reset

• Design complies with standards ANSI B11.19, UL991, ISO 13850 (EN418),
and ISO 13849-1 (EN954-1) (Safety Category 4)

• For use in functional stop category 0 applications per ANSI NFPA 79 and IEC/
EN60204-1

• 6 or 7 amp safety output contacts, depending on model

• Plug-in terminal blocks

• 24 V ac/dc operation

Models

Models

ES-FA-9AA
ES-FA-11AA 2 Normally Open and 1 Normally Closed (NC) 7 A

WARNING: Not a Stand-Alone Safeguarding Device
This Banner device is not a stand-alone point-of-operation guarding device, as defined by

OSHA regulations. It is necessary to install point-of-operation guarding devices, such as safety light
screens and/or hard guards, to protect personnel from hazardous machinery. Failure to install point­of-operation guards on hazardous machinery can result in a dangerous condition which could
lead to serious injury or death.

Supply Voltage Outputs Output Contact Rating

24 V ac/dc

3 Normally Open (NO) 6 A

Important: Read this First

The user is responsible for satisfying all local, state, and national laws, rules, codes, and regulations relating to

the use of this product and its application. Banner Engineering Corp. has made every effort to provide complete
application, installation, operation, and maintenance instructions. Please contact a Banner Applications Engineer with any
questions regarding this product.

The user is responsible for making sure that all machine operators, maintenance personnel, electricians, and
supervisors are thoroughly familiar with and understand all instructions regarding the installation, maintenance, and use of
this product, and with the machinery it controls. The user and any personnel involved with the installation and use of this
product must be thoroughly familiar with all applicable standards, some of which are listed within the specifications.
Banner Engineering Corp. makes no claim regarding a specific recommendation of any organization, the accuracy or
effectiveness of any information provided, or the appropriateness of the provided information for a specific application.

Applicable U.S. Standards

ANSI B11 Standards for Machine Tools Safety
Contact: Safety Director, AMT – The Association for Manufacturing Technology, 7901 Westpark Drive, McLean, VA 22102,

Tel.: [phone]

Original Document
60606 Rev. G

12 August 2016

ES-FA-9AA ES-FA-11AA

Power ON LED

Channel 1

Active LED

Channel 2

Active LED

ES-FA-9AA and ES-FA-11AA E-Stop Safety Module

ANSI NFPA 79 Electrical Standard for Industrial Machinery
Contact: National Fire Protection Association, 1 Batterymarch Park, P.O. Box 9101, Quincy, MA 02269-9101, Tel.:

800-344-3555
ANSI/RIA R15.06 Safety Requirements for Industrial Robots and Robot Systems
Contact: Robotic Industries Association, 900 Victors Way, P.O. Box 3724, Ann Arbor, MI 48106, Tel.: [phone]

Applicable International Standards

ISO 12100-1 & -2 (EN 292-1 & -2) Safety of Machinery – Basic Concepts, General Principles for Design
ISO 13849-1 Safety-Related Parts of Control Systems
ISO 13850 (EN 418) Emergency Stop Devices, Functional Aspects – Principles for Design
IEC 60204-1 Electrical Equipment of Machines Part 1: General Requirements
Contact: Global Engineering Documents, 15 Inverness Way East, Englewood, CO 80112-5704, Tel.: [phone]

Overview

An Emergency Stop Safety Module is used to increase the control reliability of an
emergency stop circuit. As shown in the hookup drawings, the models ES­FA-9AA and ES-FA-11AA E-Stop Safety Modules are designed to monitor a 1­channel or 2-channel E-stop switch. A 2-channel E-stop switch has two
electrically isolated contacts.

WARNING: Risk Assessment

The level of safety circuit integrity can be greatly affected
by the design and installation of the safety devices and the
means of interfacing of those devices. A risk assessment

must be performed to determine the appropriate level
of safety circuit integrity to ensure the expected risk
reduction is achieved and all relevant regulations and
standards are complied with.

Figure 1. Features and Terminals

Safety Circuit Integrity and ISO 13849-1 (EN954-1) Safety Circuit Principles

Safety circuits involve the safety-related functions of a machine that minimize the level of risk of harm. These safety­related functions can prevent initiation, or they can stop or remove a hazard. The failure of a safety-related function or its
associated safety circuit usually results in an increased risk of harm.

The integrity of a safety circuit depends on several factors, including fault tolerance, risk reduction, reliable and well-tried
components, well-tried safety principles, and other design considerations.

Depending on the level of risk associated with the machine or its operation, an appropriate level of safety circuit integrity
(performance) must be incorporated into its design. Standards that detail safety performance levels include ANSI B11.19
Performance Criteria for Safeguarding and ISO 13849-1 Safety-Related Parts of a Control System.

Safety Circuit Integrity Levels

Safety circuits in International and European standards have been segmented into categories, depending on their ability to
maintain their integrity in the event of a failure. The most recognized standard that details safety circuit integrity levels is
ISO 13849-1 (EN954-1), which establishes five levels: Categories B, 1, 2, 3, and the most stringent, Category 4.

In the United States, the typical level of safety circuit integrity has been called ”control reliability.” Control reliability
typically incorporates redundant control and self-checking circuitry and has been loosely equated to ISO 13849-1
Categories 3 and 4 (see CSA Z432 and ANSI B11.TR4).

If the requirements described by ISO 13849-1 (EN954-1) are to be implemented, a risk assessment must first be
performed to determine the appropriate category, in order to ensure that the expected risk reduction is achieved. This risk
assessment must also take into account national regulations, such as U.S. control reliability or European “C” level
standards, to ensure that the minimum level of performance that has been mandated is complied with.

2 www.bannerengineering.com - Tel: [phone] P/N 60606 Rev. G

ES-FA-9AA and ES-FA-11AA E-Stop Safety Module

Fault Exclusion

An important concept within the category requirements of ISO 13849-1 is the probability of the occurrence of the failure,
which can be decreased using the "fault exclusion" method. This method assumes that the possibility of certain well­defined failure(s) can be reduced to a point where the resulting fault(s) can be disregarded.

Fault exclusion is a tool a designer can use during the development of the safety-related part of the control system and
the risk assessment process. It allows the designer to eliminate the possibility of various failures and justify it through the
risk assessment process to meet the requirements of Categories 2, 3 or 4. See ISO 13849-1/-2 for further information.

Monitoring of Safety Devices

Requirements vary widely for the level of control reliability or safety category per ISO 13849-1 (EN954-1) in safety
applications. While Banner Engineering always recommends the highest level of safety in any application, it is the
responsibility of the user to safely install, operate and maintain each safety system and comply with all relevant laws and
regulations.

Although only two applications are listed, the Module can monitor a variety of devices as long as the input requirements
are complied with (see Electrical Installation and Specifications). The Safety Module does not have 500 ms simultaneity
between inputs and thus cannot be used for monitoring a two-hand control. In all cases, the safety performance (integrity)
must reduce the risk from identified hazards as determined by the machine's risk assessment.

WARNING: Emergency Stop Functions
Do not mute or bypass any Emergency Stop device. ANSI B11.19, ANSI NFPA79 and IEC/EN

60204-1 require that the Emergency Stop function remain active at all times.

Emergency Stop Push Buttons and Rope/Cable Pull Switches

The safety inputs can be interfaced with positive-opening switches to monitor an emergency-stop (E-stop) push button or
rope/cable pull. The switch must provide one or two contacts for safety which are closed when the switch is armed. Once
activated, the E-stop switch must open all its safety-rated contacts, and must require a deliberate action (such as twisting,
pulling, or unlocking) to return to the closed-contact, armed position. The switch must be a "positive-opening" (or direct­opening) type, as described by IEC 60947-5-1.

Standards ANSI NFPA 79, ANSI B11.19,, IEC/EN60204-1, and ISO 13850 specify additional emergency stop switch device
requirements, including the following:

• Emergency-stop push buttons shall be located at each operator control station and at other operating stations
where emergency shutdown is required.

• Stop and emergency-stop push buttons shall be continuously operable and readily accessible from all control and
operating stations where located. Do not mute or bypass E-stop buttons or rope/cable pulls.

• Actuators of emergency-stop devices shall be colored red. The background immediately around the device actuator
shall be colored yellow (where possible). The actuator of a push-button-operated device shall be of the palm or
mushroom-head type.

• The emergency-stop actuator shall be a self-latching type.

In addition, for Rope/Cable Pull Installations Only:

• The wire rope should be easily visible and readily accessible along its entire length. Red markers or flags may be
fixed on the rope to increase its visibility.

• The rope or cable pull must provide constant tension and must have the capability to react to a force in any
direction.

• Mounting points, including support points, must be rigid.

• The rope should be free of friction at all supports. Pulleys are recommended.

• The switch must have a self-latching function that requires a manual reset after actuation

Some applications may have additional requirements; comply with all relevant regulations. See the device manufacturer
installation instructions for complete information (such as SSA-EB1..-.. p/n 162275, or RP-RM83F.. p/n 141245 data
sheets).

WARNING: Emergency Stop Functions
Do not mute or bypass any Emergency Stop device. ANSI B11.19, ANSI NFPA79 and IEC/EN

60204-1 require that the Emergency Stop function remain active at all times.

Interlocked Guards (Gates)

The safety inputs can be interfaced with positive-opening safety switches to monitor the position of an interlock guard or
gate. Each switch must provide electrically isolated contacts: at minimum, one normally closed (N.C.) contact from each
individually mounted switch. The contacts must be of "positive-opening" (direct-opening) design, as described by

P/N 60606 Rev. G www.bannerengineering.com - Tel: [phone]

ES-FA-9AA and ES-FA-11AA E-Stop Safety Module

IEC60947- 5-1, with one or more normally closed contacts rated for safety. In addition, the switches must be mounted in a
"positive mode," to move/disengage the actuator from its home position and open the normally closed contact when the
guard opens.

The design and installation of the interlocked guard and the safety switches should comply with ANSI B11.19, ISO14119,
ISO 14120, and/or other applicable standards. See the device manufacturer installation instructions for complete
information (such as GM-FA-10J p/n 60998, SI-LS83/-LS100 p/n 59622, or SI-HG63 p/n 129465 datasheets).

In higher levels of safety performance, the design of a dual-channel coded magnetic switch typically uses complementary
switching, in which one channel is open and one channel is closed at all times. The inputs of the Safety Module do not

support complementary switching, and thus should not be used with coded magnetic safety switches.

Mechanical Installation

The Safety Module must be installed inside an enclosure.
It is not designed for exposed wiring. It is the user’s responsibility to house the Safety Module in an enclosure with NEMA 3

(IEC IP54) rating, or better. The Safety Module mounts directly to standard 35 mm DIN rail.
Heat Dissipation Considerations: For reliable operation, ensure that the operating specifications are not exceeded. The

enclosure must provide adequate heat dissipation, so that the air closely surrounding the Module does not exceed the
maximum operating temperature stated in the Specifications. Methods to reduce heat build-up include venting, forced
airflow (for example, exhaust fans), adequate enclosure exterior surface area, and spacing between modules and other
sources of heat.

Electrical Installation

WARNING: Shock Hazard and Hazardous Energy
Always disconnect power from the safety system (for example, device, module, interfacing,

etc.) and the machine being controlled before making any connections or replacing any
component.

Electrical installation and wiring must be made by Qualified Personnel1 and must comply with the
relevant electrical standards and wiring codes, such as the NEC (National Electrical Code), ANSI
NFPA79, or IEC 60204-1, and all applicable local standards and codes.

Lockout/tagout procedures may be required. Refer to OSHA 29CFR1910.147, ANSI Z244-1, ISO
14118, or the appropriate standard for controlling hazardous energy.

It is not possible to give exact wiring instructions for a Safety Module that interfaces to a multitude of machine control
configurations. The following guidelines are general in nature.

The Safety Module has no delay function. Its output relay contacts open within 25 milliseconds after a safety input
opens. This classifies the Safety Module as a functional stop "Category 0" control, as defined by ANSI NFPA 79 and IEC/EN
60204-1.

The safety inputs can be connected to:

• A +24V dc source that is switched by a hard/relay contact in single-channel hookup configuration, or

• Hard/relay contacts in a dual-channel hookup configuration using terminals S11-S12 and S21-S22.

Safety Input Device Hookup Options

The operation of all dual-channel hookup options is concurrent, meaning that input channel 1 and input channel 2 must be
in the same state in both the STOP and RUN condition, but with no simultaneity (timing) requirement between the
channels.

The dual-channel hookup configuration is able to detect certain failures and faults, such as short circuits, that could
result in a loss of the safety function. Once such a failure or fault is detected, the Safety Module will turn OFF (open) its
safety outputs until the problem is fixed. This circuit can meet ISO 13849-1 Category 2, 3, or 4 requirements, depending
on the safety rating and the installation of the safety input device. This circuit can detect a short circuit between channels
or to another source of power, at a minimum, when the device is actuated.

A single device with redundant outputs that can fail in such a manner to lose the safety function, such as a single safety
interlocking switch, can typically meet only a Category 2. See below for means to eliminate or minimize the possibility of
failures and faults that could result in the loss of the safety function(s).

1

A person who, by possession of a recognized degree or certificate of professional training, or who, by extensive knowledge, training and experience, has
successfully demonstrated the ability to solve problems relating to the subject matter and work.

4 www.bannerengineering.com - Tel: [phone] P/N 60606 Rev. G