Banner GM-FA-10J Original Instructions Manual

GM-FA-10J Gate Monitoring Safety Module

Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [e-mail]

24V ac/dc operation, 1- or 2-Channel Input

Original Instructions

• Monitors one or two safety switches for a contact failure or wiring fault

• Two output switching channels for connection to control-reliable power in­terrupt circuits

• Auto reset or monitored manual reset

• Design complies with standards UL991, ISO 14119, and ISO 13849-1
(EN954-1) (Safety Category 2, 3 or 4)

• For use in functional stop category 0 applications per NFPA 79 and IEC
60204-1

• 6 amp safety output contacts

• Plug-in terminal blocks

• If terminal blocks are swapped, Module remains functional with no loss of
safety function

Overview

The GM-FA-10J Gate Monitor Safety Module (the “Safety Module”) is used to verify the proper operation of coded magnetic safety
switches and positive-opening safety switches by monitoring a normally open (N.O.) and a normally closed (N.C.) contact from each
switch. It can also be used to monitor and verify the correct state of two redundant current-sourcing PNP signals. (One PNP source must
be Normally OFF and the other Normally Conducting for each input channel.) In a typical application, two safety switches (individually
mounted) indicate the open or closed status of a gate, moveable guard, or barrier (all called “guards” throughout this document).

Two functions of the Safety Module are:

1. To monitor the contacts and wiring of safety switches for certain failures and to prevent the machine from restarting if the switch or
the Module fails, and

2. To provide a reset routine after closing the guard and returning the inputs to their “closed” condition. This reset function may be
required by machine safety standards.

The Safety Module monitors each switch for complementary switching; each channel must have one open (OFF) input and one closed
(conducting) input at all times. These inputs must always be in opposite states and must switch state within 1 second of each other.
Channel 1 has a “guard closed” condition when S11/S13 is closed and S11/S12 is open. Similarly, Channel 2 has a “guard closed” condi­tion when S21/S23 is closed and S21/S22 is open (see Figure 2. Wiring to two 4-wire coded magnetic safety switches on page 7 and

Figure 3. Wiring to two positive-opening safety interlock switches on page 7). The Safety Module also will detect and properly respond

to a short circuit between the channels and a short circuit to other sources of power. The Safety Module will open the safety outputs
within 35 milliseconds of the switching of either channel when the guard opens.

When the guard closes, debounce logic in the Safety Module’s inputs increases the reliability and repeatability of successfully resetting
the Safety Module and reduces the necessity of re-cycling the guard. This feature can result in increased efficiency of the machine, even
if the guard is misaligned or vibration is present.

Important: Read This First!

The user is responsible for satisfying all local, state, and national laws, rules, codes, and regulations relating to the use of this

product and its application. Banner Engineering Corp. has made every effort to provide complete application, installation, operation, and
maintenance instructions. Please direct any questions regarding the use or installation of this product to the factory applications depart­ment at the telephone numbers or address found at Banner website.

The user is responsible for making sure that all machine operators, maintenance personnel, electricians, and supervisors are thorough­ly familiar with and understand all instructions regarding the installation, maintenance, and use of this product, and with the machinery it
controls. The user and any personnel involved with the installation and use of this product must be thoroughly familiar with all applicable
standards, some of which are listed within the specifications. Banner Engineering Corp. makes no claim regarding a specific recommen­dation of any organization, the accuracy or effectiveness of any information provided, or the appropriateness of the provided information
for a specific application.

GM-FA-10J Gate Monitoring Safety Module

Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [e-mail]

Applicable U.S. Standards

ANSI B11 Standards for Machine Tools Safety

Contact: Safety Director, AMT – The Association for Manufacturing Technology, 7901 Westpark Drive, McLean, VA 22102, Tel.:
703-893-2900

ANSI NFPA 79 Electrical Standard for Industrial Machinery

Contact: National Fire Protection Association, 1 Batterymarch Park, P.O. Box 9101, Quincy, MA 02269-9101, Tel.: [phone]

ANSI/RIA R15.06 Safety Requirements for Industrial Robots and Robot Systems

Contact: Robotic Industries Association, 900 Victors Way, P.O. Box 3724, Ann Arbor, MI 48106, Tel.: [phone]

Applicable International Standards

ISO 12100-1 & -2 (EN 292-1 & -2) Safety of Machinery – Basic Concepts, General Principles for Design

IEC 60204-1 Electrical Equipment of Machines Part 1: General Requirements

ISO 13849-1 (EN 954-1) Safety-Related Parts of Control Systems

ISO 13855 (EN 999) The Positioning of Protective Equipment in Respect to Approach Speeds of Parts of the Human Body

ISO 14119 (EN 1088) Interlocking Devices Associated with Guards – Principles for Design and Selection

Also, request a type “C” standard for your specific machinery.

Contact: Global Engineering Documents, 15 Inverness Way East, Englewood, CO 80112-5704, Tel.: [phone]

Certificate of Adequacy

This Safety Module datasheet (p/n 60998) satisfies the requirements of Machinery Directive 2006/42/EC, Section 1.7.4 — instructions.

Safety Circuit Integrity and ISO 13849-1 (EN954-1) Safety Circuit Principles

Safety circuits involve the safety-related functions of a machine that minimize the level of risk of harm. These safety-related functions can
prevent initiation, or they can stop or remove a hazard. The failure of a safety-related function or its associated safety circuit may result in
an increased risk of harm.

The integrity of a safety circuit depends on several factors, including fault tolerance, risk reduction, reliable and well-tried components,
well-tried safety principles, and other design considerations.

Depending on the level of risk associated with the machine or its operation, an appropriate level of safety circuit performance must be
incorporated into its design. Standards that detail safety performance levels include ANSI/RIA R15.06 Industrial Robots, ANSI B11 Ma­chine Tools, OSHA 29CFR1910.217 Mechanical Power Presses, and ISO 13849-1 (EN954-1) Safety-Related Parts of a Control System.

Safety Circuit Integrity Levels

Safety circuits in International and European standards have been segmented into categories, depending on their ability to maintain their
integrity in the event of a failure. The most recognized standard that details safety circuit integrity levels is ISO 13849-1 (EN954-1), which
establishes five levels: Categories B, 1, 2, 3, and the most stringent, Category 4.

In the United States, the typical level of safety circuit integrity has been called ”control reliability.” Control reliability typically incorporates
redundant control and self-checking circuitry and has been loosely equated to ISO 13849-1 Categories 3 and 4 (see CSA Z432 and ANSI
B11.TR4).

If the requirements described by ISO 13849-1 (EN954-1) are to be implemented, a risk assessment must first be performed to determine
the appropriate category, in order to ensure that the expected risk reduction is achieved. This risk assessment must also take into ac­count national regulations, such as U.S. control reliability or European “C” level standards, to ensure that the minimum level of perform­ance that has been mandated is complied with.

Fault Exclusion

An important concept within the category requirements of ISO 13849-1 is the probability of the occurrence of the failure, which can be
decreased using the "fault exclusion" method. This method assumes that the possibility of certain well-defined failure(s) can be reduced
to a point where the resulting fault(s) can be disregarded.

Fault exclusion is a tool a designer can use during the development of the safety-related part of the control system and the risk assess­ment process. It allows the designer to eliminate the possibility of various failures and justify it through the risk assessment process to
meet the requirements of Categories 2, 3 or 4. See ISO 13849-1/-2 for further information.

S21A1S11

S13

S23 S21 S22

13 23 Y1

Y2 14 24 A2

K1

K2

14 24

Machine

Safety

GM-FA-10J

Power

Fault

In 1

In 2

Output

Power ON

(green)

Input 1

Active (green)

Fault (red)

Input 2

Active (green)

Outputs

Active

(green)

S12

S13

S11

Y1

23

13

A1

A2

24

14

Y2

S22

S21

S23

GM-FA-10J Gate Monitoring Safety Module

Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [e-mail]

Configuration

Figure 1. GM-FA-10J Features and Terminal Lo-

cations

The Safety Module may be configured via DIP switches for two-channel (redundant
switches on a single guard), or one-channel operation (individual switches on two
guards). In two-channel operation, each channel must switch within 3-second si­multaneity of the other when the guard closes. If not, the guard must be re-opened
and closed until the timing requirement is met. When the guard opens, the two
channels operate concurrently (both channels must switch, but without the timing
requirement).

In one-channel operation, each channel operates individually, except to reset the
device (in which case both guards must be closed). If only one switch is being
monitored, the closed input of the unused channel must be jumpered (S11/S13 or
S21/S23).

The reset function has two options, selected by DIP switch: Automatic reset or
Monitored Manual reset. See Figure 7. Wiring to the guarded machine on page
9 for configuration information.

The reset input also can be used for an External Device Monitoring (EDM) circuit.
The EDM circuit consists of a normally closed, force-guided contact from each de­vice being controlled by the Safety Module, all wired in series with the Reset button
(if used) and terminated at terminals Y1 and Y2. See Figure 6. Alternate wiring for

two-channel monitoring of multiple guards on page 8 for further information.

The output of the Safety Module consists of two redundant output switching chan­nels, each of which is the series connection of two forced-guided relay contacts
(K1 and K2 in Figure 6. Alternate wiring for two-channel monitoring of multiple

guards

on page 8). Each of the switching outputs is rated for up to 250V ac at

up to 6 amps.

WARNING: Hazard Point
It must not be possible for personnel to reach any hazard point through an opened guard (or any
opening) before hazardous machine motion has completely stopped.

Please reference OSHA CFR 1910.217 and ANSI B11 standards for information on determining safety
distances and safe opening sizes for your guarding devices.

WARNING: Safety Categories

The level of safety circuit integrity can be greatly impacted by the design and installation of the safety
devices and the means of interfacing of those devices. A risk assessment must be performed to deter-

mine the appropriate safety circuit integrity level or safety category as described by ISO 13849-1
(EN 954-1) to ensure that the expected risk reduction is achieved and that all relevant regulations
and standards are complied with.

Safety Interlock Switch Requirements

The following general requirements and considerations apply to the installation of interlocked guards and gates for the purpose of safe­guarding. In addition, the user must refer to the relevant regulations to be sure to comply with all necessary requirements.

Hazards guarded by the interlocked guard must be prevented from operating until the guard is closed; a stop command must be issued to
the guarded machine if the guard opens while the hazard is present. Closing the guard must not, by itself, initiate hazardous motion; a
separate procedure must be required to initiate the motion. The safety switches must not be used as a mechanical or end-of-travel stop.

The guard must be located an adequate distance from the danger zone (so that the hazard has time to stop before the guard is opened
sufficiently to provide access to the hazard), and it must open either laterally or away from the hazard, not into the safeguarded area. The
guard also should not be able to close by itself and activate the interlocking circuitry. In addition, the installation must prevent personnel
from reaching over, under, around or through the guard to the hazard. Any openings in the guard must not allow access to the hazard

GM-FA-10J Gate Monitoring Safety Module

Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [e-mail]

(see OSHA 29CFR1910.217 Table O-10, ANSI B11.19, ISO 13857, ISO14120/EN953 or the appropriate standard). The guard must be
strong enough to contain hazards within the guarded area, which may be ejected, dropped or emitted by the machine.

The safety interlocking switches, actuators, sensors, and magnets must be designed and installed so that they cannot be easily defeated.
They must be mounted securely, so that their physical position cannot shift, using reliable fasteners that require a tool to remove them.
Mounting slots in the housings are for initial adjustment only; final mounting holes must be used for permanent location.

WARNING: Perimeter Guarding Applications

If the application could result in a pass-through hazard (for example, perimeter guarding), either the safe­guarding device or the guarded machine's MSCs/MPCEs must cause a Latched response following a Stop
command (for example, interruption of the sensing field of a light curtain, or opening of an interlocked gate/
guard). The reset of this Latched condition may only be achieved by actuating a reset switch that is sepa­rate from the normal means of machine cycle initiation. The switch must be positioned as described in this
document.

Lockout/Tagout procedures per ANSI Z244.1 may be required, or additional safeguarding, as described by
ANSI B11 safety requirements or other appropriate standards, must be used if a passthrough hazard can­not be eliminated or reduced to an acceptable level of risk. Failure to observe this warning could result

in serious bodily injury or death.

Coded Magnetic Safety Switches

Similar to positive-opening safety switches, coded magnetic switches used with the Safety Module must provide one normally closed
contact and one normally open contact (typically a four-wire switch). The sensor and its magnet must be mounted a minimum distance of
15 mm (0.6 inches) from any magnetized or ferrous materials for proper operation. If either the sensor or magnet is mounted on a materi­al that can be magnetized (a ferrous metal, such as iron), the switching distance will be affected. Although the sensor and magnet are
coded to minimize the possibility of false actuation, they should not be used within known fields of high-level electromagnetic radiation.

Depending on the model of sensor and magnet used, the installation must be designed to provide the correct direction of approach. The
speed of approach must be fast enough to meet the simultaneity-monitoring period of 1.0 second, approximately equal to or greater than

0.1 m (4 inches) per second. If the simultaneity requirement is not met, the Safety Module can not be reset and will not close its safety
output contacts.

Positive-Opening Interlocking Switches

Safety interlock switches used with the Safety Module must satisfy several requirements. Each switch must provide electrically isolated
contacts: at minimum, one normally closed (N.C.) contact or normally conducting source and one normally open (N.O.) contact or normal­ly OFF source to interface with the Module.

The contacts must be of “positive-opening” design, with one or more normally closed contacts rated for safety. Positive-opening operation
causes the switch to be forced open, without the use of springs, when the switch actuator is disengaged or moved from its home position
(see the Banner Catalog for examples). In addition, the switches must be mounted in a “positive mode,” to move/disengage the actuator
from its home position and open the normally closed contact, when the guard opens.

Switch Hookups, Typical Applications

Requirements vary widely for the level of control reliability or safety category (per ISO 13849) in the application of interlocked guards.
Although Banner Engineering always recommends the highest level of safety in any application, it is the responsibility of the user to
safely install, operate, and maintain each safety system and comply with all relevant laws and regulations. The applications shown in

Figure 2. Wiring to two 4-wire coded magnetic safety switches on page 7 through Figure 4. Wiring to two complementary current­sourcing PNP devices on page

(EN954-1).

7 meet or exceed the requirements for control reliability and Safety Category 3 or 4, per ISO 13849

Mechanical Installation

The Safety Module must be installed inside an enclosure.
It is not designed for exposed wiring. It is the user’s responsibility to house the Safety Module in an enclosure with NEMA 3 (IEC IP54)
rating, or better. The Safety Module mounts directly to standard 35 mm DIN rail.

Heat Dissipation Considerations. For reliable operation, ensure that the operating specifications are not exceeded. The enclosure must
provide adequate heat dissipation, so that the air closely surrounding the Module does not exceed the maximum operating temperature
stated in the Specifications. Methods to reduce heat build-up include venting, forced airflow (e.g., exhaust fans), adequate enclosure
exterior surface area, and spacing between modules and other sources of heat.

GM-FA-10J Gate Monitoring Safety Module

Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [e-mail]

Electrical Installation

Each Safety Module is powered by 24V ac/dc (at less than 150 mA). The Safety Module, in turn, supplies power to each switch.

It is not possible to give exact wiring instructions for a Safety Module that interfaces to a multitude of machine control configurations. The
following guidelines are general in nature.

The Safety Module has no delay function. Its output relay contacts open within 35 milliseconds after a safety input opens. This classifies
the Safety Module as a functional stop "Category 0" control, as defined by ANSI NFPA 79 and IEC/EN 60204-1.

WARNING: Shock Hazard and Hazardous Energy
Always disconnect power from the safety system (for example, device, module, interfacing, etc.)
and the machine being controlled before making any connections or replacing any component.

Electrical installation and wiring must be made by Qualified Personnel and must comply with the relevant
electrical standards and wiring codes, such as the NEC (National Electrical Code), ANSI NFPA79, or IEC
60204-1, and all applicable local standards and codes.

Lockout/tagout procedures may be required. Refer to OSHA 29CFR1910.147, ANSI Z244-1, ISO
14118, or the appropriate standard for controlling hazardous energy.

Connection of Power to the Safety Module

The Safety Module requires a 24V ac/dc supply voltage (see Specifications). Use extreme caution whenever installing ac power. Use a
minimum of 16 to 18 AWG wire for power and output connections. Use a minimum of 20 AWG wire for all other terminal connections. A
hand-operated supply disconnect and over-current protection (e.g., a circuit breaker) must be provided per ANSI NFPA79 and IEC/
EN60204-1.

See Figure 2. Wiring to two 4-wire coded magnetic safety switches on page 7 through Figure 6. Alternate wiring for two-channel

monitoring of multiple guards on page 8 for connection of safety switches.

Monitoring Series-Connected Safety Switches

When monitoring two individually mounted safety switches (as shown in Figure 2. Wiring to two 4-wire coded magnetic safety switches on
page 7 through Figure 4. Wiring to two complementary current-sourcing PNP devices on page 7), a faulty switch will be detected if
it fails to switch as the guard opens. In this case, the Gate Monitor Module will de-energize its output relays and disable its reset function
until the input requirements are met (i.e., the faulty switch is replaced). However, when a series of interlocking safety switches is moni­tored by a single Safety Module, the failure of one switch in the system may be masked or not detected at all (refer to Figure 5. Alternate

wiring for one-channel monitoring of multiple guards on page 8 and Figure 6. Alternate wiring for two-channel monitoring of multiple
guards

on page 8).

Series-connected interlock switch circuits do not meet ISO 13849 (EN954-1) Safety Category 4 and may not meet Control Reliability
requirements because of the potential for an inappropriate Gate Monitor reset or a potential loss of the safety stop signal. A multiple
connection of this type should not be used in applications where loss of the safety stop signal or an inappropriate reset can lead potential­ly to serious injury or death. The following two scenarios assume two positive-opening safety switches on each guard:

1. Masking of a failure. If a guard is opened but a switch fails to open, the redundant safety switch will open and cause the Safety
Module to de-energize its outputs. If the faulty guard is then closed, both Safety Module input channels also close, but because one
channel did not open, the Safety Module will not reset. However, if the faulty switch is not replaced and a second “good” guard is
cycled (opening and then closing both of the Module’s input channels), the Module considers the failure to be corrected. With the
input requirements apparently satisfied, the Module allows a reset. This system is no longer redundant and, if the second switch
fails, may result in an unsafe condition (i.e., the accumulation of faults results in the loss of the safety function).

2. Non-detection of a failure. If a good guard is opened, the Safety Module de-energizes its outputs (a normal response). But if a
faulty guard is then opened and closed before the good guard is re-closed, the failure on the faulty guard is not detected. This
system is no longer redundant and may result in a loss of safety if the second safety switch fails to switch when needed.

The systems in either scenario do not inherently comply with the safety standard requirements of detecting single faults and preventing
the next cycle. In multiple-guard systems using series-connected safety switches, it is important to periodically check the functional integ­rity of each interlocked guard individually. Operators, maintenance personnel, and others associated with the operation of the machine
must be trained to recognize such failures and be instructed to correct them immediately.

Open and close each guard separately while verifying that the Gate Monitor outputs operate correctly throughout the check procedure.
Follow each gate closure with a manual reset, if needed. If a contact set fails, the Safety Module will not enable its reset function. If the
Safety Module does not reset, a switch may have failed; that switch must be immediately replaced.

GM-FA-10J Gate Monitoring Safety Module

Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [e-mail]

This check must be performed and all faults must be cleared, at a minimum, during periodic checkouts. If the application can not exclude
these types of failures and such a failure could result in serious injury or death, then the series connection of safety switches must not be
used.

WARNING: Multiple Switching Devices
Whenever two or more devices are connected to the same safety module (controller):

• Contacts of the corresponding pole of each switch must be connected together in series. Never
connect the contacts of multiple switches in parallel. Such a parallel connection defeats the switch

contact monitoring ability of the Module and creates an unsafe condition which could result in serious
injury or death.

• Each device must be individually actuated (engaged), then released (or re-armed) and the safe-
ty module reset. This allows the module to check each switch and its wiring to detect faults.

This check must be performed during the prescribed checkouts. Failure to test each device individually

in this manner could result in undetected faults and create an unsafe condition which could result
in serious injury or death.

Connection to the Guarded Machine

The machine interface hookup diagram (Figure 7) shows a generic connection of the Module’s two redundant output circuits to machine
primary control elements MPCE1 and MPCE2. A machine primary control element is an electrically powered device, external to the Mod­ule, which stops the guarded machinery by immediately removing electrical power to the machine and (when necessary) by applying
braking to dangerous motion. The stop is accomplished by removing power to the actuator coil of either MPCE.

To satisfy the Safety Category 4 requirements of ISO 13849 (EN 954-1), each MPCE must offer a normally closed, forced-guided monitor
contact. One normally closed monitor contact from each MPCE is wired in series to the Y1-Y2 feedback/reset input (see Figure 7. Wiring

to the guarded machine on page 9). In operation, if one of the switching contacts of either MPCE fails in the shorted condition, the

associated monitor contact will remain open, preventing the reset of the Module.

External Device Monitoring

To satisfy the requirements of Control Reliability (OSHA and ANSI) and Category 3 and 4 of ISO 13849-1 (EN 954-1), the machine
primary control elements (MPCEs) must each offer a normally closed, forced-guided (mechanically linked) monitor contact. Connect one
normally closed monitor contact from each master stop control element in series to Y1 and Y2 (see hookup drawings).

In operation, if one of the switching contacts of either MPCE fails in the energized condition, the associated monitor contact will remain
open. Therefore, it will not be possible to reset the Safety Module. If no MPCE-monitor contacts are monitored, a jumper must be instal­led between terminals Y1 and Y2 (dotted line), as shown in the hookup drawings. It is the user’s responsibility to ensure that any single
failure will not result in a hazardous condition and will prevent a successive machine cycle.

One-Channel Monitoring Two-Channel Monitoring

Configured for one-channel monitoring of either one or two guards.
This application is considered to meet or exceed requirements for
Control Reliability and Safety Categories 3 and 4 per ISO 13849-1

Configured for two-channel monitoring of one guard. This applica­tion is considered to meet or exceed requirements for Control Reli­ability and Safety Categories 3 and 4 per ISO 13849-1 (EN954-1).

(EN954-1).

Mechanical stop

Guard #1

open

Guard #2

open

Blue

Gray

Black

Brown

SI-MAG..SM

SI-MAG..MM

SI-MAG..SM

SI-MAG..MM

Mechanical stop

Blue

Gray

Black

Brown

NOTE: If only one magnetic safety switch
is used,

select 1-channel input and

jumper S23 to

S21.

S12

S13

S11

S23

S22

S21

Guard

Mechanical

stop

Mechanical

stop

open

S12

S13

S11

S23

S22

S21

Guard #1

NOTE: Guard shown in closed position.

S12

S13

S23

S22

NOTE: If PNP current-sourcing signals
are used, the GM

-F

A-10J and the
current-sourcing devices must be
powered from the same DC supply
and Common (Com).

A1

A2

+24V dc

0V

+24V dc

+24V dc

N.O.

N.C.

N.O.

N.C.

0V

0V

GM-FA-10J Gate Monitoring Safety Module

Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [e-mail]

One-Channel Monitoring Two-Channel Monitoring

Figure 3. Wiring to two positive-opening safety interlock

switches

Figure 2. Wiring to two 4-wire coded magnetic safety switches

Figure 4. Wiring to two complementary current-sourcing PNP

devices