Banner Universal Input Safety Modules User Manual
UM-FA-xA Universal Input Safety Modules
For 24V ac/dc operation, solid-state or relay inputs
• Monitors a wide variety of safety and non-safety input devices:
• Optical-based safeguarding devices, such as Safety Laser Scanners
• Positive-opening safety switches used for guard interlocking
• Emergency-stop devices, such as palm buttons and rope/cable pulls
• Standard sensors for non-safety applications, such as photoelectric monitoring position
or end-of-travel.
• The safety inputs can monitor:
• +24V dc solid-state (PNP) outputs in single-channel or dual-channel hookup
• +24V dc source that is switched by hard/relay contacts in single-channel or dual-channel hookup
• Hard/relay contacts in a dual-channel hookup using terminals S11-S12 and S21-S22
• UM-FA-9A: Three normally open (N.O.) output switching channels for connection to control-reliable power interrupt circuits
• UM-FA-11A: Two normally open (N.O.) and one normally closed (N.C.) output switching
channels for connection to control-reliable power interrupt circuits
• Automatic reset or monitored manual reset, depending on hookup
• Design complies with standards ANSI B11.19 Control Reliability, ISO 13850 (EN418), and
ISO 13849-1 (EN954-1) Category 4
• Safety Integrity Level SIL 3 per IEC 61508/IEC 62061
• Category 4 Performance level PL e per ISO 13849-1
• For use in functional stop category 0 applications per ANSI NFPA 79 and IEC/EN 60204-1
• Plug-in terminal blocks
• 24V ac/dc operation
Models Output Switching Channels Safety Output Contact Rating
UM-FA-9A 3 normally open (N.O.) 6A
UM-FA-11A 2 normally open (N.O.), and 1 normally closed (N.C.) 7A
WARNING: Not a Safeguarding Device
This Banner device is considered complementary equipment that is used to augment safeguarding that
limits or eliminates an individual's exposure to a hazard without action by the individual or others. Failure
to properly safeguard hazards per a risk assessment, local regulations and relevant standards
could lead to serious injury or death.
Important... Read This Before Proceeding
The user is responsible for satisfying all local, state, and national laws, rules, codes, and regulations relating to the use of this
product and its application. Banner Engineering Corp. has made every effort to provide complete application, installation, operation, and
maintenance instructions. Please direct any questions regarding the use or installation of this product to the factory applications department at the telephone numbers or address found at http://www.bannerengineering.com.
The user is responsible for making sure that all machine operators, maintenance personnel, electricians, and supervisors are thoroughly familiar with and understand all instructions regarding the installation, maintenance, and use of this product, and with the machinery it
controls. The user and any personnel involved with the installation and use of this product must be thoroughly familiar with all applicable
standards, some of which are listed within the specifications. Banner Engineering Corp. makes no claim regarding a specific recommendation of any organization, the accuracy or effectiveness of any information provided, or the appropriateness of the provided information
for a specific application.
P/N 141249_web
Rev. E
5/28/2013
UM-FA-xA Universal Input Safety Modules
Overview
The UM-FA-xA Universal Safety Module (or "Safety Module" or "Module" in this document) is used to increase the safety circuit integrity
(for example, Control Reliability) of a circuit.
As shown in the hookup configurations in Safety Input Device Hookup Options on page 5, the Safety Module is designed to monitor a
1-channel or 2-channel safety switch(es); for example, an E-stop or safety interlock switch, or a 1-channel or 2-channel PNP output from
devices such as a sensor or a safety laser scanner.
Safety Circuit Integrity and ISO 13849-1 Safety Circuit Principles
Safety circuits involve the safety-related functions of a machine that minimize the level of risk of harm. These safety-related functions can
prevent initiation, or they can stop or remove a hazard. The failure of a safety-related function or its associated safety circuit usually
results in an increased risk of harm.
The integrity of a safety circuit depends on several factors, including fault tolerance, risk reduction, reliable and well-tried components,
well-tried safety principles, and other design considerations.
Depending on the level of risk associated with the machine or its operation, an appropriate level of safety circuit integrity (performance)
must be incorporated into its design. Standards that detail safety performance levels include ANSI B11.19 Performance Criteria for Safeguarding and ISO 13849-1 Safety-Related Parts of a Control System.
Safety Circuit Integrity Levels
Safety circuits in International and European standards have been segmented into Categories and Performance Levels, depending on
their ability to maintain their integrity in the event of a failure and the statistical likelihood of that failure. ISO 13849-1 details safety circuit
integrity by describing circuit architecture/structure (Categories) and the required performance (PL) of safety functions under foreseeable
conditions.
In the United States, the typical level of safety circuit integrity has been called "Control Reliability." Control Reliability typically incorporates redundant control and self-checking circuitry and has been loosely equated to ISO 13849-1 Category 3 or 4 and/or Performance
Level “d” or “e” (see ANSI B11.19).
Perform a risk assessment to ensure appropriate application, interfacing/hookup, and risk reduction (see ANSI B11.0 or ISO 12100). The
risk assessment must be performed to determine the appropriate safety circuit integrity in order to ensure that the expected risk reduction
is achieved. This risk assessment must take into account all local regulations and relevant standards, such as U.S. Control Reliability or
European "C" level standards.
Fault Exclusion
An important concept within the requirements of ISO 13849-1 is the probability of the occurrence of a failure, which can be reduced using
a technique termed "fault exclusion." The rationale assumes that the possibility of certain well-defined failure(s) can be reduced via design, installation, or technical improbability to a point where the resulting fault(s) can be, for the most part, disregarded—that is, "excluded" in the evaluation.
Fault exclusion is a tool a designer can use during the development of the safety-related part of the control system and the risk assessment process. Fault exclusion allows the designer to design out the possibility of various failures and justify it through the risk assessment process to meet the requirements of ISO 13849-1/-2.
Monitoring of Safety Devices
Requirements vary widely for the level of safety circuit integrity in safety applications (that is, Control Reliability or Category/Performance
Level) per ISO 13849-1. While Banner Engineering always recommends the highest level of safety in any application, it is the responsibility of the user to safely install, operate and maintain each safety system and comply with all relevant laws and regulations.
Although only three applications are listed (see Input Device Requirements on page 3), the Module can monitor a variety of devices as
long as the input requirements are complied with (see Electrical Installation and Specifications). The Safety Module does not have 500
ms simultaneity between inputs and thus cannot be used for monitoring a two-hand control. In all cases, the safety performance
(integrity) must reduce the risk from identified hazards as determined by the machine's risk assessment.
WARNING: Risk Assesment
The level of safety circuit integrity can be greatly affected by the design and installation of the safety devices and the means of interfacing of those devices. A risk assessment must be performed to determine
the appropriate level of safety circuit integrity to ensure the expected risk reduction is achieved
and all relevant regulations and standards are complied with.
2 www.bannerengineering.com - tel: 763-544-3164 P/N 141249_web
Rev. E
Power ON LED
Channel 1 Active LED
Channel 2 Active LED
1 2
ON
1 2
ON
UM-FA-xA Universal Input Safety Modules
Indicators and Adjustments
The Safety Module has indicators for input power and output relay contact status (K1 and K2); see Figure 1. Features on page 3.
There are no adjustments and no user-serviceable parts.
Figure 1. Features Figure 2. Accessing the DIP Switches
The Safety Module can monitor dry (hard/relay) contacts as well as solid state PNP outputs from sensors or light screens, either in singlechannel or dual-channel mode. To select dry contact inputs and single-channel solid-state inputs, set the two DIP switches under the
lower terminal block to ON (both switches toward the circuit board). To select dual-channel solid-state inputs, set the two DIP switches to
OFF (away from the circuit board). The factory default setting is for dual-channel solid-state input mode (both switches OFF/away from
the circuit board), see Figure 5. on page 7.
Dual- or Single-Channel
Switch 1 and 2: ON
Solid-State Dual-Channel (Default)
Switch 1 and 2: OFF
Figure 3. DIP Switch Settings
Input Device Requirements
WARNING: Incomplete Information
Many installation considerations that are necessary to properly apply input devices are not covered in this
document. Refer to the appropriate device installation instructions to ensure the safe application of
the device.
Optical Sensors
The safety inputs may be used to monitor optical-based devices that use light as a means of detection. These devices include safety light
screens (curtains), safety laser scanners, and multiple/single beam devices (grids/points).
The design and installation of the optical safeguarding device should comply with ANSI B11.19, IEC61496 (all applicable parts), ISO
13855, and/or other applicable standards. Optical safety devices must be placed at an appropriate safety distance (separation distance)
from the safeguarded hazard. Because these devices vary, it is not practical to list specific calculations here. Refer to the applicable
standards and to manufacturer documentation specific to your device for the appropriate calculations and for complete installation information (such as AG4 installation manual p/n 144924).
Interlocked Guards (Gates)
The safety inputs can be interfaced with positive-opening safety switches to monitor the position of an interlock guard or gate. Each
switch must provide electrically isolated contacts: at minimum, one normally closed (N.C.) contact from each individually mounted switch.
The contacts must be of "positive-opening" (direct-opening) design, as described by IEC60947- 5-1, with one or more normally closed
P/N 141249_web
Rev. E
www.bannerengineering.com - tel: 763-544-3164 3
UM-FA-xA Universal Input Safety Modules
contacts rated for safety. In addition, the switches must be mounted in a "positive mode," to move/disengage the actuator from its home
position and open the normally closed contact when the guard opens.
The design and installation of the interlocked guard and the safety switches should comply with ANSI B11.19, ISO14119, ISO 14120,
and/or other applicable standards. See the device manufacturer installation instructions for complete information (such as GM-FA-10J p/n
60998, SI-LS83/-LS100 p/n 59622, or SI-HG63 p/n 129465 datasheets).
In higher levels of safety performance, the design of a dual-channel coded magnetic switch typically uses complementary switching, in
which one channel is open and one channel is closed at all times. The inputs of the Safety Module do not support complementary
switching, and thus should not be used with coded magnetic safety switches.
Emergency Stop Push Buttons and Rope/Cable Pull Switches
The safety inputs can be interfaced with positive-opening switches to monitor an emergency-stop (E-stop) push button or rope/cable pull.
The switch must provide one or two contacts for safety which are closed when the switch is armed. Once activated, the E-stop switch
must open all its safety-rated contacts, and must require a deliberate action (such as twisting, pulling, or unlocking) to return to the
closed-contact, armed position. The switch must be a "positive-opening" (or direct-opening) type, as described by IEC 60947-5-1.
Standards ANSI NFPA 79, ANSI B11.19,, IEC/EN60204-1, and ISO 13850 specify additional emergency stop switch device requirements, including the following:
• Emergency-stop push buttons shall be located at each operator control station and at other operating stations where emergency
shutdown is required.
• Stop and emergency-stop push buttons shall be continuously operable and readily accessible from all control and operating stations
where located. Do not mute or bypass E-stop buttons or rope/cable pulls.
• Actuators of emergency-stop devices shall be colored red. The background immediately around the device actuator shall be colored
yellow (where possible). The actuator of a push-button-operated device shall be of the palm or mushroom-head type.
• The emergency-stop actuator shall be a self-latching type.
In addition, for Rope/Cable Pull Installations Only:
• The red wire rope should be easily visible and readily accessible along its entire length. Red markers or flags may be fixed on the
rope to increase its visibility.
• The rope or cable pull must provide constant tension and must have the capability to react to a force in any direction.
• Mounting points, including support points, must be rigid.
• The rope should be free of friction at all supports. Pulleys are recommended.
• The switch must have a self-latching function that requires a manual reset after actuation
Some applications may have additional requirements; comply with all relevant regulations. See the device manufacturer installation instructions for complete information (such as SSA-EB1..-.. p/n 162275, or RP-RM83F.. p/n 141245 data sheets).
WARNING: Emergency Stop Functions
Do not mute or bypass any Emergency Stop device. ANSI B11.19, ANSI NFPA79 and IEC/EN
60204-1 require that the Emergency Stop function remain active at all times.
Mechanical Installation
The Safety Module must be installed inside an enclosure.
It is not designed for exposed wiring. It is the user’s responsibility to house the Safety Module in an enclosure with NEMA 3 (IEC IP54)
rating, or better. The Safety Module mounts directly to standard 35 mm DIN rail.
Heat Dissipation Considerations: For reliable operation, ensure that the operating specifications are not exceeded. The enclosure must
provide adequate heat dissipation, so that the air closely surrounding the Module does not exceed the maximum operating temperature
stated in the Specifications. Methods to reduce heat build-up include venting, forced airflow (for example, exhaust fans), adequate enclosure exterior surface area, and spacing between modules and other sources of heat.
4 www.bannerengineering.com - tel: 763-544-3164 P/N 141249_web
Rev. E
UM-FA-xA Universal Input Safety Modules
Electrical Installation
WARNING: Shock Hazard and Hazardous Energy
Always disconnect power from the safety system (for example, device, module, interfacing, etc.)
and the machine being controlled before making any connections or replacing any component.
Electrical installation and wiring must be made by Qualified Person and must comply with the relevant
electrical standards and wiring codes, such as the NEC (National Electrical Code), ANSI NFPA79, or IEC
60204-1, and all applicable local standards and codes.
Lockout/tagout procedures may be required. Refer to OSHA 29CFR1910.147, ANSI Z244-1, ISO
14118, or the appropriate standard for controlling hazardous energy.
Electrical installation must be made by qualified personnel1 and must comply with NEC (National Electrical Code), ANSI/NFPA 79 or
IEC/EN 60204-1, and all applicable local standards. It is not possible to give exact wiring instructions for a device that interfaces to a
multitude of machine control configurations. The following guidelines are general in nature. Perform a risk assessment to ensure appropriate application, interfacing/hookup, and risk reduction (see ANSI B11.0 or ISO 12100).
The Safety Module has no delay function. Its output relay contacts open within 25 milliseconds after a safety input opens. This classifies
the Safety Module as a functional stop "Category 0" control, as defined by ANSI NFPA 79 and IEC/EN 60204-1.
The safety inputs can be connected to:
• +24V dc solid-state (PNP) outputs in single-channel or dual-channel hookup configuration
• +24V dc source that is switched by hard/relay contacts in single-channel or dual-channel hookup configuration
• Hard/relay contacts in a dual-channel hookup configuration using terminals S11-S12 and S21-S22
The UM Safety Module must be configured (via DIP switch) for the appropriate hookup in order to operate properly. When using devices
with redundant solid-state safety outputs (such as the AG4 Safety Laser Scanner OSSDs) or redundant hard contacts switching a +24V
dc source, both the DIP switches must be set to the "OFF" position (default position, see Figure 3. DIP Switch Settings on page 3). This
setting is for solid-state dual-channel hookup using terminals S11-S12 and S21-S22 as described in Figure 5. on page 7.
To configure the Module for dual-channel hookup to monitor a device with redundant hard contacts (such as an emergency-stop button),
set both the DIP switches to the "ON" position. This setting is for dual-channel hookup using terminals S11-S12 and S21-S22 as described in Figure 4. on page 7, or when the dual-channel input is not used (is jumpered) in single-channel hookup configuration as described in Figure 6. on page 8 and Figure 7. on page 8.
Safety Input Device Hookup Options
The operation of all dual-channel hookup options is concurrent, meaning that input channel 1 and input channel 2 must be in the same
state in both the STOP and RUN condition, but with no simultaneity (timing) requirement between the channels.
The dry (hard/relay) contact dual-channel hookup configuration is able to detect certain failures and faults, such as short circuits, that
could result in a loss of the safety function. Once such a failure or fault is detected, the Safety Module will turn OFF (open) its safety
outputs until the problem is fixed. This circuit can meet ISO 13849-1 Category 2, 3, or 4 requirements, depending on the safety rating and
the installation of the safety input device. This circuit can detect a short circuit between channels or to another source of power, at a
minimum, when the device is actuated.
The solid-state dual-channel hookup configuration cannot detect short circuits between input channels or to secondary sources of
+24V dc. To achieve higher levels of safety performance, the safety device that is connected to input channels 1 and 2 must be capable
of detecting these short circuits and properly responding by turning both channels OFF. This circuit can meet ISO 13849-1 Category 2, 3,
or 4 requirements depending on the safety rating, installation, and the fault detection (for example, short circuit) capabilities of the safety
input device. If short circuit detection is not provided, the circuit can meet only Category 3.
A single device with redundant outputs that can fail in such a manner to lose the safety function, such as a single safety interlocking
switch, can typically meet only a Category 2. See below for means to eliminate or minimize the possibility of failures and faults that could
result in the loss of the safety function(s).
The single-channel hookup configuration cannot detect short circuits to secondary sources of +24V dc or detect the loss of the switching function of the safety input device (that is, it is not redundant) and thus this circuit typically can meet only ISO 13849-1 Category 2.
1
A Qualified Person possesses a recognized degree or certificate or has extensive knowledge, training, and experience to solve problems relating to the emergency stop installation.
P/N 141249_web
Rev. E
www.bannerengineering.com - tel: 763-544-3164 5
Loading...