Banner ES-UA-5A Instruction page 4

Fault Exclusion
An important concept within the category requirements of ISO 13849-1 is the "probability of the occurrence of the
failure," which can be decreased using a technique termed "fault exclusion." The rationale assumes that the possi-
bility of certain well-defined failure(s) can be reduced to a point where the resulting fault(s) can be, for the most part,
disregarded – that is, "excluded."
Fault exclusion is a tool a designer can use during the development of the safety-related part of the control system
and the risk assessment process. Fault exclusion allows the designer to design out the possibility of various failures
and justify it, through the risk assessment process, to meet the intent requirements of Category 2, 3 or 4. See ISO
13849-1/-2 for further information.
Monitoring of Safety Devices
Requirements vary widely for the level of control reliability or safety category per ISO 13849-1 (EN954-1) in safety
applications. While Banner Engineering always recommends the highest level of safety in any application, it is the
responsibility of the user to safely install, operate and maintain each safety system and comply with all relevant laws
and regulations.
While only two applications are listed below, the Module can monitor a variety of devices as long as the input require-
ments are complied with (see Electrical Installation and Specifications). The Safety Module does not have 500
ms simultaneity between inputs and thus can not be used for monitoring a two-hand control. In all cases,
the safety performance (integrity) must reduce the risk from identified hazards as determined by the machine's risk
assessment.
WARNING . . . Emergency Stop Functions
Do not mute or bypass any emergency stop device. ANSI NFPA79 and IEC/EN 60204-1 require that the
emergency stop function remain active at all times. Muting or bypassing the Safety Outputs will render the
emergency stop function ineffective.
Emergency-Stop Push Buttons and Rope/Cable Pull Switches:
The safety inputs can be interfaced with positive-opening switches to monitor an emergency-stop (E-stop) push
button or rope/cable pull. The switch must provide one or two contacts for safety which are closed when the switch
is armed. Once activated, the E-stop switch must open all its safety-rated contacts, and must require a deliberate
action (such as twisting, pulling, or unlocking) to return to the closed-contact, armed position. The switch must be
a "positive-opening" (or direct-opening) type, as described by IEC 60947-5-1.
Standards ANSI NFPA 79, IEC/EN 60204-1, and ISO 13850 specify additional emergency stop switch device re-
quirements, including the following:
Emergency-stop push buttons shall be located at each operator control station and at other operating stations
where emergency shutdown is required.
Stop and emergency-stop push buttons shall be continuously operable and readily accessible from all control and
operating stations where located. Do not mute or bypass E-stop buttons or rope/cable pulls.
Actuators of emergency-stop devices shall be colored red.The background immediately around the device actuator
shall be colored yellow (where possible). The actuator of a push-button-operated device shall be of the palm or
mushroom-head type.
The emergency-stop actuator shall be a self-latching type.
For Rope/Cable Pull installations only:
The wire rope should be easily accessible and visible along its entire length. Markers or flags may be fixed on the
rope to increase its visibility.
Mounting points, including support points, must be rigid.
The rope should be free of friction at all supports. Pulleys are recommended.
4 Banner Engineering Corp. - Minneapolis, MN USA - www.bannerengineering.com
ES-UA-5A and ES-VA-5A E-Stop Safety Modules
Tel: 763.544.3164
P/N 122365 rev. C