Banner SC22-3E Safety Controller with Ethernet - Manual (Page 94)

The safety performance (integrity) must reduce the risk from identified hazards as determined by the machine’s risk assessment. See
section
10.1 Safety Circuit Integrity and ISO 13849-1 (EN954-1) Safety Circuit Principles on page 90 for guidance if the requirements as
described by ISO 13849-1 are to be implemented.
In addition to the requirements stated in this section, the design and installation of the interlocking device should comply with ANSI
B11.19 or ISO14119.
10.3.2 Safety Interlock Switch Requirements
The following general requirements and considerations apply to the installation of interlocked guards and gates for the purpose of safe-
guarding. In addition, the user must refer to the relevant regulations to be sure to comply with all necessary requirements.
Hazards guarded by the interlocked guard must be prevented from operating until the guard is closed; a stop command must be issued to
the guarded machine if the guard opens while the hazard is present. Closing the guard must not, by itself, initiate hazardous motion; a
separate procedure must be required to initiate the motion. The safety switches must not be used as a mechanical or end-of-travel stop.
The guard must be located an adequate distance from the danger zone (so that the hazard has time to stop before the guard is opened
sufficiently to provide access to the hazard), and it must open either laterally or away from the hazard, not into the safeguarded area. The
guard also should not be able to close by itself and activate the interlocking circuitry. In addition, the installation must prevent personnel
from reaching over, under, around or through the guard to the hazard. Any openings in the guard must not allow access to the hazard
(see OSHA 29CFR1910.217 Table O-10, ANSI B11.19, ISO 13857, ISO14120/EN953 or the appropriate standard). The guard must be
strong enough to contain hazards within the guarded area, which may be ejected, dropped or emitted by the machine.
The safety interlocking switches and actuators must be designed and installed so that they cannot be easily defeated. They must be
mounted securely, so that their physical position can not shift, using reliable fasteners that require a tool to remove them.
WARNING: . . . Perimeter Guarding Applications
If the application could result in a pass-through hazard (e.g., perimeter guarding), either the safeguarding device or
the guarded machine's MSCs/MPCEs must cause a Latched response following a Stop command (e.g., interruption
of the sensing field of a light curtain, or opening of an interlocked gate/guard). The reset of this Latched condition may
only be achieved by actuating a reset switch that is separate from the normal means of machine cycle initiation. The switch
must be positioned as described in this document.
Lockout/Tagout procedures per ANSI Z244.1 may be required, or additional safeguarding, as described by ANSI B11
safety requirements or other appropriate standards, must be used if a passthrough hazard can not be eliminated or reduced
to an acceptable level of risk. Failure to observe this warning could result in serious bodily injury or death.
Positive-Opening Safety Interlocking Switches
Safety interlock switches must satisfy several requirements. Each switch must provide electrically isolated contacts: at minimum, one
normally closed (N.C.) contact from each individually mounted switch. The contacts must be of “positive-opening” (direct-opening) design,
as described by IEC 60947-5-1, with one or more normally closed contacts rated for safety. Positive-opening operation causes the switch
to be forced open, without the use of springs, when the switch actuator is disengaged or moved from its home position (visit
www.banner-
engineering.com for examples).
In addition, the switches must be mounted in a “positive mode,” to move/disengage the actuator from its home position and open the
normally closed contact when the guard opens.
Magnetically Operated Safety Interlocking Switches
In higher levels of safety performance, the design of a dual-channel magnetic switch typically uses complementary switching, in which
one channel is open and one channel is closed at all times. This provides redundancy (two contacts) and diversity (different principles of
operation) to minimize the possibility of the loss of the switching function due to common mode failures (e.g., secondary magnetic fields).
The circuitry or the Safety Controller that is monitoring the magnetic switch will detect and respond to a failure that results in the loss of
the complementary state (e.g., a short circuit between the channels, or a short circuit to other sources of power).
Coded and non-coded magnetic switches affect the ability of the switch to be defeated and to withstand common mode failures. Non-
coded switches are easily defeated by the presence of a simple magnetic field and should be mounted in a concealed position. A coded
magnetic switch that uses alternating magnetic poles should be used in applications that require higher levels of safety performance.
SC22-3/-3E Safety Controller Instruction Manual
94 www.bannerengineering.com - tel: 763-544-3164 P/N 133487 rev. C