Figure 20. Connect two redundant safety switches per interlock guard to an appropriate 2-channel input safety module
Safety Switch
#1
Safety Switch
#2
Input Channel
#1
Input Channel
#2
2-channel Safety Module
(2-channel E-stop Module
2-channel Gate Monitor Module, etc.)
Single gate
or guard
11
(21)
11
(21)
12
(22)
12
(22)
The non-safety contact (33/34) will switch at a greater degree (rotation) than the
safety contacts and may not indicate if the guard is slightly open (see
on page 2). In such situations, an unused safety contact can more accurately
indicate the status of the guard.
Refer to the installation instructions provided with the safety module or safety
controller for information regarding the interface of the safety module to the
machine stop control elements.
Two functions of the safety module or safety controller are:
1. To provide a means of monitoring the contacts of both safety switches for contact failure, and to prevent the machine from
restarting if either switch fails.
2. To provide a reset routine after closing the guard and returning the safety contacts to their closed position. This prevents the
controlled machinery from restarting by simply closing the guard (reinserting the key/actuator, for example). This necessary
reset function is required by ANSI B11.0 and NFPA 79 machine safety standards.
Use only positively-driven, normally-closed safety contacts from each switch for connection to the safety module, controller, or the
safety related part of the machine control (see
on page 2). A typical use for the normally-open non-safety contact is to
communicate status with a process controller or for other control functions that are not safety-related. Refer to the installation
instructions provided with the safety modules or controllers for more information regarding the interface of the safety module to the
machine stop control elements.
WARNING:
•
Determine the safety category
•
The design and installation of the safety devices and the means of interfacing of those devices could
greatly affect the level of safety circuit integrity.
•
Perform a risk assessment to determine the appropriate safety circuit integrity level or safety category,
as described by ISO 13849-1, to ensure that the expected risk reduction is achieved and that all
applicable regulations and standards are met.
Important:
The design, installation and the means of interfacing of the safety switches greatly affect the level of
safety circuit integrity. It is recommended that two individual safety switches be used to monitor each guard and
that the normally-closed safety contacts from each of the two safety switches be connected in a dual channel
method to a safety module or safety controller to achieve control reliability (OSHA 29CFR1910 or ANSI B11.19)
or Category 3 or 4 (ISO 13849-1). This is required to provide monitoring for safety switch failure, and to provide
the necessary reset routine, as required by NFPA 79 and IEC 60204-1.
Use of only one safety switch per
interlock guard is not recommended in situations that can result in serious injury or death.
Monitoring Series-Connected Safety Switches
When monitoring the position of several guards with a single safety module or controller, the contacts of the corresponding pole of
each switch must be connected together in series. Never connect the contacts of multiple switches in parallel. Such a parallel
connection can defeat the switch contact monitoring ability of the module and could create an unsafe condition.
When multiple safety switches are series connected, the failure of one switch in the system may be masked or not be detected at all.
The following two scenarios assume two positive-opening safety switches on each guard, both connected in series to switches of a
second guard (dual channel hookup) and monitored by a safety module or safety controller:
•
Masking of a failure
—If a guard is opened but one switch fails to open, the redundant safety switch on that guard opens
and a protective (safety) stop occurs. If the faulty guard is then closed, the module/controller will not reset because one
channel did not open, thus complying with the required fault detection. However, if a second "good" guard is cycled (opening
and then closing both of the channels), the failure appears to be corrected (input requirements satisfied) and the module/
controller allows a reset. This system is no longer redundant and, if the second switch fails, may result in an unsafe
condition (the accumulation of faults resulting in loss of the safety function).
•
Non-detection of a failure
—If a functional guard is opened, both channels open and the module/controller initiates a
protective (safety) stop. If a guard with a faulty safety switch is then opened and closed before the good guard is re-closed,
the faulty switch is not detected. The system is no longer redundant and may result in a loss of safety if the redundant switch
fails to open when needed.
The system in either scenario does not inherently comply with the safety standard requirements of detecting a single fault and
preventing the next cycle (not a Category 4 application per ISO 13849-1). In multiple-guard systems using series-connected safety
switches, it is important to periodically check the functional integrity of each interlocked guard individually. Open and close each
guard separately while verifying that the machine properly responds.
Operators, maintenance personnel, and others associated
with the operation of the machine must be trained to recognize failures and be instructed to correct them immediately.
SI-HG(Z)63 Hinge Wing Safety Interlock Switch
8
www.bannerengineering.com - Tel: + 1 888 373 6767
P/N 129465 Rev. G
