Manual

26 P/N 116390 rev. C
Banner Engineering Corp. • Minneapolis, U.S.A.
www.bannerengineering.com • Tel: [phone]
MMD-TA-11B / MMD-TA-12B Muting Module
Instruction Manual
System Installation
3.5.6.4 SSI/MSSI Interlocked Guard or Gate Hookup
The SSI (or MSSI) may be used to monitor electrically
interlocked safety guards or gates.
Safety Circuit Integrity Levels
Requirements vary widely for the level of control reliability or
safety category per ISO 13849-1 (EN954-1) in the application
of interlocked guards. While Banner Engineering always
recommends the highest level of safety in any application, it
is the responsibility of the user to safely install, operate and
maintain each safety system and comply with all relevant laws
and regulations.
The safety performance (integrity) must reduce the risk
from identified hazards as determined by the machine’s risk
assessment. See Sections 3.5.6.1 and 3.5.6.2 for guidance if the
requirements as described by ISO 13849-1 (EN954-1) are to be
implemented.
In addition to the requirements stated in this section, the design
and installation of the interlocking device should comply with
ANSI B11.19 or ISO 14119.
Safety Interlocking Switch Requirements
The following general requirements and considerations apply to
the installation of interlocked guards and gates for the purpose
of safeguarding. In addition, refer to the relevant regulations to
be sure to comply with all necessary requirements.
Hazards guarded by the interlocked guard must be prevented
from operating until the guard is closed; a stop command must
be issued to the guarded machine if the guard opens while the
hazard is present. Closing the guard must not, by itself, initiate
hazardous motion; a separate procedure must be required to
initiate the motion. The safety switches must not be used as a
mechanical or end-of-travel stop.
The guard must be located an adequate distance from the
danger zone (so that the hazard has time to stop before the
guard is opened sufficiently to provide access to the hazard),
and it must open either laterally or away from the hazard, not
into the safeguarded area. The guard also should not be able to
close by itself and activate the interlocking circuitry. In addition,
the installation must prevent personnel from reaching over,
under, around or through the guard to the hazard. Any openings
in the guard must not allow access to the hazard (see OSHA
29CFR1910.217 Table O-10, ANSI B11.19, EN 294, ISO 14120/
EN953 or the appropriate standard). The guard must be strong
enough and designed to protect personnel and contain hazards
within the guarded area, which may be ejected, dropped or
emitted by the machine.
The safety interlocking switches and actuators used with the
Muting Module must be designed and installed so that they
cannot be easily defeated. They must be mounted securely, so
that their physical position can not shift, using reliable fasteners
that require a tool to remove them.
Positive-Opening Safety Interlocking Switches
Safety interlock switches used with the Muting Module must
satisfy several requirements. Each switch must provide
electrically isolated contacts: at minimum, one normally closed
(N.C.) contact from each individually mounted switch.
The contacts must be of “positive-opening” (direct-opening)
design, as described by IEC 60947-5-1, with one or more
normally closed contacts rated for safety. Positive-opening
operation causes the switch to be forced open, without the use of
springs, when the switch actuator is disengaged or moved from
its home position (see the Banner Safety Catalog for examples).
In addition, the switches must be mounted in a “positive mode,”
to move/disengage the actuator from its home position and open
the normally closed contact, when the guard opens.
Monitoring Series-Connected Safety Interlocking Switches
When monitoring two individually mounted safety switches (as
shown in Figure 3-21), a faulty switch will be detected if it fails
to switch as the guard opens. In this case, the Module will de-
energize its safety outputs (OSSDs) and disable its reset function
until the input requirements are met (i.e., the faulty switch is
replaced). However, when a series of safety interlocking switches
is monitored by a single Module, the failure of one switch in the
system may be masked or not be detected at all (refer to Figures
3-19 and 3-20).
Series-connected interlock switch circuits may not meet OSHA
Control Reliability or ISO 13849 (EN 954-1) safety category
4 requirements because of the potential of an inappropriate
reset or a potential loss of the safety stop signal. This is due
to the typical inability to fault exclude the failure of the safety
interlock switch. A multiple connection of this type should not
be used in applications where loss of the safety stop signal or
an inappropriate reset can lead to serious injury or death. The
following two scenarios assume two positive-opening safety
switches on each guard:
1. Masking of a failure.
If a guard is opened but a switch fails
to open, the redundant safety switch will open and cause the
Module to de-energize its outputs. If the faulty guard is then
closed, both Module input channels also close, but because
one channel did not open, the Module will not reset. However,
if the faulty switch is not replaced and a second “good” guard
is cycled, opening and then closing both of the Module’s input
channels, the Module considers the failure to be corrected.
With the input requirements apparently satisfied, the Module
allows a reset. This system is no longer redundant and, if the
second switch fails, may result in an unsafe condition (i.e.,
the accumulation of faults results in the loss of the safety
function).
2. Non-detection of a failure.
If a good guard is opened, the
Safety Module de-energizes its outputs (a normal response).
But if a faulty guard is then opened and closed before the
good guard is re-closed, the failure on the faulty guard is not
detected. This system also is no longer redundant and may
result in a loss of safety if the second safety switch fails to
switch when needed.