What an elevator controller does

Tamsin Iwasaki started the third term of her second year in the Tillicum Building's penthouse machine room, standing in front of a grey steel cabinet that was taller than she was. Behind its doors were more than a hundred relays in rows, each with a small brass nameplate, a bundle of cloth-covered wires, and a smell of warm insulation and old dust. "This is the brain of car 1," Priya Sandhu said. "It was built in 1962, and every decision this car makes is a coil pulling in or dropping out somewhere in here." Then she drove Tamsin across town to Quayside Tower, opened a cabinet beside the top landing no bigger than a kitchen pantry, and pointed at a row of circuit boards and a drive. "And this is the brain of car 2. It makes the same decisions, in the same order, for the same reasons. The difference is that you can read what it is thinking."

Priya is Northcrest's senior adjuster, the person who sets up, tunes and fixes controllers and drives across the branch. She taught Tamsin's evening electrical block in ELV-210 and now takes her for a full term on controls. This course follows that term, from the relay controllers on Route 7 to the microprocessor group at Quayside, the hospital cars at Holloway on emergency power, the single machine-room-less car at Larchmont Residences, and a capstone fault on a Quayside car that only appears on hot afternoons.

The controller's jobs

Every elevator controller, relay or microprocessor, does the same set of jobs. It is useful to know the list by heart, because when a car misbehaves the first question is which of these jobs went wrong.

• It registers calls. Car calls come from the buttons in the car; hall calls come from the up and down buttons at each landing or, with destination dispatch, from keypads where passengers enter their floor. The controller remembers each call and lights its acknowledgement lamp.
• It chooses a direction. Most passenger controllers use collective selective operation: the car keeps travelling in one direction while it has calls ahead of it in that direction, answers them in order, and reverses only when there are none left.
• It commands motion. It tells the drive, or on old cars the motor-generator set and its field relays, to start, run at a speed, slow down and stop, and it lifts and drops the brake at the right moments.
• It runs the doors. It opens the doors at a stop, holds them for a set time, closes them, and reopens them if the door protection sees a passenger in the way.
• It watches the safety circuit. A chain of switches in the hoistway, pit, car and machine space must all be closed before the car may move. If any one opens, the controller removes power from the machine and the brake sets.
• It knows where the car is. A landing system or encoder tells the controller the car's position, when to start slowing for a floor, and when the car is level with the sill.
• It runs special operations: inspection operation for mechanics, independent service, firefighters' emergency operation, emergency power operation, and seismic operation in earthquake regions like the Pacific Northwest.
• It records what happened. Relay controllers keep no record at all; microprocessor controllers keep fault and event logs that are often the fastest way to the cause of a problem.

From operators to automatic control

The first passenger elevators had attendants who moved a lever or a rotating car switch to start and stop the car by eye. Signal control, which let the attendant press buttons for the floors while the car stopped itself, followed in the 1920s and 1930s, and fully automatic, attendant-free operation spread after the Second World War. Tillicum car 1 is a product of that period: its relay controller provides automatic collective selective operation, opens and closes power-operated doors, and slows and levels the car with a series of switches and relays, all without an operator. Ray Abernethy still calls the car top inspection station "the car switch", a name that goes back to the days of attendants.

From the 1970s, solid-state logic boards began to replace relays, and by the late 1980s most new controllers used microprocessors. A microprocessor controller replaces hundreds of relays with software running on one or more processors, reads its inputs through input boards and switches its outputs through relays, transistors or the drive itself. It can run complicated dispatching, store faults, talk to the drive over a serial link, and be set up or adjusted with a service tool instead of a screwdriver. The relays that remain in a modern controller are mostly in the safety circuit and the power path, where codes have long required that a single failure cannot let the car move unsafely.

Collective selective operation

Collective selective operation is what most people picture when they think of an automatic elevator. A car going up stops for car calls above it and for up hall calls above it, in order. It ignores down hall calls on the way up and leaves them for the trip down, unless it has nowhere else to go. When it has served its last call in the up direction, it either reverses to serve calls below, or parks and waits. Downward collective, used in some apartment buildings, has only one hall button per floor and serves all hall calls on the way down, on the assumption that everyone above the lobby wants to go to the lobby.

The rules sound simple, but they hide a great deal of logic. The controller must know which calls are ahead of the car, must not stop for a hall call it has already passed, must decide whether to answer a down call at the top floor on the way up, must cancel calls as it answers them and must handle a passenger pressing a call for the floor the car is already standing at. On Tillicum car 1, every one of those decisions is made by contacts on a mechanical floor selector in the machine room, driven by a steel tape from the car, and by relays wired to it. On Quayside car 2 it is a few hundred lines of code.

# Collective selective operation: which call does the car answer next?
car_floor = 7
direction = "up"
car_calls = {3, 9, 12}
up_calls = {10}
down_calls = {5, 11}

def next_stop(floor, direction):
    if direction == "up":
        ahead = [f for f in car_calls | up_calls if f > floor]
        if ahead:
            return min(ahead), "up"
        # nothing more going up: highest down call above, or reverse
        above_down = [f for f in down_calls if f > floor]
        if above_down:
            return max(above_down), "down"
        return next_stop(floor, "down")
    else:
        ahead = [f for f in car_calls | down_calls if f < floor]
        if ahead:
            return max(ahead), "down"
        return None, "idle"

floor, d = car_floor, direction
order = []
while True:
    stop, d = next_stop(floor, d)
    if stop is None:
        break
    order.append(stop)
    car_calls.discard(stop)
    if d == "up":
        up_calls.discard(stop)
    else:
        down_calls.discard(stop)
    floor = stop
print("stops in order:", order)
print("ends at floor", floor, "with no calls left")

stops in order: [9, 10, 12, 11, 5, 3]
ends at floor 3 with no calls left

The car leaves floor 7 going up, stops at 9 and 10, then at 12, the highest car call. It then answers the down call at 11, which it passed on the way up, and carries on down to 5 and 3. A real controller adds more rules, for example parking at the lobby or treating the top floor's down call as an up-direction stop, but the core is this loop: serve what is ahead, then reverse.

Relay controllers and microprocessor controllers side by side

Priya had Tamsin fill in a table during the first week, comparing the two cars they would work on most.

The table makes the relay controller look primitive, but Priya was careful to say otherwise. A relay controller is easy to see into: every function is a coil and a set of contacts on a print, and a mechanic with a meter and the print can find any fault. A microprocessor controller hides its logic in software, which the mechanic cannot read, and depends on the manufacturer's documents and tools. Many independent contractors like Northcrest maintain controllers from several makers, and part of a controls mechanic's skill is knowing which tools and documents each one needs, and what can be learned from the fault log without them.

Where controllers live

In a machine room, the controller stands beside the machine, usually with the drive in the same cabinet or next to it, and the main line disconnect on the wall at the entrance. On a machine-room-less car like Quayside car 2 or Larchmont, the controller is in a cabinet at a landing, often beside the top landing door, or in a small control room or closet, and the code sets rules for its access, lighting and working space. Wherever it is, the controller connects to the car through a travelling cable that hangs from the middle of the hoistway to the car, carrying power, safety circuit wires, serial communication pairs and often a network cable for a camera or display. It connects to the hall fixtures through wiring in the hoistway, and in a group to the other cars through a group link.

Ray's rule for a controller is the same as his rule for a machine: lock it out before you put your hands in it. A controller cabinet holds the line voltage for the drive and the brake, a DC bus in the drive that stays charged for minutes after the disconnect is opened, and control circuits on separate transformers. ELV-210 covered lockout and the DC bus in detail; Priya repeated one point on the first day. "Turning the inspection switch on or opening the stop switch stops the car. It does not make the cabinet safe."

Codes for controls

The rules for controllers sit mainly in two parts of CSA B44, harmonized with ASME A17.1 and adopted in British Columbia. The part on operating devices and control equipment covers the safety circuit and its devices, inspection operation, door control, protection against a single failure of a relay or a component, and the conditions under which software and electronic devices may perform safety functions. The part on emergency operation and signalling devices covers the emergency stop and alarm, two-way communication from the car, firefighters' emergency operation and emergency power operation. Maintenance requirements, including periodic tests of the safety functions and the keeping of records, are in the maintenance part, and Technical Safety BC enforces them through inspections and permits.

Like the machines in ELV-230, controllers are built to the code of their day. Tillicum car 1's controller predates most of the current rules on redundancy and monitoring; Quayside's meets the edition in force when the car was permitted. A controller replacement is an alteration that brings the car up to many current requirements, which is one reason a controller modernization, covered in ELV-430, usually costs more than the boards and relays alone.

What this course covers

Lessons 2 and 3 cover relay logic: the safety circuit, which every controller still has in some form, and how to read a relay controller's prints and follow its sequence through a run. Lessons 4 to 6 cover microprocessor controllers: their architecture, their inputs, outputs and serial links, and the certified safety electronics that now do work once done only by relays. Lessons 7 and 8 cover how the controller knows where the car is and how it moves it smoothly and stops it level. Lesson 9 covers group dispatching and destination dispatch, Lesson 10 the special operations that every mechanic must test, and Lesson 11 the diagnostic tools, fault logs and remote monitoring that make modern troubleshooting faster. Lesson 12 is a capstone fault at Quayside, followed from the first call to the written report.