Interlocks, door contacts and restrictors

The hoistway door interlock is the device that stands between a passenger and the two fatal door accidents of lesson 1. Priya put it plainly when she handed Tamsin a worn interlock taken off a Tillicum landing: "This little box decides whether a door can open with no car behind it and whether a car can move with a door open. When it fails safe, the car stops and somebody is annoyed. When it fails the other way, or somebody defeats it, somebody dies." This lesson explains how interlocks, car door contacts and car door restrictors work, what the code requires of them, how they are adjusted and tested, and why door bypass switches exist.

What an interlock must do

An interlock does two jobs, and the code requires both. First, it must lock the hoistway door so that it cannot be opened from the landing side unless the car is within the landing zone, a short distance above or below the floor, 450 mm (18 in) in the code. Second, it must prevent the car from operating unless the door is closed and locked. The lock and the electric contact are combined in one device, arranged so that the contact cannot close until the locking members are engaged by at least the minimum amount the code and the maker require. The contact is wired into the door circuit, the part of the safety circuit from ELV-310 that the controller watches before every run.

The contacts in an interlock must be positively opened: the locking member itself forces them apart when the door unlocks, rather than relying on a spring. A spring can break or a contact can weld; a positively opened contact cannot stay closed while the lock is released. The interlock must also be protected so that it cannot easily be reached and defeated from the landing, and it must be a listed or certified type, tested by its maker for endurance and for these functions.

How a typical interlock works

Most passenger interlocks are hook locks. A hook pivoted on the door hanger or the header falls into a keeper when the door closes, and a contact bridge on the hook closes the circuit as the hook seats. To open the door, the clutch vanes on the car door grip the interlock's rollers and move the arm that lifts the hook out of the keeper; only then can the car door drag the hoistway door open. Because the rollers are where the car's clutch passes, the lock can be released only when the car is at the landing, which is how the interlock enforces the landing zone. The hoistway door unlocking device, the access keyhole or escutcheon at the landing, lets an authorized person release the lock from the landing with a special tool, for emergencies and for access to the hoistway; codes require it at specified landings, and on many newer cars at every landing, and its tool must be kept under control.

Older equipment has other designs: gravity locks, roller-and-cam locks, and on freight and swing doors, mechanical locks with separate contacts. Whatever the design, the checks are the same: the lock engages by the required amount, the contact closes only after the lock engages, the contact opens when the lock is released, and the lock cannot be released from the landing without the tool when the car is away.

# Interlock engagement check (maker's minimum and code rule; figures illustrative)
minimum = 7.0             # required engagement before the contact can close, mm
readings = {1: (9.5, True), 2: (10.0, True), 3: (6.0, True),
            4: (9.0, True), 5: (9.5, False)}   # floor: (engagement, contact made only after lock engaged?)
for floor, (eng, sequence_ok) in readings.items():
    problems = []
    if eng < minimum:
        problems.append("engagement short")
    if not sequence_ok:
        problems.append("contact closes before lock engages")
    print(f"floor {floor}: engagement {eng:.1f} mm -> {'ok' if not problems else 'REMOVE FROM SERVICE: ' + ', '.join(problems)}")

floor 1: engagement 9.5 mm -> ok
floor 2: engagement 10.0 mm -> ok
floor 3: engagement 6.0 mm -> REMOVE FROM SERVICE: engagement short
floor 4: engagement 9.0 mm -> ok
floor 5: engagement 9.5 mm -> REMOVE FROM SERVICE: contact closes before lock engages

The Tillicum survey found two faults: floor 3's lock engaged less than the minimum, from a worn keeper, and floor 5's contact bridge had been bent so that it touched the contacts before the hook seated. Either one could let the car run with the door not properly locked. Both were repaired before the car returned to service, and both are the kind of fault that only shows up when someone checks.

The door circuit and how to find an open lock

The interlock contacts of every landing are wired in series, usually up one side of the hoistway and back, and the car door contact is in series with them or in its own branch. When a car shuts down on a door lock fault, one of these contacts is open. The method from ELV-310 applies: measure across the string at the controller's test points, then split it. On a relay car with a long series string, the quickest test is to measure the voltage across each lock in turn from the car top as the car moves on inspection; the open contact has the full circuit voltage across it. On a microprocessor car, the controller often reads the door circuit at several points and can tell which section is open, and some newer systems monitor each lock separately.

# Find the open lock: voltage measured across each interlock contact (doors closed)
supply = 120
readings = {"floor 1": 0.2, "floor 2": 0.1, "floor 3": 0.2, "floor 4": 118.6, "floor 5": 0.0,
            "floor 6": 0.1, "car door contact": 0.1}
for name, v in readings.items():
    if v > 0.5 * supply:
        print(f"{name:<18} {v:6.1f} V  <- this contact is open")
    elif v > 2.0:
        print(f"{name:<18} {v:6.1f} V  <- high resistance, contact burnt or dirty")
    else:
        print(f"{name:<18} {v:6.1f} V")

floor 1               0.2 V
floor 2               0.1 V
floor 3               0.2 V
floor 4             118.6 V  <- this contact is open
floor 5               0.0 V
floor 6               0.1 V
car door contact      0.1 V

A closed contact has almost no voltage across it; the open one has nearly the whole supply. A contact reading a few volts is closed but burnt or dirty and will soon cause intermittent trips, which is exactly what Tamsin found on Tillicum car 1's car top stop switch in ELV-210.

Car door contacts and car door locks

The car door contact proves the car door is closed. It is usually a switch on the car door operator or the car door header that is closed by the car door in its last few centimetres of travel. The car may not run unless it is closed, except during levelling and relevelling in the door zone under the code's bypass conditions. Where the car is far from the hoistway wall, so that a passenger who opens the car door between floors could fall into the space between the car and the wall, the code also requires the car door to be locked, with a car door interlock that works like a hoistway door interlock. This is common on cars in unusual hoistways, and some newer designs lock every car door as a matter of course.

Car door restrictors

Passengers trapped in a stalled car sometimes force the car door open and try to climb out. When the car is between floors, this is extremely dangerous: the person can fall down the hoistway below the car, or be caught if the car moves. The code therefore requires a restrictor, a device that prevents the car door from being opened more than a small amount, about 100 mm (4 in), from inside the car when the car is outside the unlocking zone, the zone close to a landing where the hoistway door can be unlocked by the car. Within the unlocking zone the car door can be opened by hand, so passengers at a floor can get out. Restrictors may be mechanical, using a hook on the car door that catches on a fixture in the hoistway except at landings, or electromechanical, using a solenoid released only in the door zone.

Restrictors must work with the rescue procedures. A trapped passenger in a car near a floor can be released by a mechanic who opens the hoistway door with the unlocking tool; the restrictor then allows the car door to be opened because the car is in the unlocking zone. Outside the zone, the car must first be moved to a floor by the procedure for that equipment. ELV-110 covered the rescue rules; the point here is that a restrictor that has been removed or disabled, because it caused nuisance problems, takes away the protection exactly when passengers are most tempted to use the door.

# Can the car door be opened from inside? Restrictor logic by car position
zone = 450           # unlocking zone above or below a landing, mm
landings = [0, 3600, 7200]     # landing positions, mm
for pos in (3550, 4200, 5400, 6900):
    nearest = min(landings, key=lambda f: abs(f - pos))
    off = pos - nearest
    if abs(off) <= zone:
        state = "in unlocking zone: car door may be opened by hand"
    else:
        state = "outside zone: restrictor limits opening"
    print(f"car at {pos:6.0f} mm ({off:+5.0f} from nearest floor): {state}")

car at   3550 mm (  -50 from nearest floor): in unlocking zone: car door may be opened by hand
car at   4200 mm ( +600 from nearest floor): outside zone: restrictor limits opening
car at   5400 mm (+1800 from nearest floor): outside zone: restrictor limits opening
car at   6900 mm ( -300 from nearest floor): in unlocking zone: car door may be opened by hand

Door bypass switches and jumpers

Faults in door circuits are among the most common reasons a car is shut down, and the temptation to jumper a lock to get a car moving is old. Jumpered door circuits have caused deaths of passengers and mechanics, because a jumper left in place lets the car run with a door open. Modern codes respond in two ways. Controllers on new and altered cars must have hoistway door and car door bypass switches, keyed or guarded switches in the controller that bypass the door circuits only on inspection or hoistway access operation, never on automatic, and that sound or show a warning while in use. And controllers check the door circuits for faults such as a door circuit that stays made when the doors are open, which detects a jumper or a welded contact and stops the car.

Northcrest's rule follows from this: on cars with bypass switches, use the bypass switch and nothing else; on older cars without them, any temporary jumper must be a red-tagged, logged jumper controlled under the branch's jumper procedure, applied only with the car on inspection and the affected doors protected, and removed and checked off before the car returns to service. Lena audits the jumper log monthly, and a missing jumper is a reason to stop and search the controller before anyone leaves.