Elevator recall and shunt trip interfaces

Riverlight Tower's elevator contractor is replacing the controllers on all four cars, and the fire alarm interface has to be rewired to the new controllers. Joel Haddad, the elevator mechanic, meets Sasha in the machine room. 'You give me three dry contacts and a supervised shunt trip circuit,' he says, 'and I'll make the cars do what the code says. The trouble starts when the contacts don't match what my controller expects.' The elevator program covers firefighters' emergency operation from the elevator side, including Phase I recall and Phase II in-car operation. This lesson covers the fire alarm side: which detectors start recall, what signals the fire alarm sends, how shunt trip works, and how the interface is wired and tested.

Why elevators are recalled

In a fire, an elevator can carry passengers to the fire floor, fill with smoke in a hoistway, or lose power with people inside. Elevator codes therefore require cars to return automatically to a safe landing when a fire is detected in an elevator lobby, hoistway or machine room, and then to stay out of normal service so that firefighters can use them under their own control. The elevator controller does the recall; the fire alarm system tells it when, and to which landing.

Two landings matter. The designated level is normally the main entrance floor, where firefighters arrive. The alternate level is another floor, used when the fire is detected at the designated level itself, so that cars aren't sent to the fire. A third signal tells the controller that the fire is in the hoistway or machine room, which makes the firefighters' hat symbol flash in the cars as a warning that the elevator itself may be affected.

Which detector sends which signal

The elevator code, CSA B44, and the fire alarm standards set the rules, and the building's sequence of operation shows how they apply. In general:

• A smoke detector in any elevator lobby other than the designated level, or in the machine room or hoistway where the code calls for it, sends recall to the designated level.
• A smoke detector in the designated level lobby sends recall to the alternate level.
• A detector in the machine room, the hoistway or a control space also sends the flashing hat signal.
• Waterflow and manual station signals do not normally start recall, unless the code or the authority requires a particular arrangement.

The detectors used for recall are the devices the code requires for that purpose, and they must start recall even when the rest of the fire alarm system is a manual system. Where the environment in a lobby or machine room is unsuitable for smoke detectors, the code allows other types of detection.

# Recall logic from the detectors' locations (illustrative sequence)
designated = 1
def recall(location, floor=None):
    out = set()
    if location == "lobby":
        out.add("recall alternate" if floor == designated else "recall designated")
    if location in ("machine room", "hoistway"):
        out |= {"recall designated", "flash hat"}
    return sorted(out)
for loc, fl in [("lobby", 3), ("lobby", 1), ("machine room", None), ("hoistway", None)]:
    print(f"{loc:13s} {'floor ' + str(fl) if fl else '':9s} -> {', '.join(recall(loc, fl))}")

lobby         floor 3   -> recall designated
lobby         floor 1   -> recall alternate
machine room            -> flash hat, recall designated
hoistway                -> flash hat, recall designated

Real designs add details: a machine room at the designated level may send recall to the alternate level, and where several elevator groups share a lobby, each group's recall signals must reach its own controller. The sequence of operation for each building is the authority for the test.

Shunt trip

Where sprinklers protect an elevator machine room or hoistway, water from a sprinkler can make the car's brakes and controls behave unpredictably. The codes therefore require the elevator's main power to be disconnected automatically before water is discharged. This is done by a shunt trip: a coil in the elevator's main disconnect that opens it when energized, triggered by the fire alarm system.

The usual arrangement uses heat detectors placed next to each sprinkler in the machine room or hoistway, with a lower temperature rating and a faster response than the sprinkler, so that the heat detector operates and trips the power before the sprinkler opens. Smoke detectors are not used to trip elevator power. The circuit that operates the shunt trip, and its control power, are supervised so that a fault is reported. Canadian practice varies with the adopted elevator code and the authority, and many Canadian buildings avoid sprinklers in hoistways where the codes allow; the sequence of operation for each building says what applies.

# Heat detector placement and rating for shunt trip (illustrative values)
sprinklers = [("machine room S1", 0.4, 57, 68), ("machine room S2", 0.9, 57, 68), ("hoistway top S3", 0.5, 74, 68)]
max_dist = 0.61
for name, dist, det_rating, spr_rating in sprinklers:
    ok_dist = dist <= max_dist
    ok_rating = det_rating < spr_rating
    print(f"{name:16s} {dist:4.1f} m from sprinkler: {'ok' if ok_dist else 'too far'}   detector {det_rating} vs sprinkler {spr_rating} C: {'ok' if ok_rating else 'detector must be rated lower'}")

machine room S1   0.4 m from sprinkler: ok   detector 57 vs sprinkler 68 C: ok
machine room S2   0.9 m from sprinkler: too far   detector 57 vs sprinkler 68 C: ok
hoistway top S3   0.5 m from sprinkler: ok   detector 74 vs sprinkler 68 C: detector must be rated lower

Two of the three sprinklers in the example fail a check. S2's heat detector is too far from it, and S3's detector at the top of the hoistway is rated higher than the sprinkler beside it, so the sprinkler could open first. Both are corrected before the interface is accepted.

Wiring the interface

The fire alarm system connects to the elevator controller through relay contacts, usually dry contacts that the controller monitors. The rules that apply to any emergency control function apply here:

• The relay is listed for the purpose and is located close to the equipment it controls, commonly within about a metre of the elevator controller, so that the wiring between them is short and protected.
• The wiring from the fire alarm system to the relay is supervised, so that an open or short is reported.
• The relay contact must be rated for the voltage and current it switches. A dry contact into an elevator controller input carries very little current, but a contact that switches a shunt trip coil may carry several amperes at line voltage, and must be rated for it.
• The signals are labelled at both ends, and the elevator mechanic and the fire alarm technician agree which contact means what before anything is connected.

# Is each relay contact rated for its load? (ratings and loads illustrative)
# (name, contact rating: kind, volts, amps), (load: kind, volts, amps)
relays = [("recall designated", ("DC", 24, 2.0), ("DC", 24, 0.01)),
          ("recall alternate", ("DC", 24, 2.0), ("DC", 24, 0.01)),
          ("flash hat", ("DC", 24, 2.0), ("DC", 24, 0.01)),
          ("shunt trip", ("DC", 24, 2.0), ("AC", 120, 4.5))]
for name, (rk, rv, ra), (lk, lv, la) in relays:
    ok = rk == lk and lv <= rv and la <= ra
    print(f"{name:18s} contact {rv} V{rk} {ra} A, load {lv} V{lk} {la} A: {'ok' if ok else 'NOT RATED - use a relay listed for the load'}")

recall designated  contact 24 VDC 2.0 A, load 24 VDC 0.01 A: ok
recall alternate   contact 24 VDC 2.0 A, load 24 VDC 0.01 A: ok
flash hat          contact 24 VDC 2.0 A, load 24 VDC 0.01 A: ok
shunt trip         contact 24 VDC 2.0 A, load 120 VAC 4.5 A: NOT RATED - use a relay listed for the load

The shunt trip relay in the example is rated for low-voltage DC and is being asked to switch a line-voltage coil drawing several amperes. It may work a few times and then weld or burn its contacts. The fix is a relay listed and rated for the shunt trip coil, mounted near the elevator disconnect.

Testing with the elevator mechanic

Elevator recall testing is a joint job. The fire alarm technician operates each detector that starts recall, and the elevator mechanic confirms what each car does. For each detector, the test confirms:

• the correct recall signal is sent, to the designated or alternate level as the location requires;
• every car in the group responds, returns to the right landing, opens its doors and stays out of normal service;
• the hat flashes when the detector is in the machine room or hoistway;
• the cars are restored by the mechanic before the next test.

Shunt trip is tested in two stages. The fire alarm side is tested by confirming the heat detector operates the relay and that the supervision of the circuit and its control power reports faults. The full trip, which removes power from the elevator, is done only when the mechanic and the owner agree, with no passengers in the cars, because it can strand a car between floors.

# Record of a recall test (Riverlight, four cars, illustrative)
tests = [("lobby floor 7", "designated", ["1", "1", "1", "1"], False),
         ("lobby floor 1", "alternate", ["2", "2", "2", "1"], False),
         ("machine room", "designated", ["1", "1", "1", "1"], True)]
for det, expect, landings, hat in tests:
    want = "1" if expect == "designated" else "2"
    wrong = [f"car {k + 1}" for k, f in enumerate(landings) if f != want]
    print(f"{det:14s} expect {expect:10s} {'all cars ok' if not wrong else 'wrong landing: ' + ', '.join(wrong)}{'  hat flashing' if hat else ''}")

lobby floor 7  expect designated all cars ok
lobby floor 1  expect alternate  wrong landing: car 4
machine room   expect designated all cars ok  hat flashing

At Riverlight, car 4 goes to the designated level when the first-floor lobby detector operates. It should go to the alternate level. The new controller's input for alternate recall on car 4 was wired to the designated-level terminal. Joel corrects the wiring on his side, and the test is repeated for every car.

Common interface faults

Elevator interfaces fail in a few predictable ways, and most of them appear after a change on one side or the other:

• Swapped or misidentified contacts after an elevator modernization, so a car goes to the wrong landing.
• A recall detector replaced with a different model or programmed as an ordinary alarm point without its recall output.
• A new elevator lobby created during a renovation without a recall detector, or with a detector on the wrong recall group.
• Shunt trip control power taken from a switched source, so its supervision troubles whenever the elevator is idle.
• Heat detectors for shunt trip replaced with a higher rating than the sprinkler beside them.

The cure is the same in every case: work from the sequence of operation, test every recall input with the mechanic after any change on either side, and record the results in both the fire alarm and the elevator documents.

Elevators used for evacuation

Some newer tall buildings use elevators to help evacuate occupants or to give firefighters protected access, with hoistways and lobbies designed to stay usable longer in a fire. These designs depend on more interface signals: lobby status, smoke in specific areas, water in the hoistway, and messages to occupants in the lobbies. The design documents for such a building list every signal, and the testing follows them; the principles in this lesson still apply, with more of them.

# Interface signal list for one elevator group, checked against the controller's inputs (illustrative)
fire_alarm_outputs = {"recall designated", "recall alternate", "flash hat", "shunt trip"}
controller_inputs = {"recall designated", "recall alternate", "flash hat", "lobby status"}
print("sent but not wired at controller:", sorted(fire_alarm_outputs - controller_inputs - {"shunt trip"}) or "none")
print("expected by controller but not sent:", sorted(controller_inputs - fire_alarm_outputs) or "none")
print("shunt trip goes to the main disconnect, not the controller")

sent but not wired at controller: none
expected by controller but not sent: ['lobby status']
shunt trip goes to the main disconnect, not the controller