Safety controls and lockouts

Wes called from the seniors' residence on a Monday morning: the kitchen's walk-in freezer had shut down overnight, the compressor was locked out, and the cook had moved the frozen stock to a reach-in. The freezer used an older semi-hermetic compressor with a mechanical oil pressure safety control, and the reset button on the control had popped out. The night cleaner had pushed it twice, and each time the compressor ran for about two minutes and stopped again. "Somebody wants to jumper it," Wes said, half joking. Raj did not laugh. "That control is the only thing standing between that compressor and a seized crankshaft," he said to Theo on the drive over. "We find out why it tripped. We don't make it stop tripping."

Safety controls protect people, equipment and buildings from conditions the operating controls cannot or should not handle: pressures that could burst components, loss of lubrication, frozen coils, loss of water flow, overheated motors, flooding from condensate and fire. They act whatever the operating controls are asking for, and many of them latch off until a person investigates. This lesson covers the common safety controls in HVAC-R equipment, how they are wired, how their resets and lockouts work and how to troubleshoot a tripped safety without defeating it.

The safety chain

In most equipment, the safety controls are wired in series, forming a safety chain or safety circuit, ahead of the compressor contactor coil or into a control board input. Every switch in the chain must be closed for the compressor to run. A typical refrigeration chain includes the operating control, a high-pressure control, a low-pressure control, an oil pressure safety on compressors with oil pumps, a motor protection module or internal overload, and sometimes a discharge temperature control. On packaged air conditioners and heat pumps, the board reads several of these as separate inputs and logs which one opened, which makes diagnosis faster.

The RAC-130 hopscotch method applies directly. With the chain energized and one meter lead on the common side, step the other lead through the chain. Voltage appears up to the open switch and disappears after it. Once you know which control is open, the real work begins: finding out why.

High-pressure controls

A high-pressure control opens the compressor circuit when the discharge or condensing pressure rises to its cut-out. It protects against a failed condenser fan, a dirty coil, a closed service valve, loss of condenser water, non-condensables or an overcharge, and it acts well before the pressure relief device, which is the last line of defence. Refrigeration safety codes, CSA B52 in Canada and ASHRAE 15 with the mechanical codes in the United States, require pressure-limiting devices on many systems and set rules for their settings and reset type; the cut-out is normally below the system's design or maximum working pressure on the nameplate, and below the relief valve setting. Many high-pressure controls are manual reset, so a technician must see that the system tripped before it can restart.

A high-pressure trip is almost always a symptom of heat not leaving the condenser. Check condenser airflow and cleanliness, fan operation and rotation, the water flow and temperature on water-cooled units, service valve positions and the refrigerant charge, as RAC-220 described. On units that trip only on hot afternoons, look at recirculation of discharge air, a fan motor that slows when hot and condenser coils packed with cottonwood fluff or grease.

Low-pressure safeties and freeze protection

A low-pressure safety protects against loss of charge, a frozen or blocked evaporator and operation in a vacuum, which can pull air and moisture into a system at any leak. On air conditioners, it also protects the evaporator from freezing: as the coil temperature falls below freezing, ice blocks the airflow, the suction pressure falls further and liquid can return to the compressor. Packaged equipment boards often treat the low-pressure switch as automatic reset with a short bypass time during start-up and defrost, and then lock out after several trips in a set period.

Air handlers and chillers have their own freeze protection. A freeze-stat, or low-limit thermostat, has a long averaging capillary strung across the face of a coil and shuts down the supply fan and closes the outdoor air damper if any part of its length senses a temperature near freezing, often about 2 to 4 °C (35 to 38 °F). Chillers have a low leaving water temperature cutout and a low refrigerant temperature or pressure cutout, set according to whether the loop is water or glycol, and a flow switch or differential pressure switch that proves water is flowing before the compressor can start. Losing flow through a chiller evaporator while the compressor runs can freeze and rupture the tubes in minutes, which is why flow proving is never bypassed.

• Flow switches: a paddle in the pipe or a thermal-dispersion sensor; must be installed in a straight run, the right paddle length for the pipe size.
• Differential pressure switches: sense the pressure drop across the evaporator, which rises with flow.
• Interlocks: auxiliary contacts on the pump starter prove the pump is running, but not that water is moving; a flow switch is still needed.

Oil pressure safety controls

Semi-hermetic and open reciprocating compressors and many screw compressors have an oil pump driven from the crankshaft. The pump's discharge pressure is above the crankcase pressure, and the difference, called the net oil pressure, is what forces oil to the bearings. An oil pressure safety control measures the net oil pressure, not the gauge reading at the pump, by comparing the pump outlet with the crankcase. Because the pump needs a short time to build pressure at start-up, and because oil can foam briefly, the control has a time delay, commonly in the range of about 90 to 120 seconds. If the net oil pressure stays below the control's setting for the whole delay, the control trips and locks out, usually with a manual reset.

Older mechanical oil safeties use a small heater and a bimetal: while net oil pressure is low, the heater is energized, and if it stays energized for the full delay, the bimetal opens the safety circuit. Electronic oil sensors screw into the pump and report to a module that does the timing. Because the heater type depends on the supply voltage, it will trip early or late if wired to the wrong voltage terminal. In either case, a tripped oil safety is a warning that the bearings were short of oil for well over a minute.

# How an oil pressure safety times out: the delay accumulates while net oil pressure is below the setting
SETTING = 70      # minimum net oil pressure, kPa (illustrative)
DELAY = 120              # seconds below the setting before the control trips

def oil_safety(samples, dt=5):
    below = 0
    for i, net in enumerate(samples):
        below = below + dt if net < SETTING else 0   # a mechanical heater cools if pressure recovers; reset here for simplicity
        if below >= DELAY:
            return f"trips at {(i + 1) * dt} s"
    return "does not trip"

normal = [0, 40, 120, 180, 200] + [210] * 40
foaming = [0, 20, 40, 50, 45, 60, 55, 50, 60, 65, 50, 55, 60, 45, 50, 60, 55, 50, 60, 55, 50, 60, 55, 50, 120, 200]
print("normal start:", oil_safety(normal))
print("start with refrigerant-diluted, foaming oil:", oil_safety(foaming))

normal start: does not trip
start with refrigerant-diluted, foaming oil: trips at 120 s

The simulated foaming start shows the pattern the residence's compressor was producing: oil pressure that rises, collapses and wobbles, never staying above the setting long enough to reset the delay. Foaming is caused by liquid refrigerant in the crankcase boiling off when the crankcase pressure drops at start-up. The causes to look for are refrigerant migration during the off cycle, floodback during running, a failed crankcase heater and an overfeeding expansion valve. Low oil level, a worn pump, a plugged oil pickup screen and a failed sensor also cause oil safety trips.

Motor protection

Hermetic and semi-hermetic compressor motors are protected by internal overloads, which are bimetal discs or thermostats in the windings, by external overloads in the starter, or by motor protection modules that read thermistor chains buried in the windings and sometimes in the discharge. Modules typically lock out the compressor when the thermistor resistance rises past a set value and reset when it cools, often with a time delay; some models also monitor phase loss and phase reversal, which matters for scrolls that are damaged by reverse rotation. Discharge temperature thermostats or sensors trip on very high discharge temperature, a sign of high compression ratio, high superheat, low charge or a failing compressor. RAC-130 covered checking overloads and windings; here the point is that any motor protection trip has a cause in the system, such as low voltage, high superheat, short cycling or poor ventilation, that must be found.

Building and life-safety interlocks

HVAC equipment also connects to building safety systems. Duct smoke detectors and fire alarm relays shut down air handlers to keep smoke from spreading; condensate overflow switches stop cooling before a pan overflows onto a ceiling; high static pressure limits protect ducts when dampers close; and gas-fired units have their own flame safeguard controls, limit switches, rollout switches and draft pressure switches. Technicians in this trade must recognize these inputs and know where they are wired, but servicing gas controls and flame safeguards requires the appropriate gas technician certificate in Ontario, issued under TSSA's rules, and fire alarm devices are serviced by qualified fire alarm technicians. Restoring a unit after a fire alarm shutdown is done through the building's fire alarm procedures, not by jumpering the relay.

Resets, lockouts and why you never jumper a safety

Controls reset in three ways. Automatic reset controls close again by themselves when the condition clears. Manual reset controls stay open until someone presses the reset. Software lockouts on boards and controllers count trips and, after a set number in a set period, enter a hard lockout that requires a power cycle or a reset command. Each method is chosen to match the risk. A technician may briefly jumper a switch to prove that it is the open device, but only with the equipment under direct observation, with gauges on, and never for a pressure, oil or flow safety while the compressor is running. A jumper left in place turns a protective control into a wire.

# A board's lockout logic: three trips of the same safety in 60 minutes cause a hard lockout (illustrative)
WINDOW = 60      # minutes
LIMIT = 3

def board(events):
    recent = []
    for t, name in events:
        recent = [x for x in recent if t - x < WINDOW]
        recent.append(t)
        if len(recent) >= LIMIT:
            return f"{name} trip at minute {t}: hard lockout ({len(recent)} trips in {WINDOW} min); manual reset required"
        print(f"{name} trip at minute {t}: soft lockout, automatic retry after delay ({len(recent)} in window)")
    return "running"

print(board([(12, "high pressure"), (95, "high pressure"), (118, "high pressure"), (140, "high pressure")]))

high pressure trip at minute 12: soft lockout, automatic retry after delay (1 in window)
high pressure trip at minute 95: soft lockout, automatic retry after delay (1 in window)
high pressure trip at minute 118: soft lockout, automatic retry after delay (2 in window)
high pressure trip at minute 140: hard lockout (3 trips in 60 min); manual reset required

Lockout logic is the board's way of saying that a problem is not going away by itself. A soft lockout followed by a successful restart hours later is easy to miss, which is why it is worth reading every board's fault history on arrival, before clearing anything.

Finding the cause at the residence

At the walk-in, Raj installed gauges on the suction and oil pump ports and had Theo watch a start. The oil gauge rose, then fell back and flickered, while the crankcase sight glass turned milky with foam. The net oil pressure never stayed above the control's setting for more than a few seconds. The crankcase heater was cold: its leads had been disconnected during a compressor valve plate repair the previous year and never reconnected. Overnight, with the condensing unit in a cold roof enclosure, refrigerant had migrated into the oil. Raj reconnected and tested the heater, let it run for several hours with the compressor locked off, then restarted. The oil pressure built smoothly to about 200 kPa (30 psi) net and stayed there. He reset the oil safety, recorded the event and recommended an oil analysis at the next maintenance visit. Theo added a line to the residence's equipment log: crankcase heater must be connected after any compressor work.