Relay logic and the safety circuit

On her second morning with Priya, Tamsin found Tillicum car 1 shut down at the fourth floor with its doors open and the car light on. The lobby attendant said it had stopped with a jolt. Priya did not open the controller first. She opened the car operating panel and looked at the emergency stop switch, then walked to the machine room and put her meter across the safety relay coil. "No voltage," she said. "So something in the string is open. Now we find out which one." Twenty minutes later they found it: the counterweight buffer switch in the pit had been knocked open by a cleaner's mop handle. Every elevator, relay or microprocessor, has the same chain of switches standing between the power supply and the machine, and this lesson is about that chain and the relay logic around it.

Relay logic in one page

ELV-210 covered how relays and contactors work: a coil that pulls in an armature when energized and a set of contacts that open or close with it. Relay logic builds decisions from those contacts. Contacts in series make an AND: the coil at the end of the line energizes only if every contact is closed. Contacts in parallel make an OR: any one closed contact energizes the coil. A normally closed contact makes a NOT: the coil is energized when the relay that owns the contact is not. A relay that holds itself in through one of its own contacts after a momentary push makes a memory, called a seal-in or latch, and that is how a relay controller remembers a call after the passenger lets go of the button.

Relay controllers are drawn as ladder diagrams, with two vertical supply lines and each circuit as a horizontal rung between them, contacts on the left and the coil on the right. Every coil has a name, usually a few letters, and every contact on the print carries the name of the coil that operates it. A contact marked U belongs to the up direction relay, wherever it appears on the print. Reading a relay controller is mostly the skill of following one name through every rung where its contacts appear.

The safety circuit

The safety circuit, often called the safety string, is a series of normally closed contacts, one on each device that must be in its safe state before the car may move. The circuit ends at a safety relay, or on modern cars at a safety input monitored by a certified safety board. Because the contacts are in series, the relay is energized only when every one of them is closed; open any one and the relay drops out, the drive and the brake lose power, and the brake sets. The devices are called electrical protective devices, and the code lists the ones each type of elevator must have. On a typical traction car, the string includes:

• The pit stop switch, and on deep pits a second stop switch near the pit ladder at the bottom landing.
• The car and counterweight buffer switches, where oil buffers are used, which prove each buffer is extended.
• The governor overspeed switch and, on many cars, a switch that opens if the governor rope goes slack or its tension sheave drops.
• The car safety switch, on the safety plank, which opens when the safety gear is applied.
• The final terminal stopping switches at the top and bottom of the hoistway, which open if the car travels past the normal terminal landings.
• The car top stop switch and the car operating panel's emergency stop switch, where one is fitted.
• The emergency exit contacts on any car top or side emergency exit.
• The compensation sheave switch on cars with tied-down compensation, and on many cars the machine's own switches, such as a brake or machine overspeed contact.
• Finally, the door circuit: the car door contact and the hoistway door interlocks, which prove every door is closed and the hoistway doors are locked.

The door contacts are often wired as a separate branch of the string, because the controller must allow the car to move a short distance with the doors open when it levels or relevels at a floor. That bypass is allowed only inside the door zone, only at low speed, and only through circuits the code sets strict rules for; Lesson 7 covers the door zone and Lesson 6 the electronic devices that now supervise it.

Why the string fails safe

The safety circuit is built so that the common failures leave the car stopped. A broken wire opens the string. A loose terminal opens the string. A blown fuse in the control supply drops the safety relay. A relay coil that burns open drops out. For the circuit to let the car move when it should not, a contact would have to stay closed when its device is in the unsafe state, or something would have to connect the two sides of an open device. That is why the codes treat the safety circuit's design in great detail, and why two failures are the ones a controls mechanic worries about: a contact that welds closed, and a jumper left in place.

A welded contact is a contact that has arced and fused so it no longer opens. If the contact on a safety relay that carries the brake or drive supply welds closed, opening the string would no longer stop the car. Codes since the 1980s and 1990s have required that the failure of a single relay, contactor or solid-state device, including a welded contact, must not let the car keep running or start again. Controllers meet this with redundancy and checking: two relays or contactors in series in the motor and brake circuits, so either one can stop the car, and a check at every start that both have dropped out since the last run. If one did not drop out, the controller refuses to start the next run and logs the fault. Tillicum car 1, built before these rules, has a single contactor in its generator field circuit, which is one of the items Ray lists for its eventual modernization.

# Redundancy and checking: two contactors in series, checked at every start
runs = [
    {"run": 1, "M1_dropped": True, "M2_dropped": True},
    {"run": 2, "M1_dropped": True, "M2_dropped": True},
    {"run": 3, "M1_dropped": True, "M2_dropped": False},   # M2 contact welded during run 2
    {"run": 4, "M1_dropped": True, "M2_dropped": False},
]
for r in runs:
    # before each start, both contactors must show they are open (auxiliary contacts)
    if r["M1_dropped"] and r["M2_dropped"]:
        print(f"run {r['run']}: both contactors proved open, start allowed")
    else:
        stuck = "M1" if not r["M1_dropped"] else "M2"
        print(f"run {r['run']}: {stuck} did not drop out, start blocked, fault logged")
        print("        the other contactor still opens the motor circuit if the string opens")
        break

run 1: both contactors proved open, start allowed
run 2: both contactors proved open, start allowed
run 3: M2 did not drop out, start blocked, fault logged
        the other contactor still opens the motor circuit if the string opens

The check works because each contactor has an auxiliary contact that tells the controller whether its main contacts are open. When M2 welds, the car is still safe during that run, because M1 can still open the motor circuit, and it is stopped from starting again until someone repairs M2. The same principle runs through modern safety boards, which test their own outputs on every run.

Jumpers

A jumper is a wire with clips used to bridge a contact. Mechanics use jumpers when they must move a car with a device open, for example to move a car with a damaged hoistway door contact to a floor where the door can be repaired. A jumper on a safety device is one of the most dangerous tools in the trade, because it removes the protection without leaving any sign at the device itself. Elevator accident reports include many cars that ran with a door interlock jumped out after the mechanic who placed it was called away.

Northcrest's rule, like most contractors', is that a jumper on a safety device is used only on inspection operation, only with the supervisor's knowledge, only with a tag on the controller and a note in the log, and only for as long as the job requires; every jumper is counted out of and back into a jumper kit, and the car does not go back in service until the count is complete. Recent code editions go further and require door bypass switches on the controller of new cars, so a mechanic who must move a car with a door contact open uses a labeled, keyed or covered switch that limits the car to inspection operation and sounds or shows a signal, instead of a jumper. On a microprocessor controller with a certified safety board, a jumper across a door circuit is often detected anyway, because the board checks that the door circuits open and close when they should.

Priya showed Tamsin the jumper kit in the Northcrest van: six jumpers, each numbered and with a red tag, and a laminated card listing the rules. "If you ever leave a site without counting these," she said, "you go back."

Finding an open device

When a car shuts down with the safety relay dropped, the mechanic's job is to find the open device quickly and safely. Ray's method on relay cars and Priya's on microprocessor cars start the same way: confirm the safety relay is out, confirm the control supply is present, then measure along the string. With the meter's common lead on the return side of the control supply, the voltage is present at every terminal up to the open device and absent after it. A mechanic can walk the string from one end, but on a long string with devices in the pit, on the car and in the machine space, it is faster to split it in half, check the middle point, and keep halving.

Many controllers make this easier. Relay controllers often have test points or terminal numbers at the junctions between groups of devices, such as after the pit devices, after the car devices and after the hoistway doors. Microprocessor controllers read the string at several points and show which section is open, and their fault logs record when and in which section it opened. At Tillicum, Priya checked three junction terminals in the machine room and knew the fault was in the pit before she opened the pit door.

# Halving the safety string to find the open device with the fewest readings
string = ["pit stop", "pit ladder stop", "car buffer", "cwt buffer", "governor",
          "car safety", "upper final", "lower final", "car top stop", "exit contact",
          "car door", "door lock 1", "door lock 2", "door lock 3", "door lock 4",
          "door lock 5", "door lock 6", "door lock 7", "door lock 8", "door lock 9",
          "door lock 10", "door lock 11"]
open_device = "cwt buffer"

lo, hi, readings = 0, len(string) - 1, 0
while lo < hi:
    mid = (lo + hi) // 2
    readings += 1
    # voltage present after device mid means the open device is further on
    if string.index(open_device) > mid:
        lo = mid + 1
    else:
        hi = mid
print(f"{len(string)} devices, open device found by halving after {readings} readings: {string[lo]}")
print(f"walking from the start would take up to {string.index(open_device) + 1} readings here,")
print(f"and up to {len(string)} if the open device were the last door lock")

22 devices, open device found by halving after 5 readings: cwt buffer
walking from the start would take up to 4 readings here,
and up to 22 if the open device were the last door lock

Five readings find one open device in twenty-two by halving, against up to twenty-two walking the string. In practice the mechanic also uses what the car tells them: a car that stopped with a jolt in mid-travel probably lost a device that can open while the car is moving, such as a buffer switch, governor switch or final limit, while a car that will not leave a floor with its doors closed points to the door circuit.

Inspection operation and the safety circuit

Inspection operation lets a mechanic run the car at slow speed from a station on the car top, in the car, in the machine space or, on many newer cars, in the pit. When inspection is switched on, the car stops answering calls, and it moves only while the mechanic holds a run button together with an up or down button. The safety circuit stays fully in force: inspection operation does not bypass any electrical protective device except, where the code allows, in tightly limited cases such as moving the car off a final limit with a separate switch. The car top inspection station must also have a stop switch, and the codes require that when inspection is selected at more than one station, the car cannot be run from any of them unless the stations agree, so a mechanic on the car top cannot be surprised by someone running the car from the machine room.