Safety PLCs and programmable electronic safety systems

For most of the history of elevators, the rule was simple: safety functions were done with switches and relays, and software was never trusted with them. A processor could decide which floor to go to, but whether the car was allowed to move at all was decided by contacts in series. That rule has changed. On Quayside car 2, the door zone, the leveling with doors open, the monitoring of the brake and parts of the inspection operation are supervised by a safety board that is itself a computer, with two processors checking each other. Priya spent a week of Tamsin's term on this board, because it changes how a mechanic must think about testing and repair. "On Tillicum, a safety function is a contact you can see," she said. "On Quayside, it is a function that someone proved, on paper and in a test lab, could be trusted to a software system. Our job is not to undo that proof."

Why software in safety functions

There are good reasons to let electronics do safety work. A relay contact can weld, and a mechanical switch can stick or be jumpered; an electronic system can test itself many times a second and detect faults that a relay circuit would never notice. Some functions, such as detecting unintended movement of a car away from a floor with its doors open, or supervising a car's speed near the terminal landings so that shorter buffers can be used, are far easier to do well with a processor that knows the car's position and speed than with switches. And as car tops, pits and machine spaces have filled with sensors, a safety system that reads them over a monitored serial link can replace dozens of conductors in the traveling cable.

The risk is that software can fail in ways that are hard to predict or test. A program can have a mistake that appears only in one unusual combination of conditions; a processor can fail partly rather than completely; electrical noise can corrupt a value. The answer the safety field has developed, in industry generally and in elevators specifically, is not to trust software less but to prove it more: to design, build, test and document safety-related electronic systems to a recognized standard, and to certify the result.

The standards

The general standard for safety-related electronic systems is IEC 61508, which defines four safety integrity levels, SIL 1 to SIL 4, each a band of how rarely the system may fail dangerously. Higher levels need more redundancy, more self-testing, more careful software development and more independent assessment. For lifts, ISO 22201-1, built on IEC 61508, sets out how programmable electronic systems in safety-related applications for lifts, known by the acronym PESSRAL, are designed and developed, and the European lift standards use the same approach.

ASME A17.1 and CSA B44 allow electrical protective devices and other safety functions to be performed by programmable electronic systems, provided the system is certified to the safety integrity level that the code requires for that function, and the code includes a table listing the required level for each function. Functions such as door bypass during leveling, car speed monitoring, unintended movement detection and the electronic replacement of a switch in the safety circuit each have a required level. The certification is done by an independent body against the standard, and the system must carry identification that ties it to the certificate. The maker's instructions then become part of what keeps the system safe: how it must be installed, which parts can be replaced, which settings a mechanic may change, and which tests must be done after any change.

How a certified safety board works

A typical safety board has two processing channels, often two processors of different types running different programs written from the same specification. Each channel reads its own copy of the safety inputs, such as the door zone sensors, the safety circuit at several points, the inspection station and the position and speed from separate sensors. Each decides independently whether the car may move, and each can open its own safety output. The outputs drive two contactors or a contactor and the drive's safe torque off input, so that either channel can stop the car. The channels compare their inputs and their decisions continuously. If they disagree beyond a short time, the board stops the car and records a discrepancy fault.

The board also tests itself. It switches its outputs briefly to check they can open, a test called a pulse test, so fast that the contactors do not react; it checks that inputs which should change during a run actually change, so a sensor stuck on, or a jumper across a door circuit, is detected; and it checks its own memory and timing. Most boards show their state with a small set of lamps and a code on the controller's display, and they keep their own fault record.

# Two-channel cross-check of the door zone sensors
tolerance_ms = 40      # how long the two channels may disagree before a fault
samples = [  # time in ms, channel A sees door zone, channel B sees door zone
    (0, False, False), (10, True, False), (20, True, True), (30, True, True),
    (200, True, True), (210, False, True), (220, False, True), (230, False, True),
    (240, False, True), (260, False, True), (270, False, False)]
start = None
for t, a, b in samples:
    if a != b:
        start = t if start is None else start
        if t - start > tolerance_ms:
            print(f"{t:4d} ms: channels disagree for {t - start} ms -> discrepancy fault, car stopped")
            break
    else:
        if start is not None:
            print(f"{t:4d} ms: channels agree again after {t - start} ms (within tolerance)")
        start = None
else:
    print("no discrepancy fault")

  20 ms: channels agree again after 10 ms (within tolerance)
 260 ms: channels disagree for 50 ms -> discrepancy fault, car stopped

On entry to the zone the sensors disagree for 10 ms, which is normal: no two sensors switch at exactly the same instant. On leaving, sensor B stays on for more than 40 ms after A has gone off, which is not normal, and the board stops the car. On a real car, the cause could be a misaligned sensor, a damaged magnet or a dirty tape, and the fault record shows which channel lagged. This is the same kind of fault Tamsin will chase in the capstone.

What a mechanic may and may not do

A certified system is safe only as long as it stays the way it was certified. That puts firm limits on what a mechanic does with it. Priya's list for Quayside, drawn from the maker's instructions, is typical.

• Never jumper, bypass or force a safety board input or output. If a function must be bypassed to move the car, use the bypass the maker provides, such as the door bypass switches, under the conditions they allow.
• Replace safety boards and safety sensors only with the parts the maker lists, and only by the procedure the maker gives. Do not swap a safety sensor for an ordinary sensor of the same shape.
• Change only the settings the maker allows a mechanic to change. Safety-related parameters are usually locked with a separate password, and many cannot be changed in the field at all.
• After any change to the safety system, including replacing a sensor or moving a magnet on the landing system, do the tests the maker specifies before returning the car to service, and record them.
• Keep the identification on the board readable, and record the board's part number, revision and software version in the car's record.

Tamsin asked what happens if the maker goes out of business. Priya said it was a fair question and part of why owners now ask for documentation and spare parts commitments when they buy a controller; the safety board cannot be repaired at the component level by a contractor, and an obsolete one means a controller replacement.

Testing safety functions

Periodic tests in the code's maintenance part apply to electronic safety functions as they do to switches: the function must be shown to work, not just assumed. On a relay car, testing a buffer switch means opening it and seeing the car stop. On Quayside, testing unintended movement detection means following the maker's procedure, which typically uses the service tool to command a small movement with the doors open and confirms that the board detects it, sets the brake and stops the car within the allowed distance. Testing a door zone sensor means confirming each channel sees the zone at each floor and that a single failed sensor is detected. These tests are often built into the service tool as guided routines that record their results.

# Unintended movement test record: was the car stopped within the limit?
limit = 48            # allowed movement from the floor with the doors open
results = [("floor 1, empty car, up", 7), ("floor 1, empty car, down", 8),
           ("floor 30, test weights, down", 13), ("floor 30, test weights, up", 6)]
for name, moved in results:
    verdict = "pass" if moved <= limit else "FAIL, investigate brake and detection"
    print(f"{name:<30} stopped after {moved:5.0f} in -> {verdict}")

floor 1, empty car, up         stopped after     7 in -> pass
floor 1, empty car, down       stopped after     8 in -> pass
floor 30, test weights, down   stopped after    13 in -> pass
floor 30, test weights, up     stopped after     6 in -> pass

The figure used here for the limit follows the code's rule for stopping a car that moves away from a floor with its doors open; the maker's procedure states the limit and the test conditions for each car. The car is stopped well within the limit in every case, and the heavier test in the down direction moves farthest, as expected.

Safety boards on modernized cars

When an older car like Tillicum car 1 is modernized, the new controller usually brings a certified safety board with it, and the car gains functions it never had: brake monitoring, unintended movement protection and electronic supervision of the door zone. Those functions need new sensors on the car and in the hoistway, and sometimes a second brake or an emergency brake on the rope. A modernization plan must include them, and ELV-430 returns to this in detail. For now, Priya wanted Tamsin to understand one thing: a modernized car is a different kind of system, and the habits that work on relay cars, such as a quick jumper to move a car, do not just break the rules on a safety board car; the board will often detect them and lock the car out.