NAVY SHIPBOARD CARGO AND WEAPONS ELEVATOR CONTROLLER AND SENSOR--ETC(U)

DEC 81 G 0 THOMAS
UNCLASSIFIED NRL-84NL

IIEEEEEIIEEE
EEEEEEEEEEEEEE
EEEEEEIIIIIIIE
IEIIEEEIIIEEE
EIIE-EEIIEIIEE
EEEEEIhEIhEIIE
 3.

1.25
~fl~ 2.2
N1111L
I1 1II, L 6

NVIONL
o WWIAil
 ~LE,_EL /
NRL Report 8488

ctl Navy Shipboard Cargo and Weapons Elevator

Controller and Sensor Subsystem Problem Analysis
G. 0. THOMAS
Special Applications Group
Marine Technology Division

DTIC
ELECTE
December 24, 1981 SFEB 3 18

NAVAL RESEARCH LABORATORY

Washington, D.C.

Approved for public release, distribution unlimited.

L •
 r
SECURITY CLASSIFICATION OF 'TiS PAG E fW". Oata Entered)
PAGE READ INSTRUCTIONS
REPORT DOCUMENTATION BEFORE COMPLETING FORM
1. REPORT NUMGER j2. GOVT ACCESSION NO. I. RECIPIENT'S CATA.OG NUMBER

NRL Report 8488 A7-V!o___________

4. TITLE (and Sibtltle) S. TYPE OF REPORT 6 PERIOo COVERED
NAVY SHIPBOARD CARGO AND WEAPONS ELEVATOR Final report on one phase of the
CONTROLLER AND SENSOR SUBSYSTEM problem. (June 1979 - March 1980)
PROBLEM ANALYSIS 6. PERFORMING ORG4.REPORT Nulbea

7. AUTNOR(e) S. CONTRACT OR GRANT NUMdRl(.)

Geoffrey 0. Thomas

S. PERFORMING ORGANIZATION NAME AND ADDRESS 10. PROGRAM ELEMENT. PROJECT. TASK
AREA & WORK UNIT NUMUERS

Naval Research Laboratory Element 63705N

Washington, DC 20375 Task 15623 58-0254-0-1
/it '
II. CONTROLLING OFFICE NAME AND ADDRESS 12. REPORT DATE
Naval Sea Systems Command (Code 5142) December 24, 1981
Washington, DC 20362 13. NUMGER OF PAGES
147
14. MONITORING AGENCY NAME A ADORESS(II dllferen fron C01tIWMlnd Office) 15. SECURITY CLASS. (of thie report)
UNCLASSIFIED
15. OECLASS#FICATION/OOWNGRADING
SCHEDULE

I6. oSTRiRUTiON STATEMENT (of thle RePOrt)

Approved for public release; distribution unlimited.

I. DISTRISUTION STATEMENT (of the obstracI entered In Block 20. It diflrlent freat Report)

l0, SUPPLEMENTARY NOTES

It. KEY WORDS (ColImng on reversee ade if neceeeay end Idletfy by block nufbker)

Elevator controllers Semiconductor logic Explosion proofing

Elevator sensors Programmable controllers Intrinsic safety
Elevator controller components Reliability
Relay logic Maintainability
Static logic Supportability --

20. A*S . MACT (Contlne an reoel'Re sidp necessaey mad Ideritity by block nmber)
report documents 94asLL £view±L41 the Navy shipboard elevator controller and sensor
subsystems research, development, test and evaluation plan. The Navy shipboard elevator develop-
ment program was inaugurated following numerous problems experienced by the fleet on cargo/weap-
ons elevators installed in underway replenishment ships. Many elevator controller styles were in
service with systems and components produced by numerous manufacturers.--.Vndors were often
not in business, not in the same product line, or not producing older models any lo .,rReplace-
ment components were frequently procured from sole source suppliers at high cost with attendant
(Continu. )
D O , 1473 EITION o I Nov ss is OssoLETE
S/N 0102-014- 6601 SE[CURITY CLASIICATION OFf THIS PDAGE (lUle Doe. Entered)
SEC l.A V CLASSIFICATION Of THIS PAGI Ot.ate .,)

20. AlSrRACT "Cohfinuod)

long delays in delivery. Controller sensors, which include limit switches and interlocks,
were subject to the same problems of variety and obsolescence as the control systems. The
weapons elevator RDT&E program was set up to address and attempt to correct this problem
area. The review phase of the program addressed by the present report evaluates the state of the
art of elevator controllers and sensors existing and at conceptual design levels. The review
includes Navy and commercial marine freight and passenger elevators and records discussions made
at manufacturer's plants and during visits to U.S. Navy ships. Evaluation criteria used in rating
alternatives included maintainability, long-term availability, multiple sources of components,
reliability, maintenance and operator training requirements, human-interface and trouble shooting,
initial cost, the effects of injecting new technology through overhauls during the ship life, fail-
safe operation, and standardization. The conclusion of the review was that elevator manufact-
urers in general have motives in design and construction of elevator controller/sensor packages
that sometimes run contrary to naval elevator requirements. Often early obsolescence is designed
into the product .Technologies are used which require high skill levels for servicing which can
be o2wi
nly by the manufacturer. Patented or proprietary circuits or manufacturing methods
are used that limit flexibility between sources for replacement components. Controllers were
considered using relay logic, standard logic and programmable microprocessors. The conclusion
is reached that further design studies should concentrate on controllers using solid-state
relay logic. Sensors considered included optical, eddy-current, variable reluctance, Hall-effect,
and other magnetics. The conclusion is reached that sensors that will best withstand the hazards
of shipboard use including painting, electromagnetic interference, physical abuse, marine
environment, and operation in explosive atmospheres should use d-c magnetic flux as the physical
property to be detected. The review also includes an analysis of the requirement for explosion-
proofing of elevator controller/sensor electrical circuits. The recommendation is made that all
circuits entering hazardous areas such as those that may be subject to the accidental discharge
of aviation gasoline or used for the stowage of hypargolic fueled missiles, should first pass
through intrinsic safety barriers limiting electric current and voltage to safe levels based upon the
particular hazard being designed against. A Military Standard on intrinsic safety electronics does
not yet exist and it is recommended that this standard be completed external to this program.

sgur9CUIY CLASSIFICATION OF ?WIS PAOEftem Dote CRIOMO

ii

*1
A
v CONTENTS

BACKGROUND ....................................................................................... 1

INTRODUCTION ........................................................................................ 2
SUMMARY OF RESULTS.............................................................................. 2
SPECIFICATION REQUIREMENTS................................................................... 3

TRAINING REQUIREMENTS ......................................................................... 3

EXISTING SHIPBOARD CONTROLLERS AND SENSORS......................................... 6

CONTROLLER PHILOSOPHY......................................................................... 32
POTENTIAL SHIPBOARD CONTROLLERS......................................................... 53

SENSOR PHILOSOPHY................................................................................. 63
POTENTIAL SHIPBOARD SENSORS................................................................. 70
PRESENT AND FUTURE REQUIREMENTS FOR SHIPBOARD ELEVATOR
ELECTRICAL CIRCUITS IN HAZARDOUS ENVIRONMENTS................................... 86
INTRINSICALLY SAFE ELECTRICAL CIRCUITS.................................................. 87
DISCUSSION AND RECOMMENDATIONS ......................................................... 93

CONCLUSIONS ....................................................................................... 109

REFERENCES ........................................................................................... 109
APPENDIX A-Abbreviated List of Organizations.
Ships and Personnel Contacted ......................................................................... 112
APPENDIX B-Key Provisions of Military Specifications and Standards .......................... 114
APPENDIX C-Extract from MIL-HDBK-217C Military Standardization Handbook
Reliability Prediction of Electronic Equipment ........................................................ 120

APPENDIX D-Abstract of Building Specification Relating to Elevator

Controllers and Sensors USS AMERICA (CVA.66)...............I................................... 128
APPENDIX E-Abstracts from Notes by Elevator Maintenance Personnel
on USS NIMITZ ....................................................................................... 131
 APPENDIX F-Weapons Elevator Inspection-General Comments by Elevator
Maintenance Personnel on the USS NIMITZ.......................................................... 134
APPENDIX G-Inputs, Functions and Outputs of the PDP-14 Logic Controller................. 135

APPENDIX H-Control and Control Systems Manufacturers........................................ 142

APPENDIX I -Sensor and Sensor Component Manufacturers...................................... 143

Accession For
NTTS c&
DTI.2 TAB

FDA vt i
~Ion/
A tjjUty Codes
Aw and/or
DI Lt Pclal

COPY iv

- ES
 NAVY SHIPBOARD CARGO AND WEAPONS ELEVATOR CONTROLLER
AND SENSOR SUBSYSTEM PROBLEM ANALYSIS
BACKGROUND

Navy shipboard cargo and weapons elevator controller and sensor subsystems are critical areas
which have attracted considerable attention due to numerous problems of fleet maintenance support.
In 1973 a conference was convened at the Naval Sea Systems Command Headquarters to discuss
casualty reports on various elevators in underway replenishment ships.

Elevator controller systems now in use on Navy ships are of many different designs and vintages,
arnd are supplied by a variety of manufacturers. Some of these control systems are obsolete in terms of
vendors, current pf iduct lines, and replacement components. Replacement parts are procured from
sole source suppliers at high cost with attendant long delays in delivery. There is little or no Navy con-
trol of quality and no standardization or interchangeability among manufacturers.

This large variety of control systems and the apparent overcomplexity of some designs have
resulted in poor performance in terms of parts support and documentation, and in training maintenance
and operational personnel.

Closely related to the elevator control systems are the "sensors." These devices are the limit
switches and interlocks of either mechanical contactor or static proximity types that sense such func-
tions as whether doors or hatches have been closed, whether levels have been reached, or whether
automatic platform-locking bars are engaged. The second part of the sensor is the actuation device
used to actuate the switch. Variety and obsolescence are major problems in sensors just as they are in
the control system. Malfunctions of sensors are a heavy contributor to the casualty rate of some ship-
board elevators.
In 1977 a second conference convened at the Naval Sea Systems Command revealed that,
although much progress had been made, many of the problems remained. In order to take a fresh look
at the issues, the Naval Sea Systems Command, in 1979, developed a cargo and weapons elevator sys-
tems research, development, testing and evaluation program plan. One task under the plan addressed
the controller and sensor subsystems. The present report, addressing the subject of problem analysis, is
the first of a series that will eventually cover design studies, hardware specification, prototype fabrica-
tion, prototype shore testing, and shipboard testing.

Development of the RDT&E plan in controller and sensor subsystems benefited greatly from an
ad hoc study performed by R. Cox of the Naval Research Laboratory. Ill]. This study, which was
funded by the Naval Sea Systems Command (PERA CV) at Puget Sound Naval Shipyard, addressed the
subject of controllers and sensors used in the Improved Weapons Handling System elevators aboard air-
craft carriers CV 59 through CV 64. It was determined that a controller based on electromechanical
relays rated highest against practically all criteria standards. It did not rate highest in regard to failsafe
uperation, but had a respectable rating. The unexpectedly high rating in regard to reliability was due to
the light usage factor of weapons elevators. Relay controllers, on the other hand, have been demon-
strated to be highly maintainable by assigned maintenance personnel. One disadvantage of electro-
mechanical relays is in the area of underwater shock. While relays can readily be designed to function

Manuscript submitted on March 26. 1931.

 G.O. THOMAS

properly following a shock wave, most relays have unbalanced mass contactors that will change state as
the shockwave passes. Controllers that require manual intervention following the passage of a shock
wave are, however, presently accepted in construction specifications so long as fail-safe provisions
apply.

INTRODUCTION

The objectives of the task of which this report represents Phase I are to bring fleet-installed eleva-
tors to a more acceptable level of performance and effectiveness through the development of standard
Navy elevator control systems technology and to produce guidelines for acceptable practices in the
design, selection, and application of sensors to be used with the control system. The two elements of
controller and sensor are combined for the purpose of this development due to the influence each part
has on the design and performance of the other. It is the objective to address cargo and weapons eleva-
tors on all classes of U.S. Navy ships. The task's near-term objective will be to improve the 667 eleva-
tors presently installed in operational ships. Far-term objectives afford a development of guidance on
major conversions involving new or greatly modified elevators and for new contruction ships. It was
determined that the review phase of this work covered by this report should include a study of control
and sensor systems and devices in use in Navy and commercial or industrial applications for elevators,
conveyors, hoisting machinery, and similar systems. Coverage of the complete range of technology
sophistication from basic relay logic to reprogrammable micro-processor systems was attempted. The
range of sensors examined included mechanical limit switches, fiber optics, light and infra-red emitting
diodes, magnetic reeds, Hall-effect, variable reluctance, eddy current and other proximity switches. A
ranking of the systems, sensors, and components was made that appeared most suitable for elevators
and conclusions were reached for entering the second phase of the development, namely the design
study period.

The investigation is an attempt to review the state of the art of elevator controllers and sensors
both at existing and concept design levels. The review includes marine freight and passenger elevators.
Manually controlled man-riding elevators were also considered versus automatic dispatched type eleva-
tors. A special study conducted along with the controller and sensor work involved the analysis of the
requirement for explosion proofing elevator electronic circuits on ships which store aviation gasoline.
An abbreviated list of organizations, ships, and personnel contacted in connection with 'he survey is
given in Appendix A.

SUMMARY OF RESULTS

The review phase of the program addressed by the present report evaluates the state of the art of
elevator controllers and sensors existing and at conceptual design levels. The review includes Navy and
commercial marine freight and passenger elevators and records discussions made at manufacturers'
plants and during visits to US Navy ships. Evaluation criteria used in rating alternatives included main-
tainability. long-term availability, multiple sources of components, reliability, maintenance and operator
training requirements, human-interface and trouble shooting, initial cost, the effects of injecting new
technology through overhauls during the ship life, failsafe operation, and standardization. The conclu-
sion of the review was that elevator manufacturers in general have motives in design and construction
of elevator controller/ sensor packages which sometimes run contrary to naval elevator requirments.
Often early obsolescence is designed into the product. Technologies are used which require high skill
levels for servicing which can be provided only by the manufacturer. Patented or proprietary circuits or
manufacturing methods are often used which limit flexibility between sources for replacement com-
ponents. Controllers were considered using relay logic, standard logic and programmable microproces-
sors. The conclusion is reached that further design studies should concentrate on controllers using

2
 NRL REPORT 8488

solid-state relay logic. Sensors considered included optical, eddy-current, variable reluctance, Hall-
effect, and other magnetics. The conclusion is reached that sensors which will best withstand the
hazards of shipboard use including painting, electromagnetic interference, physical abuse, marine
environment and operation in explosive atmospheres, should use d-c magnetic flux as the physical pro-
perty to be detected. The review also includes an analysis of the requirment for explosion-proofing of
elevator controller/sensor electrical circuits. The recommendation is made that all circuits entering
hazardous areas such as those which may be subject to the accidental discharge of aviation gasoline or
used for the stowage of hypergolic fueled missiles, should first pass through intrinsic safety barriers lim-
iting electric current and voltage to safe levels based upon the particular hazard being designed against.
A Military Standard on intrinsic safety electronics does not yet exist, and it is recommended that a stan-
dard be completed external to this program.

SPECIFICATION REQUIREMENTS

Weapons elevator controller/ sensor systems are procured to a variety of military specifications and
standards. A listing of the most significant of these is given in Table 1. Since it will be necessary to
refer back to these documents which form boundary values to the problem, a summary of key provi-
sions of articles in the most significant specifications is given in Appendix B.

Reliability calculations in this report are based on the parts-count method described in Military
Standardization Handbook MIL-H-DBK-217C. An extract from this handbook describing the parts-
count reliability procedure is included as Appendix C. The parts-count method was regarded as most
applicable for calculating reliability both in the early stages of elevator controller design and for qualita-
tive evaluation of existing controllers.

Elevator specifications were reviewed for Navy auxiliary ships AD40, AD4I. AE2I. AE26, and
AOE3.

It was found that platform speeds varied between 18 rn/mmn (60 ft/mmn) and 45 rn/mmn (150
ft/mmn). Platform working loads ranged between 3600 and 5400 kg (8 000 and 12 000 Ib). All eleva-
tors were two-speed with levelling speed equal to 1/6 full speed. Some elevators were automatic "sencr
only while others included a "calr feature.

One specification included a continuous repetition duty cycle with full load of not less than 40
round trips per hour between the main deck and the lowest terminal stopping 24 seconds at each end of
travel. Total lifetime endurance was not mentioned.

Proximity and limit switches were required to have a sensing range from 0.3 to 1.25 cm (1/8 in.
to 1/2 in.) from the face of the sensing plate and on-off hysteresis of less than 0.3 cm. Repeatability
should be better than :±0.8 mm (±r 1/32 in.).

Since elevator controllers on aricraft carriers are so important to this review, an abstract was made
and is presented as Appendix 0 of the elevator controller section of a modification specification for the
USS AMERICA (CVA-66). Reference to this specification summary will show the problem as
presented to the elevator controller contractors.

TRAINING REQUIREMENTS

Guidelines for this study directed that the maintenance level of training for elevator controllers
and sensors should be directed at Electricians Mate ratings 2 and 3 (EM2 and EIM3). Certain of the
* building specifications for shipboard elevators also specify that planned maintenance and repair person-

1
nel ability level should be that of Electricians Mate third class. (See Appendix D.) Duties of this rate

are described in the Navy Enlisted Manpower and Personnel Classification Manual [2).

3
 G.O. THOMAS

Table I - Military Specifications, Standards and Handbooks

Used for Weapons Elevator Controller/Sensor Procurement
Spec/Std # Title
MIL-C-915 Cable and Cord, Electrical, for Shipboard Use-- General Spec. for

MIL-C-2212E (SHIPS) Controllers, Electric Motor, AC or DC and Associated

Switching Devices, Naval Shipboard

MIL-E-16400G (Navy) Electronic, Interior Communication, and Navigation

Equipment Naval Ship and Shore

MIL-E-17807B (SH) Elevator, Weapon and Cargo, Electromechanical (Shipboard)

MIL-H-46855A Human Engineering Requirements for Military Systems,

Equipment and Facilities

MIL-M.28787 Modules, Electronic. Standard Electronic Modules Program--

General Specification for

MIL-M-38510 Microcircuits-General Specification for

MIL-N-28787A Standard Electronic Modules Program--General Specification for

MIL-R-19523A (SHIPS) Relays, Control, Naval Shipboard

MIL-R-28750A Relay, Solid State--General Specification for

MIL-S-901 Shock Tests (High-Impact) Shipboard Machinery, Equipment

and Systems-- Requirements for

MIL-STD-167-1 (SHIPS) Mechanical Vibrations of Shipboard Equipment Type I

Environmental

MIL-STD-756A Reliability Prediction

MIL-STD-1 130A Connections. Electrical, Solderless Wrap

MIL-STD-1346A Relays Selection and Application

MIL-STD-1378D Requirements for Employing Standard Electronic Modules

MIL-STD-1389A Design Requirements for Standard Electronic Modules

MIL-STD-1665 Test Equipment for the Standard Electronic Modules

Program

MIL-HDBK-217C Military Standardization Handbook Reliability

Prediction of Electronic Equipment

MIL-HDBK-246 Program Managers Guide for the Standard Electronic

Modules Program

* -A ~ i,.
 NRL REPORT 8488

Detailed training requirements for EM2 and EM3 are given in the Electricians Mate Rate Training
Manual (31.

Electricians Mates 2 and 3 are required to be familiar with electromechanical relays and relay con-
tollers and also be able to read electronic and logic circuits and semiconductor circuitry. Eight pages in
the training manual are dedicated to logic instruction. The ratings learn logic symbols (nand, nor, and,
or), truth tables, gates, inhibit, flip-flops, multivibrators, Schmidt-triggers, pulsers, steppers, amplifiers,
etc.

For this instruction the Electricians Mates attend EM Class A school. This is a 6-week school
where they spend 4 days on AC controllers, 2 days on logic and I day on elevators. There is also an 8-
week EM school where 6 days are spent on AC/DC controllers, 3 days on logic and 1/2 day on elevator
operation and test.

The computerized job descriptions of Electricians Mate ratings show that the EM3 performs 438
different tasks. About 10% of the population works on elevator control systems for a total of about 5%
of its time. This does not include regular maintenance of elevator side doors. elevator locks, etc. A
total of 379 different tasks are performed by EM2 ratings with about 16% of the population working on
elevators (excluding cleaning and lubrication) for a total of 7% of their time. (These figures are for
CV59-62-63-64).

Discussions with personnel at the Naval Training Center, Great Lakes indicated that during the A
school, ratings see a Cutler Hammer controller but nothing more. After two years in the fleet when
ratings re-enlist, they often elect as a re-enlistment incentive to go to the 18-week EM Class C-7
school. Attendance at this school does not necessarily change their rating but of those EMs aboard
ships who were interviewed and had taken this course none were found to be working at the detailed
level of maintenance on elevator controllers.

During the 18-week C-7 school, 7 days are spent on logic, about the same on transistors, and I
week specifically on the Cutler Hammer controller. Two days are spent on the elevator theory and the
rest in hands-on training and trouble-shooting bad cards.

There is also a 26-week school where somewhat more time is spent on AC and DC controllers.

At the Naval Trainirg Center, Great Lakes, there are trainers for the PDP-14, Cutler Hammer,
and General Electric (GE) controllers. The GE controller is not taught any longer. The PDP-14 con-
troller is covered only in a special two week ROM/ENCODER School.

About nine students attend the ROM/ENCODER School per year. During the course, about I
day is devoted to studying the encoder and diode matrix. The balance is spent on the PDP-14 con-
troller. hoisting machinery, and safety devices.

One other solution to sophisticated elevator controller maintenance is to use different

classifications of rating on different parts of the controller. Possible maintenance personnel [2) include
Electronics Technician (radar), Electronics Technician (communication), Data Systems Technician
Basic, Electricians Mate Basic, and Aviation Electricians Mate Basic.

Electronics Technicians 2 and 3 [41 are specialists in either communications or radar. The radar
people learn about radar and navigational systems such as inertial, Loran and satellite navigators. The
communications training is almost all analog in CW and voice communication, fleet multichannel
broadcasting, facsimile systems, etc.

- . - .,.--., - ~ .. ? .4
 GO. THOMAS

Data Systems Technicians are capable of locating defective parts within electronic circuits. They
can insert and monitor diagnostic programs in digital and analog equipment and record results. They
can diagnose malfunctions of digital data equipment by analyzing the operation.

Variables in the maintenance personnel equation are (a) the rate classification of the individual
performing the maintenance, (b) the training level of the maintenance technician and (c) the ship
department responsible for the maintenance.

Since EM2 and 3 ratings spend so little of their time on elevator controllers, highly specialized
and sophisticated electronics training, just focused on these tasks, is considered unjustifiable. In all
likelihood the training would be forgotten by the time it was put to use.

A mixture of ET and EM ratings in the repair and maintenance of elevator controllers was tried
for a short time aboard one aircraft carrier. What was found here was that the EM considered the
source of the trouble to be in the controller maintained by the ET while the ET was sure that the
source of the trouble was in the sensors and interlocks which were maintained by the EM. It is recom-
mended that responsibility for maintaining and repairing elevators be placed on the shoulders of a sin-
gle rate classification.

During visits to aircraft carriers it was found that in some cases the weapons elevators were under
the control of the aviation systems department while on others they came under the hull department.
The department responsible for performing maintanance work on elevators did not seem to affect the
system performance and availability.

It is recommended that shipboard elevator systems should continue to be maintained by Electri-

cians Mate Ratings EM2 and EM3. These ratings are given no training on computer or microprocessor
address or data-bus type dynamic logic systems. They also receive very little training on static-logic sys-
tems maintenance and only then using simple circuits such as 'nand' and 'nor' logic. Taking these
qualifications as the base line for new elevator controller systems, Electricians Mates should not be
asked to replace as part of their maintenance duties, modules which belong to another technology of
which they have no understanding. Such modules might be multiphase computer system clocks,
RAM/ROM memory units, tri-state buffers etc. When maintenance is performed by numbers instead
of with complete understanding of the functioning of the system, the maintenance personnel become
nervous and suspicious. When problems occur, they immediately suspect the black box rather than that
part of the circuitry that they understand.

A comparison between system complexity aboard US naval ships and naval vessels of the USSR
uncovered some revealing facts. On Russian ships, systems are kept just as simple to maintain and
repair as they know how. Also, on Russian ships officers perform all maintenance functions: ratings
merely operate the equipment. Whether this has any bearing on the maintenance strategy is a subject
which could be debated at length.

EXISTING SHIPBOARD CONTROLLERS AND SENSORS

Information contained in this section of the report was obtained primarily through visits made to
numerous U.S. naval ships during 1979. Athough many gaps in the data collected exist, the objective
was to obtain information on each ship in the following format:
number of freight/weapons elevators
controllers:
manufacturers
voltages
types
problems

6
r

NRL REPORT 8488

mean time between failure (MTBF)

condition monitoring/maintenance aids
suggestions for improvement
sensors:
manufacturers
voltages
types
reliability/availability information (MTBF)
maintainability and ease of maintenance
signal noise problems
suggetions for improvement
information on elevator usage rates
training recommendations
A summary of data on all existing ammunition and bomb elevators on aircraft carriers is given in
[5]. This publication forcefully illustrates the wide range of elevator geometries, configurations and
loading capacities found on aircraft carriers. It was quickly discovered that there was a limited number
of elevator controller manufacturers. This being the case, it was decided to present the information in
the order of manufacturer.

Cutler Hammer

A series of elevator controllers were provided for later COONTZ class destroyers (DLGN 38-41)
using an entirely AC system.

All circuits were 110 VAC 60 Hz except for the elevator motors which were 440 VAC 3 phase 60
Hz and the elevator-motor brake which was 360 VDC/62 VDC. The limit switches were all elec-
tromechanical.

The design provided for a safe stop unless simultaneous failure occurred of two or more com-
ponents. The car will also brake if the supply voltage is removed or is too low and also if the high-
speed contactor does not de-energize.

Entirely 440 VAC controllers were provided as original equipment for forward and aft strike-down
elevators on the SPRUANCE class destroyers (DD963) [6]. These elevators are lightly loaded
(2340Kg) (5200 lb) and operate at slow speed 18/3 m/min (60/10 ft/min). In this system, made
entirely by Cutler Hammer, all contactors, relays, push buttons, and limit-switches operated from 440
VAC across two phases (ungrounded).

Because of several near accidents with this 440 volt system, SPRUANCE class destroyers are
presently being back-fitted with controllers using less lethal voltages on the push-buttons and sensors.
(See Unidynamics later.)

One very successful Cutler Hammer product line was called Direct Static Logic (DSL). The DSL
system is used in many naval ships, in particular the USS NIMITZ (CVAN-68) and the USS
EISENHOWER (CVAN-69) [7,8]. Maintenance problems on a DSL controller were investigated dur-
ing a visit to the USS NIMITZ.

The Cutler Hammer Direct Static Logic (DSL) controller on the USS NIMITZ uses elemental
logic functions in an ad-hoc design process to provide "send" but not "call" control from more than one
station.

Types of logic cards are: 3 input "and," 3 input "or," 3 input "power and," "not," "set/re-set," "flip-
flop," "out amplifier," "re-set gate" and "resistor signal converter."

FkII
 G.O. THOMAS

The logic uses 110 VDC. Certain functions such as emergency' run, high- and low-speed overload,
slack cable. overtravel switches, push-buttons, etc.. use 48 VDC. Power supplies are 10 VDC at 8 A
and 48 VDC at 3 A. An example of an *or" logic card is shown in Fig. 1.

In the technical manual, 29 sheets of logic drawings are provided which require a certain deterrmi-
nation on the part of qualified maintenance personnel to decipher. A page taken from the notebook of
one EM showing his personal attempt to understand the system is shown in Fig. 2.

Other functions used with the logic cards are "timer," "stepper" and "pulser." In the logic, 10 VDC
is logic one and 0 VDC is logic zero.

Thne 48 VDC signals from contact-type inputs go through resistance converters to reduce the level
to 10 VDC for use with DSL. 'Send" push-buttons are ineffective once the elevator has started to run.

A jogging control is provided which operates directly on the motor contactors and will not be
described further. Emergency-stop features are provided per MIL-E-17807.

Extreme upper and lower deck memories are always set so that if there is a proximity switch
failure at an intermediate level the elevator will continue up or down and stop normally at the highest
or lowest level. If the high-speed contactor does not drop out when commanded to do so the elevator
stops at high speed.

Failure mode design is such that the elevator never fails to stop except on simultaneous failure of
two or more proximity switches, logic elements or contactors. There are back-up electromechanical
overtravel switches.

If there is power failure, upon restoration the elevator will not run. Push-button lights are all
backed up with two lamps. Push-buttons are shock tested to grade A, Class I in MIL-S-901. Logic
boards have trou ble- shooting tungsten lights derated in voltage by 50%/. The style of controller technol-
ogy is printed circuit board with discrete germanium transistors. The technology is about 15 years old.

The input to proximity switches is 115 VAC at 60 Hz and 10 VDC. Proximity switches are of the
two part device with sensing head located remotely from the logic module which amplifies the signal
from the sensing head and converts it to 10 VDC. Two switches are provided with ranges of 5 cm and
1.25 cm. The switch is .of the variable reluctance type. With a steel target in front of the head the
switch logic module has 10 VDC out. Details of the switch head and amplifier circuitry are shown in
Fig. 3.

Because of potted construction, sensing heads are considered explosion-proof and water-tight, but
there is no limiting of current to the sensor. When the target is in the sensing zone the sensing head
has an output that is amplified, rectified and filtered, switching the output of the Schmidt trigger off and
turning the output switch to its "on" state. Thus, with the target in the sensing zone there is an output
and the state light LI in Fig. 3 is on.
Sensitivity of the switch can be adjusted through potentiometer P1, Fig. 3. The sensing coils are
in series opposition. When energized by mutual inductance of the third coil the output is balanced by
means of the tuning slug. When the target enters the sensing field the balance is disrupted resulting in
a low-level AC output from the head. A portable DSL board-tester is provided.
Spares are very costly and difficult to obtain for the DSL controllers. There is only one Cutler
Hammer supplier for the germanium transistors used and so many naval ships are dependent on one
small business operation. There is a nine months delivery on cards. On the NIMITZ one elevator was
being cannibalized for parts. Usage rates were such that during in-port, two elevators were run two to
three times a day; while at sea two or three elevators are run continuously.
8
 NRL REPORT 8488

DI D2

R5

PATILS
SYMBOL2
DIAGRAM COPNN CHRCI SISNMEC REQUIED PRT O
R. R 4R.R.R.R:
* R1. R1 Resstor 330, 1/ wat S R07D 332
R3. R.
ResstorR1, R1 470 hm, /4 wtt 4R3G41
R IO.R4 1 eitr 100om / at4ROG12
*~ ~ ~ 2 ~ ~
eitr ~ 40om~ / ~t4R2G47
~~7
RDRS 01,

QRuQ Tr6iso 104i 03 D504-

R9 ideI~S12134 -h~ R7

9D

R16 W -- Q8 -&07- R1
 G.O. THOMAS

~~ c.

Fig
2 noebo
vE ex rct SIMI te amrDLlgccnrle

- ;10
Er

..
Z)**** . .
 NRL REPORT 8488

FRONT VIGW OF CASR R1G4T SIDI VIEW

113 S

.7A*ET sUiNS IN~ It ___________

SS
upPLY 3

E.. i. v"'PL I

OUITPUJT

L.._M C-NFF. NO.S6- 364

SPPLt AEC" ILA $.MITT OUTPU

U
UPYA.C. AIPLIFIEL6A1TRGE
S FILTER SWITEN

~~~ i ,*O 30
as
510
C1

7 as,3
SI 416
6,
CROT, IS
OP TI a.Is 0
1 ®. IWO?.I.
n -to T~. 6' 1 0r T
'R P0

I II T
55,6~~~Q INPUTWIIUT1
EOOL

A-SOT CTlls U-wA

Ait Op17 z.IK o

'"'~~ iDPt' IO T CCG

.111
 G.O. THOMAS

The biggest problem of maintenance was proximity switch circuits. The )roblem was made worse
in the writer's opinion by the provision of sensitivity adjustment slugs on zhe sensor head and by a sen-
sitivity adjustment potentiometer on the first amplifier stage of the proximity switches. Within no time
at all, unqualified maintenance people would have the entire elevator sensor system out of alignment
(see Discussion and Recommendations for further comments). One reason for sensor problems was
that proximity targets would frequently bend or be knocked off for one reason or another.
Another problem was solenoid valves which operate dog/undog mechanisms etc. When solenoid
replacements were made, the new solenoids were found to draw 7.67 A at 115S VAC. Fuses from the
output amplifiers were 6 A slow-blow which at first blew until replaced with higher rated fuses. After
this the power amplifier cards burned out. This problem points to the need to design into ship systems
a margin for alterations and modifications to be made during the ship life.

Recommendations were made for (a) lights which indicate that particular doors are open not sim-
ply that all are closed. (b) lights which indicate the position of the platform at all times and do not go
out immediately when the platform leaves a level, (c) more discrete indicators on safety circuits instead
of one safety permissive.

Digital Equipment Corporation

Controllers developed by Digital Equipment Corporation were used for Improved Weapons Han-
dling System elevators on aircraft carriers of the FORRESTAL class (CVA59-62) and of the KITTY
HAWK class (CVA63-64). A visit was made to the USS INDEPENDENCE (CVA62) to investigate
this type of controller (91 system. The center piece of this controller is a Digital Equipment Corpora-
.tion (DEC) PDP-14 mini-computer. Other names for this controller are ROM. which stands for Read
Only Memory, and the Phoenix elevator controller. Problems with this elevator system resulted in the
study of Ref. [1] and indirectly to the present study.

On the INDEPENDENCE there are hatches at the main deck and at the third deck which are
interlocked so both cannot be opened at the same time. These hatches are both water-tight and for
ballistic protection. The elevator normal mode uses the automatic controller. There is also a manual
jog mode which will not be mentioned further.

Deck stations on the elevator have the ability to control door open ing/closi ng, placing the elevator
in run/stop mode, and dispatching to any other station. There are emergency-stop push buttons and
.car here" indicator lights. At the master control station, in addition to these functions, there is the
capability of jogging, if the jog mode is selected at the controller. There are also additional information
displays for such things as low hydraulic pressure with different colors indicating failures, caution, and
operational-go.

The logic controller is comprised of a PDP-14 control unit (S VDC TTL), interrogator box, acces-
sory box, input box, three output boxes, a 28 VDC power supply, auxiliary relays for up/down.
high/low speed, two diode matrix pinboards, an encoder interface panel, a proximity test switch, an
elapsed time meter, six platform indicator lights, and ten terminal boards. The controller issues com-
mands such as dog/undog, latch/unlatch, hatch open/closed. There are fault indicators of system mal-
function and indicator lights to assist in trouble shooting. The controller also monitors the status of
door interlocks, slack cable, motor overload and motor temperature, and hydraulic pressure.

Practically nothing about the internal workings of the logic controller is known by the Electricians
Mate doing maintenance. He knows nothing, for example, about specifics of the PDP-14 computer
coding (which is extensive). Table 2 represents page 14 of the 25 page revised Weapons Elevator
Number Six ROM Controller Program CVA-64-701-2283504 March 1976. When problems occur by

12
 NRL REPORT 8488

:V '

L- 'r L. .:) .La)-r 7

n 1. z f r a C I ';

Q. C + I

.,c 7~ . l L 1 V . ) *l ., .7 C)

4 4 * e4 d4 ' cU~
cZ .
ch ciLL . ilL ..C UL c

~~~~~ a-. -- C I 4 4 .4 -c .- -AO -c

La ey C, r ,r c c4-c-u.. C -. I -c c. c -

10 '3 Cl 0 C '3 OO e f C 134

C ~ .C 221 -C. t C; .3 - .
 G.O. THOMAS

numbers on the controller indicator, the maintenance EM is expected to simply remove and replace
electronic cards until the fault is isolated and corrected.

The approximate platform position in the trunk is indicated through a printed circuit card encoder.
There is also a gear-driven limit switch safety device which operates independently of the encoder and
is mechanically coupled to the hoisting cable drum shaft. The gear-driven limit switch prevents upward
travel of the platform from below the third deck as it approaches the third deck if the hatch is not fully
open. This switch also causes system power to be removed if the platform fails to shift to low speed
when approaching the main deck.

There are four slack-cable limit switches, an overspeed governor limit switch and a speed gover-
nor slack cable limit switch. Thirty interlock switches are used in the six doors of the system- two for
dogged, two for undogged and one for door closed at each door. There are up and down overtravel
limit switches at the extremes of travel and at the hatches. The overtravel limit switches at the hatches
are bypassed if the hatches are open. Other safety interlocks are for motor high-speed overload, low-
speed overload and over temperature.

The pressure switch monitors the hydraulic power [normally 10.33 x 106 Pa (1500 psi)] and
breaks a safety interlock if pressure falls below 8.26 x 106 Pa (1200 psi). An air hose and electric cable
are provided to the platform on the elevator for the pneumatic locking bars and to service the active
sensors on the platform. The elevator speed is 41 m/min (135 ft/min) [57 m/min overspeed (190
ft/min)] and 6.7 m/min (22 ft/min) leveling speed. In fault isolation of the PDP-14 an interrogator
box BT-14A is used. The manual contains many pages on fault isolation.

Proximity switches are built by ELDEC of Lynnwood, Washington. They are four wire: plus 28
VDC, common, built-in-test, and switch output. Circuit boards are to MIL-P-13949 type GF. The
switch is encapsulated in rigid epoxy per MIL-I-16923E self extinguishing. Switches operate in the
sourcing mode. Mean time between failure is greater than 100,000 h. Target requirements are 3.75 cm
(1.5 in.) x 8.75 cm (3.5 in.) of 0.625 cm (0.25 in.) steel. The test circuit operates by connecting the
test lead to high for a target away condition, or the test lead to open for a target near condition. Nor-
mal operation is with the test lead connected to common. There are 26 proximity switches utilized in
the elevator system comprising; 12 for the main deck hatch, 12 for the third deck hatch and 2 for the
elevator platform. The ELDEC switch used in this system works on the eddy current loss principle.
(See lower Fig. 4.) The proximity switches used on this elevator were the ones which gave the least
maintenance problems of any elevator system visited. This was because of the clear on-off signal with
no adjustment or tuning slugs and also because of the added test feature.

The ELDEC switch described above is part number 08748-8-078. Initially this switch experienced
problems in electromagnetic interference. After correction by the manufacturer, later versions of the
switch passed MIL Spec. radar frequency testing.

Comments by maintenance crew on the USS INDEPENDENCE were that the controller was too
complicated for the ship's force to maintain. They would prefer to be able to trouble shoot the con-
troller with an ohmmeter. Mechanical relays and lights or simple "and' and "or" logic was preferred
(they had no problems with the motor controller). On the INDEPENCENCE two EM-3s were dedi-
cated to maintaining Phoenix elevators. More maintenance time was spent on the two computer con-
trolled elevators than on all of the remaining 20 freight, food, and weapons elevators on the ship.

Phoenix elevators were down two to three times every week. The primary sources of problems
were O-rings of hydraulic cylinders which operate the doors, elevator electric systems, and computer
cards. This elevator has platform locking bars and the greatest source of problems is that locking bars
will not extend unless the platform is practically dead level (within 0.15 cm). This need for leveling
conflicts with the ± 0.625 cm (± 0.25 in.) requirement of the elevator specification MIL-E-17807B.

14

" • l'4
 NRL REPORT 8488

VARIABLE RELUCTANCE PROXIMITY SWITCH

,-
c lunrI tLttTuitSIF
C ITPUT

EDDY CURRENT LOSS PROXIMITY SWITCH

421

Fig. 4 - ELDEC proximity switch electrical circuits. Reprinted with

permission
WIL from
Is Corporation.
ELDEC $IT[
TEST.

Usage rates on the INDEPENDENCE weapons elevators were that the two Phoenix elevators
were run once or twice a day in port and continuously at sea. Maximum continuous operation recorded
was 72 h straight. There was always the need for both Phoenix elevators, and at least two others, to be
running at the same time.

EMs maintaining the visited PDP-14 systems all had very little elevator training and none had
been to the ROM/ENCODER school. Suggestions made were that it would be helpful in trouble shoot-
ing if there were lights for every door interlock instead of one door interlock permissive.

15
 G0O. THOMAS

General Electric Directomatic I

Older versions of the General Electric Directomatic elevator controller are installed on many
ships. The one visited was USS KENNEDY (CVA-67) [101. Original equipment on the KENNEDY
provided for Directomatic control of a series of bomb conveyors as well as elevators. Alterations to the
ship have discontinued servicing and are presently in the process of removing the conveyors. Since the
conveyor controllers are being left with the ship for spare parts, there is no shortage of spares.

The Directomatic static controller uses "nor" logic. The technology is aged about 1950. Each of
the cards made with glass melanine is constructed using individual wire hookups between the pins.
Plugs and receptacle contacts are gold plated. Boards are conformal coated (dipped in a special tran-
sparent plastic compound).

Voltage levels used are -6 VDC bias supply for the logic, and +25 VDC. The +25 VDC power
supplies the logic, static limit-switches, push buttons and indicating lights.

All cables are zero-current (both wires of a single phase circuit or all three conductors of a three-
phase circuit are run within the same armor) A.C lines operating at high-powev levels are routed away
from the logic inputs. Power supply leads .,: .
* 'ascaded from device to device. The design minim-
izes ground loops in static limit-switch ig.;v ,I't Signal cables are not in the same conduit or cable
trough with power or relay coil wires. ,. - controlling the elevator platform, hatches and door
operations are 115 VAC single phase 11..;,it!. 'e coil operates from a rectifier providing 100 VDC.
Limit switches operate at 25 VDC on 25 - The switches operate with a vane between caliper arms.
High voltage is 11.5 to 16.2 VDC with - present. Low voltage is less than 1 V.

The elec-.ical configuration of the General Electric limit switch is shown in Fig. 5. The switch is
of the variable inductance type. The vrtertion of a copper vane in the 22 mm (0.875 in.) slot separat-
ing primary and secondary coils of a transformer affects the level of an oscillator circuit, which is
detected.

There were no serious maintenance complaints regarding the General Electric switch on the USS
KENNEDY. There had been six replacements in two years. There was a proximity switch availability
problem. The principle cause of replacement was the vane construction which was designed into the
switch. Some elevators on the KENNEDY had 5 cm sway as they moved along the trunk. Occasionally
this would cause the vanes to wipe out the switches.

Some time ago it was found that the GE proximity switches are affected by radar interference.
Because of this, electromechanical switches had been back fitted on the KENNEDY at flight-deck
hatches. In one way this defeats the purpose of proximity switches since mechanical switches, which
are most susceptible to environmental corrosion, are placed in an area of the elevator that sees the
worst marine environment. The reason why the mechanical switches at the flight deck did not produce
maintenance problems was that the flight-deck hatches were rarely opened.

On these elevator systems there are four proximity switches at each level, one slow and one stop
switch for both up and down. Usage rates for IWHS elevators on the KENNEDY were given as 4 h per
day on four elevators during operations.

The major maintenance problems connected with elevators on the KENNEDY were: door inter-
lock permissive, emergency stop, and slack cable. Only two controller cards on the average were
replaced every two months. The elevators were normally operated in the manual mode, however, in
preference to use of the automatic feature.

16

-- I '
 NRL REPORT 8488

in
', l

4i
"
6 - I £

InI
33

9.;-.
" - 3 i+,

+
•- 4,
°zC T,4.+ +o .2

T 0
c66

-o a 0

2!~

- , :- ' i + + + "; . +,'il++,+ '. la .. ". . U,

ivs

• fi~~ll-ii . - o,..
......
.. - ! . -.! !. .s .
" "L.,. : ,. . . v
Si
il .'t -

' !
I #:~i
l.- 6 *1tI
-i
hhj:" jij 0-
-
',:ii

"12s: "1 "" L .. .

"O -
1 . r

I * -vi
64 ,-,,
_ +

I_ _ _ _III _I II__ _ I

17
 G.O. THOMAS

There were no trouble shooting aids on the Directomatic controiler. All that was available was a
test light hooked up with two leads of wire. EMs maintaining the elevator system were unanimous that
they would like to receive more elevator ,raining.
It is normal to install lights or horns at flight or main deck hatches on aircraft carriers. This safety

feature was omitted on the KENNEDY and aircraft have been overturned as a result.

General Electric Directomatic 1I

The GE Directomatic II is a later version of the Directomatic I using individually wired printed
circuit cards with technology about 12 years old. Many ships in the Fleet used Directomatic II. The
ship visited was the USS CANISTEO (AO-99) 11ll. This is a medium speed elevator (30 m/min/5.1
m/min) made by Turnbull Elevator Inc,

In Directomatic I, positive logic is used (logic one is about 7 VDC, logic zero is less than 0.5
VDC). Logic types are "and," "or," "exclusive or," and "logic inverter." There are also time-delays.
oscillators, flip-flops, single-shots, Schmidt triggers, shift-registers, digital amplifiers, and indicators.
There are also annunciators, clock drivers, display drivers, gate expanders, input buffers, relay drivers,
triggers, and filters, etc.

Simple logic functions such as "and" and "or" are achieved through a combinatic i of resistors and
diodes. One standard load equals 1.6 mA at 20 KHz maximum pulse rate connected to the + 12 VDC
power supply. Open inputs are considered high. For logic zero, an input must be grounded. Power
supplies are + 12 VDC regulated for logic and + 28 VDC at 3 A unregulated for external functions and
for relays through relay driver cards, etc. Inputs from miscellaneous interlocks and push buttons must
be 25 VDC at the terminal board. t,puts from noninverting static limit switches with "vanes-in" should
be 12 VDC at the input buffers. Inputs from inverting static limit switches with "vanes-out" should be
14 VDC at the input buffers. Proximity switches used on the CANISTEO are standard General Electric
vane-type Fig. 5.

The basic circuit is an oscillator and a detector. The transformer primary is wound onto one arm
of the limit switch and is part of the oscillator tank circuit. The transformer secondary is wound into
the other arm of the limit switch and is connected to a rectified circuit. Coupling is changed by a
copper vane positioned between the two arms. The rate and level of oscillation is set at the time of
manufacture. There is no adjustment needed by personnel aboard ship. This switch, which is based on
inductance coupling, goes from an output state to no output when the vane is inserted.

Maintenance problems are that 25 proximity switches have been replaced in two years. In a three
month period, one or two controller cards are always found to be faulty. The ship's crew had lroblems
locating bad cards. There should have been a card tester on the ship but maintenance people did not
know where it was. Cards were not intended to be repaired at the component level. They were
designed as a throw-away item.

Usage rates on the elevators were about 30 times each day in port and 10 times each day at sea
when there were no exercises. During underway replenishment all elevators made about 100 cycles in a
12 h period.

The Directomatic i controller is also used for control of bow-ramp operation on the NEWPORT
Class (LST-I 179) of tank landing ship. For this application the proximity switches are made by
Microswitch and are of the variable reluctance type. The switches are watertight and sealed throw-away
units and details of the circuitry are not available.

18
 NRL REPORT 8488

There are 34 proximity sensors per vessel. Sensors are shock tested to MIIL-S-901 grade A Class
1. The sensor is temperature compensated for operation between -340 and +88*C. MIL Spec. tested
endurance exceeds 100,000 cycles. Other tests to MIL-C-23994 include vibration. under-voltage. vol-
tage limits, insulation resistance, dielectric strength, and to meet water-tight requirements.

The sensor head is shown in Fig. 6. Sensing distance is about 25 mm (I in.) as determined by
the target size (see Fig. 7). Sensors require a preamplifier, which is also potted and a throw-away unit.
Sensors can be separated from the preamplifier by up to 45 mn(150 ft) of four conductor twisted
shielded pair 20 gauge cable. For unshielded cable the power leads must be separated from the signal.
and all should be inside of metallic conduit.

Input to the sensor head is 33 VAC 60 Hz at 81 mA. Output is from 0.9 to 2.0 VAC at 60 Hz
and 33 A A. The preamplifier (42 FC 22) provides an output of 100 mA at 20 VDC. The output is
normally de-energized.

Protection is provided for output shorting, failsafe and transient voltage. There is a 50 ms built-in
delay at the sensor head to protect against false voltages entering the system. The input power is first
isolated with a step down constant voltage transformer and the DC is filtered and zener diode. regulated.
The amplifier output has shunting and blocking diodes for protection.

Puget Sound Naval Shipyard Relay Controller

There are two versions of the Puget Sound relay controller presently aboard ships. The hybrid
controller was back fitted to all elevators aboard the USS CAMDEN (AOE-2) and on one elevator
aboard the USS SACRAMENTO (AOE-l) [121. An all MIL Spec. electromechanical relay version of
the controller is being evaluated aboard the USS CONSTELLATION (CV-64). Operation of the hybrid
controller was observed during a visit to the SACRAMENTO.

Cargo elevator number 7 operates as "send only. Doors are manually operated and electrically
locked. The elevator has normal safety features including emergency-stop. The run-stop feature stops
elevator movement during on- and off- load and allows the door to be opened by energizing the door
solenoid which retracts the door latch. The safety interlock relay is normally energized and is de-
energized by interruption of power on any safety feature. The emergency run push button may be
depressed to by-pass the overload contacts. The system has a self-leveling arrangement where, if the
platform slips through a level, it will automatically change direction and return. Front and rear views of
the control panel are shown in Fig. 8.

Logic switching is achieved using six-pole double-throw miniature commercial electromechanical

relays (see lower Fig. 9). These relays have an integral light-emitting diode (LED) light for use as a
troubleshooting aid. There is also a test socket to allow individual relays to be checked.

There is one 24 VDC 12 A power supply for the entire system including logic elements, indicator
lights, push buttons and proximity switches. Electromechanical timing relays are used in connection
with the self-leveling feature and to check for high-speed contactor drop out. The circuitry diagram is
extremely simple to follow but, in many ways, the system is susceptible to the eff~ects of electromag-
netic and electrostatic noise. Examples of this are the paralleling of push buttons on a common supply
lead and the use of commercial solid-state relays which are not externally protected for over-voltage and
transient spikes. Solid-state relay output is provided to interface the motor contactor solenoids. The
solid-state relays are made by Crydom. They are not tested to MIL-R-28750A which provides for test-
ing of relays under over-voltage and transient spike conditions.

.19
 G.O. THOMAS

01

- -

-c -- 9 w

in)

rw°
a(z
U.It rC

,W

20C
0 cn ,

T am

Nv0

tot

J IL
 NRL REPORT 8488

PK- 82140
MICRO SWITCH PROXIMITY SENSORS RELATIVE
3.82 -APPLICATIONS INFORMATION
(0.5) ~
(TYPICAL DATA - NOT WORST CASE) <

II FB430
3.55-
SENSOR W -
.(1.4) 11 FB422
0nSENSOR CC

wLw

0 1.3)
0

0 3.05 -:
1.2)
0_ _-
_
(n 3: a:
LU0 . w
D 0 aD

z
( 1) -_
w .
X
= CDCOn
z P
x" =--Z z o... I-- 0 w
T2.54 =-- - z
m- 4 -.
E (I.O) C) )
wj W N4
<- , < ,, ,

2.28 . .,_ c0 Z
(0.9) W No 0-x 0 N

(z 02
n VZ 0 0O co S -2
z 2 03 a.lX:Nt,
W NX N
p:(
w . -cj -l 2 0x
Cfl(0. 8) a- I0
_ 0Z 2X zX 0

1.751 0 OPERATE 0 RELEASE

(0.7)
Fig. 7 - Micro Switch variable reluctance sensor range/target data

21

S.. . 4
 Control Panel
Front View

*~ .~YU~4L~
TM I-O-
~ Control Panel
Rear View
0

40 0 -

22
 NRI R IPORI1 8488

F~g 9 - tipper tnidvnamtc% optical proximitv v ith lor PSNSN controller logic relay

23
 G.O. THOMAS

Proximity switches generally used with this elevator system are called "GO" switches made by the
General Equipment and Manufacturing Company, Inc. (Model 43-100). The switches use a balanced
rocker arm and two magnets of different strengths. When ferrous material or another magnet is
brought within the sensing range, the magnetic field is disrupted permitting the lesser strength magnet
to switch the relay. The switch remains switched until the actuator is removed, causing the armature to
return to its original position.

The switch is hermetically sealed under 345 x 103 Pa (50 psi) of purged and back-filled hydrogen
to prevent deterioration of contacts. Contacts are rated for over two billion cycles. The switch is rated
at 1250 W for up to 600 VAC resistive load. The switch should be derated for DC use. Response time
is 0.008 s with repeatability of 0.05 mm (0.002 in.). The switch has been MIL Spec. tested for shock
and vibration. Under MIL-S-901 there was no apparent physical shock damage to the switches. Con-
tact chatter occurred but was not sufficient to cause a 20 ms relay to drop out. There was no resonance
noted and no apparent damage to the switches during vibration tests to MIL-STD-167.

Other qualification tests to MIL Spec. QPL-2212-19 were for materials and workmanship, weight.
creepage and clearance, general operation, inclination (450 and 600), temperature rise, endurance, insu-
lation resistance, and effectiveness of enclosure (the switch was submerged under water and high
vacuum for 30 min. each). A US Coast Guard letter dated 2 May 74 says the switches are acceptable
for use in Class I Division I Groups A, B, C and D hazardous areas based on approval by Canadian
Standards Association File Number 24226.

The discussion with Electricians Mates aboard the SACRAMENTO revealed that they preferred
the relay controller to other controllers with which they were familiar. Elevators 1, 2. 3, 4. 5 and 6 on
the SACRAMENTO use the old form of General Electric Directomatic controller. In comparing the
old Directomnatic and the relay controllers it was found that both controllers rarely malfunctioned.

On the GE controller about one static switch was replaced per underway replenishment. One-half
of the switch replacements were because of electrical faults, the remainder were knocked off because of
vanes striking them. The GE cards did not require replacement often. The main fault here was that
resistors would burn out and take the transistors with them.

The main advantage of the relay system, and the reason it was preferred, was because of the sim-
plicity of the circuit diagrams, the trouble-shooting aids and the ease of effecting the maintenance. Fre-
quently problems in the relay controller could be isolated and corrected without referring to the
technical manual at all.

Elevator duty information for the SACRAMENTO is that elevators are run in port between once
a week and five to ten round trips per day (for a total of 1-1/2 h each day). During load-out (which is
about every 6 mo) elevators are run for four days continuously at 20 h/day.

A MIL Spec. relay version of the Puget Sound Controller was installed aboard the LSS CON-
STELLATION (CV-64). There is no log of experience with the new system at this time.

Differences between this controller and that on the SACRAMENTO (other than use otf MIL Spec.
relays) are the use of a combination of ELDEC proximity switches which were already installed and
"GOr switches, provision of relay lights separate from the relays they monitor, and a control panel
which is hinged for easy access to the rear.

Push buttons allow the elevator positioning switches to be checked where the switches have a
self-test feature. Measurements made on the system showed that at 26 VDC, from 2.7 to 3 A were
taken from the power supply. In this system, all push buttons, contactors and solenoids take 115 VAC.
Total AC current into the controller at 115 VAC was 4 A rms. Electricians Mates maintaining the

24
 NRL REPORT 8488

elevator systems on the CONSTELLATION generally liked relay systems but could find very little to
fault the PDP-14 controller which was discussed. On the CONSTELLATION there are no EMs dedi-
cated to the PDP-14 systems and there was general agreement that more training was needed.

Elevator problems generally centered around sensor adjustment and solenoid burnout. It was not
established whether the solenoids burned out due to overheating from the coil when the plunger does
not go in or because of insulation deterioration caused by occasional wetting from the water-glycol
hydraulic fluid mixture. Duty information for weapons elevators on the CONSTELLATION is that
they are used about two hours per day in port and often one hour on and one hour off for three weeks
continuously at sea. Members of the Naval Ship Systems Engineering Station, Philadelphia commented
in 113] on the Puget Sound Relay Elevator Controller. The following significant sections were extracted
from their report.

The CAMDEN has experienced failure of 25 LED indicators since the initial installation. Indica-
tors are integral with the relay and are not replaceable separately. CAMDEN has also experienced six
relay coil failures since installation. This appears to be high over a short period of time. The solid-state
relays have no heat sink, but Crydon manufacturing data indicates that a heat sink should have been
provided. At least four solid-state relays have failed since initial installation, which is a high failure rate
for this type of relay. Both CAMDEN and SACRAMENTO have experienced unexplained nuisance
stops of their relay controlled elevators. Incomplete seating of relays has been suspected. On the
CONSTELLATION it is said to take 20 min to remove a MIL-Spec. relay with the present securing
method as opposed to a minute or so for the commercial version (the 20 min has since been reduced).

Also on the CONSTELLATION, AC and DC electrical cables were passed in the same bundle.
DC wire runs were not shielded in the relay controller enclosure. Some lines to solenoids have high
current surges which cause DC relays to change state erratically (this may be caused by interference on
ELDEC sensor built-in-test circuits). Recommendations made by the Naval Ship Systems Engineering
Station were that an elapsed time meter should be installed. Separate LED indicators on input and
neon lights on output would seem to be the most reasonable design approach for the future. It was also
recommended that standard electronic modules (SEM's) should not be discounted in elevator control
design. It is believed that a simple effective control design can be achieved when the unique blend of
elevator system knowledge and SEM component knowledge is merged.

Unidynamics Controllers

Unidynamics is the largest supplier of elevators to the marine industry. Table 3 lists shipping
interests which have recently installed Unidynamics elevators and dumbwaiters in their ships. Elevator
types manufactured by Unidynamics include those for transporting: stores/freight, pallets/ammunition,
coal/grain, and personnel (including chimney, tower and crane servicing). In the oil industry both on
tankers and on off-shore platforms Unidynamics has provided elevators for use in hazardous environ-
ments.

Commercial elevators made by Unidynamics generally use the single card TTL static-logic con-
troller shown in Fig. 10. The design methodology used is similar to other manufacturers discussed pre-
viously in this report. The front view of the logic controller card showing arrangement of integrated
circuits is shown in upper Fig. 10. Lower Fig. 10 shows the underside of the controller card, which
uses wire-wrap interconnections. Unidynamics manufactures very few of the components which make
up the controller. For example, the card shown in Fig, 10 was made by Cambian and the wire-wrap was
performed by machine through a subcontractor. All Unidynamics commercial controllers operate on 5
VDC TTL with no optical coupling at the input. The output is via solid-state relays.

25
A
 G.O. THOMAS

Unidynamics manufactures the sensors, which are vane type using infrared LEDs and photo-
transistors (see upper Fig. 9). The slot width for the vane and slot depth into the switch are 1.9 cm
(0.75 in.) and 3.17 cm (1.25 in.) respectively. Normally sensors are placed only on the platform with
vanes on the elevator trunk. In some cases the controller has also been placed on the elevator plat-
form. The arrangement of sensors is that there are five on the platform. Two of the sensors are for
stop and slow and three sensors are arranged to provide binary information based on the number of
vanes on the trunk to indicate deck level. The controller using three sensors in this manner can sense
eight deck levels. The two sensors for slow and stop operate in a manner similar to other controllers
(particularly the Puget Sound Controller). When one sensor operates, the elevator switches from high
to low speed. When both operate the elevator stops.

The commercial controllers use plastic DIP small-scale integrated circuits in sockets with gold-
plated contacts. One side of the card is the , plane on 5 mil copper and the other side is ground with
fiberglass board between giving good capacitance across 8+.

Unidynamics has considered using telephone frequencies for providing sensor information, and
has breadboarded prototype models. They have not used the technique to date in production controll-
ers on grounds of expense.

The Unidynamics optical sensor has several advaniages and disadvantages. The advantages are
that the sensor can be used in hazardous areas where current must be restricted in an intrinsically safe
manner to a level at which an explosion cannot occur. At 5 VDC the intrinsic safety regulations permit
600 mA of current in circuits located in hazardous areas. Unidynamics uses these sensors also for push
buttons in the pump rooms of tankers.

Disadvantages are that these switches are susceptible to malfunction. The Unidynamics switch
shown in Fig. 9 has been subjected to spray painting which has covered the photo-transistor window
Cleaning of the paint proved to be ineffective since the solvent was found to also interact with the win-
dow material causing a gradual opacity to develop over a period of weeks. Far less paint sprayed than
shown would necessitate the replacing of the sensor, which is the presently recommended procedure
when paint spray has been in the air near these elevator sensors.

Another disadvantage is that the sensor is affected by sunlight. Where these switches come in
contact with the open deck the sensing components are covered by a split rubber boot which is subject
to abrasion by the vanes. Direct sunlight will saturate this sensor even if the light is pulsed. Uni-
dynamics has considered using 60 Hz pulse-light as a safety measure for detecting an error condition.
Another disadvantage is that while the LED emitters radiate in a narrow spectrum of infrared the photo
transistor responds to a very broad range of frequencies. Since, by design, this sensor must have a win-
dow which admits electromagnetic radiation it is suspected that the switch would be very susceptible to
electromagnetic interference.

Problems with the Unidynamics commercial controller occurred at the input of the sensors to the
controller. Voltage spikes on the sensor leads were responsible for destroying input gates (which have
no isolated input coupling). Unidynamics resolved this problem by installing capacitors on all sensor
inputs at the controller. Another problem with the input circuitry is that the TTL input operates on a
ground-open circuits float high. The mode of operation for the switch is that for the vane "in" condi-
tion- the TTL signal is shorted to ground. This method of operation does not give a safe indication of
the switch condition. For example, if the switch is not there at all and the signal line is open, the con-
troller is unable to detect a condition that would call for stopping the elevator.

A Unidynamics controller was reviewed aboard the USS STUMP (DD-978) [14). The Unidynam-
ics strike-down elevators on the USS STUMP were manufactured to MIL-E-17807B using standard elec-
tronic module (SEM) units for elementary logic functions. The controller system on the STUMP was

26

.............. . . ...
 G.O THOMAS

%I Ai I F IF A oli & I'% IlAiIEHSTable 3 -Unidynamics Customer List for Marine Elevator,
KkI
IE E I &N,
1,Y0A P KS1 tbII!N
Il .lKS,
I(W

NI ~~ ~ iNli~ ~ ~ tiDh
..'llr.IlinK L It..rd--t A-,, 2I.Ir
1i 1 S. N-~ liurtttm: Ia Amn.
Dtrill 1R5, l'rotin o V. S. N-, AwnpittaI It. Pi. s
A il il
AI.NtAAIA ILDIVi. Ilailarn. Aual
-- 11 MAdI
Kat' Drill S1,q, Stan . I a ~uiiy-I~N~ 1-n Ani.

351 IIt.A\SSII~lCII JEEPSAT

It. Ik Gi--ef-lt"

it 51.5- r
I-dnands I, EYINC1Slii SHIP'YAIRDS
IAnSlMAR(INK 742 Ito.n Ianipanii-s Oil Rig Pe
P'.t
l~inl
r.t ttid(U,.a I- lP. -i III uatiinilti-
Ti It OCK~iKEEDSlI(~IPIIIIINI,
. S. aN-
V- Sabnnueiru AS 39 40 & 41 Carl
NVItNIA I K .SlIllYA IllS Tender DuiW
221. SI'l., ' IIla,
[)-~la I S. Carcti ..3. 41,tIIWT P,-rsao lc 'i
72 %1~-ian iltI.t .;. It NATIINA I !,TEE 1.
22"' tmi- /,-l, tIt 3.Z A ries harii- Ship (18( Carrie '0. N lIkWT pAe"
2 7 ayptl (ill St,- t3h3lt Sn- i
tlahoirruIti Sigl Bu1lhead 21 :1911 Ai,n-Mari- Shipping Tanker .7. uOODTtt
4277 - 21 351 * .
(21 392
2213 121i 394 Thirdl lnup. I-c K9.7WDIWT
7t17 SE.DCI) W1It., Seri- Singli lkilkhead (21 395
-b cnirnihke 396
229a Standard 0,14SK1lK, 1latk,,r tk,tIOlnIWT personnel i1It 397
279i. ill 39' hpnn
2297 il) 399
229' ' II) 400 - -.
229 EXXON Taike r Pe-rsoomeIIll Pump Room (11 401
DKnmitwer Il) 3nn
Personnel Ill1 Pump Roan All 3,19
Dnwunter ill 4015 Shell Oil Tanker.
IS
us- oi-rn
p 0t1pV..I Dredge P11o1ll I3h.040WT Peel
I 406.
lrATipo ORS495 Atlantic Riehlield 150. nim6WT
BA~h 11111 W~ilt.S409
361. Staten SUteannlip (10 i(, ship lnOOO0DWT personnel (2) Dumbwaiter til NEWPORT NEWS
162) ' 1 6I0. Kl Paso Nat. Gan LNG Carrier
3ii 6 S. DIVIT Par!
12) 111 609
31. --- - ' (2) l1t 610
-- .S5 Na.-Pto FFC? Cl.a PulIlet Etensturs 112) 613 Interstate OIil V ICCI V LICC 39. 77140W1 Pair
Fr.gate tDumbwaiters 412) 614 .. ICC-2
BAY~~~~~1 I apata 0-loa(ri n-.,
Z~~Il~III Ine,
71
In 13.5 Steel lir Cantort 62.0nlOWTl' Penona WI
7211 An, i-icao 23.0000WT (1) PKTEKSK(Y SiffPit'I LDINI.
REIEC. ar-PitCity W, Boston EsI'ldiot Pens
4liT. Atlantic
Kithlield Takr l20IIOODWT tieruonel ill 9411 Anirrica. Hen-,,ilNO
t Nil iilii 4S101DWl 3.5
4 :16 (1) 912
4637Il
4641 ilM-.ne. ShitlIaldlng Tanker E20i0IjDWT PersoinalIl
4642 MEFC(loton Tanki.r Taker I20lll0IilNT PeinnelII
464.3 ' ISEATRAINSHtl'BItNi.
4644 th
10 tasnglt Shipping Tanker 225ii0OWT Pogo
46,45 Gin. Amer Trunk. P ICC 26.0IIKDWT PernnelIlPop Room I1 1l 1 Tyler Tankrr Carp
102 Polk Tanker Corp
466103 Film."e Tanken Corp Po

I3RAVO CORPORAT(IN
-- Flane Corporation SiA--Coo Freight Elevstor 11)

I~rNRAI'DY'I%1 cks~unrySUN SRI DD C0,

ILNE
DY-lLLt 15~m 637 Mobil oil Tesker 125. 540(1WT km
41 Cyroxenir Energy [Nil Corrier 65,.IIOODWT personnel (Il 647
42 LNG Trsoapnei III 674 Ttemo O-ns Trultr RO/RO Slip 14.000DWT
46 t.iiqajis5 Truns I(- 44
"a shipe-got" Tanker t 14.244(1* kmr
44 Chor,'*- Ship oep. 125.00OCaM Il 60 Sln-
47 -II (1) 675 S3iWec.45 tO/Rto Ship 14.00(1*7
4" (11 474 Sun Testing & Miet- Tanker 30.4(* kmDT
e
.50 '(tI TODDSHI!PVARIISCORP(RATMD
53 toninun (ll U. R.eep Patrnl FIF07 CIA". PIN
54 Itttpe Do

27
(Pagc 28 Blank)
 G.O. THOMAS

er List for Marine Elevators and Dumbwaiters

=ur Li rb-t Ftis OiTHER SPECIAL LIENiATLRS "Dt L'UMBWAITEBS

SIntrio," ls LOtt-r trio- I TyW
Corp.i of t -11,i~
11-nern C- N. Ar., Sategord Site Fi-ght O
Destroyer DM6t/ Clari AnImoI.,ktor. Ifir North Dakota Pe W
A. phitiu I IiA I'lass Pirsnol I
C'sa.. Ahips UtSta N~v
Bostuonot Shipyards 1'. S. Nosy Boston NSY Worksnena His
...
Dia-esn 1193Coo Aos iate
Puollman Powoir Piroducts PenryLsasa New Catie. ChoUey Elevator I

It...rsion Missi..siPpi Peroon-i 31 ttomtuaitr. (2) Fii PownerCompany Pa.

Flu-t11t L-oIsoill Gab KoantadaiLe. Chiney Eleoator IL
Elrrtric Ky.

Oil Big Se.I- Proors 12t Catgutl. tn,. Portland.Or. Grain Processing
oubiteriti Plant Elevator

Xubmartre AS 39. 404&4t C.irgs E.tsr Grit - Manitowo Manitowoc, St-nine Elevator tL
rte~ri Dosh-Wit. 131 Engineering Wisc. for Ceas

Miods Shtipptng E. L. D.sPont Tug-Boaut Personnel Elevator iL

030 Carrier 500ittWT P-ru..nem-1
-- Vsl~ryMartinville. Tower Elevator IL
Tnsker 87. OOODWT Cootntos. -A Tests.

it .TVA Raccon Mountain Insprtlon Mantit

99. 700DWT i1) Storage Plantit

It) Corps o4 Engineer U2.S. Anny Garrison Dami Buck L Pinion Eltrs
11) Omaha

Li Ui-Eterrisa Mohil Shipping Geophysical Dumbhwaiter i

ill Vessel
Nkisahotwat Comnpany Sihealand Seir- Comnarship. Dlumbwsaiter. I t0t

Tartwr,, 138. OODWT Prrsionne i Bethlehem Steel I S. Navy Cable Ship Dounhwaitters (21

IS.SOWTI I McNally Pittsrg Grand Biver Pryor. Oklahtoma Coat Processing

itAuthority Plant Elevators 12)
LNG Csrier 65.SOOI2W1 Per-.-nr (1l it. S. Bureau of Grand CoaiLeeDarn Blech #APinion
li Brutsio Elevator i1l
VLCC 390, 77OWT Pe--n~I hctalty Pittsurg
M Midwest Mining Salinas County. Cost Lsnocessunp
:1,Illinois Plant Elevator (1l

Boat Chimney Din. Trnas Municipal Carioa. Texas Back & Pinion
Exii-P o.I4)Power Agency Chimnsey Eleoator 41)
Dame topein Bros. i.tS. Corps of Hlopper Dredge Dumbhatetr iL)
RU/RU Ship 4500 DWy SnoresDumbwraiter II Egner

Stirgent II lUndy Wiacosini Puhlin Wausauo.Wise. Back & Pinion

Sernice Chimney Elevator (1)

Tanker. 22ti.OOODWT P. rsonqiLIt Sma I

Peears2an0Ot itr-

Tanker II . ZMIDWl Persar II :UN1

NO/No ship 14. 90DWy (1)
TsAker 301000DWT Peesnativl (1 ILLwair
1

Petra PF(/t Clasa Pallet Elerators t17t

Frif DumbxtRer LI7)

27
(Page 28 Blank)

/-sFI Is
 NRL REPORT 8488

Front View
Showing Arrangement
of IC's

~ ~ Rear View
Showing Wire-Wrap
Interconnections

Fig, 10 - tinidvnamnics commercial TTL static logic controller

29
 G.O. THOMAS

back fitted as a replacement for the original Cutler Hammer equipment which used 440 VAC
throughout. Because of this ship modification, the STUMP has had both the highest and lowest vol-
tages on elevator sensor signal leads that are found in the fleet today; namely 440 VAC and 5 VDC.
Eventually it is planned to convert all ships of the SPRUANCE class to lower voltage controller sys-
tems. The controller aboard the STUMP had just been installed at the time of the visit and no
maintenance or operational experience data were available. A four day school on the controller had
been held aboard the ship by Unidynamics. This was supposed to be a one-time event.

Sensors used on the STUMP are standard Unidynamics with split-rubber boot covering to prevent
interference from sunlight, especially at the weather deck hatch level. Documentation was not
uncovered to show that the Unidynamics infrared sensor has passed MIL-Spec. radiation testing.

The controller aboard the STUMP is basically the same design as Unidynamics commercial con-
trollers. The system is 5 VDC TTL and is not isolated at sensor inputs. Outputs are optically coupled
to solid-state relays which drive the 115 VAC motor controller contactors. The solid-state relays are
made by International Rectifier. The motor controller, made by Cutler Hammer, drives the 440 VAC
elevator motor. The 5 VDC supply voltage is used throughout, including for the optical level-sensors,
the push buttons (which use the same optical sensors), and for mechanical interlock switches at the
doors.

On the USS STUMP, sensors are located on the elevator trunk and vanes on the platform, which
is opposite to Unidynamics general commercial practice. Continuous light sensors are used and there
have been problems already in connection with sunlight interference. Initially the vanes were painted
white. When the color was changed to black the problem appeared to be corrected. Consideration ws-
also given to the use of a threaded pipe to columniate the light. As on commercial controller,.Uni-
dynamics has installed 0.1 1 F capacitors on all inputs, to filter unwanted noise.

The controller on the STUMP is constructed using standard electronic modules (SEM). Standard
electronic modules are made by a variety of manufacturers to a high level of military specification and
certification (see MIL-N-28787A). Environmental tests are required for durability, humidity, thermal-
shock, shock, fungus, corrosion resistance, flammability, toxicity, and hydrogen atmosphere. Modules
can be ordered to Class I or Class Ii. Class II modules are subjected to more severe testing. Operating
environmental requirements consider operating temperature range. vibration, transient operating tem-
perature, and life testing. An indication of qualification requirements for SEM modules is given in
Table 4.

The significant advantages of using SEM modules will be discussed later- but at this time one
disadvantage mentioned by Unidynamics will be recorded. SEM modules frequently have! multiple
gates or flip-flops on the same card. In some cases it is necessary to use a card with six flip-flops on it
when only one is needed. Another comment by Unidynamics was that the present card box on the
STUMP is wire-wrapped at the back. They would like to make the entire card-box a plug-in on future
ships as an aid to trouble shooting.

A great advantage of using SEM modules was that Unidynamics was able to design into the con-
troller on the STUMP a mean-time-between-failure of one year. In this controller there are no lights
for testing in place but a test box is provided inside the controller cabinet with slots to take each key
code of SEM module used.

Recommendations for improvement to the strike-down elevator were offered by mates responsible
for the maintenance. They would like more lights indicating the position of the platform at all times.
The elevator is of the "send only" variety; a "call button would allow the platform to be moved around
more easily.

'i
30
 NRL REPORT 8488

Table 4 - Qualification Requirements for SEM Environmental Classes

OPERATING CLASS I CLASS II

FIN TE4PERATLR 06C 60C 59C 1250C

(FREQ CPS) AMPLITUDE IN,(FREQ CPS) (APLITLIE IN)

VIBRATION 5-33 .03-.01 5-2000 2DA t30g
PEAK
9,
2 SIN
RANDOM

NON OPERATING CLASS I CLASS II

OUIAELITY 500 CYCLES

HUJMIOITY MIL-ST-81O METHOD 507 PROC 1

THERMAL SHOCK -550C TO 85C -650C TO +125 0 C

SALT FOG MIL.STr-810 METHOD 509 PROC 1

MIL-STO-810 14IL-STD-810
SHOCK METHOD 516 PROC 1 IETHOD 516 PROC IV
_ SINE PtLSE FOR 11 ms AT 50 S _AWTO
T M10(. &2

FIJS MIL-STD-810 METHOD 508 PROC 1

Duty cycles on strike-down elevators are such that they are used about 3 h continuously each
week for maintenance checkout- at other times they are used about four or five times each week when
the ship is in port and about one or two times each week when the ship is at sea with no exercises.

US Elevator

The US Elevator Company is at the forefront of commercial elevator controller technology. In

the past they have provided the US Navy with many onboard elevator controllers. In the commercial
area the company now turns to microprocessors as a solution to most high-speed multi-level controller
systems. A single 20 cm x 42.5 cm printed circuit card using microprocessor-based circuits controls an
entire elevator system in Las Vegas [15]. Eight elevators and forty-eight landings are serviced in serial
time-division multiplexing over a two-wire system with Modem. This single wire pair replaces 100
signal-handling wires for each elevator car. The microprocessor used was the Fairchild F8, which is an
8 bit NMOS general purpose microprocessor. More recently the Intel 8085 microprocessor is being
used. Power supplies are 12 VDC for the coded serial digital data and 48 VDC for push buttons and
lights. Solenoids are either 220 VAC or 48 VDC. The controller is 5 VDC TTL. One microprocessor
is provided for each car, There is also an executive microprocessor.

This computing system is prepared to maximize elevator operation during up peaks and down
peaks. Decisions are made on which is the closest car and whether to send one or more cars to a par-
ticular landing. Microprocessor operation was selected for these complex elevator systems on the
grounds of cost, reliability, and fewer parts that can fail in service. For the commercial market US

31

it'.
 G.O. THOMAS

Elevator no longer uses light switches. A magnetic switch made by Maxton is used which is operated
by means of a steel vane.

A shipboard controller made by US Elevator was viewed on the AD-41 while this ship was under
construction at National Steel and Shipbuilding Co., San Diego. Elevator controllers on the AD-42 will
be similar. The controller enclosure says that the controller is static logic but, in fact, US Elevator
would' .call it a TTL synchronous machine. This controller effects digital switching using a form of
microprocessor made from lower level integrated circuits. The only reason a well-known standard
microprocessor was not used was because the controller designer could not find a MIL Spec. version of
a microprocessor at that time.

The controller uses a MIL Spec. tested integrated circuit called a Field Programmable Sequencer
(FPS). Sig~ietics has recently developed a similar special integrated circuit for elevator control
specifically called a sequential system controller. The controller on the AD-41 uses a slow-speed two-
phase clock (4 KHz).
Programming is achieved using read only memory (11ON0) Five different types of printed circuit
boards are used. Integrated circuits are soldered into the boards'. there are no sockets.

A shipboard tester will be provided to give a "GO" or "NO GO" determination at the board level
(not the chip level). The tester itself has one large printed circuit board about 37 cm by 15 cm. In per-
forming the test, the tester is aware specifically of where the problem exists on a particular board but
this information is not provided to the maintenance personnel since replacement of controller com-
ponents is at the board level. A variety of sensors are used in conjunction with this programmable con-
troller.

Overtravel limit switches are electromechanical wheel actuator type made by Cutler Hammer.
Safety switches (excluding door interlocks) are electromechanical plunger type made by Cutler Ham-
mer. Door interlocks are vane type proximity switches made by General Electric. Leveling sensors are
magnetic "GO" switches made by General Equipment Co.

The reason given for this perplexing variety of sensor types is that electromechanical safety
switches were called for in the specification. There was no good reason for using General Electric prox-
imity switches on the doors with "GO' proximity switches in the trunk.

The mounting of the leveling switches was considered too flimsy. Mounting brackets for the sen-
sor rail were 22.5 cm x 3.75 cm x 3 mm. Material 3 mm thick is too light for this application where
bending and corrosion could cause malfunction of the elevator.

CONTROLLER PHILOSOPHY

This section of the report summarizes contacts made with designers and manufacturers of con-
trollers and with controller design, trouble shooting and training personnel at naval shipyards and naval
research establishments. The discussions centered on lessons learned from past experiences with ship-
board controllers and recommendations for improved controllers of the future. The section begins with
a brief history and development of elevator control systems abstracted from a Puget Sound Naval Ship-
yard inter-shipyard memorandum by D. Osgood.

Historical Overview

Problems of' the old relay control systems were, (a) the relays were unreliable, (b) they would
stick, short out and require constant cleaning, replacing and adjusting of contacts, (c) the mechanical

32
 NRL REPORT 8488
switches would fail. (d) actuator arms would corrode, bend and break. (e) condensation would cause
short circuits and multiple grounds. Relays were placed in series/parallel circuits with multiple grounds
'~
causing elevator malfunctions which were responsible for casualties. Because of these problems, solid-
state controls replaced relay control systems. The solid-state controllers used solid-state proximity
switches that were potted and more suitable to the environment. The system, however, became more
complex.

Problems of the solid-state discrete-logic systems were. (a) extremely high cost. (b) there were
electrical noise problems (proximity switches would actuate due to interference and logic would mal-
function due to electrical noise). (c) maintainers found it difficult to troubleshoot due to the large
number of different kinds of modules. Wd it was found that the typical sailor could not understand
logic diagrams and special schools were set up. (e) although the logic diagrams were very complex they
did not provide all of the interlocks and functions required to interlock the main- and third-deck
hatches.

The programmable controller was the next type of controller used. This was more complex yet
again than the discrete logic type', but the number of modules was greatly reduced, while the controller
performed many additional interlock and trouble shooting functions. Switches in the elevator trunk
were replaced by a shaft-encoder and diode matrix which allowed monitoring of platform position
within 1.25 cm at any time of the elevator travel.

Problems of the programmable controller are, (a) complexity (with computer type operation using
registeiz!, communication busses, etc.. the sailor cannot find a bad signal and trace it to a problem). (b)
reliability (the controller is intrinsically highly reliable, however, when a failure does occur, the system
is usually down until outside assistance can be obtained), (c) isolation of fault input signals (inputs and
outputs have indicator lights but it is not easy to determine if the status is proper. This requires a
knowledge of the software program and how it functions; knowledge not normally possessed by the
ship's force).

Due to complaints about both static-state logic controllers and programmable logic controllers, and
also when the General Electric discrete logic controller on the USS DETROIT (AOE-4) could no longer
be supported and was in need of extensive repair, a miniature relay controller system was developed for
elevators on the USS CAMDEN (AOE-2).

Elevator Cybernetics

The control problem for a large weapons elevator is illustrated in Figs. I11and 12 taken from a
technical manual for the USS AMERICA (CVA-66). Although the word cybernetics has rarely been
used in connection with onboard elevator control, it can be seen that the control problem including
safety and condition monitoring is not insignificant. Stability of onboard elevator control systems in the
past has relied upon motor acceleration and brake deceleration factors and igeneral mechanical inertia of
the system.

The control technique usually used in these systems can be termed ad-hoc. To design for ad-hoc
logic control a specific set of logical requirements must be fulfilled before a particular enable or disable
command can be generated.

There are other more sophisticated techniques which could be considered (161 based upon linear
feedback servo-mechanisms and Nyquist stability criteria. J.R. Moore is credited with the idea of com-
bining closed-cycle control with open-cycle control. The so-called 'Moore Machine" uses a series con-
troller with open-cycle forward control and a parallel controller for feedback. The feedback loop is
designed for stability and dynamic response while the steady state operations are taken care of by the

33
 G.O. THOMAS

CCN INU 711* N2

To ~ . ~.-4"D"ja k

=4Q C)~J~ m SIA&tAUI

zm i"A %-T.- Az-_

0-" "01 I m AT f c.t Iosw p

z m W ai I A Xf ~
4 -f 4 7S , 0 C

4A 40 %fl -- CPA -L-. : r ~

M&..
xI"PA
I AT V* PLAT
%f'V~LZTMAU
01P-. ZOtt1 T4'- of 'o4,LV
. 1-1- i'LaAI
T , r . . I0A~~: 10" Q. 3t Z4 C P1 - 08 W

-,a~~-,C:v - e _7 1 01--Pu -Q a

L-.- e-~D%2L.i
TolCO"
C~ IA7W1~

- =-

L= CMjCOC C.C'

fC

zx !,1 r N 10' TO 4-0.

.~M I ~ 2iTo :.-Pk&1-

C-k; -
e ;,t oc'Czf V %

C3 002 0O-
X3 V..
C:Z*z I r-AZ
t) t ~_SO
-. ~r =a 3

C-. cc. 0 .TZ oe

N3.4

:.a "P. .0 Joe.

 NRL REPORT 8488

CONTINUATION________ 6 CFsgU.

731'-u
~ P~AC,~INoor S0IN

'rf UAA,'"1 ~~~~~~~~~~llo u 4'OaC?' ~

uO C.?C. o

4" 1C4.

Sy.Xlrcr Cvvf6&/%1fI.1

Fig. 12 -Emergency mode controls for large weapons-elevator on USS AMERICA (CVA.66)

35
 G.O. THOMAS

open-cycle portion. Another form of engineering control in which the output is a function of the
present state and the input is named for Miele. US Elevator uses "Mijele Machine" in all of its
microprocessor and other forms of dynamic programmable controller. This form of control was used
on the AD-41. Two clocks with different phases operate at 4 KHz. The input and present state is
checked at the pulse rise of the phase-one clock. Changes are made to the next state on the pulse rise
of the second clock.

Just how much sophistication is required in a shipboard elevator controller could be debated at
length. Elevators which use simple relay-ladder diagrams and static-logic operate quite satisfactorily.
Also, in most present systems, an error signal feedback (on leveling, for example) could not be used in
a closed loop analog servo system since most motor drives are at two fixed speeds. There are two
places in elevator control where some form of feedback is used at the present time. One is in the case
of variable speed doors on passenger elevators and the other is to assist in leveling of high-speed eleva-
tors.

Shipboard elevator speeds have been increasing over recent years. Why this is so is not entirely
clear, since the speed of the elevator Is not a significant part of the overall efficiency in a weapons load-
ing or replenishment operation. Since the ratio of high- to low-speed for elevator motors has been
fixed at 6:1 this increase in high speed has brought about a corresponding increase in leveling speed.
Cutler Hammer pointed out that on recent shipboard elevator designs this high leveling speed has been
hard to work with while still maintaining the shipboard requirement for leveling at 6.25 mm (:± 1/4
in.).

Largely because of this problem, recent elevators have used an automatic leveling feature whereby
when the platform slips through a level after brakes have been applied, the control logic senses this fact
and reverses (pulses) the elevator motor for a short duration of time to return the platform to within
the leveling tolerance. So long as the extra time necessary for automatic leveling is acceptable there is
probably no other solution which would be as straightforward. For cases where a certain amount of
automatic leveling time is objectionable and also where elevator speeds are extremely high, it is neces-
sary to develop a fully variable speed controller system similar to those being prototyped by US Eleva-
tor and the Reliance Elevator Company. When fully variable speed drives are used this, once again,
increases the complexity of the system and infliences the reliabifity, maintainability and training
requirements.

US Elevator implements its variable speed system in the following manner. A low-cost single-
speed AC motor is used (Lincoln or equtal). AC power is first rectified to DC. The DC is then re-
inverted into three-phase AC using pulse width modulation techniques and power FETs. Note that
switching is achieved with transistors and not silicon controlled rectifiers (SCRs). US Elevator said that
a study conducted for NASA by Kinematics Research Ltd. found SCR triacs not safe for use in
human-vehicle systems. The variable speed AC drive is achieved by controlling output power in
voltage and frequency. Volts per second change is maintained constant. Frequency can be varied
linearly with time from DC to 90 Hz. As frequency increases beyond 60 Hz the output voltage remains
constant at 440 VAC. As frequency is reduced below 60 Hz there is a corresponding linear reduction in
output voltage to zero vofes at DC. The objectives of this motor controller system are to develop con-
stant torque at low frequencies and constant horsepower at high frequencies. US Elevator claims 90%
efficiency with good power-factor for this conversion system. The great advantage of course is that it
achieves excellent speed feed-back. Bath GE and Westinghouse make power switching transistors ind
power Darlingtons. An alternative variable speed system design could also consider hydraulics.

Controller Alternatives

Controller alternatives will be discussed under titles which describe the technology involved: (a)
electromechanical and hybrid relays, (b) discrete logic. (c) programmable units. (d) all solid-state

36
 NRL REPORT 8488

CONTINUAXTION 5 '-6--C9z 3

II

*~ ~cwO
WI1NEISHOM
S pOI~t~4 9 p~j45al §4 ( M:LvL
7 0 CASaJ.)

O~ ~~~~PW4 1 "AO?.C
I1010ACLV~

olreweoneevor
2-Emrncmoeonrl
Fig.~~~~~~~~~~~~~~~~, o U.AERC CV-6
35 OGDW

Ckk .r
%mow.
ZV-4..r
 NRL REPORT 8488

relays. In rating the differing technologies the following factors were used, (a) reliability. (b) compata-
bility with items existing in the supply system, (c) supportability over a twenty-year life, (d) standardi-
zation, (e) maintainability, (f) safety including fail-safe, electromagnetic interference, and safety system
permissive. The safety requirements of operation in a hazardous environment will be considered later
in the report. Reliability calculations to MIL-HDBK-217C are summarized in a section which follows
the general discussion. Input signal conditioning from proximity switches, push buttons, etc., and out-
put drivers are treated differently in general by every designer and manufacturer. Because of this, these
subjects have been separated from the controller alternatives per se and are treated in the sections
which follow next.

Input Signal Conditioning

Methods employed to condition elevator input control signals are as follows. Unidynamics uses a
small capacitor at the input to TTL gates to filter high voltage spikes on the 5 VDC signal lead. There
is no signal voltage shifting. US Elevator uses 24 VDC on the proximity and other external switches.
They voltage-level shift and filter the signal for input to 5 VDC TTL gates as shown in Fig. 13. The
General Electric Directomnatic 11 input is level-shifted (through a resistance divider) and filtered as
shown in Fig. 14. Applying the proper voltage to the appropriate pin will make the normal output unity
and the inverse output zero and vice versa. The input signals are not self-supplied so that an open cir-
cuit input will be interpreted as zero. Additional external capacitor filtering can be added if required at
the terminal labeled CAP.

Most electromechanical relay systems have no level-shifting or filtering. Relay coils generally are
grounded at every relay. In this case it would be possible to obtain a degree of noise rejection provided
both coil leads were passed to the sensor as a shielded twisted pair. No manufacturers were found to
use common-mode rejection techniques for signal inputs despite evidence of high voltage spikes on sig-
nal leads. The preferred input is a differential device such as an opto-coupler, input transformer, coil.
or differential amplifier. A programmable standard electronic module controller is being developed by
Naval Weapons Support Center, Crane, Indiana which uses opto-couplers at the input. This approach is
recommended as being the preferred input, using twisted, shielded pairs for signal input and return.

Output Drivers

Most older controllers use power amplifiers for output drivers to solenoids, motor controller con-
tactors, etc. (sometimes via auxiliary relays). The output amplifier uses an emitter- follower or other
technique for amplifying power. Voltages are generally DC and may or may not be the same as logic
voltages.

More recent controllers are almost universally switching to solid-state relays similar to the ones
used by Puget Sound in their hybrid relay controller and made by Crydom. Naval Sea Support Center
personnel are also back-fitting older controllers with solid-state relay outputs when DC amplifier cards
are no longer serviceable.

Certain manufacturers in the industry, particularly US Elevator, are questioning whether this
move to opto-coupled output triacs is in the interest of safety. The NASA study mentioned earlier con-
cluded that silicone controlled rectifiers (SCRs) and triacs are not safe to use in human vehicle systems.
Triacs and SCRs have features which can cause unprogrammed turn-on. In one case there is a capaci-
tive coupling betw'f.en the input and the gate. Input line voltage spikes having a critical dv/dt can cause
the gate to turn on. Once the gate is turned on the triac can only be turned off when the output
current gots to zero. An AC output could therefore be turned on for 1/2 cycle. This normally should
not effect elevator output devices such as solenoids and motors. The idea of automatic turn-on of out-
put devices is disturbing, however. In the case of over-voltages the triac can also automatically turn on,
ie.. if line voltage transients exceed the peak voltage rating of the relay.

37
 G.O. THOMAS

if

(41WY-2.l/Ord%)

Fig. 13 - U.S. Elevator input signal condition circuit

I itNO*UT O PU

~ 5-0

-~

Ca C D
A 7- LIBA Byv Ov 1 0

Ov 12v 1 0
VCPO - D 8v 12v 1 0

Fig. 14 - General Electric Directomnatic 11input buffer

38
 NRL REPORT 8488

Extremely careful consideration should be given to a design using triac-based solid-state relays.
Buffers and filters may need to be provided for protecting against over-voltage and transient frequency.
(although some protection is usually built into the device) and, depending on the application, it may be
necessary to install heat sinks to dissipate heat generated at the SCR junction. None of the solid-state
relays used in controllers and seen during the visits had been procured to MIL Spec. testing (except for
Teledyne relays on the SEM programmable controller). There was also evidence in certain cases that
unusual occurrences in the form of unexplained starts and stops were happening to elevators that have
commercial solid-state relays. It is recommended that solid-state relays in the future be purchased to
N'IL-R-28750 which sets up requirements and tests to guard against malfunction of solid-state relays in
the naval vessel environment.

US Elevator is so concerned with this subject that it has decided not to use SCR based solid-state
relays or output triacs in the future on passenger elevators. When suitable transistors are available the
technique to be followed uses back-to-back field effect transistors (FETs) which have greater immunity
to noise and can drive either AC or DC output loads.

Another controversial topic related to commercial solid-state relays is that most varieties turn on
at zero voltage and, of course, turn off at zero current. When the output device is inductive such as a
solenoid or motor contactor coil, the zero-voltage turn-on feature results in a high current surge.
Although solid-state relays can handle current surges equal to ten times their rated current, they can
usually only withstand these surges for a limited number of times in the region of 100. To guarantee a
surge every time the relay is turned on shortens the relay life. Ways to avoid this are, (a) to use a ran-
dom turn-on relay (which will only occasionally surge current to inductive loads), (b) use a solid-state
relay that turns on at peak voltage, (c) monitor voltage and current at the controller and schedule turn
on to minimize current surges (most simply achieved through the use of a microprocessor). The
recommended technique between these three would depend upon the sophistication of the controller.

Electromechanical and Hybrid Controllers

Most older elevator controllers use electromechanical relays and many are still being built to this
day. Westinghouse Elevator Company is one firm that continues to make new relay controllers,
although they have also used solid-state transistor and dual-inline-plastic (DIP) technology on more
sophisticated equipment. A contact at Westinghouse stated that the Company had no standard elevator
controller. Each elevator manufactured used different controller technology and it was changing week
by week.

On the subject of whether AC or DC relays should be used it was found that most systems use
DC relays on the grounds of higher reliability. Voltages used in relay controllers vary widely.
Designers in general have no basic objection to AC or DC but most favor the use of lower voltages,
i.e., below 24 V for safety reasons.

In recent years a number of hybrid systems have been built which use electromechanical relays
for logic functions and solid-state relays for output drivers. Although readily maintainable, easy to
understand and having long-term supportability, relay systems do tend to have lower reliability than
solid-state equivalents and the particular relay controllers in mind made by Puget Sound Naval Shipyard
have not been in service for a sufficient length of time to account for teething problems in the system
or to gain operational experience data.

One basic problem in the use of relay controllers is contact chatter due to shock. Most relays
tested to MIL-S-901 do not suffer damage as the result of shock testing but change state during the pas-
sage of the shock pulse. Since large weapons elevators are so important to the mission and survivability
of an aircraft carrier it is desirable that elevators continue to function through standard shock trials, and
do not lose their memory or otherwise drop out, thereby requiring manual intervention.

.39

14
 G.O. THOMAS

The recommendation is made that controllers, and this applies to all controllers, should be made
transparent to short duration (20 ins) shock pulses. More will be said on this subject in the section
entitled Discussion and Recommendations.

Although many companies make commercial miniature electromechanical relays (including

Teledyne, Potter and Brumfield, T-Bar, Qinron, Magnecraft, North American Philips) there are very
few companies who make MIL Spec. tested relays that are suitable for the application. The recommen-
dation is made that relays that have not been MIL Spec. tested should not be used in elevator controll-
ers.

Two electromechanical relay standard electronic modules exist. One is a 10 DPDT key code RRF
and the other is a 5 DPDT key code RSP. They are in the Teledyne series 900. At the present time
these electromechanical relay SEM modules have not been used in elevator controller design.

One form of electromechanical device that could be used in a controller system is the reed relay.
Discussions with Western Electric Inc. on methods for switching telephone circuits revealed that ferrite
reed contacts are widely used as logic switches in telephone systems. There are many manufacturers of
commercial reed relays and they come in just as many different packages.

Compared to standard solid-state logic devices reed relays offer better isolation between coil and
switch circuits, better dielectric strength between contacts, longer life and greater reliability [171. The
best relays can require less than 100 mW of coil driving power and switch in less than one ins. Break-
down voltages for unpressurized miniature reed switches is 300 to 400 VDC. For higher voltage appli-
* cations (up to 2000 VDC) the switch atmosphere is pressurized to IO 5Pa (6 atm). There can be elec-
trostatic attraction between blades, however, at high voltages and high frequencies. This attraction
* causes vibrations and, at resonant frequencies, the voltage hold-off is reduced and arcing can occur.

In relays for low-level switching, films may form on the surface of the contacts. A 10 to 15 V sig-
nal can punch through the polymer surface film, but the surface can appear open at lower voltage lev-
els. Polymer films will generally form on relay contacts within the first few million operations. One
problem related to the contact plating is that spontaneous cold weld or stick frequently occurs after
about ten million operations at frequencies below 10 Hz. There is always low-level noise present in the
millivolt region caused by the bi-metallic active junction.

Shock and vibration standards are particularly difficult to meet for reed relays but a successful
controller design may be possible with proper attention to time delays and use of sample and hold cir-
cuits.

Another form of mechanical relay uses mercury as the element that is attracted. Although some
relays using mercury have inclination limitations the most recent mercury relays make use of surface
tension and can be operated in any position. Me rcury relays will be considered no further in this report
since the use of mercury in shipboard equipment is banned. except for special case-by-case approval,
under MIL-E-17807B.

In conclusion on electromechanical relay controllers, it was found that there was much support
among shipyard and support center personnel for relay logic controllers and, in particular, the Puget
Sound Controller experiment was enthusiastically received.

Discrete Logic Controllers

Discrete or static-logic controllers were discussed at the Naval Sea Support Centers, Naval Ship-
yards and ai industrial plants. Alternatives for static logic systems are to use diode and transistor logic

40
 NRL REPORT 8488

(DTL), integrated transistor transistor logic (TTL), complimentary metal-oxide-silicone logic (CMOS),
and standard electronic module elementary logic functions (SEM).

A summary of comments by shipyard and support center personnel is as follows. They were
unanimous in agreeing that simple logic systems were preferred. One recommended solution was to
develop a controller based on the Cutler Hammer model with the following modifications: (a) use TTL
dual inline plastic (DIP) integrated circuits, (b) use solid-state relays for solenoid drivers. (c) use sen-
sors with positive non-adjustable on/off characteristics and test circuits similar to ELDEC. The design
of inputs to withstand high transients is absolutely necessary. Switching in power lines z:auses very high
power current di/dt. Transient voltages on signal cables have been measured as high as 1000 V. The
consensus on signal voltages was that they should all be above 15 V. Lower voltage systems tend to
have more problems for one reason or another.

The support centers have noticed that ships with the same kind of controllers frequently have
greatly differing experiences in maintaining them. In particular the USS EISENHOWER which has
Cutler Hammer Controllers and the FORRESTAL which has PDP-14 controllers have experienced
fewer problems than others in the same classes. This is clearly a function of the training and motiva-
tion of maintenance personnel and the attitude of officers and general ship's crew morale.

While aboard the USS NIMITZ the writer abstracted from notes written by an elevator mainte-
nance electrician (Appendix E). This Appendix gives a good indication of the status of many elevators
aboard the major aircraft carriers. Appendix F records comments made by electricians mates following
a weapons elevator inspection aboard the USS NIMITZ. The statement, made in this Appendix can not
be overemphasized.

Turning now to discussions with the elevator controller contractors, the first attitude statement
comes from General Electric Control Division, Salem, Virginia. The GE Control Division designed
and built Directomatic II. A senior executive of the company stated that since the Navy wanted only a
small production run they could not keep the design and manufacturing group together and was forced
to let them go. The subject is still a very sore point with company management and the chief engineer
would love to get back into the shipboard elevator controller business; but company policy is not to
respond. The senior executive felt that, in any event, it would be hard to make a comeback since they
were now so far behind the competition.

Contacts at Westinghouse Elevator Company Inc. referred to their efforts with integrated circuits.
They are primarily using basic logic TTL integrated circuits at the present time. CMOS pilot projects
were introduced but were abandoned.

At Cutler Hammer it was found that they were building static-logic controllers for use in industry
using both TTL and diode transistor logic (DTL). They have a CMOS programmable controller which
has found application in oil refineries and other industries. Cutler Hammer would consider using mili-
tarized CMOS in ceramic packages for future static-logic Navy elevator controllers.

In the new ladder-static-logic (LSL) system lights are used once more for trouble shooting with
the lights of interest being selectable by a switch. Output is 24 VDC through triacs, reeds or solid-state
relays.

The people at Unidynamics Inc. are riding a success story with their TTL controller using all
NAND gates and inverters. They have installed elevators on five classes of Navy ships and seven
classes of commercial ships as well as aboard the CONDEEP Oil Drilling Platform on location in the
Norwegian sector of the North Sea. They specialize in elevators designed for use in hazardous environ-
ments which will be discussed later. They have no developmental or prototype controllers under

41
L "-i.
 0.0. THOMAS

evaluation and plan to make no changes to their controller technology at this time. All Unidynamics
elevators are of the one-callI-at-a- time type, i.e., the elevator completes one command before a second
call is accepted.

Programmable Units

A feasibility study was conducted by M. Rosenblatt & Son, Inc. in 1977 on the subject of aircraft
carrier weapons elevator split-hatch control [181. This study found that the only significant difference
between static-logic and programmable-logic was in the level of training required for understanding, and
therefore trouble-shooting. It was found that since the static-logic controller was somewhat more analo-
gous to conventional relay logic, it was more likely to be understood by personnel trained to service
electro-mechanical systems. The programmable system would require some knowledge of computer-
type controls and a great understanding of their control logic.

This same sentiment was re-echoed in a report issued by Hunters Point Naval Shipyard [191. The
Hunters Point report addressed problems on the USS RANGER which uses PDP-14 controllers on the
major weapons elevators. This report stated that maintenance of the newer elevator controller systems
has become complex with the introduction of static-logic control and programmable machine control.
Since electricians are responsible for maintaining these complex electronics systems, there is a training
gap. In addition, some of the fail-safe features are very confusing, especially the cycling of doors which
must be performed prior to new dispatches.

To illustrate the complexity of a program mable-logic controller, Appendix G has been extracted
from a technical manual for the USS INDEPENDENCE (CV-62). Figures mentioned in Appendix G
can be found in the original technical manual-they were not reproduced here.

There are some AC and some DC inputs to the controller. Direct current inputs from the prox-
imity switches are at 28 V. Outputs are via solid-state intermediate relays to handle the large inrush
currents required by the motor contactor solenoids.

Of particular interest is the list of timer functions which is unique to this form of elevator con-
troller. To extract two timing functions at random, if a hatch does not open or close in 35 s, or a lock-
bar lock or unlock in 5 s, the controller shuts down automatically. To an electrician looking for an
elevator problem it is often hard to understand that wear in hydraulic cylinders, which slows down the
speed of operation of a hatch, can be the cause of the malfunction.

Another unique feature of this elevator system is the encoder subsystem comprising the encoder
interface unit, power supply. nixie tube display, equality detector, comparator, matrix driver, and diode
matrix pin board. Although it reduces the number of sensors in the elevator shaft, the encoder subsys-
tem presents new experiences for the electrician by using technology which is beyond his training and
by having failure modes which are extremely difficult to track down to the encoder. The present
encoder is of the printed circuit board type. A fault relating to the brushes and printed circuit traces
can take two or three days to locate using simple equipment, in the author's personal experience. More
reliable encoders are now available. It is recommended that consideration be given to using optical
encoders when printed circuit board encoders are replaced.

The PDP-14 control unit itself is entirely commercial. Plastic DIP integrated circuits are used and
there is no testing to military shock and vibration specifications of the unit itself. To meet shock and
vibration requirements the unit is supported by flexible isolators. This is not the preferred route to take
if it can be avoided. In the vibration standard MIL-STD-167. testing is required to establish resonant
frequencies and the unit vibrated at those resonant frequencies for two hours. Since all flexible mounts
have resonance frequencies, despite damping which may be present, mountings designed to enable
equipment to pass the shock requirements frequently run into difficulties during the vibration tests.

42

414 '4
 NRL REPORT 8488

The preferred method is to design the equipment itself to withstand shock and vibration requirements
of the building specifications.

In programmable controllers there are four principal directions, (a) commercial controllers, (b)
commercial microprocessors, (c) a microprocessor built entirely from NAND gates in the form of
small-scale integrated circuits, (d) standard electronic module controllers.

Commercial controllers which have been used, and the standard electronic module controller, will
be discussed more fully in the next section on potential shipboard controllers. Remarks below on the
different types of programmable units are intended to be more in the nature of general comments based
on the visits and contacts.

(a) Commercial Controllers

The dividing line between commercial programmable controllers, microcomputers and micropro-
cessors is becoming blurred sinct the industrial controllers utilize commercial microcomputers or
microprocessors and some microprocessor integrated circuits have controller output architecture. A
recent article in Electronic Design Magazine [20J lists 109 single-board microcomputer systems and 107
microcomputer operating systems which could all be applied to the elevator controller problem.

From this list of logical unit manufacturers, contact was made with Digital Equipment Corporation
(DEC) because of their previous relationship with the PDP-14 elevator controller systems. Obsoles-
cence, provisioning and long-term support was discussed for company products. It was asked why new
technology could not be incorporated in such a manner that board size and pin compatibility was main-
tained. The name given to this interchangeability of technology is technical insertion. Corporate policy
of DEC is to not design for technical insertion in order to promote the market for new products. Sup-
port for five years is the maximum they would agree to with possible provisioning for ten years. This
attitude towards fast depreciation and renewal of equipment was found to be common throughout all
commercial logical unit and controller manufacturers. Military versions of DEC equipment are
manufactured by Norden. Supportability of this equipment after ten years will most likely be depen-
dent upon the initial stocking of parts. No commercial programmable controller system can be
expected to meet the twenty year supportability requirement of this study.

(b) Commercial Microprocessors

The market in microprocessor development has bloomed in recent years to the extent where an
article in Electronic Design [21] can review over 104 different processors. Many general-purpose
microprocessors are reviewed in addition. Nineteen companies are now making all-in-one processors in
a variety of technologies including NMOS, PNIOS and CMOS. Companies which have been considering
microprocessors for elevator control in addition to US Elevator include Westinghouse and Otis.

Westinghouse has been considering microprocessors for the control of high-speed gearless systems
aiming at the market 18 mo from now. The Westinghouse contaL said that in selecting the production
microprocessor it would be necessary to locate a locked-in supplier of the microprocessor for 40 years.
This will be no easy task. Discussions with the chief Of. 7esearch at Otis determined that they also were
considering the use of microprocessors for elevator con.ollers. The principal advantages of employing
microprocessors were cheapness in initial cost and the use of less space. It was recommended that for
shipboard use the Navy should stay away from highly sophisticated systems and keep elements easily
understood and maintainable.

One application of a microprocessor used to control elevators is given in Digital Design Magazine
[221. A conceptualized design is described for a 13 level elevator using a Motorola 6800 microprocessor

43
 G.O. THOMAS

with 1024 bytes of ROM and 128 bytes of RAM. There are four stages of shift register. Buttons are
accompanied by an LED indicator which is used by the microprocessor to acknowledge. Doors are
operated manually by the passengers.

In the control algorithm, the car stops to answer both car-stop requests and car-call requests
registered in the car direction of travel, in floor sequence. When no more requests of either type are
registered in the direction ahead of the car, the car moves to the furthest floor at which a car call for
traveling in the opposite direction is registered (if any), reverses its direction of travel and starts
answering calls in the new direction.

(c) Microprocessors Built Entirely From Small-Scale Integrated Circuits

This technique was suggested by designers at US Elevator as a means for overcoming the obsoles-
cence of present microprocessors while still retaining the sophistication and flexibility of a dynamically
programmed controller. Only two active component types would be necessary in such a system: the 741
operational amplifier and the TTL 7400 quad 2- input NAND gate. Such a controller would be much
larger than a microprocessor controller but would be far easier to trouble-shoot and the logistics burden
in the supply system would be kept to a minimum. Suitable wire-wrap boards which could be usea with
this fabricated microprocessor are manufactured by Standard Logic Inc. Two power supplies would still
be used: one for logic and the other for sensors and external commands.

(d) SEM Controllers

A logical extension of the standard electronic module program is to develop a programmable con-
troller built from SEM modules. Such a controller has been developed by the Naval Weapons Support
Center, Crane, Indiana, and is presently being evaluated aboard the aircraft carrier USS KITTY HAWK
(CVA-63) on lower-stage elevator number 3.

Great care was taken in the design and assembly of the SEM controller to ensure that all com-
ponents and assemblies meet relevant military specifications such as MIL-N-38510 for microcircuits and
MIL-E-16400 for other testing of electronic equipment. Proper isolation of input and output was
achieved using optically coupled devices, front end rectification, and capacitive filtering for noise. An
earlier SEM version of the PDP-14 also was evaluated aboard the KITTY HAWK.

All Solid-State Relay Controllers

One alternative for fabrication of the logic controller is to use integrated circuits in the form of
CMOS or TTL analog switches. The logic unit could also be made entirely of opto-couplers. When the
components of the controller have been selected they could be established as SEM units and thereby
take advantage of the SEM qualified products list. Such SEM modules could be developed for both
logic and power solid-state relays. Analog switches in integrated circuit form are a recent addition to
the electronic product line but are now made by a number of major companies including Intersil.
Harris, PMI and Siliconix. Manufacturing technology of the circuits varies between the manufacturers
but many components are, or can be, made interchangeable.

In the case of opto-couplers a number of industry standards exist and many manufacturers are in
the area such as Motorola, General Electric, Optron, Fairchild, Monsanto/General Instruments,
Honeywell/Spectronics, and Theta-J. Opto-couplers are provided with a variety of outputs including
Triacs, SCR, bipolar junction and field-effect-transistor. They have LEDs or other light emitting
sources at the input.

Miniature printed circuit board opto-coupled solid-state relays featuring MOS outputs generally
have advantages over triacs by virtue of having greater immunity to voltage rate effect thus eliminating

44

,.S~... - ---
 NRL REPORT 8488

RC snubbers. They generally are more immune to high-temperature latch-up and varieties are
manufactured that will not turn on under 25 s thus eliminating much radio frequency interfetence.
Excessive instantaneous dissipation cannot cause runaway as with bipolar transistor products, since out-
put current is controlled by gate current and current surges are prevented.

In addition to switching applications opto-isolators can be used as differential amplifiers and are
ideal for logic interfacing [231. Opto-devices can isolate different voltage levels, prevent interference
between control circuits and the power circuits, insulate people or low voltage circuits from high voltage
shock, eliminate DC ground loops, amplify or attenuate signals, in addition to performing on-off
switching. Basically all devices incorporate an infrared emitter and use two LEDs in parallel for AC
applications. The output, which is generally a photo-SCR or silicon photo-transistor, sometimes in Dar-
lington formation, can also be a photodiode with Schmidt trigger integral to the integrated circuit pro-
viding a TTL compatible interface.

A number of commercial manufacturers make solid-state relays suitable for controller output
currents in the 10 A range and having life cycles to failure of about 107 operations. The companies
include Crydom, Douglas Randall, Elec-trol, Electromatic, Electronic Instrument and Speciality Cor-
poration, Gordos, Grayhill, Guardian California, Hamlin, Magnecraft, Omron, Potter and Brumfield,
Teledyne, and Theta-J. Solid-state timers and delay pull-in and drop-out relays are manufactured by
Omron and Artisan Electronics among others.

Some of the manufacturers' products are tested to MIL-STD-202 for shock and vibration but, in
general, solid-state relays available commercially do not meet the requirements of a full MIL-SPEC
testing program. For example, testing to MIL-R-28750A for transient voltage and voltage spikes is
rarely mentioned in manufacturer's literature. Because of this, the advantages of developing logic or
output solid-state relay modules under the SEM program cannot be over-emphasized. In the case of
the all solid-state relay controller the use of SEM modules also simplifies logistics support requirements,
provides flexible intra-module packaging requirements, achieves a coordinated maintenance policy, and
ensures high reliability though quality assurance requirements [24].

Because of rapid obsolescence of electronic technology, maintenance aboard ships generally is

effected at the component level. This would seem to discourage the use of throw-away cards, with con-
centration on components expected to be available for 20 years. Nevertheless there is much to recom-
mend the use of items from the standard electronic modules listing, since these items, although stand-
ardized at the electronic function level, are procured in such a way from multiple sources that they
have a potential availability and survivability for 20 years.

Controller Reliability and Other Selection Criteria

Controller selection criteria include reliability, maintainability, supportability, standardization.

training needs, ability to meet military specifications and life-cycle costs. This section deals mostly with
reliability since other items are rather nebulous to evaluate and involve qualitative judgments on the
part of the writer.

Reliability and maintainability are two items (involving one which is easy to assess and one which
is numerically difficult) which should be considered together. If a system is low in reliability but can be
repaired easily and quickly. with parts readily available, then the total availability of the system can be
optimized at lower reliability.

Commonly used terminology in this section includes mean-cycles between failure (MCBF),
mean-time between failure (MTBF) and mean-time to repair (MTTR). In terms of these factors total
casualties (N) - time/MTBF, and down-time - MTTR x N. These equations neglect much of the
composition of up- and down-time, which can be better appreciated by examining Table 5. Reliability

45

................................................
 G.O. THOMAS

Table 5 - Composition of Elevator Controller Up- and Down-Time

Supportability Lifetime
Availability up-time I ____ Downtime
Standby time Operational time ______ ________ _____

Preventive- System Light Heavy Problem Obtaining Repair Recalibration

maintenance time ready duty duty diagnosis ordering parts time and post-
time period period (fault (supply delays) repair
(Dockside) (sea isolation) testing
I ~exercises)I

calculations were performed in detail for certain types of controller/ sensors subsystem, to the parts-
count prediction model described in MIL-HDBK-217C (Appendix C).

This model generally uses the component failure rate per 106h as the basis of calculation. When
part failure rate can be considered constant over the time period of interest the exponential function
permits the addition of failure rates for series elements. In the present calculation, to make results
more realistic in the opinion of the writer, failure rates on elements which are cycle sensitive such as
push-buttons and electromechanical relays were calculated on the basis of cycle rate as described under
the part-stress analysis model of MIL-HDBK-217.

Duty cycle information used for elevators was as follows. An average of 24,000 dispatches per
year or 612 running hours per year per elevator was calculated from information given on in-port active
and inactive periods and at-sea exercise and non-operational periods. This information results in aver-
age cycle rates of six cycles per hour being used for relays and three cycles per hour for push-buttons.

Reliability data for cycle-sensitive components are summarized in Table 6. Reliability data for
other components, which are assumed to be time-sensitive, are taken from MIL-HDBK-2 17 for naval
sheltered environment (NS) and listed in Table 7.

Table 6 - Reliability Data for Cycle-Sensitive Components

Part category Failure rate Failures/ million hours Cycles
per
MIL-STD Commercial hour
Relays logic 6PbT 17.400 104.20 6
Relays logic SPDT 3.800 22.80 6
Relays contactor SPDT 1.080 9.77 6
(5-20 amp)
Relays time delay 3.88 est. 25.60 est. 6
Push-buttons (non snap) 0.150 2.293
Solenoid valve 1.0 est. 9.0 est.
Alarm Bell 1.0 est. 9.0 est.____

Under the parts count method of computing reliability, cumulative failure rates are obtained by
summing for all parts catagories the number of parts multiplied by the failure rate for each parts
category. Quality factors have already been incorporated into Tables 6 and 7 to differentiate between
commercial and MIL-STD reliability.

46
 NRL REPORT 8488

Table 7 - Reliability Data for Time Sensitive Components

Failure rate Failures/million hours
Part Category
MIL-STD Commercial
Digital IC 4 gate TTL 0.046 6.97 Hermetic 13.95 Plastic
Digital IC 40 gate TTL 0.085 12.75 Hermetic 25.50 Plastic
Digital IC 400 gate TTL 0.245 36.75 Hermetic 73.50 Plastic
Digital IC 4000 gate TTL 16.500 2475.00 Hermetic 4950.00 Plastic
ROM 2K bytes TTL 0.205 30.75 Hermetic 61.50 Plastic
RAM 2K bytes TTL 0.720 108.00 Hermetic 216.00 Plastic
Digital IC 4 gate MOS 0.070 10.50 Hermetic 21.00 Plastic
Digital IC 40 gate MOS 0.215 32.25 Hermetic 64.50 Plastic
Digital IC 400 gate MOS 0.850 127.50 Hermetic 255.00 Plastic
Digital IC 4000 gate MOS 64.000 9600.00 Hermetic 19200.00 Plastic
ROM 2K bytes MOS 0.750 112.50 Hermetic 225.00 Plastic
RAM 2K bytes MOS 2.625 393.75 Hermetic 787.50 Plastic
Linear < 32 transistors 0.080 12.00 Hermetic 24.00 Plastic
Linear 33-100 transistors 0.175 26.25 Hermetic 52.50 Plastic
Transistors Si NPN 0.026 2.60
Transistors Si PNP 0.041 4.10
Diodes 0.009 0.09
Zener diodes 0.022 2.20
LED 0.050 4.50
Thyristers 0.040 4.00
Resistors 0.026 0.08
Variable resistors 4.800 14.40
Capacitors 0.029 0.09
Variable Capacitors 4.200 12.60
Electrolytic capacitors 0.960 2.88
Transformer audio 0.034 0.10
Transformer RF 0.140 0.42
Transformer power 0.130 0.39
Coils RF 0.010 0.03
Connections per pair 0.053 0.16
PC Board (2 sides) 0.005 0.005
Fuses 0.1 0.1
Lamps neon 0.2 0.2
Lamps incandescant 1.0 1.0
Circuit breakers 2.0 2.0
Meters 10.0 10.0
Connections:
Wire wrap 0.0000075 0.0000075
Wave solder 0.00043 0.00043
Hand solder 0.0078 0.0078
Crimp 0.00078 0.00078

47

I •,A.. ... .. .
 G.O.THOMAS

Calculated reliabidities for assemblies, such as solid-state relays, power supply, and a variety of
sensors and common subassemblies are presented in Table 8. Controller system common sensor and
elements selected for further study included 74 push buttons, 80 indicator lights, three safety elec-
tromechanical limit switches, 60 eddy current proximity switches, 18 solenoid valves and one alarm
bell.

Calculated reliabilities for a variety of controller/sensor subsystem types are shown in Table 9.
Reliability of the common elements including the sensors is significant in all cases and can actually
dominate in the case of the programmable controller. The controller types fit into three reliability
groupings. Electromechanical relay and hybrid relay controllers have about the same reliability which is
lower than discrete logic and programmable controllers which also have about the same reliability. All-
solid-state relay controllers fall in between in both reliability and ease of maintenance. The large
difference between MIL-STD and commercial mean-time-between-failure emphasizes the liability of
using commercial components aboard Navy ships.

The question now arises (relating to reliability) on how much an elevator system can be con-
sidered redundant. If people are always available to make repairs and repairs do not interfere with the
operation of the ship, then calculated mean-time-between-failure is meaningless. Availability can be
calculated from the relationship MTBF/(MTBF + MTTR). If failed controller components can be
manually replaced quickly then the reliability approach is that of a redundant system with component
reliabilities in parallel. A study of the reliability of components and systems in parallel has been made
by Feller [251.

For a total of N nonidentical systems in parallel each with availability A,, A, etc., the availability
of at least K systems can be obtained from the following formula for overall availability A.
A = CKKS(K) + CK.K11 S(K + I) + CKx +2 S(K + 2) + + CK.. S (N)

where
(_ l)IK +.v1(N-I)!
K.V= (N- K)! (K- )!
S(l) - AI + A, + A 3 + + A.v

S(2) - A 1A 2 + AIA 3 + + AjA v + AAj + +

S(N) - AA 2A 3 ...A.v
K must be less than N.

To take a simple example, when three parallel systems all have equal availability of 0.75 and only
one must function for successful operation, then k - I, N = 3, and A I - A 2 = A 3 = 0.75. The
overall availability A of any one from the three is 0.984. This parallel availability can be achieved either
by the provision of actual duplicate elements and automatic failure sensing or through manual interven-
tion provided the mean-time-to-repair is short. It also shows that simple systems with lower reliability
in Table 9 are not necessarily those with lower availability.

Taking into account all of the rating factors, Table 10 was compiled as an overall evaluation of
controller types. In Table 10, the relative strengths under the column Life-cycle Costs were taken from
the controller study evaluation summary by Cox f261.

Although the values in Table 10 are extremely qualitative, it is felt that they represent a true
reflection of the relative merit in selecting each type of elevator controller. Although the all solid-state
relay controller system came out on top, there is little to choose between any of the controller types

48

a . ))1 '
 NRL REPORT 8488

Table 8 - Calculated Reliabilities for Assemblies

and Common Subassemblies

Assembly or Failure rate Failures/million hours

Subassembly MIL-STD Commercial
Solid-state logic relay 6PDT 2.70 164.00 plastic
4 resistors 2.56 without LED's 92.00 hermetic
4 capacitors 79.10 hermetic without LED's
3 LED indicators
6 linear
I diode
100 connections
Solid-state output relay SPST 1.0 44.30
(zero volts turn on)
I LED
I thyristor
5 capacitors
I varistor
4 resistors
1 photo transistor
I digital
2 linear
connections
Solid-state output relay SPST 0.21 13.00
(random turn on)
I LED
2 thyristors
2 capacitors
1 resistor
connections
Variable reluctance ([C) 1.93 127.00 TTL plastic
proximity switch
2 coils
11 resistors
4 linear
6 capacitors
2 digital IC
1 PCB
100 connections

Table continues

49
 G.O.THOMAS

Table 8 - Calculated Reliabilities for Assemblies

and Common Subassemblies (Concluded)
Assembly or Failure rate
__________ Failures/million hours
______________

Subassembly MIL-STD Commercial

Eddy current (IC) 0.42 70.00 MOS plastic
proximity switch
2 resistors
Icoil
2 capacitors
1 MSI IC
I transistor
I zener diode
PCB
connections
Variable reluctance 8.10 42.4
(discrete components)
proximity switch
1 variable resistance
26 resistors
10 capacitors
6 transistors
I lamp incandescent
5 diodes
I zener diode
I transformer
3 coils
1 PCB
100 connections
Power supply 4.75 13.2
1 transformer
4 capacitors
10 resistors
40 soldering joints
10 crimping joints
2 fuses
Controller system sensor and 147.30 4695.00
common elements:
74 push buttons
80 indicator lights
(tungsten)
3 EM safety limit switches
60 proximity switches
(eddy current)
18 solenoid valves
I alarm bell

50
!N
 NRL REPORT 8488

Table 9 - Calculated Reliabilities for Controller/Sensor Subsystem

Controller - Controller Failure rate I MTBF
only Failures/million hours
Logic controller System - sensor and I______
other common elements MIL-STD Cormercial MIL-STD Commercial
_ plus controller Months Days
Electro-mechanical relay controller Controller 922.6 5567 1.5 7
48 6PDT relays System 1070.0 10262 1.3 4
2 time delay relays
4 output SPDT relays
I power supply I
18 solenoid driver relays I i I
100 solder joints 4
Hybrid relay controller Controller 870.5 6040 1.6 7
48 6PDT relays System 1018 10735 1.4 4
2 time delay relays SPDT
4 output SS relays SPDT
I power supply
18 solenoid driver SSR relays
100 solder connections
All solid-state relay controller Controller 155.5 1 4943 89 8
50 6PDT relays System 302.8 9638 4.6 4
4 output SSR's
I power supply I
18 solenoid driver SSR's
100 solder connections
Discrete logic controller Controller 31.4 TTL 1 1657 TTL Hermetic 44.2 25
96 4 gate digital IC Controller J 2327 TTL Plastic is
4 output SSR's Controller 33.7 MOS 3003 MOS Plastic 41.2 14
18 solenoid driver SSR's System 183.7 TTL 6352 TTL Hermetic 7,8 6
I power supply System 7022 TTL Plastic 6
640 wave solder System 181.0 MOS 7698 MOS Plastic 7.7
Programmable controller
I 4000 gate digital IC Controller 47.1 TTL 3949 TTL Hermetic 29.5 10
3 2K byte ROM Controller 6909 TTL Plastic 6
10buffe
32Kbyte RMsystem
RAM System 0 TTL
194.4 TTL I 8644 T Hermetic
ls~ 7.1 S
10 buffers System 14TLPasi4
4 output SSR's 1
18 solenoid driver SSR's
I power supply
wave solder

51
Sl4
 G.O. THOMAS

Table 10 - Overall Evaluation of Controller Types

Rating factors Totals (assuming

Logic controller type
Reliability Maintainability Supportability Standardization Training Military spec. Life cycle costs eallfacto carry
all factors

test results (from Cox)

MIL-STD
Electromechanical relay 2 5 5 5 5 3 5 30
Hybrid relay 2 5 5 5 5 4 5 31
Discrete loglic relay
All solid-state 45 43 5
5 5
5 43 55 34 31
29

Programmable 5 2 5 5 2 5 2 26
COMMERCIAL
Electromechanical relay 1 5 5 5 5 2 4 27
Hybrid relay 1 5 5 4 5 2 4 26
All solid-state relay I4 3 3 4 3 3 21
Discrete logic L 3 2 3 3 4 21
Programmable 1 2 1 1 2 4 1 12
I - Low
2 - Medium to Low
3 - Medium
t4 - Medium to High
5- High

52

'a
- .kK ~,
 NRL REPORT 8488

evaluated. This final evaluation still reflects the advantage of using MIL-STD quality in preference to
commercial.

POTENTIAL SHIPBOARD CONTROLLERS

In this section, established commercial controllers and the SEM controller will be presented in
more detail with some comments on other types. A list of manufacturing companies consulted in con-
nection with control systems is given in Appendix H.

In looking at commercial sytems, evidence was collected which would fit in with the existing rat-
ing criteria used elsewhere in this report i.e., to maximize reliability, maintainability, equipment suppor-
tability, standarization, fail-safe or fail-soft operation, and explosion-proof operation. Other factors con-
sidered included human interface problems and overall life-cycle cost. Particular attention was paid to
trouble-shooting aids for fault isolation and detection.

The present line of Cutler Hammer products includes the Ladder Static Logic (LSL) controller
and the D120 programmable controller. The LSL system is an outgrowth of the older Cutler Hammer
static logic systems; but modules are more closely identified with relay functions. A front view of a
typical LSL control panel is shown in Fig. 15.

Standard logic boards are provided such as normally open contacts (8 pairs per board), normally
closed contacts (8 pairs per board), timer coil (4 per board), latch coil (4 per board), control coil (12
per board), monitor driver, master control and output driver. Inputs, outputs and coil functions are
monitored by means of lights. LEDs are used for logic monitoring and neon lights for external high-
voltage monitoring. Power supplies are 5 VDC and 24 VDC. Limit switch-es and solenoids operate on
24 VDC. The boards have keyed sockets to eliminate the chance of error. Switch outputs are by
means of power-reed.

The D120 programmable controller uses relay logic to the outside world by means of a ladder
diagram with only three instructions. Printed circuit boards are provided for the 6 V power supply,
memory, control, 115 VAC input (10-2 mA per board), 115 VAC output (10-2 A/10 A inrush per
board), timer (5 per board, 0.05-250 s), latch (5 per board), stepper (10 steps), flow sequencer, and
filler blank board.

The programmable controller uses CMOS logic. The random access memory (RAM) has a back-
up pack to maintain memory for 30 days during power outage. Programmable read only memory
(PROM) which is also used will maintain memory indefinitely. The system is modular and can accom-
modate special functions as required. Up to 1000 words of RAM or PROM memory are available
which permits up to 400 relay coil equivalences with no limit on contacts and 400 input/output devices.

The equipment is designed for high industry environmental standards without special ventilation
or cooling. It meets the 1500 V showering arc noise test for NEMA noise immunity specification
ICS3-304. There is only 0.1 A dissipated per chassis at 115 VAC 50/60 Hz. The programmable con-
troller has self-contaiined trouble shooting similar to buzzer and jumper trouble shooting in relay sys-
tems.

At the Square D Company it was found that they continue to manufacture and expand their main
product line of controller which is called NORPAK. Also manufactured are two varieties of programm-
able controller; the SY/MAX.20 and the 8881. The NORPAK system comes in two forms, encapsu-
lated as in upper Fig. 16 and plug-in as in lower Fig. 16. The form of encapsulated "NOR" logic used is
shown in Fig. 17.

53
 G.O. THOMAS

24 V. D.C.
INPUT PANEL LEFT HINGE MONITOR PANEL
BOARDS BUCKET FRAME 5V. POWER SUPPLY

24 V.

TIMER ADJUST PANEL BOARD

110 V. A.C. POWEREED
REED SWITCH
OUTPUT PANELS
BOARDS
Fig I i- Cutler Haimmer t%vica LSL control pdflci Rlrntcd t.W
permission from Cutler-Hammer Products. Eaton Corpotration

54
 NRI HI i iHk 1

Fig 16~ - 'NJtlarc AY %N)RF-N

G.O. THOMAS
RED WAFER

Ilk WAFER (FOR Loft

RES

0V -
 NRL REPORT 8488

The basic encapsulated system has building blocks for three and four input, six and twenty pack
NOR, OR, retentive memory, transfer memory, BCD counter, reversible BCD counter, single shot
multivibrator, shift register, time delay and power. There are input and output packs f'or signal conver-
sion, filtering and output amplification. The plug-in NORPAK system has a wider range of logic func-
tions which are more than adequate for elevator control purposes.

Applications of encapsulated NORPAK logic systems are on American Motors assembly lines and
are in Ford press controls. While the encapsulated and push-in NORPAK systems use discrete transis-
tors the encapsulated NORPAK uses germanium transistors while the push-in NORPAK uses silicon
transistors. The NORPAK system dates from 1958 [27]. At the present time there is no Navy ship
which uses this type of controller.

Packaging of this system was designed to meet the most stringent industrial requirements. Port-
able kits are provided to aid in training. The plug-in system requires about one-half as much space as
the encapsulated system. NORPAK power is +20 VDC and -20 VDC.

The SY/MAX-20 programmable controller was designed to replace conventional relay control sys-
tems of as few as 15 relays. Applications are packaging and assembly -materials- handling machinery.
machine tools, wood and paper processing machinery. etc. The controller uses a Schottky bipolar cus-
tom microprocessor. There are up to 2000 words of read/write nonvolatile memory and electrically
alterable read only memory is provided. One word is equivalent to one relay contact or coil. Relay
rungs can contain up to 60 contacts (10 across by six down). There are 80 three-digit counters and
timers, and reversible shift registers. Arithmetic functions are available such as plus, multiply and
divide. Input modules cover the range 6 V/120 VAC or DC. Output modules provide 120/240 VAC
or low voltage DC. There are also simulator plug-in modules for input and output.

The controller comprises power supply, processor and memory module (there is a program inter-
face module for monitoring). The controller fits into a cabinet which is 12.5 cm (5 in.) deep. For
checkout, outputs can be forced to the "on" or "off" state. LED indicators are provided for status or
location of malfunction. There is a separate portable programmer which uses standard relay symbols
for direct entry from relay ladder diagrams. A CRT can be used to visually inspect the ladder diagram
on the screen. Program changes can be made while the controller is operating machinery. The Class
8881 programmable controller incorporates a Motorola 6800 microprocessor. The controller, which
uses 12 VDC CMOS technology is a direct replacement for relay systems in very large applications. Ini-
tial costs are often a fraction of the amount encountered with relay or hard-wired solid-state logic.

There are 2048 inputs and outputs. A magnetic reed/write core can be provided with up to
16,000 words. Input is via optically isolated buffers or reed relays. There are 120 VAC output cards
which use solid-state triacs. A built-in monitoring system used LEDs. Inputs and outputs both have
indicator lights.

The 8881 has a programming box which allows programs of relay- ladder- logic to be created and
changed easily. Programs are functionally equivalent to relay logic and 95 steps can be programmed
into one relay ladder diagram rung with up to eight parallel branches opened before the rung is closed.
The relays can be given analog or digital timing via functions which are available.

The controller, which is more powerful than required for elevators, can be interfaced with many
peripherals and can perform simple arithmetic functions.

Contacts with the Digital Equipment Corporation (DEC) revealed the following. The Digital
Equipment Corporation continues to manufacture many varieties of their PDP-1 1 system. Table 1I
shows the DEC operating system comparison. The policy of DEC is one of roll-over in their product
line towards items of new technology. As items of high technology become available it is company pol-
icy to develop new products rather than make pin-for-pin technology insertion replacements for older
57
 G.O. THOMAS

0)L 0)4

u) V ) E)
)4) E

o, x 4)o E '
E 'a a w .0*
o 10- 0 0 x 0
0Oz
= 04) - o2 U CD

xO >.-0 0 < x ' zN

0 0j I-c QC

O ) E
M) 0.0(D0 E0 0.
0 CL a -00
.24-IF M4 C c, - >

4)0E .1 4 0) 2

00L, m. w I' j a0.1 j

u0E, EZ22
w 2
-1 UQ 00 a.. 42 0 >-)4)1
0.0 0
0 cc4) L -5 1
L)) <)<
4) 0o
E E

Es 00 t E O 0.)
-L L. . ocO o-

0m0ca:M x iLLL -rCj

0 )4

a 0 0) 0.0 0)
< c/r 0 li a ZZ 2C
CL u~44) 'o 2'C

-~~0 0)0Q. .

1.) -J M) "E..~'0
c c <
0 .
0g

CL 0.E 0c)
0) >0 !q I2 75 .
- 0 a.V0 :I=. 0)0) =C
-
E- E~ oZv .z0.
m 0
MM-N-z
0) 00 cy 'aEa U c
(D
4) 2 l- t - -)V M w1
0C , c 0 . .=0 CD
LU 2, 0 L CLN)jI .

< 4) oa CO

"M J .1

Cl)) 0.0>M
2 1u
-I x w- D
2X
i)J CL

1 Ln'-
, LnMM ~- 0a ,'E
 NRL REPORT 8488

products. Latest versions of the PDP-11 are /23 and /24. These will eventually replace the PDP-
11/03.

One common thread running through the PDP-11 series is the instruction set comprising 400
software instructions. The LSI-II is a large-scale integrated 16-bit processor. The PDP-11/03 is the
LSI-11 in a box complete with a power supply and fans. The LSI is the PDP-11 on a single card. The
failure rate on the LSI-1 microprocessor chip is 20 000 unit hours per failure. Present initial cost of
the LSI- I I including 4K of 16-bit RAM is less than S 700.00. Because of company policy the contact at
DEC said that five years technical support was the maximum they would agree to for their range of pro-
ducts, although they were prepared to provide provisioning for up to ten years.

Norden Division of United Technologies manufacture militarized versions of the PDP-I 1 micro-
compt.ter. The PDP-I1/34M is a military specification machine used by the U.S. Army. The PDP-
11/70M is another militarized minicomputer. These models are housed in a box complete with power
supply. Norden Division also manufactures the LSI-II M which is a militarized version of the LSI- II
minicomputer on a single card. Technical data for the LSI-II M is shown in Table 12.

Other manufacturers of small machine controllers surveyed included Hyde Park Electronics.
Omron Electronics. Electromatic Components, Giddings and Lewis Electronics, and Eaton Corp. Count
Control Systems Division.

The machine controller made by Hyde Park Electronics is a part detector used primarily for
applications on conveyor lines for bottle filling etc. There are different modules for delay, stop motion,
single pulse, shift register and power. Signals from proximity or photoelectric switches or timing dev-
ices are stored or compared with values in the memory circuit. Control circuitry times the start and
stop of machine action, or initiates alarms.

Omron manufactures miniature controller units incorporating timer and memory operation. There
are LED operational and power indicators. The controller will accept AC inputs and provide DC out-
puts. Electromatic Components Ltd. manufactures modular plug-in controls, counters and meters.

Giddings and Lewis Electronics Company produces a programmable controller that can make com-
parisons, call subroutines, scan controls, do arithmetic computations, and provide DC output drives.
CRT graphics can be used to aid programming.

The Count Control Systems Division of Eaton Corporation manufactures its Durant system 6500.
This programmable controller can handle up to 16 sub-programs at 220 programmable levels. There are
16 program inputs, 16 program outputs, seven inputs for reset and one output for alarm. The con-
troller has been used for plastic molding, dye-casting and metal cutting. Several companies make com-
ponents which could be used in a specially designed controller system.

Reed relays are made by Gordos Corporation. MEKO Instruments Company, C. P. Clare and
Company, Elec-trol Inc., Magnecraft Electric Company and Hamlin Inc. The life of regular reed
switches is on the order of fifty million to one hundred million operations. Mercury film switches with
over 3.4 x 1010 lifetime operations are made by Gordos and Fifth Dimension Inc., but to use these
would require a waiver under MIL-E-17807B on the use of mercury aboard ships. A thorough descrip-
tion of all standard relay types and symbols is given in MIL-STD-1346A. As of this date, however, no
selected standard solid-state passive telegraph relays have been established.

Finally, the discussion under this heading will address standard electronic module (SEM) controll-
ers. Both static-logic and programmable controllers can be assembled using SEMs. As of 1974 there

59
 G.O. THOMAS

Table 12 - Norden LSI-I INt Technical Summary

LSI-11M features Ambient Temperature Ranges

(Module edge temperature)
" Versatile PDP-11 instruction set (over 400 0
-54" to -85 C
Operating
instructions)
* Identicality with LSI-11 software Non-operating -621 ,o -851C
" Up to four times faster than the LSI-1 1
" Available with 4K word resident RAM memory Test standards
" Memory expandable in off-the-shelf, plug-in Temperature -Altitude
modulesML-E-5400, Class tA or 2X
modulesTeprtr-Aiud MIL-E-400, Rang1
" 16K and 32K word core memory modules
MILE-41 58
" 4K word PROM memory option V a n-- H r M n
" Bus flexibility
Vibration - Hard Mounted
* Firmware multiply and dividesep option Sinusoidal
Procedure - MIL-STD-810 method 514 2
*SFloatigpintiructin
Floating point instruction set
Figure 514.2-2 curve J 5 . 5-50C Hz,
" Bit, byte, and word instructions - MIL-STD-810 method 514 2
* • VecoredinteruptsRandom
Vectored interruptsFiue5422creJ5G.500H Procedure IA
" Built-in bootstrap and automatic self test P- eure IA
" Power fail and automatic restart 514 %2A W = 04 3-Hz 7 3 3 RMS
S-aure
" Virtual console routine
Shock - Hard Mounted
" High military reliability
MIL-STD-810 Method 516.2 P'ocedure I
* Off-the-shelf, plug-in interfaces for serial and 15 G11 MS pulse:
parallel I/O
Bench Handling. Procedure V
" Resident firmware debugging techniques
Shock - Modified Mounting
" Hardware and software training programs MIL-S-901. Class 1A
" Unmatched program development facilities Solar Radiation
* Extensive OECUS (user library software)
MIL-STD-810. Method 5051 Procedure
" Supported by RT-11 and RSX-1 1S 104 Watts/t-
operating systems Humnidity
Physical specifications MIL-STO-810. Method 507 1 P-oceoure d
Fungus
Size: 6 in. x 8.2 in. x 1 in.
MIL-STD-810, Method 508 1 Procedure I
Power: 19.5 watts Salt Fog
Weight (approx): 2 Ibs. MIL-STD-810. Method 509 1 Procedure I
Dust (fine sand)
Performance characteristics (typical) I
MIL-STD-810. Method 510 1 Procedure
Speed: 200 KOPS Exoosive Atmosphere
Istruction 2TimKi
Instruction Timing MIL-STD-810, Method 511 1. Procedure I
Move: 1.5 usec Multiply: 12.5 usec EMI
Add: 1.5 usec Branch: 3.25 usec Comply with applicable portions of
MIL-STD-461A, Notice 3
Resident RAM Memory Test per MIL-STD-462
Read access time: 500 nsec TEMPEST

Input/Output Comply with applicable requirement of

I/O transfer rates up to 833K words/sec NACSEM 5100
Copyrisht 0 1971 by United Technologies Corporation

60
 NRL REPORT 8489

were over fifty systems in the Department of Defense using SEMs for a total of three million modules.
At that time there were approximately 250 standard module types. The throw away modules are dis-
tinguished by high quality control and reliability.

The general specification for SEMs is MIL-M-28787. A program manager's guides for using the
modules is published as MIL-HDBK-246. Requirements for employing standard electronic modules are
contained in MIL-STD-1378.

Design requirements for use by manufacturers of new modules are covered by MIL-STD-1389.
This specification defines such things as key codes and critical or transient temperatures. etc. Other
requirements cover initial and end-of-life tolerance after 30 000 h operation, and that contact pins shall
be gold plated. Performance parameters are specified for equipment needed for testing of standard
electronic modules in MIL-STD-1665.

Standard electronic modules could be developed or are presently on the drawing board for solid-
state relays or analog switches, from which an elevator controller could be built which duplicates relay
logic. Static-logic controllers using SEMs have already been built by Unidynamics Inc. for installation
aboard DD963 class ships, and are being proposed for the CVA-71 new construction.

A standard electronic module programmable controller is presently being developed by the Naval
Weapons Support Center (NWSC), Crane, Indiana. A block diagram of this controller is shown in Fig.
18. NWSC began the programmable controller program following the development of a memory board
for the PDP-14 controlled elevators when the DEC withdrew support for their line of PDP-14 mini-
computers.

One version of the controller [28] was evaluated aboard the USS KITTY HAWK. A new
microprocessor design which has been developed is presently being evaluated at sea, also on the KITTY
HAWK. There is an input box. a central processor box and an output box. The input box converts
signals to levels compatible with the central processor. The central processor performs logic operations
and provides outward control signals using instructions supplied by the read only memory (ROM). The
output box retains information sent by the central processor and uses this stored information for
controlling external equipment or for further interrogation.

The microprocessor control system is built entirely of SEM modules. It has 25 different key codes
and 188 modules. Ten of the key codes are new. The 1/O is organized into blocks capable of accepting
up to 16 inputs or controlling up to 16 outputs or providing up to 12 programmable timers. All elec-
tronics is TTL which uses +5 VDC. Other power supplies are ±+12 VDC and -30 VDC. Incoming
signals can be 115 VAC, 28 VDC or 5 VDC.

Twisted pair cable is used between input and output boxes and the central processor. Incoming
TTL signals from the conversion circuit go to a multiplexer which selects a 16 bit word based on the
word select information. The system clock generates 12 clock phases which effectively divide one
machine cycle into 12 parts.

The controller has normal computer features such as steering logic, operation decoder, instruction
register, program counter, read-only-memory, central processor, CP select, A and B registers, compara-
tor, test flag, location register, output register, readout, input register, computer interface. etc. Solid-
state relays in the output boxes switch alternating current devices such as motors, solenoids. etc. There
are two ratings of the solid-state relays, I A and 10 A. All outputs are cleared when powering up to
insure safe start-up. Indicator lamps can be located on both input and output signals. Neon indicators
can be installed across the AC side of the SSRs to tell whether the SSR is on or off.

61

' .. ... . . . ~.."'-

, , ,.. , ,, '"
 G.O. THOMAS

40 a c

ob a

u~ E

CCo

51
II cc ~ W)-w
rn X'u'

= 1z
C
1. 'a

'-4

*a-- ,--'..
zC

Z J .- .t

zo :~62

w OL .
 NRL REPORT 8488

There is a list of firm-wear failure codes. In the manual there are 78 pages of firm-wear or
module fault isolation information. The system is designed for fail-safe operations with self-test
designed to isolate 95% of system faults to 5 or less modules. A variety of indicator lamps are provided
for AC power. 5 VDC, standby, operate, and error indication. A 6-digit display is used to present fault
information to the operator.

Following developmental costs, production costs of 20 systems are estimated to be 1 000 11000
FY79 dollars, i.e., $50 K per unit. Reliability calculations using MIL-HDBK-217B predict a MTBF of
34 000 h. Many of the non-standard modules being developed for this program have great potential in
becoming standards of the future such as the 10 A and I A relays, the optically isolated input, the
peripheral interface, the 2 ROMs and the timer.

SENSOR PHILOSOPHY

This section of the report summarizes contacts made with designers and manufacturers of sensors
and with sensor trouble-shooting and training personnel at naval shipyards and other naval support
establishments. The discussion centers on lessons learned from past experiences with shipboard sen-
sors and recommendations for improved sensors and signal transmission links of the future. The term
sensor in this section is used in the broader sense to cover electromechanical and proximity devices
used for remote sensing of elevator position, door and hatch opening status and for command devices
such as push buttons. The section opens with a brief history of elevator sensor development.

Historical Overview

Until recently, sensors on shipboard elevators have been of the electromechanical type using
make and break normally open or normally closed contacts for sensing both proximity and command
requirements as push buttons. Although mechanical limit switches are still readily available and
manufactured by many suppliers in a wide variety of configurations, their use has steadily been reduced
aboard ships. Reasons for this are (ai) corrosion from salt spray and aqueous film forming foam
(AFFF) fire extinguishing mixture which affects the actuator arm bearing and roller, and (b) humidity
which corrodes the contacts.

The low reliabilitv okf these s-viz.ch~s can be improved but only at the expense of weight and cost
to provide a container sealed against hu~m~dity or a rotor mechanism which cannot corrode. Even when
these problems have been corre 'tcd, ih actuator arm on most limit switches will rotate to a new sens-
ing position on the shaft when the elevator is slightly out of alignment. This is to prevent physical
damage to the contactor mechanism from over travel of the armature, but severely restricts the toler-
ance in alignment of electromechanical limit switches. The same problems were discovered to have
occurred in commercial aircraft (291.

Aircraft of the first jet generation were equipped with electromechanical actuated position indicat-
ing systems. No one needs to tell the airline people anything about the constant adjustment problems
or switch failures associated with that system. A workshop on landing gear in 1968 pinpointed the
problem inherent in the electromechanical system as false landing gear position and/or landing gear
door position indication and inability to retract the landing gear due to gear handle lock circuit malfunc-
tion.
The following types of troubles were listed, (a) hermetically sealed switch housing seal failures
* permitted moisture to enter the switch housing causing corrosion, (b) freezing of switch linkage and
mechanism during winter operation, (c) connector plug corrosion shorting open circuits, and (d) bro-
ken wires in landing gear harness. These failures cause malfunction of the gear/door position indicating
system or gear handle lock, generally resulting in an interrupted flight.

63
 G.O. THOMAS

The heart of new designs for shipboard conveyors and elevators, and aircraft undercarriage sys-
tems, is the proximity switch. The proximity switch operating without contact with its target is an effort
to design out the deficiencies of the hermetically sealed electromechanical limit switch.

Although there are differences in principles of operation and reliability between proximity
switches, the most important problem has been availability. Limit switches, for the most part. are
proprietary or patented devices which are usually encapsulated and unrepairable at the ship. There is
no industry standard or government owned design for any of these devices, which makes long term
availability problematical. Manufacturers frequently obsolete sensor models from their product line.
When replacements are found they frequently are of different size, require different hold-down founda-
tions and provide different signal outputs.

Sensor Alternatives

The review of sensor alternatives considered the following rating factors. (a) detection technique.
(b) historical availability of sensors. (c) mean time between failure or other reliability information. (d)
whether passive or active operation. (e) problems of maintenance or maintainability. (f) provision for
EMI protection, and (g) major applications for each sensor. The suggestions of sensor users for
improvement were carefully recorded. The safety requirements for operation in a hazardous environ-
ment are more easily met with some sensors than with others, these aspects will be-considered later in
the report. The major divisions under which sensors will be discussed are electromechanical devices.
proximity switches and encoders.

Electromechanical Devices

Enough has been said already on electromechanical limit switches and mechanical push buttons
that a further discussion of their disadvantages is unnecessary. The problems of explosion -proofing
mechanical contactor devices will be treated later.

The advantages of using mechanical contactor switches are. (a) many companies manufacture
these switches. (b) there are a number of industry standards. (c) the switches are attractive for long-
term availability and low design -obsolescence. Underwriters Laboratories cover commercial switches in
[301. Although the selection of switches to meet military shock and vibration specifications greatly
reduces the range of those which can be considered, the advantages of using electromechanical switches
are still significant.

It was found in talking to electricians mates aboard Navy ships that they had very few objections
to the use of electromechanical switches. When the writer asked about corrosion etc.. few illustrations
of such problems were identified. In one case mentioned earlier but repeated here for effect, when
electromagnetic interference affected proximity switches at a flight deck hatch. mechanical switches
were used to replace them. When asked why mechanical switches at such an exposed position did not
suffer deterioration from environmental effects it was found that it was only on rare occasions that the
flight deck hatch was opened.

All manufacturers use mechanical limit switches for certain elevator design functions, The use of
these switches provides a second mode of failure to proximity switches and have advantages where
duplicate or end of travel sensing is required for safety purposes. In Navy specification MIL-E-17807
mechanical limit switches are required for overtravel and certain other safety functions.

While most manufacturers of commercial elevators use a mixture of proximity and mechanical
switches it was found that Westinghouse Inc. uses only mechanical limit switches on all passenger
elevators. It is significant that this company uses no light or magnetic controls.

64
 NRL REPORT 8488

Mechanical push buttons are still used by the majority of elevator manufacturers although some
use light switches, magnetic Hall effect switches, and finger activated electrostatic switches. There
seems to be no good reason for shipboard use of anything other than mechanical push buttons, espe-
cially when current limiting in control circuits can avoid the need for expensive explosion proofing.

Proximity Switches

Proximity switches reviewed fall under the headings; (a) variable reluctance, (b) eddy current, (c)
light activated, (d) magnetic, (e) electrostatic, and (f) acoustic.
(a) Variable Reluctance

Reluctance is the term used in a magnetic circuit to describe the resistance to magnetic flux. If a
magnetic circuit includes an air gap, then the reluctance of that circuit can be reduced by partly filling
the air gap with a ferromagnetic material. This variation in the reluctance causes an increase in
impedance at the sensing head which can be detected either through the use of an impedance bridge or
through the detuning of an oscillator circuit. Examples of variable reluctance sensors are those made
by Cutler Hammer (Fig. 3), ELDEC (Upper Fig. 4), and General Electric (Fig. 5).

New versions of variable reluctance sensors are being made by Cutler Hammer and by Square D.
The ELDEC variable reluctance sensor has not been used on Navy ships at this time, being fitted pri-
marily to aircraft. The ELDEC sensor installed on the USS INDEPENDENCE and other ships is of the
eddy current type. The frequency used in variable reluctance sensors varies between 60 Hz and 100
kHz. Some switches use proprietary circuitry for switching AC loads without the need for a separate
DC power supply.

Variable reluctance switches can be made with ranges to 24 mm on a S0 mm x 50 mm steel tar-

get. The range with an aluminum target is about 58% of that for steel. Switching histeresis is about 0.4
mm. A most advanced variable reluctance sensor system has been developed by ELDEC for use on the
new range of Boeing commercial jetliners [31,32,331.

Two-piece proximity switches are recommended with an electronics unit and a remotely located
variable reluctance sensor. The proximity switches feed into a microprocessor used to monitor flaps,
detect faults. verify that flaps move in the direction commanded, prevent deployment of flaps at unsafe
speed, and monitor landing gear functions in the aircraft. The electronics unit contains proximity elec-
tronics cards, logic cards, output driver cards and test module. The switches have a 19 mm range.
Mean time between failure is in excess of 200 000 h compared to 1 500 h for high-quality mechanical
switches. Due to extremely high reliability there is virtually no maintenance scheduled or unscheduled
during the 60 000 flight hours life of the aircraft. The switch conforms to commercial specifications for
humidity, sand, dust, salt spray, fungus, altitude, shock and vibration.

(b) Eddy Current

The eddy current sensor works upon the principle that energy is robbed from an electromagnetic
circuit due to currents set-up within the target material. These sensors are most effective when con-
ducting target materials are used such as copper and aluminum.

Frequencies in eddy current devices are usually about I kHz. The loss of energy from the eddy
currents can be used to reduce the level or kill the oscillator. Alternatively the mutual inductance
butween the transmitter and target can be used to change the natural frequency of the oscillator. Both
AC and DC versions of eddy current sensors are available with AC or DC input power and switching.
The ELDEC eddy current sensors installed on CVA 59 class ships were preferred unanimously by per-
sonnel from the Norfolk Naval Shipyard Design Division and the Atlantic NAVSEA Support Center.

65
 G.O. THOMAS

Initially ELDEC sensors were susceptible to electromagnetic interference, but following a design
change the switches now perform satisfactorily. Tests were run from 30 MHz to 150 MHz at 200 V/rn
electric field. Sensors are not now susceptible to the range of EM interference when targets are located
both near and far. The switch is manufactured both as a DC model, which has a valued built-in test
circuit, and as an entirely 115S VAC model with 5 A inductive load output relay capacity. Electromag-
netic interference testing on the AC switch is reported in [341. Electromagnetic interference testing
was to MIL-STD-461 A Notice 3 Test Method RSO3.

(c) Light Activated

Light activated sensors have been used quite extensively in the past on both Navy and commer-
cial elevator systems and conveyors. Light sensors used with a GE Directomnatic 11 Controller on the
LISS AMERICA were replaced with Denison eddy current proximity switches after the light sensor
manufacturer rendered the switch obsolete.

Many of the passenger elevators on Navy ships presently use light sensors. These elevators do
not usually go to the open deck where switches may be affected by the sun. Also, in passenger eleva-
tors, salt spray generally can not enter the elevator trunk to coat the light windows and attenuate the
beam.

Some food conveyors on Navy ships use light sensors in safety circuits to detect that packages
have been removed before inverting and returning conveyor pallets at the end of travel. Light sensors
of various kinds have been used extensively by the Otis Elevator Company and other major manufac-
turers of passenger elevators.

Light activated sensors are made using incandescent lamps and lenses, neon lamps and light emit-
ting diodes. The most common light sensors manufactured today use infrared sources which can over-
come to some extent the problems of a dirty environment. These sensors were the ones preferred by
Naval Ship Systems Engineering Station (NAVSSES), Philadelphia.

Advantages of light sensors are that they can be used to detect planes to a close tolerance at
ranges more than adequate for elevator purposes.

Disadvantages of light sensors are (a) they are fast acting, (b) they can be affected by ambient
light, (c) the passage of light is easily attenuated by grime, salt spray or accidental paint spraying opera-
tions, (d) the window which admits light also admits electromagnetic interference and photo- transistors
are readily saturated by intense high-frequency radiation (See Fig. 19).

Five guests in a hotel elevator recently suffocated when smoke from a fire obscured the photocell
light beams. The elevator could not move since the controller read this condition as a sensor malfunc-
tion. A fire and smoke hazard is certainly also present in combatant ships.

Light sensors used in open deck locations are generally fitted with a rubber boot to exclude sun-
light. In one case, painting surrounding the sensor which initially was white was changed to black. For
elevators with a high usage rate the rubber boot tends to wear or tear requiring additional special
maintenance of this system.

Where light sensors are used in open sunlight, for instance by the logging industry, the light is
generally pulsed instead of continuous with pulse frequencies of between I and 2 kHz. Filtering for
this frequency provides the signal which will not be present if the light source is blocked or if sunlight
saturates the receiver. Cutler Hammer has an infrared sensor under development using this technique.
Tne infrared frequency is 950 nm and a bicycle r.flector can be used at ranges from 6 m to 15 m. The
light source is of 8 ls pulses at I to 2 kHz repetition rate. Since the sunlight represents a DC level
over the AC signal there is a filter to drain the sunlight effect.
66
 NRL REPORT 8488

LEO/DETECTOR SPECTRAL MATCHING CHARACTERISTICS

0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 1.1

WAVELENGTH (nAm)
Fig. 19 - Radiation response of LED emitters versus detectors. Reprinted with permission from Electronic
Design, Vol. 27, No. 19, copyright ' 1979 from Hayden Publishing Co., Inc.
(d) Magnetic

Recent years have shown a large increase in the number of magnetic sensors used for elevator
and conveyor control. There are Navy applications on aircraft carriers and auxiliaries. Commercial
manufacturers such as US Elevator and Otis use them extensively. In the writer's opinion magnetic
sensors were the preferred type of all those studied.

The most common magnetic sensor uses a mechanical rocker arm and permanent magnets. The
contactor mechanism is enclosed within a housing and filled with hydrogen to prolong contact life by
excluding humidity from the mechanism and bearing and by limiting compounds produced by arcing of
the contacts. One form of this switch is made by the General Equipment and Manufacturing Company
under the proprietary name "GO" switch. These "GO" switches have 1250 W resistive contact ratings at
120 to 480 VAC. Sensing distances are over 20 mm.

An improvement to this switch would be the addition of a separate test circuit for automatic
remote testing purposes. The switch as presently configured is a throwaway unit. On-site maintenance
would be improved if the mechanical contactors were replaced so that the switching effect was achieved
by a variable capacitor or lightbeam interruption. This new circuit could still be enclosed within a
copper housing to exclude dirt, humidity and salt spray, and protect the device from electromagnetic
interference and paint spraying operations.

Other kinds of magnetic devices which would use DC magnetism are sensors based on the flux-
meter and flux-gate magnetic saturation effect. Switches of this type were not found in the literature or
in any installation, but deserve further study [351.

Miniaturized flux-gate magnetometers can be made using toroidal cores with semicircularly wound
second-harmonic detector windings acting as a field sensitive element. Toroids wrapped using 2-mil
nickel-iron composition tape can readily be saturated at low excitation power.

One other magnetic technique, which has been developed by Microswitch into limit and push-
button switches, makes use of the Hall effect. Hall-effect integrated circuits which could be used in a
Navy designed limit switch are manufactured by Texas Instruments.

67
 G.O. THOMAS

The Hail effect is described as follows. When a current is flowing in a material at right angles to a
magnetic field, then a voltage is developed at right angles to both the current and the magnetic field.
All conducting materials possess the Hall effect characteristic to some extent but some alloys have been
especially developed to accentuate it. The H-all effect is generally very small. A practical detector
requires large magnetic fields and some preamplification. One advantage is that the same sensor could
be used for both proximity and push-button switches. No example was found on any Navy or commer-
cial elevator or conveyor system of the use of Hall-effect switches, although there is no good reason
why they should not be used under certain circumstances.

(e) Electrostatic
Electrostatic sensors make use of capacitance changes between a sensor plate and the presence or
absence of a target plate or the operator's body. Electrostatic push buttons are used in commercial
passenger elevators but most other electrostatic sensors are made with other applications in mind. In
one case a sensor area 60 cm x 60 cm in the vicinity of rotating machinery was provided as a safety
barrier to protect personnel from injury. The machinery was designed to turn off automatically when
any part of the observer's body passed through the safety screen.
The equation for plate capacitance in air is C = 0.2235 KA (it - l)d. C is the capacitance in
microfarads between n number of plates of area A square inches spaced d inches apart in a medium
with dielectric constant K (K - I for air). Using this formula a capacitance change of I /AJi would
result when a 5 cm x 5 cm target plate is placed 20 mm from a 5 cm x 5 cm sensor plate.
(f) Acoustic

No acoustic proximity switches were found to be generally available for elevator control applica-
tions although the use of acoustics was considered to be a good idea by naval personnel associated with
the problem. Inexpensive acoustic ranging sensors are made today and are included in automatic cam-
eras made by Polaroid Inc. In a similar manner as for light, it would be possible to pulse or condition
acoustic sensors to discriminate against background noise and other interference. The sensitivity of
piezoelectric transducers in air or condenser microphones would be more than adequate for the applica-
tion intended.
(g) q,!'dioisotopic

Sensors using low-level radioisotopes were suggested on more than one occasion but no systems
reviewed or commercial manufacturers were found to use this technique.

Encoders

One sensor which has been used in the past to replace several sensors in the trunk is the digital
encoder. As the elevator platform moves within the trunk the encoder records its position by rotation
caused through the movement of an encoder cable or the main drive shaft.

Older systems developed by Westinghouse Inc. made use of a spot light counter which counts the
teeth which go by in a toothed wheel. Elevator position accuracy to 12 mm can be achieved in this
way. The encoder used on CVA 59 class ships uses a printed circuit card but functions essentially the
same.

Because of the elongation of elevator cables under load, encoder sensors driven from the main
drive generally can not be used for fine accuracy platform levelling. They can, however, replace sen-
sors used exclusively for effecting elevator speed changes and for providing approximate stopping infor-
mation. Encoders in Phoenix elevator systems have been the source of problems recently. This is

68
 NRL REPORT 8488

likely to be caused by brush wear on the rotating printed circuit card. A change of encoder type to one
activated by light would improve reliability and greatly simplify trouble shooting. Encoder sensors were
used in only a small minority of the elevator systems reviewed. They reduce the overall number of
proximity switches needed in the elevator trunk but complicate maintenance by adding components to
the logistics base peculiar to the encoder subsystem.

Signal Transmission

Signal transmission will be discussed under headings of voltages and cable properties.

Voltages

Practically any voltage between 5 VDC and 440 VAC can be found on elevator systems both com-
mercial and in Navy use. New sensors being developed by the Square D Company used 12 VOC. while
Westinghouse Inc. prefers 27 VDC or 125 VDC. New sensors in development at Cutler Hammer
operate on 6/7.5 VDC or 115 VAC. The 115 VAC sensors rectify and clip the AC input power at 30
V, to charge capacitors which power the electronics through one cycle. In this way, the switch operates
entirely on AC power without the necessity for a separate DC power supply for the electronics.

The general consensus among naval personnel was that signal levels less than 27 V should be
used but preferably not so low as 5 V. For sensor voltages less than 115 V it is necessary to invoke
MIL-STD-1399 "Interface Standard for Shipboard Systems," for electromagnetic interference levels to
assume on shipboard cables.

Cable Pt-opt rfies

Cables in the better designed naval and commercial elevator systems reviewed used shielded
twisted pair telephone type cable for sensor and command signals. For example, the cable recom-
mended for use with ELDEC eddy current sensors is a ten conductor shielded cable MHOF-10 per
MIL-C-915. The Square "D" company uses 2 pair twisted shielded I/0 cable per Belden 8723.

Sensors that use preamplifiers practically all use twisted pair cable from the sensor to the
preamplifier. Sometimes single wire unshielded transmission line is used from the preamplifier to the
controller.

Most electromechanical relay controllers and the Puget Sound hybrid electromechanical relay con-
troller use single wire or looped systems for sensors and push buttons, where each sensor or push
button might have one wire with one single common return serving all. The single conductor sensor
system is most prone to electro-magnetic interference. The worst system is one which uses single con-
ductors to the sensors and grounds each sensor at the sensor. Multiple ground loops of this type
should be avoided.

Transients and voltage spikes on the supply line can be as high as 700 V amplitude for 2 ms and
2500 V as a positive peak amplitude short duration spike according to MIL-E-16400G. High voltage
inductive spikes on elevator signal leads have been measured aboard ship and are considered to be the
cause of particular controller malfunctions where signals are interfaced directly to the controller without
isolation. There is no evidence that transients on signal lines present a problem when shielded twisted
pair cables are used and controller input isolation is provided by relay coils, input transformers, or
opto-couplers.
To facilitate maintenance it is also preferable that all sensor and command information be brought
separately to the controller and not looped as is conventional for the door interlock permissive. By pro-
viding every test point at the controller, the Electricians Mate can identify most electrical problems
from a single location.
69
 G.O. THOMAS

A recent alternative to electrical cable transmission systems is to use fiber optical links [361. A
summary of optical-fiber characteristics is listed in Table 13 extracted from Electronic Design of
November 8, 1979. While the light attenuation of glass fiber is extremely low, the cost at the present
time is prohibitively high at one dollar per meter. New developments by Hewlett Packard and others
(Table 14) point to a less expensive plastic fiber which can be used for high data rate transmission over
short distances.

For 2-way circuits paired cable is 10 times cheaper per kilometer than fi .opticcable [371.
Present transmission facilities cost 0.015 dollars per meter for number 26 AWG urban loop telephone
systems. As the data rate increases, however, fiber-optic cable is much more attractive such that at
1000 circuits, paired cable cannot be used and fiber optic cable is 10 times cheaper than coaxial cable.

The clear advantage of using fiber-optic cable is in being able to reduce the number of
sensor/command cables involved by digital multiplexing of information on a single cable. This has
been done by US Elevator in connection with high rise multi-elevator systems.

One interesting possibility is that if fiber-optic cable is used for the transmission link together with
light sensors, then light could be used all the way from the controller and back to the controller thereby
avoiding electromagnetic interference. Unfortunately the run can probably not be made all in one
length and there would be the need for fiber-optic cable unions and junction boxes. In the past the
connecting of fiber-optic cables was an intricate exercise but recently simple-to-use commercial fiber-
optic connectors have been made available by Hewlett Packard, Amphenol, Cannon and others 1381.

POTENTIAL SHIPBOARD~ SENSORS

In this section, commercial sensor characteristics will be presented in more detail with comments.
A list of manufacturing companies consulted in connection with elevator sensors is given in Appendix
I.

In looking at commercial sensors, evidence was collected which would fit rating criteria used else-
where in this report. Once again attention was paid to trouble-shooting aids for fault isolation and
detection. In the case of sensors it was found that only in very rare instances was it possible to open
the sensor and effect a repair on board ship. Sensors in general are designed as throw-away units but
this, in the main, was found by Navy support personnel to be not the most undersirable feature of sen-
sors. The worst problem of commercial sensors is that the companies will frequently stop manufacture
on a particular model in order to concentrate their industrial effort and sales on a new product line.

A summary of characteristics found in commercial sensors is given in Table 15. Encoders were
omitted from the Table on the grounds that they are peculiar to a small segment of the elevator popula-
tion and would most likely be avoided in an easily maintainable standard system. The Table includes
no manufacturers of radio-isotopic sensors since none were found.

The conclusion of the sensor review was that the preferred sensor should be of the magnetic type
preferably using some form of DC or permanent magnetic detection. Sensors based on the flux-gate
principle look attractive as an alternative to the "GO" switch mechanism. No commercial sensors were
found, however, which use the flux-gate, Faraday effect of phase shift in light. or other magnetometer
principle. Magnetic sensors would be one area in which it would be possible to develop a Navy stan-
dard for use in all elevator applications.

70
 NRL REPORT 8488

Table 13 - Optical-Fiber Characteristics

Opticai-fiber characteristics

liietrca Aletrali adsh Ut/r blen Talki

Fie
M Cent Omlagjsfiber apenae IdS11/bau (-3d$) UI~z-km vande, i bays redoau steg~ti ma
Alpatc 38 400 053
0 320C. 690cim OuPoes 935 25 P fP/aIR 140 cables ofilyl
stepmile.) 92 OO00 053 I3is 1. 650 n DPont I 3345 3.5 25 P40 icables only)
P A. '1

t9lwcaIP(CI 200 600 04 40 ri 775own DuPont $15 3 6 i P-lasS320

step neft 50 (%820 m (cablesonly)I
125 300 500 03 35 00,790 rm ITT 3050 5 5, 101os.I T30. 2.3
to (. 90n $055I
200 350 500 33 [S 1. 790 nm aT ,0 o,332
0 11.790nhm IIT 3075 5,11vT2
I' to 790 'm $085
250 550 33 10leS~n
go5 Iate PCIO
200 Soo 03 Dls,800cSm j 25 PCOS
200o 400 0 19 25 30 Thomas &1 8 6 sg Madeor Fot Fiber
400 600 BeLlS Qocs Pans$
Do France
ANglass 625 125 200 0716 7 a.0c 50 I'mes lo 70,as,
stepn"de.I 33 (. 430n
-il-wmode 300 15 03 I 8 0 830chm 10 NEC SeifocSFS IICOPR
15 1,830 "m 00O9
0 11,30m DO
7008
55 35-s Soo0 025 721. 850cmti ITT so065 5 5 ,~ c101TO 2 3
480 00m 3095
5 6L 060nI
01 1060 e
50 325 020 0 30 617
Thomras g n b, 'c
10 5!s 029 1 Betts 75 iig
Allglass 5 100 01 20 so, 633cm vailec S405Aba.
Stec mleo 8 (. 800900 cmin
s"nilen.4
mod 5. ri 060cno
45 s0 500 031 -20 t
630and850c 500- T 5 T___
1130
Allglass
cultiwnode
625 125 350 02 8.3 100400 valtec
I
040 to
$
133
I1 . cs 13 Modems 572
1060S8910
5220 540 370 420 d30
W000 M1
233 73240
32
2 50 50 m7 060 5 , 0' T,
701 2'3
1 OL060c1. $070

625 725
200 016 ~50 . 00 m'2000 tTws0 ca.
5 8400cm

T
55 15So52 Same as2012 400 ITnc $ 75
$150 T C1
1 3 22ew
60 1 30 0 80 . 80 miw 30n0 EC
n 3053N 73
F G! odeP72Q 719
S0
(.60900SFG 670 60 40 62A9 4

~~
81 5f042 ~ ~0 ~orhr ~
11001290404000;S ~ tm 49

10
63 720 070 027 27on 8Z0 m 200 000I Corning3070 15 2 .0' ps Shlo tn c !:boe
, SOTre
x

0w 7060 OCO 30p,41

0027470
01 and
8 .80
3303cm '0 0 onn 052 1 osI
0 004 0dm47 58 51035023
also -cwal 400 $0 08 0tl

63 120
25 020 2 m " 3940
0 omangSo
TOO 70 2 0 .g Lon .8"en g W'Mc

Reprinted with permission from Electronic Design. Vol. 27, No 23,

copyright ~'1979 from Hayden Publishing Co., Inc.

71
 G.O. THOMAS

Table 14 - Manufacturers of Fiber-Optic Transmission Links

Manufacturer Product
Amp, Inc. Connectors for Fiber-optic systems
Belden Fiber-optic cable
Clairex Corporation Photo-transistors and Darlington photo transistors
Hewlett Packard Fiber-optic 100 meter digital transmitter HFBR-1001
Fiber-optic digital receiver HFBR-2001
Fiber-optic connector/cable assemblies HFBR-
Hitachi America Ltd. Laser diodes HLP Series
Motorola Semiconductor High-power infra-red emitting diodes MFOE series
Products Photo-transistors, photo-Darlingtons, and photo diodes
MFOD Series
Spectronics Division Fiber-optic transmitter module SPX 4140
of Honeywell Fiber-optic receiver module SPX 4141

72

S.- . .
 NRL REPORT 8488

Table 15 - Summary of Commercial Sensor Characteristics

Manufacturer Sensor Characteristics

Mechanical
Allen-Bradley Standard mechanical limit switches
Cutler Hammer Models include pin plunger, standard lever, roller
lever, spring lever and rod lever
The ESO Series is for up to 600 V rating
Mounting dimensions are standard with other brands
Low cost (about $80)
Continuous AC current 10 A
Temperature range - 17/94°C
Denison Standard mechanical switches
Microswitch Model CX:
Rain-tight explosion-proof switch
Up to 20 A rating
NEMA type 1; general purpose
Type 3; dust-tight, rain-tight and sleet resistant
Type 4; water-tight and dust-tight
Type 5C and 5D; hazardous locations Class I
Types 9E, 9F and 9G; hazardous locations Class 1I
Type 13; oil-tight and dust-tight indoors
Model EN/J:
Epoxy potted, inert-gas filled, stainless steel
enclosure switch with Teflon ice scraper and "0"
ring seal
15 A resistive load at 28 VDC
MIL-S-8805 Specification calling for temperature
range -540/+85°C and reliability of 25,000 cycles
electrical and 100,000 cycles mechanical
Model EX:
20 A rating
NEMA type I; general purpose
Types 7C and 7D; hazardous locations Class I
Types 9E, 9F and 9G; hazardous locations Class II
Model HE/J:
Hermetically sealed switch with bellows
Model LSX:
Weatherproof, explosion-proof switch
Side rotary, top rotary, top plunger, top roller,
side plunger, side roller and wobble stick
10 A continuous rating
Table continues
73
 G.O. THOMAS

Table 15 - Summary of Commercial Sensor Characteristics (Continued)

Manufacturer Sensor Characteristics

Meets NEMA standards for hazardous locations type 7,

Class I, Groups B, C and D
Also type 9 Class II, Groups E, F and G
Water, dust and oil-tight conforming to NEMA types
1, 3, 4 and 13
Omron Model D2 RV:
Reed switches for 0.25 A at 50 VDC and 0.1 A
at 100 VDC
Some Reed switch models are for 10 A rating
models with solid-state output are for 2 A
Some models have pilot lights for test
MTBF for Reed switches, 10 x 106 operations
Square "D" All standard mechanical limit switches similar to
Cutler Hammer

Variable Reluctance
Square "D" Class 9007 type PS-1:
Range, 8 mm/steel, 4 mm/aluminum, 8 mm/aluminum foil,
3 mm/copper, with 25 mm x 25 mm 16 gauge target
15 mA input at +20 VDC
Provides output at -10 VDC into standard NOR gate
250 operations per second
Sensitivity adjustment
Class 9007 types V-9, V-10, VQ-1, VQ-Sl:
Range varies with model to 19 mm using 25 mm x 25 mm
16 gauge steel target
Input power; 120 VAC at 25-400 Hz, 8 VA
Output drives 2 logic loads at -16 VDC
ELDEC The ELDEC variable reluctance system is a two-piece
sensor and amplifier controller which can be adapted
to microprocessor logic control of many switches
MTBF on the average printed circuit card in the
proximity card box was calculated at 50 750 operational
hours
Reliability of the average proximity logic box
printed circuit card is 194 000 h MTBF
Uses 1100 Hz oscillator
Microswitch Models FMF:
Sensitivity to 40 mm at -40°/85°C
Needs separate preamplifier controller
Table continues
74
 NRL REPORT 8488

Table 15 - Summary of Commercial Sensor Characteristics (Continued)

Manufacturer Sensor Characteristics

Eddy Current
Cutler Hammer Series 50 proximity sensors operate using an oscillator
and sensing coil with detector and output switch.
Target causes voltage drop in the oscillator.
Sensing range- 5-15 mm on metallic targets
Used for motion detection, positioning, metal gauging,
position limiting
Temperature range -20*/+ 80*C
LED indicators for power-on and switch closed
0.5/1 A load continuous at 40/120 VAC 50/60 Hz
NEMA 1500 V showering arc specifications
DC sensors operate on 12/24 VDC
Denison These proximity switches distributed by Denison are
manufactured in Germany.
Frequency changes in a transistor oscillator are detected.
Range: 36 mm
Being used for replacement aboard USS AMERICA
Low cost (about S80 in quantity)
ELDEC Model 8-078-01:
This switch has been used on US Navy ships USS KITTY
HAWK, RANGER, INDEPENDENCE, SARATOGA, CAMDEN
and SACRAMENTO.
There have been three failures in 650 units in seven
years in shipboard use.
There was an electromagnetic interference susceptibility
problem on AOE bow ramp and underway replenishment
systems.but a new design exceeding 200 V/m was
developed (old design was 20 V/m).
Range is 22 mm on 38 mm x 76 mm x 6 mm steel target
Input load is 30/130 mA at 20/30VDC
The switch is normally activated and provides an open
emitter output into a 100 mA load.
The switch has a built-in-test (BIT) circuit.
MTBF is greater than 100 000 h
The housing is 304 stainless steel and is solidly
encapsulated.
Power transients are per MIL-STD-704A.
Temperature range is -30"/+65* C
The vibration specification is MIL-E-5272C Procedure XII
Shock. MIL-S-901C for grade A Class I equipment.
Table continues
75
 G.O. THOMAS

Table 15 - Summary of Commercial Sensor Characteristics (Continued)

Manufacturer Sensor Characteristics

RFI; MIL-STD-461, 462, 463 at 200 V/m

Operation is for 95% humidity at 65* C.
Electrical is to MIL-E-9170.
Model 8-222:
Range; 13-25 mm with ferrous materials
Input; 20 mA at 20/30 VDC
Load; 500 mA
Temperature range; -54*/+80* C
MTBF 200 000 h
Model 8-274:
Range; 13 mm on aluminum target 25 mm high x 50 mm radius
x 0.4 mm
Supply load; 35 mA at 13/17 VDC
Open Collector output of 100 mA
Logic "0"is detection (target near)
3 m of shielded leads are provided with fitting for 1/2"
14 NPT male conduit
Model 8-277-02:
This switch has been fitted on US Navy ships KITTY
HAWK, RANGER, CAMDEN, SACRAMENTO.
Range; 25 mm on a ferrous target 44 mm x 91 mm x 6 mm
Supply; 115 VAC at 60 Hz
Mechanical relay outputs; 2NO and 2NC
Temperature range; -30°/65°C
Transients to MIL-STD-704 high EMI resistance
200 V/m field
To relay specification MIL-R-5757 for 10 A resistive/5 A
inductive load
Vibration specification; MIL-STD-167 type 1
Shock specification; MIL-S-901C Grade A Class I
RFI to MIL-STD-461, 462, 463
Salt Spray to MIL-E-5272 4.6.1 Procedure 1
Humidity; 95% at 65 0C
Hermetically sealed to MIL-R-5757 (encapsulated in semi-
rigid epoxy)
Electro Corporation Model 50:
Range, 13mm on any conductive metal target
120 VAC at 50/60 Hz operation at 5 A solid-state
switching, NO/NC configurations
Table continues
76

- ':_-. - .... . . _ . _:: ,. .; ,. . .

 NRL REPORT 8488

Table 15 - Summary of Commercial Sensor Characteristics (Continued)

Manufacturer Sensor Characteristics

Switch state indicator light

Built-in transient and RFI suppression
Low Cost ($90)
Model 55191, 55525 series:
Sensing range; 16 mm on any conductive metal target
For 5, 12 and 24 VDC
Separate sensor and controller
Model 55125 series:
Plug-in proximity sensors
Range to 25 mm
115/230 VAC or 24 VDC
Separate sensor and controller
Temperature range; -40°/80°C
Electronic Counters and Model PU-785A:
Controls Inc. 6 mm slot with copper vanes provided
Output NPN sink or source for 5/24 VDC at 40 mA
Potted in epoxy for -18°/60°C operation

Model PU-7928A:
Sensing range; 5 mm with 25 mm x 25 mm square steel
target
Input, 8/28 VDC at 5 mA
Output; sink 20 mA or source 10 mA
Potted in epoxy for temperature range -25°/70°C
Applications are limit switch, level detection and footage counting.
Gordon Products Inc. Model PE600:
Range; 15 mm with 25 mm x 25 mm iron target
Supply; 12/24 VDC at 1.2 W
Output; 50 mA within 2 V of supply voltage
swing
LED operation light
There is also a 115 VAC model with 5 A rated relays
Microswitch Model FM:
Sensitivity up to 38 mm
Needs separate amplifier control
Model 100 FW:
Range; 3 mm shielded, 6 mm unshielded on 16 mm
diameter x 2 mm steel target
Table continues

77

-i
 G.O. THOMAS

Table 15 - Summary of Commercial Sensor Characteristics (Continued)

Manufacturer Sensor Characteristics

Supply; 18/32 VDC

Output- 32 VDC max deactivated, 1 VDC max actuated
Environment sealed
Power transients to MIL-STD-704
EMI per MIL-STD-461A
Model FY:
DC switches to 16 mm sensitivity, AC switches to
32 mm sensitivity
Input; 120 VAC at 50/60 Hz or 8/20 VDC
Output current; 1.2 A AC, 170 mA DC
LED output indicator
Omron Model E2M-F:
20 mm wide slot for vane actuator
Operating frequency 820 kHz
Model E2M-G:
5 mm wide slot for vane actuator
Model E2M-LP30:
Range; 30 mm :: 10% using iron target
Supply; 24 VDC at 35 mA
Output; 24 VDC at 200 mA from open collector
Frequency of operation 38 -- 4 kHz
LED operational indicator
Molded aluminum case, nitrile rubber seal, poly-
carbonate operational window, phenol resin
detecting surface
A phase discriminator circuit compares the phase
of the excitation voltage with that of eddy currents
generated on the surface of metallic target objects.
The eddy currents are sensed through a detector coil
and inductance bridge.
Model E2M-M:
Range- 20 mm using iron targets
Operation frequency; 225 kHz
Model E2M-N:
Range; 10 mm :± 10% for iron with repeatability
accuracy of 0.02 mm
DC supply; 12/24 VDC at 100 mA
AC supply; 100/200 VAC at 50/60 Hz and 0.5/ VA
Table continues
78

* q
 NRL REPORT 8488

Table 15 - Summary of Commercial Sensor Characteristics (Continued)

Manufacturer Sensor Characteristics

DC output; 12/24 VDC at 200 mA

AC output; 1 A resistive, 0.5 A inductive
Frequency of operation 465 kHz using a grounded collector
Hartley oscillator
Sensor detects difference in circuit current between
oscillating and non-oscillating state
LED operational indicator
Temperature range; -25 0 /700 C
Relative humidity; 35195%
Shock; 50 g
Vibration; 10/55 Hz for two hours or 2.5 mm peak to
peak
Model TL-L:
Range; 50 mm with ferrous target 100 mm x 100 mm x 1 mm
DC and AC types; 10/30 VDC, 90/250 VAC. 200 mA
load for both cases.

LED operational indicator

Temperature range; -25 0 /70°C
Shock; 100 g
Vibration; 10/55 Hz at 1.5 mm peak to peak
Relative humidity; 35/95%
Square "D" Many different models are made with applications to
part feeders, food process machinery, conveyors,
printing machinery, cut-to-length lines, part count-
ing etc. The switches have all solid-state components
and are encapsulated in epoxy.
Model BQ- I:
Input; 115 VAC or DC
DC and AC models have sealed reed relays for 1.8 A
output. AC model has solid-state amplifiers switched
by reed relay for 2 A.
Model PSI01:
Range; 15 mm on steel target
Input; 110/120 VAC at 50/60 Hz
Output is by solid-state NO or NC relay with 80 mA
minimum and 0.5 A maximum. Maximum inrush
current 10 A.
LED Operational Indicator
0 0
Temperature range; -10 /70 C
Table continues
79

.!
'. ,.-- . . -, . . . . -,
 G.O. THOMAS

Table 15 - Summary of Commercial Sensor Characteristics (Continued)

Manufacturer Sensor Characteristics

Optical
Banner 2 wire photo-electric control with modulated LED and
epoxy potted circuitry
Clairex Electronics Model CLI series:
Wide range of vane activated switches using LED emitter
and photo-transistor or photo-Darlington outputs
Emitter; Ga As diode with 4 V reverse and 60 mA
current
Detector; collector current 100 mA pulsed cycle,
current gains 0.1 -3.0, VCEO 30-55 V, VECO 5 V
Denison Optical sensors up to 40 mm range
Also 600 VAC relay output with 0.5 A break rating
Most models NO or NC
Electronic Counters and Model PU-372, PU-303, PUS-C:
Controls, Inc.
Range; 100 mm retroflective with 6 mm x 6 mm reflective
tape. Up to 2 m with 75 mm diameter target.
Diffuse range up to 150 mm
Input; 12/15 VDC except direct models which are AC or DC
Output; NPN transistors sinking 250 mA maximum
Emitter; modulated LED on retroflective models, modulated
infra-red LED on diffuse models, number 12 plug-in type
tungsten lamp on direct models
LED operational indicator for object not detected in
retroflective and diffuse models
Electronics Corporation Models 42SPl, 42SP2, 42SR2:
of America
Pulsed LED sensors for proximity and long-range switching
Field of view; 5*-20*
Miniature size:I I mm W x 10 mm H x 20 mm D
NEMA 3, 4, 12 and 13 water-tight and oil-tight enclosure
Commercial vibration and shock resistant
LED alignment and operational indicator
Ferranti Model ZNP100 series:
Photo-switch with detector and output stage for level
sensing
Microswitch Model MLS4A series:
2500 mm range with separate sensor and receiver
Infra-red emitter 0.9 1Am wavelength pulsed
Table continues
80

2 " 4
 NRL REPORT 8488

Table 15 - Summary of Commercial Sensor Characteristics (Continued)

Manufacturer Sensor Characteristics

Supply; 12 VDC
Emitter and receiver are completely potted
Model MLS7A series:
Scan distance 3 m retroflective
Supply; 12/24 VDC
Red LED alignment indicator
Light-operated or dark-operated NO or NC output
Omron Model E3S-L:
Range up to 500 mm for aluminum plate targets 50 mm x
75 mm in the reflective mode
Input; 12 VDC at 50 mA maximum
Load current; 80 mA
Interference limits; 3k lux from incandescent lamps,
10k lux from sunlight
Shock; 50 g, s
Vibration; 10/55 Hz at 1.5 mm peak-to-peak for 2 h
Temperature range; -25°/55"C
Relative humidity; 45/85%
Water resistant NEMA enclosures
Models E3B, E3S, E3N:
These photo-sensors feature ranges which extend to
30 m.
Some models use diffuse light and some retroflective
while others use separate emitters and detectors.
Opcon Inc. Sun-proof optical limit switches using pulsed LED
Ranges to 45 m
Scan-A-Matic Corporation Model S322-3:
Detects large targets at 75 mm
Lamp or Led emitter. Light is conducted coaxially
to the target through glass optical fibers in a
threaded barrel. Light reflects from the target to
the photo-transistor located at the tip of the
barrel.
Input; 5 VDC or VAC. LED takes 100 mA. lamp
takes 115 mA current
LED delivers 0.94 microns light
AC lamp life is 40 000 h
Spectronics Miniature optical vane detectors, reflective switch
components and optical emitter and detector chips
Table continues
81

iI• ,1 T"
 G.O.THOMAS

Table 15 - Summary of Commercial Sensor Characteristics (Continued)

Manufacturer Sensor Characteristics
Veeder-Root AC and DC models with ranges to 150 m direct
and 6 m reflective
Model 7191:
Range; up to 2 m retroflective on 75 mm diameter
target. Minimum scanning distance, 25 mm retroflective.
Input; 12/26 VDC at 450 mW
Output; current sinking logic or current sourcing/sinking
analog output
NEMA enclosure codes to cover water-tight, dust-tight
and oil-resistive
Ambient light interference; no effect when fluorescent
or incandescent light is on optical axis. Sensor
will operate to within 5' angle of the sun.
Filtered for noise spikes
Xercon Inc. Manufactures a wide variety of optical switches with
ranges to many meters. Also pulsed infra-
red retro and proximity switches are made.
Model DO-15, LO-15:
Switches for long ranges indoors using incandescent
lamps
Output; two 3 A triac loads at 110/220 VAC
Model D- 12:
Range; 7500 mm
Supply; 12 VDC
Output; 250 milliamps
Model R:
Range; 3300 mm retroflective, 75 mm off a glossy box
Supply; 120/240 VAC
Output; 5 A DPDT relay
Optical Switch Component A large number of companies manufacture optical switch
Manufacturers components including International Rectifier, Spectronics
and Vactec. Switch comoonents include LED sources,
photo-diodes, photo-transistors, photo- Darlingtons,
opto Schmidt detectors, silicon light sensors and light
dependent resistors.
Magnetic
Microswitch Model l AV:
2.5 mm gap vane operated Hall-effect
Table continues

82

. . .. . . . . .- "
I -
 NRL REPORT 8488

Table 15 - Summary of Commercial Sensor Characteristics (Continued)

Manufacturer Sensor Characteristics

Supply; 6-16 VDC

Output; 20 mA
Temperature range; -40°/100°C
Model 200 FW:
Hall-effect sensor operates on 350 gauss (G), releases on
30 gauss. Practical for ranges to 20 mm with strong
permanent magnet.
Supply; 18/32 VDC
Environmentally sealed
Transients per MIL-STD-704
EMI to MIL-STD-461A
Model FR:
Two piece sensor with separate magnet, or one piece
sensor using ferromagnetic target
Range to 20 mm
Output up to 2 A at 400 VDC or 280 VAC
Model SN:
Hall-effect, bounce-free, push-button switch
Uses barium ferrite PVC magnet
Input; 5 VDC
To MIL-S-8805 and MIL-S-3950
Model SR:
Hall-effect sensor requiring 400 G to operate.
Practical range to 20 mm
Input; 5 VDC or 6/16 VDC
Output; digital source or sink
Temperature range- -40°/150°C
Model SS series:
Hall-effect chips requiring 400 G to operate
Input; 4/5 VDC or 6/16 VDC
Output; will sink up to 20 mA
New Microswitch Hall-effect sensors use silicon technology
in preference to indium antimonide
Omron Model D2EV:
Hall-effect sensor with pin plunger
Input; 12/24 VDC
Table continues

83

"-.- ' -
 G.O. THOMAS

Table 15 - Summary of Commercial Sensor Characteristics (Continued)

Manufacturer Sensor Characteristics

Sentrol Reed switch models:

Range; 3-100 mm
Switching voltage; 130-200 VDC at 0.3-0.5 A
Internal dry nitrogen atmosphere with rhodium plated
contacts to eliminate cold welding and sticking
Reliability, 107 cycles to failure
Shock, 50 g,s at 11 ms
Vibration; 35 g,s at 50/200 Hz
Temperature range; -55*/125°C
Sprague Model UGS-30119
Hall-effect digital switch similar to TI intergrated circuit
Requires 420 G to operate
Supply; 20 VDC at 12 mA
Output; 20 mA sink
Temperature range; -40'/+ 150'C
Model UGS-302 OT:
Hall-effect sensor requiring 220 G to operate
Supply; 25 VDC at 6 mA
Texas Instruments Both Texas Instr .,ments and Microswitch manufacture
Hall-effect devices that can be incorporated into
integrated sensor systems.
They all require between 400 and 600 G to operate
Supply voltages vary from 4 to 16 VDC
Output is sometimes open collector
Electrostatic
Gordon Products Inc. Model PC127:
Sensor plus control unit
Range; 200 mm on all materials
Model PC 131:
Range; 40 mm
Model PC251:
Range; 300 mm
Omron Model E2K:
Range; 3-25 mm
Table continues

84

*1 *-
 NRL REPORT 8488

Table 15 - Summary of Commercial Sensor Characteristics (Concluded)

Manufacturer Sensor Characteristics

Input; 10/40 VDC or 90/250 VAC

Output; 200 mA DC or NO/NC solid-state switch
Sensor frequency; 70 Hz for DC input, 10 Hz for AC input
Applications are for use on glass, lumber, plastics,
containers and objects in walls
Shock; 50 g,s
Vibration, 10/55 Hz at 1.5 mm peak-to-peak
Relative humidity; 35/95%
Temperature range; -25°/70°C
Proxigard Model PC 110-12:
Machine safety switch to OSHA standards
Model 02C025:
500 mm x 1000 mm plane detector
Model PC300:
Capacitance touch-switch
Acoustic
Asco Models 6090/6080:
Range; 50 mm -200 mm reflective or 1000 mm directly
opposite
Operating frequencies; 50 kHz sound
Fluid amplifier using input air at I m of water
pressure
Output; air at 200 mm of water pressure for "ON," 8 mm of
water pressure for "OFF"
Applications are for light-transparent materials.
Explosion-proof switch
Hyde Park Electronics Inc. Microsonic switch:
Can detect objects 13 mm wide at the rate of 2000/min.
Uses high frequency sound
Output; 15 VDC
Applications are for use on light-transparent objects.
Explosion-proof and intrinsically safe

85

*.'>r*.
 G.O. THOMAS

PRESENT AND FUTURE REQUIREMENTS FOR SHIPBOARD ELEVATOR ELECTRICAL

CIRCUITS IN HAZARDOUS ENVIRONMENTS
Discussion of this topic will be conducted in the order of present requirements, future require-
ments and equipment for use in hazardous environments.

Present Requirements

General specifications for ships of the US Navy [391 presently require explosion-proof Group D or
explosion-proof fan-cooled Group D enclosures in (a) gasoline hazard areas, (b) paint mixing and issu-
ing rooms, (c) flammable liquid storage rooms, and (d) gas cylinder storage rooms (flammable).
Enclosed spaces adjoining and opening into the aforementioned spaces shall have explosion-proof
enclosures unless the doors opening into the spaces have certain classifications. In oil-cargo ships, com-
partments with access less than 2.4 m (8 ft) above nonenclosed cargo handling decks shall have
explosion-proof enclosures unless the space is provided with specified ventilation.

References to gasoline mean aviation or automotive gasoline. Gasoline hazard areas include
tanks, tank compartments, tank cofferdams, packaged stowage compartments, pump rooms, motor
rooms, filter rooms, access trunks, piping trunks, jettisonable stowages, paint or flammable liquid
storage rooms, and areas within an open horizontal distance of 4.5 m (15 ft) and below 1.2 m (4 ft)
above the deck of the weather access to gasoline cargo tanks, pump rooms, replenishment stations,
paint storage rooms, etc., if these rooms have access to the weather.

Elevator trunks and pits and spaces that are open to hangars or other areas in which gasoline
fueled aircraft are stowed or fueled are also gasoline hazard areas as are areas within 1.2 m (4 ft) of the
deck of hangars and well-decks on landing ships and docking ships in which gasoline fueled aircraft or
vehicles are stowed or fueled, and within 1.2 m (4 ft) of highest water-line in docking wells of docking
ships.

Other gasoline hazard areas are compartments that are next to gasoline tank compartments, pack-
age stowage compartments, cofferdams, etc., and compartments having direct access to gasoline hazard
areas including compartments containing ventilation duct work serving gasoline hazard areas. Installa-
tions for JP5 fuel to MIL-T-5624 do not require explosion-proof equipment.

Requirements in hypergolic missile spaces are specially defined in [40J. Hypergolic or liquid pro-
pellents are pre-packaged combinations of fuel and an oxodizer, generally nitric acid, which ignite spon-
taneously and continue to burn when allowed to come in contact with each other. The Bullpup missile
and the drone-target use engines which utilize liquid propellents.

Certain bomb clusters use the fuel-air explosive ethylene oxide which will produce an explosive
atmosphere when released. The liquid fuel hazards are fire, explosion, toxicity and corrosion. The
ethylene oxide (EO) weapon will produce hazardous fire or explosive environment and a mildly toxic
atmosphere.

Magazines and adjacent handling and assembly areas are considered to be Class I Division 2 hazar-
dous locations as defined in the National Electrical Code. Electrical equipment installed in these spaces
which are spark producing are required to be provided with explosion-proof or hermetically sealed
enclosures complying with MIL-STD-108.

Future Requirements

Discussions were held with NAVSEA personnel directly responsible for general specification
changes in shipboard elevator electrical circuits in hazardous environments. The decision has been

86

s' .
 NRL REPORT 8488

made to phase out all avgas requirements from aircraft carriers and some other fleet ships. When there
is no avgas on a ship the hazardous areas for elevator electronics will cease to include elevator trunks
and hangar and flight decks. Elevator electronic explosion- proofing requirements will then exist only in
hypergolic and fuel -air-explosi ve weapons magazines for the vast majority of fleet ships.

Elevator Electronic Equipment in Hazardous Environments

It will be noticed that only one method for dealing with electronic equipment in hazardous
environments is mentioned in present ship specifications. The solution required is for explosion-
proofing of the equipment. Actually there are two methods acceptable today for achieving the same
objective. The second method is by use of intrinsic safety techniques [411.

In ex plosion- proofing equipment the technique is to construct around the equipment (such as a
switch or push button) a strong and heavy enclosure with controlled ventilation to the outside. When
an explosive atmosphere is present both inside and outside of the heavy enclosure and a spark ignites
the inflammable mixture within the enclosure, the strength and mass of the enclosure ensures that the
exploded gas will be released in a controlled manner-, and also that as the gas is released its temperature
is reduced to the point where the inflammable mixture outside of the enclosure will not ignite.
* Many manufacturers make explosion-proof equipment. Cutler Hammer makes an explosion-proof
limit switch Model CBX for example. This switch meets hazardous location requirements of the
National Electrical Code under Class I Groups B, C, D and Class 11 Groups E, F, G. Cutler Hammer.
in addition to this, makes a full line of explosion-proof switches, as do other manufacturers such as
Square "D." The principle disadvantage of explosion-proof equipment is in the weight, space and cost of
providing the explosion-proof barrier. The technique of intrinsic safety achieves the same objective in a
* more sophisticated manner and at far less cost or weight and volume increase.

Intrinsic safety is a relatively new idea, dating back only 20 years. in which current in circuits is
limited depending on the resistive or reactive nature of the load to levels which can be shown to be
incapable of causing an explosion in particular hazardous mixtures. Use of the technique began initially
in mine workings but has been used aboard ships for transmitting messages in ship-to-ship communica-
tions along replenishment-at-sea fuel lines. The technique is now widely accepted by the navies of all
Western countries and by the US Coast Guard, however, the choice between explosion-proofing and
providing intrinsic safety has not yet been written into Navy specifications. There is also no Navy or
military standard for use in specifying such equipment.

* It is recommended that where it is necessary to place elevator electronic equipment in hazardous

locations, then those circuits should be considered for protection using intrinsic safety barriers as an
alternative to explosion-proofing. It is also recommended that a military standard be written on the
subject of intrinsically safe electrical circuits for Navy shipboard use. Since this s'tbject is relatively
new, a more detailed discussion is presented in the next section.

* INTRINSICALLY SAFE ELECTRICAL CIRCUITS

During visits to Systems Commands and commercial manufacturers it was found there was strong
recommendation for the consideration of intrinsically safe circuits in preference to explosion-proofing
equipment in hazardous environments. In particular. Cutler Hammer recommended that instead of
using, explosion-proof switches the Navy should consider intrinsic saiety i.e., the selection of
voltage/current combinations with barriers intended to avoid sparking or explosion. The section will be
discussed under the headings Regulations and Intrinsically Safe Equipment.

87
 G.O. THOMAS

Regulations

The only US Government regulation found relating to intrinsic safety was in the Code of Federal
Regulations (CFR) relating to the US Coast Guard and Title 46-Shipping.

Intrinsically safe instruments and equipment or wiring may be installed in any hazardous area for
which it has been approved by the Commandant US Coast Guard. It may be used in lieu of explosion-
proof equipment.

Where it is specified that equipment shall be approved for Class I or Class 11 locations, approval
by an independent test laboratory is required. This approval shall be based on the tests outlined in the
Underwriters Laboratory Inc., "Standards for Industrial Control Equipment for Use in Hazardous Loca-
tions. Subject 698."

Intrinsically safe systems may be installed in any hazardous area as permitted by other Coast
Guard regulation. The recommended practice for intrinsically safe and non-incendive electrical instru-
ments (RP 12.2) published by the Instrument Society of America is recognized as a guide for approval
of intrinsically safe equipment by the Commandant. British Government standards on this same sub-
ject are contained in 142].

Another US regulatory body for intrinsically safe circuits is the Mining Enforcement and Safety
Administration (MESA) under the Department of Interior. This agency is responsible for mines and
mining operations with specific reference to coal dust and methane gas atmospheres. The National Fire
Protection Association has addressed the subject under the heading Intrinsically Safe Process Control
Equipment [431.

Commercial standards on intrinsic safety are covered by Underwriters Laboratory in the standard
UL913 and by Factory Mutual Engineering Corporation in their publication "Intrinsically Safe Electric
Circuits for Application in Hazardous Locations." Factory Mutual hazardous locations are taken from
Article 500 of the National Electrical Code as follows:

Class I Atmospheres which contain concentrations of flammable gases or vapors

Class II Atmospheres which contain ignitable amounts of dust
Class III Atmospheres which contain combustable amounts of fibers or filings
Divisions of these classes refer to the probability that a hazardous atmosphere will be present.
Division I refers to locations where particular hazardous materials are present in the air in potentially
flammable concentrations continuously, frequently or intermittently, under normal operating conditions
(NEC Code 5004A). Division 2 locations are those which might become hazardous in the event of a
mechanical breakdown, accidental failure or the abnormal operation of equipment (NEC Code 5004B).

Groups indicate the type of hazardous environment: Groups A to D are flammable gases or
vapors. Groups E, F and G apply to combustable or conductive dusts. Equipment approved by Factory
Mutual is approved as intrinsically safe based upon Class. Division and Group.

Factory Mutual also uses two additional definitions:

intrinsically safe refers to equipment incapable of releasing sufficient electrical or thermal
energy under normal or abnormal operating conditions to cause ignition of a specific hazardous
mixture-,

nonincendive refers to equipment which assures that sufficient electrical or thermal energy will
not be released under normal operating conditions to cause ignition of the specific hazardous

88
 NRL REPORT 8488

mixture. An intrinsically safe barrier must be able to withstand two separate faults. At 24 VDC
and 10 mH inductance, 0.5 A can be tolerated as intrinsically safe.

The Instrument Society of America has published several recommended practices on intrinsic
safety. Instruments in hazardous locations including intrinsic safety, explosion-proofing, purging, seal-
ing, etc., are topics discussed in [44].

Another instrument society recommended practice for intrinsically safe and nonincendive electri-
cal instruments is [45]. This practice covers Class I Division 1 and Division 2 hazardous areas as
defined in the National Electrical Code. When intrinsically safe equipment is used, requirements for
explosion-proofing do not apply.

The following definitions are made by the Instrument Society of America:

Intrinsically safe equipment and wiring is equipment and wiring which is incapable of releasing
sufficient electrical or thermal energy under normal or abnormal conditions to cause ignition of
a specific hazardous atmospheric mixture in its most easily ignited concentration. Non-
incendive equipment is equipment which, in its normal operating condition, would not ignite a
specific hazardous atmosphere in its most easily ignited concentration. Circuits may include
sliding or make-and-break contacts releasing insufficient energy to cause ignition. Circuits not
containing sliding or make-and-break contacts may operate on energy levels potentially capable
of causing ignition.

Abnormal conditions defined :bove will cover accidental damage to any part of the equipment or
wiring, insulation or other failure of electrical components, application of over-voltage, adjustment and
maintenance operations, and other similar conditions. Abnormal conditions also include any two faults
in combination; however, if one of the faults is highly improbable, the circuit is intrinsically safe if nei-
ther fault alone can raise voltage or current above the levels specified in Fig. 20. The data shown in
Fig. 20, extracted from the Code of Federal Regulations, Title 46, Shipping, was developed from vari-
ous experimental results for minimum ignition energy of mixtures at normal room temperature and
pressure. Most of the experiments used capacitors and pointed electrodes.

The information in Fig. 20 includes factors of safety on currents and voltages determined from a
relationship of inductive and capacitive circuit energy storage components and the hazardous material
group involved. The Instrument Society has published similar information [451 and also a recom-
mended practice on installation of intrinsically safe instrument systems in Class I hazardous locations
[461.

Intrinsically Safe Equipment

A directory of equipment approved for intrinsically safe installations is published by Information

Concepts Inc. (ICON) of Philadelphia. Unidynamics Inc. makes entire elevator systems which are int-
rinsically safe and non-sparking for use in tanker pump rooms and in other areas where hazardous
atmospheric mixtures may exist. Elevators were installed aboard the CONDEEP oil drilling platform.
The hazardous area elevators incorporate solid-state infra-red switching and sensing, low
voltage/.current operation, effective circuit iso~atiu., special construction at all rubbing and impact
areas, solid-state controls, over-voltage protectIon, ani remote location of high voltage components to
US Coast Guard regulations 111.80-5(a) to subchapter 1, 1971.

Isolation of low-voltage circuitry in hazardous areas was achieved through DC to DC converters

via optically coupled transistors for isolation. Over-voltage protection was by "crow bar." The crow bar
is an SCR device which short circuits the power supply when an over-voltage condition triggers the
SCR.

89
 G.O. THOMAS

fl,.~~~ Yr roi I sr.,

I-,- '~~~* - ~ -.-

------ - -8

____ {___ ___ __

__ _ t
27ff.5v_0_

___90
AD-AlO 443 NAVAL RESEARCH LAB WASHI NGTON DC F/G 9/5
NAVY SHIPBOARD CARGO AND WEAPONS ELEVATOR CONTROLLER AND SENSOR--ETC(U)
DEC 81 G 0 THOMAS
UNCLASSIFIED NRL-8488 1L

EhEEEEEE
I 2omo omoi INI
 1I.0
20

1111125 111111.4 I
 NRL REPORT 8488

T 1'' '......M
Z' '.

- _. ---
>
II2

- -
I I
3. ....

4
I

SI I J[ - I I I I :
-
I
.AL3YY
.. .. A.....
JJO3M
.... . . .. .. . .. 1 ... . . . -

_
T2VO,~ I u
-9_

- e. 3 ; . S I !j -

- • II II - AUI 3NI
 G.O. THOMAS

JY.IY
Y r- .7 ' -

S 0

I .. •IL7 r.
C

- - I~O | - : :MrlLld ':-

a.4

4--
*.!

Ill- I I- -I~-

92
 NRL REPORT 8488

Transformer protection is provided by an electrostatic shield which shunts the voltage to ground
should the transformer break down. All wire ropes are made of bronze. All impacting points are
bronze to steel construction to guard against sparking.

The Taylor Instrument Company Process Control Division manufactures intrinsic safety barriers
to limit energy available in a hazardous field area to levels below that required to cause an explosion.
The barrier consists of resistance to limit current and Zener diodes to limit open circuit voltage. A fuse
in series with the signal is also provided. Positive and negative barrier circuit diagrams are shown in
Fig. 21. Components are selected so that the fuse will fail before the Zener diodes fail open.

Redundancy in the form of two Zener diodes and multiple grounding provides maximum fail-safe
security. With reference to Fig. 21. the diodes are selected so Dl always has a slightly higher Zener
voltage than D2. If a fault occurs in the safe area that applies excess voltage between terminals I and
2, diode D2 conducts. YCthe excessive voltage is high enough and of long enough duration, diode Dl
will conduct and the fuse will blow. Resistor RI limits the fuse current. The combination of diode D2
and resistor R2 regulates the maximum voltage, and resistor R3 limits the maximum output current at
terminals 3 and 4.

Barriers are installed in the signal leads between the safe area and the hazardous area. The selec-
tion of the proper barrier depends upon which lead is grounded. If the positive signal lead is grounded
a negative barrier is used. If neither signal lead is grounded two barriers are used, one in each signal
lead. Barriers must be physically located in a non-hazardous area. Each barrier must have redundant
connections to system grounding electrodes. Only one signal circuit per barrier is permitted. Standard
commercial twisted pair signal wire may be used to make connections between the barrier and the
hazardous equipment.

Specifications on one of the DC barriers supplied by Taylor Instrument Company are as follows:
Input voltage; 20 VDC
Fault voltage; 250 RMS
Output normal current; 4-20 mA
.Maximum ignition current; 170 mA
Impedance, inut to output in series; 236 Qt
Impedance, output effective fault current limiting. 206 0l
Operating temperature, +4*/+60*C

Other manufacturers making intrinsically safe equipment are Delaval, Electro Corporation, Gen-
eral Equipment and Manufacturing Company, Honeywell, Microswitch and 5o.'are "D." The "GO"
switch is rated Class I Division 2:. Class 11 Groups E, F, G; and Class Ill. A r - ic level detector is
made by Microswitch which uses the change in refraction of a prism immerse: .i as the detecting
principle. This sensor is rated intrinsically safe for Class 1, Division 1, Groups A1, , C and D in the
National Electrical Code.

Square "D" manufactures a 10 A single-pole double-throw relay for 120-550 VAC with intrinsi-
cally safe features. This relay must be mounted in a nonhazardous area. Only the control leads go into
the area to "start" or "stop" push buttons. Solid-state energy-limiting components are encapsulated in
epoxy resin. Low AC is rectified to 12 VDC and Zener diode protection added. The relay is rated by
Underwriters Laboratory for Class I Groups A, B, C and D or Class 11 Groups E, F and G.

DISCUSSION AND RECOMMENDATIONS

A state-of-the-art review and problem analysis has been conducted into elevator controller and
sensor subsystems. The results may be used to improve on or develop standard control systems for use
in Navy shipboard freight and weapons elevators. The conclusions of the study are as follows:

93
 G.O. THOMAS

Ri RZ R3
USA 10 20 206

Safe Do "1 02 Hazardous

A ra 30V 30V Area

A- 1715"13[1)A

Positive Barrier

RI R2 R3
I/A 10 20 206

Safe 0f 02 Hazardous
Area 30V L 30V L Area

Negative Barrier "

.5

Fig. 21 - Taylor Instrument Company intrinsic safety barrier circuits

Elevator Logic Controllers

Technology levels of controllers examined during the review included:

a. Electromechanical relays using both commercial relays and those designed to military
specifications including SEM.

b. Relay-logic using solid-state relays for both the controller and as operational drivers.

c. So-called static-logic of various types including standard TTL and CMOS "and/or" or
"nand/nor logic.

d. Standard TTL logic using existing Standard Electronic Modules.

e. Programmable microprocessors using commercially available large-scale integrated com-

ponents or the prototype Navy Development of a Standard Electronic Module programm-
able microprocessor controller.

94
 NRL REPORT 8488

The recommendation is made that relay-logic is the preferred technology to use. This is based on
the simplicity of understanding relay-logic for shipboard maintenance personnel. Other technology lev-
els will require additional training for either all of the maintenance personnel or some specific section
designated to service the equipment. Both of these alternatives are considered undesirable at this time
since additional training of personnel to perform a function for a very small part of their productive
time would result in the speciality being lost due to insufficient practice. The other alternative, which is
to train a small number of people specifically at a new technology level, was seen to be a very question-
able practice as it affected Electronics Mates on those ships requiring this procedure. Personnel changes
resulting from reassignment or release from the services quite frequently depleted the one or two peo-
ple responsible for this very important system aboard particular aircraft carriers visited. The preferred
route to take would be to direct maintenance and repair work at all Electronics Mates 2 and 3 class
aboard the vessel and structure the work so that it can be performed by those at the lowest common
denominator of training, education or motivation.

Relay-logic systems were found clearly superior in maintainability, long-term parts supportability,
component standardization, human interface, existing population, and complexity.

Message 062207Z Nov 80 originating with Naval Sea Support Center Pacific Detachment
(NAVSEACENPAC DET) San Diego, CA commends the prototype Puget Sound Naval Shipyard relay
controller installed on USS CONSTELLATION (CVA-64) lower-stage (LS) #6 weapons elevator. The
messsage states that minimum effort is required to troubleshoot. Also, when problems arise, ships
force personnel can maintain equipment without specialized training. The message originator feels that
any future effort to develop a standard weapons/cargo elevator controller should be channeled along the
lines of the NAVSI-IPYD PUGET relay control.

Relay systems are not superior relative to overall reliability but are quite acceptable based on the
usage rate of shipboard elevators. Relay systems also may not be superior in relation to initial cost.
Initial cost was found to be the driving force behind commercial applications of microprocessors. Dis-
cussions with US Elevator Company Inc. showed there really was no overriding reason other than initial
cost for using microprocessors in commercial elevators. A further reason which came out very clearly
in discussions with Digital Electronics Corporation, Cutler Hammer, Otis Elevator and US Elevator was
that the elevator industry has objectives which included:

a. the need to fund new design initiatives by the company in addition to constructing eleva-
tors to print

b. manufacturers in general have no interest in what is termed injection technology. That is

to say they do not wish new technology alternatives to be incorporated into existing
designs in a way that function cards can be simply unplugged and new technology cards
inserted in their place

C. the elevator industry bases its assumptions on general commercial procurement practices.
Petroleum refining companies, for example, might replace controllers every five or six
years after adequate amortization and a new technology level develops. They frequently
are not interested in self-main tenance, and rely on the elevator manufacturer to provide
service support directly.

It was found that the commercial manufacturers look upon the small volume of Navy work as
being secondary to their main product lines. Because of this there is always the attempt to mold the
Navy objectives to suit the commercial objectives of the company: At the very least, companies
attempt to use existing product-line equipment, designed with other objectives in mind, in Navy con-
struction projects where clearly the requirement may be for something else.

95
 0.0. THOMAS

It also was found that among commercial manufacturers there was little standardization of com-
ponents, subassemblies, sensors, voltage levels, technology or anything else. Because of this it was
impossible to find multiple sources for anything but the most basic components.

Static-logic and microprocessor systems have the edge in space and weight saving but the
space/weight required for all forms of controller considered was low and quite uncritical in todays war-
ships. In fact, a small amount of additional space can be tolerated to reduce installation complexity and
improve maintainability. Relay controllers were clearly quite superior in terms of new research and
development effort required for their use.

The one criteria of comparison on which relay controllers in the past have required specification
waivers was in the area of silock limitations. Military electromechanical relays, which will withstand
specified shock and other environmental limits, are available from a very small roster of sources. On
the other hand the unbalanced masses of electromechanical relays result in their frequently not being
able to operate without an intermittent change of state called "contact chatter" during the passage of the
shock wave. This is one bad feature of their use in critical elevator systems. It takes considerable time
to manually jog a large weapons elevator on an aircraft carrier to its stow position should the relay sys-
tem drop out during an initial combat encounter. Because of this. the recommendation is made that an
entirely solid-state relay system is preferred. Multipole logic solid-state relays are not available com-
mercially. A Navy design of solid-state relay controller would thus have to be developed. At the
present time it would seem that such a controller could be designed using a combination of small-scale
integrated circuits with functions such as analog switches, tni-state buffers. opto-couplers and timers.
All of these functions are available in components from many suppliers.

The following comments address the Navy's Standard Electronics Module (SEM) program. At
this time Standard Electronic Modules exist for a variety of TTL and CMOS logic functions, a series of
low current electromechanical relays, and for the various functions involved in microprocessor controll-
ers such as the central processor unit and the read-only-memory.

There are many desirable features in the Standard Electronic Module program and much to
recommend it. Components and modules are tested to ensure ultra-high reliability. The objective is
toward standardization at the module level. Maintainability is handled on the basis of throw away
modules. Obsolescence is overcome by specifying the input/output characteristics of modules and not
the technology level inside the module. Supportability is achieved by attempting to obtain competitive
bidding from multiple sources for the procurement of each module batch. Modules are constructed to
two high military specification levels of environmental and shock requirement. Existing modules are
very attractive in that they require no new research and development effort and are quite compact.

Disadvantages of Standard Electronic Module units are that multiple functions on one unit fre-
quently require the use of an entire unit instead of one particular logic gate. The existing population of
modules is quite small. Although manufacturers list SEMs in their literature, a direct contact with an
order to buy frequently reveals that there is no stock of such components and that long delays will be
experienced while modules are manufactured. Modules at the present time are made in relatively light
quantities and hence do not benefit from mass production discounts.
Because of the limited range of SEM vendors the recommendation is made that all SEM elevator
controllers should be compared against those designed at the component level. Components can be
used that are just as standard and just as supportable as SEM modules. Nevertheless, there is much to
recommend the SEM control system.
One disadvantage of the SEM program is that when the need is seen to arise for a new standard
function there is the need to produce a new Standard Electronic Module to handle that function. This
has led to the list of SEMs growing 1014cr each year. Many of the SEMs on that list are rather special-

96
 NRL REPORT 8488

izeci with small total populations existing in service or in the supply system. In the present case, if the
recommendations above are followed it would be possible to design a standard module as a multipole
i~~double-throw solid-state logic-level relay. Such a module does not yet exist.

Since this is the case, if it is decided that the preferred system should use Standard Electronic
Modules and require no new development, then an acceptable solution is a static-logic SEM controller
using existing Standard Electronic Modules. Such a system has been proposed by the Naval Ship Sys-
tems Engineering Station (NAVSSES), Philadelphia. This controller, in many ways, would be similar
to that installed as backfit on the DD963 class and proposed for installation on the CVA7I.

If SEM modules are not used, then the controller design will run up against all of those problems
which have been solved nicely for us by the standard modules, namely humidity, temperature, and
other marine environmental effects, and shock. In many cases it is possible to obtain military
specification integrated circuits which themselves meet the environmental and shock specifications and
these should be used where available.
One solution to the shock requirement is that the controller should be shock mounted as a unit in
preference to shock mounting individual components and circuits within the controller. This can be
made to satisfy the shock specifications in regard to operation of the controller following an explosion.
Shock mounting frequently aggravates vibration problems, however, since MIL-Spec vibration tests
require two hours performance at the resonant frequency.

Use of components that do o7 do not change state during passage of a shock wave can be left to
the designer of the controller. It is necessary to select components which either have no moving parts
or, where mechanisms are used, they are (a) properly balanced or restrained to withstand the specified*
shock limits, or (b) will operate in a delayed manner that makes the controller transparent to the effects
of shock-induced contact chatter.

Controller Fault Detection

Fault detection methods in controllers reviewed varied widely with manufacturer. Older controll-
ers made by General Electric had no fault isolation circuitry. On one ship a previous electronics techni-
cian had hooked up a glow-lamp on a wire probe and this constituted the test apparatus.

The Cutler Hammer controllers both as installed in combatant ships and new developments at the
plant are rated highly in this regard. Logic levels are shown by lights which usually do not effect the
overall reliability of the controller operation. Older versions used tungsten lights derated in voltage by
50% while newer versions used light-emitting-diodes. Shipboard personnel were unanimous in praise
for this aid to maintenance. One minor criticism was that the lights are on at all times when the eleva-
tor power is turned on and not just during trouble-shooting duties. Because of this the fault isolation
lights can sometimes be failed when the technician arrives to perform his duties.

The elevator system manufactured by Unidynamics, which used Standard Electronic Modules,
provides a module tester as part of the controller package. In this case there were no lights indicating
the logic states of the modules while in operation.

In some cases commercial controllers which use relays, use a form of relay that has a light-
emitting-diode incorporated into the coil circuit; i.e., such as automated bowling-alley equipment.
Several elevator controllers developed by Puget Sound Naval Shipyard used this same type of relay.
Technicians find it very easy to maintain controllers using relays with coil lights. Maintenance can usu-
ally be accomplished even without the need to study the elevator schematic diagram contained in the
technical manual.

97
 G.O. THOMAS

The recommendation of the review in this regard is that new specifications should require (a) that
fault isolation circuitry should be designed into the controller system and (b) that controller module
test equipment be available aboard ship.

Though trouble-shooting aids are desirable at the controller, it must be emphasized here that this
feature should not be overdone to the extent that the reliability of the trouble-shooting aids becomes a
significant part of maintenance of the elevator controller system. Indicator lights of the type used by
Cutler Hammer are recommended as being about the greatest extent it is necessary to go in this direc-
tion. If the controller design permits trouble-shooting lights to be turned off when not needed then this
is an added feature but not essential.

Trouble-shooting circuitry has been carried to great lengths aboard commercial passenger aircraft.
The latest design of Boeing in the 757 series includes many ELDEC variable reluctance sensors. The
sensors are used to indicate that undercarriages are down, locked, up or secured, etc. Each sensor has a
test circuit which is regularly monitored using a microprocessor. Immediately when one sensor does
not respond to the test interrogate an indication is given to the pilot that such condition exists. This
sophistication in the monitoring of sensors and controllers was not considered necessary aboard ship for
the reason that the extra circuitry would add to the complexity of maintenance of the elevator and,
since fail-safe design is used for shipboard elevators, casualties to sensors or controller components are
generally not life threate ni ng.

Controller Output Drivers

The controller output performs a variety of functions such as energizing high or low speed, or for-
ward or reverse power contactors of the main elevator motor, driving the solenoids which operate
hydraulic valves, and turning on and off lights that indicate the elevator position and safety status.

In the past the two most common driver outputs of controllers have been either through an elec-
tromechanical relay or by means of driver amplifier cards. A considerable margin in output driver per-
formance should be designed into the controller initially to permit equipment modifications or changes
to be made throughout the life of the vessel through major overhauls.

The driver output of one controller system in particular has been very troublesome and the reason
is as follows. Hydraulic cylinders which operate doors, hatches. etc., used solenoid valves which it
became necessary to replace because of nonavailability. The new solenoids required more current than
the old and at first this resulted in blown fuses in the driver section of the controller. The shipboard
staff, noticing that fuses were blowing, replaced the fuses with higher current varieties where upon the
output driver stages burned out.

In addition to being able to provide more than necessary drive capability, a desirable additional
feature of the output stage of the controller is to isolate controller electronics from the output electron-
ics and in this way provide noise immunity to the logic operation within the controller.

The recommendation of this review is that the output stage of controllers should be through
solid-state relays. Solid-state relays generally are optically coupled triacs for AC operation or back-to-
back transistors for AC/DC operation. Many manufacturers make versions of single-pole single-throw
relays. Solid-state relays have excellent shock resistance and military versions are available. FET or
bipolar output is preferred to SCR or triac because of non-self-triggering characteristics.

U.S. Elevator is reluctant to use triac or SCR output stages for passenger elevator systems on
grounds of safety. The writer's feeling is that relays which meet MIL-R-28750 voltage spike and tran-
sient levels are acceptable for shipboard elevator use. For most applications spurious half-cycle turn-on

98
 NRL REPORT 8488

is quite safe (in the case of lights, solenoids, motors, etc.). The use of solid-state relay outputs to the
controller provides an extra flexibility in that voltage and current level changes to output devices and
displays can be made during the life of the elevator system to accommodate new developments without
disrupting the existing elevator system.

Sensors and Signal Transmission

The types of sensor in use on elevators and conveyors by the Navy and in commerce were more
numerous than the number of manufacturers involved and probably equaled the number of designers at
work on elevator controllers. Sensors were almost never directly interchangeable for one reason or
another. Bolting foundations were different, sensing techniques were different, some sensors had nor-
mally open or closed relay outputs, some had logic level outputs, some sensors had trouble-shooting
test circuits, signal voltage levels varied from 5 VDC to 440 VAC, some operated on steel or copper
proximity targets, some by interrupt of vanes. The physical principles involved in the sensors reviewed
i.duded simple mechanical, variable reluctance, eddy current, optical, magnetic, electrostatic and
acoustic. Some of these sensors required a power supply, others did not.

The situation regarding sensors is worse than that for controllers, if that is possible. Manufactur-
ers of sensors were very reluctant to disclose even the most basic details of their sensor. They all
regarded the sensor as a throw-away item requiring replacement from the manufacturer for any mal-
function. Indeed, the electronics of most sensors were potted in materials designed both to withstand
abuse in the field and to discourage on-site maintenance. The writer found no proximity sensor which
was an industry standard; all sensors had only one supplier who frequently changed his product line.
An engineer in the Otis Elevator Company told me they rarely used the same sensor on two elevators.
You would think that sensors would be standardized within the same company, but this is not so. Dis-
cussions with other manufacturers including US Elevator confirmed this conclusion.

Visits and calls to the Naval Sea Support Centers on both coasts indicated the severe problems of
replacing sensors as they become obsolete. The present policy is to scan the market for yet another
sole source sensor manufacturer and modify whatever is necessary to make it fit. This can be very
costly, even if it results only in the changing of every support bracket or target, but where it also
involves changes to voltage levels or other controller circuitry the expense can be really high.

The conclusion reached from the sensor survey was that the Navy needs to develop its own stan-
dard sensor. The sensors considered to be most promising for further investigation included those
which used DC or permanent magnetism as the physical property to be sensed.

Specifically recommended for further consideration are the mechanical magnetic and Hall-effect
magnetometers. A new technique which the writer could not find in any commercial sensor and which
looks to be very attractive would be based on the flux-gate magnetometer principle. Specific recom-
mendations are made to bread-board such a sensor, which might be used both as a proximity switch and
as a plane detector. Following a laboratory demonstration the decision would be made on whether to
develop the sensor further as an operational prototype. Indications are that a flux-gate magnetometer
would overcome aill iroblems identified in sensors during the visits to Navy ships. A Navy designed
device could be mai~ained aboard ship and also have standardized signal and test voltage levels.
Advantages and disadvantages of the sensor techniques can now be discussed.

Standard mechanical limit switches are regarded very highly by the ships' force. In some elevator
systems they are the only sensors used for all functions. On those elevators that use proximity switches
they are still used for detecting over-travel and other safety features as a second sensor technology with
different failure modes to the first. The advantages of mechanical limit switches are that they are an
established technology and are nut greo.ly expensive. Disadvantages are that they have arcing contacts

99
 G.O. THOMAS

in hazardous areas, they are subject to corrosion of the actuator arm and shaft seizing in marine
environments, and actuator arm rotation on the switch shaft is possible as platform sway tolerances
increase under service which results in functional errors of the switch from that point on.

It has been found from experience that the preferred sensor for detecting such moving objects as
elevators and related mechanical components such as doors, hatches, locking bars, etc. is one which is
not physically interfered with by the object being sensed.

Variable reluctance sensors using inductance bridges are found on existing ships. The availability
of bridge adjustment or nulling controls is a bad feature. The Cutler Hammer sensors provide a low-
level 60 Hz signal to the control panel some distance away. At the controller there is a preamplifier
with adjustable gain to compensate for variations in RMS line voltage on different ships. This often
means that there is a need to readjust each time the ship goes from shore to ship power, however.
Shipboard personnel frequently do not understand detailed operational characteristics of the circuit and
will make arbitrary adjustments affecting particular sensors in an attempt to find the cause of a problem.

Inductive sensors do not have a great sensing range. When a sensor is adjusted for a no-load
elevator condition, tolerance displacements of the platform under load can cause the maintenance peo-
ple to suspect the null or sensitivity adjustment again. It is recommended that standard sensors do not
have any need for fine adjustment by ships' force personnel.

Eddy current devices are already used in elevator controller systems and were the most trouble
free of those sensors which have been time-tested. A disadvantage is that they are expensive at about
S1000 each. These sensors initially were subject to electromagnetic interference at radar frequencies.
The manufacturer modified the circuit to overcome the problem. The possibility that design
modifications will be needed to meet military specification requirements each time a new sensor is
selected is one reason for recommending a Navy standard sensor. Power is supplied to eddy current
devices and, generally, logic-level signals are generated. Power absorbed by the eddy losses is detected
by changes in the oscillator level.

The next variety of sensor examined used light as the physical property. Older passenger eleva-
tors used a light switch extensively. Discussions with the manufacturers revealed that these are being
replaced in new elevators mostly by sensors using magnetism.

In recent years the availability of light-emitting-diodes and p hoto- transistors has generated a new
range of optical sensors both in the visible and infrared regions. Some sensors use continuous light and
some pulsed light. Pulsed light sensors are preferable where sunlight interference is a possibility. Such
sensors which extract an AC component from the light pulses are used extensively in the logging indus-
try on conveyors.

Continuous light sensors have already been used on Navy ships both for dumbwaiter stores con-
veyors and on small strike-down weapons elevators. The sensors are not expensive but are found to
have a variety of problems which make their future use not recommended. They are of course very
susceptible to malfunction from dirt, grime, or smoke obscuring the light or detector window. This is
the main reason that commercial passenger elevators do not use them any longer.

On shipboard, the stores conveyor safety sensor, which frequently is a ligl't sensor, is the area of
shipboard conveyors which receives the most maintenance effort. Other disadvantages of light sensors
are that the photo-transistor is receptive to a wide range of frequencies and is difficult to shield against
electromagnetic interference. This is despite the narrow band of frequencies generated by the light-
emitting-diode source. Light sensors presently on ships must be protected during painting operations.
Even paint mist in the air will affect the optical window. Cleaning of the paint was found ineffective
owing to the interaction of the solvent with the window material. Sensors are now generally replaced at
considerable expense when malfunction follows painting operations near the elevator.
100
 NRL REPORT 8488

Optical sensors are available that use a reflector or set the transmitter and receiver opposite each
other across a gap. Those that use a reflector depend upon the reflector being kept clean. The ones in
"U" configuration can be subjected to physical damage when struck by the operating vane on elevators
where sway tolerances increase due to wear during service life. There are some inductive sensors that
also take this "U" form with vane operation. In general a horseshoe or caliper shaped sensor is not the
most preferred geometry. Sensors that operate across a gap to a flat target have the best record of sur-
vivability.

One subset of optical sensors that was considered made use of fiber-optics in the transmitting and
receiving circuitry. Fiber-optics is an exciting new concept that virtually eliminates EMI on the
transmission link. Some installation problems, especially at the coupling of fiber-optic cables, are still at
the forefront of technology, but the use of fiber-optics was given serious consideration. With a fiber-
optic sensor system the emitter or emitters could be located at the control panel and light or infrared
radiation conducted through the fibers to the sensor, across a gap, and back to the controller.

Many of the disadvantages of light sensors would also affect fiber-optic sensors. They could mal-
function in dirty environments or where painting was taking place. A horseshoe configuration or
reflector would be necessary. Continuous light varieties would be subject to interference at open deck
hatches by daylight radiation. Pulse modulated light would not avoid detector saturation.

Except for the Puget Sound Naval shipyard relay controller there was no evidence on any system,
whether Navy or commercial, that interference on the signal lines was a severe problem. In one system
using 5 VDC logic, capacitors were backfitted to all sensor lines. Following this action the signal noise
problems were not noticed.

Since signal line noise appears to be not a significant problem aboard ship, it does not seem
justified to recommend a change at this time to a technolgy such as fiber-optics which would need a
new infrastructure of spare parts and logistics. The'present multiconductor twisted shielded pair cable
system is simple, inexpensive, and time-tested. Standard cables used for many other Navy functions
such as the telephone can be used. Finally there would be no need for new training in an area that can
get along very well without the necessity for new training.

Next the discussion turns to sensors using DC magnetism. Magnetic sensors fall into two
categories: those using DC flux termed magnetometers, and those using AC fluctuations which come
under the variable reluctance heading.

The DC magnetic sensors in general have superior characteristics to other sensors. They can fre-
quently be used with simple ferrous targets. Even when a permanent magnet target is necessary it is
not a complexity that requires much understanding or adjustment of attitudes. Signal conditioning elec-
tronics in magnetic sensors can generally be protected from electromagnetic and electrostatic interfer-
ence behind metallic screening material. Magnetic flux interferenc~e on ships tends to be cyclical in
nature at either 60 cycles or radio frequencies. This is a further reason why steady state flux sensors
are regarded to be superior. Ship residual magnetism and earth magnetism are usually of such
strengths that they readily can be isolated from !he signal.

One type of magnetometer uses the Hall effect. Why such sensors have never been used on
elevators is probably due to the small sensing distance of Hall-effect transducers. Since the Hall-effect
voltage is very small, either large magnetic fields or high gain circuits must be used in order to effect a
detection. Although Hall-effect transducers are made by several manufacturers, complete sensor pack-
ages could be found made by only one company. This sensor, as for most others, cannot be repaired
aboard ship.

101
 G.O. THOMAS

Magnetic reed and mercury switches were briefly considered. The reed switches were rejected on
the grounds of unbalanced masses. Reed switches have a contact welded to a ferrous leaf spring. The
magnetic attraction at the air gap causes the contacts to attract each other against the resilience of the
springs. Normal magnetic mercury switches are unsuitable to shipboard use since the mercury would
move with the motion of the ship. A new kind of mercury relay, recently on the market, involves a
thin film of mercury. This switch can be operated in any position as opposed to the earlier varieties.
Magnetic mercury switches were not considered further since the use of mercury aboard ship is barred
by MIL-E-1 7807.

One kind of mechanical-magnetic switch reviewed uses two permanent magnets, one with greater
strength than the other. A balanced armature with gold plated contacts in a hydrogen filled enclosure
provides a double throw switch. As ferrous material or a permanent magnet is passed near the arma-
ture, flux is robbed from the stronger of the magnets permitting the less strong magnet to effect the
switching. This sensor has very few disadvantages and considerable advantages. It has no preamplifier
electronics in the head and uses no power supply. The initial cost is low, (less than S100) and the sens-
ing distance is up to 20 mm. There is no provision for remote troubleshooting, however, and repair of
the sensor on board ship is not practical. Here again there is only one manufacturer of the sensor and
so we are back to the sole source and product obsolescence problems once again.

The recommendation of this review concerning mechanical- magnetic switches is that they could
quite easily satisfy all requirements, provided (a) the switch was made to a Navy design for production
by multiple sources in competition and (b) remote test circuitry is incorporated. Although electrostatic
and acoustic sensors are feasible. no commercial versions were found that were entirely suitable.

Turning to the subject of signal voltages, it was previously stated that signal levels reviewed varied
from 5 VDC to 440 VAC.

There seems to be little reasoning behind the selection of voltage levels. The use of 440 VAC on
sensors and push buttons very nearly resulted in a serious accident aboard one class of Navy ship when
a weapons pallet broke loose and severed high voltage sensor cables. Systems using 115 VAC were
common at one time on combatant ships and high voltage DC systems are quite common in commer-
cial elevators.

At the other end of the scale a few manufacturers use 5 VDC because of its compatibility with
TTL logic used for the controller electronics. Systems using 5 V tend to be less immune to noise
interference than systems operating at higher voltage levels. Signal transients of 1000 V have been
measured and must be considered, especially if signals go to or come from unisolated TTL gates.
There is another disadvantage of using 5 VDC directly interfaced into TTL logic. These TTL systems
are activated by a contact to ground. When a TTL gate is left open it normally floats high. Since a
stopping operation is not performed on a high level but on a ground, when malfunctions occur (such as
sensor power interrupt) or signal lines are cut accidentally causing an open circuit, the controller reads
the sensor as safe. Navy specifications require the voltage to be normally high for safe signals.

A few controllers examined used low voltage AC signal levels (24 VAC) but owing to the greater
variety of relays operating from DC by far the majority of designers use DC signal circuits in the range
of 15 to 27 V. These voltages over the years have shown to give little trouble regarding noise pick-up
on the signal lines, they are not hazardous to the health of the maintenance personnel involved in trou-
bleshooting, they can be readily provided by commercial power supplies or in some cases by simple
rectifier circuits, and a variety of electronic components both electromechanical and solid-state are avail-
able that will operate on them directly without voltage level transformations.

It is recommended that a standard Navy shipboard elevator sensor voltage level be selected
between 15 and 24 VDC Signals and signal return should, wherever possible, be run as twisted pairs

102
 NRL REPORT 8488

into differential devices such as coils, transformers or opto-coupiacrs, to isolate the controller electronics
from sensor electronics and provide noise immunity to sensor sigials. It is also necessary to treat test
circuits to the sensors in the same manner as signal lines since noise picked up on test circuits will
activate the sensor in just the same way as the elevator target.

Push Buttons and Lights

Conclusions of the problem analysis on the selection of aevices for transmitting operator com-
mands on elevators indicated that very little could fault the present make-break contact of the push but-
ton system. Not one elevator failure on all ships examined was attributed to malfunction of the com-
mand subsystem. There was also no obvious evidence of electromagnetic interference on the command
transmission lines.

Certain commercial elevators use the same switches for push buttons as are used in the sensing of
elevator position, door 'Interlocks, etc. The Unidynamics Corporation, who developed an infrared
photo-proximity sensor compatible with TTL, used the same device for both command and signal func-
tions throughout their commercial elevator systems. In the command function spring-loaded push but-
tons with vanes were built into the switch to interrupt the passage of light from an emitter to a photo-
transistor. Other manually operated switches based on proximity techniques have been developed by
makers of Hall-effect devices. Microswitch Incorporated has several push-button and other switch types
using solid-state electronics and Hall-effect magnetic sensors.

* The conclusion on command devices was that conventional push buttons are quite acceptable.
There is very little to go wrong with a push-button circuit and, provided it can be made to withstand
the requirements of shock specifications, it is sufficiently reliable for elevator purposes, easily maintain-
* able, readily available and not subject to technical obsolescence. The idea of using sensor technology
for command devices at first sight appears attractive, especially from the issues of standardization and
minimization of parts to be stocked, but this writer considers that the best circuit to use should be one
that works and passes all other elevator criteria while being as simple as possible.

High technology, manually operated, switches which are not similar to the sensor are not recom-
mended since they have no attractions in regard to parts standaraization and add complexity, mainte-
nance. and training problems to the elevator system. Such devices, which are frequently becoming
common in the case of commercial elevators, are capacitance switches which activate upon the capaci-
* tance change of an operator's fingers. Such switches aboard combatant ships could readily be designed
to withstand shock, but it would mean that a person wearing gloves might have to remove these gar-
ments to operate the elevator.

The next subject to be dealt with in this discussion concerns display lights used throughout the
elevator system. The recommendation is made that there should be clear indication by means of lights
of the whereabouts of the elevator at all times. This was not the case in the past where lights would
indicate that the elevator had arrived at a particular level, but when the elevator was between decks no
lights were activated. When elevator malfunction occurred while passing through these blacked-out
zones, it was frequently difficult for maintenance personnel to determine exactly where the elevator
was. They would usually know where it started from and to which deck it was sent, but an exact deter-
mination of its location frequently required that trunk doorways be opened so that a visual inspection
could be made. Future elevator systems, at least at the master control point, should light two lights for
both above and below the position of the platform while the elevator is in transit between decks and
one light when the platform has arrived at a particular deck.

Voltages used for elevator indicator lights in the past have been just as varied as voltages used for
the controllers. Very often voltages used for the lights are different from those used by the controller.
The most common voltages were 115 VAC, 24 VAC, 24 VDC and 15 VDC. There is some evidence

103
 G.O. THOMAS

that tungsten lights operated from DC have a longer mean time between failure, but the difference is
not sufficient to give it much consideration in design. Other lighting techniques considered used gas-
discharge lamps and light-emitting-diodes.

Small neon lamps and LEDs have the disadvantage of being not very bright. Many commercial
elevators are now using large dimension LEDs, but commercial elevator foyers are often quite darkened
and the lights do not need to be seen from any great distance. A further disadvantage of both neon
and LED lighting is the necessity to provide, in some cases, a separate power supply. In the case of
LEDs there are no industry standards for large dimensioned displays, with each manufacturer making
different sizes with different pin configurations. To use LEDs would bring with it the problems of sole
source supply and the need to increase the inventory of different items stocked in the Navy supply sys-
tem. An advantage of neon discharge and LED light displays is that they are usually more reliable and
have higher mean-time-between-failure than tungsten lighting. In this writer's opinion, however, the
advantages do not outweigh the disadvantages at this time.

The recommendation is made that tungsten lighting be used for elevator displays. Tungsten lights
are readily available and bulb replacement is a simple matter for maintenance engineers. The one
disadvantage of short operating life needs to be addressed separately. Two solutions can be suggested
in this regard. One is to provide two bulbs at every location so that a change in light level will attract
attention and indicate the need to replace a bulb. Another method is to use a derated voltage for the
bulb selected. For example, a transformer providing 80 VAC could be used on 115 VAC lamps.
Since a 15-24 VDC supply is recommended for signal circuits, a logical recommendation for the
lights is to use 15-24 VDC for the supply with 28-V lamps. A 15-24 VAC system could also be used.

Interlock and Other Safety Indicators

A special variety of indicator lights is necessary in the case of the safety system. Door interlocks
are frequently connected in series with one "GO" or "NO GO" interlock sensor permissive to the con-
troller. Discussions with personnel aboard ships visited indicated that this design arrangement can fre-
quently result in increased elevator down-time. It is perfectly acceptable from a safety point of view,
but the troubleshooter at the controller sees simply the presence or absence of the interlock signal. If
the signal is absent it means that one of the doors in the interlock daisy chain may be open. Since he
doesn't know which door, and there may be many levels with two doors on each level, the problem in
locating the fault is not trivial. The way this is usually done is to open one of the doors and look up
and down the shaft for light entering through a door not closed. Where the doors are closed but are
not activating the interlock sensor, or where the sensor itself is defective, the above method of
troubleshooting does not work. In this case the Electricians Mate must crawl around inside the eleva-
tor shaft up and down through maybe four or five deck levels looking for the problem.

To correct this situation the recommendation is made that is should be possible to test and
observe the status of every interlock sensor from the location of the controller or, at the very least, in
groups at each deck level.

Controller and Sensor Shock Requirements

The discussion so far has already covered shock to some extent as it affects controller components
and sensors. There still remains, however, the need to address the question of shock requirements as
they should be written into elevator construction specifications.

Other requirements of military tested equipment such as for humidity, temperature, altitude, etc.,
are properties which are important but may not be terribly significant for the components of elevator

104

..................... . . . . . . . . ,.. . . .
 NRL REPORT 8488

controllers, which are usually well protected from both the environment and elevated temperatures.
The one specification requirement which in the past has presented some difficulty is shock.

Important elevator systems on combatant ships are Grade A equipment. Grade A equipment
must withstand shock loadings without significant effect on performance. Whether the equipment
should function during and after or only after a shock is left to the writer of the particular ship
specification.

In the past, some elevator systems have been able to operate both during and after a shock, while
the majority are designed to be undamaged as the result of the shock but malfunction during a shock
owing to change-in-state of controller components. This is especially true of electromechanical relay
controllers that have unbalanced contact masses. It is the writer's opinion that a firm new statement of
requirements for elevators in the shock environment is necessary which clarifies the specification situa-
tion.

The following recommendation is made based on discussions held as part of this review. Elevator
systems should be made transparent to shock pulses lasting less than 20 ins. Controller DC power sup-
plies should be provided with sufficient capacitor filtering so that an interruption of power of 20 ms will
not cause the loss of memory of controller logic units. Interruptions of less than 20 ms in the main
power to the elevator motors can be ignored. At the elevator component level solid-state assemblies
are least affected by short durations of shock pulse.

Where electromechanical relays are used they should be designed into the circuit with this
requirement in mind. The addition of sample and hold temporary memory for important logic elements
is one method that could be considered with others, in designing controllers to provide shock tran-
sparency. Another technique would be to use some form of rotary relay or rotary stepping switch with
integral components effectively balanced against the effects of shock. The orientation of the relay can
be a factor since athwartships shock is approximately one half of the vertical, and the longitudinal shocfk
one half again. No allowance is made for this in MIL-S-901. however.

The next shock requirement deals with power outages to the controller lasting longer than 20 ins.
The effects of shock on main circuit breakers could be to effect a disconnect which would have to be
reestablished manually. In this case power to the controller could be out for several minutes while the
problems in power distribution were determined and rectified. Power outages to the controller longer
than 20 ms should cause the elevator to stop. On some ships forklift trucks on weapons elevators are
manned between decks, despite regulations to the contrary. In the dark and confusion of a power
outage people could be moving around in the elevator trunk when the power is reinstated. It seems,
for this and other reasons, to be undesirable that the elevator should automatically dispatch with the
resumption of power. Weapons elevators operate in this manner now, since, with a power outage, they
lose the memory function of what it was they were doing.

At the present time, when a power failure occurs while the elevator is in operation, the usual
practice is to jog the elevator to the nearest deck level and then turn over control to the operator at the
deck or master control who then "sends" or in some special cases 'calls" the elevator to the next desired
location. It is considered that this reestablishment of automatic control by initializing the elevators is
time consuming and could be disastrous in the event of an unexpected hostile attack. The sending of
large elevators to the "stow" location and the closing of hatches is an essential feature of the integrity of
aircraft carriers as a defense against nuclear, chemical and biological warfare.

It is recommended that the elevator system be such that when an elevator "goes down" between
levels it is not necessary to perform the jogging function, but that the elevator will dispatch when the
power is restored upon depression of "send" or "cair buttons at normal operator stations.

105
 G.O. THOMAS

To do this it will be necessary for the platform to be passed from sensor to sensor or target to tar-
get as it proceeds through the trunk, with no gaps. Some form of absolute counting shaft-encoder also
could be used. To make the system absolute the count would need to be retained through power
outages. Navy practice with shaft-encoders has been good on certain ships and bad on others. Because
of the complexity of shaft-encoders and the difficulty of detecting failures in them it is recommended
that future systems be considered that do not use the shaft-encoder sensor technique. Continuous
monitoring of the elevator using trunk or plaform mounted sensors could be achieved either by
extending the length of targets or adding a small number of extra sensors. With positive determination
regarding the position of the elevator when power is restored (as shown by elevator lights being lit for
both levels between which the elevator came to rest), "send to stow" or some other command could be
activated following the determination that it was safe to move the elevator to the selected level. This
feature would be in addition to the other requirements normally found in elevator specifications. For
the case where there is no controller power interruption but logic-level components can change state
during a long transient, as during a nuclear explosion, the same criteria should govern as for a power
failure.

Explosion Proofing

The present requirement in elevator specifications is that switches, sensors etc., will be explosion-
proof where they are required to be positioned in particular hazardous locations aboard Navy ships.
Such locations are areas where there could be an accidental spill of aviation gasoline or in weapons
magazines where powder is carried separately or where hypergolic chemicals may be present.

Powder magazines have passed into history and present plans call for the retirement of all naval
aircraft using aviation gasoline, in the near future. On future aircraft carriers and most other surface
ships, the only requirement for explosion-proofing will be in the vicinity of hypergolic propellent mis-
siles and fuel air explosive bombs.

Since there is still a continued requirement for explosion-proofing of electronics, there is a need
to discuss this aspect of controller electronic design. The explosion-proofing of equipment particularly
applies to such components as switches with make and break or sliding contacts. On aircraft carriers
where avgas spills could occur in the elevator trunk potted proximity switches have been used which
meet explosion-proofing requirements. Push buttons are the major concern and these are generally
located outside the specified area of hazard. Where this was not possible, explosion-proof push-button
containers were used. Mechanical actuator limit switches are also available in explosion-proof contain-
ments.

Explosion-proofing using heavy containers is accomplished by permitting gasses within the

chamber to be ignited by the spark of make-and-break contacts. The chamber is designed to withstand
the initial pressure whereupon the burnt gas is released to the outside hazardous environment in a con-
trolled fishion designed to insure sufficient cooling so that explosion external to the chamber cannot
occur.

Disadvantages of explosion-proofed push buttons and sensors are the limited number of manufac-
turers, the cost of the enclosures, and the weight and bulkiness of the resulting switches. Explosion-
proofing does not protect against shorting of the interconnecting cables of the elevator system as a
result of weapons damage. Explosions could result if cables were severed and grounded just as if the
explosion-proof containers did not exist. To clarify the problem, it should be noted that the elevator
controller and most of the elevator circuitry is outside of any hazardous environment and is not affected
by these requirements.

Now that we have established that there will continue to be a requirement for explosion-proofing
on Navy ships of the future, the discussion centers on which is the best way to achieve that objective.

106

.- -
 NRL REPORT 8488

The present solution is not very satisfactory, but neither would be an inflexible edict to, for example,
use only solid-state push buttons and switches, when simple make-and-break contacts are much easier
to maintain and cost less.

The answer lies in a technique which has been used for many years and is now known under the
heading of Intrinsic Safety. Intrinsically safe circuits limit voltage and current in such a manner that it
is not possible to cause an explosion when particular hazardous chemicals or materials are present.
Another term used is nonincendiary and the difference between the two is as follows. Nonincendiary
circuits are used where we wish to protect against explosion under normal operation of the equipment.
Intrinsically safe circuitry is used where we wish to protect against explosion during abnormal operation
of the equipment.

Intrinsic barriers for voltage and current overload provide double protection using devices which
have different failure mechanisms. An illustration of this is that for over-current protection we might
consider both resistors and fuses.

There is a US National Electrical Code, and a US Coast Guard code in the Federal Regulations, in
addition to Instrument Society of America recommended practices in this area but there is no Military
Standard or specification. It is recommended (outside of the scope of this project) that a Military Stan-
dard be written addressing the subject of intrinsically safe circuitry for use in hazardous environments
on combatant ships.

A number of commercial manufacturers in the United States make intrinsic barriers approved by
Factory Mutual, and they have been used in such areas as on ferrys carrying cars with gasoline in their
tanks and in the pump rooms of oil tankers. They have recently been extensively used on oil-drilling
and production rigs, especially in the North Sea. There is some use of the barriers already aboard war
ships, especially protecting the circuits to sensors detecting the elevation of oil in fuel tanks. It is
recommended that in places presently calling for explosion-proofing in elevator specifications. the alter-
native is allowed to the use of intrinsically safe circuits as is customary practice in Coast Guard regula-
tions.

In the case of elevator controllers, the designer would be able to consider providing barriers to
those push buttons, lights, and sensors inside hazardous locations, or where the total power consump-
tion of the elevator controller system falls below the critical level; one barrier at the front end of the
power supply to the entire controller might be acceptable. Barriers could be either commercial or to
special design. There are sufficient commercial manufacturers available that supply problems in the
future are not likely to materialize. Since stored energy within a circuit is a major factor in its intrinsic
safety, sensor and driver circuits of the controller should be made as nearly totally resistive as possible
where the unit being sensed, indicated, or controlled is in a hazardous area.

Elevator Specification

The present specification for shipboard weapons and cargo electromechanical elevators (NIIlL-E-
17807B (SH)) presents articles which in many cases are statements after-the-fact of what exists on US
Navy ships, as opposed to a requirement on what to provide. This specification will need to be
reworked should a standard elevator controller/sensor system be established.

It will be necessary to delete options on different technology levels i.e., microprocessor based,
static-logic based, etc. It may also be necessary to develop a military standard in this area. Adequate
treatment in the new specification must be given to qualification testing of components and the entire
system in accordance with other military specifications and standards such as those for voltage tran-
sients and spikes, shock, vibration, electromagnetic interference, humidity, temperature, fungus, etc.

107
 G.O. THOMAS

Table 16 - Summary of Recommended Controller Systems

OPTION A SPECIAL FEATURES

"6PDT Solid-state relay logic Standard Electronic Modules
" SA and 30 A FET transistor based SPST solid-state relay output drivers
" Solid-state magnetic proximity switches throughout
" Voltages:
Signal, 15 to 24 VDC unregulated
Controller;, 12 VDC regulated
Output, 12 to 115 VDC or VAC

OPTION B SPECIAL FEATURES

" Static-logic Standard Electronic Modules (NAND gate, inverters, etc.)
" 10 A and 25 A triac based solid-state relay output drivers
" Solid-state commercial eddy-current proximity switches throughout
" Voltages:
Signal; 15 to 24 VDC unregulated
Controller;. 5 VDC regulated
Output; 24 to 115 VAC

COMMON FEATURES APPLICABLE TO BOTH OPTIONS A AND B

*The design will be fail-safe upon power failure or unless there is simultaneous failure of two or more
components
* Input and output isolation will be provided for signals, commands. displays, solenoids and contactor cir-
cuits to buffer electromagnetic and electrostatic interference
*Commands will be via mechanical push buttons
"Display lights will have double lamps or be derated
" Two display lights for levels both above and below the platform will be illuminated when the platform is
between decks-or other acceptable technique for locating the platform in the trunk at all times
" Sensor and command cables will be shielded twisted pairs
" The controller and sensor system will be transparent to short duration transients caused by shock of less
than 20 ms
" The logic controller will be designed for ease in trouble shooting. Trouble shooting aids will include
indicator on all inputs, logic functions and outputs at the controller. A go/no-go module tester will be
provided
" It will be possible to test all interlocks and safety devices individually at the controller or in groups at
each deck level
" Operation will allow dispatch from each level with recall to the main control level
" It will be possible to jog the platform in slow-speed off or to any level to facilitate maintenance and
access to elevator components
"Intrinsically -safe as an alternative to explosion-proof circuits are recommended where there are exten-
sive hazardous spaces entered by elevator electronics
" Documentation for the controller will be designed for ease of trouble shooting

108
 NRL REPORT 8488

CONCLUSIONS

The conclusions of this Navy shipboard cargo and weapons elevator controller and sensor subsys-
tem problem analysis are given in the summary of recommended controller systems Table 16. There
are two principal alternatives:

Alternative One

In Table 16, option A is for an all-solid-state relay SEM controller with NRL solid-state magnetic
proximity switches. A controller to these requirements still needs some developmental effort and
certification testing (about two years) before becoming operational. Since this is the case, an acceptable
short-term solution could be endorsed on those ships where alterations must proceed to the elevator
controller system. This solution would be to install miniature-electromechanical logic and solid-state
output commercial component relay controllers of the Puget Sound Naval Shipyard hybrid relay type.
These controllers do not fully meet marine environmental or shock specifications but would be accept-
able as an interim measure, being similar in logic type and in most other important aspects (training,
maintenance, etc.) to the concept of option A, and considering the protected location of the controller
space.

Alternative Two

If it is necesssary to take immediate action on a standard controller, then one which requires no
new development would be required and the best choice, in the opinion of the writer, would be option
B of Table 16. Option B is for a discrete-logic controller using SEM modules with commercial solid-
state eddy-current proximity switches. Of these two alternatives the writer recommends and found
most support for Alternative One.

REFERENCES

1. R.L. Cox, "Final Report IWHS Elevator Controller Study," NRL Memorandum Report 3901, Nov.
1978.

2. "Manual of Navy Enlisted Manpower and Personnel Classifications and Occupational Standards
Section 2 Navy Enlisted Classifications," NAVPERS 18068D, July 1978.

3. "Electricians Mate 3 and 2 Rate Training Manual," Naval Education and Training Command
NAVEDTRA- 10546D.

4. "Electronics Technician 3 and 2 Rate Training Manual," Volumes I and 2 Naval Education and
Training Command NAVEDTRA 10195A.

5. "General Information Handbook - Ammunition and Bomb Elevators on Aircraft Carriers,"

NAVSEA Publication 0978-LP-036-1010 June 1977.

6. "DD963 Class Ship Forward and Aft Elevators," Technical Manuai NAVSEA 0916-LP-042-7020
Volumes 1 and 2 1976.

7. "Ten-Level Lower-Stage Weapons Elevator Number 6, CVN 68 and 69," Technical Manual
NAVSEA 0978-LP-038-9130, 1976.

8. "Three-Level 11,500 Pound Cargo and Weapons Elevator AOR-7," NAVSEA Publication 0978-
LP-061-6070, 1976.

109
 9. "10.500 Pound Lower-Stage Weapons Elevator Number 8 Frames 181-186 Port USS INDEPEN-
DENCE CVA62," NAVSEA Technical Manual SG420-AH-MMO-OIO/CV62, July 1978.

10. "Weapons Elevators and Horizontal Conveyors for Bombs, Rockets and Missiles, CVA-67,"
Technical Manual NAVSHIPS 0978-021-0080. 1969.

11. "Weapons Elevator 10,500 Pounds AO-51, 98 and 99," Technical Manual NAVSEA 0978-LP-
026-2010, 1968.

12. "Cargo Elevator Number 7 Frames 174-177 Centerline USS SACRAMENTO (AOE-1)," Technical
Manual NAVSEA 0916-LP-045-6010.

13. Letter Reference 034D:AMC~jms of 28 February 1980 from Naval Ship Systems Engineering Sta-
tion, Philadelphia, PA to Naval Sea Systems Command.

14. "Forward and Aft Elevators for DD-963 Class Ship Installation. Operation, Maintenance, and
Repair Instructions with Parts List Volume I," Technical Manual NAVSEA 0916-LP-042-7010,
1978.

15. "Macrogram," Macro Corporation, June 1978.

16. H.S. Tsien, Engineering Cybernetics. McGraw-Hill Book Company Inc., 1974.

17. B.R. Campbell, "Get Superior Performance from Reed Relays in Switching Low-Level Signals,"
Electronic Design Magazine, 27, December 1979.

18. "Aircraft Carrier Weapons Elevators Split-Hatch Design Feasibility Study. Part I - Hatch Study.
Part II - Control Study," M. Rosenblatt & Son, Inc. December 1977.

19. W.D. Heilman, "New Features Incorporated in a Weapons Elevator Electrical Control System
Installed on the USS RANGER (CVA-61) During FY 72." Hunters Point Naval Shipyard. March
1972.

20. "Micro-Computer Data Manual" Electronic Design 28, March 1980.

21. D. Bursky, "Microprocessor Data Manual," Electronic Design 27, November 1979.

22. C. Halatsis and A. Sokos, "Microprocessor Application - 6800 Replaces Mini-Computers and
Controls Elevators," Digital Design, April 1979.

23. G. Agftman. "Opto Electronic Components Sparked by Faster Switching, Higher Isolation." Elec-
tronic Design 27, September 1979.

24. "Standard Electronic Modules Program (SEM)" Naval Electronic Systems Command Brochure.

25. W. Feller, An Introduction to Probabilitv Theorv and its Applications. John Wiley and Sons Inc.. New
York, 1968 p. 106.

26. R.L. Cox, "Evaluation Summary of the IWHS Elevator Controller Study - Final Report," NRL
Letter Report to NAVSEA PERA(CV), September 1978.

27. "NORPAK Technical Manual," Square D Company, 1969.

110

'1

• • . . , j t.
 NRL REPORT 8488

28. "Standard Electronic Module Control System (SEMCOS)," Naval Weapons Support Center
Manual.

29. T.N. Bowers, "L-1011 Reliability and Maintainability Experience with the Proximity Switch Sys-
tem," Lockheed-California Company, March 1975.

30. "Standard for Elevator Electric Contacts and Elevator Hoist-Way Door Interlocks," Underwriters
Laboratories Inc.

31. ELDEC Specification to Boeing on Use of 757/767 Proximity Switch System.

32. "Landing Gear Control and Indicator Systems," ELDEC Corporation Application Brief.

33. "Flap Control and Indicator Systems," ELDEC Coro-,'<,;on Application Brief.

34. "Electromagnetic Interference Test Report r ". orporation Proximity Switch Part Number
8-277-02 S/N P1," Boeing Aerospace Corrv,-v- 1977.

35. W.A. Geyger, "Flux-gate Magnetometer," E ":is.June 1962.

36. A.A. Boraiko, "Fiber Optics Harness,4g Light by a Thread," National Geographic Magazine,
October 1979.

37. "Communications Technology Forecast," Electronic Design 28, 1980.

38. S. Ohr and S. Adlerstein, "Fiber Optics is Growing Stronger - Better Connectors, Cables Will
Speed Things Up," Electronic Design 27, November 1979.

39. "General Specifications for Ships of the US Navy," Naval Ship Systems Command Technical
Manual NAVSHIPS 0902-001-5000.

40. "Shipboard Safety and Damage Control Facilities for Stowage of Hypergolic Fueled Missiles and
Fuel-Air-Explosive (FAE) Bombs," Naval Sea Systems Command Technical Manual NAVSHIPS
0978-003-9000, 1972.

41. R.J. Redding, Intrinsic Sajerv, McGraw-Hill Publishers. 1971.

42. "British Approvals Service for Electrical Equipment in Flammable Atmospheres," Certification
Standard SFA3004, Shunt Diode Safety Barriers Issue I Department of Trade and Industry, 1971.

43. "Intrinsically Safe Process Control Equipment." National Fire Protection Association Report
NFPA 493, 1969.

44. "Recommended Practice, Electrical Instruments in Hazardous Atmospheres," Instrument Society

of America Report ISA-RP 12.1, 1960.

45. "Recommended Practice for Intrinsically Safe and Non-incendive Electrical Instruments," Instru-
ment Society of America Report ISA-RP 12.2, 1965.

46. "Installation of Intrinsically Safe Instrument Systems in Class I Hazardous Locations," Instrument
Society of America recommended practice RP 12.6, 1976.

f 111

IIIA
 Appendix A
ABBREVIATED LIST OF ORGANIZATIONS, SHIPS
AND PERSONNEL CONTACTED

Organization/Ship Personnel

NAVSEA Donald Morris

Conrad Waby
Andy Gutow
Abraham Sid Levenson

NAVSEACENTLANT W. D. Owenby
J. Milton Oakley

NAVSEACENTPAC Bob Simkins

Norfolk Naval Shipyard Design Division Stephen J. D'Antoni

Puget Sound Naval Shipyard Design Division Wilner Radke

Frank Mapes

Puget Sound Naval Shipyard PERA CV Ernie Perez

Naval Weapons Support Center, Crane Dean Winkler

Roger Price
Jim Wriford
Dan Doades

Naval Training Center Great Lakes Randall McCaffity

Charles Soper

USS CANISTEO (AO-99) EM3 Cappiello

USS CONSTELLATION (CVA-64) EM2 J. R. Housel

USS INDEPENDENCE (CVA-62) EM3 T. M. Kirk

USS KENNEDY (CVA-67) Ensign G. Stuart

EM3 E. Barton
EM2 Bodani

USS NIMITZ (CVAN-68) LTCDR Gentile

LT R. E. Murphy
EM I Schimizzi
AOI Kimbrell

USS SACRAMENTO (AOE-I) EM2 Newell

EMC Pappin

112

, . I
............................
 NRL REPORT 8488

Organization/ Ship Personnel

USS STUMP (DD-978) GMG2 Joe Brooks

Cutler Hammer John Slowiak

P. M. Kintner
P.O. Gauerke
D. I. Slichter
W. H. Balcken
J. W. Vogel
D. L. Vanzeeland

Digital Equipment Corporation Bob Mebane

ELDEC Corporation Bill Maysner

Otis Elevator R. Drofty

Square "D" Company Richard A. Omdahl

Thomas E. Kelm
Larry R. Sunday
David N. Collins

U nidynamics Mlell Kennedy

US Elevator Mark E. M'illman

Turgay Goker
Westinghouse Elevator Company Frank Ivcklillan
Hank Shey

113
 Appendix B
KEY PROVISIONS OF MILITARY SPECIFICATIONS AND STANDARDS

MIL-C-2212E (Ships) Controllers, Electric Motor. AC or DC and Associated Switching Devices.

Naval Shipboard

Solid-state controllers and solid-state limit switches are not included in this specification. Shock
testing of controllers will be to MIL-S-901 Grade A Class 1 Type A. Momentary changes of state
under shock are permitted. Line contacts may open for up to 20 ms and close for up to 10 ms. Auxili-
ary contacts may close for up to 20 ms or open for up to 20 ms. Contactors and relays shall not per-
manently change their state following the shock. During shock, overload relays shall not trip when car-
rying 85% of tripping current. Timing relays may begin to recycle provided that the starter returns to
normal running condition without operator intervention.

Controllers will meet vibration type I tests of MIL-STD-167 without mechanical damage, contact
chatter or other malfunction. Test frequencies are from 4 to 33 Hz.

Mechanical interlocks shall be provided for motor reversing or speed selecting contactors if there
is a possibility of short circuit resulting from simultaneous contaci closures. Magnetic contactors shall
have a means for overload relay bypass.

Endurance requirements for relays and contactors (except overload) size 0 through 5 shall be
50.000 make and break operations at full voltage and power factor equals 1 for 100q,, break current and
00% AC/400% DC make current. There shall also be 50 operations at 0.4/0.5 lagging power factor
and 1101 voltage at 60011/ AC/400% DC make and break current. One million cycles endurance is
required for mechanical operation only.

Electrical switches require 50 000 cycles at full voltage and current and 50 cycles at full voltage
and 1501% current. When not otherwise specified, enclosures for controllers shall be drip-proof (450) to
MIL-E-2036.

MIL-E-1641)OG (Navy) Electronic. Interior Communication. and Navigation Equipment Naval Ship
and Shore

Equipment will withstand transient voltages equal to the normal upper limit + 18M4 for two
seconds and the lower normal limit - 18% for two seconds. In addition to this, solid-state devices shall
be subjected to an input transient of 700 V amplitude at two ms while equipment is operating. The
equipment shall function normally following the transient.

Transient frequencies are as follows. With the frequency set at normal +5%, there shall be an
increase of 3% for 2 s. With the frequency set at normal -5%, therc shall be a decrease of 3%/ for 2 s.
In addition to the transients a supply line voltage spike of 2500 V positive peak amplitude shall be
applied to spike wave shape defined as short time transient in MIL-STD-1399.

NIL-E-17807B (SH) Elevator. Weapon and Cargo Electromechanical (Shipboard)

This specification states that mercury in any form shall not be used in shipboard equipment. Test
reports shall contain a statement certifying that no mercury containing instruments have been used.

114

t ,, i
 NRL REPORT 8488

Equipment not exposed to weather shall be for temperatures O'C to 50'C. Exposed to weather
temperature requirements are -20'C to +650 C.

Endurance requirements are that the elevator will not require component parts during a minimum
life of 250 000 cycles at 16 cycles per hour for 10 hours per day. The cycle is a round trip between
extremes of the elevator. These endurance requirements do not include preventative maintenance such
as replacement of ropes, brake linings, relays, etc.

The equipment shall include safety devices for broken or slack hoisting rope, downward speed and
speed governor slack rope. The speed governor will activate when the downward speed is 140% of the
rated speed or 52.5 in/mmn (175 ft/mmn), whichever is less. Equipment shall operate on 440 V 3 phase
60 Hz 3 wire ungrounded type I power complying with steady state and transient characteristics of
MIL-STD-1399.

Hoisting motors shall be squirrel cage two speed (1800/300 rpm) induction 440 V intermittent
duty 3 with embedded integral thermal temperature detectors. Locked torque shall be no less than
1301%1 of full speed full load torque.

Brakes will be continuous duty operating on 110 or 440 VAC. Brakes must stop the platform
within I m (3 ft) when platform is travelling downwards at rated speed and supporting 150% of rated
load. The brakes must be able to hold the platform while supporting twice the rated load.

The control system shall have a two speed capability and also be able to stop the platform within
±0.625 cm (:L 1/4 in.) of' selected level when loaded or unloaded. The controller shall operate from
440 V 3 phase 60 Hz or 110 V 60 Hz single phase. Protection and sensors are required for low voltage.
overload, and embedded motor temperature. The enclosure will be drip-proof.

Features will be provided for emergency stop, normal stop, emergency run. overtravel bypass.
slack rope bypass, jog down, jog up, normal/jog, power available white light, red stop light indicator.
red motor over- tempera ture light, red motor over-load light, and elapsed time meter NIS 17J24 national
stock number 6645-00-952-9069.

Magnetic contactors for up-down and high-low speed are to be of the same NEMIA size and rating.
Contacts are to be electrically and mechanically interlocked to prevent both of the speed or both of the
direction contactors from operating together. Contactors for jogging are to be derated as NEMA ICS-
1970 Part 2-3218.

Controller power shall be from 440/Il15 VAC transformer with protective fuses. The secondary
shall not be grounded.

There shall be a manual power disconnect switch type AQB MIL-C-17361 modified for NBQ
operation and containing a shunt trip coil. The switch will interrupt power under conditions of fault
current. Any emergency stop switch will actuate the 115 VAC 60 Hz power to the shunt trip coil.
Power to the shunt trip coil will come from the control system' without interruption by additional fus-
ing.

Electromechanical limit switches shall be 115 VAC single phase rating, explosion-proof or water-
tight, heavy duty construction with 5 cm (2 in.) minimum roller diameter.

Proximity switches shall be water-tight and capable of withstanding repeated immersion in

petroleum based fluids, glycol or synthetic or hydraulic oils. Maximum switching hysteresis is to be less
than 0.25 cm (0.1 in.). Maximum actuating distance to be not less than 1.25 cm (0.5 in.) nor more
than 5 cm (2 in.). Repeatability shall be ± 8 mm (±t 1/32 in.). Temperature limits are to be 00 C to
65*C.
115
 G.O. THOMAS

Electromagnetic compatibility requirements for proximity switches are to be to MIL-STD-461.

The requirements of this standard are as follows:

Frequency Range Units

Communications Volts per meter
250 kHz to 30 MHz 50
Average Peak
Radar (mW/cm) (mW/cm 2)
200 MHz to 225 MHz 7 1 500
400 MHz to 450 MHz 5 300
850 MHz to 940 MHz 12 400
1.215 GHz to 1.365 GHz 3 3 900
2.7 GHz to 3.7 GHz 78 32 000
5.4 GHz to 5.9 GHz 2 1 400
16.3 GHz to 33 GHz 1 1 000

Each proximity switch is to be provided with a 6m (20 ft) integral cable. Limit switches shall be
provided for up and down overtravel and also on hatch covers to prevent running into the covers.

A normal stop switch shall be provided unless access to the platform is through an interlocked
door. When the normal stop switch is in stop position it shall not be possible to initiate or continue
platform motion.

Interlocks shall be provided for each door to prevent it from being opened when the platform is
not at that level. Interlocks shall also prevent elevator travel unless the door is fully closed. When two
doors are at one level, each door shall be separately interlocked so that only one door can be opened at
one time. Automatic controllers are considered control 2. Control 2 elevators shall be operated in one
of the following modes:

a. the operator at each level shall select the level to which the platform will be sent

b. the operator of the master control station shall select by use of an electroswitch or switches
the two levels between which the platform will operate. Push-button switches at each level
served shall ,hen be used to send the platform up or down.

Master control stations shall have an emergency stop switch. normal stop switch, push-button
switches for levels, platform position indicator lights, door open/close switch, and power-on indicator
light. Other control stations shall have an emergency stop switch, r.ormal stop switch, push-button
switches fGr dispatching to other levels, car-here indicator light, door open/close switch.

Lights in the elevator machinery space shall indicate the level of' the platform.

Electromechanical relay logic (method A controls) shall use MIL-C-2212 or MIL-R-19523

category A or B Class I relays.

Programmable controllers (method B controls) will have no mercury wetted contacts.

For programmable controllers elevator position shall be monitored by a shaft angle encoder.

For static logic (method C controls) the DC power source for the internal logic shall be separated
and isolated from other power sources and not used for any external function. All external circuits
shall operate at 20 VDC or AC minimum. The controller shall be provided with a manual monitoring

k. 116
.
 NRL REPORT 8488

system that would allow examination of the state of each input and output and each control element. A
tester will be provided capable of testing all circuits on the boards on a go/no-go basis.

MIL-H-46855A Human Engineering Requirements for Military Systems, Equipment and Facilities

A human engineering effort shall be provided to improve the man-machine interface and to
achieve required effectiveness of personnel performance during system operation, maintenance, con-
trol, and to make economical demands upon manpower resources, skills, training and costs.

Human engineering principles should be applied to identify and select the equipment to be
operated, maintained and controiled by man. The analysis should assure that human performance
requirements do not exceed human capabilities.

Role models should be identified and trade-off studies made to determine which system functions
should be machine implemented and which should be reserved for human operator or maintainer.
These analyses shall also be used as the basis for developing manning levels and skill/training require-
ments.

IMIL-R-19523A (Ships) Relays, Control, Naval Shipboard

Endurance requirements are:

Category A 500 000 operations
Category B 100 000 operations
Category C 25 000 operations

Relays shall pick up at not more than 80% of rated voltage and operate in the range of 800/0 to
110% of voltage at operating temperature. Relays shall drop out at not less than 10% of rated voltage.

There are two operating temperatures, 50°C and 65 °C. Those built for 50°C will operate from
5 0 C to 50 0 C. Those built for 65"C will operate to 85 0 C for one hour without damage. For this rem-
perature test the relays will be energized but need not operate.

Relays will be shock tested to MIL-S-901. Relays shall be Grade A sub assemblies Class I soliuly
mounted. Relays are classified under this specification as follows:
Class 1. Those relays whose contacts will not chatter in either the ener-
gized or de-energized position.

Class 11. Those relays whose contacts will not chatter long enough to
either drop out the relay or drop out a standard relay having a
drop out time of 4 ms. Contacts will not close from the open
position.

Class Ill. Those relays whose contacts will not chatter long enough to
drop out a standard relay having a drop out time of 4 ms. Con-
tacts shall not close from the open position due to shock.

Class IV. Those relays whose contacts will not chatter long enough to
either drop out the relay or drop out a standard relay having a
drop out time of 20 ms. Contacts shall not close from the open
position due to shock.

Class V. Those relays whose contacts will not chatter long enough to
drop out a standard relay having a drop out time of 20 ms.
Contacts shall not close from the open position due to shock.
117
 G.O. THOMAS

Class VI. Those relays whose contacts will not close ,,orn the open posi-
tion due to shock.
Class VII. No requirements for electrical operation.

Under vibration specification MIL-STD-167, relays must perform without mechanical damage,
contact chatter or other maloperation.

MiI-S-901C (Navy) Shock Tests (hi-impact) Shipboard Machinery, Equipment and Systems -
Requirements for

Grade Categories:
Grade A. Machinery. equipment and systems essential for the safety and
continued combat capabilty of the ship. Design shall withstand
shock loadings without significant effect on performance and
without equipment coming adrift or otherwise creating a hazard.

Grade B. Machinery, equipment and systems not required for safety or

continued combat capability of the ship. Design should be suit-
able to withstand shock loadings without equipment coming
adrift or otherwise creating a hazard.
Class Categories:

1. Equipment is to withstand high shock without external or internal resilient mounts.

2. Equipment must withstand high shock with the use of resilient mounts.

3. Equipment may be used with or without mounts and therefore must meet both Class I and
Class 2 requirements.

Test Classifications:

Lightweight category equipment weighing 112.5 kg (250 Ib) or less

Medium weight category equipment between 112.5 kg (250 Ib) and 2700 kg (6,000 lb)

Heavy weight category equipment between 2700 kg (6,000 Ib) and 13500 kg (30,000 Ib)

Type Classifications:

A. Test of a principle unit.

B. Test of a subsidiary component and shall be performed for those cases where a testing machine
or facility of sufficient capacity is not available.

C. Test of a subassembly having a variety of shipboard applications.

Unless otherwise specified, Grade A equipment will be assumed. Where performance during the
shock test is not specified, the requirements for Grade A items following the test shall be the same as
those prior to the test.

118

-, -'A- , , ,. ,-.,
 NRL REPORT 8488

Lightweight equipment up to 180 kg (400 lbs) including mounting may be tested on a lightweight
testing machine. This machine has a 180-kg (400-Ibs) hammer weight. One drop is made dt 30 cm (1
ft), a second at I m (3 ft), and a third at 1.5 m (5 ft) for a total of three blows parallel to each of three
principal axes of the apparatus for a grand total of nine blows. Where equipment has two states (for
example, circuit breakers) the nine blows shall be delivered for each condition.

MIL-STD-167-1 (Ships) Mechanical Vibrations of Shipboard Equipment

Type Classifications:

1. Environmental

2. Internally Excited

Electronic equipment is Type 1.

Acceptability under environmental vibration means the ability of the equipment to perform its
function during and after the tests specified. Minor damage or distortion will be permitted provided the
function is not impaired. Nonrepetative failures of vacuum tubes, condensers, wiring, etc.. which can
easily be replaced, are generally considered minor failures. In these cases the repair is made and the
tests continued with no penalty.

Equipment is tested along each of the three rectilinear axes. Equiipment shall be vibrated for five
minutes at intervals of I Hz according to the following schedule:
Hz cm (in.) Amplitude
4 to 15 0.075 ± 0.015 (0.03 ±t 0.006)
16 to 25 0.05 ± 0.01 (0.02 ± 0.004)
26 to 33 0.025 ± 0.005 (0.01 ± 0.002)
34 to 40 0.0125 ± 0.0025 (0.005 ± 0.001)
41 to 50 0.0075 + 0-0.0025 (0.003 + 0-0.001)

The equipment shall be vibrated for an endurance test of at least 2 h at resonant frequencies. If
no resonant frequencies are found this test is performed at the highest frequency used in the test.
Equipment which incorporates resilient mounts integrally in the equipment, such as electronic cabinets,
shall be installed as supplied.

119

,!
 Appendix C
EXTRACT FROM MIL-HDBK-217C
MILITARY STANDARDIZATION HANDBOOK RELIABILITY PREDICTION
OF ELECTRONIC EQUIPMENT

Two methods of reliability prediction are described in this Handbook:

I. Part-stress analysis
2. Parts-count method.

The parts-count method requires less information and is more applicable to elevator controllers in
the early design phase. The following pages are extracted from MIL-HDBK-217 on the subject of
parts-count reliability prediction.

3.0 PARTS COUNT RELIABILITY PREDICTION

This prediction method is applicable during bid proposal and early design phases. The information
needed to apply the method is (1) generic part types (including complexity for microelectronics) and
quantities, (2) part quality levels, and (3) equipment environment. The general expression for equip-
ment failure rate with this method is:
XEQUIP 'Vi (XG ITQ)i 1

for a given equipment environment where:

XEQUIP total equipment failure rate (failures/ 101 hr.)
XG *= generic failure rate for the i th generic part (failures/
10' hr.)
trQ quality factor for the i th generic part.
N, quantity of i th generic part.
n number of different generic part categories.

The above expression (1) applies if the entire equipment is being used in one environment. If
the equipment comprises several units operating in diff'erent environments (such as avionics with units
in airborne inhabited (A,) and uninhabited (A4t) environments), then Eq. ( 1) should be applied to the
portions of the equipment in each environment. These "environment-equipment" failure rates should
be added to determine total equipment failure rate. Environmental symbols are as defined in Table 2-3.
page 2-4.

The quality factors to be used with each part type are shown with the applicable kG iables and are
not necessarily the same values that are used in Sect. 2.0. Part Stress Analysis. Multi-quality levels are
presented for microelectronics, discrete semiconductors, and for established reliability (ER) resistors
and capacitors. The AG values for the remaining parts apply providing that the parts are procurred in
accordance with the applicable parts specifications and, for these parts. ?TQ0 I. Microelectronic devices
have an additional multiplying factor. 7rL (learning factor) as defined in Table 3-4.

It should be noted that no generic failure rates are shown for hybrid microcircuits. Each hybrid is
a fairly unique device. Since none of these devices have been standardized, their complexity cannot be
determined from their name or function. Identically or similarly named hybrids can have a wide range
of complexity that thwarts categorization for purposes of this prediction method. If hybrids are antici-
pated for a design, their use and construction should be thoroughly investigated on an individual basis
with application of the prediction model in Sec. 2.1.7.

120
 NRL REPORT 8488

Table 3-1 - Generic Failure Rate, A G, for Bipolar Digital Devices (TTL & DTL)
vs. Environment (f./10 6 hr.)*
Circuit Complexity GB&SF GF AIT AIF NS GM AUT AUF NU ML
1-20 gates .0070 .029 .070 .13 .093 .091 .11 .20 .12 .21
21-50 gates .020 .062 .12 .21 .17 .16 .20 .33 .23 .34
51-100 gates .032 .094 .18 .29 .24 .23 .28 .45 .34 .47
101-500 gates .079 .22 .37 .56 .49 .45 .61 .89 .71 .85
501-1000 gates .13 .34 .56 .82 .73 .67 .92 1.3 1.1 1.2
1001-2000 gates .29 .78 1.3 1.8 1.7 1.5 2.1 2.9 2.5 2.7
2001-3000 gates .81 2.1 3.5 5.1 4.5 4.1 5.8 8.1 6.7 7.3
3001-4000 gates 2.2 5.7 9.6 14. 12. 11. 16. 22. 18. 20.
4001-5000 gates 5.9 16. 26. 38. 33. 30. 43. 60. 49. 54.
ROM** 4 320 bits .0083 .022 .036 .053 .048 .043 .060 .085 .070 .078
ROM 321-576 bits .012 .033 .055 .081 .072 .066 .091 .13 .11 .12
ROM 577-1120 bits .020 .052 .087 .13 .11 .10 .14 .20 .17 .19
ROM 1121-2240 bits .029 .078 .13 .20 .17 .16 .22 .31 .25 .29
ROM 2241-5000 bits .045 .12 .20 .30 .27 .24 .33 .48 .39 .45
ROM 5001-11000 bits .068 .18 .31 .47 .41 .38 .51 .75 .60 .70
11001-17000 bits .10 .28 .48 .73 .63 .58 .79 1.1 .92 1.1
*See Tables 3-3 and 3-4 for [I Q and 11 L values.
**RAM failure rate - 3.5 X ROM failure rates.
Ns - Naval Sheltered Environment
Nu - Naval Unsheltered Environment

Table 3-2 - Generic Failure Rate, XG, vs. Environment for Bipolar Beam Lead, ECL,
All Linear, and All MOS Devices (f./10 6 hr.)*
Circuit Complexity GB&SF GF AIT AIF NS GM AUT AUF NU ML
1-20 gates .010 .048 .099 .16 .14 .12 .21 .30 .25 .24
21-50 gates .048 .19 .31 .40 .43 .34 .73 .86 .92 .5;
51-100 gates .076 .31 .48 .59 .68 .54 1.2 1.3 1.5 .78
101-500 gates .19 .82 1.2 1.4 1.7 1.3 3.1 3.4 3.9 1.7
501-1000 gates .32 1.4 2.0 2.3 2.8 2.1 5.1 5.5 6.4 2.6
1001-2000 gates .74 3.1 4.6 5.2 6.4 4.8 12. 13. 15. 6.0
2001-3000 gates 2.0 8.4 13. 14. 17. 13. 33. 35. 41. 16.
3001-4000 gates 5.4 23. 35. 39. 47. 36. 90. 96. Ill. 44.
4001-5000 gates 15. 62. 94. 105. 128. 97. 241. 258. 299 121.
ROM**, < 320 bits .021 .087 .13 .15 .18 .14 .33 .36 .42 .17
ROM** 321-576 bits .031 .13 .19 .22 .27 .20 .49 .53 .62 .26
ROM** 577-1120 bits .048 .20 .31 ,35 .42 .32 .78 .84 .98 .41
ROM** 1121-2240 bits .072 .30 .45 .52 .63 .48 1.2 1.3 1.5 .61
ROM 2241-5000 bits .11 .46 .70 .80 .96 .74 1.8 1.9 2.2 .94
ROM** 5001-11000 bits .17 .70 1.1 1.2 1.5 1.1 2.7 2.9 3.4 1.5
ROM** 11001-17000 bits .25 1.1 1.6 1.9 2.2 1.7 4.1 4.5 5.2 2.2

Linear, < 32 .011 .052 .12 .20 .16 .15 .22 .35 .27 .33
transistors
Linear, 33-100 .023 .11 .24 .41 .35 .31 .48 .73 .60 .66
transistors
'See TABLES 3-3 and 3-4 for [IQ and IL values.
**RAM failure rate - 3.5 x ROM failure rate.

121

!1
 G.O. THOMAS

Table 3-3 - ir Q, Quality Factors

for Use with Tables 3-1 & 3-2*
Quality Level iT Q

S 0.5
B I
B-I 2.5
B-2 5
C 8
c-I 45
D 75
D-1 ISO
*See Table 2.1.5-1 for descriptions of
quality levels. 7-rT values shown here ire
different from those in Table 2.1V5- 1.

Table 3.4 - 7TL, Learning Factors for Use with Tables 3-1 & 3-2

The learning factor lT L is 10 under any of the following conditions:

(1) New device in initial production.

(2) Where major changes in design or process have occurred.
(3) Where there has been an extended interruption in production or a
change in the line personnel (radical expansion).

The factor of 10 can be expected to apply until conditions and controls

have stabilized. This period can extend for as much as six months of
continuous production.

ir I is equal to 1.0 under all production conditions not stated in (1), (2)
and (3) above.

122
 NRL REPORT 8488

Table 3-5 - Generic Failure Rate, AG, (f./10 6 hr.) for Discrete Semiconductors
vs. Environment (See Table 3-6 for Quality Factor)
Part Type GB&SF GF AIT AIF NS GM AUT AUF NU ML
Transistors
Si NPN .017 .11 .28 .59 .26 .59 .60 1.2 .84 .96
Si PNP .025 .17 .46 .96 .41 .96 .96 1.9 1.4 1.5
Ge PNP .025 .25 .75 1.6 .84 1.6 .78* 1.6* 2.1* 2.5
Ge NPN .072 .66 2.0 4.3 2.2 4.3 3.3* 6.6* 5.4* 6.6
FET .046 .31 .78 1.6 .70 1.6 1.7 3.4 2.3 2.6
Unijunction .15 1.0 2.7 5.6 2.4 5.6 6.3 13. 9.0 9.0
Diodes
Si, Gen. Purpose .0051 .036 .098 .20 .090 .20 .24 .48 .33 .33
Ge. Gen Purpose .0066 .078 .25 .51 .30 .51 .44 .87* .75* .81
Zener & Avalanche .016 .096 .24 .51 .22 .51 .54 1.1 .72 .84
Thyristor .023 .16 .43 .90 .40 .90 1.0 2.0 1.4 1.4
Si Microwave Det. .19 2.2 6.0 12. 3.9 12. 7.5 25. 17. 46.
Ge Microwave Det. .41 5.6* 18.* 35.* ** 35.* ** ** ** **
Si Microwave Mix. .25 3.0 8.0 16. 5.1 16. 17. 34. 23. 64.
Ge Microwave Mix. .72 10.* 31.* 61.* ** 61.* ** ** ** **
Varactor, Step .24 1.5 3.9 8.1 3.5 8.1 8.6 17. 12. 13.
Recovery, Tunnel
LED .034 .14 .25 .49 .45 .35 .91 1.8 1.4 .88
Single Isolator .051 .21 .38 .74 .68 .53 1.4 2.7 2.1 1.30
'This value is valid only for electrical stress. S < 0.3. as defined in Sec. 2.2.
**Do not use in these environments since temperature normally encountered combined with normal power dissipation
are above the device ratings.

123

A ' -A - .
 G.O. THOMAS

Table 3-6 - irQ, Quality Factors for Table 3-5

Part Type JANTXV JANTX JAN Non-Mil Hermetic Plastic
Microwave Diodes 0.3 0.6 1.0 2.0 -
All Other Types 0.1 0.2 1.0 5.0 10.

Table 3-7 - Generic Failure Rate, XG, (f./101 hr.) For Resistors
(see Table 3-9 for quality factor)

Resistors. Fixed Use Environment

Mil-R- GB& GF AIT AIF NS GM AUT AUF NU ML
Construction Style Spec. SF
Composition RCR 39008 .00051 .0032 .0037 .0075 .0046 .0066 .014 .027 .021 02
Composition RC 11 .0025 .016 .018 .038 .023 .033 .069 .13 .10 099
iFilm RLR 39017 .0012 .0031 .0043 .0088 .0033 .0062 .016 .032 .021 028
Film RL 22684 .0061 .015 .022 .044 .017 .031 .079 .016 .10 .14
Film RN 55182 .0014 .0033 .0049 .01 .0037 .007 .018 .036 .024 032
Film RN 10509 .0073 .017 .025 .05 .019 .035 .09 .18 .12 .16
Film, Power RD 11804 .012 .026 .055 .11 .026 .078 .15 .29 .19 46
Film, Network RZ 83401 .026 .072 .17 .34 .14 .24 80 1.6 1.2 1,l
Wirewound, RBR 39005 .0085 019 058 .12 .020 .078 22 44 .17 39
Accurate RB 93 .043 .094 29 .58 .10 -39 1.1 2.2 .85 1L9
Wirewound, RWR 39007 .014 .044 .073 .15 .037 .091 19 37 .25 .54
Power RW 26 .072 .22 .36 73 .19 .45 .94 1.9 1.3 2.7
Wirewound. RER 39009 .0079 021 .045 .090 .024 056 .11 .22 .16 34
Ch. Mount RE 18546 .040 .010 .22 .45 .12 .28 56 1.1 79 17
Resistors. Variable
Wirewound. RTR 39015 .014 .034 .078 .16 .077 .15 .19 37 24 1.1
Trimmer RT 27208 .072 .17 .39 .79 .39 .74 .93 1.9 1.2 5.5
W.W., Prec. RR 12934 .84 2.1 5.5 11. 4.6 11 14. 29. 18. 132.
WW.., Semi- RA 19 .31 .84 2.4 4.8 2.1 9.5
Prec. RK 39002 .31 .84 2.4 4.8 2.1 9.5
W.W., Power RP 22 .31 .78 2.0 3.9 1.7 7.8
Non-W.W. RJR 39035 .02 .067 .12 .23 .95 23 .27 54 34 1.8
Trimmer RJ 22097 .10 .33 58 1.2 4.8 1.2 1.4 2.7 1.7 92
Composition RV 94 .12 .49 1.1 2.1 .88 4.1 6.6 13 6.8 18.
Non-W.W. Prec RQ 39023 .086 35 65 13 .58 1.3 2.8 5 2.b 10.
Film RVC 23285 .096 .34 6 1.2 .51 1.2 2.2 4.4 2.0 9.6

not normally used in these environments

124

• _ i~*1
 NRL REPORT 8488

Table 3-8 - Generic Failure Rate, AG, (f/O hr) for Capacitors
(See Table 3-9 for quality factors)
Capacitors, Fixed Use Environment
Dielectric Style MiI-C- GB & SF GF Air Ajr Ns G, AUT AUF .VU ML
Spec.
Paper CP 25 .0117 .022 .057 .11 .047 .057 .16 .31 .15 .29
Paper CA 12889 .012 .031 .087 .17 .083 .087 .47 .90 .53 .44
Paper/Plastic CZR 11693 .0047 .0098 .025 .05 .021 .025 .072 .14 .064 .13
Paper/Plastic CPV 14157 .0021 .0042 .0088 .018 .0088 .0088 .025 .05 .023 .044
Paper/Plastic CQR 19978 .0021 .0042 .0088 .018 .0088 .0088 .025 .05 .023 .044
Paper/Plastic CHR 39022 .0028 .006 .012 .024 .012 .012 .035 .069 .032 .06
Paper/Plastic CH 18312 .02 .042 .084 .17 .087 .084 .24 .49 .22 .42
Plastic CFR 55514 .0041 .0086 .022 .043 .018 .03 .067 .13 .075 .13
Plastic CRH 83421 .0023 .0048 .0096 .019 .010 .0096 .028 .055 .025 .048
MICA CMR 39001 .0005 .0022 .0059 .012 .0043 .0084 .044 .088 .042 .042
MICA CM 5 .003 .013 .035 .071 .026 .050 .27 .53 .25 .25
MICA CB 10950 .09 .19 .42 .85 .3 .60 1.9 3.8 1.4 3.0
Glass CYR 23269 .0003 .0014 .0037 .0075 .0066 .0053 .027 .054 .028 .026
Glass CY 11272 .001 .0043 .011 .022 .020 .016 .082 .16 .084 .079
Ceramic CKR 39014 .0036 .0076 .033 .066 .0098 .016 .068 .14 .032 .12
Ceramic CK 11015 .011 .023 .099 .20 .029 .047 .20 .41 .096 .35
Ceramic CCR 20 .0008 .0032 .008 .016 .0058 .011 .058 .12 .070 .057
TA, Sol. CSR 39003 .012 .026 .078 .16 .035 .052 .15 .29 .14 .26
TA, Non-Sol. CLR 39006 .0061 .014 .082 .16 .049 .069 .14 .28 .15 .23
TA, Non-Sol. CL 3965 .018 .043 .24 .49 .15 .21 .42 .83 .46 .69
Al Oxide CU 39018 .074 .23 1.2 2.3 .96 1.6 4.8 9.7 5.3 5.5
AL Dry CE 62 .090 .36 1.9 3.7 1.7 2.6 10. 21. 12. 8.7
Capacitors, Variable
Ceramic CV 81 .32 1.6 2.5 4.8 4.2 3.5 24. 48. 19. 31.
Piston PC 14409 .099 .54 1.2 2.3 1.7 1.5 9.2 18. 22. 7.5
Air, Trimmer CT 92 .4 3.0 4.8 9.4 8. 6.8 49. 98. 37. 60.
Vacuum CG 23183 1.2 6.2 15. 29. 15. 21. 140. 270. 94.

*Not normally used in this environment

Table 3-9-w-Q" Factor for

Resistors and Capacitors
Failure Rate Level * -Q
L 1.5
M 1.0
P .3
R .1
S .03
'For Non-ER parts (Styles with
only 2 letters in Tables 3-7 & 3-8).
ir - I providing parts are pro-
cured in accordance with the part
specification, if procured as com-
mercial (NON-M IL) quality, use
irQ - 3. For ER parts (Styles
with 3 letters), use the irQ value
for the "letter" failure rate level
procured.

125
I . -'d|
'A
 G.O. THOMAS

Table 3-10 - Generic Failure Rate, X G (f/10 6 hr) for Inductive Electromechanical
and Miscellaneous Parts (See Table 3-11 for 7rQ)
Part Type Use Environment
4
Inductive G8 & SF GF .4IT AIF Ns Gi L
Lr ALF NL ML

Low power pulse .003 .0048 .041 .082 .017 .047 .069 .14 .065 .12
transformer
Audio transformer .006 .0096 .082 .16 .034 .094 .14 .28 .13 .24
High power pulse & .019 .053 .31 .60 .13 .35 .46 .92 .98 .86
power transformer
filter,
R.F. transformer .024 .038 .33 .64 .14 .38 .56 1.1 .52 .96
R.F. coils, fixed .0016 .004 .021 .042 .0096 .048 .039 .078 .038 !2
R.F. coils, variable .0032 .008 .042 .084 .019 .096 .078 .16 .077 .24
Motors * 15. 19. 19. 24. 19. 41. 41. 49.
Relays
General purpose .13 .30 .65 1.3 .89 .81 2.8 5.6 2.9 16.
Contactor, high ,44 1.0 2.2 4.5 3.0 2.8 9.6 19. 10. 56.
current
Latching .10 .24 .52 1.0 .71 .65 2.2 4.5 2.3 13.
Reed .11 .26 .55 1.1 .75 .69 2.4 4.8 2.5 14.
Thermal bi-metal .29 .69 1.5 3.0 2.0 1.9 6.4 13. 6.7 37.
Meter movement .90 2.1 4.6 9.2 6.3 5.8 20, 40. 21.
Switches
Toggle & push .035 .011 .A' .35 .15 .61 1.8 3.5 .84 24.
button
Sensitive .15 .44 .74 1.5 .59 2.5 7.4 15. 3.4 100.
Rotary .22 .67 1.1 2.2 .89 3.8 II 22. 5.1 150.
Connectors (Per
Pair)
Circular. Rack & .0062 .029 .12 .24 .053 .12 .17 .34 .23 .18
Panel
Printed wiring .0031 .028 .060 .12 .036 .060 ,090 .18 .11 .090
board
Coaxial .0084 .032 .13 .26 .060 I0 .18 .36 .24 .20
Two-side PC board .0012 .0024 .005 .01 .0048 0048 .012 024 012 024
Multi-layer PC board .15 .30 .63 1.3 .60 .60 1.5 3.0 1.5 3.0
Connections See Section 2.13
Tubes See Section 2.3
Lasers See Section 2.4
*Not normally used in lhese environments.

Table 3-11 - frQ Factor for Use with Table 3-10

Quality Level
Part Type
Mi-Spec Non-Mil
Inductive 1 3
Motors I 1
Relays 1 3
Switches. toggle & sensitive 1 20
Switches, rotary 1 50
Connectors 1 3
P.W. Boards I -
Others - 1

126

01
 NRL REPORT 8488

2.1.5 FIGURES AND TABLES FOR THE MONOLITHIC MODEL PARAMETERS

This section presents the tables and figures for quantifying the parameters of the failure rate
models in Sec. 2.1.1 through 2.1.4 for the various monolithic microelectronic device types. The tables
are presented first, and then the figures.

Table 2.1.5-1. - rTQ

, Quality Factors

Quality Level Description

S Procured in full accordance with MIL-M-38510,
Class S requirements.
B Procured in full accordance with MIL-M-38510.
Class B requirements.
B-I Procured to screening requirements of MIL-STD-
883, Method 5004, Class B,and in accordance
with the electrical requirements of MIL-M-
38510 slash sheet or vendor or contractor
electrical parameters. The device must be
qualified to requirements of MIL-STD-883,
Method 5005. Class B. No waivers are allowed.
B-2 Procured to vendor's equivalent of screening 10
requirements of M1L-STD-883. Method 5004.
Class B,and in accordance with vendor's
electrical parameters. Vendor waives certain
requirements of MIL-STD-883. Method 5004. Class B.
C Procured in full accordance with MIL-M-38510, 16
Class C requirements.
C-I Procured to screening requirements of MIL-STD- 0
883, Method 5004. Class C and in accordance
with the electrical requirements of MIL-M-
38510 slash sheet or vendor or contractor
electrical specification. The device must be
qualified to requirements of MIL-STD-883.
Method 5005, Class C. No waivers are allowed.
D Commercial (or non-mil standard) part, I5o
hermetically sealed, with no screening
beyond the manufacturer's regular quality
assurance practices.
D-1 Commerical (ot non-mil standard) part. 300
packaged or sealed with organic materials
_ _(e.g.. epoxy, silicone, or phenolic).

127

1.
 Appendix D
ABSTRACT OF BUILDING SPECIFICATION
RELATING TO ELEVATOR CONTROLLERS AND SENSORS
USS AMERICA (CVA-66)

This specification was a modification to CVA-66, it is not the original building specification.
Elevator travel speeds shall be 37 .5m/min (125 ft/min) and 6m/min (20 ft/min). Magnetic contactors
on controllers are for I10 VAC, 60 Hz.

The coils of the solenoid valves are 110-120 VAC 60 Hz with an inrush current of 3 A and hold-
ing current of 0.SA. The operating coils shall be energized only sufficiently long to remove the spool in
the hydraulic control valve from one position to the other where it will remain after the coil has been
de-energized

Access to the trunk is by vertical or horizontal doors at each station and by horizontal ballistic
hatch covers at the main and third deck. The hatch covers and doors shall be so interlocked that (a) no
two doors in one trunk can be opened at any one time, (b) both hatch covers cannot be opened at any
one time, and (c) no door can be opened when the main deck hatch cover is open.

Control systems shall consist of a fully automatic static-logic system and a manual system permit-
ting jogging (only in slow speed) through direct control of the magnetic contactors in the motor con-
troller.

Fully automatic control of the hatch covers at the third and main deck will be required including
the control of the dogging arrangement in hatch-closed position and the latching arrangement in open
position.

Trunk access doors shall be push-button controlled for opening and closing from the particular
access level concerned. Access door dogging is manual and will not require interlocks. Access doors
on elevator platforms shall be interlocked to preclude opening more than one door at a time, opening
an access door if the elevator platform is not at that particular level, and dispatching the elevator plat-
form if the access door at that level is not closed.

In emergency mode the hatches will be opened by manipulating the hydraulic valve and the eleva-
tor jogged from either the main control station or the elevator machinery room.

Common switches and cabling shall not be used for the automatic and manual modes. There
should be an automatic-manual selector switch in the elevator machinery room.

Mechanical-type switches shall be furnished to de-energize the motor and brake when the plat-
form overtravels in either direction.

The static control and static switches need not be a qualified product b% 2hould be tested for
high-intensity shock, vibration and electromagnetic radiation.

Except for static switches, the equipment shall be suitable for operation at 50"C ambient tempera-
ture. Static switches shall be suitable for 65°C ambient.

128
 NRL REPORT 8488

Mechanical switches are used for overtravel. in connection with door opening and closing, and
related to jogging.

All equipment which requires installation in the elevator trunks and at the forward side on the
fourth deck of elevator number 5A shall be explosion proof Class I group D environment defined by
NEMIA.

Enclosures in the elevator machinery room shall be drip-proof. All other equipment shall be
spray-tight.

If the elevator is going to the main deck and receives no hatch-clear signal within 5s of arriving at
the stow level, the dispatch shall be cancelled and a new dispatch order is required.

For upward travel to the second deck. the third deck hatch remains open. This hatch closes only
for travel to the main deck and then only after stowage.

The elevator departs at high-speed except under jogging. Upon approaching a level, the speed
shall be transferred from high to low and finally stop with an accuracy of ±0.6 25 cm (±1/4 in.).

When the platform is being dispatched to an intermediate level, the slow and stop switches at the
end of the trunk in the direction of travel shall also act in case the switches at the intermediate level
fail. This will also apply to the stowage level sensors to prevent running into a closed main deck hatch
cover. An interlock switch is provided at the stowage level to allow an access door to be opened at the
second deck level when the platform is at stowage.

Emergency override at the main deck does not operate when the main deck hatch is fully closed.
When the hatch is partly open or fully open. momentary acttuation cancels al] orders and dispatches the
platform to "stow" at high speed. Upon reaching "stow" the main deck hatch is automatically closed and
dogged. There are locking bars for the platform while at stow.

Four slack-cable devices and an overspeed device are required. These slack-cable and overspeed
conditions shall not prevent jogging either up or down.

A safe or dispatch signal shall consist of a potential difference from ground or chassis into tile
logic. When the potential returns to ground it causes an unsafe signal.

Duplicate slow-down switches shall be provided for the upper and lowermost landings of each
elevator. If the slow switch has failed to open the high speed contactors, the second slow switch inter-
rupts all power to the motor and brake. The high-speed contactor provides a signal different from
ground when open, and the slow-speed contactor provides a signal different from ground when closed.

The auxiliary contacts on the high and slow contactors shall be connected in series to form one
input signal to the logic. No single failure ot' any component in the control system or wiring shall cause
unscheduled operation of the controlled equipment. An analysis shall be made documenting the effects
of all failure modes of the components and wiring.

The motor controller will have a power-on indicator light and a neon indicator light in parallel
with the emergency stop switches. The power supply for the logic will be designed to absorb transients
of ±20% in the AC power supply without causing malfunctions. Printed circuit boards will be to MIL-
P-13949D. Semiconductors and integrated circuits, if not selected from NIIL-STD-701F. will be tested
in accordance with MIL-STD-202 method 106B. Cabinets will be drip-proof to MIL-E-2036.

A 10 000-h non-resetable elapsed time meter shall be installed. The device need not be shock
resistant and not necessarily visible from outside of the cabinet.
129
 G.O. THOMAS

A GO/NO-GO tester shall be provided. The tester shall include 10% of every card type but at
least one card of any type for the most complicated elevator system on the ship. These cards are not
considered as spares.

Potting of electronic components should be avoided except that this requirement does not apply to
static switches. No assembly, except static switches, shall be furnished which will not permit emer-
gency repair including the removal and replacement of semiconductors without undue damage to
printed circuit boards. A means for checking the status of input devices is needed.

Static switches for safety purposes shall provide a logic one output to indicate a safe condition.
Logic one is different from ground. Static switches have an output logic one when the switch is not
actuated by a device. Platform sensing accuracy must be ±0.156 cm (± 1/16 in.) at within 1.25 cm (1/2
in.) from the sensor.

Static switches shall be watertight and explosion proof to MIL-E-2036C (NAVY), and shock proof
to MIL-S-901C (NAVY) for Grade A, Class 1. Type A. Static switches shall have 6 m (20 ft) of
molded, flexible shielded integral cable.

Reliability objectives for the system are 2 000 h mean operating time between failure. Preventa-
tive maintenance should not be scheduled for operating time segments of 100 h. Preventative mainte-
nance scheduled for 1 000 h segments must be such that it is possible to return to an operating condi-
tion upon command within 20 min. Planned maintenance and repair personnel ability level is that of
an Electricians Mate third class as defined in the manual of "Qualifications for Advancement in Rating"
NAVPERS 18068-A.

130
 Appendix E
ABSTRACTS FROM NOTES BY ELEVATOR MAINTENANCE PERSONNEL
ON THE USS NIMITZ
Subi: Lower stage weapons elevator #1; Status of

1. Proximity switch 41 amplifier improperly labeled. Should be "Main Deck Door Unlatched."

2. Elevator Hoist Motor Controller "power on" indicating light is out.

3. Hold door will only partially undlog. Proximity switch 78 amplifier indicating light does not come
on.

4. Unlatch proximity switches 61 and 79 only operate intermittently.

5. Second platform aft door won't undog.

6. There is no signal to the third deck hatch pin secure solenoid even though proximity switch amp
has an output.

7. "Elevator herie light on second deck works with elevator movement in down direction only.
Second deck up stop proximity switch #5 does not work with elevator movement in up direction.

8. Main deck door won't open. No signal from D1013.

Subj: Lower stage weapons elevator #2. Status of

1. Sixth deck inboard door unlatch proximity switch 67 not operating properly.

2. Fifth deck inboard door "closed' proximity switch 62 amplifier puts out a constant signal irregard-
less of door position.

3. Inboard and starboard doors on the fourth deck are inoperative due to faulty magazine interlock
proximity switch circuit (PS 76 & 77).

4. Second deck door won't open because undog solenoid consistently blows fuse F40.

5. Supplies stowed on top of main deck hatch. Therefore could not inspect on station main deck.
hatch sequence, or hatch operaition.

Subj: Lower stage weapons elevator #3-. Status of

I. Hold port door unlatched proximity switch 89 amplifier indicating light is not on with door closed.

2. Third deck hatch pin secured proximity switch 41 amplifier indicating light on with hatch closed.

3. Hold aft door extend ramp solenoid fuse FlI 10 blown.

4. Could not operate elevator due to bent cable sheath.

131

. . ... .
 G.O. THOMAS

Subj: Lower stage weapons elevator #4; Status of

1. Hold slow-speed proximity switch 25 amplifier indicating light inoperative.

2. Amplifier indicating light doesn't work for unlatch proximity switchs 70, 75, 82, and 89.

3. Hold starboard door won't undog--SCR amplifier G5B probably defective.

4. Hold forward door won't open.

5. Second platform starboard door won't undog-SCR amplifier G2B probably defective.

6. Second platform forward door won't open-set-reset memory E5B has no output.

7. First platform starboard door-open solenoid missing.

8. First platform starboard door ramp-extend fuse F72 continually blows.

9. First platform forward door proximity switch 64 amplifier indicating light doesn't work.

10. Several solenoids in machinery room have puddles of cellulube beneath them.

Subj: Lower stage weapons elevator #5; Status of

1. Hold port door-open solenoid missing.

2. Hold aft door will not open--down-stop proximity switch 27 inoperative.

3. Second platform port and aft doors will not open.

4. Second platform aft door unlatch proximity switch 87 amplifier indicating light out.

5. First platform port door will not open.

6. Fourth deck port and starboard doors will not open.

7. Second deck forward door keeps blowing fuses.

8. Third deck hatch can't be closed--mechanical problem.

9. First platform starboard and aft doors, fourth deck forward and aft doors could not be tested.

Subj: Lower stage weapons elevator #6: Status of

1. Third deck hatch always open due to mechanical problems.

2. Proximity switch amplifier 97 has no SD tag (third deck hatch pins unsecured).

3. Fifth deck port door won't close-PS 60 inoperative.

4. Sixth deck forward door won't open-Fl I 1 blows (undog).

5. Fifth deck forward door won't open-F83 (PS67 undog) blows.

132
 NRL REPORT 8488

6. Fifth deck starboard door won't open.

7. Couldn't check stow level due to third deck hatch problem.

8. PS95 and 102 operate intermittently-seventh deck (hold) forward and starboard doors unlatched.

Subj: Upper stage weapons elevator # 1; Status of

1. 01 level forward door open solenoid is missing.

2. 01 level forward door will not dog automatically due to faulty dog solenoid or SCR E8B.

3. Elevator cannot be sent from stow to 01 level.

4. Flight deck hatch will not open.

Subj: Upper stage weapons elevator #2. Status of

1. Second deck port door ramps won't retract and door won't dog automatically.

2. Main deck aft door won't open.

3. Main deck aft door ramp retract proximity switch amplifier 59 has no output when ramp is
retracted.

4. Elevator can't be sent from main deck to second deck electrically-possible defective SCR E1B.

S. Elevator will not stop at 02 level regardless of direction of travel or barrel switch positions.

6. Could not test 02 level starboard door for reason stated in 5.

7. Flight deck hatch undogged proximity switch 19 operates intermittently.

8. This elevator has a major memory logic problem that precluded the testing of on station flight
deck or flight deck hatch.

Subj: Upper stage weapons elevator #3; Status of

I. Main deck hatch inboard ramp-retracted proximity switch 29 operates intermittently.

2. Second deck starboard door will not open.

133

,. t,-. -:- ,j . . . . , , ., . -.... . . ,

 Appendix F
WEAPONS ELEVATOR INSPECTION -GENERAL COMMENTS BY
ELEVATOR MAINTENANCE PERSONNEL ON THE USS NIMITZ

Subj: Weapons Elevator Inspection -General Comments

I. The number of major discrepancies discovered during this inspection are considered to be exces-
sive given the importance of the equipment.

2. Communication of known discrepancies between the operators and maintenance personnel is

inadequate.

3. It is suggested that the normal functions of the elevators be tested at least once a month by
knowledgeable personnel.

4. Maintenance personnel should be cross-trained as operators and have a thorough understanding of

the elevators' sequence of operation.

5. All proximity switches should be inspected at least once a quarter for proper operation. The prox-
imity switch nulls and amplifier rheostats should be adjusted only during this inspection, if neces-
sary, and not independently, (as a matter of course) while trouble-shooting:

6. Manual overriding of the hydraulic valve solenoids should only be done upon the concurrence of
both an electrician and an aviation ordnanceman.

7. The knowledge level of the equipment currently held by maintenance personnel is considered to
be too low for proper elevator electrical maintenance.

8. To insure proper operation these elevators must be kept in adjustment. In order to do this and
reduce the large amount of corrective maintenance currently needed it is suggested that a more
comprehensive preventive maintenance package be compiled and inaugurated.

134
 Appendix G
INPUTS, FUNCTIONS AND OUTPUTS OF THE
PDP-14 LOGIC CONTROLLER

INPUTS TO LOGIC CONTROLLER (Figure 5-5)

The following interlocks, and switches provide the Logic Controller with information concerning
the status of the elevator and the commands requested. The inputs are received in the ENCODER
INTERFACE unit or the INPUT BOX A of the PDP-14 system. It is assumed that on the Motor Con-
troller, the NORMAL/JOG switch is in the NORMAL position:

a. ROM Interlock (Safety) (Figure 5-5 Sht. 2) - This interlock furnishes an AC input to the
controller to indicate the Safety Interlock circuit is complete. If the OVERTRAVEL BYPASS on the
Motor Controller is turned to the UP or DOWN position, the ROM Interlock portion of the switch will
be opened, causing the PDP-14 to stop its dispatch. When the NORMAL/JOG switch is placed in the
JOG position it will also disconnect the ROM Interlock circuit. This signal is connected to INPUT BOX
A of the PDP-14 unit.

b. LOCKBARS EXTENDED Limit Switch (Figure 5-5 Sht. 2) - When the lockbars are
extended an AC input is provided to the controller. This signal is connected to INPUT BOX A of the
PDP-14 unit.

c. LOCKBARS RETRACTED Limit Switch (Figure 5-5 Sht. 2) - When the Lockbars are
retracted an AC input is provided to the controller. This signal is connected to INPUT BOX A of the
PDP-14 unit.

d. HS INTERLOCK (Figure 5-5 Sht. 2) - This interlock will provide an AC Input when the
elevator is operating in the LOW SPEED mode. During HIGH SPEED operation the interlock will be
interrupted. This signal is connected to INPUT BOX A of the PDP-14 unit.

e. ENCODER Unit (Figure 5-5 Sht. 5) - This unit provides the controller with a 13 bit binary
number which represents the location of the elevator platform in the trunk. The encoder also sends a
complementary 13 bit binary number which is used in a self checking feature. Power for the encoder is
provided by the encoder interface unit and is a +5 VDC. This 13 bit binary signal of 5V level is con-
nected to the encoder interface as an input.

f. PROXIMITY Switches (Figure 5-5 Sht. 5) - There are 26 of these switches providing the
following information to the PDP-14: A- platform high leveling (1), and platform low leveling (Q), B-
3rd Deck Hatch. dogged (2), undogged (2). opened (2), closed (2). latches (2), and unlatched (2). C-
Main Deck Hatch. dogged (2), undogged (2). opened (2), closed (2), latches (2), and unlatched (2).
The switches operate on a 28VDC which is supplied by a special 28VDC Power Supply located in the
logic controller. The switch is a type 8-078-02 proximity switch which means it is configured in the
normally open position or de-actuated with the target away. The signals from the switches are con-
nected to the encoder interface unit. The logic control has a test feature for use with the proximity
switches which will be covered under test equipment and features.

g. DISPATCH Commands (Figure 5-5 Sht. 4) - These AC signals are originated at the various
control stations in the system. Pressing the dispatch push buttons, Main Deck, Stow, 2nd Deck, 4th
Deck, Ist Platform, Dispatch Enable, Hatch Clear, or EMERGENCY OVERRIDE will provide the
PDP-14 with the appropriate request. The signals are connected to the AC INPUT BOX.

135

I.
 G.O. THOMAS

LOGIC CONTROLLER FUNCTIONS

This controller was designed to replace relay and static logic control systems. The automatic
selection and control of the various functions of the elevator is accomplished primarily by the PDP-14
control system. The PDP-14 will take an incoming command signal, check it against the status of the
system, and using a Read Only Memory Unit, initiate commands in a logical sequence to complete the
function requested. The logic controller is used only in the NORMAL (Automatic) mode. The major
components of the logic controller are discussed below. All references are to Figure 5-5.

a. POWER UNIT (Figure 5-5 Sht. 6) - This unit is a Technipower Inc. Type M-28 .O-6.OG
power supply. Using 115 VAC input it produces an output of 28 VDC which is used to supply the
power requirements for the proximity switches.

b. A.C. INPUT BOX A - BX14-DA (Figure 5-5 Sht. 4) - The input box is a part of the PDP-
14P system. This unit has the capability of receiving 32 inputs, however, at present only 16 are used.
The function of the input box is signal conditioning, isolation, and input selection. The four K578
modules (each capable of processing 8 signals) receive the 115 VAC incoming signals, where they are
reduced and isolated thru a step down transformer, then rectified and filtered to provide a 5 VDC sig-
nal. A small LED lamp on each input line will indicate when a signal is present. The input box which
is constantly being scanned by the Control Unit using a SELECTION CODE and PACKAGE SELECT
for a SAMPLE RETURN (signal). A PACKAGE SELECT signal from the control unit is sent to the
K136 GATE module which will then allow the two K161 DECODER modules to respond to
SELECTION CODE. An active input provides a 5 VDC signal on the SAMPLE RETURN LINE and
an absence of input provides a zero voltage. The Control Unit will select one of the two signals pro-
cessed by the K161 modules.

c. OUTPUT BOX - BY14-DA (Figure 5-5 Shts. 4 and 6) - The controller has a total of three
output boxes, which are a part of the PDP-14 system. In the elevator drawings they are labeled A. B.
and C. Each output box has the capability of receiving 16 output commands; however, 16 for A box,
12 for B box, and 4 for C box are used at the present time. The functions for the output boxes are
output selection (and testing), output function command, and Isolated AC output switching.

(1) A PACKAGE SELECT signal from the control unit is sent to the K135 GATE module to
activate 2 particular output boxes and select one of two K161 DECODERS. This will enable
the K161 DECODERS to respond to the SELECTION CODE which in turn selects one output
control circuit of eight contained on the two K207 Stowage Registers. There are a total of four
K207 Registers in each output box, each register contains four output control circuits. Each of
these outputs is used to control an AC output on a K616 ISOLATED AC SWITCH module.
There are four K616 modules in each output box. The output of the K207 Stowage Register
will turn ON or OFF a solid state AC control device in the K616 module. This will activate or
deactivate the external solenoid or device that is required.

(2) When the Control Unit sends its SELECTION CODE, it can also issue one of these func-
tional commands, ENABLE SET, ENABLE RESET, and CLEAR. ENABLE SET will turn on
a K207 control circuit corresponding to the selected output. The ENABLE RESET will turn the
circuit off. The CLEAR signal will turn every output circuit off, regardless of selection. The
K207 will remain in its present state until another command is received, meaning it acts as a
memory device. When the PDP-14 system is stopped and then restarted, all K207 output cir-
cuits are turned off, just as if the CLEAR command had been issued.

(3) When the SELECTION CODE has selected an output, a SAMPLE RETURN indicates the
condition of the selected K207 to the Control Unit. All the K207 modules are continuously
scanned for status via SAMPLE RETURN signal regardless of whether a command has been
issued or not.
136
 NRL REPORT 848

A LED lamp provides an indication when the K616 module is providing an output to the eleva-
tor.

(4) Due to the large inrush currents required by the four Up and Down, Slow and High Speed
contactors in the Motor Controller, it was necessary to provide AC solid state intermediate
relays, which are controlled from the K657 output circuits of a BY14-DA output box. The
solid state relays in turn control the current to the main contactor coils.

d. ACCESSORY BOX - BA14 - The accessory box is physically identical to the input and out-
put boxes. There are no AC circuits in the Accessory box and the entire space is therefore available for
time delay modules. Six are used in this application. Each accessory box functions in SET, RESET,
and TEST operations, exactly as an output box and therefore contains groups of K135 GATES, K161
DECODERS and K207 STORAGE REGISTERS in addition to the K302 timers. The meaning of the
SET and RESET commands is similar to the output box; they activate or deactivate the selected output
circuit. The TEST command produces a SAMPLE RETURN which indicates the operation of the
selected device.

(1) Each K302 timer is separately adjustable for the desired time, depending on the function as
below:

APPROXIMATE ACTUAL
TIME SETTING (s) TIME SETTING (s)
DY60 STOP DELAY 0.1
DY61 POSITIONING DELAY 5.0
*DY62 HATCH OPERATION DELAY 35.0
DY63 POSITIONING FAILURE DELAY 10.0
DY64 EMERGENCY OVERRIDE DELAY 2.0
DY65 HIGH SPEED STOP DELAY 0.1
DY66 HATCH CLEAR TIMER 25.0
DY67 MASTER CLOCK 0.5
DY70 ENCODER ROTATION FAILURE DELAY 1.25
DY71 LOCKBAR TIMER 5.0
DY72 LEVELING PULSE TIMER 0.1

(2) As in all output circuits, a timer is normally OFF. A timing cycle is begun by a SET com-
mand from the PDP-14 Control Unit. At the end of the time delay, the timer output turns ON
until a RESET command turns it OFF. In other words the timer is a delayed ON type.

e. ENCODER INTERFACE UNIT (Figure 5-5 Sht. 5) - The Encoder Interface Unit is a small
frame which contains logic circuits to interface the Encoder to the control system and provide D.C.
input capability for the Proximity switches. The unit is made up of seven sections, a Power Supply, a
Nixie Tube display, an Equality Detector, a Comparator, a Matrix Driver, a D.C. Input box and a Par-
tial Output box.
(1) POWER SUPPLY - The Power Supply is made up of a K741 transformer module to pro-
vide 12.6 VAC for the Nixie tubes, a K731 +5 VDC power supply and regulator module and
the K732 slave regulator module which is added to increase the +5 VDC output of the K731
module to 3 amps which provides power to the Encoder Unit in the Machinery Room. The
power bus of the PDP-14 control unit is tied in parallel with the output of this power supply
and is large enough to handle the interface without the K731I and K732 modules, however, the
K741 transformer is still required for the Nixie tube display.

137
 G.O. THOMAS

(2) NIXIE TUBE DISPLAY - This display uses five K415 modules to indicate the Encoder
number in Octal form (base eight numbers), this number gives the relative position of the plat-
form in the trunk. The numbers are expressed in base eight due to the ease in converting from
base two to base eight and because base two numbers are very difficult to remember.

(3) EQUALITY DETECTOR - Since during operation of the elevator, the operator would
have no way of knowing if the Encoder is operating properly until a casualty occured. the Inter-
face unit utilizes the fact that the Encoder puts out a complementary output for each normal
output and detects if any two outputs, that should be opposite, are equal. If this occurs, a sig-
nal is given to the Control Unit of the PDP-14 and the elevator is stopped.

NOTE
Such a failure could occasionally occur
due to noise in the system, loose wiring
or an occasional bounce of a brush in
the Encoder. If this should occur the
power to the elevator must be turned
off and then on before the system will
operate again.

(4) COMPARATOR - This section tells the PDP-14 Control Unit whether the Encoder out-
put Binary number is above or below the Matrix Pinboard output number. The Comparator
simply compares the Matrix Output to the Encoder output and gives a signal out if the Encoder
number is lower (Platform higher). The controller understands that if there is no signal that
the Platform is lower than the reference line, and that if there is a signal that the Platform is
higher than the reference line. The Comparator does not give any indication of "how much"
only "above or below."

(5) MATRIX DRIVER - This section combines the twelve LEVEL inputs (outputs from the
Control Unit but inputs to the Matrix Driver) and the four OPERATIONAL inputs to produce
48 outputs to the Matrix Pinboard. The Matrix Driver uses simple "AND" logic to take one
LEVEL input and one OPERATIONAL input to obtain one Matrix output. For example, if the
Platform was traveling up to the 2nd Deck in high speed, the controller would want to know
when it should slow down. Therefore, once during each pass of the program it would energize
the 2ND DECK output and the UP-SLOW output. The Matrix Driver would combine these
inputs and energize an output corresponding to the 2ND DECK UP-SLOW position.

NOTE
It should be noted that this elevator
uses only six of the twelve outputs
since only six individual levels are
served in this installation.

(6) D.C. INPUT BOX - This input box serves the same purpose as the A.C. input box dis-
cussed previously, except the input modules are four, K564 modules. The four modules each
have 8 inputs available for use. Three use all 8 inputs while the fourth uses only 2 inputs.
They accept a DC voltage of 28 V from the proximity switches and convert it to a 5 VDC sig-
nal.
(7) PARTIAL OUTPUT BOX - The Control Unit of the Logic Controller has one output
slot (16 outputs) assigned to the Interface unit. These outputs are energized when the program
requests the position of the Platform with respect to a position given by the Matrix Pinboard.
This output is exactly the same as the other Output boxes except they are not in the same

138
 NRL REPORT 8488

enclosure and they are never raised above the +5 VDC level. rhe outputs are instead fed
directly into the "Matrix Driver."

NOTE

Twelve outputs correspond to the vari-

ous levels of the elevator; Main Deck,
Sequence Level, 2nd Deck, etc. and
four outputs correspond to positions
around the levels; Up-Slow, Up-Stop,
Down-Stop and Down-Slow.

f. MATRIX PINBOARD - This is an AMP, Inc., Type 397070-5 unit that is an operational
part, although not a physical part, of the Encoder Interface Unit.

(1) The Pinboard is a very simple mechanical device consisting of vertical and horizontal rows
of gold-plated metal strips which are layed out to accept diode pins, which connect these strips
through diodes. The horizontal strips are connected to the outputs of the Matrix Driver and
the vertical strips are inputs to the Comparator section of the Interface unit.

(2) Only one input to the Pinboard can be accepted at any one time. This input energizes a
particular horizontal strip which in turn energizes the vertical strips that have a Diode Pin at the
intersection of the horizontal strip. The Diode Pins act as conductors from the horizontal strips
to vertical strips but are non-conductors from vertical strips to horizontal strips.

g. CONTROL UNIT - This unit is a type PDP-14 consisting of a DA-14L Computer Interface,
MR-14 Read Only Memory (ROM) and M232 Storage Module.

(1) To accomplish its purpose, the PDP-14 tests the status of its input devices, consisting of data
from the Encoder, dispatch orders from pushbuttons and signals from safety devices that show the
elevator is in a safe operating condition. It also tests its outputs, which consist of signals to the Motor
Controller contactors and relays, the coils of solenoid operated hydraulic valves and the indicator lights
showing the position of the platform. The PDP-14 compares these conditions one at a time with infor-
mation from the control program within the ROM. The results of these comparisons cause outputs
associated with these conditions to be turned "on" or "off." The PDP-14 Control Unit interrogates the
inputs and outputs continuously in a cyclic fashion.

(2) The Read Only Memory contains all PDP-14 control system instructions in a pattern or braid
of wires. This pattern is actually a list of permanently wired electrical instructions which are read by the
Control Unit to dictate the system's operation.

(3) The storage module provides 16 dummy output circuits to be used by the ROM program.
This module is a single-height module which replaces the cabi' normally used to attach an "0' box or
"A"box to the control unit.

(4) For a detailed theory of operation see PDP-14 system maintenance manual DEC-14-HGZB-D
chapter 3.

h. SUPPORT TEST EQUIPMENT

(I) INTERROGATOR BOX - The interrogator box is a very useful tool in troubleshooting the
PDP-14. It allows the troubleshooter to see what inputs or outputs the PDP-14 "thinks" are on or off.
The interrogator box interrupts the normal program process for one instruction and executes its own

139
 G.O. THOMAS

instruction to ask if the selected input or output is on or off. In this way it is very similar to a test
computer.

(2) PROXIMITY SWITCH TEST CIRCUIT - The purpose of this circuit is to check the
electrical operation and circuitry of the proximity switches. The switch operates in three modes: (1)
normal, (2) actuated, and (3) dc-actuated. In the normal mode the switch responds to the presence or
absence of a target at its sensitive face. In the actuated mode the switch has a voltage output regardless
of the presence or absence of a target. The mode is controlled by the switch's white wire call BIT (built
in test). When the wire is connected to the negative or common line the switch is in the normal mode.
When the wire is left to "float," that is not connected, the switch is in the actuated mode. When the
wire is connected to the positive or supply line the switch is in the dc-actuated mode. The way the
wires are connected is controlled by the test switch in the logic controller. The switch has three posi-
tions and will simultaneously test all proximity switches. The three positions marked OFF-NORMAL-
ON connect the BIT wires to the supply voltage, common voltage and no voltage respectively. The test
results are displayed by LEDs on the DC input modules located in the Encoder Interface Unit.

OUTPUTS FROM THE LOGIC CONTROLLER (Figure 5-5)

The following outputs serve the operation of the elevator either as control command functions or
for system operational status. Some of the outputs originate only from the Logic Controller during
NORMAL operation, while the remaining outputs may originate from the Logic Controller during
NORMAL mode and the Motor Controller during JOG mode. It is assumed that on the Motor Con-
troller, the NORMAL/JOG switch is in the NORMAL Position. When the output is originated from
either controller it will be discussed below.

a. HATCH SOLENOID CONTROLS (Figure 5-5 Sht. 4) - These outputs originate only from
the Logic Controller and are used to energize the hydraulic solenoids that control the
dogging/ undogging, opening/closing, latching and unlatching of the 3rd Deck and Main Deck Hatches.
The indicators on the A Output Box will light when the solenoid is energized by 115 VAC supply.
There are 12 of these indicators for the hatch solenoid function and no more than one should be lit at a
time. When the Motor Controller is placed in the JOG mode the power is removed from the Logic
Controller, and therefore, no power is available to control the solenoids.

b. HATCH CLEAR INDICATOR (Figure 5-5 Sht. 4) - This output originates only from the
Logic Controller and when energized will light the Hatch Clear indicator lamp on the Main Deck
Recessed Control Station.

c. HATCH OPERATION ALARM (Figure 5-5 Sht. 4) - This output energizes only from the
Logic Control and when energized will supply power to a bell warning device located on the underside
of the Main Deck Hatch. The signal may be steady or interrupted, depending upon the operation tak-
ing place.

d. MASTER CLOCK (Figure 5-5 Sht. 4) - This output is returned to the control unit via cable
G782 to slot 32C. It is used internally in the PDP-14.

e. HATCH FAILURE INDICATOR (Figure 5-5 Sht. 4) - This output originates only from the
Logic Controller and when energized will light the Hatch Failure indicator lamp on the 2nd Deck Mas-
ter Control Station.

f. AT STATION INDICATORS (Figure 5-5 Sht. 4) - These outputs originate only at the Logic
Controller, and when energized indicate the location of platform by lighting lamps on the Logic Con-
troller and the Master Control Station. The indicators are Main Deck, Hatch Sequence, 2nd Deck, 4th

k 140
 NRL REPORT 8488

Deck, 1st Platform and 2nd Platform. The output signal will be steady or interrupted depending upon
the platform status.

g. INDICATOR LIGHT FLASHER (Figure 5-5 Sht. 4) - This output is returned to the Out-
put Box B as an AC input for the At Station indicators (paragraph 5-19f). The output is either steady
or interrupted, depending upon the position and status of the elevator platform.

h. RETRACT/EXTEND LOCKBARS (Figure 5-5 Sht. 4) - These outputs both originate from
the Logic Controller, however, when the Motor Controller is in JOG mode RETRACT LOCKBARS
may take place by pushing the RETRACT LOCKBARS push button on the Motor Controller (Figure
5-5 Sht. 2). The output signal is 115 VAC which is used to energize the pneumatic solenoid valves for
platform locking bars.

i. INDICATOR LIGHT ENABLE (Figure 5-5 Sht. 4) - This output may originate in the Logic
Controller in the NORMAL mode, and from the Motor Controller in the JOG mode. The output sig-
nal (115 VAC) is routed through the NORMAL/JOG switch, BY35 to Y35, (Figure 5-5 Sht. 2), then
through CAR HERE indicators and Deck Level indicator switches (Figure 5-5 Sht. 3), in the JOG
mode 115 VAC is supplied through one side of the primary supply line to Y35, then the same route as
above.

j. LEVELING FAILURE INDICATOR (Figure 5-5 Sht. 4) - This output originates only from
the Logic Controller and when energized will light the Leveling Failure indicator lamp on the 2nd Deck
Master Control Station.

k. ENCODER ERROR INDICATOR (Figure 5-5 Sht. 4) - This output originates only from
the Logic Controller and when energized will light the Encoder Error Indicator lamp on the 2nd Deck
Master Control Station.

I. AUX RELAY OUTPUTS (Figure 5-5 Sht. 5) - These outputs may originate in the Logic
Controller in the NORMAL mode, or the Motor Controller in the JOG mode. There are four Aux
Relay outputs on the Output Box C. which when energized provide 115 VAC to intermediate relays
which in turn provide 115 VAC to the UP, DOWN, HIGH SPEED and LOW SPEED contactors in the
Motor Controller (Figure 5-5 Sht. 2). When using the JOG mode, the 115 VAC signal is provided
directly to the Motor Contactors using the JOG UP and JOG DOWN pushbuttons. In JOG mode, only
the LOW SPEED contactor is used.

141

.
I)'|

...... II ...............
.... in..... _... .. .. ..
 Appendix H
CONTROL AND CONTROL SYSTEMS MANUFACTURERS

Allis-Chalmers

B and B Electromatic Corporation

Bunker-Ramo

Cutler Hammer

Digital Equipment Corporation

Dover Corporation Elevator Division

Electronics Corporation of America

Gems Division DeLaval Turbine

General Electric

Honeywell, Inc.

Link-Belt

Otis

Square "D" Company

Unidynamics

US Elevator

Wavco

Webb Jervis B. Company

Westinghouse Electric Corporation

142

b.
 Appendix I
SENSOR AND SENSOR CONMPONENT MANUFACTURERS

ASCO
Autron, Inc.
Banner
Clairex Electronics
Conveyer Systems, Inc.
Cutler Hammer
Eldec
Electro Corporation
Electronic Counters and Controls, Inc.
Ferranti
General Equipment and Manufacturing Company
Gordon Engineering Corporation
Hyde Park Electronics
International Rectifier
Magnetics. Inc. Industrial Division
Microswitch
Midland-Ross Corporation Electric Products Division
NAMCO Controls
National Sonics Corporation
OMRON
Otis
PECO Corporation
R & S Industrial Control Devices Electrical Products Division
RCA
Sentrol
Singer Company
Skan-A-NLatic Corporation
Spectronics Division of Honeywell
Sperry
Sprague
Square "D"
Texas Instruments
United Power and Control Systems, Inc.
Vactec
Ward Leonard Electric Company
Webb Jervis B. Company
Xercon. Inc.

143
IcI