Surplus electronic parts : https://epartsconnect.com
Stock and Crypto AI Prediction : https://stocksignalslive.com

This is an RS14 module which is connected to a shaft or car network on an Elevator. It has four connectors designed to interface to illuminated buttons.
In the case of the landing call buttons there would be a four wire network running down the shaft with power (30V) and data lines. The network cable loops past each of these modules in the LOP units (Landing Operating Panel) where two or more illuminated buttons will be plugged into it.
When a landing button is pressed the module communicates with the main controller to let it know, and then receives data back to turn on the LEDs in the button. Each of these modules has a set of address switches to indicate its position in the system.
I was expecting this to use a CAN bus network, but it appears to be a proprietary standard with Otis's own data transfer protocol. I was quite surprised to see that it didn't use a standard RS485 or other network driver chip, as they simplify the circuitry and are usually quite rugged.
At this point in time I haven't sussed out the communication circuitry, but I'll make a guess that the comparator is probably receiving a differential signal and the module may be using a discrete push-pull circuit to put data onto the network.
I'm wondering if the RSL (Remote Serial Link) system is just an early standard that Otis developed and have continued to use due to their core software being based around it.
As with many other things, the module has been cloned in many forms. You can get copies for around £10, although it should be noted that if the software they use is a bad clone then they could cause network reliability issues.
When I was trying to identify the chip based on the Otis part number I found many Chinese sellers offering the chip for sale. I'm not sure if it's the real thing or a clone.
If you enjoy these videos you can help support the channel with a dollar for coffee, cookies and random gadgets for disassembly at:-
http://www.bigclive.com/coffee.htm
This also keeps the channel independent of YouTube's advertising algorithms allowing it to be a bit more dangerous and naughty.
#ElectronicsCreators

This tiny little board is a zero network node for an otus elevator, and it's designed to control in this particular instance uh four of these illuminated buttons. So you basically got a little button. You press it and it will actually then eliminate the button and your call is in um, but it's quite interesting, the construction of it - and this also seems to be using a proprietary network system. So, let's take a closer look at the circuit board in a larger scale, because i've already blown it up, not actually i've actually not managed to blow it up physically, but this is what it looks like on the front.

This is what it looks like on. The back. Goodness knows what it looks like inside, because it's a multi-layer circuit board, and that is quite frustrating, but on the back, basically speaking, it's the uh in this area. It's the button, filter inputs and the rest of it is largely, i think, the network control, which is very very hard to trace.

But let's take a look at the circuit board itself and what's on it, so i'm going to zoom down a bit. It's kind of interesting, it's very typical, of an industrial application. This area is covered in conformal coating. It's not an attempt to hide the numbers, it looks like numbers have been scrubbed off, but in reality it's just they've put splooge all over this and the reason they've done.

That is probably for stability, because sometimes these modules get operated in humid environments or are in a wall where water drips down onto them, and one of the problems of that is that if water drips onto the circuitry here and causes problems particularly around the oscillator area, If it caused the processor to glitch or crash, it could actually pull down the entire network and just basically stop all the landing buttons in every level from operating this. Incidentally, the four buttons, if in the case of say, for instance, the lop the landing operating panel - you'll just possibly have one of these. But in the case of the car operating panel, the cop, you might have a stack of these clipped into a little frame or a version with a lot more channels depending on the brand or you know, depending on the manufacturer and their their particular preference. I did notice the chinese were selling a version of this that looked basically at the one network, connection and power connection, but it had stack.

It had multiple sets of these and it had that repetition of this chip. This chip, incidentally uh - what's the number on it? It is gaa 31070 aaa 1 and it appears to be a microcontroller pic microcontroller, but it's been custom programmed with otis's own code and it's been given their part number on the white connector. At the side. We have the two zero bus connections.

I believe that the uh rsl, the remote serial link network is based on rs485 voltage levels, but i'm not 100 sure about that. It appears to be using otis's own protocol. I thought it was going to be canvas. I was looking for a can bus chip.

I don't even see an rs485 driver, and i have to say because this is a multi-layer pcb that you can't actually see both sides similar well, the the interior layers. It's made it very very hard to trace out. I may give it another go, but it's also. I had to put my little super extra thin gold probes, the stabby needle ones on, but trying to actually probe on one side, while probing on the other side is extremely difficult, because the probes, still you know, slip off the components it just it's been.

It's been frustrating particularly those hidden tracks, but the supply comes in 30. Volts uh has a transient suppression diode here a polarity protection diode here there's some other filter capacitors, but here is the electrolytic. Capacitor is used just to basically provide a stable local supply. That is then used to generate two 23 volt supplies.

I'd guess that the standard is probably 24 volt, but they've nudged them down by one volt. And although they've got two regulators, i think they've just split the load between two regulators, because each one is doing two connectors and that's it except this one which has a little resistive me off through a diode network. And then it's coming down. That's going to another regulator, the tl317 they're all 317s, which is local programming to set it for 5 volts.

The only other chip here on the microcontroller is an lm393, which is a comparator which is like an op-amp, but it's designed for decisive voltage comparisons and a sudden logic transition. Um. The buttons they've got a couple of uh local, smooth capacitors for those 24 volt supplies. They have basically on the pins here.

They've got uh the zero volts they've got the input from the push button, the 24 full output from the regulators and then they've got uh an output to drive the led. The output is switched by this little mosfet, which uh is driven by these four pins. Here, the microcontroller, incidentally uh i was trying to work out what it was. I've not deduced what it is yet pins.

One and fourteen are negative pins. Two three and four are positive: uh and pins. 28, 27 and 26 are the crystal um. I shall cut to the chase i'll go straight to the schematic.

I'm not i've not drawn the whole thing out, because a autism probably get quite miffed uh and uh. Also uh, it would take a very long time. This uh is the addressing switch here. This sets the address uh, where it is on the network.

Anything else worth looking in the back, not really no, there's nothing worth looking at the bag. Just uh those two resistors in that capacitor and each cluster of these is uh. The switch filtering, which i shall show you so here is a basic. This is just showing the power.

This is showing the inputs and outputs, it's not showing the network. So the 30 volts come in there's the transient suppression, diode, the transil or transorb. There is the diode for polarity, there's the smoother capacitor and there's the two regulators. In reality, these regulators they're not just fixed voltage regulators they're variable, so they've got a resistor divi resistive divider, actually setting the voltage in each of these two 23 volts that also lets them custom program.

The voltage on these then there's a little tap off through a resistor and diodes to the little five volt regulator provides a five volt supply over to the microcontroller, the microcontroller, and i got this wrong this i drew what i was expecting: a resistor and a npn Transistor in reality, let's just draw that in that's what it is. It's uh n-channel mosfet by the look of it and the output goes straight to the n channel mosfet um, it's quite odd. The the mosfet is called. What is it called? I did look for it.

Uh qg that doesn't really help when you do a search for mosfet qg. You find that qg is an abbreviation for gate charge and there's therefore appears in many data sheets. It's a terrible name for a mosfet for finding it, but anyway it looks like a mosfet. So the microcontroller one, when you push the button uh, here's the three pins on each of those outputs, the uh button.

Actually bridges it doesn't use the zero volts. I guess that's just an optional available thing, but it bridges the 23 volts to the input. Pin the button pin that is then goes through goes through a 20k resistor limit current and it forms a potential divider with this 4k 7 to bring it to a level that microcontroller can safely handle. There's also a decoupling filter capacitor to remove any noise, because there's always a risk that you're going to get well electrostatic discharge, restart and also pick up electrical noise from a cables around the vicinity of, say, lighting cables for a illuminated panel or other stuff.

Just any wire axis antenna that provides filtering but there's also another layer protection with a little a7 diode, which is uh i'll, show you in the drawing it's there, there's one next to each of these inputs and that uh means that the voltage exceeds the supply rail By about 0.6 volts, it will conduct to the supply rail and vice versa, from the zero rail. So that just stops it going well beyond the range of the microcontroller. But it is well current limited anyway, but it caps that voltage and that just filters that input. When you press this button, when you press the button, it sends a signal to the mic controller.

It says you know a button has been pressed the microcontroller most likely. Then uh sends a signal on the bi-directional serial network uh which it will have to actually command attention to that i think it jams it deliberately just to get the attention it's similar to the canvas, but it's not canvas, i don't think very strange, but uh. It sends a signal back saying: the button has been pressed and if everything is working as normal, if it's not working as normal, it won't light, but it sends a signal back to the microcontroller that says turn on the transistor and it turns on the led. That's fundamentally that i have you know for such a simple thing: it controls four buttons on a zero network.

I have spent so much time i wasted so much time trying to find that chip before someone pointed out that it looks like a otis number uh, because i've mentioned it and patreon has said any idea what this is and they said, yeah. It fits in with a load of voters, sort of part numbers, and it did turn out to be that that was the case, but an interesting little thing. I do kind of want to reverse engineer the driving of the network, but that is quite a lot of work to do um, particularly on the multi-layer board, and in a way you know, i'm so used to to me rs-485, even bi-directional, like say, for instance, uh Rdm remote device management of like the theater equipment lighting, it just uses a bi-directional rs485 interface. I'm not sure why they've chosen to go with their own proprietary standard because it it's not like when this was designed the in 2003.

It's not like you know, canvas or like rs-485 wasn't established by then, although it might just be harking back to an older standard. Uh orders do seem to have a patent on this communication protocol. That seems to be sort of a proprietary thing that they designed. So it may have actually happened, knowing otis uh, certainly all daughters.

They were quite inventive. They were always a bit pioneering. They were always sort of ahead of the crowd and designing new stuff. So it's possible that this is just a standardized network that dates back to an original design of when electronics was really just coming in and microprocessors.

But it's interesting it's a typical example. It seems well i'd expect it's otis, it's going to be well designed, but um. It's got all the sort of protection inputs. It's got the uh strangely, not so much the outputs but ultimately, probably just saying well, it's a mosfet switching led what could go wrong um but uh.

It's interesting like dividing it through the little two little voltage regulators and then another one tapped off that for that, i'm guessing the reason they chose 30 volts is because this is going to be a power and data cable coming down the shaft, so they went for A higher voltage, although this thing only it doesn't take that much current the button hold on. Let me just uh light the button up again at 23 volts. It's only about eight milliamps. This button takes but uh.

This thing here only drew about 13 milliamps in its standby state, with just uh the microcontroller running, but that's it that is the uh otis rs14 network node for controlling the call buttons in the car and in the hall um or for some other applications, i'm guessing As well, but it's quite interesting - it has matching displays and uh controllers that will also use the same serial network. But the one thing it can't do is replace the safety is like say, for instance, the switch switches in the shaft doors all have to be hardwired. Right back to the control panel, so that you can't rely on a data for that it has to be a hardwired network, so if a door gets jammed open, it's a very decisive uh signal that you know the lift shouldn't move because the door is uh. Currently, in a unknown state, but there we go interesting stuff.

.

11 thoughts on “Exploring an Otis Elevator button interface PCB”
  1. Avataaar/Circle Created with python_avatars Fonk Badonk says:

    We have been asked for a quote on a control system for a hospital elevator system recently, that is nearing the 20 year old mark by now. From the schematics we had been given, it looked like all buttons, light and numerical indicators ended up as simple discrete signals from the POV of a global controller. Including the button and level indicators for each cabin. If I recall correctly, this wasn't an Otis system to begin with, and this honestly looks horribly overcomplicated for the time.
    By 2003, most elevators, at least in a slightly commercial setting, would probably have used some sort of PLC overseeing the whole operation, that combined with any kind of bus would have easily coped with all inputs and indication needs. The only setting where I could imagine this kind of module making sense would be for small residential use, like 8 stories, maybe 2-4 shafts at maximum. But even then, getting all the special-operation modes across (fires or other kinds of failure) seems troublesome to me, given how little an even half-decent heading PLC would cost compared to the whole setup. Especially compared to custom made silicon and PCBs.
    Therefore this really does somewhat look like the attempt of some 70/80s engineers/electricians trying to force their way into the 2000s while not really keeping up with times. Am I horribly blinded here?

  2. Avataaar/Circle Created with python_avatars pmailkeey says:

    Dad's approach to towns is to park in the multi-storey car park and park on the top level – yes even if it was a split level car park, he'd go up that last 'half' level. Next, after all getting out of the car, we'd walk the periphery of the top level and admire the views ! It was no different in Blackpool. Having done this there, we walk to the lift and pressed the button. The lift never came. We eventually walked down a level and managed to use the lift from there.

    On returning to the car in the evening, yes, the lift wouldn't take us to the top floor. So we had to walk up the last flight of stairs. On passing the lift to get to the car, I stopped – and pushed the landing doors open ! Yes, they weren't locked ! I guess the lift had a lock problem on the top floor and they'd disabled calls to that floor. This I guess was back in the 1980s.

  3. Avataaar/Circle Created with python_avatars Donald Davis says:

    That was my trade for 40 years.. Otis was….the king in the 60's and early 70's….. then, when they started this crap it all went to hell fast! At one point their junk was using wire wrap circuit boards and controllers. We both know how bad wire wrap was! This vintage had the main CPU in the COP car operating panel when people could do all kinds of bad things to it…. soft drinks, piss in it and my favorite…. metalic chewing gum wrappers! And of course all of their stuff was proprietary….

  4. Avataaar/Circle Created with python_avatars Mumbai Verve says:

    Very interesting video ! I have seen some cheap fire panels which use serial communication for connecting various nodes ( smoke detector, glass switches, etc. ) They were running a UART Rx/Tx with an optocoupler to switch 24V to get distance. The baud rate was less than 9600 IIRC. There was a master/slave protocol, with the main board pinging each node and waiting for a reply. Otis make large revenues on their AMC , so i guess it makes sense for then to use proprietary protocols. Also AFAIK CAN bus needs to set unique priorities for each node, and it may not make sense here because each floor switch would need the same priority; (maybe someone can correct me on this) Would be interesting to see if BC makes a follow up video on this.

  5. Avataaar/Circle Created with python_avatars Fred Hababorbitz says:

    The reason for switching a positive signal on a switch is when you analyze this in a fault analysis, the probability of having a signal fault to ground is much higher then faulting to a voltage. This I learned from working on avionics. They protect against transients, as again, a fault analysis will always fault the device in the worst case outcome, as you don't know what the internals of the micro processor are, so put in overkill protection to minimize this fault possibility.
    Also, I was on a working group looking for a new serial bus, we tested CAN bus, the signal levels are too small, and would be upset very easy with RF radiated and conducted susceptibility tests. I don't think they use drive by wire in cars, using the CAN bus.

  6. Avataaar/Circle Created with python_avatars TaliaKuznetsova says:

    Cause of your videos I bought a nitecore tube recently and 10/10. Charges with the same cable as my phone. Nitecore Tip SE is what I got. My old keychain touch activate light was dieing and now its fantastic. Adjustable modes, can charge in my truck while driving, long battery than the button cell, no more accidentally activating when my knee touches it. Great utility light tho not heavy enough to put in my fire gear.

    You do more unintentional advertising than you think. Next thing you know I'll be buying elevator parts.

  7. Avataaar/Circle Created with python_avatars Michael Reis says:

    I have an idea for reverse engineering multilayer boards. If you had a small (microwave) phased array antenna receiver, and you sat the board right on top of it, I bet you could inject signals with a probe and identify the paths they take. Effectively turn each circuit trace into an antenna while it is probed. Complex but would it work? Boards that are microstrip may not but I am not sure. Once you're well above the frequency the board is designed for then everything starts coupling.

  8. Avataaar/Circle Created with python_avatars Rob L. says:

    Ah, the good ole RS-14 button board. There's literally millions of them out there, and whenever there's an issue with a hall button not working, it's almost always due to a damaged button, and not this board. I have literally seen hall stations driven into with vehicles or man lifts, destroying everything, and I can just change the buttons and it all works again.

  9. Avataaar/Circle Created with python_avatars Ted McFadden says:

    I think you're right on the money that the protocol itself is quite old, and might stem back to the days before computer controlled elevators. Since neither of us is seeing a driver on the board, I guess they're bit-banging the comm bus on the microcontroller. Maybe they're using resistor networks (like the button), and/or FETs to deal with the voltage difference. 🤷‍♂️

  10. Avataaar/Circle Created with python_avatars Kae Eberhardt says:

    When I worked in maintenance many years ago, I got called to a two story building who's second story call button wasn't always working. Suspecting bad contacts in the switch, I took it apart and found an unused set of N/O contacts. I switched the leads to them and it worked just fine! Having a bit of fun, I installed the Down button upside down and anounced that I just added a third story to their building! But, after having it pointed out that people would now have to take the stairs down to ground level, I destroyed my imaginary "third floor" and installed the switch the right way around. 😀

  11. Avataaar/Circle Created with python_avatars Brian Freeman says:

    Regarding any wire acting as an antenna/aerial – I worked on an access control system in a large TV studio complex. In a few places, doors would spontaneously unlock as frequently as every few minutes. The system would register the pressing of a Request-to-exit button except it hadn't been pressed. We eventually put it down to RF or electrical interference from high current cables in the vicinity. Using earthed/grounded screened cables worked in some locations but not others and using a small capacitor helped – to "slug" out the input but again, not always. A bloody nightmare all told. I have only come across anything similar on a house alarm where the house was near the London underground. Years later, I bought a house by the Underground – all my alarm circuits are wired in screened cable and I have no problems.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.