Safety switch and method of checked redundancy

A method of disabling a drive system of a passenger conveying system, comprising:

• monitoring the passenger conveying system with switches each arranged to detect a respective malfunction of the passenger conveying system;
• providing a shutdown signal from a respective one of the switches detecting the respective malfunction to a corresponding shutdown contact and to a controller;
• operating the corresponding shutdown contact to interrupt a drive enabling signal of the drive system in response to receipt of the shutdown signal from one of the switches;
• monitoring the shutdown signals from the switches and the drive enabling signal with the controller;
• sending a signal from the controller to open a redundant contact to interrupt the drive enabling signal if the shutdown signal is detected and the drive system remains enabled.

A method, comprising:

• monitoring a passenger conveying system with functional units, each functional unit having a switch;
• providing a shutdown signal from a respective switch for the functional unit to a controller and to a corresponding shutdown contact when a fault with the passenger conveying system is detected by the functional unit;
• detecting with the controller if the shutdown contact opens;
• sending a signal from the controller to open a redundant contact if the shutdown contact does not open.

A safety circuit for a passenger conveyor having a drive system, comprising:

• a plurality of switches connected in electrical parallel, each switch being responsive to a functional unit associated with the passenger conveyor to produce a switch output signal having a first state if the functional unit is operating properly and a second state if the functional unit is malfunctioning;
• a controller apparatus including:
• a plurality of input terminals each coupled to a respective one of the switches by a respective individual wire for receiving the respective switch output signals;
• and
• a plurality of sets of contacts arranged is electrical series to conduct a drive enabling signal for the drive system when the contacts are all in a closed state, each set of contacts being opened in response to a respective switch output signal having the second state to interrupt the drive enabling signal to stop operation of the drive system.