Analytical Method for Defining Requirements for Elevator Rescue

by Hilkka Hämäläinen and Jaakko Kalliomäki

This paper was presented at the 2022 International Elevator & Escalator Symposium in Barcelona, Spain.

Abstract 

Elevator rescue situations can be classified in different categories depending on if the car is in the door zone, can be moved there or is stalled between landings. Rescue methods where passengers can be released directly to the landing are safer than using car-to-car rescue operations, trap doors or such. Yet the rescue requirements in EN 81-20 and A17.1 cover only manual moving of the car and brake release but are otherwise ambiguous.

Exceeding the minimum requirements set by the safety standards can be done through various methods for releasing a stalled elevator. The main benefit is increased passenger safety. In addition, most rescue situations can be managed by elevator technicians without having to burden emergency services, if not necessary, due to medical reasons. Avoiding the use of emergency services also reduces risk of damage to the elevator during rescue.

However, depending on the requirements, these complementary methods may become very complicated, so a systematic way is needed to evaluate in which situations should it be possible to move the car to the landing. 

This article assesses the current standard requirements and presents an analytical approach for evaluating fault situations that may lead to a stalled traction elevator, focusing on high-rise elevators. A detailed analysis of one stalled scenario is explained, including the chain of events leading up to it and under what circumstances special methods are needed for moving the car to the landing. Finally, there is an example of how a summary of the different scenarios could be used as a basis for defining the rescue scope and requirements for the rescue methods. The approach can be applied on a product platform level or for individual elevators. 

A similar method could be used in the future for defining rescue requirements in elevator safety standards. 

1. Introduction

Since the introduction of machine-room-less elevators (MRLs) in the 1990s, new technologies have been introduced in elevators at an ever-growing speed. This has led to the realization that releasing entrapped passengers requires higher and more specific skills than before, and that passengers are at a greater risk due to use of unsafe release methods versus if they were left in the elevator car until competent persons arrive.^[1] The requirements given by standards were analyzed against this background. 

The presumption for this paper was that rescue scenarios, or passenger release scenarios, could be systematically analyzed and categorized based on their difficulty and likelihood. Following the analysis, it could be decided for which scenarios — beyond the standard requirements — it would be feasible to develop release methods and have the tools available on-site. This work could then be utilized during development of new elevator products to identify safety improvement potential in existing installations and contribute to the evolution of elevator standards. 

2. Background

Rescue systems can be relatively expensive, especially for high-rise elevators, and manufacturers may offer these as options, so the builder may choose to not purchase them unless clearly specified.^[2] The time it takes to release passengers may also differ greatly between solutions.^[3] Ambiguous terminology and standard requirements that are subject to interpretation may lead to unhealthy competition and expose passengers to unnecessary risks. For these reasons, among others, an analytical method for defining rescue requirements was needed.

2.1 The Problem of Terminology 

The terminology used in relation to rescue has been often criticized^{[4, 1]} for overdramatizing the situation. The term “emergency” includes the notions of danger and haste. “Rescue” is also closely associated with danger, while the emphasis should be on prudence and safety. Yet, both “rescue” and “emergency” terms are used in EN 81-20:2020. 

Further perplexity is created by nonstandard-based terms like Automatic Rescue Device (ARD), which refers to battery-driven systems that are able move the elevator car to the landing in case of a power outage.^[3] However, systems from different suppliers may have very different specifications.

The approach in this paper is to talk about releasing passengers to the landing using simple, technical or special means depending on the difficulty of the passenger release operation, as shown in Table 1. Alternative means are used as a last resort to release passengers when direct release of passengers to the landing is not possible. The terms “rescue” and “emergency” are used mainly when referring to the standards or medical urgency. 

2.2 Situations Meriting “Emergency Rescue”

While, generally, passengers in a stalled elevator are not in a dangerous or distressing situation^[4] (an assumption that is also taken in this paper), there are situations in which fast rescue may be needed due to medical reasons. There has also been discussion about whether the ventilation dimension defined by standards is adequate for fully loaded cars.^[5] The situation may be particularly acute if the ambient temperature is high and custom-installed car interiors (or retrofitted air-conditioning units) may restrict the ventilation. ^[3] For these reasons, continuous communication with the entrapped passengers is critical to assess if extreme measures are needed to ensure their well-being.

2.3 The Standard Requirements of EN 81-20 for Traction Elevators

The definition as written in EN 81-20:2020 states that rescue operations are actions required to safely release persons entrapped in the car and shaft by competent persons. Unfortunately, concerning the rescue requirements, the standard is not so clear; the coverage is limited and the content is spread in a multitude of subclauses. The most relevant requirements are listed in Table 2. Hydraulic elevators were not considered.

Based on the above, the following interpretations can be made for the rescue procedures:

• The primary rescue method is to drive the elevator to the unlocking zone using electrical emergency operation controls provided in the machine room or the machinery cabinet (5.9.2.3.4 and 5.2.6.6.2).
• If the primary rescue is not successful, there must be either a manual or electrical brake-release system that enables the car to move to the unlocking zone, unless there is a balanced load condition between car and counterweight. (5.9.2.2.2.7, 5.9.2.2.2.9, 5.9.2.3.2).

Implicitly, it can also be interpreted that:

• Rescue operations should be completed in 1 h, because the lighting in the car and power for the electrical means to move the car to landing have to work for that time.
• Two or more independent faults leading to rescue do not need to be considered (unless otherwise specified).
• In addition, the standard provides requirements for conditions where the primary and secondary rescue procedures fail:
• Adjacent cars must have an emergency door if there is more than 11 m between shaft doors (5.2.3).
• It must be possible to open the car door from outside when the car is outside the unlocking zone (5.3.15.3).
• Apron extension is there to provide protection when rescuing passengers when the car is not directly on the landing (5.4.5.2).
• The release of safety gear must be possible with procedures available on site (5.6.2.1.4.2).
• The minimum size of the car roof emergency trap door is 0.40 m X 0.50 m — if provided.

What the standard does not really specify is:

• For which contingency the above-mentioned additional requirements are planned
• The responsibility of the elevator technicians in executing rescue in these situations
• Which solutions are applicable as the back-up power supply, e.g., in 5.9.2.3.1 b) 1).

2.4 Other Standards and Regulations

The North American ASME A17.1/CSA B44 does not offer much more guidance, but it has a few clear distinctions to EN 81-20:2020: a car roof emergency trap door must normally always be provided (2.14.1.5), car emergency doors are prohibited (2.14.1.10), forced ventilation with 1-h auxiliary power is required for observation elevators exposed to sunlight (2.14.2.3.3) and backup power needs to be provided for car lights and two-way communication for at least 4 h. Requirements are also given on testing back-up power (8.6.4.19.7) and the training and availability of rescue procedures (8.6.11.5).^[7]

In addition, ASME has published a Guide for Emergency Personnel (ASME A17.4). In extension to what has already been discussed, it recommends that release of passengers from elevator cars is performed under the supervision of elevator personnel, and it defines how entrapped passengers are rescued in case the car is a maximum of 914 mm from the landing.^[8]

In China, there are additional regulations concerning the release of passengers. The periodical inspection regulation according to TSG T7001-2009 includes testing of rescue procedures with balanced load.^[9] According to Regulations on Safety Supervision of Special Equipment, if the passengers are trapped in the elevator car for more than 2 h, it is classified as an “Ordinary Accident.”^[9] So, it is commonly followed as a guideline that the rescue must be completed in 2 h. Another Time-related requirement is from TSG T5002-2017, which specifies that, after receiving information of trapped passengers, the arrival time of an elevator technician to the site shall not exceed 30 min in cities and 1 h in other areas.^[10] Furthermore, TSG T7007-2022 requires so-called “additional braking means” to limit elevator speed in case the normal brakes fail. This can also increase safety when passengers are released by brake release.^[12]

2.5 Roles and Competencies of Personnel Performing Rescue

In many cases, elevator technicians are the first to arrive at the site after receiving information from the remote alarm system. They should be competent in safely releasing passengers using simple and technical means, and it is in their interest to perform the release in a manner that causes minimum damage to elevator. However, challenges may emerge due to a large variety of equipment being in service and the pressure created by the situation.

In large buildings, there are often building management personnel on the location, and they may also be trained to perform simple release of passengers. Their training can focus on release methods needed specifically for the equipment in their facility, but their understanding of complex machinery may be limited and the staff turnover rate may be high. The scope of release procedures for which the building management is competent should be clearly set out and refresher training should be provided at least annually.^[11]

Emergency services personnel are the only ones who are trained in rescue of people from heights and in intrusive rescue methods in case the car is permanently immobile. They are also the most competent to assess if passengers inside that car need assistance due to medical reasons. They focus on the quick and safe rescue of the passengers; possible material damages are less of a concern. This, together with possible unwanted attention created by the arrival of emergency services, can postpone their being called to a location. Also, emergency services personnel may not have in-depth knowledge of elevator systems. The rescue operation should always be done under the supervision of elevator personnel.^[8,12]

It should be noted that, in larger emergencies such as earthquakes, the availability of any personnel beyond those who are already on-site may be restricted for extended periods of time. 

3. The Systematic Analysis

As discussed, there is much lack of clarity regarding rescue requirements in the standards. Therefore, an analytical approach was created for assessing the probability and severity of different rescue scenarios or passenger release scenarios, as explained in Figure 2. The target was to create data for assessing what release by special means should cover, i.e., in which situations it is justified to have special tools and techniques for releasing passengers to the landing. 

The scope of the analysis was the current high-rise elevator platform at KONE — elevators with a machine room, either traditional steel ropes or KONE UltraRope^® as suspension means, reduced-stroke buffers and conventional overspeed governor safety systems. 

Passenger-release scenarios were defined by considering not only reasons for entrapment, but also all the other technical aspects that affect release operations. Table 3 lists all the faults and conditions related to passenger-release scenarios. Here, “Faults” refer to activated safety systems stalling the elevator. All other factors affecting the elevator are referred to as “Conditions,” meaning the car load, whether the elevator is operable and if anything else is hindering car movement.

The “Faults” category has several options that can appear on their own or as combinations, e.g., single- or double-safety gear activation, where the opposite side has activated due to inertia in the overspeed governor rope. 

The balance situation in the elevator is not only dependent on the car load, but also on the car location in the shaft due to compensation unbalance. For simplicity and consistency with EN 81-20:2020, only the car load was used in this analysis. 

The “Machinery” options describe if the elevator is operable: whether the main or back-up power supply is available, and the drive and machine are functional. In some cases, e.g., when both the car and counterweight safety gear are activated, the machinery could be functional but there is not enough torque and friction for moving the car. If the power supply, machine and drive control system were out of use but the traction sheave was free to rotate, this condition was marked as “Machinery out of use during passenger release.”

The “Possibility to Move the Car” category is an umbrella term for atypical or not safety system related reasons for having a stalled elevator, such as a non-rotating traction sheave, entangled overspeed governor ropes and such. 

Next, the probabilities of everything listed in Table 3 were estimated. Almost all of the events had to be broken down into more detailed chains of events for more precise estimates. The counterweight buffer run probability analysis is presented as an example case below. 

Different variations and passenger release options for the counterweight buffer runs were identified (see Figure 3). The buffer runs were divided into two types — low- or high-impact speed — and further split according to safety gear activation on the opposite side due to overspeed governor rope inertia. Electrical emergency operations and brake release were possible in certain cases, as long as the safety gear was not activated on the car side. Releasing passengers to the landing was a possibility in all the categories, assuming the car was close enough. The used limits were based on EN81-20:2020 5.6.7.5. The focus in this analysis was on the situations where none of these methods were applicable.

Breaking down the buffer runs began by studying what needs to happen for the counterweight to hit the buffer in the first place. The chain of events leading to a buffer run below impact speed is described in Figure 4. The Fault Tree Analysis (FTA)^[12] method was considered for building the chains of events, but a customized visualization was chosen instead. 

The analysis was then continued with several additional aspects: 

• How often does the counterweight approach the buffer, i.e., how often does the car drive to the highest floor?
• How often will the car jump and the car safety gear be activated due to rope inertia?
• How high can the car jump? 
• How often will the machinery be functional after a buffer run?
• How often is the counterweight side heavier than the car side?
• What is the buffer stroke and how much of it is used? 

Input values for the analysis were collected from EN 81-20, safety integrity levels defined in IEC 61508,^[13] KONE statistics, simulation data and expert opinions.

Figure 5 presents how the three release methods from Figure 3 were defined so there is no overlap. The area of interest in this analysis is when none of the methods is applicable. 

The passenger release scenarios other than counterweight buffer runs were analyzed similarly, except the release of passengers to the landing was only considered possible with the buffer run cases, due to the typically long distances between landings in high-rise elevators. The assumption was conservative; in reality, there will be cases where releasing passengers to the landing will be, nonetheless, possible. 

The total risk of each passenger release situation was estimated as a product of its probability and severity. In this case, the risk to be assessed was how dangerous release by alternative means was depending on the location of the stalled elevator. Passenger release operations inside the shaft were defined as a reference point. Passenger release operations in the pit were considered less dangerous, since there is access from the lowest landing to the car roof. The most severe cases were the passenger release operations in the headroom, since access from the top floor reaches only the bottom side of the car. The severities are listed in Table 4. Risk scores were assessed on product platform level data only, i.e., assuming typical elevator usage and typical distribution of counterweight overspeed governors, etc.

Figure 6 shows the probabilities and risk scores of the passenger release situations that require special means for moving the car to the unlocking zone or releasing by alternative means. The results are to be used only for comparison between cases. Therefore, the values have been omitted.

On the product platform level — the “high-rise population” data set — these situations were nearly equally likely for all three safety gear activation cases: car, counterweight or both, but notably less common for the buffer runs. 

However, looking specifically at the elevators that have counterweight safety gear, there is a clear increase in double and counterweight side safety gear activations that are no longer covered by simple or technical means for passenger release. The same applies for the car buffer run cases.

In shuttle elevators, there are more counterweight buffer runs overall and a significantly higher number of them require release by special or alternative means. An emergency door in the headroom could be useful, especially for this type of elevator.

There is a range of uncertainties and error sources in the approach, mainly because detailed data was not available for all inputs and expert opinions had to be used instead. There were also some assumptions and simplifications that were unconservative, i.e., not representing the worst-case scenario. For example, it was assumed that a safety gear activation could be released by simply releasing the brakes (assuming there is some unbalance), while, in reality, this may require some additional force.

A limited sensitivity analysis was done by variating some selected inputs. Ideally, this should be done on all inputs. It was also recognized that the original fault may directly impact the passenger release scenario, e.g., in case of machine bearing failure, the machine is automatically not available during release operations. These kind of cross dependencies could not be fully taken into consideration in the analysis. 

4. Discussion

The target of the research was to identify the entrapments and conditions where there should be an easily applicable method for releasing passengers to the landing. A higher degree of preparation improves passenger safety, but getting ready for extremely rare events increases product costs. Complex methods may prove impractical in real situations. In exceptional cases, having passengers first released by emergency services and repairing the system in due time may be a smart course of action. But, relying too much on emergency services may also be a weakness.

When it comes to releasing passengers from a stalled elevator, the EN 81-20:2020 standard is, unfortunately, not very clear. The problem has become more acute due to the introduction of new elevator solutions, in particular for high-rise applications with heavy masses and long distances between landings. Also, the terminology lacks needed precision.

Since the elevator standard did not offer adequate guidelines for determining requirements for the release of passengers, an analytical approach was introduced for evaluating the different scenarios.

Analyzing elevator fault situations analytically proved to be a useful tool in estimating the scope of different passenger release methods. For instance, it brought up the need to more clearly define a safe release principle of passengers to the landing in case the car is stuck close to the unlocking zone and demonstrated the benefit of having an emergency door to the headroom in high-speed shuttle elevators. It also emphasized the importance of a reliable back-up power solution.

Assessing how several events or factors affect each other is in contrast with the EN 81-20:2020 approach, which only covers single faults. The holistic view raises, for instance, the question of whether electrical emergency operation can be used during release operations. Can the machinery and drive be assumed to be functional when a fault has caused an entrapment in the elevator? And what is the standard’s take on safety gear activations caused by overspeed governor rope inertia in terms of rescue operations?

A similar, analytical approach could be used in the future for defining rescue requirements in elevator safety standards.

Finally, extensive reflection of special means for releasing passengers to the landing has led to the realization that one hour may not be adequate to apply such means.^[15] The requirements for car emergency lighting and two-way voice communication should be extended. Also, a battery-operated car fan would make conditions in the car more tolerable. For the same reason, local modifications to car interiors, which may affect car ventilation, should be considered as part of the elevator safety inspection.

References

[1] “Guidance On The Release Of Trapped Passengers By Non Lift Personnel,” Lift & Elevator Industry Association, 2018.

[2] E. Akçay, “Risks of Rescue Operations from Elevators,” ELEVATOR WORLD Türkiye, No. 37, pp. 78-81, 2021. 

[3] S. Babu, “Elevator Emergency Operations,” EW, No. 11, pp. 82-72, 2014. 

[4] M. J. Ryan, “Rethinking ‘Rescue”,’” EW, June, 2020. 

[5] R. S. Smith, “Cabin Ventilation, Code Requirements and Experimental Results,” 3rd Symposium on Lift and Escalator Technologies, Northampton, 2013. 

[6] “EN 81-20 Safety rules for the Construction and Installation of Lifts – Lifts for the Transport of Persons and Goods – Part 20: Passenger and Goods Passenger Lifts,” European Committee for Standardization, 2020.

[7] “ASME A17.1/CSA B44 Safety Code for Elevators and Escalators,” The American Society of Mechanical Engineers, 2019.

[8] “ASME A17.4 Guide for Emergency Personnel,” The American Society of Mechanical Engineers, 2015.

[9] “TSG T7001 Regulation for Lift Supervisory Inspection and Periodical Inspection—Traction and Positive Drive Lift,” General Administration of Quality Supervision Inspection and Quarantine of the People’s Republic of China, 2019.

[10] “Order No. 549 Regulations on Safety Supervision of Special Equipment,” State Council of the People’s Republic of China, 2009.

[11] “TSG T5002 Lift Maintenance Regulation,” General Administration of Quality Supervision, Inspection and Quarantine of the People’s Republic of China, 2017.

[12] “Maintenance Requirement for Lifts, Lifting Platforms, Escalators and Moving Walks,” LEIA (Lift and Escalator Industry Association), 2013.

[13] T. L. Jarboe and J. O’Donoghue, Elevator and Escalator Rescue: A Comprehensive Guide, Tulsa, PennWell Corporation, 2007. 

[14] P. O’Connor and A. Kleyner, Practical Reliability Engineering, John Wiley Sons Inc., 2012. 

[15] “IEC 61508-1 Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems – Part 1: General Requirements,” The International Electrotechnical Commission, 2010.

[16] H. Leone and R. Sobol, “How 6 People Were Rescued From an Elevator in a Chicago Skyscraper,” Chicago Tribune, November 17, 2018.