Providing Secondary Protection from Traction Elevator Brake Slippage

One of the most dangerous things that can happen with traction elevators is shearing due to a brake slip. Unfortunately, it is also one of the most difficult to prevent, because it may stem from defects in the traditional, control-mode elevator. In the long-term evolution of an elevator’s entire safety system, many features have been improved and strengthened, but when it comes to one of the most important safety protections — for the brake — there are still challenges.

An elevator’s electromechanical rope-gripping device can, to a certain extent, provide secondary protection for the brake. Not all elevators, however, have disposed electromechanical rope-gripping devices, and because of the recent widespread use of the synchronous motor in elevators, more and more units have no rope-gripping device disposition when they are manufactured. This means many elevators cannot use rope-gripping devices to prevent shear accidents. This article deals with the challenge of finding a universal way to provide secondary protection from brake slippage.

The issue of preventing the short-circuit of the door interlock and brake circuit can be solved with circuit hardware and software upgrades.

How Elevator Shear Accidents Happen

Elevator shear accidents can happen one of three ways: elevator door interlock failure, electrical-control brake failure or mechanical brake failure. When elevator door interlock failure occurs, such as when a door-interlock circuit has short-circuited, the elevator should run directly with the door open once the signals outside or within the car have registered, because the control system may mistake it for being closed.

In addition, if the brake-control circuit has short-circuited or the contacts have been welded together, the elevator should move directly with the door open, because the brake can’t brake as power on. As long as the car moves with the door open, shear accidents can easily occur. In order to avoid this dangerous scenario, the door-interlock and brake-control circuit must add anti-short-circuit (or weld) protection so that operation will automatically cease when the circuit shorts. The issue of preventing the short circuit of the door-interlock and brake circuit can be solved with circuit hardware and software upgrades.

For mechanical brake failure, the solution is much more complex. When an elevator stops at a landing, the mechanical braking system ensures the reliability of the stop. If mechanical braking force is not enough, elevator slippage can also occur with the door open. Since this problem originates in the brake itself, the elevator must use another safety-protection device. But, other existing safety protection devices do not act like a brake, which provides the most effective protection against shear accidents. Furthermore, it is not easy to add a new protection device to an elevator.

Effectiveness of Other Safety Devices

Safety devices, both mechanical and electrical, can fail, which can lead to serious consequences. Appropriate secondary protection can prevent such situations. An elevator brake may fail, too, potentially causing a serious accident. But now, when brake failure leads to a shear accident, most other safety devices are unable to provide better secondary protection.

An elevator’s safety gear is an important mechanical safety device used for overspeed protection. It is not designed to act at low- or medium-low speed, so it cannot provide protection in low- or medium-speed shear accidents. If this were the case, its operating frequency would increase significantly, causing greater damage to the guide rail. In addition, to protect against shear accidents, there must be an electrical-monitoring device to gauge their possibility. Once faced with the risk of a shear-accident brake fail, an electrical monitoring device would trigger safety gear. Now, however, all safety gears must be triggered by mechanical action, making such a device unable to provide secondary protection against shear accidents.

If its motion-control system has been properly modified, a rope-gripping device can protect against shear accidents better than other safety components.

A buffer is an important mechanical safety device, but its ability to guard against shear accidents is very limited. A buffer provides effective protection in just two, very special circumstances — i.e., when the elevator is stopped directly at the top floor and has just slipped up, or stopped at the bottom floor and just slipped down.

If its motion-control system has been properly modified, a rope-gripping device can protect against shear accidents better than other safety components. However, the rope-gripping device has its limitations. Rope-gripping devices are divided into two kinds — mechanical and electrical — and only an electromechanical rope-gripping device can perform secondary protection for the brake. A purely mechanical rope-gripping device cannot. What is more, because of the use of the synchronous motor in recent years, more and more elevators, including machine-room-less units, have no rope-gripping device disposition when manufactured. As for other electrical safety devices in elevators, because the final protection will be performed by the brake, once that system fails, electrical safety devices fail, too.

Shear Accidents Attributed to Brake Slippage

If its braking force is short, an elevator can easily slip, regardless of if it is carrying a light or full load. According to elevator provisions, the balance coefficient should be between 40-50%. If the rated load of an elevator is 1000 kg, and the balance coefficient has an intermediate value of 45%, then the maximum eccentric load is only 450 kg when the car is lightest, the maximum eccentric load can be 650 kg when the car is overloaded, which is 110% of rated load. Although slips attributed to brake failure can occur in light-load conditions, they primarily occur in full-load or overload situations.

In October 2011 in Chongqing, China, a shear accident attributed to brake failure fatally injured a man. Before the accident, an elevator car was carrying a full load to an upper floor, stopping near the top landing. The doors opened. At the same time, the car began to slip down with its doors still open. In the process, the man’s head became jammed between the top of the car door and bottom landing door. The injured man was transported to a hospital, but his injuries were too severe, and he died several days later. A post-accident investigation revealed that the elevator’s braking force was insufficient, and that the balance coefficient was smaller, because once the car had been loaded to nearly full, the elevator slipped, leading to the shear accident.

Devices Work Together to Form Complete Safety System

As mentioned previously, the independent role of any other safety device cannot surpass that of the brake, which is key in preventing shear accidents. But, if independent safety devices can work together to form a complete safety system, the scenario improves greatly. When shear accidents occur, the main failing component is usually the brake. The functions of other safety devices — door interlock, car door, inspection operation, buffer, etc. — may not pose a problem, but if they can cooperate with each other, they can play the important role of secondary protection from shear accidents related to brake failure. In a perfect protection system, devices that cooperate harmoniously with each other can make up for the weaknesses of each individual component and can form a new, powerful function. So, a perfect protection system will not collapse on account of an isolated component failure, because other components make up for that, in turn causing the system to stop in a safe manner that does not harm people or equipment.

Next, this paper introduces a function against shear in a traction elevator that can be used as a general secondary protection for the brake. It includes the releveling process which is similar to an early function but has a major difference. The speed and leveling control ability of early elevators was usually poor, making one-time accurate leveling difficult. To remedy this situation, early elevators used an automatic releveling function. As speed and leveling control improved over time, releveling fell out of favor.

Releveling for the purpose of shear protection may be similar to the simple releveling of early elevators but with essential differences. First, releveling of early elevators was carried out when brakes were working normally, but releveling for shearing protection is carried out when brakes fail. Second, the purpose of releveling in early elevators was simply for accurate leveling, but the purpose of releveling for shearing protection would be to prevent a tragic accident. Third, simple releveling is a single method, but releveling for shearing protection involves cooperation among components to form a synthesis.

Figure 1 illustrates the basic control process for protection against traction-elevator shearing. This process is mainly for secondary protection of the brake. Although the door-interlock and brake short-circuit could also lead to a shear accident, I discussed that scenario in my earlier article (ELEVATOR WORLD, July 2011). The basic idea follows.

Device Cooperation Procedure

First, we need monitoring devices (such as an electrical one for contact welding or short-circuit, one for the position of car leveling or the position in the unlocking zone, or another corresponding device or software) to determine the brake’s state of failure. When an elevator arrives at a landing, the monitoring device first detects whether the circuits have shorted in the door-interlock and brake circuit. If there is a short in the door-interlock circuit or brake circuit, the monitoring device should disconnect the safety-chain circuit to cut off the main motor and brake and stop the elevator. Since the main motor and the brake have no problem as long as the electric power has been disconnected, the elevator running can be terminated. And, if no short has been detected in the door-interlock or brake circuit, the monitoring devices should detect the moving position in the unlocking zone.

In a perfect protection system, devices that cooperate harmoniously with each other can make up for the weaknesses of each individual component and can form a new, powerful function.

If the car continues to move as doors open after power has been disconnected, and the movement distance is larger from leveling precision position, it can be concluded that there is something wrong with the brake. Once brake failure has been confirmed, the protection system ought to immediately take more complex secondary protection measures against a potential shear accident. The first step should be alarming to rescue service, such as by initiating an alarm. Alerting responders should be done in conjunction with activating other automatic-protection measures, because getting help to the scene as soon as possible is crucial.

If an elevator car stopped directly at the top floor and slipped up, or at the bottom floor and slipped down, when the accident occurred, the control system need not initiate the releveling process, because, in this case, the buffer can prevent a shear accident. But, in other cases, if the car stopped at a floor and slipped with the door open, the process should be initiated immediately. That is to say, if the car has slipped downward at the bottom edge of the unlocking zone, the elevator should be immediately energized for upward releveling. Conversely, if the car has slipped upward at the top edge of the unlocking zone, the elevator machine should be immediately energized for downward releveling. Because the process of upward slip is similar to that of downward slip, we will only analyze the latter.

In the releveling process, the control system first issues a voice reminder to passengers to leave the car-door area, then forces the door closed. Two conditions are necessary for an elevator shearing accident to occur — the opening of landing and car doors, and the shearing movement of the landing and car doors. As long as the two conditions do not occur at the same time, we can effectively prevent shearing accidents.

When the car door closes in the unlocking zone, the function of reopening it in the event of a person or persons being struck in the entrance should be retained, but the door should be closed once again without delay. If some passengers are struck by the door in the process, the door should open once again and so on. But, once the car door has been closed completely, the car’s open-door button should be neutralized to prevent passengers from opening it, for this is very dangerous. It would be best for the car to be provided with a mechanically locked door that can only be opened through the landing the door in the unlocking zone, in turn preventing passengers from opening the door when the elevator is operating out of the unlocking zone.

Because of brake failure, a car that has gone to the landing level during the protection process may slip again, but as long as its door is not closed, the car should repeat the leveling process and continue using voice prompts to guide passengers out of the car-door area until the doors have closed.

To avoid the machine initiating too much frequency in too short a time, the protection against shearing should lower the frequency of leveling as far as possible. Therefore, releveling should be executed in the opposite direction of the slipping. In other words, the basic process of slipping and releveling should alternate. Also, the conversion time should be extended as much as possible — i.e., the releveling process should be initiated just when the car has slipped to the edge of the unlocking zone — and, ideally, the releveling process should extend to the middle of the unlocking zone of the other side: exceeding the landing level but not reaching the edge of the unlocking zone.

In Figure 1, it is just a simple way that the elevator will stop the releveling process when the car arrives at the landing level. In guarding against the shearing process, the releveling speed should slow as much as possible (not exceeding 0.3 mps), and the elevator should have an electric safety contact (or safety circuit) that can conform to related requirements and prevent all movement of the car outside the unlocking zone with the door open.

Because the monitoring system will have automatically sounded an alarm after the brake failed, notifying rescue workers, when they arrive on the scene, they can also stop the releveling process and select the appropriate method to rescue passengers. Before rescue workers arrive, if the elevator door can be automatically closed, the releveling process can be stopped automatically. During this time, if the car load is near rated load or overloaded, it should slowly operate downward to the bottom floor with the door closed; if the car is near to light load, it should slowly operate upward to the top floor with doors closed and stop in failure lock as passengers wait for rescue.

In this process, some passengers may escape by forcefully opening the door. This would mean a load reduction, which could mean the car slips upward as a result of the lighter load after the elevator car has arrived at the bottom floor with rated load or overloaded. During this time, if some passengers continue to escape, a shearing accident may still occur. In other words, if the car slips upward at the top edge of the unlocking zone, releveling for the downward process should be initiated again.

If the elevator doors have been closed again in the protection process, the elevator should operate to the top floor and stop in failure lock. When the car has arrived at the top floor from the bottom floor, even if some passengers escaped by opening the car door, the car will become lighter than before and cannot slip downward; thus, it does not need releveling. If the car slipped upward at the highest position of the top floor and some passengers jump down as they escaped, the car apron can prevent them from falling into the pit. Therefore, the car apron should have sufficient length and rigidity for such protection. According to standard requirements (for example, EN 81-1), the height of the car apron’s vertical portion should be at least 0.75 m. This height is safe if the apron has enough rigidity.

In terms of the overall security of the elevator, the brake is probably the component that needs secondary protection most.

If the brake failure and the car slipped to the edge of the unlocking zone with the door open, the releveling process should be initiated to protect traction elevators from shearing. Has the operation had any security problems? No, it has not. Some elevators still utilize the leveling method with the door open in the unlocking zone to raise the efficiency of opening the door. This has security problems when the car moves outside the unlocking zone with its door open. In some technical standards, an elevator car is allowed to level or re-level in the unlocking zone with its door open. However, the leveling or releveling speed has a limit, so it must have an electric safety contact (or safety circuit) that can conform to related requirements and prevent all movement of the car outside the unlocking zone with the door open.

Protection against shearing of a traction elevator not only has these requirements, but also has better security. This is because if the brake slips, the electric safety contact of the general elevator would lose efficacy. An elevator that has protection against shearing can prevent movement of the car outside the unlocking zone through releveling when the car slips to the edge of the unlocking zone. At the same time, protection against shearing can also prevent the car from moving outside the unlocking zone with its door open.

Under brake failure, a car releveling to the landing level may still slip, but as long as the car door is not closed, the car should repeat the releveling process after it has slipped. Usually, this should not cause the machine to have too much frequency in too short a timeframe. Because the releveling speed is slow, even if the brake slips again after releveling, the initial stage of slipping is still slow. Although the speed of the slip may gradually increase, this process will be terminated by the releveling operation before it occurs. So, passengers have enough time to react during the first or second cycle of change of slip and releveling. Due to the use of a voice prompt in the releveling process, it is highly likely that all passengers will be able to quickly escape from the car and that the door will close automatically. But if they do not escape, they will back away from the car door at this time, and the door will automatically close. In either case, as long as the car door has been closed, protection against shearing can terminate the releveling process. So, generally, the protection should not cause the machine to have too much frequency in too short a time.

Conclusion

Elevator components can be divided into two kinds: working and protection. Working components are usually in working condition, so they are bound to have some wear and tear and will finally fail over time. These important working components should be protected to avoid serious consequences that could be caused by their failure. Protection components do not typically work in ordinary operation, so wear and tear on them is largely avoided. So, once working components fail, protection components should protect or replace them. For example, ropes on the traction sheave and the controller of the driving machine are typical working components, while safety gears and buffers are typical protection components that do not work when the elevator is in normal operation. If all the ropes on the traction sheave have broken due to excessive wear, the safety gear will protect the car by clamping it onto the guide rail. And, if the elevator runs to its terminal location when out of control, the buffer will terminate its operation.

Elevators have a few special components that are both working and protection, such as the brake. While it is a very important working component, many other working components need its protection when they fail, making it a very important protection component, as well. In terms of overall elevator safety, the brake is probably the component that needs secondary protection most.

Protection against brake slippage is a more difficult proposition, because this kind of protection should be done by the brake. If the brake itself is not working, however, it is very important to introduce new, comprehensive protection formed by other various protective methods. If the problem of protecting against brake slippage of an elevator in middle to low speed is solved, the overall safety performance of the elevator will be markedly improved.

By making the appropriate adjustments and using the proper combination of existing components, one can implement an important new secondary protection against traction-elevator shearing. Because the process involves control-system improvements rather than component additions, it could be used in almost all elevators.