UCM++

During my 40-some years in the elevator business, I’ve learned one thing for sure: the number of problems elevator mechanics encounter during their work is not infinite and can and should be defined, as well as the procedure of how to address each of these problems in a safe manner. Just like any other maintenance work involving safety, elevator maintenance depends solely on elevator mechanics’ professional integrity. In most cases, one cannot inspect the work elevator mechanics do in real time; one must completely trust their judgment, assume they are well trained, can be trusted and are not reckless.

In most cases, elevator maintenance reliability is based on self control, rather than dual control. There isn’t a second eye to inspect work done upon completion of it, such as with car maintenance, where quality-assurance inspectors rate the work and its quality. This leads to the conclusion that elevator mechanics carry a position of trust, together with a great deal of responsibility, despite not always being well compensated for it.

Some elevator mechanics’ duties require overriding safeties, such as bypassing door locks, which creates the potential for accidents, especially when a mechanic works alone. While there is no doubt a team of elevator mechanics is much safer than a lone worker, sometimes elevator work requires a single technician.

The real problem is that not all elevator mechanics are well trained in performing override actions safely. For example, I asked my professional group on LinkedIn, “What might be the best and safest way for an elevator mechanic to reach the car top when encountering a faulty door lock?” I have been amazed with the comments I got from various members answering this question. Some claimed such a question must be removed, as it might give some dangerous ideas. This kind of answer led me to the sad conclusion that some members of even professional groups don’t have a clue about how to perform such basic actions safely. I also got the impression that actions involving a door-lock bypass are not to be mentioned in public.

On one hand, we cannot ensure that every elevator mechanic sent on a mission has the right knowledge, patience and mood for each fault he or she may encounter. On the other hand, since it might be a high-priced error, we need to provide the technician with protection(s) against all known possible errors – in other words, to protect the mechanic from his or her own mistakes.

I’m sure we all agree that an elevator running automatically under “Normal” control mode with an open door is the dangerous situation in our business, having recently caused horrific accidents. It is the aim of this article to present a new method of how to prevent this kind of accident.

The unintended-car-movement (UCM) protection, combined with my Fail-Safe Safety Guard (FSSG) device (ELEVATOR WORLD, May 2012), creates a system, UCM++, that protects a modern elevator from running with open doors as a result of a faulty motor brake, together with door locks bypassed, while it is under “Normal” operation mode. At the same time, the system allows running under “Inspection/service” mode to safely implement maintenance, inspection and installation.

Nowadays, new elevators are equipped with bidirectional safety gears, as well as the UCM protection. These devices’ main objective is to prevent car movement with open doors that may result from a faulty drive unit, machine-coupling breakage, machine-shaft breakage, machine-brake failure or suspension failure. Such failures allow an uncontrolled rotation of the traction sheave/wheel. Together with accelerating car movement in either direction, horrific accidents to people entering or exiting the car may occur while the doors are open.

If any of the above failures occur, the safety gear is to be activated by the UCM protector to hold/clamp the car on its guide rails. Safety-gear activation is achieved by activation of the overspeed governor, which is triggered by an electric solenoid installed on it. Per code requirements, the solenoid signal is output by the controller as a decision whether to activate the UCM protector.

The design of UCM protector activation, in accordance with the rules that apply to the hoist machine, intends that if the machine is permitted to run, the UCM protector is disabled, allowing car movement. Otherwise, the UCM protector is to remain active to prevent car movement –for example, as a result of brake failure in which the brake remains partially open/closed, although the machine motor comes to rest. Especially with gearless machines, this allows instant car movement, even when a relatively small capacity (such as that of one person) enters the car. With the UCM protector operational, this hazard is avoided, simply because the car cannot move under that circumstance. The UCM protector will act in the same way in the case of suspension failure to prevent free fall of the car with its doors open.

I have concluded that the car moving with its doors open allows us to take immediate action to activate the emergency stop of the overspeed governor, instead of waiting until the car gains enough speed to activate it the conventional way, which would also require the absorption of an unpleasant stop in the realm of 1.2 g. There is no doubt the UCM protector is an excellent solution to the problems described above, and it has doubtlessly prevented an unknown number of elevator accidents. It is now incorporated into the EN 81 code as an essential preventive device.

The Problem with the UCM Protector

The only case in which the UCM protector cannot protect passengers involves the bypassing of door locks or the car gate switch. The code requires:

2.19.2 Unintended Car Movement Protection

2.19.2.1 Purpose.

Protection shall be provided with a means to detect unintended car movement (see 1.3) and stop the car movement, as a result of failure in any of the following:

• electric driving-machine motor, brake, coupling, shaft, or gearing
• control system
• any other component upon which intended car movement depends, except suspension means and drive sheave of the traction machine

2.19.2.2 Where Required and Function.

All electric traction elevators shall be provided with a means (see 2.26.2.30) that shall

• detect unintended car movement in either direction away from the landing with the hoistway door not in the locked position and the car door or gate not in the closed position.
• “(b) control system” is for UCM protector activation while the doors are not in the locked position. Until now, door-lock bypass has not been considered by the elevator controller as “control system failure.” Instead, it considers the doors closed and locked; therefore, car movement is allowed with open doors. In such a case, UCM is disabled. Before the appearance of the FSSG, there was no way for the controller and UCM protector to distinguish whether the door-lock circuit was bypassed. However, the FSSG enables this.

Door-lock bypass may either be intentional (by the elevator mechanic to accomplish his or her duties) or unintentional (as a result of a short circuit such as a grounded phase single-ground occurrence). For either case, the door-lock circuit is bypassed, and UCM is disabled. Thus, the car is allowed to move with open doors, while still under “Normal” operation.

Though I suggested in my previous article to switch the elevator controller into inspection mode whenever a bypass is detected with an FSSG installed, it later occurred to me that this is sometimes not enough and does not provide the right solution/protection, nor satisfy the safety requirements. This is because the elevator may experience a combination of both door-lock bypass together with another mechanical failure (such as machine-brake failure). In such a case, switching the elevator to “Inspection” does not and will not prevent the car from uncontrolled running with an open door unless the UCM protector is operative. Therefore, the UCM protector must be kept in operation and not be disabled under any circumstances. This is particularly true when the door-lock circuit is bypassed.

The UCM++ Solution

In the event of the car moving with an open door as a result of suspension failure, shaft or coupling breakage, or machine-brake failure, instant UCM protector activation is required without any complication. My solution refers to the situation where door-lock bypass is involved. This process actually creates a mask that hides the true status of the doors’ position from the controller. It is a way to deceive the controller and allow the elevator to run under a false assumption that the doors are closed and secure.

UCM++ utilizes the FSSG not only as a bypass detection device, but also to distinguish between elevator runs on a closed door-lock circuit or when that circuit is bypassed. At that time, I thought it might be useful for informing the elevator mechanic about the door-lock circuit status, although bypass existed, thus saving him or her the time of looking for the faulty door lock. But this was the least I could do with it, bearing in mind that whenever the elevator runs on bypass, it means that it runs with open doors, and that the bypass doesn’t have any effect when the door-lock circuit is closed.

This led me to conclude that since the FSSG has the ability to detect bypass although the door-lock circuit exists, the FSSG has the ability to distinguish between both cases. Contrary to the former situation (with the FSSG on), one cannot deceive the elevator controller letting the elevator run under a false assumption that the doors are closed and locked. This allows integration of the UCM protector with the FSSG (UCM + FSSG = UCM++) to accomplish the main goal, preventing car movement in “Normal” mode, while door locks are bypassed and failure occurs. This has been implemented by connecting a normally closed (N/C) or normally open contact in series with the overspeed governor’s activation solenoid: the contact status is controlled by the FSSG, which makes the decision whether to allow car movement according to the rule of bypass, such that if bypass is detected, the FSSG will disconnect the solenoid, thus triggering or activating the governor when the elevator starts moving with open doors. However, the decision made by the FSSG is independent from the decision made by the elevator controller. The decisions are not contradicted; the elevator controller makes the right decision, which complies to the rule of the elevator main motor. As for the FSSG, it acts in accordance with the rule for when bypass exists. This means the controller acts as if doors are locked, but the FSSG keeps it from being deceived.

The solution for how to allow the elevator mechanic to run the elevator under inspection mode during bypass with an operative UCM was quite simple. I used the common push button in the inspection station to override the N/C contact to the overspeed governor, thus allowing the controller to trigger the governor’s solenoid, thus allowing the car to move with an open door, but only under inspection mode.

The solution described above makes the following statement valid: “This elevator will never be able to run with open door under ‘Normal’ operation mode.” UCM++ is patent protected.