Rupture valves, overspeed and safety devices

Ray told Tamsin about the worst hydraulic failure he had seen. Years before, in another city, a rubber hose between a power unit and a jack had burst while a car was coming down with a full load. The car had no rupture valve, and with the hose open, the oil in the jack rushed out as fast as the broken hose would let it. The car dropped faster and faster until it hit the buffers in the pit. Nobody was killed, but two passengers were badly hurt. "Everything we are adding at Holloway is there because of failures like that," he said. "The rupture valve, the safety bulkhead, the protected cylinder. A hydraulic car sits on a column of oil. Every device in this lesson is about what happens if that oil escapes."

What can go wrong

A hydraulic car is held up by the oil trapped in the jack, the piping and the valve. If that oil escapes quickly, the car falls. The main ways it can escape are a burst hose or pipe, a split fitting, a cracked valve body, a failed cylinder wall or bottom, or a valve that opens fully and stays open. Slower losses, from leaking packing, seepage past the check valve or a weeping fitting, let the car sink gradually, which is a different hazard covered in Lesson 10. Other failures cause the car to rise too far, as when a valve sticks closed on an up run, or press the system to too high a pressure, as when a car is overloaded or the shut-off valve is closed with the pump running.

The code deals with each failure by a combination of strength, so that parts are unlikely to fail, and devices that act if they do. The rest of this lesson takes the devices one at a time.

The pressure relief valve

The relief valve, in the power unit's valve block, is a spring-loaded valve that opens when the pump pressure reaches its setting and passes the pump's full flow back to the tank, so that the pressure cannot rise further. It protects the pump, the piping, the jack and the cylinder against overpressure from an overloaded car, a jammed car, a car driven up into its stop ring at the top of its travel, or a closed shut-off valve. The code limits its setting to a range above the working pressure, high enough not to open in normal service, and not more than a set percentage of the working pressure, so that the system's parts, designed with that pressure in mind, are never overstressed. The setting is tested and sealed, as Lesson 10 describes.

The check valve

The check valve in the valve block lets oil flow from the pump to the jack but not back. When the pump stops, it closes and holds the car. If a power unit pipe or the pump fails upstream of it, it prevents the car from falling. But it cannot protect against a break between the valve and the jack, which is why a rupture valve is needed at the jack itself.

The manual shut-off valve

The code requires a manual shut-off valve in the line between the power unit and the jack, near the power unit, so that the jack can be isolated for work on the valve or power unit and for tests. It is a quarter-turn ball valve or a gate valve, with a handle that shows whether it is open or closed. With it closed and the car landed on its stops or blocking, the power unit can be opened without draining the jack. Ray checks that it is fully open before returning a car to service, because a part-closed shut-off valve restricts flow, heats the oil, slows the car and can confuse the valve's control.

Rupture valves

A rupture valve is a flow-sensing valve mounted at the jack inlet, between the jack and the piping. In normal service, oil flows freely through it in both directions. If the flow out of the jack exceeds a set value, as it would if a pipe or hose burst and the oil rushed out, the valve snaps shut and traps the oil in the jack, stopping the car. Most rupture valves are spring-loaded poppet valves: the flow out of the jack passes through an orifice and the pressure difference across it pushes against a spring; when the flow, and so the pressure difference, exceeds the setting, the force overcomes the spring and the poppet closes. Once closed, it stays closed until the line is repaired and the pressure on the line side is restored, which lets it reopen, or until it is reset as the manufacturer describes.

The trip setting must be above the highest normal down flow, including a fully loaded car descending with hot oil, so that the valve does not close in normal service, and low enough that the car is stopped before it gains dangerous speed after a break. The code limits the speed at which the valve must close in terms of the rated down speed, and limits the deceleration when it does. The manufacturer's data sheet gives the setting for each valve size and car, and the adjustment is sealed after the test. On new installations such as Holloway car 2, the code requires a rupture valve or an equivalent overspeed device on in-ground and other jacks.

The trip flow is the plunger area times the car speed at which the valve should close. The second equation estimates how far the car moves while it stops after the valve closes, at a deceleration a. With a trip speed a modest amount above rated down speed and a deceleration below the code limit, the stopping distance is small.

# Rupture valve trip setting check for Holloway car 2 (illustrative values)
import math
area = math.pi * 0.150 ** 2 / 4            # m2
v_rated = 0.50                            # rated down speed, m/s
hot_loaded_down = 1.10 * v_rated         # down speed with rated load and hot oil, observed at commissioning
v_trip = v_rated + 0.30                  # trip speed: rated plus a margin, within the code limit, m/s
a = 9.81                                  # deceleration when the valve closes, m/s2
q_trip = area * v_trip * 60000
q_norm = area * hot_loaded_down * 60000
print(f"highest normal down flow {q_norm:.0f} L/min, trip flow {q_trip:.0f} L/min")
print(f"margin above the highest normal flow: {100 * (q_trip / q_norm - 1):.0f} %")
v_si = v_trip 
s = v_si ** 2 / (2 * a )
print(f"stopping distance after closing about {s * 1000:.0f} mm at {a} m/s2")

highest normal down flow 583 L/min, trip flow 848 L/min
margin above the highest normal flow: 45 %
stopping distance after closing about 33 mm at 9.81 m/s2

The margin between normal down flow and trip flow is why the commissioning tests include a fully loaded down run with warm oil: if the car's normal down speed is close to the trip, the rupture valve will close during ordinary service and trap passengers. Equally, a rupture valve set too high would let the car reach a dangerous speed before it acted.

Testing a rupture valve means making it close. Methods depend on the valve and the manufacturer: opening a test bypass in the line to simulate a break, using the valve's own test feature, or running the car down with the down valve opened beyond its normal setting so that the flow rises above the trip. The test is done with the car carrying the load the code specifies, and with people out of the car. The car must stop within the limits, and the valve must hold.

Overspeed valves and plunger grippers

Other devices give similar protection. Some installations use an overspeed valve that senses car speed rather than flow. Some, especially where an existing cylinder could fail at the bottom, use a plunger gripper: a clamp mounted on the cylinder head or pit that grips the plunger and stops the car if it overspeeds downward, sensed by a governor or speed sensor. The gripper protects against a cylinder failure below the gripper, which a rupture valve at the inlet cannot do, because the oil would escape from the cylinder itself. For that reason grippers are one of the accepted ways of protecting existing single-bottom cylinders. Each device has its own annual or periodic test, set by the code and the manufacturer.

Hoses and piping

The line from the power unit to the jack is made of steel pipe or tube, with a flexible hose in some installations to isolate noise and vibration or to connect to a moving part. Pipes, fittings and hoses must be rated for the pressures in the system, with large safety factors, and the code sets requirements for the hose's rating, marking and testing. Hoses age: the rubber hardens and cracks, the reinforcement corrodes and the crimped fittings loosen. Older installations had hose replacement intervals; many jurisdictions now require a rupture valve or overspeed protection on cars with flexible hoses. Hoses are inspected for bulges, cracks, abrasion, kinks and weeping at the fittings, and they are pressure tested with the system.

Pipe runs are supported at regular intervals with clamps that allow for expansion, and protected where they pass through walls or floors. Buried pipes between the machine room and the hoistway are a special concern, because a leak there is hidden; new installations avoid them or put them in a sleeve or trench where leaks can be seen.

Devices at the ends of travel

A hydraulic car's travel is limited at the top by the plunger's stop ring, which bottoms against the cylinder head, and by normal and final terminal stopping devices that stop the car electrically before it reaches the stop ring. Driving the plunger against its stop ring at full speed would shock the system and push the pressure up to the relief setting, so the controller slows the car at the top terminal and the final limit cuts the pump if the car goes too far. At the bottom, the car is stopped by its normal terminal stopping device and, if it overtravels, by buffers or bumpers in the pit. Roped hydraulics also have the safety gear, governor and slack rope device described in Lesson 7.

Low oil protection, motor thermal protection, phase protection and the anti-creep or re-levelling operation complete the list. Each is tested at the intervals the code sets, and each test result goes in the maintenance records, which the inspector reviews.