Ascending car overspeed and unintended movement devices

The governor and safeties of lessons 7 and 8 protect against a car going down too fast. For most of the trade's history that was thought to be enough, because a car falls down, not up. But a traction car is balanced by a counterweight that is heavier than the empty car by about 40 to 50 % of the rated load. If the brake fails, or the machine loses its grip on the car through a broken shaft or gear, an empty or lightly loaded car does not fall; it is pulled up by the counterweight and accelerates into the overhead. And a car whose brake fails while it is standing at a floor with its doors open can creep away from the landing, up or down, with a passenger half in the doorway. Accidents of both kinds led to two requirements added to the codes from around the year 2000: ascending car overspeed protection and unintended car movement protection. Priya introduced them at Larchmont, whose machine-room-less car has both, and Ray at Tillicum car 1, which has neither.

What the two requirements are

Ascending car overspeed protection must detect when the car is moving up faster than it should, at a speed set relative to the car governor's tripping speed, and must then slow and stop the car with a deceleration that is not harmful, no more than 1 g, by a device that acts independently of the normal machine brake. Unintended car movement protection must detect when the car moves away from a landing with the hoistway door and car door not closed and locked, in either direction, and stop the car within a short distance of the landing, which the code sets at 1,220 mm (48 in), again by a device that does not depend on the normal brake alone. The two functions often share the same stopping device, called an emergency brake, and on newer cars the detection is done by the certified safety board from ELV-310.

Detecting ascending overspeed

The simplest detection uses the car governor. A governor for a car with ascending overspeed protection has a switch and often a trip mechanism for the up direction as well as the down direction. When the car moves up too fast, the up-direction switch opens and, if the car continues to accelerate, the governor's up trip operates the emergency brake or up-direction safeties. On Larchmont's car, the governor in the hoistway has a bidirectional trip and an electrical actuator, so that the safety board can also trip it remotely, for the unintended movement function and for testing. Some systems detect ascending overspeed electronically from the controller's encoder and position system, provided the detection is certified as a safety function.

# Ascending car overspeed: detect and act (illustrative settings)
gov_trip = 1.36            # car governor tripping speed, m/s
limit = 1.10 * gov_trip    # detection set no higher than 10 % above it (illustrative setting)
speeds = [1.0, 1.12, 1.25, 1.39, 1.52, 1.66]   # car speed upward, sampled every 0.1 s after a brake failure
for i, v in enumerate(speeds):
    t = i * 0.1
    if v > limit:
        print(f"t = {t:.1f} s: up speed {v} m/s exceeds {limit:.2f} -> emergency brake set")
        break
    print(f"t = {t:.1f} s: up speed {v} m/s")

t = 0.0 s: up speed 1.0 m/s
t = 0.1 s: up speed 1.12 m/s
t = 0.2 s: up speed 1.25 m/s
t = 0.3 s: up speed 1.39 m/s
t = 0.4 s: up speed 1.52 m/s exceeds 1.50 -> emergency brake set

This illustrative run uses the figures of a car like Tillicum car 1 with a failed brake and an empty car: the car accelerates upward at about 1.3 m/s2 under the counterweight's pull, crosses the detection speed in about half a second, and the emergency brake sets. The setting of the detection speed comes from the code rule and the maker's equipment; the point is that detection happens within a fraction of a second, so the car has not gone far.

Emergency brakes and other stopping devices

Several kinds of device can stop the car. A rope gripper is a clamp mounted under the machine or on the machine beams that grips all the hoist ropes between two friction shoes, set by springs and held open hydraulically or electrically; it is a common retrofit on older geared and gearless cars. A sheave brake grips the drive sheave directly, independent of the machine brake. On modern permanent-magnet gearless machines like Larchmont's and Quayside's, the machine is usually fitted with two independent brakes, each able to hold and stop the car on its own, acting directly on the sheave or its shaft with no gearing between brake and sheave; with the right monitoring, the code accepts the second brake as the emergency brake. Some cars use safeties that grip the rails in both directions, or counterweight safeties for the up direction, because a counterweight falling is the same event as the car going up.

Whatever the device, it must stop the car without harmful deceleration. For the ascending case, the device has the empty car and the full counterweight moving upward together, with the counterweight's extra weight still pulling them, so its force must exceed that pull with a margin. Too strong a device, though, would stop the car too abruptly, especially with a full load going up.

# Rope gripper stop of an empty car going up (illustrative figures)
g = 9.81
m_car, m_cw, m_ropes = 1250, 1704, 450     # empty car, counterweight, ropes and moving parts, kg
v = 1.5                                      # speed when the gripper sets, m/s
grip = 26000                                   # gripper retarding force, N
m_total = m_car + m_cw + m_ropes
pull = (m_cw - m_car) * g                 # unbalance still accelerating the car upward, N
a = (grip - pull) / (m_total )        # net deceleration
s = v * v / (2 * a)
print(f"unbalance pull {pull:,.0f} N, net deceleration {a:.1f} m/s2 = {a / g:.2f} g, stopping distance {s:.2f} m")
print("within 1 g" if a <= g else "TOO ABRUPT")

unbalance pull 4,454 N, net deceleration 6.3 m/s2 = 0.65 g, stopping distance 0.18 m
within 1 g

The masses are Tillicum car 1's from ELV-230. The gripper force is a design figure, not Tillicum's, since the car has none; Lena is using numbers like these to compare gripper models for the modernization. The stop is gentle and short. On the US calculation, the pound figures are weights, so dividing by g gives mass and the pull comes out in pounds-force.

Detecting unintended movement

Unintended movement is detected from the door state and the car's position. When the doors are not closed and locked, the car is allowed to move only within the door zone, for levelling and relevelling at low speed. If the car leaves the door zone with the doors open, by more than a short distance, something has failed, and the emergency brake must set. On Larchmont's and Quayside's cars, the certified safety board reads two door zone sensors and the door circuits and trips the emergency brake. On retrofits to older cars, a separate monitoring unit with its own door zone sensors does the job. The stopping distance is measured from the landing: detection, the device's reaction time and its stopping distance together must keep the car within the code distance, which is why the detection must be fast and the device must act quickly.

Brake monitoring is part of the same protection. Since a failed machine brake is the most common cause of unintended movement, newer codes require the controller to check that the brake actually lifts and sets on every run, using switches or sensors on the brake, and to prevent the next run if a brake fails to set. Tamsin had seen this on Quayside in ELV-210, where a broken crimp on one brake coil stopped the car with a brake monitoring fault.

When older cars must be upgraded

Codes do not require every existing car to be fitted with these devices at once. They are required on new installations, and on existing cars when an alteration triggers them: typically when the machine, the brake, the controller or the drive is replaced, or when the car's rated speed or load is changed. Some jurisdictions have also set their own dates for upgrading certain older equipment, such as cars with single brakes of particular designs. Tillicum car 1 has neither protection, because it was installed long before the rule, and its coming modernization will trigger both. Lena's modernization plan includes a rope gripper on the machine beams, brake monitoring on the existing brake until the machine is replaced, and a safety board in the new controller that detects unintended movement. ELV-430 returns to this when the modernization is planned in detail.

# Does this alteration trigger ascending overspeed and unintended movement protection? (illustrative screening list)
triggers = {"machine replaced", "brake replaced", "controller replaced", "drive replaced",
            "rated speed increased", "rated load increased"}
jobs = {"Tillicum car 1 controller and drive modernization": {"controller replaced", "drive replaced"},
        "Tillicum car 1 rope replacement (same size and type)": set(),
        "Marlowe door operator replacement": set(),
        "Delmont two-speed car, new machine and brake": {"machine replaced", "brake replaced"}}
for job, changes in jobs.items():
    hit = changes & triggers
    print(f"{job}: {'add both protections (' + ', '.join(sorted(hit)) + ')' if hit else 'not triggered by this list'}")
print("confirm with the code edition in force and the regulator before planning")

Tillicum car 1 controller and drive modernization: add both protections (controller replaced, drive replaced)
Tillicum car 1 rope replacement (same size and type): not triggered by this list
Marlowe door operator replacement: not triggered by this list
Delmont two-speed car, new machine and brake: add both protections (brake replaced, machine replaced)
confirm with the code edition in force and the regulator before planning

The list is a screening aid, not the code: the exact triggers are in the code's alteration part for the edition in force, and Technical Safety BC decides any doubtful case. Lena always confirms in writing before a modernization is priced.

Testing emergency brakes

Emergency brakes and their detection are tested on the yearly and five-year schedule in the maker's procedure. Typical tests include operating the device with the car moving on inspection to prove it stops and holds the car, checking the ascending overspeed trip at its set speed during the five-year governor test, and testing unintended movement detection by commanding a small movement with the doors open, as in ELV-310. Rope grippers need their shoes, springs and release checked, and their hydraulic or electrical release tested for failure in the safe direction: if power or pressure is lost, the gripper must set, not release.