Final limits, terminal stopping and buffers

At each end of the hoistway, a car that fails to stop at the terminal landing must be stopped before it hits the pit or the overhead. Three layers of protection do that, each meant to act only if the one before it fails. The normal terminal stopping devices slow and stop the car at the terminals even if the controller's normal stopping means fails. The final terminal stopping devices, the final limits, open the safety circuit and set the brake if the car travels beyond the terminal landing. And the buffers in the pit absorb the energy of a car or counterweight that is still moving when it reaches the bottom of its travel. Ray called them "the belt, the braces and the mattress". Tamsin met all three at Tillicum, whose car 1 has spring buffers and cam-operated limit switches in the hoistway, and at Quayside, whose cars have oil buffers and an emergency terminal speed limiting system.

Normal terminal stopping devices

In normal service, the controller stops the car at the terminal landings like any other floor. The code also requires normal terminal stopping devices, independent of the normal stopping means, that slow and stop the car automatically at or near the terminal landings if the normal means does not. On older cars like Tillicum's they are switches in the hoistway, operated by a cam on the car, that open the up or down direction and slow-speed circuits as the car approaches the terminal. On newer cars they may be switches or certified electronic functions using the position system, and on cars with higher speeds there are several slowdown points. ELV-310 covered how the controller uses them in its speed profile; the point here is that they are safety devices, tested by making the car approach the terminal without the normal stop and showing that it slows and stops.

Emergency terminal stopping and speed limiting

Faster cars need more. If a car approaches a terminal much faster than it should, a normal terminal stopping device may not be able to slow it in time. Emergency terminal stopping devices, required on cars above a certain speed, monitor the car's speed as it approaches the terminal and, if it exceeds a set value at set points, cut power and set the brake. Where the code permits buffers with reduced stroke, shorter than a full stroke for the car's rated speed, an emergency terminal speed limiting device must ensure that the car cannot reach the buffer faster than the speed the shorter buffer is designed for. Quayside's cars use reduced-stroke oil buffers, so their speed at the terminals is monitored by the safety board against limits set at several points in the last floors of travel.

Final terminal stopping devices

The final limits are the last electrical protection. A final limit switch at each terminal, operated by the car, opens the safety circuit if the car travels beyond the terminal landing, so that the drive is cut and the brake sets. It must be set to operate as close to the terminal landing as practicable, but not on a normal stop, and on cars with spring buffers it must operate before the car or counterweight strikes the buffer. Once a final limit has opened, the car must not be able to run in either direction on normal operation until it is moved back by a qualified person, usually on inspection operation with the controller's provisions for moving off a final limit. Final limits on traction cars are often mounted in the hoistway and worked by a cam on the car; on some older cars they are on the machine, driven from the machine shaft, which the code no longer allows for new work on most cars because they would not detect a rope slipping on the sheave.

# Setting the bottom final limit and checking runby (Tillicum car 1, spring buffers)
runby = 16                  # car runby: car sill level with landing to buffer contact, in
runby_min, runby_max = 6, 24   # range for this car's spring buffers, in
cam_to_switch = 3          # distance below floor level at which the cam opens the final limit, in
print(f"runby {runby} in -> {'within range' if runby_min <= runby <= runby_max else 'OUT OF RANGE'}")
margin = runby - cam_to_switch
print(f"final limit opens {cam_to_switch} in below the floor, {margin} in before the buffer is struck")
print("ok: limit opens before the spring buffer" if 0 < margin else "MOVE THE SWITCH: it opens after buffer contact")

runby 16 in -> within range
final limit opens 3 in below the floor, 13 in before the buffer is struck
ok: limit opens before the spring buffer

The runby is the clearance between the car's buffer striker plate and the buffer when the car is level with the bottom landing. Tillicum car 1's runby was set after the rope replacement in ELV-230 and has since settled as the new ropes stretched; Ray now checks it at every maintenance visit. The final limit opens well before the buffer is reached.

Buffers

Buffers stand in the pit under the car and the counterweight. They are not meant to stop a car in normal service; they absorb the energy of a car or counterweight that has passed the terminal, at up to a little more than rated speed, without injuring passengers. There are two main kinds. Spring buffers are heavy coil springs on a stand. They store the energy and give it back, so the car rebounds, and they are allowed only on slower cars, up to the speed the code sets, which on most traction cars means rated speeds up to about 200 ft/min. Tillicum car 1 is at that limit. Oil buffers, also called hydraulic buffers, have a plunger that pushes oil out of a cylinder through a set of orifices; the orifices close progressively as the plunger descends, so that the car decelerates at a nearly constant rate and the energy is absorbed as heat in the oil rather than stored. A spring returns the plunger afterward. Oil buffers are used on all faster cars. Some newer cars use polyurethane or elastomer buffers, which are allowed in the speed range of spring buffers.

The stroke of an oil buffer is set by the code so that a car or counterweight striking it at 115 % of rated speed is stopped with an average deceleration of no more than 1 g, and with no peak deceleration of more than 2.5 g lasting longer than a few hundredths of a second. The stroke for an average of exactly 1 g is the distance a body falling freely from rest would need to reach the striking speed, which gives a simple formula. Spring buffers have minimum strokes from a code table, and a spring buffer must be strong enough that it is not compressed solid by a static load well above the car and its rated load.

# Minimum full oil buffer stroke from the code rule (115 % of rated speed, 1 g average)
g = 32.2
for name, v in [("Tillicum car 1 (spring buffers today)", 200), ("Larchmont", 200), ("Quayside", 500)]:
    v_strike = 1.15 * v / 60
    s = v_strike ** 2 / (2 * g) * 12
    print(f"{name:<38} rated {v} ft/min -> full stroke at least {s:.1f} in")

Tillicum car 1 (spring buffers today)  rated 200 ft/min -> full stroke at least 2.7 in
Larchmont                              rated 200 ft/min -> full stroke at least 2.7 in
Quayside                               rated 500 ft/min -> full stroke at least 17.1 in

A full-stroke oil buffer for Quayside's speed would need more than 16 in of stroke, plus the buffer's own length; in a pit of limited depth that is a lot. That is why Quayside's cars use reduced-stroke buffers with emergency terminal speed limiting: the car's speed at the buffer is guaranteed to be lower than rated, so a shorter buffer is allowed, within the code's limits on how much the stroke may be reduced.

Buffer switches and oil

Oil buffers must be filled to the correct level with the oil the maker specifies, and their level is checked at every examination; a low level means a leak or that oil was lost in a test and not replaced. Many oil buffers have a switch that opens the safety circuit if the plunger is not fully extended, so that a car cannot run with a buffer that has not returned after being compressed. After a buffer test, the plunger must return to its fully extended position within the time the code sets, and a slow return means a weak return spring, a sticking plunger or the wrong oil. Spring buffers need much less: the springs and their stands are checked for corrosion, cracks and secure mounting, and the striker plates on the car and counterweight for damage.

# Oil buffer record after the five-year test (Quayside car 2, car and counterweight buffers)
return_limit = 90       # seconds allowed to return to full extension
records = {"car buffer": dict(oil_ok=True, return_s=41, switch_ok=True),
           "counterweight buffer": dict(oil_ok=False, return_s=38, switch_ok=True)}
for name, r in records.items():
    issues = []
    if not r["oil_ok"]:
        issues.append("oil below mark: top up with the specified oil and look for a leak")
    if r["return_s"] > return_limit:
        issues.append(f"returned in {r['return_s']} s, too slow")
    if not r["switch_ok"]:
        issues.append("switch did not open")
    print(f"{name}: " + ("ok" if not issues else "; ".join(issues)))

car buffer: ok
counterweight buffer: oil below mark: top up with the specified oil and look for a leak

Testing terminal devices and buffers

Each year, normal terminal stopping devices and final limits are tested by running the car toward each terminal on inspection or at reduced speed with the device it is meant to back up bypassed in the way the maker's procedure allows, and confirming it acts. Buffers are examined, oil levels checked, and the buffer switches operated. Every five years, oil buffers are tested by running the car, with its rated load, onto the car buffer at the speed the code requires for the test, with the normal and final terminal devices bypassed for the test, and the counterweight onto its buffer with the car empty, then checking that the plungers return within the allowed time and that nothing is damaged. Where emergency terminal speed limiting allows reduced-stroke buffers, the test speed is based on that system's limit. These are some of the most demanding tests in the trade: the car really does strike the buffer. They are done by a qualified crew under a written procedure, with the inspector present where the jurisdiction requires.