Skip to content


Thomas D. Barkand
U.S. Department of Labor
Mine Safety and Health Administration
Cochrans Mill Road, P.O. Box 18233
Pittsburgh, Pennsylvania 15236


Over a five-year period, there were at least 18 documented cases of ascending elevators striking the overhead [1]. In some cases, the accidents resulted in serious injuries or fatalities. These accidents occurred on counterweighted elevators as a result of electrical, mechanical, and structural failures. Elevator cars are fitted with safeties that grip the guide rails and stop a falling car; however, these devices do not provide protection in the upward direction.

Rules and regulations applying to elevator safety have come under review in response to these accidents. Some governing authorities have already revised their regulations to require ascending car overspeed protection. This paper will discuss basic elevator design, hazards, regulations, and emergency braking systems designed to provide ascending car overspeed protection. In addition, a case-study report on a pneumatic rope brake system installed and tested on a mine elevator will be discussed.


Elevators incorporate several safety features to prevent the car from crashing into the bottom of the shaft. Safeties installed on the car can prevent this type of accident from occurring when the machine brake fails or the wire ropes suspending the car break. However, the inherent design of the safeties render them inoperative in the ascending direction.

In the upward direction, the machine brake is required to stop the cage when an emergency condition occurs. Under normal operation, the machine brake serves only as a parking braked to hold the cage at rest. However, when an emergency condition is detected, modern elevator control system designs rely solely on the machine brake to stop the car.

In the United States mining industry, the accident history has proven that this is not the best control strategy [2], [3]. These accidents occurred when the retarding effort of the drive motor was defeated when the mechanical brakes were inoperative. This allowed the counterweight to fall to the bottom of the shaft, causing the car to overspeed and strike the headframe. The high-speed elevator crashes into the overhead structure caused extensive mechanical damage and potentially fatal injuries.


A basic understanding of elevator operation is required in order to assess the safety hazards present and determine the accident prevent methods available. Figure 1 shows a complete view of a mine elevator.

Fig. 1. Mine Elevator

In a typical elevator, the car is raised and lowered by six to eight motor-driven wire ropes that are attached to the top of the car at one end, travel around a pair of sheaves, and are again attached to a counterweight at the other end.

The counterweight adds accelerating force when the elevator car is ascending and provides a retarding effort when the car is descending so that less motor horsepower is required. The counterweight is a collection of metal weights that is equal to the weight of the car containing about 45% of its rated load. A set of chains are looped from the bottom of the counterweight to the underside of the car to help maintain balance by offsetting the weight of the suspension ropes.

Guide rails that run the length of the shaft keep the car and counterweight from swaying or twisting during their travel. Rollers are attached to the car and the counterweight to provide smooth travel along the guide rails.

The traction to raise and lower the car comes from the friction of the wire ropes against the grooved sheaves. The main sheave is driven by an electric motor.

Most elevators use a direct current motor because its speed can be precisely controlled to allow smooth acceleration and deceleration. Motor-generator (M-G) sets typically provide to dc power for the drive motor. Newer systems use a static drive control. The elevator controls vary the motor's speed based on a set of feedback signals that indicate the car's position in the shaftway. As the car approaches its destination, a switch near the landing signals the controls to stop the car at floor level. Additional shaftway limit switches are installed to monitor overtravel conditions.

The worst fear of many passengers is that the elevator will go out of control and fall through space until it smashes into the bottom of the shaft. There are several safety features in modern elevators to prevent this from occurring.

The first is the high-strength wire ropes themselves. Each 0.625-in-diameter extra-high-strength wire rope can support 32,000 lb, or about twice the average weight of a mine elevator filled with 20 passengers. For safety's sake and to reduce wear, each car has six to eight of these cables. In addition, elevators have buffers installed at the shaft bottom that can stop the car without killing its passengers if they are struck at the normal speed of the elevator.

As previously discussed, modern elevators have several speed control features. If they do not work, the controls will disconnect the motor and apply the machine brake. Finally, the elevator itself is equipped with safeties mounted underneath the car. If the car surpasses the rated speed by 15 to 25%, the governor will trip, and the safeties will grip the guide rails and stop the car. This was the invention that made elevator transportation acceptable for the general public.


A historical perspective of elevator development can account for today's problems with elevator safety rules and regulations [4]. In the beginning of modern elevator history, it was realized that although there were several factors of safety in the suspension rope design, the quality of construction and periodic inspection could not be assured. Therefore, the elevator car was equipped with reliable stand by "safeties" that would stop the car safely if the suspension ropes failed. In 1853, Elisha Otis, a New York mechanic, designed and demonstrated an instantaneous safety capable of safely stopping a free- falling car. This addressed the hazard shown in figure 2.

Fig. 2. Suspension Failure

Later on, it was realized that passengers may be injured when the car overspeeds in the down direction with suspension ropes intact, as shown in figure 3. To prevent this hazard, an overspeed governor with gradually applied safeties was developed. It detected the overspeeding condition and activated the safeties.

Fig. 3. Car Overspeed Down

Furthermore, it was noticed that frequent application of safeties caused mechanical stress on the elevator structure and safety system. Therefore, a governor overspeed switch was installed that would try to stop the car by machine brake before the safeties activated. The switch was a useful idea because it could also initiate stopping in the case of overspeeding in the up direction as well.

The problem started in the 1920's when the American Elevator Safety Code was developed. The writers most likely looked at the technology that was available at that time and subsequently required it on all elevators covered by the Code.

The writers were so concentrated on describing the design of the required devices that they forgot to acknowledge the hazards that the devices are guarding against and the elevator components that may fail and cause the hazards. They did not consider the fact that for 90% of the elevator trips, the elevator is partially loaded (i.e. less than 45% of rated load)[5]. Therefore, if a brake failure occurs, the elevator will overspeed and crash in the up direction as shown in figure 4.

Fig. 4. Car Overspeed Up

Until recently, elevator safety systems have not differed significantly from the early 1900's designs. The problem arises because rulemaking committees and regulatory authorities are reluctant to require new safeguards when the technology has not been fully developed. Conversely, the elevator manufacturing industry cannot justify the product development expense for a new safety device with little marketability. This problem will be addressed in the following sections.


Several rulemaking committees and government safety authorities have addressed the deficiencies in the existing elevator regulations and have proposed revisions to the elevator safety codes.

ANSI/ASME A17.1 Safety Code on Elevators and Escalators

The report from the American Society of Mechanical Engineers - A17 Mechanical Design Committee on "Cars ascending into the building overhead,"-dated September 1987, contained the types of failures that could result in elevators accelerating into overhead structure and an analysis of the possible solutions. In addition, a proposal to the A17.1 Committee for a new code Rule 205.6 was introduced as follows:

Rule 205.6 ("Prevention of overspeeding car from striking the overhead structure"): All traction elevators shall be provided with a means to prevent an ascending car from striking the overhead structure. This means shall conform to the following requirements:

  1. Prior to the time when the counterweight strikes its buffer, it shall reduce the speed of the car to the speed for which the counterweight buffer is designed.

  2. It shall not develop an average retardation of the car in excess of 32.2 ft/s2 (9.81 m/s2) during the stopping phase.

  3. It shall be a mechanical means independent of the driving machine brake.

  4. It shall prevent overspeeding of the elevator system through the control of one or more of the following:

    1. counterweight
    2. car
    3. suspension or compensating rope system.

This proposed rule is currently under committee review, and consideration has been given to requiring protection to prevent the car from leaving the landing with the doors opened or unlocked.

Pennsylvania Bureau of Deep Mine Safety

An ascending elevator car accident occurred at a western Pennsylvania coal mine on February 4, 1987 and caused extensive structural damage and disabled the elevator for two months. Following this accident, the Pennsylvania Bureau of Deep Mine Safety established an advisory committee to determine these devices that are available to provide ascending car overspeed protection for new and existing mine elevator installations.

The following four protective methods were determined to be feasible based on engineering principles or extensive mine testing.

1) Weight balancing (counterweight equals the empty car weight)
2) counterweight safeties
3) dynamic braking
4) rope brake.

The Pennsylvania Bureau of Deep Mine Safety has approved these four methods and has made ascending car overspeed protection mandatory on all existing counterweighted mine elevators within the state of Pennsylvania, effective December 1, 1991.

Other requirements for new elevators are a governor rope monitor device, back out of overtravel switch, and a manual reset.

CSA-B44 Elevator Safety Code

Four days after the fatal Scotia Plaza construction elevator accident occurred in Toronto on August 29, 1987, the CSA Executive Committee on Elevator Safety Codes started to consider the need for protection against the hazard of the car overspeeding into the overhead structure [4]. The Canadian CSA-B44 Elevator Safety Code addressed the ascending car overspeed hazard with a three-page-long rule that went into effect April 1, 1990. The rule clearly specified possible elevator components failures and defined the hazards that could be caused by failures such as free fall and overspeed in both directions. The rule also listed basic performance criteria for protective means to guard against the hazards, allowing application of new technologies without prohibiting the old designs.

The safety code also addressed the potential risk of injuries to passengers if a failure would cause the car to leave the landing with the door open. This hazard could cause the passenger to be crushed between the car floor and landing door header. This risk is also present in the down direction. To eliminate the "trapping risk" in both directions, additional protective means that must detect any uncontrolled movement of the car are required.


Several methods are available to provide ascending car overspeed protection. Some methods are feasible only on new installations, and others are easily retrofitted to existing elevators. Three of the most viable solutions are presented here for consideration.

Counterweight Safeties

The obvious method is to install traditional safeties on the counterweight; however, the reliability of this old technology is being questioned. In addition, this method can be difficult to install on existing elevators, especially if the counterweight guide rails and brackets need to be replaced to accommodate the additional load forces. Clearances may not be available for the counterweight safeties due to limited shaftway dimensions. There is also a problem with maintaining the safety system under the less than desirable operating environment that is present in the mine shaftway.

Dynamic Braking

A second solution used in the United States mining industry is the application of passive dynamic braking to the elevator drive motor [6]. As mentioned earlier, most elevators use direct current drive motors that can perform as generators when lowering an overhauling load. Dynamic braking simply connects a resistive load across the motor armature to dissipate the electrical energy generated by the falling counterweight. The dynamic braking control can be designed to function when the main power is interrupted. Dynamic braking does not stop the elevator but limits the runaway speed in either direction; therefore, the buffers can safely stop the conveyance.

Rope Brake

A pneumatic rope brake that grips the suspension ropes and stops the elevator during emergency conditions has been developed by Bode Aufzuge1[7]. This rope brake has been used in the Netherlands since August 12, 1957.

Case Study: Rope Brake Testing and Evaluation

The first pneumatic rope brake was installed in the United States at a western Pennsylvania coal mine on September 8, 1989. The largest capacity Bode rope brake (model 580) was installed on this coal mine elevator. This rope brake installation was tested extensively by Mine Safety and Health Administration engineers from the Pittsburgh Safety and Health Technology Center. A summary of the findings will be presented in this study.


The rope brake is a safety device to guard against overspeed in the upward and downward directions and to provide protection for uncontrolled elevator car movements.

The rope brake is activated when the normal running speed is exceeded by 15% as a result of a mechanical drive, motor control system, or machine brake failure. The rope brake does not guard against free fall as a result of a break in the suspension ropes.

Standstill of the elevator car is also monitored by the rope brake system. If the elevator car moves more than 2 to 8 inches in either direction when the doors are open or not locked, the rope brake is activated and the control circuit interrupted. The rope brake control must be manually reset to restore normal operation.

The rope brake also provides jammed conveyance protection for elevators and friction driven hoists. If the elevator car does not move when the drive sheave is turning, the rope brake will set, and the elevator control circuit will be interrupted.

The rope brake control contains self-monitoring features. The rope brake is activated if a signal is not received from the pulse tachometer when the drive is running.

The rope brake requires electrical power and air pressure to function properly. The rope brake sets if the control power is interrupted. When the power is restored, the rope brake will automatically release.

Typically, elevator braking systems are spring applied and electrically release. Therefore, no external energy source is needed to set the brake. The rope brake requires stored pressurized air to set the brake and stop the elevator. Therefore, monitoring of the air pressure is essential. If the working air pressure falls below a preset minimum, the motor armature current is interrupted, and the machine brake is set. When the air pressure is restored, the fault string is reset.

Pneumatic Design

The rope brake system is shown in figure 5. Starting from the air compressor tank, the pressurized air passes through a water separator and manual shut off valve to a check valve. The check valve was required to ensure the rope brake remains set even if an air leak develops in the compressed air supply. A pressure switch monitors for low air pressure at this point and will set the machine brake as mentioned earlier. The air supply is split after the check valve and goes to two independent magnetic two-way valves. The air supply is shut off (port A), while the magnetic valve coil is energized. When the magnetic valve coil is deenergized, the air supply is directed to the B port, which is open to the rope brake cylinder. The air pushes the piston inside the rope brake cylinder and forces a movable brake pad toward a stationary brake pad. The suspension ropes are clamped between the two brake pads. The rope brake is released by energizing the magnetic valve, which vents the pressurized rope brake cylinder to the atmosphere through a blowout silencer on port S.

Figure 5. Rope Brake System

The force exerted on the suspension ropes equals the air pressure multiplied by the surface area of the piston. The rope brake model number 580 designates the diameter of the brake cylinder in millimeters. This translates into 409.36 in2 of surface area. The working air pressure varies from 90 to 120 lbf/in2. The corresponding range of force applied to the suspension ropes is 36,842 to 49,123 lb. The force experienced by the ropes as they pass over the drive sheave under fully loaded conditions is about 34,775 lb. Therefore, the ropes experience a 6 to 41% greater force during emergency conditions than normally encountered during full load operation.

Mechanical Modifications

Prior to testing, several mechanical modifications were required to protect the rope brake system from environmental and mechanical damage. The modifications also reduced the possibility and the undesirable effect of an air leak in the pneumatic system. The following modifications were included in the rope brake design:

  1. The 200 lbf/in2 rated plastic air hose was replaced with 2,000 lbf/in2 rated metal braided hose with integral couplings.

  2. The air hose compression fittings were replaced by stainless steel threaded connectors.

  3. All the electrical components were installed in protective enclosures, and the wiring was installed in conduit.

  4. A check valve was installed in the compressed air supply line to hold the rope in the applied position once it was set even if air pressure was lost in the air compressor tank.

  5. The added check valve required an additional pressure switch to monitor the supply air pressure. The original pressure switch would not detect a pressure loss in the air compressor tank when the check valve was installed. The contacts of the two pressure switches were installed in series.

Mechanical Testing

Tests were conducted to determine if the rope brake would operate reliably in the mining environment to provide ascending car overspeed protection.

First, accelerated mechanical testing was performed to determine if the braking system could withstand repeated operation without experiencing significant wear or failure. These tests were performed while the suspension ropes were stationary. This testing was conducted at both the mine site installation and in the laboratory.

Mine site testing was conducted every 4 hr. Mechanical counters were installed on both the machine brake and the rope brake to record the total number of operations for each brake. Every 4 hr, the number of times the machine brake had set during the previous 4 hr period was noted, and then, the rope brake was operated an equal number of times.

The mechanical testing concluded after 30 days of around the clock testing. The total number of rope brake operations was 3430. The temperature range varied from 25 to 83°F.

One of the rope brake components subjected to wear was the piston ring gasket. This gasket provides the air seal between the moving piston, which presses against the traveling brake pad, and the stationary cylinder. An overload test was conducted to determine the integrity of this seal.

For the test, 8750 lb (125% of rated load) was loaded onto the car at the bottom of the shaft. Then, the rope brake was set, and the machine brake was disengaged. The air pressure was released from the air compressor tank, and the air pressure inside the rope brake cylinder was monitored. The load was successfully held stationary for 1 hr. The initial air pressure was 114 lbf/in2, and after 1 hr, the pressure was 102 lbf/in2. The pressured reduction may be attributed to an air leak through the check valve or past the piston ring gasket as a result of wear.

Laboratory mechanical tests were also performed on the rope brake in the Mine Electrical Systems Division laboratories located at the Pittsburgh Safety and Health Technology Center. The testing was performed on the smaller Bode rope brake model 200. The rope brake system was positioned outside the laboratory building under an awning that allowed the brake system to be exposed to the outside air temperature and humidity but was protected from direct contact with the rain and snow. The rope brake was activated remotely by computer control. The computer was programmed to apply and then release the rope brake every 38 s and log the number of operations. The outside air temperature, relative humidity, and barometric pressure were also continuously recorded.

After 2 mo of testing and 146,836 operations, the rope brake was disassembled and inspected for wear. The pneumatic piston ring gasket exhibited minimal wear. Superficial rust was evident where the compressed air entered the rope brake and displaced the lubricant.

Over the 70 days of testing, the temperature ranged from 5 to 82°F, and the relative humidity varied from 25 to 100%. At times, thick accumulations of frost build up on the air line between the magnetic valve and the rope brake cylinder. Therefore, the formation of ice inside the compressed air lines was possible; however, no adverse affects were observed. Rope Brake Control Failure Analysis

In addition to the previously discussed mechanical analysis, testing and evaluation of the rope brake electrical control system was conducted. Brake control system studies were performed at the mine site and in the laboratory. The safety evaluation was conducted to ensure that a single undetected failure would not defeat the protection provided by the rope brake.

Component failure should be detected by the brake control system and cause the elevator to stop safely and remain at rest until the failure is corrected. If automatic detection was not feasible, the periodic inspection and maintenance procedures were required to specify detailed testing of the possible failed component.

The rope brake control system, which is shown in figure 6, monitors the following four inputs: M contactor, speed relay, pressure switch, and the rope pulse tachometer. Based on this input information, the brake logic decides to set the machine brake or both the machine brake and the rope brake. A test board was designed and built to simulate the brake control inputs with toggle switches and to provide relay coil loads for the brake logic output. A separate power source supplied 24 Vdc to the simulator board and brake control box. Evaluation of this simulation board provided the following information on the function of each input.

Figure 6. Rope Brake Control System

Rope Pulse Tachometer Test: The brake control logic obtains the speed reference signal from an independent pulse tachometer assembly. The pulse tachometer assembly consists of two proximity switches mounted 45 mechanical degrees apart around a rotating rubber wheel. Two sheet metal screws are installed into the rubber wheel on opposite sides (180° apart). The rubber wheel is friction driven by the suspension ropes. A spring tension arm maintains pressure between the rubber friction wheel and suspension ropes. Electrical pulses are generated as the screw heads pass beneath the proximity switches. This pulse train is interpreted by the brake control box to obtain the speed of the elevator.

Each proximity switch is equipped with three wires: supply power, common, and pulse output. Fault testing of the proximity switch revealed that opening any one wire would render the proximity switch inoperative. Furthermore, it was found that if either one of the two proximity switches failed, the overspeed and stand still protection were defeated. In other words, the opening of any one of the six proximity switch wires would render the primary protection of the brake control inoperative. This failure would be detected when the speed check relay opens in the elevator control. The speed check relay will be discussed in detail later. The recommendation was made to redesign the brake logic control to use only one proximity switch or, preferably, to use the two proximity switches in a redundant configuration.

Speed Relay Input Test: The brake control logic also monitors a speed relay to determine if the elevator should be running. For this installation, the elevator speed relay RL2 is monitored by the brake control logic. The normally closed contact of RL2 opens when the elevator reaches 60% of the rated speed. The speed contact serves as a check on the rope tachometer. When RL2 is opened, the brake control should be receiving a signal from the rope tachometer. The rope brake and machine brake set if the tachometer fails for any reason to produce a signal when the elevator control has a run command.

If the RL2 relay coil fails or the contacts short, the checking of the rope tachometer is defeated. This failure would be undetected by the brake control. As a result of this discovery, additional speed relay contacts were required to be installed in series with the RL2 contact. Another requirement was that at least one of the contacts should be from the slowest speed relay. This will usually be the inspection speed relay. Using this slowest speed, relay will result in the earliest possible detection of a failed rope tachometer.

Motor Contactor Input Test: The M contact is the main motor contactor that closes to supply armature current to the drive motor. When the M contact is open, power is removed from the elevator drive motor and the machine brake is set. An auxiliary contact on the M contactor drives theMx relay, which then drives the Ma relay. The normally open contact on the Ma relay is monitored by the rope brake control logic. Therefore, when the Ma contact is open, the elevator should be stationary or coming to a stop.

If the Ma contact is open and the elevator moves 2 to 8 in as detected by the pulse tachometer, the brake logic will activate the rope brake and the machine brake. However, it was discovered through testing that a short circuit across the Ma contact would render this standstill protection inoperative. Furthermore, a short across this contact would exist undetected unless it was specifically tested with an ohmmeter. As a result of this discovery, additional contacts were required to be installed in series with the Ma contact to improve the reliability of the circuit via redundant contacts.

Pressure Switch Test: The rope brake is equipped with two pressure switches to monitor the air pressure on each side of the added check valve. The contacts for each pressure switch are connected in series. Therefore, both must be closed to provide power to the SR relay (fault string) and allow the elevator to run. According to the previously discussed test results, the pressure switch contacts close when the air pressure is greater than 54 lbf/in2. When low pressure is sensed on either side of the check valve, the SR relay drops out, which opens the safety fault string, thereby removing the drive power and causing the machine brake to set.

The two pressure switches provide different types of protection. The pressure switch on the supply side of the check valve monitors for low pressure in the air tank. The primary function of the pressure switch installed on the other side of the check valve is to monitor the activation of the rope brake. The brake should be released when air pressure is detected by this pressure switch.

The brake control logic did not detect the shorted failure of the pressure switch during laboratory testing. Therefore, a mechanical limit switch was required to be installed on the rope brake to monitor the position of the rope brake pads and assure that the rope brake is released when the elevator is running.

Test Button: A test button is located on the front panel of the brake control box. The purpose of the button is to test the speed-sensing circuitry of the brake control system. If the test button is pressed while the elevator is running at rated speed, a red indicator button is illuminated.

During laboratory testing, it was discovered that depressing the test button will defeat the overspeed protection of the brake control. As a result of this discovery, the test button was required to be disconnected from the rope brake electronic control and was required to be mechanically disabled.

Mine Site brake control tests were conducted by introducing single component faults into the brake control logic and recording the elevator system response. The mine site testing verified results that were observed in the laboratory.

Dynamic Performance Tests

The retarding capacity of the Bode rope brake model 580 was tested at the mine site on three occasions over a 6-mo period. During the test procedure, the elevator motor armature current, field current, armature voltage, speed (analog tachometer feedback), and rope brake cylinder air pressure were monitored and recorded on an eight-channel thermal array recorder.

The tests were designed to determine the following:

  1. Whether the braking effort of the rope brake had deteriorated over the 6-mo test period and if the rope brake could safely stop the maximum expected load;

  2. whether the rope brake can safely stop the elevator when low air pressure is detected, the number of times the rope brake can stop the elevator under low air pressure conditions, and to determine the effect of low air pressure on the stopping distances;

  3. the effect of compound braking when the rope brake is activated in addition to the dynamic brake, machine brake, safeties, and all other possible combinations of braking systems acting together. The braking tests were conducted under rated load, no load, rated speed, and overspeed conditions.

Rope Brake Test: Approximately 100 deceleration tests were conducted over the 6-mo period. Increasing rope brake retarding effort was observed during the final tests. The increase in rope brake effectiveness may be attributed to the grooves worn into the brake lining by the suspension ropes. After approximately 125 operations of the rope brake, the groove wear-in becomes self limiting [8].

Initially, the rope brake lining is flat and smooth; grooves are worn into the brake lining after the rope brake has repeatedly stopped the elevator. These grooves conform to the contour of the suspension ropes, which greatly increases the braking surface area. This increased surface area dissipates the heat more effectively and therefore reduces the peak temperatures generated when the brake is applied. Lower brake lining and suspension rope temperature increases the coefficient of friction and consequently generated a greater braking effort.

Another factor that would increase the braking effort is the cleaning effect the application of the rope brake would have on the suspension ropes. The repeated application of the rope brake over the testing period would have stripped the dirt and grease accumulations off a majority of the suspension rope. If the rope brake was applied on the cleaned portion of the suspension rope, the braking effort would improve.

Low Air Pressure Tests: A series of tests were conducted with the air compressor motor disconnected from the power source to determine the number of times the rope brake could stop the elevator from the stored pressurized air in the compressor tank. The test were conducted with no car load in the upward direction.

The elevator was stopped by the rope brake 12 times from rated speed with the air compressor power supply disconnected as shown by the dashed line in figure 7. Then, the air pressure fell to 52 lbf/in2, the pressure switch tripped and opened the elevator control fault string and prevented operation of the elevator. The pressure switch contact was temporarily bypassed to allow further testing. The rope brake was activated eight additional times, and the corresponding air pressure and stopping distances are shown in the solid line of figure 7. The rope brake was activated at various speeds ranging from 640 to 680 ft/min.

Figure 7. Rope Brake Retarding Effort During Low Air Pressure

The stopping distances were calculated from the actual deceleration rates based on an initial speed of 600 ft/min. As expected, the stopping distance increased as the available air pressure decreased. The rope brake was able to effectively stop the elevator within 82 feet with as little as 30 lbf/in2 in the air compressor tank. After the rope brake set, only 22 lbf/in2 was available in the air compressor tank. The slight distortion in the curve may be attributed to the varying condition of the suspension rope surface and initial speed fluctuations.

Compound Braking: The effect of compound braking is always a concern on elevators equipped with multiple brakes. This elevator is equipped with four independent braking systems: the machine brake, dynamic brake, rope brake, and safeties. Each system must be individually capable of retarding the elevator. However, deceleration rates in excess of 16 ft/s2 should not occur when all the braking systems are activated simultaneously.

Analysis of the data showed the greatest deceleration rates were observed when the machine, dynamic, and rope brakes were activated with no car load in the down direction. This compound braking produced a deceleration rate of 13.8 ft/s2, which is considered to be a safe stopping rate.

The rope brake was also capable of stopping the maximum rated load (7000 lb) traveling down at rated speed. The measured deceleration rate was 5.88 ft/s2, which translates into a stopping distance of 8.5 ft when traveling at 600 ft/min.

The most rapid deceleration was recorded when the rope brake and the safeties were activated together. The inadvertent operation of the safeties during the rope brake overspeed test in the down direction with rated load (7000 lb) produced a deceleration rate of 19.4 ft/s2.

The rope brake acting alone will decelerate the elevator at 5.88 ft/s2. Therefore, the safeties retarding contribution was 13.5 ft/s2. Any of the braking systems compounded with the activation of the safeties will produce retardation rates greater than 16 ft/s2. The great retarding effort achieved by the safeties has been accepted since they are considered the final overspeed arresting device prior to the conveyance striking the buffers.

To better illustrate the compound braking effect, speed curves from four separate mine site tests are shown in figure 8. The first three curves show the machine brake, dynamic brake, and rope brake independently activated with an empty car in the ascending direction. The combined response of all three braking systems acting together, under the same test conditions, is shown on the compound braking curve.

Figure 8. Brake System Response, Empty Car, Ascending Direction

The primary response of the machine brake provides a linear deceleration rate of 2.5 ft/s2. However, a slight fading of the braking effort was observed as a result of the temperature rise in the brake lining during the final 400 ms. There is also an initial increase in speed while the overhauling counterweight accelerates downward prior to the machine brake setting. The retarding effort of the drive motor is interrupted immediately by opening the M contactor. However, there is an inherent 440 ms time delay before the machine brake sets.

The dynamic braking system produces a retarding force proportional to the speed with an initial deceleration rate of 2.7 ft/s2. The dynamic braking system begins retarding the elevator immediately since the motor contactor connects a resistor across the motor armature instead of opening the circuit and allowing the counterweight to accelerate downward. The dynamic braking effort is reduced as the speed decreases until an equilibrium is reached between the retarding effort and the load forces, resulting in a steady-state speed [6].

The rope brake produced an inverse speed response and developed a deceleration rate of 714 ft/s2. This is the greatest retarding effort produced by any of the three independent braking systems. The rope brake retarding effort increases as the rope speed decreases to produce the observed convex-shaped speed curve. This brake also suffers from an inherent time delay before actuation, which is similar to that of the machine brake, which results in an increase in the initial speed.

The compound braking response produced a "S"-shaped curve with an average deceleration rate of 9.09 ft/s2. The initial 200-ms deceleration response was proportional to the speed (concave speed curve) as a result of the dynamic braking effort. After the inherent 200-ms time delay in the mechanical braking systems, the brake curve exhibited an inverse speed response as a result of the combined effort of the linear machine brake and the dominant inverse speed rope brake.

Dynamic braking is an excellent system to assist the mechanical brake since the dynamic brake limits the initial overspeed conditions without having a significant compound braking effect.

Test Summary

Extensive mine and laboratory tests were conducted on the rope brake's mechanical and electrical system to determine if the rope brake would operate reliably in the mining environment to provide ascending car overspeed protection., As a result of the testing and evaluation, several recommendations were proposed to enhance the reliable operation of the emergency rope brake in the mine environment and during fault conditions.

Future rope brake installations will be evaluated to determine the effect the rope brake has on the suspension ropes. Several concerns exist at this time: mechanical distortion, abrasive wear, and frictional heating of the wire ropes caused by the application of the rope brake.

The mechanical distortion should be minimal since the force applied by the brake may not significantly exceed the full load force experienced by the suspension ropes as they pass over the drive sheave. However, the typical load forces are distributed over a larger area on the drive sheave compared with the rope brake lining. This may cause flexing and fatigue in the wires and strands.

The other concern is the altering of the breaking strength and elasticity of the suspension rope by frictional heating when the rope brake is applied. The temperature rises will be greatest for a new rope brake installation when the frictional heating is localized on a small portion of the suspension rope surface area prior to the grooves being worn into the brake linings. This heating may affect the strands in direct contact with the brake lining, causing a reduction in the ultimate breaking strength of the suspension rope.

The maximum suspension rope temperature measured by the rope brake manufacturer was 104°F. This temperature would not alter the metallurgical properties of the wire rope. The maximum temperature measured in the brake linings was 176°F.

These concerns are offset by the fact that the rope brake should operate very infrequently and that suspension ropes on mine elevators are changed rather frequently (i.e., every five years) due to other environmental factors. If minor alterations of the mechanical properties of the suspension ropes are found, a counter will be needed to log the number of operations of the rope brake. This information will be factored into the retirement criterion for the suspension ropes.

If the suspension ropes are dragged through a fully or partially set brake, the excessive frictional heating and wear of the suspension ropes may require immediate retirement of the suspension ropes. This reinforces the need for the mechanical limit switch to monitor the rope brake lining position and not allow the elevator to run if the rope brake is set and the pressure switch has failed.


Elevator accidents have indicated a strong need to provide additional requirements for ascending car overspeed protection. Additional safety hazards have also been identified. The time has also come to review the current elevator safety equipment and incorporate new technologies in the field of elevator safety.



A17 Mechanical Design Committee Report on Cars Ascending into the Building Overhead, ASME, Sept. 1987.

W.J. Helfrich, "Island Creek Coal Company V.P.-5 Mine," MSHA, Mine Electrical Systems Division Investigative Report No. C080978, August 1978.

T.D. Barkand, "Investigation of the Accident and Installation and Testing of Dynamic Braking on the Main Elevator at Duquesne Light, Warwick Mine, #3 North Portal," MSHA, Mine Electrical Systems Division Investigative Report C-052287-12, May 1987.

C. E. Valhovic, "Rational for New Rules, in CSA-B44 Safety Code for Elevators," Elevator World, July 1989.
[5] J. A. Nederbragt, "Uncontrolled Speed, Up and Down," Elevator World, Dec. 1985.

T.D. Barkand, W.J. Helfrich, "Application of Dynamic Braking to Mine Hoisting Systems," IEEE Transactions on Industry Applications, September/October 1988.

J.A. Nederbragt, "Rope Brake: As Precaution Against Overspeed," Elevator World, July 1989.

-----, "Report of Test Results" conducted by TNO-IWECO, Delft Tech. Univ., June 7, 1989.