© 2006-2017 Elevator Load Test Inc. All rights reserved.
Elevator Load Test, Inc. performs independent and
Falling Hydraulic Elevators In Need of A Safety
by John W. Koshak
For more than 100 years, direct-acting hydraulic elevators have been part of the inventory of the vertical transportation industry. In the early years, they were use primarily as freight elevators, however, in the last 50 years, they have become the popular choice for both freight and passenger elevator applications. Their cost efficiency and dependability have proven their worth by the estimated 500,000 installations in North America alone. Simple installation and the advantage of not requiring overhead building structure for primary support make them a much more cost-effective choice over electric or traction elevators. They have been applied as high as 11 floors, speeds of 200ft/m (1m/s) and have a virtually unlimited loading capacity.
As straightforward as they are to install, cylinder installation practices varied across the continent. Prior to A17 Code direction, thousands of cylinders were installed with no protection against electrolysis or fluid failure from any source. Safety rules were written for elevators such as door interlocks, terminal limit switches and overspeeds; yet, one unaddressed issue was a requirement for pressure system failure protection. Electrolysis was corroding steel cylinders and underground steel pipes virtually from the time they went into the ground, but in most cases, it took years before the leaking showed up, sometimes catastrophically. In addition, many incidents of fitting, valve and other component failures led to catastrophic accidents.
By the late 1960s and early 1970s, pressure system failures were becoming notorious. What started out as a very reliable, safe system was becoming tarnished by reports of injuries and fatalities to passengers and constructors. In lieu of providing mandatory safeties similar to electric elevators, double bulkheads at the bottom of the cylinder, coatings of cylinders, mechanical protection of the coatings, installation in PVC outer casings and galvanic protections were proposed and adopted in code. These rules have helped to protect the in-ground portion of the pressure system to some degree, but injuries still occur in newer systems due to unprotected above-ground portions of the pressure system should they fail. Some areas require seismic or rupture valves to address traumatic failure of piping during an earthquake, but not all. These devices also do not prevent all uncontrolled downward motions since some partial breaches do not create enough pressure differential to discriminate normal motion from an uncontrolled motion. They can sometimes not close when needed creating dangerous conditions. So the risk of catastrophic failures, while reduced, is not eliminated.
In the last 10 years alone, millions of dollars have been spent in litigation and liability payouts and lives have been lost. This will continue because protecting the entire pressure system is still not required. While the code has addressed some of the causes, until it addresses all of them, there will always be a risk of a catastrophic fall. New technologies are now available to mitigate these risks, providing protection to the entire system. One of them is known as the LifeJacketÂ®, which can be retrofit on many existing direct-acting hydraulic elevators. It doesn't damage the plunger, it prevents damage to the elevator and prevents injury to its passengers. The LifeJacket can also be incorporated in new installations. Another device with similar results has now been patented and can be expected to reach the market in the near future. (Details of the patented device were not available at press time.)
As with all new technologies, many questions are raised by the industry. One is "What is the rate of retardation of this device?" This article answers that question and educates readers on the concepts of acceleration in relation to falling hydraulic elevators. To evaluate the risks associated with pressure system failures, this article describes some effects that can and do occur to falling elevators every year. It then describes the effects of a LifeJacket stop using the same criteria.
Pressure system failures of direct-acting hydraulic elevators can range from pinhole leaks allowing very slow speeds, larger leaks that allow the car to travel hundreds of feet per minute, or a total blowout, with a total loss of fluid and pressure, causing virtual free fall. To determine what the falling impact effects are, the common mode of failure and therefore the quantity of the pressure and fluid loss must be identified. A common failure is the underground portion of the pressure system as evidenced by the replacement of an estimated 3,000 cylinders per year in North America. Another is the failure of the feed pipes, both over- and underground. Valve, fitting and flexible hose failures are also common modes of failure. In short, all of the components of the pressure system have failed in the past and all with catastrophic results. It should be stressed that not all catastrophic accidents are preceded by a loss of oil, only the majority of cylinder failures are.
Of cylinder failures, the majority of them are of the pinhole variety. Some cases are catastrophic, hitting so hard that impact forces are extrapolated by calculating the bent steel bolster channels and platform to estimate the force at impact. These elevators did indeed hit with a tremendous amount of force after falls of one or more floors. This article estimates these calculations by formulae without considering the deflections of the elevator equipment. This is to illustrate the dramatic forces that need to be protected against by adding a safety device.
Although the answers here are broad, they represent the true relative forces as they occur in real life. Because of the damping effects of the material deflections, that is, the bending of the bolster channels and platform for example, it is impossible to calculate exact forces without scientific analysis. However, if you know the total deflection of the materials, you know how much distance was taken up in the stopping of the elevator. That is, going from falling velocity to a stop. With this information, you could calculate the average retardation deceleration. It is the intent here to represent estimations of the forces. The results of the simple force calculations vary widely and demonstrate that even with very significant damping, the impacts are devastating. Without some form of device to retard the uncontrolled downward motion and protect the occupants and equipment, these impacts can result in death.
To begin to determine what the impact force of a falling mass (elevator) is, the velocity of the mass must be determined. The formula for linear motion with constant acceleration, solving for final velocity is Equation 1:
To calculate the impact velocity of a two-stop elevator falling 10 feet at Gravity (32ft/s), starting from zero velocity, the formula is Equation 2:
To convert this velocity to feet per minute (ft/m) from ft/s, see Equation 3:
Based on this formula, the velocity of an elevator that falls at gravity for 10 feet will impact the buffers at a little over 1,500ft/m. This does not include the small amounts of wind resistance, frictional elements or other forces that would act to slow the elevator, but their effect would be minimal. The elevator will continue to accelerate until the fluid outflow is choked by the outhole orifice size. This will not occur if the outhole is a broken feed pipe in the pit or elsewhere, there will be minimal choke restriction of flow in 10 feet of travel, and the car will free fall until impact.
Velocity of the elevator as it strikes the pit structure is only one way to visualize the impact damage. Another method is to calculate the multiple of the acceleration of gravity, "g" force at impact. This represents the force acting on the mass at impact to slow and stop the mass and can best be thought of as a multiplier of the force of gravity "g", very similar to an airplane pilot in a steep turn that will experience "g" forces as a result. The effect of the rapid deceleration can be devastating above certain levels, and it is these rapid decelerations that are responsible for the injuries in this accident category.
To answer the specific question of what the average multiple of "g" force the impact will produce, we must make an assumption of the stopping distance. This may include the kinetic energy dissipation of the buffers and damping effect of deflecting materials of the pit structure and the car itself, but in this article, I am only considering the stopping distance prior to the bending of the car structure. These average estimations are calculated in Equations 4 and 5. The main reason for that is to keep the article simple, and because the gross numbers illustrate the forces so plainly that further deflections would not damp anywhere near enough to be a factor. These common failures occur every year with very telling results. Following the first example are representative estimations of other kinds of impacts and then the calculation of what a LifeJacket impact stop will do, given the same criteria. Assuming a 10-foot free fall, Vf = 25.29ft/s2, then calculating what the negative acceleration is at impact with a stopping distance of 1/2in. to get us to multiple of g: (for a stop onto a solid buffer with 1/2in. of rubber), S = 1/2in. (.0417ft), the solution would be in Equation 4:
This stop from a 10-foot fall, accelerating at gravity onto a solid buffer with 1/2in. of rubber, without considering any damping effect by the deflection of components of the car and pit structure, would be quite high. Multiplying 240 times the mass of the elevator would mean that if the car and occupants weighed 5,000lbs, the force at impact would be 1.20-million pounds of force. A tremendous impact. A passenger weighing 170lbs would quickly weigh 40,800lbs.
Consider an imaginary car crash, where a car had a velocity of 100mph, crashed and stopped in five feet.
Converting mph into ft/s Equation 6:
then calculating what the negative acceleration is at impact with a stopping distance of five feet to get us to multiple of g: S = 5ft, the solution would be:
This stop is 67 times the acceleration of gravity and illustrates why there is such massive damage to the components of the car. Again, there are other factors involved with stopping a mass of a known velocity and the damping effect of the deflections of the components involved, but the example should give some context to these impact examples.
Next, assuming an elevator, falling at gravity for 10 feet onto a spring buffer with a stopping distance (spring stroke) S = 4in. (.333ft), the formula would be:
Remember that this is a free fall of 10 feet and does not allow for the damping effect from the deflection of the components of the car or pit structure if that occurs to lengthen the stopping distance. A multiplier of 30 times the mass of the car would mean that if the car and occupants weighed 5,000lbs, the force at impact would be like 150,000lbs hitting the pit structure, a tremendous impact. Spring buffers are not rated for this kind of impact; they are rated for three times the static gross load and two times rated load at rated speed, without full compression. A force exerting a 30-times-the-mass impact is so high that the spring will hardly be noticed. If the 5,000lb gross load elevator had rated springs, they would absorb 15,000lbs of kinetic energy. When you impact the spring with 150,000lbs of kinetic energy, the spring will go coil to coil very quickly leaving the remaining 135,000lbs of kinetic energy to be dissipated by breaking, bending, deflection and retardation.
From the examples above, a picture of the severity of these impacts becomes clear. An elevator that loses suspension can and does fall very fast. It was for this very reason that electric elevators are required to have governors and safeties to limit the velocities and therefore the stopping force.
In contrast, the rates of retardation (negative acceleration) of the LifeJacket are calculated below. The worst case would be the highest overspeed setting of the LifeJacket controller of 256ft/m (4.267f/s) and a specification of 4in. (0.333ft) maximum stopping distance. Any overspeed can be adjusted for, typical overspeed is set for 125% of rated speed in the down direction, and here we will look only at the extreme cases. There are therefore four situations that need to be considered:
Case 1: The car is moving down at 200ft/m (the fastest hydraulic speed normally applied) when a small hole (e.g., less than a blowout) develops, in which case the velocity would be limited to 256ft/m (maximum setting) and the LifeJacket would trip. An elevator traveling full speed can also be assumed to have its doors and gate closed and locked, otherwise the valve would not allow the car to move.
Case 2: The car is not moving and has no demand to move when a small hole develops and begins to allow the car to drift down, in which case the velocity would be limited by the LifeJacket to 30ft/m and it would trip. An elevator which moves without valve direction should be deemed to have its door and gate presumed open creating a shear condition between the falling car transom and the stationary hall sill.
Case 3: The car is moving down at 200ft/m when a blowout develops, in which case the velocity would be limited to 256ft/m (maximum setting) and the LifeJacket would trip.
Case 4: The car is not moving and has no demand to move when a blowout occurs and free fall begins, in which case the velocity would be limited to the hydro-mechanical delay of the LifeJacket.
All of these conditions must consider the propagation delay inherent in the electronic sensing system and in the hydro-mechanical actuation of the LifeJacket control system. A "signal to set" time allows the velocity of the car to increase thus allowing higher "g" forces to accrue. With the LifeJacket, the electronics sense an uncontrolled descent and instruct a safety set in just under 60 milliseconds, worst case. The hydro-mechanical portion of the system responds to a pressure change in about 25 milliseconds. Therefore, a total propagation delay is 85 milliseconds, worst case.
A hydro-mechanical set, without any electronic sensing system, will occur when the system pressure goes to less than the spring force in the hydraulic control cylinder of the LifeJacket. During a feed pipe break or large outhole failure condition, the pressure will go close to 0 psi rather quickly, in 2-15 milliseconds. (See Figures 1 and 2.) This extreme drop in pressure allows the normally compressed actuation spring on the LifeJacket to extend and bring the arms down setting the safety. With a 25-millisecond delay for the hydro-mechanical components, it will actually respond quicker than the electronic components under blowout conditions in some cases. (See Figures 3 and 4.)
Given the different types of failures, two different accelerations will be used. In the non-blowout cases, an acceleration of 4ft/s2 will be assumed. In the catastrophic ruptures or total blowout cases the acceleration of gravity, 32ft/s2 will be assumed.
In these first two cases, we will assume that a small hole, not a blowout, has developed (a = 4), the velocity (Vo) is given and the "signal to set" delay (Vos) is the electronic and hydro-mechanical propagation delay of the system (85ms).
These first two cases illustrate the stopping force is less than a 1 multiplier or less than 1g. Case 1 is .9M and Case 2 is .03M. Both of them are below the existing code requirement of stopping of less than 1g. Figure 5 is a typical accelerometer waveform of a LifeJacket stop, first the raw waveform and then through a 10Hz filter. In that raw wave illustration, it can be seen that there are no peaks greater than 2g for any duration which indicates compliance to a proposal that stopping should never be more than 1g average and at no time be greater than 2g for more than 0.040 seconds.
In these next two cases, we will assume that a blowout has developed (a = 32), the velocity is given and the "signal-to-set" delay is the hydro-mechanical delay of the LifeJacket system (25ms).
Calculating the velocity increase in the signal to set time, we get:
Again in Case 3 and 4 it can be seen that the stopping does not exceed an average of 1g and in physical testing never exceeded 2g for more than 0.040 seconds.
Empirically, the LifeJacket does not slide a full 4in. at slower speeds. The axial forces are not as high at slower speeds and therefore there is less kinetic energy to dissipate and consequently there is less sliding distance. The lowest recorded accelerations are in the .2 ranges instead of .03 as calculated. This indicates that the sliding distance is much less than required at full and overspeeds. These next two cases illustrate the stopping distances actually occurring to achieve the recorded accelerations of .26g.
Cases 5 and 6 are here to illustrate that a 1/2in. stopping distance is required to meet the measured accelerations of >.26g.
Calculating the acceleration with a stopping distance of 1/2in.:
In all these cases, the stopping force is limited to under the 1g-stopping limit imposed by elevator codes for buffer and safety impact. (There are also time considerations that are being addressed by some task groups; for example, a 1g average can consist of very high accelerations for some short amount of time. It has been suggested that the retardation rates be limited to a 1g average with no accelerations greater than 2g for longer than 40 milliseconds. The LifeJacket complies with this criterion.)
These examples should have brought attention to two facts: A falling elevator is no place to be when it impacts or passes the sill with the doors open, and some form of device should be required to prevent these types of falls. The fact that they have happened should direct us to consider it will happen in the future and make changes to prevent it. There are many precedents that are analogous to this situation; Fire Recall, Earthquake and Door Restriction retrofits to name a few. Where a fatality has occurred, the risk should be addressed; where dozens have occurred, mandatory solutions should be applied.
These pressure failures may be thought of as rare or not rare, depending upon your point of view. Presumably, most occur when there are no passengers on the elevator, minimizing the injuries. Some recent cylinder bulkhead failures have settled for amounts in the multi-million dollar range. With this potential for injury and death, it makes sense to take reasonable precautions to minimize the risks. Requiring fluid failure protective devices on direct-acting hydraulic elevators would be a logical next step in eliminating these types of accidents.
Other solutions such as cylinder replacement are not the total answer since fatalities or injuries have occurred when other components have failed. Any number of things can break: a feed pipe, falling fascia, a sheet of plywood a mover drops down into the pit, electrolysis of the feed pipes, full-flow flexible hose bursts or pit valves bursting. Cylinder sides and couplings have failed, underground feed pipes have burst and various types of valves have failed open. It is a list of the all of the pressure system components, and they can happen every day, without regard to age of the equipment.
Additionally, conventional governor and safeties on the elevator will not protect a falling elevator until the governor overspeed is tripped. This leaves dangerously high speeds unguarded and a shearing danger between the falling elevators falling transom and the stationary hall sill. It is because of this that the LifeJacket was designed without a traditional governor. With the reliability of modern electronics, it is possible to monitor all dangerous conditions; not just overspeed situations. Systems developed in the future should also monitor for all conditions and trip accordingly. This feature would also allow unintended car motion protection to be applied to hydraulic elevators as is required of electric elevators in Part 2 of the A17.1-2000 Code.
From the examples given, it is clear that the most important factors to limit are the velocity and reaction time, which will reduce the force impact to acceptably safe levels. The LifeJacket's primary benefit is that it monitors the velocity and responds quickly to the emergency and sets. To do this without damage to the plunger and the ability to retrofit onto existing cylinders makes it a good choice for total protection of direct-acting hydraulic elevator pressure systems.
To further emphasize the value of a device such as the LifeJacket, as of press time, there have been 10 elevators (out of 1,000 installations) equipped with the LifeJacket where the pressure system failed, and the elevators were stopped safely. Since its introduction in November 1997, there have been fatalities and injuries in falling hydraulic elevators. Given the nature of the failures being virtually unpredictable, the retrofit of this type of device is the best solution to eliminating the possibility of uncontrolled falls associated with pressure system failures. It is pleasing to note that a competing device has been designed and patented by a major company. We hope that it has the same success in beta testing as the LifeJacket and will soon reach the marketplace.
© 2006-2017 Elevator Load Test Inc. All rights reserved.