Elevator Safety Brake: Why a Snapped Cable Doesn't Drop the Car

Why the car never hangs on one cable

A traction elevator is not a box on a single cable. It rides on several independent steel hoist ropes, commonly four to eight, draped over a grooved traction sheave. On the other side hangs a counterweight of roughly the empty car plus 40–50% of the rated load, so the motor only has to move the imbalance.

The ropes are heavily overbuilt. EN 81-20 requires a safety factor of at least 12 for traction lifts with three or more ropes (16 with two), and often more once sheave bends are counted. With five ropes and a factor of 12, each rope alone has a breaking load of at least 12 ÷ 5 = 2.4 times the entire rope load. Losing one rope, or even most of them, still leaves the car hanging.

A car is more likely to overspeed because of a slipping brake, a drive fault or ropes losing grip on a worn sheave, all with every rope intact. So the last line of defence ignores rope tension and watches speed. If the car is descending too fast for any reason, it gets stopped by clamping the steel guide rails bolted to the shaft wall. That load path bypasses the ropes, the sheave and the motor entirely.

The overspeed governor: a speed sensor made of rope and flyweights

At the top of the shaft sits the overspeed governor, a grooved sheave carrying a thin, separate governor rope. The rope runs down to a weighted tension sheave in the pit and back up, and both ends are fixed to the safety lever on the car. As the car moves it drags the loop around, so the sheave spins in exact proportion to car speed.

On the sheave, flyweights held in by a spring feel a centrifugal force F = m r ω², which grows with the square of speed. Take a car rated at 2.0 m/s and a sheave of 300 mm pitch diameter. At rated speed the sheave turns at ω = v/r = 2.0/0.15 ≈ 13.3 rad/s (about 127 rpm). At a 2.5 m/s trip it turns at about 16.7 rad/s (159 rpm). That 25% rise in speed produces (2.5/2.0)² ≈ 1.56 times the outward force, a jump that a preloaded spring can pick out cleanly.

The governor acts in two stages. First, the swinging weights operate an overspeed switch that cuts motor power and drops the machine brake. On lifts rated above 1 m/s it must act before the tripping speed. Most overspeed events end there. If the car keeps accelerating, the weights release a latch: a pawl catches a ratchet and stops the sheave, and the rope is held by groove friction or a spring-loaded jaw. Tripping speed must be at least 115% of rated speed. Once tripped, the governor must grip its rope with at least 300 N, or twice the force needed to engage the safeties, whichever is greater.

Safety gear: wedges that pull themselves tight

Once the governor holds its rope, the rope pins the safety lever while the car keeps dropping, pulling the lever upward relative to the car. A linkage across the car frame lifts the safety gear on both rails together, so neither side grips first and tilts the floor. Each unit is a steel block straddling the machined blade of a T-section guide rail, with a hardened, serrated or lined wedge sitting in a tapered pocket a few millimetres clear of the rail.

As soon as the wedge touches the rail, the gear becomes self-energising. Seen from the falling car, the rail is moving upward, so friction drags the wedge further up its taper and presses it harder against the rail, which creates even more friction. That is how a few hundred newtons of rope pull can command tens of kilonewtons of braking force.

In progressive safety gear, the jaw on the other side of the rail is backed by a calibrated spring, either a U-shaped flat spring or a stack of disc springs. The wedge climbs until it hits a stop, and from then on the spring's deflection fixes the clamping force. Braking force stays roughly constant, and the car slides to a controlled stop over tens of centimetres on a slow lift and several metres on a fast one, scoring the rails as it goes. Instantaneous safety gear has no limiting spring: a wedge or captive roller simply jams and stops the car abruptly, so EN 81-20 permits it only for rated speeds up to 0.63 m/s. Releasing the gear requires moving the car upward, which draws the wedges back out of the taper.

Worked example: stopping a car after every rope parts

Gravity keeps pulling throughout the stop, so to slow a mass m at a rate a, rail friction must supply F = m(g + a). Take a car descending at its rated 2.0 m/s, governor set to trip at 2.5 m/s, when every hoist rope parts at once and the counterweight no longer helps.

• Reaching trip speed. Free fall adds the extra 0.5 m/s in t = 0.5 / 9.81 ≈ 0.05 s, over a distance of (2.5² − 2.0²) / (2 × 9.81) ≈ 0.11 m. Latch and wedge travel add a little more in practice.
• Stopping. At an average 0.6 g (5.89 m/s²), d = v² / 2a = 2.5² / (2 × 5.89) ≈ 0.53 m and t = v / a ≈ 0.42 s.
• Force. For a 1,200 kg car carrying its 1,000 kg rated load, F = 2,200 × (9.81 + 5.89) ≈ 34.5 kN, or about 17.3 kN per rail. Each rail has two friction faces, so with an effective friction coefficient of ~0.2 each rail's spring must supply roughly 17.3 / (2 × 0.2) ≈ 43 kN of clamping force.
• Energy. F × d ≈ 18 kJ becomes heat. That is the car's kinetic energy at 2.5 m/s (≈6.9 kJ) plus the potential energy it loses while sliding (≈11.5 kJ).
• Passengers feel close to weightless for about a twentieth of a second, then 1.6 times their normal weight for under half a second.

Because the spring fixes the force rather than the deceleration, the car's mass matters. The same 34.5 kN acting on the empty 1,200 kg car gives a = F/m − g ≈ 28.8 − 9.8 ≈ 19 m/s², about 1.9 g. That is why EN 81-20 defines its 0.2–1.0 g window with rated load in the car, and why each gear is certified for a specific range of total mass.

Standards, type tests and inspections

Europe uses EN 81-20 (design and installation) and EN 81-50 (calculations and type tests), which replaced EN 81-1 and EN 81-2. North America uses ASME A17.1/CSA B44, which calls instantaneous gear Type A and progressive gear Type B. The key EN 81 requirements are:

• Trip speed: at least 115% of rated speed. For progressive gear on lifts rated above 1 m/s it must also stay below 1.25v + 0.25/v m/s, which is 2.625 m/s for a 2.0 m/s lift, so a 2.5 m/s setting fits.
• Governor rope: a pull of at least 300 N when tripped, or twice the engagement force if that is greater. The rope itself must be at least 6 mm thick with a safety factor of 8, on a sheave at least 30 rope diameters across.
• Deceleration: progressive gear must average 0.2–1.0 g in free fall with rated load. Instantaneous gear is allowed only up to 0.63 m/s rated speed.
• Level floor: after the stop, the car floor, whether empty or evenly loaded, must be within 5% of its normal position.

Each gear design is certified on a test tower. Masses are dropped in free fall over repeated runs while braking force, stopping distance and deceleration are recorded. Certificates are tied to a rail surface condition, since dry and oiled rails grip differently. At handover, the installer trips the governor by hand while the loaded car descends at rated speed or slower. Routine inspections then recheck governor trip speed, rope condition and linkage movement. ASME A17.1 also calls for a no-load safety test every year and a full-load, full-speed test every five years (the Category 1 and Category 5 tests).

From Otis's wagon spring to the Empire State Building

Before Otis, a broken hoist rope could mean a fatal fall. In 1852 Elisha Graves Otis, working at a bedstead factory in Yonkers, New York, fitted a platform with a stiff wagon spring that the hoist rope's tension kept flexed. If the rope went slack, the spring snapped straight and its ends caught in ratchet teeth along the guide rails. At New York's Crystal Palace in 1854 he rode the platform up, had the rope cut and, as the story goes, told the crowd “All safe, gentlemen, all safe.”

Otis's catch could answer only one question, whether the rope had let go, so it could not stop a car running away on an intact rope. Later designs moved the trigger to a centrifugal governor, a descendant of the steam-engine flyball governor, and swapped ratchet teeth for friction jaws that stop a fast car smoothly.

The famous exception shows how much has to go wrong. On 28 July 1945 a B-25 bomber flew into the Empire State Building in fog and damaged elevator ropes. A badly injured elevator operator, Betty Lou Oliver, was put in a car to be taken down. Its weakened ropes gave way and the car fell about 75 storeys. She survived, and the coils of severed rope in the pit and the air squeezed beneath the car are credited with cushioning the landing. It is still cited as the longest survived elevator fall.

Failure modes, look-alikes and myths

It is not the machine brake. The machine brake, spring-applied and electrically released on the motor shaft or traction sheave, holds the car at floors. Under EN 81-20 it must stop a car descending at rated speed with 125% of rated load, and its mechanical parts are duplicated so that either half alone still slows the car. But it acts through the ropes, while the safety gear acts on the rails. The pit buffers are not the backstop either. Oil buffers limit a car arriving at 115% of rated speed to no more than 1 g on average, which handles overtravel, not a fall.

The upward runaway. The counterweight outweighs an empty car, so a failed brake sends a lightly loaded car up, the one direction classic safety gear does not grip. EN 81-1 added ascending-car overspeed protection in 1998. In 2009 it added unintended car movement (UCM) protection, for a car that leaves a floor with its doors open. Solutions include rope brakes, safety gear that grips in both directions, and dual-circuit brakes acting directly on a gearless machine's sheave. In Tokyo in 2006, a car in a Minato-ward housing block rose with its doors open and killed a 16-year-old. Japan made door-open movement protection mandatory for new elevators from 2009.

Maintenance failures. Governors can seize from dirt and corrosion, and wedges can rust into their housings. Governor ropes can stretch until the tension weight bottoms out, and over-lubricated rails can stretch the stop beyond its certified range. Among the deadliest are jumper wires left bypassing the safety circuit: in 2011 one let a car at 285 Madison Avenue in Manhattan move with its doors open, killing a woman.

What a real trip looks like. Far from the Hollywood plunge, the governor trips, the gear sets with a thump, and passengers wait, stuck but safe, until a technician raises the car off its wedges.

The elevator safety brake and the devices it is confused with: what each one grips, what sets it off, and what it is for.

Device	Acts on	Triggered by	What it is for
Progressive safety gear (ASME Type B), the safety brake	Guide rails: self-energising wedges with a spring-limited clamp	Overspeed governor latching its rope at ≥115% of rated speed	Stops a runaway or free-falling car at an average 0.2–1.0 g with rated load
Instantaneous safety gear (ASME Type A)	Guide rails: a wedge or captive roller that simply jams, with no limiting spring	Overspeed governor rope	Same job with an abrupt stop; allowed only for rated speeds ≤0.63 m/s under EN 81-20
Machine brake	Motor shaft or traction sheave	Power cut to its release coil, at every stop or on a fault: spring-applied, electrically released	Holds the car level at floors and stops it in normal and emergency stops, acting through the ropes
Pit buffer (oil or spring)	The car or counterweight striking the pit	Overtravel below the bottom landing	Absorbs an overtravel impact; oil buffers hold a car arriving at 115% of rated speed to ≤1 g average
Rope brake or UCM protection	Hoist ropes, traction sheave or rails, depending on design	Upward overspeed, or the car leaving a floor with its doors open	Covers the cases that downward-acting safety gear cannot
Otis safety catch (1854)	Toothed ratchet rails	Loss of hoist-rope tension releasing a wagon spring	Caught a platform whose rope broke; blind to a runaway on an intact rope