Elevators and Fire

orderly shut down. An emergency stop occurs
when the elevator stops as a result of power being
removed from the hoist machine motor and brake.
In this mode, the car may stop anywhere in the
hoistway. An orderly shut down will allow for a
predetermined elevator stopping sequence which
can permit the elevator car to reach a landing
before shutting down the control.

Elevator controls with solid state motor drives
or power supplies, may have thermal sensing
devices such as thermistors, which monitor the
temperature of power components. When
conditions cause temperature thresholds to be
reached, these monitoring devices are designed
protect the power devices. Depending on design
philosophy, the elevator may be brought to an
orderly shut down. If the car is in motion and
conditions permit, the car may be brought to a
stop at the next available landing and open its
doors prior to shutting down. Designers may set
the monitoring devices to trip at temperatures
between Tyso and Typo [0 protect the passengers
from an abrupt emergency stop which might
otherwise occur if the equipment was allowed to
operate beyond Typo. This type of response
mode could also be designed to allow the system to
automatically return to normal operation once the
temperature fell back below the threshold value.

With no temperature monitors to prevent the
control from operating above Tpyo; Other types of
circuits could disrupt elevator operation as
temperature rises above Tpyo- One type could be
considered performance monitoring circuits. In
this case, devices which monitor performance, ¢.g.,
velocity, position accuracy, acceleration, etc., can
cause the elevator to stop if it runs outside
acceptable performance limits. Dead man timers,
which monitor the health of micro processors, will
trip when the processor begins to fail.

A second type of circuit may be considered
component protection monitoring circuits. In
higher operating temperatures, current demanded
from power supplies tends to increase for the same
given load condition. Over current protection
devices protect components from damaging high
currents and would also be the source of elevator
shut down,

Performance or component protection
monitoring circuits would normally cause an
emergency stop of the elevator. They could be
designed reset automatically if conditions permitted
or may require manual reset by a service
technician. Fuses, which are over current
protection devices, usually require manual reset.

41

ASME A17.1 CODE REQUIREMENTS

As we can see in Table 1, ASME A17.1 code
requirements address only some of the causes of
elevator control responses in categories 3 and 4.
They are explained as follows;

Rule 209.2b, Emergency Terminal Stopping
Device (rule 209) requires an emergency stop if the
system is not in proper control of the elevator in
the terminals areas due to performance
degradation or failure (category 3).

Rule 210.2d Motor Field Sensing Means,
requires the elevator to make an emergency stop if
the motor field sensor does not detect motor field
current (category 3 if the motor field power supply
tripped on over temperature, category 4 if the
supply failed.) In static control (solid state), the
tule permits the use of over speed monitoring
(category 3) in lieu of motor field monitoring.

Rule 210.9 Control And Operating Circuits,
requires the elevator to shut down if a failure
(category 4) rendered any of the electrical
protective devices in 210.2 to become ineffective or
would allow the car to run with the car or hoistway
door contacts open.

None of these A17 rules, prescribe manual or
automatic restart of the system once the fault has
cleared. This alternative is left up to the
manufacturer.

V CONCLUSION
Analysis on the Effect on Fire Fighter Services

ASME A17.1 rules in section 211.3, Fire
Fighters’ Service, Automatic Elevators, do not
address the possible response modes of an elevator
system to elevating temperatures. Certainly, only a
few of the possible causes of category 3 or category
4 response modes are addressed by the code. This
would mean that even with the elevator in
Firefighters’ Service, the response of the elevator
system to temperatures above Tyysq is, for the
most part, left up to the discretion of the
manufacturer. Today, firemen can not depend
upon consistent elevator control response to rising
machine room temperatures from one
manufacturer to the next or even from one product
to the next.

With machine room ambient temperature
specified at 90 deg F, unexpected elevator
shutdowns or service disruptions are possible as



Elevators and Fire

OUTSIDE
| AMBIENT

TEMPERA-
TURE

T, =T,, + Ty + T, + T;

= Component temperature
Design safety margin
T,, = Machine room Ambient temperature

T, = Temperature rise into controller
T, = Temperature rise into assembly

FIG. 2

Figure 2 provides an elevator machine room
illustration of this consideration. The temperature
rise inside of the control enclosure is a function of
the total power dissipation inside the enclosure
and the ability of the design to transfer heat to the
external air at a given altitude. Heat sinks, fans,
and cooling vents are some the techniques used by
designers to minimize this temperature rise.
However, cost and size constraints will limit the
designers ability to achieve ideally no temperature
rise between the machine room ambient air
temperature and the device temperature in the
control enclosure.

As an example, consider an elevator control
made up of industrial grade components rated at
85 °C. Taking a 40% thermal derating for worst
case design power dissipation, the components are
now limited to 51 deg, C maximum operating
temperature. Adding 5 °C for thermal safety
margin and given 32 °C (90 °F) as the maximum
machine room ambient temperature, the designer

must provide a thermal transfer design which will
allow no more than a 14 °C temperature rise from
external ambient to the devices in the enclosure.
In this case , Tysgq Would be 32 °C (90 °F), Tupo
would be 37 °C (99 °F), Typo is 71 °C (160 °F)
maximum.

In summary, the designer must negotiate
between the maximum specified operating
temperature, performance/reliability requirements
and the cost constraints of the elevator control.

SYSTEM RESPONSE TO
ELEVATING TEMPERATURE

Having defined temperature thresholds, I will
now examine possible system response modes
which may result from the elevator control being
exposed to rising temperatures. There are two
basic system response modes: emergency stop and



42

Elevators and Fire

A17.1 Requirement
Over temperature Emergency stop or 3 None
devices orderly shutdown
Performance Emergency stop 3 Rule 209.2b
monitors Terminal overspeed
Component protection | Emergency stop 3 Rule 210.2d
monitors Lost Motor field

Device failure

Emergency stop

the temperature rises above this value. A fire
below a machine room could easily cause machine
room temperatures to exceed Typo, especially if
the machine room cooling system shuts down or is
inadequate to handle additional heat brought to
the machine room from a fire below. Consider a
fire test conducted outside a 10th floor building
stairwell. The temperature at the 10th floor
stairwell reached 150 deg F in 15 minutes and 240
deg F in 30 minutes. The temperature on the 14th
floor stairwell reached 125 deg F and 150 deg F
respectively®,

One could expect similar results if a machine
room were at the 14th level and the fire was
outside the elevator shaft at the 10th level below.
Due to the up draft in an elevator shaft, the
machine room temperature could rise
correspondingly. Using my previous example for
calculating temperature thresholds (1), we can see
that a Tpyyo Of 99 °F could easily be exceeded and
a Tyo Can easily be approached in this case.

Recommendations

Today’s complex elevator control can be better
utilized to provide safer firefighters’ service for the
fireman. Several steps can be taken to make the
elevator system more predictable and consistent in
their response to rising machine room
temperatures which may be created from a building
fire. Steps can also be taken to provide fireman
additional operating temperature margin in case
the need arises.

ASME A17.1 rules in section 209, Terminal
Stopping Devices, and 210.2, Electrical Protective

Rule 210.9
Ineffective protection

Devices, could be modified to specify when and
how the elevator system will try to automatically
reset. This could handle most of the response
modes between Typo and Tyo since in most
cases the response is an emergency stop. Perhaps
one possibility would be to give the fireman an
easy means to reset the system if an automatic
reset is not provided.

Other possible code modifications could be
written into A17.1 rules in section 210.9, Control
And Operating Circuits, to govern the elevators
response to temperatures between Tyco and
Tapo- Under firefighters’ service, the code could
allow the fireman to bypass manufactures
performance or thermal protection devices which
may have caused the elevator to stop during use.
Perhaps the elevator system could also be switched
by the fireman to a derated level of performance
which would allow the system to attempt to
operate in higher machine room temperatures.

Since thermal protection monitoring is not a
code requirement, it is possible for some elevator
systems to suffer catastrophic failure with no
forewarning. For this reason it is also
recommended that the code require thermal
monitoring by the elevator system. The thermal
monitoring system should as a minimum, prevent
the system from going beyond Typ while
operating. It would also be desirable that the
elevator control system monitor for potential
thermal failure and communicate this information
to the fireman.

Ai7.1 ruies in section 211.3, Fire Fighters
Service, Automatic Elevators would also need to
be modified to address such modifications.



Elevators and Fire

37

HIGH TEMPERATURE OPERATION OF ELEVATORS

by Vincent P. Robibero

ABSTRACT

Solid state elevator controls are complex
systems which meet the demand for efficient
vertical traffic flow in modern high rise buildings.
They are also considered an essential tool for high
rise building fire operations. Exposure to rising
machine room temperatures pose special problems
for the control equipment and the users of
elevators during a fire. To date, there is little in
the way of codes or regulations which will make
these systems react in a consistent manner during
exposure to elevated temperatures. The response
of the elevator control is, for the most part left, up
to the manufacturers. An understanding of how
solid state controls are temperature rated and
what problems they may present to the fire fighter
when in use, will help in the development of new
code requirements which the fireman can rely
upon. The advanced technology used in solid state
controls provides plenty of opportunity to help the
fire fighter maintain control of her situation while
using an elevator for fire operations.

INTRODUCTION

Elevator systems are commonly used as an
important tool for fighting fires in high rise
buildings. O'Hagan points out that *...reliable
elevator service is a necessity for effective fire
fighting and rescue operations in high rise
buildings". However, he also points out that
"Elevators have probably contributed to more loss
of life in high rise fires in the United States than
any other component or building system."?

Since an elevator system is vertically located
the entire length of a building, its components are
extremely vulnerable to the hazards of fire. Many
elevator system components have malfunctioned
due to the heat generated from building fires.
Electric hoistway door contacts and hall call
buttons are just two examples.

This paper will address the possible effects of
building fire heat on modern solid state elevator
controls. This equipment is typically located in a
machine room over the elevator shaft and may be
exposed to increasing temperatures generated from
fires below. The malfunction of the elevator
control system is an important consideration which
the fire fighter must take into account when
selecting an elevator for fireman service.

I will explain what the elevator designer must
consider when specifying an acceptable operating
temperature for their control equipment. The
possible effect on the solid state elevator controls
tesulting from temperature rising above the
designers specification will also be discussed. The
possible system effects which may be experienced
by the user of an elevator control exposed to the
rising temperatures will then be explored.

Finally, I will present ASME/ANSI A17.1
elevator codes which require a specific elevator
response as a result of malfunctions which may be
caused by rising machine room temperatures.

Final analysis and recommendations for
improvement are provided in the conclusion of this
paper.

In this paper, the term semiconductor refers to
all solid state devices such as micro electronics and
power semiconductors.

TEMPERATURE THRESHOLDS

When establishing a specified maximum
allowable operating ambient temperature for their
control equipment, the manufacturers designer will
work to incorporate the following with cost and
performance objectives:

(1) The grade of the individual devices used in
the design. This establishes device temperature
limits.

(2) The design of electrical power stress on the
devices.


Elevators and Fire

Another area which may be addressed is the
temperature rise ratings for machine rooms
exposed to heat rising up the elevator shaft from a
fire below. Such ratings could prolong the service
of elevators during a fire.

Since operating temperature can be critical to
firefighters’ service, (in particular for high rise
elevator systems where the elevator is essential),
standards should be established which provide for
minimum operating temperatures for the various
response categories described in this paper. A
study will need to be conducted to establish
acceptable temperature thresholds and the impact
on cost for the elevator system.

NOTES

1 O’Hagan, J. T., 1977, High Rise/Fire and Life
Safety, Dun Donnelley Publishing
Corporation, New York, N.Y., pg. 137.

2 O’Hagan, J. T., 1977, High Rise/Fire and Life
Safety, Dun Donnelley Publishing
Corporation, New York, N.Y., pg. 219.

3 IC MASTER, 1989, Hearst Business
Communications, Inc., Garden City, N.Y., pg.
3414.

4 Coit, D. W. and Priore, M. G., July 1988,
Reliability Prediction Models For Discrete
Semiconductor Devices, Technical Report
RDAC-TR-88-97, Rome Air Development
Center, Griffiss Air Force Base, NY, pp. 4-8 to
4-24,

43

5 ASME/ANSI A17.1b—1989, Safety Code For
Elevators and Escalators, pp. 75-84.1 .

6 O'Hagan, J. T., 1977, High Rise/Fire and Life
Safety, Dun Donnelley Publishing
Corporation, New York, N.Y., Chapter 2, test
4.

ADDITIONAL REFERENCES

1 Anderson, R. T., March 1976, Reliability Design
Handbook, ITT Research Institute, Chicago, Il.,
Catalog No. RDH-376.

2 Craney, P. M., March 1983, "Electromechanical
vs. Solid-State Relays", Electronic Products.

3 MIL-STD-217B, Reliability Prediction of
Electronic Equipment, September 1974.

Vince Robibero is the manager of Drives
Development Engineering at Schindler Elevator
Corporation in Morristown NJ. A member of the
ASME A17 Main Committee and the Electrical
Sub-committee, he is an electrical engineering
graduate from Manhattan College (1977) in
Riverdale NY and received his MBA from
Montclair State College (1988) in NJ. He has
over 10 years experience in the elevator industry.



Elevators and Fire

CATEGORY 4: CATASTROPHIC FAILURE

MRO
Fd CATEGORY 3:
4 MALFUNCTION
et
wv MDO
i CATEGORY 2:

DEGRADED
PERFORMANCE
& RELIABILITY

MSO

CATEGORY 1: NO EFFECT

>

SYSTEM OPERATION SEVERITY EFFECT

FIG. 1

(3) The design of the thermal transfer of heat
from the devices, assemblies, and enclosure to the
outside ambient.

(4) Design and reliability safety margins.

To discuss the possible response modes of the
elevator control system to rising machine room
temperatures, it is helpful to categorize maximum
ambient operating temperature thresholds. The
temperature thresholds are considered to be the
ambient air temperature of the machine room
surrounding the equipment enclosure, vents, heat
sinks, etc. With each threshold, I am defining a
level of degradation the control will suffer as a
result of being exposed to temperatures within the
thresholds.

Figure 1 provides a presentation on the
relationship between the critical temperature
thresholds and the response categories.

They are defined as follows:

Category 1: No Effect.

Temperature threshold: maximum specified
operating temperature (Tyg). This is the
elevator equipment manufacturers specified
maximum temperature in which the equipment can
operate while assuring no degradation in the

manufactures reliability and performance
specifications. It normally includes the
manufactures design and reliability safety margins.

Category 2: Degraded Performance/Reliability

Temperature threshold: maximum design
operating temperature (Typo). This is the
maximum temperature in which the equipment can
operate, without design or reliability safety
margins. Degraded performance and long term
reliability may result when operating between
Taso 20d Typo. The performance degradation is
limited to degraded ride quality. Once the
equipment temperature returns to Tyso,
performance returns to normal.

Category 3: Performance Malfunction
(Recoverable)

Temperature threshold: maximum recoverable
operating temperature (Typo). This is the
maximum temperature in which the equipment can
operate under reduced load conditions. The
equipment will most likely malfunction as load is
increased. Once the equipment is allowed to cool,



Elevators and Fire

it will function again, although the system may not
automatically resume service without the aid of a
service mechanic.

Category 4: Catastrophic failure

Operation above Typo, will result in
non-recoverabte failure of the system.

DESIGN

Elevator controls have come a long way from
utilizing electro-mechanical devices for the control,
signaling and drive functions of the elevator
system. Today, solid state devices and
micro-processor circuitry, similar to that which is
found in modern computers, are used to perform
these functions. Although solid state controls may
be more sensitive to elevating temperatures than
older electro-mechanical controls, they permit
more complex functions and efficient control of the
elevator, along with improved performance and
reliability, than that which can be achieved with
electro-mechanical control systems.

In order to meet acceptable cost and reliability
requirements, the designer of solid state elevator
controls must make use of devices and equipment
cooling design necessary for elevator operation in
normal machine room ambient temperature. This
temperature is established between the customer
and industry. Today, machine room ambient
temperatures are typically rated at 32.2 °C (90 °F).

Solid state chips for example, may be acquired
in commercial, industrial or military grades.
Typically, commercial grade solid state chips have
maximum ambient operating temperature ratings
of 70 °C (158 °F), industrial devices are typically
rated at 85 °C (185 °F) maximum and most
military grade devices are rated at 125 °C (257 °F)
maximum operating temperature? If the maximum
allowable operating temperature of a device is
exceeded, the performance characteristics of the
device can no longer be assured. Normally, higher
temperature rated devices are more expensive then
lower temperature rated devices.

When the operating temperature rises above
the maximum allowable, solid state devices will
begin to go out of design tolerance and will not
properly operate together in the design circuit.
This will most likely lead to an elevator control
malfunction. If the temperature of a solid state
device rises sufficiently, it will go into a condition

39

known as thermal runaway and fail catastrophically.

Solid state devices must be derated to lower
than maximum rated operating temperatures.
There are two reasons for this, (1) power
dissipation capability and (2) reliability.

Performance specifications for solid state
devices operating in an ambient above 25 °C (77
°F), normally require a trade off between the
maximum power demanded from the device and its
maximum operating temperature. In most devices,
such as micro processors, power demand increases
with increased operating speed (switching losses)
and/or increased current demand (conduction
losses). The designer must either sacrifice the
devices available power dissipation for higher
operating temperatures or vice versa.

A similar trade off must also be made between
the long term reliability of the device and the
operating temperature. Models for the predicted
reliability of electronic components is provided in
MIL-STD-217.4 Semiconductor failure rates are
modeled as a function of the semiconductor
junction rating, operating temperature and power
dissipation (electrical stress). At a given junction
temperature, when operating temperature or power
dissipation is increased, the predicted failure rate
of the device also increases.

The mean time between failure (MTBF) is a
measure of the predicted reliability of the elevator
control and is equal to: 1/sum of the individual
failure rates of all the control devices. An increase
in device failure rates will result in a lower MTBF
(reliability) for the control system.

Designers will most likely add a thermal safety
margin to establish to Tyg9-This may be
represented by an additional temperature rise from
the enclosure to all devices in it. We can call it
Typ The purpose of this safety margin is to
provide an acceptable confidence level in the
specified performance and reliability of the system.
It is used to minimize the risk of statistical
variability of the component thermal characteristics
on system performance.

Because the cooling design of the system
effects the temperature rise from machine room
ambient to the device ambient, the ambient
temperature of a device ( T,,) can be expressed as:

Tan = Tr + To tT + Tz + +Tp

where

T,, is the room ambient temperature,

T,z is the design thermal safety factor,

T,, Tz, and T,, are the temperature rises from
the machine room ambient to the device.