Escalator Brake Failure Investigation

Introduction

Most everyone has heard the saying, “Accidents don’t ‘just happen’. They are caused by the actions or inactions of one or more people.” I know I heard that saying many times in nearly every safety meeting that I attended in my career. But I have found the statement to be true from experience investigating escalator accident.

The following is a brief synopsis of a case where I was an expert witness, and which demonstrates that “accidents don’t just happen.” The case pertains to a down running escalator carrying a load of passengers. On one particular day, the escalator suddenly sped up to the point where many passengers could not exit the escalator without falling down.

Fortunately, the injuries were few and minor. I would call this incident a “near miss.” The escalator overspeed condition could have resulted in severe damage to the escalator and severe injury to the passengers. Consequently, a careful investigation of this incident needed to be completed to determine what went wrong so that steps could be taken to make sure there was no next time.

Information Provided

When initially contacted by an attorney representing the manufacturer of the escalator I was informed generally about the incident and about various theories regarding the cause of the incident. After some discussion with the attorney we agreed, that since I was as a designer of escalator control systems and escalator braking control systems during the time period the escalator was manufactured, I should review the case information and make a site visit to perform an inspection of escalator.

The attorney then provided to me information including but not limited to the following:

• A video of the incident.
• Depositions
• Make, model, and location of the escalator involved in the incident.

Information Reviewed

Normally I begin my investigations with procuring and reviewing manufacturing documentation, including but not limited to: Wiring diagrams, controller information, brake control type, brake type, motor data, safety devices, general mechanical details, and more. But, since a video of the incident was provided I decided to watch the video first.

I watched and rewatched the video numerous times while starting and stopping the video repeatedly. I even watched the video frame by frame to see what I could learn about the starting, the duration and the conclusion of the incident.

From the video I learned:

• A down running escalator operating at a normal rated speed, the same speed as the adjacent up running escalator, quickly sped up to what appeared to be more than twice rated speed. The video did not reveal why the escalator sped up. But the video did reveal loading was not the cause of the overspeed.


• The escalator was loaded with a significant number of passengers but not loaded to anything approaching code load. How could I tell that? The rise of the escalator was tall but there was an empty step or two between many of the passengers and generally there was no more than one person on an occupied step. In fact, there were several steps with no passengers between groups of passengers. At first glance at the escalator, one might think that the escalator was heavily loaded if the one looking at the escalator was unaware of code load requirements or the design load of the escalator. But I know the code load requirements and I knew the minimum design load of this escalator so I could definitely rule out the escalator was overloaded. So, overloading was not the cause of the escalator overspeed.


• After the down running escalator sped up, it continued moving in the down direction until all of the passengers, except 3 or 4, exited at the lower end of the escalator. From the time the escalator began to speed up until the escalator stopped, about 20 seconds had elapsed. The escalator coasted to a gentle gradual stop. It appeared to me as though the escalator had no brakes or if it had brakes, they did not engage.

Next I procured and reviewed the manufacturing documentation which included the wiring diagrams, controller information, safety devices, general mechanical details, and more.

From the manufacturing documentation I learned:

• The escalator controller was a microprocessor based controller with many safety features including closed loop brake control, overspeed detection, stopping distance too long detection, and more. Additionally, this controller maintained fault and event logs which could be accessed via a pc or a handheld service tool.


• The brake control was a CSA certified closed loop control which varied braking torque while stopping the escalator to maintain a set deceleration rate.


• There were two CSA certified magnetic brakes which were self-adjusting brakes with an “auto gap” feature. The brakes did not require adjusting in the sense of adjusting torque. The brakes only needed to be set up properly. The brake gap (the distance between the armature plate and the brake stator when the brake is in the open position) is determined by the “auto gap” feature and not by some manual adjustment. To set the brake gap to the correct measurement all that needed to be done was:
• Electrically open a brake
• Manually pull the brake armature plate and retaining hardware out passed the setting of the “auto gap” mechanism.
• Manually push the brake armature plate closed. When manually pushing the brake armature plate closed, the “auto gap” feature then sets the brake gap to the proper measurement. After proper installation, the brake did not require adjusting or re-adjusting.


• The manufacturer of the escalator provided:
• A document detailing how to properly set up the brakes.
• A document detailing how to inspect and maintain the brakes and when to replace the brakes. (I wrote this document.)


• From the Inspection and Maintenance Procedure, that I wrote, a brake needs to be replaced, not readjusted, if any of the following are true:
• The measured static torque of the brake does not meet and cannot be made to meet the minimum value as stated in the document.
• If the static brake torque measurement is low, the brake may be burnished to clean the braking surfaces. If after burnishing the brake the static brake torque is within spec the brake does not need replaced because of low static torque.
• The brake is worn to the wear indicator.
• The wear sensor, if equipped, indicates 90% brake wear.
• The brake wear material is contaminated with oil or other friction reducing agent.
• The brake gap, after proper setup, will not automatically maintain the required gap measurement.
• The brake coil is open or shorted.
• The brake armature plate wobbles or rattles while rotating at speed.
• The brake cannot be made to open cleanly.
• The brake does not have the proper Montgomery or KONE part number.
• The serial number stamped on the armature plate does not match the serial number stamped on the stator. (My note: The stator and the armature plate are a matched set from the brake manufacturer.)


• There were two three phase squirrel cage asynchronous induction motors which maintain a constant speed.
• My Note: The running rpm of a three phase asynchronous squirrel cage induction motor is determined by the frequency of the voltage applied to the motor terminals and not by the voltage level applied to the motor terminals.


• One large soft starter, with an energy saving feature, was supplied to start the escalator gently.
• My note: The energy saving feature reduces the voltage to the motor terminals when the motor is lightly loaded. This feature should be switched OFF for escalator and power walk use. From my own testing in the lab, this feature does not save energy on an escalator. Lowering the voltage on the motor terminals reduces the motor torque. The reason this feature does not save energy is a subject for another discussion.

Next I reviewed the depositions that had been taken and provided to me.

From the depositions I learned:

• Maintenance records indicated that within a week before the incident, several overspeed faults had been generated by the escalator controller. After each overspeed event, the escalator was put back into service without performing any corrective actions because “it wasn’t clear” what caused the escalator controller to generate an overspeed fault and because an overspeed could not be reproduced. (My note: The Overspeed/Stop Distance Too Long faults were being generated when the escalator was switched off at the end of the day. The Overspeed/Stop Distance Too Long faults were being generated because the escalator was stopping long.)


• After the incident occurred an escalator mechanic inspected the escalator and determined that the left brake failed the torque test, but the cause of the overspeed was not determined. The torque value that the mechanic reported was still more than 90% of the minimum required torque measurement. (My note: Even though the brake should have been replaced, 90% torque on one brake was still sufficient to stop the escalator if the 2nd brake passed the torque test.)


• The mechanic seemed to not know how the escalator controller operated or at what point the controller, if ever, would shut the escalator off due to an overspeed condition.


• The mechanic seemed unaware that the braking system was a closed loop controlled system that varied the braking torque during a stop sequence to maintain a predetermined deceleration rate. They assumed that the brake functioned like many other escalator brakes in that the brake simply applies full brake torque on every stop.


• After the incident, the mechanic tested the brakes by starting and stopping the escalator. He noticed that both brakes engaged, and that the escalator stopped normally.


• The mechanic did not check the “brake gap.”


• The mechanic did not notice any delay in the application of the brakes.


• The actual cause of the overspeed was not known but some believed that the soft starter had failed in some way to cause the overspeed condition. Consequently before putting the escalator back in service the decision was made to remove the soft starter from the escalator control system. (My note: There was no evidence that the soft starter had failed. Regardless, the soft starter was removed, and the escalator was put back into service without knowing what had caused the overspeed condition.)


• The maintenance records indicated that the brakes had been rebuilt. (My note: These brakes cannot be rebuilt but are to be replaced.)


• The mechanic said that the “pick was adjusted.” (My note: There is no such thing as a “pick” adjustment with the brakes on this escalator. Perhaps he meant “brake gap”? Regardless, the gap is not adjustable.)


• A former employee of the escalator manufacturer, acting as an expert witness, stated that he was able to generate an overspeed condition on the escalator with no one on the escalator. He said he observed the brakes delayed in setting when the escalator was stopped (using a stop switch.) He said that the overspeed fault was generated because the brakes delayed in setting or engaging. (My note: This particular controller will generate an overspeed fault if the escalator overspeeds by 10% or if the stop distance is too long.)

Next I created a check list for my onsite inspection.

Abridged check list for Onsite Inspection:

• Record Escalator controller service tool logs around the date of the incident.
• Take pictures of the service tool screens.
• Check service tool encoder frequency parameter setting and compare to the actual encoder frequency.
• Review all service tool parameter settings.
• Start and stop the escalator several times and record the stop distances recorded by the escalator controller.
• Check Brake Software part number and date.
• Check brakes.
• Brake #1 gap measurement.
• Brake #2 gap measurement
• Brake #1 torque measurement.
• Brake #2 torque measurement.
• Take pictures.
• Inspect the brake that had been removed from the escalator.
• Inspect the Nordic Soft starter that had been removed from the escalator control system.
• Take pictures of soft starter.
• Take pictures of soft starter potentiometers.
• Take pictures of soft starter wiring.
• Wire soft starter back into escalator control system.
• Test soft starter by starting and stopping escalator with the soft starter wired into the escalator control system. Repeat several times.
• Test overspeed detection.
• While escalator is running, use the service tool to change the encoder frequency parameter to be 90% of actual real time encoder frequency.
• Take pictures of the controller and record the software revision.

Next I made a site visit and performed an inspection of escalator.

What I learned from the Site Inspection:

• The escalator controller service tool fault log had numerous overspeed fault entries with date and time stamps days before the date of the incident.
• Service tool encoder frequency parameter was set correctly.
• All other service tool parameter settings were set correctly.
• The escalator started and stopped correctly. Stop distances were where they were to be.
• Brake Software part number and date were correct.
• Brake Check:
• Brake #1 gap measurement was too wide and would delay setting when stopping the escalator.
• Brake #2 gap measurement was too small, and the brake would not open cleanly.
• Brake #1 torque measurement was within spec.
• Brake #2 torque measurement was way under torque.
• Both of the brakes needed to be replaced.
• My note: The escalator if loaded, would over speed again if a safety device tripped while running in the down direction. The escalator was currently in service.
• The Nordic Soft starter was wired back into the control system.
• The soft starter did not appear to be burned or damaged.
• The soft starter potentiometers were set correctly.
• The soft starter wiring was such that the soft starter was bypassed.
• My note: At the time of the incident, if the soft starter was wired as I found it, then it was not possible for the soft starter to have play a role in the escalator overspeed.
• The soft starter functioned properly when wired per print. The soft starter was not defective.
• The overspeed detection function worked properly.
• The controller was the correct controller, and the loaded software was the correct part number and revision.

What my investigation led me to conclude about what did not cause the escalator overspeed condition:

• Too much weight on the escalator was not the cause of the escalator overspeed condition. The escalator was not overloaded.
• The passenger load on the escalator was well within the design load of the escalator.
• From R&D lab motor testing that I have done over the years, I know that three phase squirrel cage induction motors, like the ones utilized in this escalator, can produce significantly more than the rated torque before the motor can no longer hold the load.
• Before the load on an escalator would cause the motor to “runaway” the motor current would be sufficiently large enough to trip the motor overload relays or trip a circuit breaker.
• As long as the correct voltage is being applied to the motor terminals the motor will maintain speed.


• The Nordic soft starter was not the cause of the escalator overspeed condition.
• The Nordic soft starter was not damaged or burned out. The Nordic soft starter functioned perfectly fine.
• The potentiometers on the soft starter were set correctly and such that the energy saving feature was switched off. If the energy saving feature had been switched on and if the soft starter had not been bypassed then the escalator would have sped EVERY time the escalator was loaded as shown in the provided security video of the incident.
• The Nordic soft starter was wired with the input wires and the output wires connected directly to the output terminals effectively bypassing the soft starter. At the time of the incident, the soft starter was bypassed – that is if the wiring had not been modified sometime after the incident and before I made my inspection. One of the mechanics testified that the wiring had not been “fiddled with.”


• The escalator controller failing to command the brakes to engage was not the cause of the overspeed condition.
• The over speed detection of the escalator operated properly and initiated a stop when the speed of the escalator exceeded the rated speed by 10%.
• The escalator service tool parameters were set correctly.
• The brake controller worked fine.


• The cause of the escalator overspeed was never rectified even though the condition was present weeks before the incident and after the escalator was put pack into service.
• Maintenance records indicated that days before the incident at least 7 Overspeed/Stop Distance Too Long faults had occurred and had been reset. Each time the fault was reset the escalator was put back into service without correcting the root cause of the fault.
• Maintenance records showed that the brakes were rebuilt. Which cannot be done.
• Maintenance records showed that the brakes were adjusted. Which cannot be done.
• Maintenance records showed that the “Pick” was adjusted. Which cannot be done.
• Maintenance records show that the escalator was started and stopped, and all seemed ok.
• The service tool also indicated a number over speed faults listed in the memory of the escalator controller around the time of the incident.

What my investigation led me to conclude about what did cause the escalator overspeed condition:

• At least one safety device tripped causing power to be removed from the driving machine motors.
• With power removed from the driving machine motors, the motors no longer produced torque to keep the escalator from over speeding.
• The tripped safety device also caused the brake controller to remove power from the driving machine brakes.
• The driving machine brakes either did not engage or had insufficient torque to hold back ANY load. The escalator coasted to a stop.
• Since only one brake was tested to be a little under torque, I had to conclude that the brakes did not engage. This was confirmed by the fact that the escalator coasted to a stop.
• One expert witness said when he tested the brakes he saw the brakes delay setting.
• The Overspeed/Stop Distance Too Long faults recorded days before the incident were generated because the escalator was stopping too long. The escalator was stopping too long because the brakes were delaying each time the escalator was switched off.
• The reason the brakes delayed setting is because at the time the brakes needed to apply the brake gap was too wide for the magnet to pull the armature plate into the braking surface of the stator. If the brake gap is too wide the brakes will either delay setting or not set at all.
• I have observed this phenomena before on more than one escalator with worn out brakes. I have seen worn out brakes set only after the escalator had coasted to a stop.

Conclusion:

As I stated in the Introduction, “Accidents don’t ‘just happen’. They are caused by the actions or inactions of one or more people.” In this case, the incident was caused by the inaction of the maintenance personnel. Mechanics maintaining the escalator did not:

• Know what caused the over speed.
• Understand how the escalator controller and brakes functioned.
• Know how to maintain the brakes properly.
• Seem to have knowledge of the manufacturers document detailing how to properly set up the brakes.
• Seem to have knowledge of the manufacturers document detailing how to inspect and maintain the brakes and when to replace the brakes.

If the mechanics maintaining the escalator had followed the instructions in the two documents provided by the escalator manufacturer, the mechanics would have known how to set up and maintain the brakes. Consequently, they would have replaced both brakes and set them up properly and the overspeed condition would have never happened.

I have worked with many escalator mechanics in the field and almost without exception, they are proud of the work that they do. I am confident that in this case, the mechanics did their level best to prevent the escalator overspeed condition. However, they were unable to prevent the overspeed condition because they were not trained in the operation and maintenance of this control system and brakes.

Summary:

The escalator over sped because the brakes did not engage when a safety device tripped. The brakes did not engage because the brake gap was too wide.
The brake gap was too wide because the escalator brakes were worn out.
The mechanic repeatedly and unknowingly put the escalator back into service with worn out brakes.
The mechanic did not know the brakes were worn out because he was not trained properly.

Anthony S. Boom, is an Electrical Engineer and Escalator Controls Expert Witness with over 35 years in the escalator business. Currently providing expert witness services though Cetek, Inc., he spent the last three decades working as an Electrical Engineer with Montgomery Escalator and KONE R&D, escalator division. Mr. Boom offers expert witness services to attorneys representing plaintiff and defense. Services include expert witness testimony, written or oral affidavits, site inspections, technical investigations, technical review documentation, etc. 

©Copyright - All Rights Reserved

DO NOT REPRODUCE WITHOUT WRITTEN PERMISSION BY AUTHOR.