.avif)
Layered Elevator Safety Systems
In the analysis of elevator-related incidents, a central analytical construct is the relationship between the equipment's protective architecture and the mechanical loading an occupant could plausibly experience during an anomalous event. Modern passenger elevators use layered, redundant protection rather than a single "fail-safe" device. Governing codes describe a sequence of independent systems, each intended to intervene if a preceding layer does not hold, and each shaping car kinematics differently (ASME A17.1/CSA B44).
The first layer is the suspension itself. Suspension typically uses multiple wire ropes or belts, and codes require high factors of safety so that loss of one member does not equate to immediate loss of support (ASME A17.1/CSA B44; Khzouz, 2025). The second layer is the machine brake, which holds the car when power is removed or an emergency stop is commanded. Beyond these, the code framework provides an overspeed governor coupled to car safeties and, as a terminal measure, pit buffers. Ascending-car overspeed and unintended-car-movement protection in modern revisions extend the same protective concept to motion in either direction and to movement away from a landing with the doors open (ASME A17.1/CSA B44).
The pivotal point for injury analysis is that layered redundancy means a single component fault rarely produces uncontrolled motion; instead, it typically produces a controlled or semi-controlled stop whose characteristics are determined by whichever layer engages. This distinction governs the deceleration pulse an occupant experiences, and therefore the injury potential of the event.
Overspeed Governors and Car Safeties
An overspeed governor monitors car speed; when trip speed is exceeded, the governor actuates car safeties that grip the guide rails and retard or stop the car. The governor operates independently of the drive machine and control system, remaining functional in scenarios where the primary drive or brake has been compromised (ASME A17.1/CSA B44).
Car safeties—commonly Type A instantaneous or Type B gradual (wedge)—stop a descending car by clamping the rails; Type B designs develop controlled retardation over a slide distance. An instantaneous safety produces a shorter, higher-magnitude deceleration; a gradual safety spreads the same velocity change over a longer slide, lowering peak acceleration at the car floor. The stopping mode of the engaged safety—instantaneous versus gradual—is a primary determinant of the deceleration pulse delivered to standing passengers, and it is among the first parameters a biomechanical evaluation should establish from the equipment record.
Buffers and Energy Absorption
Where safeties address overspeed along the hoistway, buffers address overtravel at the terminal. Pit buffers—spring or polymer energy-accumulation devices, or oil energy-dissipation devices—provide a final energy-absorbing stop if the car or counterweight travels beyond the normal terminal. Oil buffers dissipate kinetic energy as heat during stroke; spring and polymer buffers accumulate energy as strain. Application is speed-dependent: oil buffers or their equivalent are generally required at higher rated speeds (for example, above 200 feet per minute under California Code of Regulations, Title 8, §3031), while spring buffers are associated with lower-speed applications.
Buffers are sized so that striking at about 115% of rated speed yields average retardation not exceeding approximately 1 g (32.2 ft/s²), with peak oil-buffer retardation limits on the order of 2.5 g for durations not exceeding about 1/25 of a second (ASME A17.1/CSA B44; California Code of Regulations, Title 8, §3031). The 115% figure corresponds to a speed at which a governor is expected to have already intervened, so the buffer is designed for a bounded arrival velocity. Buffer stroke grows with rated speed because it relates to the freefall distance needed to reach 115% of rated speed under uniform 1 g deceleration assumptions.
From a biomechanical standpoint, buffers and safeties extend stopping distance and time relative to an unbuffered rigid stop, reducing peak occupant acceleration for a given arrival speed—analogous in principle to crumple-zone design. A buffer does not prevent the car from stopping; it manages how the car stops, distributing the velocity change over a stroke so that average deceleration remains near 1 g rather than the far higher values associated with a rigid impact. The equivalence is conceptual rather than quantitative, but the governing physics of impulse, duration, and peak acceleration are shared.
Biomechanics of Non-Catastrophic Elevator Events
Many reported elevator injuries arise from events other than catastrophic free-fall: unexpected stops, door entrapment or pinch, misleveling (step-up or step-down at the landing), abrupt start or stop, trips and falls entering or exiting, and contact with interior surfaces during a sudden vertical acceleration change. Each event mode has a distinct kinematic signature.
Abrupt stops can produce lower-extremity loading, lumbar compression, and secondary falls inside the cab; door-related events produce crush, pinch, and shear at the extremities; misleveling produces trip-and-fall kinematics similar to curb or step misfires. In overspeed-safety or buffer-engagement scenarios, loading is primarily axial deceleration of standing or seated occupants, with injury potential depending on peak and duration of acceleration, posture, footwear–floor coupling, age, and pre-existing conditions.
Miralbés, Cuartero, and Castejón (2013) used finite-element methods with automotive crash dummies to study emergency buffer crashes, varying dummy location and fall velocity, and evaluating biomechanical indices including HIC, CSI, forces, and accelerations. Their work frames buffer impact as an analyzable crash-pulse problem rather than an all-or-nothing catastrophe. Lee (2013) reinforces that claimed injuries must be evaluated against the kinematics and force histories of the specific malfunction mode. Kim et al. (2023) report that posture and buffering can materially change joint loading during governor or safety-device engagement.
Taken together, these studies support a single organizing principle: injury potential in an elevator event is pulse- and posture-dependent, not simply speed-dependent. Two events with the same arrival speed can produce materially different occupant loading depending on the stopping medium and on how the occupant was positioned when the pulse arrived.
The Free-Fall Myth
Popular culture often depicts elevators as prone to cable-cut free-fall. In code-compliant traction elevators, true uncontrolled free-fall to the pit is exceptionally uncommon because of redundant suspension, governor-triggered safeties, brakes, and buffers (ASME A17.1/CSA B44; Khzouz, 2025). The cinematic image of a severed rope and a plummeting car omits every protective layer described above.
Counterweighting means that total loss of traction or suspension is not equivalent to a simple "cut the rope and drop" thought experiment; direction and acceleration depend on relative car and counterweight mass and on remaining system elements. Even under hypothesized suspension failure, governors and Type B safeties are intended to retard the car, and code frameworks contemplate safety-alone stopping or combined safety-plus-buffer stopping that keeps buffer impact within rated speed (ASME A17.1/CSA B44).
The sensation of "falling then catching" reported by passengers is more often attributable to unexpected direction, rapid leveling, or abrupt brake or safety engagement than to true free-fall. A related popular belief—that jumping just before impact reduces injury—lacks support as a validated mitigation strategy for buffer or safety stops (Khzouz, 2025).
True free-fall is best understood as an exceptional failure mode requiring the simultaneous defeat of multiple independent systems, not as the typical outcome of a single fault. Analytical frameworks that begin from a free-fall assumption will systematically overstate the loading available in the far more common non-catastrophic event.
Interpreting Elevator Injury Potential in Biomechanical Context
Elevator injury analysis parallels other biomechanical frameworks used in collision reconstruction: severity indicators—arrival speed, deceleration pulse, stop duration, and displacement—are informative but not standalone determinants of injury. Just as no single Delta-V value defines injury in a vehicle collision, no single descent speed or stop distance defines injury in an elevator event.
Evaluation should consider event mode (mislevel, door, overspeed safety, buffer, runaway, and related categories); measured or reconstructed kinematics; interior geometry and occupant posture; and human tolerance variability. Establishing the event mode determines which protective layer engaged and therefore which deceleration profile is physically available. Only then can kinematics be reconstructed and resulting loads compared against human tolerance reported in the biomechanical literature (Lee, 2013; Miralbés et al., 2013). The credibility of any elevator injury assessment rests on matching the claimed mechanism to the deceleration pulse and contact geometry that the engaged safety system could actually have produced.
Conclusion
Code-compliant installations are built around independent, redundant protective layers—suspension redundancy, machine brakes, governor-actuated safeties, and energy-absorbing buffers—each of which converts a potential uncontrolled motion into a bounded, analyzable deceleration (ASME A17.1/CSA B44; California Code of Regulations, Title 8, §3031). Layered safety systems make free-fall rare; when anomalous motion occurs, injury potential is governed by the deceleration pulse and contact mechanics, not by media tropes.
The most frequently reported mechanisms—misleveling, door contact, abrupt stops, and secondary falls—are governed by the same determinants that apply across injury biomechanics: pulse magnitude and duration, posture and floor coupling, contact geometry, and human tolerance variability. These factors interact probabilistically rather than deterministically. As emphasized across biomechanical research, the validity of any assessment depends not on abstract assumptions about failure modes, but on the extent to which those assumptions correspond to the kinematics the installed systems could physically have produced.
Works Cited
- ASME. (current edition as applicable). Safety Code for Elevators and Escalators, ASME A17.1/CSA B44. American Society of Mechanical Engineers.
- California Code of Regulations, Title 8, §3031. Car and Counterweight Buffers and Bumpers. State of California.
- Khzouz, Z. (2025). Myths and realities on elevator safety. Elevator World (Europe, March–April 2025). https://elevatorworld.com/article/myths-and-realities-on-elevator-safety/
- Kim, S., et al. (2023). Evaluation of cushioning effect and human injury according to occupant posture and use of air mat in case of elevator fall. Applied Sciences, 13(19), 10607. https://doi.org/10.3390/app131910607
- Lee, W. E. (2013). Forensic engineering analysis of injury biomechanics related to elevator malfunctions. Journal of the National Academy of Forensic Engineers, 30(2). https://doi.org/10.51501/jotnafe.v30i2.793
- Miralbés, R., Cuartero, J., & Castejón, L. (2013). Biomechanical response and behavior of users under emergency buffer crash. Advances in Mechanical Engineering, 2013, Article ID 596340. https://doi.org/10.1155/2013/596340