Intelligent Braking Systems for Public Service Escalators
Dr. Lutfi Al-Sharif
The University of Jordan
Proceedings of the 1st International Conference for Building Electrical Technology Professional Network (BETNET), BETNET 2004, 11th to 13th October 2004, Hong Kong, China. This web version © Peters Research Ltd 2016
Key Words: Escalator, braking system, FMEA, intelligent braking, passenger falls, jerk, acceleration, risk assessment, public service escalator.
Public Service Escalators are characterised by carrying large numbers of passengers and as acting as part of the main route within railways and terminal stations. High safety factors are used in sizing their braking system to prevent the risk of runaway situations. This presents the hazard of passenger falls or even avalanche passenger falls when spurious stops take place. It is estimated that 2.5% of all escalator stops lead to passenger falls.
Closed loop feedback braking systems can control the value of acceleration and jerk as well as the stopping distance. This paper discusses the design, implementation and testing of an intelligent braking system on a Public Service Escalator. It outlines the aspects of the hardware and software FMEA (failure modes and effects analysis), the use of appropriate feedback devices, control algorithms and braking system hardware. Results are discussed that illustrate the success of the system in reducing stopping variations caused by changes in load.
The paper concludes by showing test results that correlate the stopping characteristics of an escalator with the probability of passenger falls. Based on those results it proposes the optimum stopping curve characteristics to minimise passenger falls and meet requirements laid down by standards.
Public services escalators are used in railway and metro stations and transport terminals in general. They carry large numbers of passengers and form a critical part of the main route within the transport terminal that they serve . For these reasons, public service escalators demand exceptionally high levels of reliability, availability and safety. The braking system of these escalators is the last and most important line of defense.
The majority of public service escalators have two brakes: An operational brake that acts on the high speed shaft, and an auxiliary brake that acts on the low speed shaft.
These two brakes would apply during any stoppage of the escalator, although in some cases an intentional delay is applied to the auxiliary brake.
A braking system has to achieve two conflicting requirements: Stopping the escalator within an acceptable distance to prevent injury (e.g., passenger entrapment) and not stopping too harshly to cause passenger falls. This is the dilemma facing the designer of the braking system.
This paper describes the development and testing of an intelligent braking system that ensures a gentle stop which also meets the stopping distance requirements.
2. Intelligent Braking Versus Conventional Braking
The main problem with conventional braking systems is that they have to cope with a number of varying factors. These include direction (up and down), load (no load to full load); wear in the brake pads/shoes, changes in temperature and contamination of the brake pads/shoes. The brakes are usually designed/adjusted to deal with full load in the down direction such that the stopping distance at full load in the down direction for a fully loaded escalator does not exceed 1500 mm (for a 0.75 m/s escalator) . However, this setup results in a sharp stop when the escalator is not loaded, as well as a very short stopping distance when the escalator is loaded in the up direction.
In effect, a conventional braking system is a form of open loop (or feed-forward) control system, as shown in Figure 1. Although it is set to a certain value, any variation in the ‘noise’ parameters would lead to large variations in output. The output in this case is both the value of deceleration and the value of stopping distance.
Figure 1: Block diagram of conventional braking system (feed-forward).
An intelligent braking system would monitor the value of the variable it is trying to control (speed in this case) during the braking sequence. It then would continuously adjust the braking effort to keep to the set speed curve. Even if ‘noise’ is introduced into the system, the feedback loop feeds this information to the system, and the braking effort is also changed to suit. This is an example of a closed loop system (Figure 2).
Figure 2: Block diagram of an intelligent braking system (feedback).
3. Principle of Operation
Brakes in lift and escalator applications have to be fail-safe. For this reason, they are invariably spring applied and power lifted (either hydraulically or electromagnetically).
The most widely used brake types on escalators are either hydraulic or electromagnetic (i.e., solenoid). An intelligent braking system would require a brake than can be proportionally controlled.
Hydraulic brakes are more amenable to proportional control than electromagnetic brakes. The problem with electromagnetic brakes is that they can either be set in the on or off positions, and it is not possible to keep them in intermediate positions in order to vary the pressure. Hydraulic brakes on the other hand can be controlled by varying the oil pressure that acts against the springs. So the decision was made to use hydraulic brakes for the intelligent braking system.
Thus all the discussions that will follow in this report will assume that the controlled braking applies to a hydraulic brake.
The pressure applied by the hydraulic brake is the result of the interaction between the spring force (trying to apply the brake pads on the disk) and hydraulic pressure (trying to keep the brake pads off the disk). The spring pressure is constant and cannot be varied, as it is a characteristic of the spring. By controlling the hydraulic pressure, the exact braking effort can be applied. The hydraulic pressure is varied by controlling the valves that control the flow of the oil. Such a control can be done via two methods:
- Proportional valves.
- Pulse width modulation (PWM) control of on/off valves.
The second method of PWM is the one used in this system. Although the switching is not proportional (i.e., only on and off), the duty cycle of the on/off proportions is varied such that a 50% duty cycle leads to no change in pressure, while a duty cycle in excess of 50% (i.e., with the valve feeding the oil staying open longer than 50%) leads to an increase in pressure and reduction in braking (and vice versa). This requirement to increase or decrease the braking depends on the comparison between the reference ideal speed profile and the actual measured speed profile.
4. Safety Considerations for Intelligent Braking Systems
A number of pertinent points needed to be considered before embarking on an intelligent braking system. Three points are discussed in detail in this section.
4.1 System Redundancy and Failure Modes Analysis
It is not possible to design an intelligent braking system (or any system for that matter) that is 100% reliable. It is thus always important to be able to revert to a conventional braking system in case of failure of the intelligent braking system.
In other words, any system that is implemented must be fail-safe. If a failure takes place and when that failure is detected, then the system should revert to a conventional hydraulic brake stop.
There are two points to consider in this respect:
- The first point is that the intelligent brake system should have redundancy within it. This acknowledges the risk of failure of the brake controller and allows for it. Redundancy could be applied to any component in the system (e.g., the input speed reference (shaft encoder); the processing board; the final output board that controls the valve). This redundancy could be taken to the extreme by having two solenoids and two valves operating on the same brake. Diversity is another aspect. It might be possible to have two different processing boards with different software implementations and different algorithms.
- The second point is that if one brake is controlled (e.g., the operational brake) then the other brake would always act as a final line of defense (in this case the auxiliary brake).
- The third points is that an FMEA (failure modes and effects analysis) needs to be carried out on the system to ensure the basic EN115 safety premise:
One single fault within the system should not lead to a dangerous situation. If one fault has been detected, the system should not restart at the next cycle and an error should be raised .
An FMEA involves assessing all the possible failure modes, identifying which faults lead to a dangerous situation and modifying the design to eliminate the risk arising from such failures. This FMEA has been carried out on the electronic and hydraulic parts of the system. As a simple example, loss of connection to the shaft encoder should not lead to a dangerous situation and should result in the system stopping and raising an alarm.
Based on the above, the approach that has been taken is:
- The critical parts of the system have redundant components.
- If both redundant components fail, then the system reverts to a conventional braking system.
- A thorough FMEA was carried out to eliminate any single point failures.
4.2 Auxiliary, Operational or both?
Another major issue that needs consideration is whether the operational, auxiliary or both brakes are controlled. EN115 stipulates that there shall be no delay in the application of the operational brake. Controlling the operational brake is not a delay as long as the controlling starts as soon as a stop command is received. There are three options for the control in this respect:
- Controlling the operational brake only, and allowing the auxiliary brake to be controlled by a timer (around 3 seconds) in case of electromagnetic brakes or by its natural hydraulic exponential decay in case of hydraulic brakes. In this scenario the operational brake would apply immediately and start controlling the speed. The auxiliary brake would apply gradually or with a delay. If the escalator has not been brought to a complete stop by the time the auxiliary brake had applied, then any change in speed caused by the application of the auxiliary brake will be reflected in the algorithm for the operational brake, which will reduce its braking pressure to accommodate this speed change.
- The second option is to control the auxiliary brake only, and allow the operational brake to apply immediately when a stop is initiated. The problem with this method is that the force of the operational brake is so strong that it will cause an abrupt stop, defeating the original purpose of the intelligent braking system in the first place.
- The third option is to use a hybrid system of controlling both brakes at the same time. One suggestion was to use the two brakes in a shadowing manner, by which the reference curve for the auxiliary brake lags slightly in time behind the operational brake and thus acts as a backup in case the operational brake does not cope and the speed goes outside the limiting bands.
For this project it has been decided to keep the auxiliary brake controlled in a conventional manner and only control the operational brake (i.e., option 1). This provides some form of diversity in terms of keeping conventional auxiliary brake control and changing the operational brake to an intelligent brake system.
4.3 Variation in load and direction
One of the problems the intelligent brake has to deal with is the variation in load and direction of travel. At full load down, the brake needs most of the braking effort. At no load, the brake needs to work very lightly to prevent an abrupt stop. At full load up, gravity is doing all the work, and the brake only needs to apply when zero speed is achieved.
5. Parameters for Evaluating Braking Performance
The current requirements of EN115  only relate to stopping distance. It requires that the escalator stop in more than 350 mm at no load (0.75 m/s speed) and at less than 1500 mm full load down (0.75 m/s speed).
New work carried out by a CEN subcommittee (TC10) and published in  proposes a new set of pass/fail criteria for braking, shown in Table 1. This basically uses two parameters: Deceleration and stopping distances. (Notice that there is no mention of jerk in here).
|Maximum deceleration: 1 m/s2|
|Speed of the step band||Minimum braking distance|
Table 1: New proposed pass/fail criteria for EN115, by CEN/TC10/WG2 (1999).
This table was based on the results of some tests carried out by the Working Group 2 (WG2) of the TC10 committee, where attendees were asked to ride on the escalator and evaluate subjectively the stopping comfort. This was compared to the values of deceleration and jerk achieved (Table 2).
From these results the value of 1 m/s2 for deceleration was suggested.
|0.65||0.617||0.300||0.948||2.7||Limit for comfort|
|0.75||0.710||0.383||1.013||2.9||Limit for comfort|
Table 2: Results of tests carried out by CEN WG2 of TC10, 19/11/2001.
6. Description of System
In this section, a general overview and description is given of the intelligent braking system.
6.1 Reference curves
The ideal curve to aim for in the stopping sequence is the S-curve. An S curve is a speed curve that starts very flat (low acceleration and jerk) then progressively becomes steeper (achieving the highest deceleration value) and then become flat again (ending with zero deceleration). The problem with the S-curve is that the initial braking is very low, and that creates a large error in the total stopping distance.
The current system uses a pre-set ramp that defines a constant deceleration. The area under the curve is equal to the stopping distance.
Figure 3 illustrates how this is set in the current system. The user defines the desired stopping time. This automatically sets a speed profile and thus a deceleration profile. The area under the curve is the stopping distance.
Figure 3: Method of setting stopping distance and deceleration indirectly.
The system has internal preset deviation bands (above and below the speed profile). When the speed profile hits one of those deviation bands, the system acts to reduce or increase the pressure in order to alter the braking effort and correct the deviation. The band becomes narrower the lower the speed (Figure 4). When the speed gets to a predetermined value called the virtual zero, the system then moves to a constant ramp to achieve the final stop.
Figure 4: Method of speed control with SOBO.
6.2 Fast approach setup to disk
Once a braking signal is received, it is important to ensure that the pads approach the disk as fast as possible to avoid any delay in the start of the braking sequence. A fast approach algorithm is applied to speed up the response of the system. Within this system the pads are brought quickly into contact with the disk at a certain touch pressure that is set in the system, so that it is ready to start braking effectively as soon as possible without a mechanical delay.
This is achieved by using a pressure relief valve that is set at a value that would allow the pads just to touch the disk without any effective braking.
6.3 Electronic processing
A general block diagram of the electronic processing system in shown in Figure 5, and a photograph of those components is shown in Figure 6.
The intelligent braking system comprises two parallel channels fed from the same shaft encoder. The shaft encoder has two channels (A and B) that are square waves 90 degrees out of phase. These are called quadrature channels and allow the system to detect the direction of rotation. The two signals from the shaft encoder are fed into two speed sensor modules that check for overspeed/underspeed. The two signals are then fed to the two identical processing boards. As each board receives both signals A and B, they can detect the direction of rotation.
The speed sensor boards feed into the processing boards (called the A and B). These two boards operate in a master-slave configuration, so that at any one point in time, only one signal is active (although both boards are processing at any one point in time). The main advantage of these specific units is that they are self monitoring, so that if an error develops internally (hardware or software) they will give an error signal. The system also has what is called a redundancy module that compares the inputs from the master and slave processing boards. It monitors the error signals received from both. If an error develops in the master board, it then starts using the signal from the slave board.
Figure 5: Block diagram of the system.
The system also has an emergency chain input function that shuts the system down and applies the hydraulic brake causing a conventional hydraulic stop. The system also uses a dump valve, such that if an error develops within the system, this valve is used to dump all the oil and allow the brake to apply fully.
A photograph of the controller showing the various electronic components is shown in Figure 6.
Figure 6: General overview of the SOBO system.
7. Feedback Device Issues
One of the main problems that was encountered during the testing was the quality of the feedback signal. A shaft encoder was used to feed back the rotational movement of the escalator top shaft. The shaft encoder was mechanically linked to a countershaft on the escalator. The quality of the signal was very poor, with a significant amount of noise superimposed on the speed feedback signal.
An investigation revealed that the cause of the noise was mechanical rather than electrical. The method of axial coupling to the shaft encoder was very sensitive to the alignment accuracy. Using an alternative method of circumferential coupling via a large radius significantly reduced the noise within the signal.
Using the countershaft axial coupling resulted in 35% noise signal; using circumferential coupling from a small radius resulted in a 41% noise signal; and using the adopted method of circumferential coupling from a large radius reduced the noise signal to 5% of the main signal (as shown in Figure 7)
Figure 7: Comparison of speed signal by three methods.
8. Commentary on Risk Assessment
In order to ensure the highest level of safety through the introduction of the system, a number of precautions were been taken:
- Relay logic used to implement all control logic.
- Speed governor is still in operation independently and can intervene to apply the auxiliary brake.
- The auxiliary brake was still controlled conventionally
- Any fault with the first processor transfers control over to the second processor.
- Any fault within system will apply a conventional hydraulic brake sequence.
- Independent hardware watchdogs are used on both processing units. If any unit goes into a software infinite loop or a jam, the watchdog will detect this lack of communication and reset the whole system and send an error signal.
9. Subjective Stopping Comfort Test
One of the main aims of a successful braking system is to reduce the risk of passenger falls. However the relationship between the risk of passenger falls and the characteristics of a stop are still poorly understood. Some of the factors proposed are the value of the jerk during the stop, value of the deceleration and the duration of the deceleration .
In order to attempt to further understand this relationship, subjective tests were carried out to assess the relationship between the subjective quality of the escalator stop and the maximum value of deceleration.
The escalator was stopped a number of times with subjects riding on the escalator and then asked to rate the quality of the stop using a scale of 1 to 10 (1 being very bad and 10 being very good). The better the stop the less likely where the subjects to fall.
Prior to starting the tests on the intelligent braking system (with various parameters), the subjects evaluating the stopping comfort were asked to ride on the escalator during a conventional stop and rate that stop from 1 to 10. They rated the conventional stop as 2 (out of 10). They were also asked to evaluate an inverter stop and a frictional stop (a frictional stop is a stop during which both brakes are lifted and the unloaded machine comes to a stop under friction). These were rated at 9 (out of 10) and 10 (out of 10) respectively. This allowed the establishment of a benchmark of the best possible and worst possible stops and aligned those to the extreme ends of the scale.
The escalator was then stopped via the intelligent braking system using various settings in order to produce a range of values of deceleration.
The maximum values of deceleration and the corresponding subjective stop assessment factors for some of the tests have been filled in Table 3.
For each reading, the value of maximum deceleration was extracted and the pair of values (i.e., subjective rating of the quality of the stop and the maximum deceleration) was plotted on a scatter diagram. The resultant scatter diagram is shown in Figure 8 revealing a high correlation coefficient of 0.89 (this means that 89% of the variation in the subjective stopping comfort was caused by the variation in the value of the deceleration).
Table 3: Values of maximum deceleration corresponding to the subjective assessment of stopping comfort.
These results show an excellent relationship between the maximum value of deceleration and the quality of a stop. Moreover, as the intelligent braking system is achieving a deceleration value of around 0.6 m/s2 at no load, then the equivalent value of stopping comfort is around 6 compared to a value of stopping comfort for a conventional stop of around 1
Figure 8: Subjective test results on the relationship between stopping comfort and the maximum deceleration of a stop (10/3/2003 and 27/7/2003).
10. Test Results
Two pass/fail criteria were set: A maximum deceleration of 1 m/s2 and a maximum variation in stopping distance of 35% between no load and full load down.
The tests results met the pass/fail criterion. The variation in target stopping distance meets the 35% variation criterion. The stopping distance achieved is around 850 mm no load and 1100 mm full load down. Moreover, at a specific load and a specific target stopping distance, the repeatability is very good (around 5 to 10% variations in stopping distance).
As far as the deceleration values are concerned, they all pass (values are between 0.7 for no load and 0.85 m/s2 for full load down; up loaded values are governed by gravity and are always around 1 m/s2).
The tests results are shown in graphical format in Figure 9 (that shows the comparison between conventional stops and intelligent braking stops at no load) and in Figure 10 (that shows the no load to full load variation of the intelligent braking system).
Figure 9: Test results comparing conventional stops with intelligent braking stops.
Figure 10: Intelligent braking results with and without load.
The following conclusions can be drawn regarding the intelligent braking system:
- A closed loop feedback braking control system can be used to successfully control the stopping characteristics of public service escalators in order to reduce the risk of passenger falls.
- The pass fail criterion set for the intelligent braking system requires a maximum value of deceleration of 1 m/s2 during a stop and a variation of 35% stopping distance between no load and full load down.
- The intelligent braking system has achieved the required pass/fail criterion.
- The intelligent braking system also achieves a high level of comfort for the passengers during stopping, and evidence shows from subjective tests that this will contribute to a significant reduction in passenger falls.
The author acknowledges the contribution of Svendborg Brakes of Denmark who supplied and installed the system and the contribution of Tube Lines, London, who commissioned the installation of the system.
REFERENCES & BIBLIOGRAPHY
- Al-Sharif L Asset Management of Public Service Escalators, Elevator Technology 9, Proceeding of the International Conference on Elevator Technology (Elevcon ’98) Zurich, Switzerland, October 1998. Reprinted in: Elevator World, June 1999 (page 96).
- Stein W, Ludwig R Brakes for escalators and moving walks Lift Report, Issue 1/2003.
- Safety rules for the construction and installation of escalators and passenger conveyors EN115: 1995.
- Al-Sharif L Escalator Stopping, Braking and Passenger Falls Lift Report [in English & German], November/December 1996.