|
|
|
|
|
>>Click here for full article for members
Schindler Elevator Accident
Tokyo University Department of Agriculture
This article is based on the Association for the Study of Failure Chairperson Yotaro Hatamura’s lecture,
“Learning from Elevator Accidents,” at the 5th ASF Annual Meeting.
Takuya NAKAMURA English translation by Carla TAKAKI
Scenario
Overview On June 3, 2006, a male high school student was suffocated to death in an elevator of an apartment complex in Tokyo’s Minato Ward. The student was riding the elevator while sitting on his bicycle and facing the back wall of the car. He was about to exit the elevator on the 12th floor when he was caught between the floor of the elevator and ceiling of the 12th floor. Investigations revealed that, despite numerous reports of problems about the manufacturer, the company had been neglecting many of these faults. Date·Place June 3, 2006, at approximately 7:20 pm in the elevator of "City Heights Takeshiba" residential apartment complex in Minato Ward, Tokyo. The elevator had stopped and opened its doors on the 12th floor. Sequence At approximately 7:20 pm on June 3, 2006, a male high school student was caught between the elevator floor and the top of the elevator door onhe 12th floor in “City Heights Takeshiba” residential apartment complex in Tokyo’s Minato Ward. The victim was suffocated to death. The victim had boarded the elevator on the 1st floor, along with a female who lived on the 13th floor of the building, and was on his bicycle, facing forward. When the elevator stopped on the 12th floor, the student sat astride the bike and attempted to exit the elevator backwards. However, just as he was exiting the car, the elevator began ascending even though the doors were still open unattended ascend. The student was caught between the elevator car floor and the exterior frame of the elevator door ceiling. His body was bent such that his head and legs remained inside the elevator, while his back and torso were caught outside the car. The woman riding in the car immediately pressed the emergency button inside the elevator and the accident was reported to the apartment complex disaster prevention center. An employee of the center called 119 emergency number in japan to report the incident. While emergency services personnel were able to extract the victim approximately 40 minutes later, he died shortly thereafter due to multiple injuries to the body and cranial fractures. Upon the results of a judicial autopsy, the cause of death was determined to be sustained, strong pressure to the chest and torso leading to suffocation. Background Manufacturing Origin Schindler Elevator K.K. (hereafter “Schindler”) is a part of Switzerland-based Schindler Holdings and is incorporated in Japan. The company specializes in elevator and escalator manufacturing, sales, maintenance, and management. Besides an the American company Otis, the group is the world’ s second largest elevator manufacturer. In 1985, the company purchased 30% of the stock of Nippon Elevator Manufacturing, incorporated itself as a group, and entered the Japanese market. The company began doing business under its current name in 1991. Schindler,however,had difficulty competing against the domestic elevator makers including Mitsubishi Electric, Hitachi Works, and Toshiba Elevator. In 1998 Schindler shifted its emphasis and began targeting government contracts by bidding low for public works projects. The apartment complex at which the accident occurred had at first hired Schindler to provide elevator maintenance inspections. However, after Minato Ward introduced a competitive bidding policy, in 2005 and every year thereafter companies other than Schindler were hired to conduct maintenance. The accident brought increased public scrutiny to Schindler, and the search revealed that more than 100 accidents involving Schindler-produced elevators had been reported nationwide. There also have been 3 deaths involving Schindler elevators overseas, in New York and in Hong Kong. Maintenance It is common knowledge among manufacturers that profits are to be found not in the selling of products, but in maintaining them. Years ago, manufacturing companies were able to make large profits because buyers of their products often contracted them for maintenance services. However, industry competition led to companies offering maintenance services for products that they themselves did not manufacture. Of course, manufacturers did not wish to lose such profitable sources of revenue, and thus as a way of protecting their advantage, they began withholding information required for the proper maintenance of their products. While the Fair Trade Commission cautioned against this practice as abuse of one’ s position (see their 2002 statement regarding Mitsubishi Electric Building Techno-Service), those in the elevator industry did not reform their practices. Thus, there have also been statements that, while non-Schindler maintenance companies attempted to maintain their elevators and expressed concerns about safety, Schindler did not disclose any of the data required to properly maintain their products. Due to the relaxation of regulations, it is probable that competition will continue to increase. It is thus essential to fully recognize that the safety of society is important above all else, and will require a clear consideration of what we must do to ensure safety. Elevator Figure 1 illustrates the basic construction of a rope elevator (traction-type), of the kind that was used the Schindler model in the accident was of this type.  Fig. 1: Example of a rope elevator structure (traction-type) The passenger car is suspended by ropes, and moves up and down along rails. The rope is moved along pulleys in a driving sheave, and a structure called a deflector wheel holds the car in equilibrium against a counterweight. The car can thus be moved without having to exert much force. The rope, pulley, and deflector wheel apparatus move solely by frictional force. Also, within the engine room a speed governor constantly monitors the speed of the elevator car. Monitoring equipment is designed to detect any abnormalities, in which case a computerized control panel is designed to control the movement of the car. Within the elevator car, there is a shock absorber and emergency stop mechanism to provide protection in the worst case. However, both functions work only when the elevator is descending, and does not work when the car is ascending. In other words, if the counterweight is lowering the emergency stop will not engage; the collision buffer will not work, either. While over its long history elevators have developed technologically, we realize that in actuality, only technical knowledge regarding falling of elevators developed but not the ascending.
While multiple overlapping causes combined in this accident, the largest three factors could be described as “direct causes,” “social aspects,” and “planning aspects.” Direct Causes It was reported that the brakes did not adequately engage because of worn-out brake pads. However, for argument’ s sake, even if friction had been reduced in all the brakes, as long as the brake arm functioned, friction would cause the brake drum to engage. Consequently, might we not question the explanation that worn brake pads prevented the car from braking? It may be the case that braking efficacy would be compromised by worn brake pads, but it cannot be thought that the elevator moved on its own just because the brakes were not operating perfectly. The actual cause is thought to have been an abnormality in the signal that causes the brakes to release; that is, the accident stemmed from a problem with the controlling mechanism. The following three points are considered to be elements related to this abnormality.
Also, because the semiconductor manufacturing process utilizes light beams and X-rays, the presence of any kind of dirt could lead to miswiring. Misdirected signals due to semiconductor contamination frequently causes defective operations. The most likely cause of the abnormality is the degradation over time of the circuit board mounting. In recent years polyimide resin has been used, but printed boards produced through multiple layerings are susceptible to deterioration over time. After 10-15 years, interruptions, connections to other areas, splits, and other malfunctions may occur. It is thus hypothesized that the immediate cause of this accident was a combination of factors. Social Aspects Let us first consider the historical conditions in which the accident occurred. The microcomputer revolution began around 1980 and spread through the 1990s. Convenient, safe, efficient ? for all these reasons we have found ourselves living in the era of the microcomputer. Now, however, as we saw in the previous section, various problems are arising relating to system software bugs. There is no doubt that from now on, both in Japan and throughout the world, malfunctions in machines that utilize computers will continue. Next, let us think about the genealogy of technology. While on one hand “modernization” via computers continues, on the other hand there are sometimes older manufacturers that insist on adhering to outmoded machines and systems. The result is that some manufacturers may introduce new computerized systems later than others. If, for example, Schindler was one of these manufacturers, it is extremely likely that the central part of Schindler-made controllers would be several years behind other manufacturers, especially those using Japanese technology. Because Japanese elevators have not made inroads abroad, from the point of view of the world market, Japanese elevators would seem to be of little consequence. However, it might be ventured that from a technical standpoint, Japan has a great deal of experience because of its simultaneous commitment to both computerization and converting to electronics and electromechanics. The “mechanical earth” has been so imposingly cultivated that it would be extremely difficult for a smaller company like Schindler to enter the field. It is possible that, despite having entered the market by degrees, a cause of Schindler’ s problems was having to sell their products before they had a full grasp of the industry. Design Aspects The background explanation for this accident described the structure of the elevator, but has so far limited its discussion of design to the case of falling elevators (the four chief elements). Aside from considering a falling counterweight, we saw that the mechanical emergency stops apply only to a falling car. According to reference 4, the mass of the counterweight is 3,025kg, the mass of the car is 2,100 kg, and the maximum loading weight is 1,850 kg. We thus understand that when half the maximum loading weight is loaded into the car, the mass of the car will be in balance with the mass of the counterweight. At the time of the accident, it was estimated that the mass of the elevator car (including 1 bicycle at 20kg and 2 passengers at 120kg) was 2,240kg. Ignoring the weight of items like wires, the difference between the car and the counterweight was 785kg. If we add in gravitational acceleration to the difference in mass, approximately 785kgf of force pushed the elevator car upwards. As 200kg of force on an adult human head or about 100kg of force on a child’s head would cause death, it is the case that even an adult head would be completely crushed by the amount of force present in this accident. If we consider that the sensor from the model experiment conducted based on the 2004 Roppongi Hills revolving door incident (in which a young boy was killed) detected about 800kg of force, it could be said without reservation that this elevator exerted enough weight to kill anyone caught in it. It is terrible that such proof ? even through a simple calculation such as this one ? has been neglected. At this point, let us consider the relationship between machines and humans. As a rule, humans have the subjective expectation that machines are safe. However, serious accidents occur when a variety of possible outcomes are overlooked during the design process. From the Schindler example, we might assume that the company did not anticipate that someone would use the elevator while sitting on a bicycle; such a statement was, in fact, made. However, sitting on a bicycle and having to back out of the elevator, bringing the bike upstairs out of worry that the bicycle would be stolen if left on the first floor, thinking it natural for a resident of a high-rise building to sit on his bike in an elevator ? these are all behaviors that should have been considered as a matter of course. We must say that neglecting to consider such scenarios during the design stage is strongly connected to serious accidents. Also, although the company concerned did state that they did not hypothesize such a scenario, it is the responsibility of the designer to search out such possibilities. In this case, the designers did not foresee this scenario because they did not want to see it. In reality, however, designers may think that such sporadic malfunctions are not their personal responsibility. Designers must carefully consider how the products they create will be used by themselves and by others. Countermeasures This accident, following on the heels of the March 2004 Roppongi Hills revolving door accident that killed a little boy, has led the Ministry of Land, Infrastructure, Transport and Tourism to begin constructing a system that will allow it to identify potential problems with elevators and other indoor equipment before accidents occur. After the revolving door accident, it was established that we must pay attention to information regarding seemingly insignificant malfunctions before they lead to fatal accidents. In July 2004, the Ministry of Land, Infrastructure, Transport and Tourism, in cooperation with related individuals, collected cases involving elevator and other indoor accidents, and agreed to maintain an information system. Work has continued on the project, with the aim of putting the system in place during 2006. In the wake of the elevator accident, the Ministry of Land, Infrastructure, Transport and Tourism also ordered an emergency inspection of Schindler elevators in 8,834 locations nationwide. They also ordered inspections of non-Schindler elevators in approximately 2,000 government-related institutions that had previous reports of elevator problems. As a preventative measure against reoccurrence, a plan has been announced to introduce a recall system, which would require manufacturers to report failures to the administration. It has also been noted that it is necessary to ensure that safety devices that are controlled by computer programs be completely free of software problems. The following three measures have thus been proposed.
Knowledge Years ago, the domain of responsibility held by humans and that held by machines came together in a moderately graceful manner. Occasionally an open area not covered by either domain would cause an accident to occur, but machine-based solutions were found in order to solve these problems. Controlling machines through the utilization of sensors and the development of electromechanics helped to increase safety. In this way, machines became more developed internally, and at first glance they seemed safe. As a consequence, the human domain of responsibility became quite small. Although the human domain kept growing smaller, the machine side did not always respond to this withdrawal with a corresponding technology, and crevices appeared in which new accidents were allowed to occur. Figure 8 provides a conceptual illustration of this phenomenon.  Fig. 8: Accidents brought forth by changes in human and machine domains of control Anyone can have this kind of experience in everyday life; we provide the following examples of this phenomenon.
Reference
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Copyright©2002-2015 Association for the Study of Failure |
