Corporation Members
   Research Organization
   How to Join ASF
   Contact Us
   Member's Area

We are accepting articles and photos of failure cases from members. Selected articles and photos will be published by ASF.

How to join ASF
Request membership
ASF sends instructions
Make payment
ASF notifies password
Failure Almanac 2006:</b>Schindler Elevator Accident
>>Click here for full article for members

Failure Almanac 2006
Schindler Elevator Accident
Tokyo University Department of Agriculture
English translation by Carla TAKAKI

This article is based on the Association for the Study of Failure Chairperson Yotaro Hatamura’s lecture, “Learning from Elevator Accidents,” at the 5th ASF Annual Meeting.

Elevator Ascended while Doors were Open

1.Poor sense of values
2.Poor awareness of safety
3.Lack of research and investigation
4.Lack of research before the accident occurred
5.Failure to anticipate malfunctions
6.Inadequate safety measures to prevent elevator car from ascending
7.Poor response to environmental changes
8.Change in economic environment
9.Outsourcing of maintenance to outside firm
10.Planning and Design
11.Poor planning
13.Hardware manufacturing
14.Software manufacturing
15.Poor Braking System
16.Incomplete functionality
17.Faulty systems
18.Disengagement of brakes
19.Physical injury
21.Delayed administrative response

    On June 3, 2006, a male high school student was suffocated to death in an elevator of an apartment complex in Tokyo’s Minato Ward. The student was riding the elevator while sitting on his bicycle and facing the back wall of the car. He was about to exit the elevator on the 12th floor when he was caught between the floor of the elevator and ceiling of the 12th floor. Investigations revealed that, despite numerous reports of problems about the manufacturer, the company had been neglecting many of these faults.

    June 3, 2006, at approximately 7:20 pm in the elevator of "City Heights Takeshiba" residential apartment complex in Minato Ward, Tokyo. The elevator had stopped and opened its doors on the 12th floor.

    At approximately 7:20 pm on June 3, 2006, a male high school student was caught between the elevator floor and the top of the elevator door onhe 12th floor in “City Heights Takeshiba” residential apartment complex in Tokyo’s Minato Ward. The victim was suffocated to death.
    The victim had boarded the elevator on the 1st floor, along with a female who lived on the 13th floor of the building, and was on his bicycle, facing forward. When the elevator stopped on the 12th floor, the student sat astride the bike and attempted to exit the elevator backwards. However, just as he was exiting the car, the elevator began ascending even though the doors were still open unattended ascend. The student was caught between the elevator car floor and the exterior frame of the elevator door ceiling. His body was bent such that his head and legs remained inside the elevator, while his back and torso were caught outside the car. The woman riding in the car immediately pressed the emergency button inside the elevator and the accident was reported to the apartment complex disaster prevention center. An employee of the center called 119 emergency number in japan to report the incident. While emergency services personnel were able to extract the victim approximately 40 minutes later, he died shortly thereafter due to multiple injuries to the body and cranial fractures. Upon the results of a judicial autopsy, the cause of death was determined to be sustained, strong pressure to the chest and torso leading to suffocation.

Manufacturing Origin
    Schindler Elevator K.K. (hereafter “Schindler”) is a part of Switzerland-based Schindler Holdings and is incorporated in Japan. The company specializes in elevator and escalator manufacturing, sales, maintenance, and management. Besides an the American company Otis, the group is the world’ s second largest elevator manufacturer. In 1985, the company purchased 30% of the stock of Nippon Elevator Manufacturing, incorporated itself as a group, and entered the Japanese market. The company began doing business under its current name in 1991. Schindler,however,had difficulty competing against the domestic elevator makers including Mitsubishi Electric, Hitachi Works, and Toshiba Elevator. In 1998 Schindler shifted its emphasis and began targeting government contracts by bidding low for public works projects.
    The apartment complex at which the accident occurred had at first hired Schindler to provide elevator maintenance inspections. However, after Minato Ward introduced a competitive bidding policy, in 2005 and every year thereafter companies other than Schindler were hired to conduct maintenance.
    The accident brought increased public scrutiny to Schindler, and the search revealed that more than 100 accidents involving Schindler-produced elevators had been reported nationwide. There also have been 3 deaths involving Schindler elevators overseas, in New York and in Hong Kong.

    It is common knowledge among manufacturers that profits are to be found not in the selling of products, but in maintaining them. Years ago, manufacturing companies were able to make large profits because buyers of their products often contracted them for maintenance services. However, industry competition led to companies offering maintenance services for products that they themselves did not manufacture. Of course, manufacturers did not wish to lose such profitable sources of revenue, and thus as a way of protecting their advantage, they began withholding information required for the proper maintenance of their products. While the Fair Trade Commission cautioned against this practice as abuse of one’ s position (see their 2002 statement regarding Mitsubishi Electric Building Techno-Service), those in the elevator industry did not reform their practices. Thus, there have also been statements that, while non-Schindler maintenance companies attempted to maintain their elevators and expressed concerns about safety, Schindler did not disclose any of the data required to properly maintain their products.
    Due to the relaxation of regulations, it is probable that competition will continue to increase. It is thus essential to fully recognize that the safety of society is important above all else, and will require a clear consideration of what we must do to ensure safety.

    Figure 1 illustrates the basic construction of a rope elevator (traction-type), of the kind that was used the Schindler model in the accident was of this type.

Fig. 1: Example of a rope elevator structure (traction-type)

    The passenger car is suspended by ropes, and moves up and down along rails. The rope is moved along pulleys in a driving sheave, and a structure called a deflector wheel holds the car in equilibrium against a counterweight. The car can thus be moved without having to exert much force. The rope, pulley, and deflector wheel apparatus move solely by frictional force.
    Also, within the engine room a speed governor constantly monitors the speed of the elevator car. Monitoring equipment is designed to detect any abnormalities, in which case a computerized control panel is designed to control the movement of the car.
     Within the elevator car, there is a shock absorber and emergency stop mechanism to provide protection in the worst case. However, both functions work only when the elevator is descending, and does not work when the car is ascending. In other words, if the counterweight is lowering the emergency stop will not engage; the collision buffer will not work, either. While over its long history elevators have developed technologically, we realize that in actuality, only technical knowledge regarding falling of elevators developed but not the ascending.
  1. Construction of Schindler’s driving sheave
        Figure 2 illustrates a drive sheave of the same type produced by Schindler and involved in the Tokyo accident (however, while the drive sheave used during the accident was 30kW, the drive sheave pictured here is half its power at 15kW).
        The rotation of the electric-powered motor is decelerated by a worm wheel. The brakes consist of a brake drum, brake arm, and brake shoe, with brake pads. Holding down the brake drum by the brake arm causes the axle to stop rotating. The brake arm is released only when an electromagnetic current is received. If an electromagnetic current is not received, a spring will always automatically engage the brake.

    Fig. 2: 15kW version of the Schindler drive, of the same type involved in the accident

  2. Construction of the brake section of the Schindler drive sheave
        Figure 3 provides a detailed view of the drive sheave pictured in Figure 2. The brake engages when a coil spring presses down on the interior of the brake arm. Also, the brake arm releases when an electric current flows through the electromagnetic coil, causing the brake to release. In short, the construction is such that the brake engages when the electric current is cut.

    Fig. 3: Enlarged view of the brake section of the Schindler drive sheave

    In order to ensure safety, a fail-safe mechanism is designed to go into effect if any kind of trouble occurs within the system. Elevators also have such a system. Figure 4 illustrates a cross-section of the brake.

    Fig. 4: Brake of the direct current electric motor drive sheave
  3. Elevator car counterweight design
        The elevator car must handle both the weight of the car itself, and the weight of the passengers riding in the car. On the other side, the weight of the counterweight is generally determined by the formula: Car weight + Half of the passenger capacity x Average body weight. In short, the system is configured such that if half of the elevator capacity rode the elevator, the car and counterweight would be in balance.
  4. Safety device to prevent the elevator car from falling
        While there have been a variety of accidents in the history of the development of the elevator, because of those accidents our elevators are now quite safe. In particular, in the event that an elevator car carrying passengers begins to fall, the following 4 safety devices are put into action:
    1. When the velocity of the car rises too quickly, the motor stops.
    2. If an abnormality occurs, the brake drum forces a stop.
    3. The guide rails seize, forcing a stop This safety mechanism take form in the following two types:
      1. Fast-acting emergency brake mechanism
            The sudden-stop emergency brake uses the end of a lifting rod that works in concert with the speed governor. When the device recognizes that the speed exceeds a certain threshold, the lifting rod ascends and creates a wedge-shaped opening, into which a roller is inserted. The car then holds tightly onto the rail, causing it to stop. This is illustrated in Figure 5.

        Fig. 5: Fast-acting emergency stop apparatus

      2. Immediate emergency brake apparatus (F,G,C types)
            This type of brake effects a gradual stop. The structure resembles the fast-acting type; both have wedge rollers, but while the fast-acting brake has only one, this brake has a line of them. Due to the concern that suddenly stopping a object moving at a high speed could be dangerous, recently numerous elevators have been equipped with this type of emergency braking mechanism. Figure 6 illustrates this form of brake.
    4. In order to soften the impact of a falling car, a box-shaped structure is installed on the bottom of the elevator car.
          These 4 safety mechanisms apply only to falling cars; they will not cause a car to stop if the counterweight begins to fall and a person becomes caught. Despite having four kinds of emergency brakes, a motor that keeps the brake is fully open will not allow a runaway car to halt.

      Fig. 6: Immediate emergency brake apparatus

  5. Disk Governor
        The governor brakes in the following ways if the elevator car rises or falls too quickly. Figure 7 provides an illustration of the disk governor.
    1. Electric Emergency Brake
          The primary wheel of the governor monitors rotation speeds through a excessive speed monitoring switch. If the speed rises past 130% of the rated value, the power source switches off, causing the brakes to engage.
    2. Mechanical Emergency Brake
          If the speed rises past 140% of the rated value, the increase in inertial force will cause a pendulum to release. When the primary wheel rotates, the pendulum flicks out a hook. The governor rope then moves a rod into a lifting position, and the brake engages. However, this structure works only when cars are descending, not when they are ascending.

    Fig. 7: Disk Governor

    While multiple overlapping causes combined in this accident, the largest three factors could be described as “direct causes,” “social aspects,” and “planning aspects.”

Direct Causes
    It was reported that the brakes did not adequately engage because of worn-out brake pads. However, for argument’ s sake, even if friction had been reduced in all the brakes, as long as the brake arm functioned, friction would cause the brake drum to engage. Consequently, might we not question the explanation that worn brake pads prevented the car from braking? It may be the case that braking efficacy would be compromised by worn brake pads, but it cannot be thought that the elevator moved on its own just because the brakes were not operating perfectly.
    The actual cause is thought to have been an abnormality in the signal that causes the brakes to release; that is, the accident stemmed from a problem with the controlling mechanism. The following three points are considered to be elements related to this abnormality.
  • Structural software bug
  • Misdirection of signals due to semiconductor contamination
  • Deterioration of the circuit board mounting
    Above all, the computer has been thoroughly introduced into our present times. New functions are constantly being added to computers in order to make them more convenient to use. However, the mutual interaction of these functions within a computer inevitably causes problems. Identifying these faults before they occur is extremely difficult; indeed, there is often no choice but to solve these problems as they occur. If we think outward from these conditions, we would realize that the probability that a software bug within the system caused the malfunction is very high. At the very least, since the early days, when a malfunction occurred we would probably be able to pinpoint its cause. However, if it is impossible to reproduce a malfunction, we are also unable to identify the problem area, leaving no choice for repairs other than replacing the entire system.
    Also, because the semiconductor manufacturing process utilizes light beams and X-rays, the presence of any kind of dirt could lead to miswiring. Misdirected signals due to semiconductor contamination frequently causes defective operations.
    The most likely cause of the abnormality is the degradation over time of the circuit board mounting. In recent years polyimide resin has been used, but printed boards produced through multiple layerings are susceptible to deterioration over time. After 10-15 years, interruptions, connections to other areas, splits, and other malfunctions may occur.
    It is thus hypothesized that the immediate cause of this accident was a combination of factors.

Social Aspects
    Let us first consider the historical conditions in which the accident occurred. The microcomputer revolution began around 1980 and spread through the 1990s. Convenient, safe, efficient ? for all these reasons we have found ourselves living in the era of the microcomputer. Now, however, as we saw in the previous section, various problems are arising relating to system software bugs. There is no doubt that from now on, both in Japan and throughout the world, malfunctions in machines that utilize computers will continue.
    Next, let us think about the genealogy of technology. While on one hand “modernization” via computers continues, on the other hand there are sometimes older manufacturers that insist on adhering to outmoded machines and systems. The result is that some manufacturers may introduce new computerized systems later than others. If, for example, Schindler was one of these manufacturers, it is extremely likely that the central part of Schindler-made controllers would be several years behind other manufacturers, especially those using Japanese technology. Because Japanese elevators have not made inroads abroad, from the point of view of the world market, Japanese elevators would seem to be of little consequence. However, it might be ventured that from a technical standpoint, Japan has a great deal of experience because of its simultaneous commitment to both computerization and converting to electronics and electromechanics. The “mechanical earth” has been so imposingly cultivated that it would be extremely difficult for a smaller company like Schindler to enter the field. It is possible that, despite having entered the market by degrees, a cause of Schindler’ s problems was having to sell their products before they had a full grasp of the industry.

Design Aspects
    The background explanation for this accident described the structure of the elevator, but has so far limited its discussion of design to the case of falling elevators (the four chief elements).     Aside from considering a falling counterweight, we saw that the mechanical emergency stops apply only to a falling car.
    According to reference 4, the mass of the counterweight is 3,025kg, the mass of the car is 2,100 kg, and the maximum loading weight is 1,850 kg. We thus understand that when half the maximum loading weight is loaded into the car, the mass of the car will be in balance with the mass of the counterweight.
    At the time of the accident, it was estimated that the mass of the elevator car (including 1 bicycle at 20kg and 2 passengers at 120kg) was 2,240kg. Ignoring the weight of items like wires, the difference between the car and the counterweight was 785kg. If we add in gravitational acceleration to the difference in mass, approximately 785kgf of force pushed the elevator car upwards. As 200kg of force on an adult human head or about 100kg of force on a child’s head would cause death, it is the case that even an adult head would be completely crushed by the amount of force present in this accident. If we consider that the sensor from the model experiment conducted based on the 2004 Roppongi Hills revolving door incident (in which a young boy was killed) detected about 800kg of force, it could be said without reservation that this elevator exerted enough weight to kill anyone caught in it. It is terrible that such proof ? even through a simple calculation such as this one ? has been neglected.

    At this point, let us consider the relationship between machines and humans. As a rule, humans have the subjective expectation that machines are safe. However, serious accidents occur when a variety of possible outcomes are overlooked during the design process. From the Schindler example, we might assume that the company did not anticipate that someone would use the elevator while sitting on a bicycle; such a statement was, in fact, made. However, sitting on a bicycle and having to back out of the elevator, bringing the bike upstairs out of worry that the bicycle would be stolen if left on the first floor, thinking it natural for a resident of a high-rise building to sit on his bike in an elevator ? these are all behaviors that should have been considered as a matter of course. We must say that neglecting to consider such scenarios during the design stage is strongly connected to serious accidents.
     Also, although the company concerned did state that they did not hypothesize such a scenario, it is the responsibility of the designer to search out such possibilities. In this case, the designers did not foresee this scenario because they did not want to see it. In reality, however, designers may think that such sporadic malfunctions are not their personal responsibility. Designers must carefully consider how the products they create will be used by themselves and by others.

    This accident, following on the heels of the March 2004 Roppongi Hills revolving door accident that killed a little boy, has led the Ministry of Land, Infrastructure, Transport and Tourism to begin constructing a system that will allow it to identify potential problems with elevators and other indoor equipment before accidents occur. After the revolving door accident, it was established that we must pay attention to information regarding seemingly insignificant malfunctions before they lead to fatal accidents. In July 2004, the Ministry of Land, Infrastructure, Transport and Tourism, in cooperation with related individuals, collected cases involving elevator and other indoor accidents, and agreed to maintain an information system. Work has continued on the project, with the aim of putting the system in place during 2006.

    In the wake of the elevator accident, the Ministry of Land, Infrastructure, Transport and Tourism also ordered an emergency inspection of Schindler elevators in 8,834 locations nationwide. They also ordered inspections of non-Schindler elevators in approximately 2,000 government-related institutions that had previous reports of elevator problems.
    As a preventative measure against reoccurrence, a plan has been announced to introduce a recall system, which would require manufacturers to report failures to the administration. It has also been noted that it is necessary to ensure that safety devices that are controlled by computer programs be completely free of software problems. The following three measures have thus been proposed.
  1. Creating redundancies by combining two separate safety systems
  2. Creating redundancies among breaking systems for falling elevators
  3. Installing emergency braking equipment that prevent the sudden and unexpected rise of elevators

    Years ago, the domain of responsibility held by humans and that held by machines came together in a moderately graceful manner. Occasionally an open area not covered by either domain would cause an accident to occur, but machine-based solutions were found in order to solve these problems. Controlling machines through the utilization of sensors and the development of electromechanics helped to increase safety.
    In this way, machines became more developed internally, and at first glance they seemed safe. As a consequence, the human domain of responsibility became quite small. Although the human domain kept growing smaller, the machine side did not always respond to this withdrawal with a corresponding technology, and crevices appeared in which new accidents were allowed to occur. Figure 8 provides a conceptual illustration of this phenomenon.

Fig. 8: Accidents brought forth by changes in human and machine domains of control

Anyone can have this kind of experience in everyday life; we provide the following examples of this phenomenon.
  • We can drive our cars by using GPS navigation systems, but we have become unable to map out our own routes.
  • We have become so accustomed to cooking rice in an electric cooker that we are unable to cook rice with gas.
  • We are forgetting how to write Chinese characters because we have become so accustomed to using a word processor.
In this way, the points of contact between humans and machines are leading, one by one, to accidents. As with the process of computerization described earlier, we may assume that additional problems will occur. There is no doubt that previously unimaginable accidents will repeatedly occur precisely at those problem points where the boundaries of human and machine control divide.

1. Shoukouki gijutsu kijyun no kaisetsu (An explanation of elevator technical standards). 2002, Ministry of Land, Infrastructure, Transport and Tourism, Housing Bureau, Construction Guidance Section
2.Erebeta, esukareta nyuumon (An introduction to elevators and escalators). Takeuchi Teruo, Koukensha.
3.Door project symposium distributed materials, Door Project, March 27, 2005, Roppongi Hill, Mori Tower, 49th floor.
4.City Heights Takeshiba erebeta jiko chousa ni kakawaru daiyongouki jikken kekka bunseki houkokusho (Analytical report of results from the elevator #4 experiment relating to the City Heights Takeshiba elevator accident, January 29, 2009, Minato Ward, Tokyo.

Copyright©2002-2015 Association for the Study of Failure