Classify the lift by its payload and exposure to harm before choosing control hardware. Closed-loop feedback improves motion, but load holding and protective functions need separate assessment. Passenger lifts require a qualified, compliant safety architecture, while demonstrators need a clearly controlled operating and maintenance boundary.
Elevator control safety starts with the load and the consequences of unexpected movement, not with the choice of controller or drive. A passenger lift needs a qualified, compliant safety architecture. A goods lift can also present serious hazards, even though nobody rides on it. A guarded demonstrator may use ordinary motion-control hardware, but only after its accessible hazards have been assessed and controlled. Encoder feedback improves motion control; it does not, by itself, make a lift safe.
Classify the lift by exposure to harm
Start by defining what the platform carries, where it travels and what can enter its travel space. The label “goods only” is not enough. A falling load, an exposed counterweight or a platform passing a landing can create crushing and trapping hazards without carrying passengers.
| Project class | Main safety question | Design consequence |
|---|---|---|
| Passenger lift | What prevents injury during normal operation and foreseeable faults? | Use a qualified lift design process and an architecture that meets the applicable lift requirements |
| Goods lift | Can movement, falling material or access to the travel space cause harm? | Assess the complete lifting installation, including access, load retention and protective functions |
| Enclosed demonstrator | Are movement and stored energy contained during operation and maintenance? | Ordinary motion hardware may be appropriate, but guarding and protective measures still need assessment |
A small model is not automatically harmless. Consider its load, travel, speed, pinch points and stored energy. Maintenance access matters too: an enclosure that prevents contact during operation does not protect against a suspended platform while the enclosure is open.
Write down the intended use and foreseeable misuse before selecting hardware. If passenger access is possible, do not treat a warning label as the measure that makes the project a non-passenger lift.
Closed-loop control is not a safety architecture
A closed-loop drive compares a command with measured feedback and adjusts motor output to reduce the difference. Depending on the arrangement, feedback may support speed regulation, position control or both.
That helps with acceleration, stopping accuracy and repeatable travel. It does not establish protection against every dangerous failure.
For example, a motor encoder measures motor rotation. It may not detect movement caused by a failed coupling or another mechanical failure between the motor and platform. A position value displayed by the controller is therefore not proof that the platform is securely held.
Keep these functions separate in the design:
- Motion control: commands speed, direction and target position.
- Load holding: prevents an unintended movement while stationary.
- Protective stopping: brings hazardous movement to an appropriate stop when required.
- Mechanical protection: addresses hazards that motor control alone cannot manage.
A standard controller can coordinate a movement sequence without being suitable as the sole means of performing a safety function. Selecting hardware with a particular safety capability also does not establish that the assembled lift is safe.
Braking must account for gravity
Removing electrical power is not the same as securing a suspended load. Gravity remains after a drive loses torque. A stopping method that works for a horizontal conveyor may be unsuitable for a vertical axis.
A spring-applied, electrically released brake can apply when its release power is removed. That principle is useful for suspended loads, but it does not settle brake selection. Required holding torque, stopping energy, wear, application time and the mechanical transmission all matter.
A brake intended to hold a stationary shaft may not be suitable for repeatedly stopping a moving load. Brake feedback may report a mechanism's position without proving its available braking torque. Those are different claims and need different evidence.
Safe Torque Off, where provided, prevents torque generation by the drive. It does not mechanically hold a suspended load or necessarily stop an already moving load. Any use of that function on a vertical axis must be coordinated with the measures that prevent dangerous movement.
Do not improvise a brake circuit from a controller output and assume that loss of power covers every fault. The complete protective arrangement needs engineering assessment, including faults that leave an output energized or prevent a brake from applying.
Passenger lifts need a complete safety design
For passenger service, start with a qualified lift specialist and the applicable legal and technical requirements. Do this before committing to the controller, motor, drive or mechanical arrangement.
The safety design must address the complete installation rather than only its normal operating program. Depending on the lift arrangement, that includes:
- Access to the car, landings, travel space and machinery.
- Door locking and the conditions under which movement is permitted.
- Unintended movement, excessive speed and travel beyond intended limits.
- Load holding and the mechanical means of arresting dangerous movement.
- Inspection, maintenance, isolation and rescue arrangements.
- Fault detection, protective responses and conditions for returning to service.
These measures interact. An abrupt stop may introduce a different hazard, while a delayed stop may allow excessive travel. The required response must follow the hazard assessment and the lift's mechanical design, not a generic rule to remove all power immediately.
A successful run between floors demonstrates normal motion only. It does not establish the behavior of protective functions under faults, deterioration or maintenance conditions. Documented verification and validation belong in the project scope from the start.
Set a firm boundary around a demonstrator
For a non-passenger demonstrator, define a physical boundary that keeps hazardous movement inaccessible. Keep the platform, suspension, counterweight and pinch points inside that boundary. Loading and adjustment must not require reaching into an active mechanism.
The demonstration should remain within its assessed load, speed and travel limits. Increasing any of them can change stopping distance, brake demand and the consequences of a failure. Reassess the project rather than assuming that an earlier result still applies.
Plan servicing separately from normal operation. A suspended assembly may need a purpose-designed mechanical support before access is allowed. Removing power alone does not remove gravitational energy.
Testing must also stay within the safety boundary. Do not disconnect feedback, defeat an access protection or deliberately remove holding capability with an exposed suspended load. Fault-response checks need an approved test method, suitable restraint and exclusion measures. Begin with non-hazardous simulation or isolated component checks where appropriate, then follow the documented commissioning plan.
The useful distinction is not “demonstrator versus real lift.” It is whether the hazards are understood and controlled for every intended activity.
Give the designer a usable project brief
The first hardware question should be what the system must safely do, not which drive family to buy. Provide enough information to establish that requirement:
- Intended payload and whether passenger access is possible.
- Platform and load masses, travel distance and intended speed.
- Suspension, transmission, counterweight and brake arrangement.
- Access points, guarding and maintenance activities.
- Required stopping and positioning behavior.
- Supply-loss behavior and arrangements for recovery or rescue.
- Installation location and applicable approval process.
The resulting design should identify each protective function, its required behavior and how that behavior will be verified. Component manuals then establish whether the proposed hardware supports the design. They do not replace the design itself.
Keep passenger information outside the safety boundary
A passenger information screen has a different job from the lift controller. Notices, building information and general messages must not become the only means of indicating a safety-critical condition or carrying out a required emergency function.
For the separate task of planning an information display, the elevator screens guide covers the buying considerations. Keep required lift indications and emergency systems within the qualified lift design. A display that shows useful information is not evidence that movement is permitted, doors are secure or the platform is safe to enter.
Questions
Can an ordinary controller be used in a lift project?
An ordinary controller can coordinate normal movement, but that does not make it suitable as the sole means of performing protective functions. Suitability depends on the lift class, hazards and applicable requirements. Passenger lifts need a qualified safety design covering the entire installation, not just its operating program.
Does encoder feedback make an elevator safe?
No. Encoder feedback helps regulate motion, but it does not secure a suspended load by itself. A motor encoder may also fail to detect a mechanical problem downstream of its measurement point. Load holding and protection against dangerous movement need separate assessment.
Does Safe Torque Off hold a lift in position?
No. Removing motor torque does not remove gravity or mechanically secure a suspended load. The required stopping and holding measures depend on the lifting arrangement. A vertical-axis design must coordinate drive safety functions with suitable braking and mechanical protection.
Does a small lift demonstrator still need protective measures?
Yes, wherever its motion or stored energy can cause harm. Small mechanisms can still create pinch points, falling-load hazards and maintenance risks. Assess the demonstrator's load, speed, travel and access, then define guarding and servicing measures before operation.
Planning information, not legal or engineering advice. Rules differ by place: check codes and permits with your local authority and your licensed trades.