Elevators are statistically safer than stairs. The reason isn't luck — it's a stack of independent safety systems that have been refined for over 170 years, since Elisha Otis first demonstrated his rope-cutter brake in 1854.
Four layers do the work. The controller watches the car continuously and cuts motor power at the first sign of overspeed or rope slack. The machine brake clamps the drive sheave electromechanically the moment power is lost. The governor and safety brake — a purely mechanical pair — engages if the car ever runs faster than its rated speed, no matter what the electronics are doing. Buffers in the pit absorb impact as a last physical line of defense.
No single failure can drop the car. The engineering assumption is that any one layer might fail; the others always catch it. Below: what each device does, how they trigger, and why the "elevator free-fall" scenario exists only in movies.
The Layers of Defense
Every safety device on an elevator answers a different question. The controller asks, "Is anything wrong with how this car is moving?" The machine brake asks, "Is power still on?" The governor asks, "Is the car going faster than it should?" The buffers ask nothing — they just sit at the bottom of the pit and wait.
The order matters. Electronic systems are fast and can stop a problem before it becomes one. Mechanical systems are slow but rated for catastrophic-failure scenarios. The way a passenger experiences this: in 99.99% of incidents, the controller has already stopped the car before any of the other layers wakes up.
Controller Monitoring & Slack Rope Detection
The controller is the elevator's brain. Modern controllers are microprocessor-based and watch dozens of inputs — car position, motor current, hoist rope tension, door state, hall calls — at sample rates of hundreds of times per second.
Two detections matter most for safety. Overspeed monitoring compares actual car speed to the speed the dispatch profile expects; if the car is even slightly fast, the controller cuts motor power and engages the machine brake. Slack rope detection uses tension sensors on the hoist ropes; a sudden drop in tension means an obstruction below the car or a rope failure, and the controller stops everything.
This is the layer that actually intervenes in real-world problems. By the time the governor would trip, the controller has usually already stopped the car.
Machine Brake (Electromagnetic)
The machine brake is an electromagnetic disc brake on the drive sheave. It is held open by an electromagnet — power flowing through a coil holds the brake shoes off the disc. The instant power drops (intentionally cut by the controller, or lost to the building entirely), springs slam the shoes against the disc and the sheave stops turning.
This is fail-safe by design. A power outage, a tripped breaker, a controller fault — anything that interrupts current to the brake coil — applies the brake automatically. You don't do anything to set the brake; you stop doing the thing that holds it open.
Hydraulic elevators don't need a machine brake in the same sense — gravity holds the car at rest because the valve blocks oil flow when not commanded. Same principle, different mechanism.
Governor and Safety Brake
If the controller missed the problem and the machine brake somehow failed, the governor catches it.
A governor is a centrifugal speed-monitoring device that lives at the top of the hoistway, connected to the car frame by its own dedicated rope. As the car moves, the governor rope spins the governor sheave at a speed proportional to car speed. If that speed exceeds a threshold defined in ASME A17.1 — typically 115% of rated car speed for the overspeed governor and a higher value for the safety brake itself — centrifugal weights swing out and grab the governor rope. The rope yanks a linkage on the car frame that drives steel jaws into the guide rails. The car stops, hard.
This system is purely mechanical. No electronics. No power required. If every wire in the building were cut, this would still work.
Door Interlocks
Door safety is a different layer because it solves a different problem: not falling, but not moving when a door is open.
Every landing door — the door on each floor — has an interlock, an electromechanical lock that keeps the door shut unless the car is physically at that floor. The car can't move unless every interlock confirms its door is locked. This is a series circuit: one open interlock anywhere on the building kills the whole chain.
This is why elevator doors don't just pop open between floors. It's also why a single faulty interlock on the 14th floor can shut down the entire elevator — the system doesn't know why the interlock is open, only that it is.
Buffers (Spring vs Oil)
At the bottom of the pit sit the buffers. If everything above failed and the car traveled below the lowest floor, these absorb the impact.
Spring buffers are used on lower-speed elevators (typically below 200 ft/min). They're cheap, durable, and require no maintenance. Oil buffers are required for faster elevators — they damp the impact more smoothly, but they need periodic inspection and oil-level checks.
Matching buffers sit under the counterweight too. They're the last physical barrier. In a properly maintained elevator, they should never see real action.
Power-Loss Behaviour: ARD and Battery Lights
The "what if the power goes out" question is one of the most common, so it deserves its own section.
When power drops, the machine brake sets immediately and the car stops wherever it is. The cab lights switch to battery backup — typically 4 hours of emergency lighting. You're not in the dark.
In modern installations, an automatic rescue device (ARD) kicks in. The ARD is a battery pack that uses just enough power to drive the car at low speed to the nearest floor, level it, and open the doors so passengers can walk out. Most ARDs complete this sequence within 60 seconds.
If the building has an emergency generator, elevators connected to it will return to normal service once the generator spins up — usually within 30–60 seconds.
Older elevators without an ARD will sit until power is restored. Either way: well-ventilated, plenty of air, no danger. The "sealed-box-running-out-of-air" scenario is a myth.
How Often These Are Tested
Safety devices aren't installed-and-forgotten. They're tested on a cadence defined by jurisdiction.
In most US states, the schedule is governed by ASME A17.1 and looks roughly like this:
- Routine inspection: every 6–12 months. Visual, functional checks of doors, controller, brakes, buffers.
- Category 1 test: annually. Tests the safety brake at low speed, the governor trip mechanism, the machine brake holding power.
- Category 5 test: every 5 years. Full safety brake test at rated speed — the governor actually trips, the safeties actually engage, with weights in the car.
Specific cadence varies by state. See Elevator Codes and Regulations for jurisdiction-specific inspection requirements.
Inspections must be performed by a QEI-certified inspector. Most states require inspection records to be posted in the elevator cab.
FAQ
Can an elevator fall if the cables break?
No. Traction elevators use multiple independent hoist ropes — typically four to eight — and each one is rated to hold the full car alone. Even in the impossible scenario where every rope snapped simultaneously, the governor would trip and the safety brake would clamp the guide rails mechanically, with no power required. Hydraulic elevators can't free-fall at all because the car sits on a piston, not on cables. The "elevator falling" scenario requires so many simultaneous failures that no documented modern incident matches it.
What happens if the power goes out in an elevator?
The machine brake sets immediately and the car stops where it is. Cab lights switch to battery backup, typically 4 hours of emergency lighting. In most modern elevators, an automatic rescue device (ARD) uses battery power to move the car slowly to the nearest floor and open the doors, usually within 60 seconds. Older elevators without an ARD will sit until power is restored or a technician arrives. Elevators are well-ventilated; passengers aren't at risk of running out of air.
Has anyone ever died from an elevator falling?
Documented passenger fatalities from elevator falls in modern (post-1900) elevators are extraordinarily rare. The fatalities the industry tracks are overwhelmingly maintenance workers — technicians caught between car and shaft, falls into open hoistways during construction, or work performed without proper lockout. The Bureau of Labor Statistics tracks these separately from passenger incidents. For passengers, elevators have a fatality rate per billion trips that is significantly lower than stairs.
How often are elevator safety systems tested?
A typical schedule under ASME A17.1: routine inspection every 6–12 months (visual + functional), annual Category 1 test (low-speed governor trip and brake hold), and every-5-year Category 5 test (full safety brake test at rated speed with weights). Specific cadence varies by state — see Elevator Codes and Regulations for jurisdiction-specific requirements.
What's the difference between a governor and a brake?
The governor is the trigger — a centrifugal device that detects when the car is moving too fast. The safety brake (or "safeties") is the stop — the steel jaws on the car frame that clamp onto the guide rails when the governor trips. They work together but they're different devices. The machine brake is a third, separate device — an electromagnetic brake on the drive sheave that engages whenever power is lost.
Are old elevators safe?
Yes, when properly maintained. Many elevators in service today were installed decades ago and pass their annual inspections every year. The safety principles haven't changed since Otis 1854; the implementations have just gotten more refined. The risk on older elevators isn't the design — it's deferred maintenance. A 60-year-old elevator with a current inspection certificate is statistically very safe; a 5-year-old elevator that's missed two annuals is the one to worry about.
Related Reading
- How Elevators Work: A Complete Guide — foundational explainer covering systems and components
- Types of Elevators — traction, hydraulic, MRL — each has slightly different safety systems
- Elevator Codes and Regulations — jurisdiction-by-jurisdiction inspection cadence and licensing
- Elevator Modernization — when to upgrade older safety systems, what gets replaced