Topics in Escalator Electrical Design

Lutfi Al-Sharif B.Sc., M.Sc., Ph.D., C.Eng., M.I.E.E.
Senior Electrical Engineer
Department of Lifts & Escalators
London Underground Ltd.


Elevator Technology 6, Proceedings of the International Conference on Elevator Technology (Elevcon ‘95), March 1995, Hong Kong.



This paper attempts to discuss various topics in escalator electrical design.  It concentrates on the use of the various electrical standards and how they relate to each other and to the escalator standards specifically.  It introduces the concept of the so-called electrical standards pyramid, and how it relates the escalator system components and to electrical systems in general.

Following a general introduction to the concept of a safety device in the escalator control system, the safety devices within the escalator system as required by EN 115 are discussed.  The implementation of safety critical devices within the escalator controller is discussed, in the form of the so-called safety relays.

Within modern control systems, there is a need to monitor the status of safety devices in order to feed this information into a remote monitoring system, or just for simple maintenance information systems.  Different methods for safety device monitoring are discussed, with the advantages and disadvantages of each.


1.0  Introduction

Escalators have special standards, which cover electrical and mechanical aspects.  However, these standards tend to be more mechanically biased, and only partly specify the electrical requirements of escalators.

Taking EN 115 (the European standard for escalators and passenger conveyors) as an example, it is seen that it explicitly excludes the national wiring regulations from applying to the escalator installation.  However, EN 115 only answers a limited number of questions relating to the electrical design, such as the following:

13.1 Insulation resistance, maximum voltages; 13.2 Component categories; 13.3 Protection of motors; 13.4 Main switches; 13.5 Electrical wiring; 13.6 Socket outlets; 14.1 Safety concepts and devices; 14.2 Controls; 5.2 and 6.3.2  Lighting; 6.3.3 Stop switches; 7.8  Broken handrail switch; 12.4 Braking system and logic; Overspeed and reversal

All these points could be summed up as follows:  Control logic for starting, braking and stopping; safety devices; lighting, electrical wiring and isolation.

The standard does not cover (understandably) all possible areas, such as:

Cable sizing and selection; Electrical overcurrent protection devices; Electrical assemblies (designing and testing); Symbols for electrical components; Motors; Components; Circuitry design; Interference; Harmonics.

Thus, in order to comprehensively design the escalator installation in accordance with the standards, the engineer has to shop around within other electrical standards.  The same problem applies to any electro-mechanical system:  food processing plants, lifts escalators, plastic moulding machines, generation plants and sub-stations.

This paper will discuss the relationship between electrical systems and electrical standards.  It will also discuss in detail the concept of a safety device within the European standard, with particular reference to the use of safety relays and the methods of monitoring the status of these devices.  


2.0  The Electrical Standards Pyramid

There is a great simililarity between electrical standards and electrical systems: they tend to group themselves into hierarchies.  Within systems, components are combined to form assemblies, via certain processes.  These assemblies are then joined and installed to form the final system.  This is depicted in Figure 1, which shows such a concept as a Pyramid, called the electrical standards pyramid.  Standards not only exist for components, but also for processes of joining them together (e.g., wiring regulations, and standards for assemblies).

It can be seen that the components and systems pyramid is mirrored by an identical standards pyramid.  This re-inforces the concept of the using standards within the design process.


Figure 1:  The electrical standards pyramid.

Figure 2 shows this pyramid applied to the escalator system, where each oval shows the component or assembly, and also identifies the corresponding standard or regulation which is applicable.

This concept highlights the idea that EN 115 only covers part of the escalator installation requirements.  Many other standards are needed to ensure full compliance and sound design.  The list of references at the end of this paper includes some of the standards necessary for such a design.  Although they are listed from a British and European perspective, a similar list could be compiled for any other country.


Figure 2:  The electrical standards pyramid, The escalator example.


3.0 Safety Devices

Although modern escalators employ electronic control, the safety line is still retained.  The safety line is a hardwired circuit which contains contacts from all the safety devices wired in series.  The end of the safety line activates the final main contactors which switch the supply to the motor.  Figure 3 shows a typical arrangement.

All discussions relating to safety devices in this paper will refer to the European standard, EN 115 (unless otherwise specified), and any clause reference number will be taken from that standard.

All electrical safety devices are wired in series, forming the so-called safety line or safety chain.  All safety devices should act directly on the final contactors.  When operated, a safety device shall prevent the setting in motion of the driving machine or immediately initiate its stopping.  The operational brake shall be applied.

Electrical safety devices shall act directly on the equipment controlling the supply to the driving machine.

The concept of a separate safety line is quite important in escalators (and lifts) because it removes the safety critical elements from the electronic programmable systems and puts it in a separate hard-wired configuration. 

Each component monitoring a safety function is called a safety device.  This is detailed in 14.1.2, and termed electrical safety devices.  Electrical safety devices are divided into two categories:  safety contacts ( and safety circuits (  A safety contact has to satisfy several requirements, the most important of which is that "its operation shall be by positive mechanical separation of the circuit breaking device".  If a safety device does not satisfy the requirements of a safety contact, or if it does not directly act on the final contactor, then it is called a safety circuit.  A safety circuit should satisfy the requirement of the dangerous situation clause (, which requires that "if one fault combined with a second fault can lead to a dangerous situation, then the escalator... shall be stopped by the time the next operating sequence takes place...". 

Table 1 shows all functions causing automatic stopping of the escalator.  Some of them are not safety devices.  Moreover, some of them should be reset before the escalator can be re-started.

3.1  Automatic and Visual Detection of a Fault

The previous argument is based on a very important assumption.  The standard assumes that the checking of whether the first fault has developed is not carried out visually, but automatically.   Thus, if a fault develops, it will automatically be detected by the controller, which will not restart the escalator unless the fault has been rectified.

It also precludes the possibility of another fault developing before the escalator has stopped.

So, CEN (European Committee for Standardization) assumes that a redundancy type circuit can fail by subsequent failure of one component after another and therefore CEN requires continuous or cyclical checking redundancy.  This is contrary to other standards (e.g., A17.1, U.S. equivalent, ASME,1993), which assume that there is no possibility for the second failure occurring before the first is visually detected and manually corrected (by service mechanics) and also that there is no risk of two simultaneous failures.


Figure 3:  Safety devices  (safety contacts) directly acting on the main contactor.

3.2 Safety Relays

3.2.1  The use of regular relays for interfacing

As discussed in the last section, when a safety device cannot be connected directly in the safety line, in order to act on the final contactors it is classified as a safety circuit (as opposed to a safety contact.  There are several reasons why this cannot be achieved.

When this case arises, one possible solution could be to use a standard relay as an interface, which is operated by the safety device, and then to use the contacts of this standard interface relay to be wired in the safety line. The danger with such an approach is that it is not fail safe:  if the relay welds or jams, it will keep the main contactor operational, regardless of the status of the safety device, thus making the safety device ineffective and leading to a dangerous situation.

3.2.2  The use of safety relays

One way of eliminating the danger associated with using an intermediate standard relay is to use redundancy, i.e., more than one relay.  This is the subject of a different standard, EN 60204, part1.

Self-     resetting 
Description  Implementation  Safety Device   
         a         • No volts No volts relay on control voltage  
         b         • Earth fault Residual current device  
         c         • Thermal overload Thermal overload relay in series with motor windings  
         d         • Thermistor in windings Thermistors in windings connected to thermal relay  
         e   Overspeed Overspeed detection device           •
         e   Reversal of Direction Usually achieved by underspeed detection           •
         f   Auxiliary brake Contact on auxiliary brake           •
         g   Breakage of step or elongation Carriage tension or slackness switch(es)           •
         h          • Reduction of distance between stations  Carriage tension or slackness switch(es)            •
          i          • Comb (foreign bodies) Comb-plate switch           •
          j          • Stopping of succeeding escalator Hardwired stop circuitry            •
         k          • Handrail entry guard Handrail entry guard switch  
         l    Sagging step Low step detector (at both landing, before the comb-plates)            •
        m          • Broken handrail  Broken handrail switch or handrail speed sensor             •

Table 1:  Items causing automatic stopping of the escalator (EN 115).

In order to overcome the danger associated with the use of standard interface relays, the standard EN 60 204: Part 1, "Safety of Machinery: Electrical Equipment of Industrial Machines:  Part 1.  General requirements" details the use and application of a fail safe configuration of interface relays.  Provisions for redundancy

By providing partial or complete redundancy it is possible to minimize the probability that one single failure in the electrical circuit can give rise to a hazard.

3.2.3 Implementation of safety relays

One possible implementation of such a system is shown in Figure 4.  

The whole setup including the three relays with all the contacts is available as a complete unit, usually called a safety relay.  The safety contact (e.g., stop switch or output from a electronic speed detection unit) is wired between points A and B.  The supply would most probably be 110 V AC.  The reset pushbutton (if applicable) is wired between the points C and D.  The terminals E and F are connected to the controller (e.g., logic controller) for monitoring purposes, while terminals G and H are wired in the safety line, to act on the final contactors feeding the motor.

3.2.4 Normal operation mode of a safety relay

The normal sequence of operation of such a setup is as follows:

When the supply is switched on all three relays K1, K2 and K3 should be off (de-energised).   The terminals wired in the safety line should be open, as well as the terminals wired for monitoring.

To energise the safety relay, the safety device contact has to be closed in order to make point B and thus point C live, and then the reset pushbutton can be pressed.  Once the reset pushbutton is pressed, relay K3 is energised, because point D becomes live.  When relay K3 has energised, it closes its normally open contacts which operate relays K1 and K2.  This causes relays K1 and K2 to energise, and self latch (electrically) through their self latching contacts.  So, when the reset pushbutton is released, relay K3 de-energises, but relays K1 and K2 are still energised.  Thus the terminals EF are closed (which need K3 to be de-energised and relays K1 and K2 to be energised) as well as terminals GH.

When the safety device contact opens, it makes point B dead, and thus the relays K1 and K2 de-energise (drop), thus opening the connection between terminals EF and GH, and consequently opening the safety line and tripping the main contactor.

Figure 4:  Example of the implementation of a safety relay. 

3.2.5  Failure modes of a safety relay

The possible failures within the system, are as follows:

The welding (non-separation of the moving armature of a relay) of one of the three relays, K1, K2 or K3.  It will be assumed that the safety device contact has opened.

If K1 has welded (the armature is jammed), then only K2 will drop out and K1 will stay attracted.  When the safety contact is closed again and the reset pushbutton is pressed, it will not activate relay K3, because the normally closed contact of K1 would still be open (because K1 has welded).  Thus the system would not reset and would need intervention.

The same applies in the case of K2 welding.  The possibility of both K1 and K2 welding is considered to be too remote to be considered.

If K3 welds, then the contacts of terminals GH will not be made, and thus the safety line will stay open, thus requiring intervention.

It can be seen how such operation provides for both redundancy (by using two relays rather than one relay) and by providing automatic detection of any fault developing within the relay.  Thus, it does not rely on visual human detection, and will not reset if there is a problem.

3.2.6  Resetable and non-resetable configurations

The relay configuration can be either used in a resetable setup or a self resetting setup.  By shorting out terminals C and D, the relay will automatically reset itself once the safety device contact is closed again, unless K1 or K2 has welded, whereby it will fail to reset.


4.0  Safety Device Status Monitoring

There is  a need with modern solid state controllers to monitor the state of safety contacts and safety devices.  This is useful in condition monitoring and in troubleshooting, where the information about the safety devices in stored in the solid state controller.  Several methods exist for achieving this objective, provided that they do not jeopardise the integrity of the safety line.  This section discusses some of these methods, with their advantages and disadvantages.

4.1  The Use of Double Pole Safety Contacts

In this method, the safety devices are equipped with double pole contacts, as shown in Figure 5.  One pair of contacts is hardwired in the safety circuit.  The other pair is used by the solid state controller for monitoring.

The disadvantage of double pole contacts is that they are not always available on every safety device.  However, this configuation is fail safe, as their is no interaction between the safety line and the control logic.


Figure 5:  Using double pole safety contacts.

4.2  Electronic Interface Circuits

In some cases, the safety device has only one pair of contacts.  In such a case, the contact is wired in the safety circuit, and an electronic interface unit (IU) is used to feed the information to the controller.  The Interface Unit is optically isolated from the controller, and incorporates a resistor for limiting the current, a full wave rectifier (if the safety line voltage is AC) and a capacitor for filtering.  An example of such a setup is shown in Figure 6.


Figure 6:  Using electronic interface units for monitoring safety contacts.

The main advantage of such a setup is that it only requires one pole for the safety device.  However, if the common line connected to the terminals of the interface units becomes loose or disconnected, the equivalent impedance of these units might short out a safety contact.  There would be no automatic detection of the fault by the controller, to prevent re-starting of the escalator in case of a fault.

To protect against this situation, the value of the impedance of these units has to be carefully selected.  Moreover, several common points should be connected between the common side of the IU's and the common point.

4.3  The Use of Single Pole Contacts with a Safety Relay

When only one pole is available, another method is to use a safety relay, which is operated via a single pole contact from the safety device, as shown in Figure 7.  The safety relay is self checking.  Two pairs of output contacts are used from the relay.  One pair is hardwired in the safety circuit, while the other is used by the controller for monitoring.  This method is fail safe.  However, the cost of the safety relay has to be taken into account.


Figure 7:  The use of a safety relay to monitor the safety device.


5.0 Conclusions

In order to comprehensively design an escalator installation in accordance with all the required standards, a large number of standards have to followed.  This is due to the fact that the escalator standards in general only cover a limited number of electrical issues.

Systems and the relevant standards are similar in their hierarchy, and this could be represented in a form of pyramid (the electrical standards pyramid), which shows how all the components are joined together to form the sub-systems and then the final system, using various processes.

Safety devices are dealt with in detail within the escalator standards, and should act directly on the final driving devices.  They are sub-divided into safety contacts and safety circuits, depending on whether or not they satisfy particular requirements.

Three methods can be used to monitor the status of safety devices, in order to feed their status into the monitoring system.  If double pole safety devices are not available, then a fail safe method is to use a single pole contact and operate a safety relay, the contacts of which are wired into the safety line, and connected to the monitoring system.



  1. American Society of Mechanical Engineers, 1991, "ASME-A17.5-1991: Elevator and Escalator Electrical Equipment", ASME, 1991.
  2. American Society of Mechanical Engineers, 1993, "ASME-A17.1-1993: Safety Code for Elevators and Escalators", ASME, 1993.
  3. BSI, 1988, "BS 88, Cartridge fuses for voltages up to and including 1000 V a.c. and 1500 V d.c., Part 1.  Specification of general requirements", [IEC 269-1: 1986].
  4. BSI, 1980, "BS 5953, Guide on power transformers, Part1, Application of power transformers", [IEC 606: 1978].
  5. BSI, 1987,  "BS 4999, General requirements for rotating electrical machines".
  6. BSI, 1978, "BS 5000, Rotating electrical machines of particular type or for particular applications, part 10, General purpose induction motors".
  7. BSI, 1965, "BS 3871, Miniature and moulded case circuit-breakers, Part 1.  Miniature air-break circuit breakers for a.c. circuits".
  8. BSI, 1983, "BS 4293, Residual current-operated circuit breakers".
  9. CEN, 1983, "EN115: Safety rules for the construction and installation of escalators and passenger conveyors", May 1983.
  10. CEN, 1992, "Safety of machinery.  Emergency stop equipment, functional aspects - Principles for design", October,1992.
  11. CEN, 1985, "EN 81 Lifts and Service lifts: Part 1.  Safety rules for the construction and installation of electric lifts".
  12. CEN, 1992, "Draft prEN 115: Safety rules for the construction and installation of escalators and passenger conveyors", April 1992.
  13. CENELEC, 1993, "EN 60947/A1, Low-voltage switch-gear and control-gear, part 2: Circuit breakers", April 1993, [IEC 947-2: 1989/A1: 1992].
  14. CENELEC, 1992, "EN 60947-4-1, Low-voltage switch-gear and control-gear, part 4: Contactors and motor starters, Section one: Electromechanical contactors and motor starters", January 1992, [IEC 947-4-1: 1990].
  15. CENELEC, 1991, "EN 60947-5-1, Low-voltage switch-gear and control-gear, part 5: Control circuit devices and switching elements, section one: Electromechanical control circuit devices", October, 1991, [IEC 947-5-1: 1990].
  16. CENELEC, 1992, "EN 60204: Part 1: October 1992: Safety of machinery, Electrical equipment of industrial machines: Part 1. General requirements", October, 1992, [IEC 204-1: 1992, modified].
  17. CENELEC, 1990, "EN 60439: Part 1: Low voltage switchgear and controlgear assemblies: Part 1.  Requirements for type tested and partially type-tested assemblies", February, 1990, [IEC 439-1: 1985, modified].
  18. CENELEC, 1991, "EN 60529, Degrees of protection provided by enclosures (IP code)", October, 1991, [IEC 529: 1989].
  19. CENELEC, 1992, "EN 50081, Electromagnetic compatibility - Generic emmision standard, part 1:  Residential, commercial and light industry", January, 1992.
  20. CENELEC, 1992, "EN 50082, Electromagnetic compatibility - Generic immunity standard, part 1:  Residential, commercial and light industry", January, 1992.
  21. Electricity Association, 1976, "G.5/3, Limits for harmonics in the United Kingdom electricity supply system".
  22. Elevator World, 1994, "Escalators - Safety for users", Elevator World, August, 1994.
  23. Health and Safety Executive, 1990, "Memorandum of guidance on the Electricity at Work Regulations 1989", Health and Safety series booklet HS(R)25.
  24. Health and Safety Executive, 1983, "Guidance Note PM 34, Safety in the use of escalators", Plant and Machinery , PM 34, November, 1983.
  25. Health and Safety Executive, 1984, "Guidance Note PM 45, Escaltors: periodic thorough examination", Plant and Machinery Series, PM 45, June 1984.
  26. Institution of Electrical Engineers, The, 1991, "Regulations for electrical installations", Sixteenth Edition, 1991.
  27. ISO, 1990, "ISO/TR 11071-1, Comparison of world-wide lift safety standards", Technical committee ISO/TC 178, Lifts, escalators, passenger conveyors, 90/81081.
  28. Pilz GmbH, 1993, "A guide to the European machinery Safety Standards", November, 1993.
  29. Pilz GmbH, 1993, "Safety products: Catalogue", January, 1993.
  30. Pilz U.K., "Type PNOZ 2:  Emergency stop unit in accordance with VDE 0113, IEC 204-1 and BS 2771".
  31. Square D, "Safety guard system Preventa:  Monitoring modules Type GSK for Emergency stop and safety circuits".