LUNAROPS · OPERATIONAL UPLINK 100% UPTIME 1,247d POSTS 893 JEFF.MOON@LUNAROPS.DEV UTC --:--:--

How Elevators Actually Work

12 min read Engineering the Everyday
mechanical-engineeringelevatorssafety-systemscontrol-systemsinfrastructureeveryday-engineering
Contents

The elevator is statistically the safest way to travel that humans have ever engineered, and it earns that title not through a single clever device but through layers of mechanical paranoia stacked one atop another, each assuming the layer above it has already failed. The cable cannot snap in normal use, but the system is designed as if it will. If it does, a speed-sensing governor trips. If the governor’s brake fails, redundant cables share the load. If all of that fails, a buffer waits at the bottom. The popular image of an elevator — a box dangling from a rope over a deadly shaft — is exactly backwards. The box is one of the most over-constrained objects in a building, and the “rope” was the thing Elisha Otis made safe in 1853 by publicly cutting it on stage and not falling. Understanding how an elevator works is mostly understanding why it refuses to fall even when everything that is supposed to hold it up lets go.

Traction versus hydraulic: two completely different machines

“Elevator” covers two fundamentally different drive systems, and which one a building uses is decided almost entirely by height.

A hydraulic elevator pushes the car up from below with a piston driven by pressurized oil. A pump forces hydraulic fluid into a cylinder; the ram extends and lifts the car. To descend, a valve simply opens and gravity pushes the car down, bleeding oil back to the reservoir — going down uses no pump energy at all. Hydraulics are mechanically simple, cheap, and need no overhead machine room, but they have a hard ceiling: the piston has to be as long as the travel (or buried in a drilled hole as deep as the building is tall), the ride gets slow and jerky, and the oil’s behavior makes them impractical above roughly six to eight stories. They dominate low-rise: parking garages, small offices, freight lifts.

A traction elevator is the machine in every tall building, and it does not push the car at all — it pulls a rope over a driven wheel. Steel ropes (or, increasingly, flat coated-steel belts) run from the top of the car, up over a grooved drive wheel called the sheave, and down to a counterweight on the other side. A motor turns the sheave; friction (“traction”) between the ropes and the sheave grooves drags the ropes along, raising one side while lowering the other. There is no piston length limit, so traction scales to the tallest buildings on Earth. The entire design hinges on one component that does the real work: the counterweight.

Hydraulic Traction (geared) Traction (gearless)
Drive Oil piston from below Motor + gearbox + sheave Direct-drive motor + sheave
Typical height 2–8 stories 5–25 stories 10–100+ stories
Speed ~0.15–0.6 m/s ~0.5–2.5 m/s up to ~10+ m/s
Counterweight None Yes Yes
Energy on descent Wasted (valve bleed) Can regenerate Regenerates strongly
Machine room Not required overhead Usually required Often machine-room-less

The counterweight is the whole trick

The single most important idea in a traction elevator is that the motor is not lifting the car. It is lifting the difference between the car and the counterweight, and that difference is engineered to be small.

The counterweight is sized to equal the weight of the empty car plus about 40–50 percent of its rated passenger load — a value called balancing at 50% load. With a half-full car, the two sides of the sheave are nearly equal and the motor barely works; it only has to overcome friction and provide a gentle nudge. With an empty or full car the imbalance is at most half the passenger load, never the entire car. The consequences are enormous:

        SHEAVE (driven wheel)
            ___
           /   \
      =====     =====
      |   |     |   |
      |   |     |   |
   [ CAR ]     [ COUNTERWEIGHT ]
   empty +     = car weight +
   people      ~45% of rated load
      |             |
   motor lifts only the DIFFERENCE,
   not the whole car

   Empty car going up:  counterweight is heavier -> motor brakes/regenerates
   Full car going up:   car is heavier          -> motor drives

This is why a traction elevator uses a startlingly small motor for the mass it moves, and why it can regenerate energy. When a full car descends or an empty car rises, the heavier side wants to fall and would drive the sheave on its own; the motor acts as a generator, braking the system and feeding power back. Modern gearless drives with variable-frequency control turn this into real savings — the same principle as regenerative braking in an electric car, where the motor that drives you also recovers energy when the load wants to move on its own. An elevator bank in a skyscraper can return a meaningful fraction of its consumption to the building this way.

The ropes themselves are redundant by code: a traction car hangs from typically four to eight independent steel ropes, each rated to hold far more than its share. A single rope carries only a fraction of the load, and the system is designed so that any one can fail with the rest holding the car easily. The “what if the cable snaps” fear assumes one cable; there has never been one cable.

Why it will not fall: governor, safeties, buffer

Suppose the impossible happens — every rope fails at once, or the sheave brake releases and the car begins to accelerate downward. This is the scenario the entire safety architecture exists for, and it is defeated by purely mechanical means that need no electricity, no software, and no human.

The first line is the overspeed governor. Alongside the car runs a separate governor rope, looped around a flywheel-like governor sheave at the top of the shaft. As the car moves, it drags this rope, spinning the governor. The governor is just a centrifugal speed sensor: if the car’s velocity exceeds its rated speed by a set margin (typically ~115% of rated for the first trip, higher for the next), spring-loaded flyweights fly outward and trip a catch. This is the same physics as a steam-engine governor, chosen precisely because centrifugal force is dead reliable and entirely passive.

Tripping the governor does two things. It clamps the governor rope, and because that rope is mechanically linked to the car, the sudden stop of the rope yanks a linkage on the car that drives the safeties — wedge-shaped or roller jaws mounted on the car frame that grip the guide rails running the full height of the shaft. On slower elevators these are instantaneous safeties that bite hard and stop the car abruptly; on fast elevators they are progressive safeties that squeeze the rails with controlled, increasing force to decelerate the car without injuring occupants. Either way, the car is now clamped to the steel rails and physically cannot fall, independent of the ropes entirely.

Below everything, at the pit floor, sits the buffer — a spring or an oil-filled hydraulic cylinder that absorbs the energy of a car that somehow reaches the bottom anyway. It is the last catch in a net no single failure can get through.

Layer Triggered by Mechanism Needs power?
Multiple ropes Normal operation Load shared 4–8 ways No
Sheave brake Loss of power / stop command Spring-applied disc brake No (fails safe)
Overspeed governor Car exceeds rated speed Centrifugal flyweights No
Car safeties Governor trip Wedges grip guide rails No
Pit buffer Car reaches bottom Spring / oil cylinder No

The critical detail in that table is the last column. The main brake on the sheave is spring-applied and electrically released — it is held open by power, so any loss of electricity, control, or signal causes the springs to slam the brake shut. The elevator’s default state, the state it falls into when anything goes wrong, is stopped. This fail-safe inversion is the heart of why elevators are safe: doing nothing means braking.

Leveling, doors, and the boring parts that hurt people

Catastrophic falls essentially never happen. The injuries that do occur cluster around two unglamorous systems: leveling and doors.

Leveling is the job of stopping the car flush with the floor. A car that stops a few centimeters high or low is a trip hazard, and it is the leading cause of mundane elevator injuries. Older systems used mechanical cams and slowdown switches; modern ones treat it as a closed-loop control problem, with the variable-frequency drive reading the motor’s position encoder and shaft sensors to ease the car into the floor within millimeters. It is fundamentally a position-and-velocity control loop — accelerate, cruise, decelerate along a smooth motion profile, then hold position against a shifting load as people walk in and out, exactly the kind of setpoint-tracking job that a PID loop is built for. The S-curve velocity profile you feel as a smooth start and stop is deliberately shaped to keep jerk (the rate of change of acceleration) low enough that you do not stumble.

Doors are where the real-world risk and the real-world complexity live. The car door and the landing door are mechanically coupled — the car carries the only motor, and a “clutch” or “vane” on the car door engages the landing door’s lock so they open together, only at a floor. This interlock is a hard safety requirement: the landing door is mechanically locked shut unless a car is actually present, which is what stops someone from prying open a hallway door into an empty shaft. Door reopening uses infrared light curtains or pressure edges to detect obstructions, and the closing force and speed are capped by code. The fact that doors are the most failure-prone, most-cycled, most safety-critical interface is why they account for a large share of elevator service calls.

The dispatch problem: fighting your wait

Once a building has several elevators, a new question appears that has nothing to do with mechanics: when you press the button, which car should come, and what should each car do? This is the dispatching or elevator scheduling problem, and it is a genuinely hard optimization that every elevator bank solves continuously.

The naive approach is collective control: a car traveling up answers all up-calls in its path before reversing, like a scan across floors, and the nearest suitable car takes a new call. It is simple and starvation-free but ignores load and can leave you waiting while a packed car sails past. Modern high-rise banks use destination dispatch, which inverts the interface: instead of pressing up/down and choosing a floor inside, you enter your destination floor at a lobby kiosk before boarding, and the system tells you which car to take. Knowing everyone’s destination in advance lets the controller group passengers heading to similar floors into the same car, drastically cutting the number of stops per trip and improving throughput during the brutal morning up-peak. The trade-off is a less intuitive experience and no ability to change your mind once committed.

The objective functions are subtle: minimizing average wait time, minimizing the worst-case wait (avoiding starvation), minimizing total travel time, and minimizing energy all pull in different directions. A system that always sends the nearest car can starve a low-traffic floor; one that perfectly balances energy can feel sluggish. Real controllers blend these with traffic prediction, learning a building’s daily rhythm — up-peak at 9, two-way lunch traffic at noon, down-peak at 5 — and pre-positioning idle cars where demand is about to appear. It is a scheduling problem disguised as a building fixture.

What breaks at extreme height

Traction elevators have no piston-length limit, but they do hit a different wall as buildings climb past about 500 meters, and the culprit is the rope’s own weight. Steel hoisting ropes are heavy, and in a very tall shaft the weight of the rope itself can exceed the weight of the car. This wrecks the balance the counterweight worked so hard to achieve — the imbalance now shifts dramatically depending on where the car sits in the shaft — so high-rise systems add compensating ropes hanging from the bottom of the car and counterweight to cancel the changing rope weight. Beyond a certain height even that is not enough: the steel rope cannot lift its own mass over the full travel, which historically capped a single elevator run at roughly 500 meters and forced supertall towers to use sky lobbies, where express elevators shuttle to a transfer floor and local elevators take over above it.

Two engineering responses pushed the ceiling higher. Double-deck cars stack two cabins in one shaft, serving two floors at once to double throughput without adding shafts — precious in a tower where elevator shafts can eat a quarter of the floor plate. And material science attacked the rope directly: KONE’s UltraRope replaced steel with a carbon-fiber core in a friction coating, roughly a fifth the weight of steel, which lets a single hoist run up to a kilometer and slashes the moving mass. The Jeddah and Burj-class towers exist in their current form partly because the hoisting rope stopped being made of steel. The mechanical principles are unchanged; only the materials moved.

Verdict

The elevator deserves its safety record because it was designed by people who refused to trust any single component, starting with Otis cutting the rope on stage to sell exactly that idea. The counterweight is the quiet genius — it means the motor lifts a fraction of the load and can hand energy back on the way down — but the safety comes from the stack of passive, power-free fallbacks: redundant ropes, a spring-applied brake that closes when power dies, a centrifugal governor that needs no electricity to sense overspeed, rail-gripping safeties that clamp the car to the structure, and a buffer waiting below. The default state of a properly built elevator, when anything at all goes wrong, is stopped and held. The dangers that remain are the prosaic ones — a car stopped a few centimeters off the floor, a door closing on a bag — which is a remarkable place for the engineering to have ended up. The box hanging in the shaft is not precarious. It is one of the most thoroughly distrusted, over-caught machines you will ever step into, and that distrust is exactly why you can step into it without a second thought.

Sources

Comments