How lift safety functions work together

Different hazards need different protections.

Door locking, movement permissions, braking, overspeed protection and end-of-travel provisions serve different purposes. Some prevent a journey from starting. Some stop or hold the car. Others respond only to a particular fault.

Start with three questions: What could go wrong? What detects it? What physically prevents or stops it? A controller indication describes one condition; it does not prove that every device can perform its job.

A missing door-lock condition.

Example: a required landing-door lock is not proved

The normal travel permission is withheld. This prevents a commanded journey from starting under that condition.

That is different from a governor responding to excessive speed, or a brake physically holding a stationary car. Removing permission and holding the load are separate jobs.

Read door locks and interlocks alongside lift safety circuits to follow the relationship between the mechanical condition and its electrical indication.

Match the protection to the hazard.

A normal journey with a required door condition missing: Door interlocks and the safety circuit withhold the relevant movement permission. A door detector that reopens closing doors has a different job.
Gravity trying to move a stationary traction car: A suitable brake provides holding force. Removing motor torque alone does not hold an unbalanced load.
Excessive car speed: In a conventional governor-and-safety-gear arrangement, the governor detects overspeed and the gear acts on the guide rails. The protected direction and functions depend on the design.
Excessive fluid loss from a hydraulic cylinder line: A suitable cylinder-side rupture valve can stop the resulting descent. Hydraulic rupture protection differs from ordinary load holding and pressure relief.
Travel beyond the normal stopping range: Terminal and final-limit provisions act at defined positions. Buffers provide a separate end-of-travel function; they are not normal floor-stopping devices.
Unintended movement away from a landing with doors open: UCMP detects the defined unintended movement and uses a suitable stopping means. This hazard can arise before an overspeed threshold is reached.

These are examples of roles, not a complete list of the protective provisions on every lift.

What is Unintended Car Movement Protection?

UCMP means Unintended Car Movement Protection. It addresses the hazard of the car moving away from a landing with the doors open. A person crossing the threshold could be trapped or crushed between the moving car and the fixed landing.

A car does not have to reach its governor's overspeed threshold to create that hazard. Even relatively slow movement changes the opening that a person is passing through. UCMP and overspeed protection therefore address different conditions.

Detect: the designed arrangement recognises movement outside its permitted conditions using the relevant door, position and movement information.
Act: its safety control triggers the specified stopping means.
Stop and hold: a suitable brake, valve arrangement or other designed device arrests the car and keeps it stopped.

For example, a traction installation may use a brake assessed for that safety role. A hydraulic installation may use a suitable shut-off or redundant valve arrangement. An ordinary brake or valve cannot be assumed to provide UCMP simply because it can stop normal travel.

Some installations allow carefully controlled levelling or re-levelling with doors open within a defined zone. That designed operation is different from uncontrolled departure. The permitted conditions, monitoring and stopping performance belong to the complete installation design.

Three different ways to look after safety.

Keeping a lift in good condition, examining it and testing a particular function answer different questions. One activity does not automatically replace the others.

Maintenance: Work to keep equipment in suitable working condition: for example, lubrication, adjustments and replacement of worn parts. Its records describe the servicing and repairs carried out.
Thorough examination: A systematic assessment by a competent person to identify defects that are, or could become, dangerous. It results in an examination report, with findings and any required action.
Testing: A way to obtain evidence about a particular condition or function. The competent person determines what testing is needed for an examination, taking account of the risks, manufacturer information and relevant guidance. There is no single test list for every lift.

The examiner must be sufficiently independent and impartial to judge the equipment objectively. HSE explains that employment by another organisation is not essential, but the examiner should not be the person who carries out its routine maintenance.

Forge uses third-party providers for LOLER examinations, keeping that assessment separate from our servicing and repairs. Our LOLER engineer guide, maintenance page and supplementary testing page explain the practical arrangements.

A closer look

Stopping is not instantaneous. The car travels while movement is detected, while the control responds and while the stopping device develops force. The complete protective arrangement must account for those stages and the load; having a detector and a brake on a parts list is not enough.

A device can serve more than one function when designed and assessed to do so. That does not make the functions interchangeable. Different lift types, installation dates and later modifications also mean that protective arrangements vary; this overview does not establish compliance for a particular lift.

Check your understanding

Does one healthy safety indication prove that every protective function is healthy?

Reveal the explanation

No. Each function has its own scope, components and evidence requirements.

Apply the idea

Missing permission or unintended movement?

Compare two situations. In the first, a required door-lock condition is missing before a journey starts. In the second, the car begins drifting away from the landing with doors open, below its overspeed trip speed. Why is the same explanation not enough for both?

Show the reasoning

The first concerns withholding normal travel permission through the interlock and safety-control arrangement. The second concerns detecting and physically stopping unintended movement: UCMP addresses that specific open-door hazard. An overspeed device need not have reached its operating condition. Neither a normal movement permission nor one healthy indication proves that all protective functions work.