An Otis stop is a mechanical safety gear that clamps an elevator car or mine cage to its guide rails the instant the hoist rope fails or the car overspeeds. It sits at the heart of every passenger elevator and every man-riding mine cage on the planet. A governor senses speed, trips a linkage, and forces hardened wedges or eccentric cams against the rails so friction arrests the fall. Elisha Otis demonstrated the principle in 1854 — and the modern descendants stop a 5,000 lb car inside 1 m of travel.
Otis Stop Interactive Calculator
Vary car weight, wedge clamp force, friction, wedge count, and stopping travel to see whether the safety gear can arrest the elevator car.
Equation Used
The calculator sums wedge friction force from clamp load, friction coefficient, and active wedge count. That upward friction must first balance the car weight; the remaining force gives the net stopping deceleration and the maximum entry speed that can be arrested within the selected travel.
- All active wedges share load equally.
- Friction coefficient is constant during the stop.
- Car weight is converted from lbf to newtons.
- Positive stopping speed requires friction force greater than car weight.
How the Otis Stop for Elevator Cars Works
The Otis stop is not one part — it is a chain of three subsystems that must all work together. A speed-sensing overspeed governor mounted in the hoistway head, a governor rope tied to the car, and the safety gear itself bolted to the car frame. When the car descends faster than rated speed (typically 115% for cars under 1 m/s, dropping to 105% at higher rated speeds per EN 81 and ASME A17.1), centrifugal flyweights inside the governor fly out, a jaw clamps the governor rope, and because the rope is now stationary while the car keeps falling, the rope yanks a lift-rod on the car. That lift-rod drives wedges or cams against the machined faces of the steel guide rails. Friction does the rest.
Why the elaborate chain? Because gravity sensing alone is unreliable — a slack rope or a stuck brake can let a car drift away without ever exceeding free-fall acceleration. Speed sensing catches every realistic failure, including a snapped hoist rope, a sheared sheave shaft, or a runaway counterweight. The geometry matters down to fractions of a millimetre. Guide rail thickness must match the safety jaw gap to within —0.5 mm — too loose and the wedges hammer before they bite, too tight and the safeties drag during normal travel and wear flat-spots into the rail.
Get the tolerances wrong and the failure modes are nasty. Wedge faces glazed with oil from a leaking guide-shoe lubricator will skid instead of grip — measured stopping distances triple. Governor rope tension below 150 N lets the rope slip through the jaw instead of yanking the lift-rod, so the safety never sets. And on progressive safeties, a worn return spring lets the wedge re-engage during normal upward travel, scoring the rail and demanding a full rail dress before the car returns to service.
Key Components
- Overspeed Governor: A flyweight-driven speed sensor mounted at the top of the hoistway. Trips at 115% of rated car speed for slow cars, tightening to 105% above 2.5 m/s. Once tripped, a jaw clamps the governor rope to a stationary sheave.
- Governor Rope: A 6-10 mm steel wire rope running in a continuous loop from the governor sheave to a tension sheave in the pit, with one end fixed to the car's safety lift-rod. Tension stays at 150-300 N — below that, the trip mechanism slips.
- Safety Gear (Wedge Clamp): Bolted to the underside of the car sling. Contains hardened steel wedges or eccentric cams that ride within 2-3 mm of the guide rail. When the lift-rod pulls, the wedges rise on inclined guides and clamp the rail with up to 60 kN of normal force per wedge.
- Guide Rails: Cold-drawn T-section steel rails, typically 8K to 30K profile (kg/m), planed flat to within 0.05 mm/m on the running faces. The safety wedges grip these faces — surface finish Ra ≤ 1.6 µm is required or friction coefficient drops below the design value of 0.15.
- Lift-Rod and Linkage: Connects the governor rope to the wedges. Must transmit ~500 N of pull from the rope into the wedge actuation in under 50 ms. Bent or corroded lift-rods are the single most common reason a tripped governor fails to actually set the safety.
- Reset Mechanism: After a trip, the safety only releases when the car is jacked or hoisted upward — driving the wedges back down their inclines and out of contact. This one-way action is deliberate; it forces a technician to inspect the rails before returning to service.
Industries That Rely on the Otis Stop for Elevator Cars
The Otis stop and its direct descendants are the legal minimum on every passenger elevator built since the late 1800s, and the same principle protects every man-riding cage in deep mining. The mechanism scales — a 600 kg residential car uses the same kinematic chain as a 30,000 kg mine cage hauling 80 miners up 2 km of shaft. What changes is wedge size, rail profile, and whether the safety is instantaneous (slams to a halt) or progressive (modulates deceleration to under 1g for human comfort).
- Passenger Elevators: Otis Gen2 and Gen3 machine-room-less elevators use progressive safeties on T89/B and T90/B guide rails, rated for 1.0-2.5 m/s cars in mid-rise residential and commercial buildings.
- Deep Mine Hoisting: Cameco's Cigar Lake and McArthur River shafts use Wabi Iron & Steel man-cages fitted with rope-actuated wedge safeties on the Koepe-hoisted production shafts — required by Saskatchewan Mines Regulations on every man-riding conveyance.
- High-Rise Construction Hoists: Alimak SC and TPL rack-and-pinion construction hoists carry an Otis-derived overspeed safety gear gripping the guide column if the pinion drive overspeeds by more than 40%.
- Freight and Service Elevators: ThyssenKrupp (now TK Elevator) freight cars in distribution centres run instantaneous safeties with shock-absorbing oil buffers below — accepts higher peak deceleration because freight tolerates 2.5g whereas passengers cannot.
- Funicular Railways: The Stoosbahn in Switzerland — the steepest funicular in the world at 110% grade — runs governor-tripped rail-grip safeties on each car. A snapped haul rope sets the safeties within 0.4 s.
- Theme Park Drop Towers: S&S Worldwide drop tower attractions use a programmed magnetic brake for normal stops but carry a mechanical Otis-style wedge safety as the legally required redundant system for ride-vehicle fall arrest.
The Formula Behind the Otis Stop for Elevator Cars
The single most useful number for sizing or auditing an Otis stop is the stopping distance after the safety sets. It tells you whether the buffer pit depth is adequate, whether the deceleration stays below human tolerance, and whether your rails will survive the energy dump. At the low end of typical car speeds (0.5 m/s residential), stopping distances run 50-100 mm and deceleration stays mild. At the nominal mid-range (1.6 m/s commercial), you're looking at 0.4-0.7 m of travel after the trip. Push to the high end (4 m/s express elevators or fast mine cages) and stopping distances exceed 1.5 m unless you switch from instantaneous to progressive safeties. The sweet spot for passenger comfort sits where peak deceleration lands between 0.5g and 1.0g — below that the system feels mushy and uses too much rail, above that and you injure the occupants.
Variables
| Symbol | Meaning | Unit (SI) | Unit (Imperial) |
|---|---|---|---|
| s | Stopping distance after safety engages | m | ft |
| v | Car velocity at moment of trip (typically 1.15× to 1.4× rated speed) | m/s | ft/s |
| μ | Coefficient of friction between wedge and rail face | dimensionless | dimensionless |
| g | Acceleration due to gravity | 9.81 m/s² | 32.2 ft/s² |
| N | Normal force ratio — wedge clamping force divided by car+payload weight | dimensionless | dimensionless |
Worked Example: Otis Stop for Elevator Cars in a deep-shaft mine cage at a Sudbury nickel operation
Vale's Coleman Mine in Sudbury is auditing the safety gear on a 12,000 kg man-riding cage that runs at a rated 6 m/s on a Koepe friction hoist. The governor trips at 115% of rated speed (6.9 m/s). The wedge safeties clamp four 30K guide rails with a combined normal force giving N = 4.0, and the wedge-to-rail friction coefficient is specified at μ = 0.20 for the dry, lightly oxidized rail face inside the shaft. The shift boss wants to know the stopping distance the cage will travel after the safeties set, and how that changes if the rails get oily.
Given
- v = 6.9 m/s
- μ (nominal, dry rail) = 0.20 dimensionless
- N = 4.0 dimensionless
- g = 9.81 m/s²
Solution
Step 1 — compute the net deceleration at the nominal friction coefficient. The wedges supply an upward retarding force; gravity still pulls the cage down, so the effective deceleration is the difference:
That negative result tells you immediately that μ × N must exceed 1 for the cage to stop at all. With μ = 0.20 and N = 4.0, μ × N = 0.80, which is below 1.0 — the cage would keep accelerating. This is the first-order sanity check every safety designer runs. Coleman's actual safeties run N closer to 6.5 because four wedges each apply roughly 20 kN against a 12,000 kg cage. Re-run with N = 6.5:
Step 2 — compute the nominal stopping distance using v2/(2a):
Step 3 — at the low end of the friction range, the rails are freshly cleaned and dry, μ rises to 0.25:
That short stop yields a deceleration of 0.62g — firm but survivable for the miners standing in the cage. At the high end of the realistic range, an oily rail face drops μ to 0.12:
Negative means the cage never stops — the friction is no longer enough to overcome gravity. This is exactly why Saskatchewan and Ontario mine regulators mandate dry-shaft inspections of guide rails inside the safety zone, and why oil-spray guide-shoe lubricators must never spray within 2 m above any landing.
Result
Nominal stopping distance is 8. 1 m on lightly oxidized dry rails at μ = 0.20. On freshly cleaned rails (μ = 0.25) the cage halts in 3.9 m at 0.62g deceleration — firm enough that miners need to grab the cage rail but well within human tolerance. On oil-contaminated rails (μ = 0.12), the friction force drops below the cage weight and the safety simply cannot hold — the cage continues to accelerate and the safety has failed. If your measured stopping distance is longer than predicted on a drop test, the three most common causes are: (1) governor rope tension below 150 N letting the rope slip through the trip jaw and delaying wedge engagement by 200-400 ms, (2) wedge-face glazing from oil migration off the guide-shoe felts which cuts μ below 0.15, or (3) lift-rod bushings worn beyond 0.5 mm clearance which absorb wedge-engagement travel before the wedges actually contact the rail.
Otis Stop for Elevator Cars vs Alternatives
The Otis stop is one of three competing approaches to fall arrest in vertical conveyance. Each suits a different speed range, payload, and acceptable deceleration. Pick the wrong one and you either over-decelerate the occupants, under-stop the car, or pay for hardware you do not need.
| Property | Otis stop (progressive safety) | Instantaneous safety | Hydraulic rupture valve |
|---|---|---|---|
| Rated car speed range | 0.63 m/s up to 10+ m/s | Up to 0.63 m/s only | Hydraulic elevators only, ≤ 1.0 m/s |
| Peak deceleration on stop | 0.2g to 1.0g (modulated) | 1.0g to 2.5g (uncontrolled) | 0.3g to 0.8g |
| Stopping distance at 1.6 m/s | 0.4-0.7 m | 0.05-0.15 m | Hydraulics-dependent, ~0.3 m |
| Hardware cost (relative) | 1.0× (baseline) | 0.4× | 0.6× |
| Rail damage on activation | Light scoring, dressable in-shaft | Deep gouging, rail section often replaced | None — no rail contact |
| Reset complexity | Jack the car upward, inspect rails | Replace wedges, dress or replace rail | Replace rupture cartridge |
| Typical service life before overhaul | 20-25 years | 20-25 years | 10-15 years (seals) |
| Application fit | Passenger and freight, all heights | Slow freight, dumbwaiters | Hydraulic passenger, low-rise only |
Frequently Asked Questions About Otis Stop for Elevator Cars
The friction coefficient between hardened wedge and steel rail is brutally sensitive to surface condition, and surface condition changes with every drop. The first drop polishes the rail and removes mill scale, the second drop runs on a slightly polished surface with higher μ, and by the fourth or fifth drop you've burnished a track that grips noticeably harder than virgin rail.
Code drop-tests require dressing the rail back to original surface finish (Ra 1.6 µm) between tests for exactly this reason. If you skip the dress, you are no longer testing the same system. A 30% variance is also a clue your governor rope tension is drifting between tests — check the pit tension sheave weight is still hanging free and not snagged on a buffer.
Progressive, no question. ASME A17.1 and EN 81 both cap rated speed for instantaneous safeties at 0.63 m/s when humans are aboard, because instantaneous wedges deliver peak decelerations of 1.5-2.5g — survivable but injurious. At 1.0 m/s an instantaneous stop in 0.05 m gives roughly 10g, which causes spinal compression injuries.
The cost delta is roughly 60% on the safety gear alone but trivial against the cost of a single injury claim. Specify progressive and size the rails for the higher friction-engagement length.
Almost always the governor's tripping speed is set too close to rated speed without enough margin for the brief transient overshoot during the start of descent. Code requires the trip at 115% of rated for cars up to 1 m/s, but if your drive controller has aggressive jerk settings you can momentarily blip past that during the acceleration ramp.
Two checks: confirm the governor flyweight calibration with a tachometer drive (most modern governors have a calibration port), and check the drive's S-curve jerk parameter — if jerk exceeds 1.5 m/s³ you'll see overshoot spikes. Also inspect the governor rope for stiff spots or contamination from hoistway debris; a sticky rope can drag the governor sheave faster than the car is actually moving.
Sometimes — but the rails almost always need replacing or reinforcing. Progressive safeties dissipate energy over a longer rail length, and they pull harder against the rail web because clamping force is sustained. Original instantaneous-rated rails (often 8K or 11K profile) flex under that sustained side load and you'll see the rails bow outward by 2-4 mm during a real arrest, which can buckle the brackets.
The practical retrofit path is to upgrade rails to at least 18K profile, double-up the rail bracket spacing to 1.5 m maximum, and have the elevator engineer recalculate the rail-fishplate splice strength. Below 18K I'd just specify a new safety system that matches the existing rail rather than fight the retrofit.
That's a classic symptom of a slack governor rope or a failing return spring on the wedge linkage. If the governor rope goes slack — usually because the pit tension sheave has bottomed out on its travel limit — the rope can lag behind the car during deceleration on upward stops, briefly pulling the lift-rod and partially setting the wedges. Sometimes they re-seat and you don't notice; sometimes they bite hard and gouge the rail.
Inspect the tension sheave first. It should be hanging mid-travel, with at least 100 mm of vertical movement available in either direction. Replace the tension weights if they've been pilfered (it happens) or if the sheave guides have seized. Then check the wedge return spring tension — code calls for the wedge to fully retract within 1 second of the lift-rod releasing.
Substantially — and not in the direction most engineers guess. Light surface moisture on a clean steel rail actually raises μ slightly above the dry value (from ~0.20 to ~0.22) because it breaks up the loose oxide layer. But once condensation forms a continuous water film, μ collapses to 0.08-0.10 and the safety becomes marginal.
Deep shafts where warm hoisted air meets cold winter rock see exactly this transition twice a year. Cameco and Vale both run shaft heaters or dehumidified ventilation in the upper 200 m for this reason. If your shaft has visible water beading on the guide rails during winter shift change, your safety gear's effective stopping distance has roughly doubled from the spec sheet — the audit needs to use the wet μ value, not the dry one.
The accepted method is a low-speed governor trip test — run the car downward at rated speed, mechanically trip the governor with the manual trip lever, and confirm the safety sets and holds the car within the code-specified distance. You measure rope tension before, observe wedge engagement timing, and inspect rail marks afterward.
Full free-fall drops with cut hoist ropes are only required at initial commissioning and after major modifications. The trip test catches 90% of real-world degradation modes — sticky governors, slack governor ropes, worn lift-rod linkages — at perhaps 5% of the cost and risk of a full drop. Annual trip testing is mandated by both ASME A17.1 and EN 81-20.
References & Further Reading
- Wikipedia contributors. Elevator (section: Safety). Wikipedia
Building or designing a mechanism like this?
Explore the precision-engineered motion control hardware used by mechanical engineers, makers, and product designers.
