Industrial Elevator Control System

Rationale: Building Occupant, Morning Rush scenario: 200+ workers arriving 07:30-09:00 require group dispatch to maintain <30s wait. Exceeding this causes lobby congestion and occupant dissatisfaction in commercial buildings.

Rationale: Building Occupant, all operational scenarios: passengers expect smooth acceleration profiles and precise levelling for safe boarding. H-004 (levelling failure) derives from poor levelling causing trip hazards.

Rationale: Building Occupant (mobility-impaired), Power Failure scenario: wheelchair user at floor 18 requires ARD to bring car to safe landing. EN 81-70 mandates accessibility features. Lifts Directive 2014/33/EU requires compliance.

Rationale: Maintenance Technician, Quarterly Maintenance scenario: technician riding car top at 0.3 m/s inspecting rails and ropes. Loss of exclusive access would expose technician to crushing hazard from adjacent car or unexpected car movement.

Rationale: Maintenance Technician, Quarterly Maintenance scenario: EN 81-20 requires inspection speed ≤0.3 m/s for car-top inspection. Technician must traverse full shaft to inspect rails, ropes, doors, safety gear, and governor tension.

Rationale: Facility Manager, all scenarios: BMS notifications trigger technician dispatch (45min ETA in Single Car Failure scenario). Without real-time status, facility manager cannot coordinate maintenance rotation or emergency response.

Rationale: Facility Manager, Morning Rush and Single Car Failure scenarios: operator must adjust dispatch behaviour for peak periods and redirect passengers when cars are out of service. Configuration changes must not require OEM intervention to control operating costs.

Rationale: Fire Service, Fire Alarm Recall scenario: all cars must recall to ground floor for evacuation. Car 3 above fire floor must stop at floor 11 for passenger evacuation before continuing to ground. EN 81-72 mandates Phase I recall behaviour.

Rationale: Fire Service, Fire Alarm Recall scenario: Phase II firefighter control per EN 81-72 and ASME A17.1. Firefighter needs exclusive control to reach fire floor, hold-to-run prevents unintended movement, door override allows venting or access.

Rationale: Regulatory Inspector: annual statutory inspections require brake torque records, ARD test results, safety circuit verification, and modification history. Inspector authority to condemn installation requires auditable evidence trail.

Rationale: Regulatory Inspector and OEM: H-001 (uncontrolled movement) and H-002 (overspeed) both rated SIL 3 require the safety controller to meet IEC 61508 SIL 3 systematic capability. Non-compliance blocks market access in EU and condemns the installation.

Rationale: OEM/System Integrator: elevator controllers have 20-25 year lifecycles. Discrete subsystems (drive, safety controller, dispatch) must be independently upgradeable. Non-modular designs force premature full-system replacement at 5-10x cost.

Rationale: Environment as stakeholder: thermal and EMC constraints from industrial building environment. H-008 (drive EMI corrupting safety signals) is SIL 2 — safety controller must reject interference. EN 12015/12016 mandatory for CE marking.

Rationale: Environment as stakeholder, Power Failure scenario: UPS sustains controller for battery-powered car movement to nearest landing. H-005 (passengers trapped during power failure) rated SIL 2 requires defined ARD capacity. IEC 60364 grounding required.

Rationale: Derives from STK-REQ-001 (passenger wait time). 200 passengers/5min is the morning rush peak from ConOps. 4-car group with 150% rated load is the design configuration. Failure to meet this causes lobby congestion and occupant complaints.

Rationale: Derives from STK-REQ-002 (ride comfort). ±5 mm levelling prevents trip hazards (H-004, SIL 1). 2.5 m/s rated speed enables 20-floor traverse within acceptable transit time. Jerk limit prevents passenger discomfort and load shifting.

Rationale: H-002 (overspeed in down direction), SIL 3. EN 81-20 mandates overspeed governor with progressive safety gear. 115% threshold from EN 81-20 Table 7. 200 ms response ensures deceleration within shaft overrun distance.

Rationale: H-001 (uncontrolled movement), SIL 3. UCMP per EN 81-20:2014 Clause 5.6.7.2. 200 mm threshold prevents passenger fall-through. Contactor welding or drive fault is the root cause — safety controller must be independent of main controller.

Rationale: H-003 (door zone entrapment), SIL 2. EN 81-20 Clause 5.3.6 mandates 150 N max force. 3-second re-open prevents passenger injury. Light curtain and force sensor provide redundant detection.

Rationale: H-005 (passengers trapped during power failure), SIL 2. Power Failure scenario: wheelchair user at floor 18 must reach landing. 0.15 m/s from ConOps. 30s limit ensures entrapment does not exceed EN 81-28 alarm trigger threshold.

Rationale: Derives from STK-REQ-008 (fire recall). Fire Alarm scenario: 60s budget accounts for car at highest floor plus door operations. Floor lock-out of fire floor prevents cars stopping at hazard. Car above fire floor stops one below for evacuation first.

Rationale: H-007 (counterweight derailment), SIL 3 during active seismic event. Seismic scenario: P-wave detection gives 5-10s before S-wave arrival. 60s hold timer from ConOps. Post-event: low-speed inspection trip (0.3 m/s) required before normal service.

Rationale: Derives from STK-REQ-001 and STK-REQ-006. Single Car Failure scenario: 3 remaining cars must rebalance, wait time rises to 45-50s. Degraded performance threshold must be explicit for BMS alerting.

Rationale: Derives from STK-REQ-006 (BMS status). BACnet/IP from external interface definition. 1 Hz from ConOps. B-ASC profile provides standard object model for elevator status (position, faults, energy, mode).

Rationale: H-008 (drive EMI corrupts safety signals), SIL 2. EMC constraint from concept phase. Safety controller must detect signal discrepancy caused by EMI rather than acting on corrupted data. Shielded cabling mandatory for safety circuits.

Rationale: Derives from mission statement (>99.5% uptime). MTBF target derived from 4-car group: single car MTBF ≥1250h allows N-1 degraded operation within the 99.5% system availability budget.

Rationale: Derives from STK-REQ-010 (test records). EN 81-20 Annex A requires comprehensive event logging. 10-year retention covers two statutory inspection cycles and typical liability periods.

Rationale: EU Lifts Directive 2014/33/EU is the mandatory legal framework for lifts placed on the EU market. STK-REQ-011 requires compliance with 2014/33/EU as a non-negotiable regulatory constraint — failure to achieve CE marking makes the system unsaleable in the EU. The conformity assessment route is specified to avoid ambiguity about which Notified Body approval path applies.

Rationale: STK-REQ-006 specifies four distinct data items (position, fault codes, energy consumption, operating mode) that the BMS requires for building automation integration and energy reporting compliance. SYS-REQ-010 establishes the BACnet/IP transport at 1 Hz; this requirement defines the payload content to ensure all four stakeholder-required data types are transmitted. Energy reporting at ±2% is required for EU Energy Performance of Buildings Directive compliance for lifts in Class A commercial buildings.

Rationale: STK-REQ-014 requires 3 rescue cycles per car, which is the benchmark in EN 81-20 Annex D for ARD energy storage. SYS-REQ-006 only specifies that cars reach the nearest landing; it does not bound the number of sequential operations available in a blackout event. Three cycles covers worst-case: power fails during consecutive trip cycles before all cars complete rescue. The 8-hour recovery specification aligns with a standard work-shift interval to ensure the system is ready for the next workday.