HOPE X. Conference "Breaking the elevator: from the basement to the penthouse." Part 1. "Elevator equipment"
Diviant Allam: we have slides here that will help to hold this presentation on hacking elevators. We were told that it should be held exactly on Sunday, for which there are reasons. I will tell you who we are and why we are here. Some of you have seen me before. My name is Diviant, I own a company that tests mostly physical penetration, so I’m exploring the possibility of committing burglaries using elevators. There is plenty of work in this direction and it is quite fun.
Howard Payne: I welcome everyone, my name is Howard, I am an elevator consultant and a former elevator inspector, I am not a member of any of these two fantastic New York organizations and I usually stay at the Atlantic City casino in Las Vegas where I sell my favorite cheap beer. I cannot imagine any particular employer here, and, in spite of my last name (the payne name in English sounds like the word pain, pain), I will not talk about elevators that hurt passengers. Many people in New York use elevators every day, and most of these trips take place without incident. Elevators injure people very rarely, but this can happen if they are not properly operated. ')
Today in New York there are almost 60 thousand elevators, which make 11 billion trips per year or 30 million trips per day. In general, only 24 trips are accompanied by such injuries to passengers that require medical intervention. Of the more than 300 million people who use the elevators, 26 people died this year, and most of them were specialists who performed repair or maintenance work at that time. These people, like me, worked on the roof of the elevator cabin, or in the engine room, or in the elevator shaft.
Now industrial accidents with elevators occur rarely, and we do not want people to think that this is not so. However, when you work with elevators, there are various equipment failures that can cause serious injuries.
This slide shows the case when a worker’s foot fell between the cabin floor and floor overlap, and the miracle was that this foot was saved. I want to warn everyone present not to try to test hotels for penetration in this way, there are cameras everywhere. You have probably met signs indicating that elevators are being monitored and their improper use or damage can lead to an accident.
This YouTube video shows a trick called "helicopter" when one guy is spinning on his back on the railing of a downward moving escalator. He does it right, but the other guy doesn’t have a trick, and as a result he falls, breaking down the design of the escalator and causing damage by a thousand dollars.
I ask you not to repeat such tricks, even if you heard that someone managed to do this.
Diviant Ollam: now we will introduce you to the technical side of using elevators. There are two elevator drive designs: Traction drive elevators and Hydro hydraulic lift elevators. You can study in detail what each construction consists of. In the first case, the elevator car pulls up and down with an electric winch with cables, they are called cables that are fixed on the cab roof, and its weight with passengers is balanced by a special counterweight. In the second case, the cab rises up and down with the help of a hydraulic piston acting on the bottom. The next slide shows that the engine room of the traction elevator is located at the top, on the last floor of the building, and the hydraulic elevator drive is at the bottom, in the basement.
Elevators move up and down, lift and lower themselves with cables or hydraulic rods. We will not tell you about the pistons and gears and delve into the terminology, we just want you to understand what will be discussed further.
People believe that elevators are fixed in a certain room of the machine, and they should be fixed on all sides during movement. The next slide shows what sets the cabin in motion - these are the rollers that move the cabin along a vertical rail. They are at the top and bottom of the cab.
You can check out the wiki for more details.
The elevator car very carefully, pulling itself up with cables, slides along two rails with the help of rollers located on its sides. It is not fixed on four sides, its position is stabilized only by these rails.
Howard Payne: My elevator is shown on this slide. On the left, you can see the COP elevator control panel located in the cab, on top the internal indicator of the elevator position on the floors and the direction of the cab movement, then the external indicators and buttons are shown with which the user can call the elevator on his floor.
If you are in the lobby, then you call the elevator and it goes down from the top, if you are at the top, the elevator goes up to you from below.
If you see in which direction the elevator is moving, up or down, then please do not call it with the button of the wrong, opposite direction.
So, the elevator moves you up or down depending on the instructions received from you, and this is due to the engine room. The cab does not have its own energy source, this energy is provided from the top of the penthouse for traction elevators or from the bottom from the basement for hydraulic.
The following slides show the engine room winches installed in the penthouse and the hydraulic drive located in the basement.
As you can see, the hydraulic drive consists of a reservoir with liquid, a pump and a control cabinet located on the wall. The lack of technical space in modern homes leads to the fact that engine rooms are becoming less and less.
The controller, located in the engine room, is the "brain" of the system. Here are located the regulators and sensors that monitor the operation of the elevator, receive control signals and issue commands to perform operations, for example, opening and closing doors.
They determine the direction of movement of the cabin, check whether your call is correct, whether you have appropriate rights according to the requirements of the security system, etc. A video showing the operation of a winch and a relay in the engine room, a device called a “selector”, which selects the direction of movement of the cabin, closes certain relay contacts during its rotation, and informs the controller which floor the elevator car is on.
This video shows not the museum exhibits, but the equipment that is used today. The shown controller is used in 2014 in elevators of a building in Manhattan.
Diviant Ollam: you may have come up to the last floors and heard through the walls, as the relays click in the engine room under the roof of the building.
Howard Payne: there are not only early versions of rotating selectors and controllers that mechanically make contacts, but also fixed versions of these devices without mechanical parts.
The next slide shows a silver metallic strip fixed to the cab roof. It moves along with the cab up and down, in contact with a black ribbon that is stretched from the top to the bottom of the shaft.
Magnetic semiconductor sensors are installed on this tape, which, due to the contact with the strip on the cab, inform the controller of its position in the shaft relative to the floors. Of course, today there are selector systems based on QR codes, because modern mines are clean enough to use such sensitive electronics.
Still, there are more primitive forms of devices, such as mechanical boundary switches at the top and bottom of the rails. Their 4 pieces - 2 lower reduce the speed, the third shows the normal position, and the fourth shows the limiting position of the cabin. If the cabin touches the uppermost switch, this means that there is no place to move further, and the controller will make the appropriate decision.
The following slides show the device for determining the speed of the cab and the safety mechanism - the brakes, which are activated if the cabin develops too much speed.
Diviant Allam: elevators are equipped with all the necessary security systems, these are really very safe machines. You can not be afraid of elevators, except that suffer from bouts of claustrophobia. Our engineers and the entire American industry have done everything to ensure that elevators work efficiently and reliably. The next slide shows the security mechanism called Governor, or “Regulator”, which controls cable tension, cab movement speed, brake operation and turns on safe mode if something extraordinary happens to the elevator.
Howard Payne: The main function of the “Regulator” is to prevent the free fall of the cabin in the elevator shaft. If the elevator for any reason loses control, this device activates the counterweight so that the cab moves up rather than falling down. There is a device that prevents a sharp jerk of the cabin or its unauthorized upward movement - the capture of a Rail Gripper from 3 metal rollers, which are pressed tightly against the rail and retard or completely block the movement of the cabin.
Ollam Diviant: there are many other devices designed to prevent the cab from falling down, usually elevators equipped with several emergency braking systems.
If for some reason it was not possible to slow down the movement of the cabin and it falls down, special spring and oil shock absorbers are arranged in the floor of the elevator shaft in the basement, designed to soften the blow. They are designed so as to prevent the floor of the shaft from touching the floor with a fully loaded elevator car flying downwards at maximum speed. So if you are in such a cabin, then the maximum will be hurt, but you will not perish.
Lifts want to keep you alive, and they do it very well. If the elevator is moving in automatic mode, we do not recommend you to act like these guys.
The screen shows a video in which two teenagers decided to ride on the roof of the elevator car. They open with a key the doors of the elevator shaft on the floor below which the cabin stands, and jump on it. Cab rises. The following shows how one of the guys, located on the very edge of the cabin, does not have time to dodge the counterweight moving down ...
In addition to the automatic mode of movement of the elevator, there are many other modes. One of them is the Independent Service Mode, “Independent Service Mode”, when the elevator management belongs exclusively to you and no one can intercept the cab on the intermediate floors when you move up or down. Typically, this mode is used to ensure that the elevator rises to a specific floor without stopping.
This mode allows you to use the elevator to hide from the guards. While you are moving in the elevator car, no one can stop you. Even if there are, for example, 10 elevators in the lobby, no one will pay attention to the fact that elevator No. 7 was not used all day. You can get into the booth, working in an independent mode, take a mobile device with you, connect it to the network and have fun for 4 hours until the end of the working day, and then just go down to the lobby.
In some elevators, the independent mode is activated with a key, in others, with ordinary switches located on the control panel of the cabin. Later we will tell you about the small hidden panels available in the elevator car.
Howard Payne: the independent mode should not be confused with the attendant, or attendant mode Attendant Mode, they are similar, but have significant differences.
Usually it looks like there is an employee inside the cabin who collects passengers and delivers them to the floors in manual mode. However, in modern elevators, this mode looks different. In the elevator there is a panel with a lock, and after that the person on duty by turning the key activates the service mode, he can make decisions on how to organize the collection of people on the floors, depending on incoming calls. Suppose that such an elevator works in a hotel where a bunch of people with suitcases have accumulated on a certain floor. In such a case, the attendant may reverse the direction of movement in order to gather these people and pull them down into the lobby, because all the other elevators are crowded. Or if he needs to serve a VIP, or an emergency situation and the like is created.
Diviant Ollam: what if you want to dispose of the elevator, but do not want an employee by your side? For this case, there are modes Express (high-speed), Executive (administrative) and VIP.
Howard Payne: administrative or executive mode, like Express mode, gives priority to using an elevator to a specific authorized person. Such a person may have his own key, which is used in the call reception panel. Turning the key tells the controller that there is a person on this floor who is more important than all the others and needs to be serviced as soon as possible.
The difference between the Executive mode and the Express mode is that in the first case the elevator can change its movement to the opposite and disembark people to arrive at your call with an empty cabin. In the second case, the elevator will simply accelerate its movement to your floor, without responding to passing calls from other floors.
Naturally, the elevator in the administrative mode will not throw people out of the cabin, it uses a voice notification of this type: “This cabin is required for other purposes, please release it on the next floor”!
Diviant Ollam: another unique mode of operation of elevators, which is found in the great New York, is Sabbath mode, or “Shabbat” mode for people practicing orthodox Jewish religion. So do not pay attention to the slide of the Black Sabbath group, but look immediately at the next one. Since on Saturday such believers are forbidden to use any mechanisms, switches and press buttons, controllers and elevator equipment programmers invented the Sabbath mode especially for them, so that they would not have to climb the stairs on foot.
Howard Payne: in most cases, this mode is that the elevator descends from above into the lobby, takes passengers and then rises to the very top, automatically stopping and opening the doors on each floor. The same thing happens when the elevator goes down from the last floor. This does not require any interference from the passengers and makes it possible for them to enter or exit the elevator on any floor.
Diviant Ollam: if a building has many floors, such a mode of using a regular elevator will be very unproductive, so a separate “Saturday” elevator is installed in some skyscrapers.
I'll tell you about other unusual features of the elevator. There is an overload mode when too many people enter the cab and their weight exceeds the allowable load. In this case, a special sensor is triggered, the elevator beeps and can stay on the floor with the doors open until someone leaves the cabin. When loading the elevator, which is close to the limit, there is an option to program it so that the cabin does not stop on the call on the floors, since no one else will be able to enter the elevator anymore, but immediately go non-stop to the first floor.
This is followed by the Antinuisance counteraction mode and the No Passenger Detection passenger mode. If someone quickly presses several buttons at once, or if an elevator arrives on a call to a floor on which no one enters or exits, the elevator can activate the mode of ignoring such calls. The next video shows how I quickly press the buttons of different floors on the panel in the cabin, after which the elevator simply drops all my calls.
Announcement in the cabin: “Dear guests, if you get caught pushing all the buttons in the elevator car, they will force you to wring out 20 times in the nude before the registration desk.Thank you for your cooperation".
There are also special peak hours “rush hour” - Up Peak / Down Peak - for offices at the beginning and end of the working day or hotels for mass departure and arrival of guests, when all elevators follow only up or only down.
Howard Payne: If I were invited to optimize the performance of your elevators, I would start by modeling your building with sophisticated software. You can laugh at the illustration depicting the construction of the tower in the Sim Tower computer game, but Maxis, who distributed this game, did not design the game from scratch, but invited a guy from Japan who worked on creating a serious building simulator and simulated elevators. I like this game, it has an interesting “trick” - if you double-click on the elevator engine compartment, a menu opens that allows you to program the elevator. There you can configure 4 different time modes of operation, taking into account the load during "rush hour" and so on.
Diviant Ollam: people from the west coast know that a seismic sensor is installed in elevators.