Data Spurs Debate Over Paternoster Elevator Safety

How a paternoster actually moves

A paternoster is best understood as one continuous circuit rather than as a set of separate lifts. Every car belongs to the same loop, so the machine has no empty return journey and no waiting time to manage.

Two vertical shafts sit side by side inside the same structural opening. Cars in the left-hand shaft travel upward and cars in the right-hand shaft travel downward, or the reverse depending on how the drive is arranged. At the top of the building the chain passes over a driven wheel; at the bottom it passes around a tension or guide wheel. The cars hang from that single chain at fixed intervals, which is why the whole installation behaves like one long necklace of cabins rather than a fleet of independent lifts.

Because the chain runs continuously, a car arrives at any landing every few seconds whether or not anybody has called it. There is no hall call, no car call and no direction indicator, because there is nothing to dispatch: the next car is always already on its way. That single design decision removes waiting time and the control system that normally exists to reduce it.

The loop, not the stop, is the design

In a conventional lift the car spends part of its time stationary at a floor and part of its time accelerating and decelerating between floors. A paternoster never does either. The chain turns at one constant speed, so the machine has no stop-start duty cycle to absorb, no levelling routine to complete and no door cycle to sequence with the drive.

Speed is deliberately low so that a passenger can walk on and walk off. Boarding and leaving are completed in the time it takes the car to pass the landing opening, which is why the classic machines feel unhurried even though the chain never rests. Accounts of the technology describe the movement as slow enough that a passenger steps in and out at walking pace, and that pace is a design requirement rather than an accident of the gearing.

Two people, standing, with nothing to close

The classic car is a small open box designed for about two people. There is no seat, no mirror, no button panel and usually no door; some installations add a folding bar or a low gate, and the shaft side of the car remains open to the landing. Because the car never stops at a floor, the landing opening cannot be closed by a door that interlocks with the machine, which is the difference that most modern safety thinking revolves around.

The small car is not a limitation that the designers overlooked. A two-person compartment keeps the chain load low, keeps the shaft narrow and keeps boarding time short, which in turn allows the chain to run at walking pace. The trade-off is capacity per car, and the paternoster answers that trade-off with frequency instead of size.

What a paternoster is not

Three pieces of equipment are often confused with one another, and the differences matter when the safety record is discussed.

• Conventional lifts stop at a floor, hold the car level, open a landing door and wait. Their protection depends on the door interlock, the levelling system and the brake.
• Dumbwaiters are small goods hoists that are not intended for people at all, whatever their size suggests to a casual observer.
• Belt manlifts carry a person on a moving belt with steps or rungs and no compartment at all. The machine is sometimes given the same name, but the passenger is exposed from every direction rather than from one side.

The name itself comes from Latin: paternoster, meaning "our Father", the opening of the Lord's Prayer. The cars on their endless loop were compared to the beads of a rosary, and the nickname stuck. British architect Peter Ellis obtained a patent for an improved hoist with two shafts in 1866 and installed the first machines that can fairly be called paternoster lifts in Oriel Chambers in Liverpool in 1868. The technology then spread through continental Europe, where it became far more common than in Britain.

Why paternoster lifts were banned

The bans were not triggered by one catastrophic failure. They arrived when a machine built around open, moving compartments met a safety philosophy that increasingly required the equipment to protect the passenger rather than the passenger to protect themselves.

Paternosters were installed enthusiastically for roughly eighty years. They moved large numbers of people through buildings with a shaft that a conventional lift group could not match, and their reputation for danger was, for a long time, treated as a fair price for that performance. What changed after the Second World War was not the machine but the standard it was being measured against.

The 1970s turning point

By the early 1970s the paternoster was already old technology. Its drive was simple, its shaft was cheap and its control system was effectively nonexistent, which had been an advantage in 1920 and had become a liability by 1970. New building codes were being written around machines that could prove, by interlock and by test, that a passenger could not be exposed to a moving part.

A paternoster cannot make that proof. The moment of boarding is, by design, a moment when a person crosses an open gap between a landing and a moving car. No amount of maintenance removes the exposure; it can only reduce the chance that the exposure ends badly. Once that was accepted as the central issue, stopping new construction followed almost automatically.

Access without a landing door

On a conventional lift the landing door is the primary protective device. It stays locked until the car is level at that floor, and the car cannot move while the door is open. The interlock is mechanical as well as electrical, so the protection survives a control failure.

Open landings make that arrangement impossible. A paternoster has no level position to detect, no door to lock and no cycle to interrupt, so the entire protective function would have to be replaced by something else: barriers, sensors, restricted access or supervision. Each of those is a human system, and human systems fail when a building is busy, when a visitor is unfamiliar with the machine, or when someone decides to move a trolley up two floors.

What was never banned

It is worth separating two things that are often merged in popular accounts. New paternosters were stopped; the existing machines were mostly allowed to keep running, subject to inspection and sometimes to restrictions on who may use them. Germany still had roughly 230 working paternosters at the time the figures were compiled, and the Czech Republic had 68. The 1994 and 2015 attempts to close them failed in the face of public support rather than in the face of a legal argument.

What the accident record does and does not show

Two claims are repeated about paternosters: that they are far more dangerous than ordinary lifts, and that the danger has been exaggerated to justify closing a piece of working heritage. The evidence supports the first claim broadly and the second claim weakly, and neither side can produce the complete dataset that would settle the argument.

Part of the difficulty is that the machines are old, dispersed across many jurisdictions and owned by hundreds of different institutions. There is no single register that records journeys, incidents and near misses for a fleet of several hundred installations, so every published comparison is assembled from inspection reports, coroners' findings and national statistics that were collected for other purposes.

What the published figures cover

The clearest statement that appears in the reference literature is a comparison of risk rather than a count of events: the overall accident rate for paternosters has been estimated at about thirty times that of conventional elevators. That figure is quoted widely, and it is consistent with the design analysis, because it captures the exposure that an open, moving car creates at every single boarding.

A second figure comes from Germany, where most surviving machines are located. A representative of the union of technical inspection associations stated that the country had averaged roughly one death a year connected to paternosters before 2002, at which point many installations were made inaccessible to the general public. That statement describes a national pattern across a fleet of more than two hundred machines, not one building's experience.

Individual incidents are better documented than the aggregate, and two of them are recorded in the reference material on surviving and former installations.

• Newcastle University, September 1975. A passenger was killed when a car left its guide rail at the top of its travel and pushed the two cars behind it into the winding room above. A second, non-fatal accident followed in 1988, and the machine was replaced in 1989 and 1990.
• The Hague, April 2012. An 81-year-old man died after being caught between a paternoster and the wall of the shaft.

Where the figures stop

None of these sources tells a reader how many passengers rode a paternoster in a given year, how many buildings reported a near miss, or how the accident rate changes when access is restricted. A rate comparison that cannot be normalised against journeys is directional, not precise.

There is a second gap. Restricting access to staff removes the passengers who are least familiar with the machine, and it removes them from the statistics as well as from the landing. A fleet that was made partly staff-only in 2002 will show a different risk profile afterwards for reasons that have nothing to do with the equipment.

The claim on this page that we cannot support

The earlier version of this article opened with the phrase "through data analysis" and presented figures on throughput, upkeep cost and risk without naming a source for any of them. Those figures were written in the site's own voice and have no traceable origin, so they should be read as commentary rather than as evidence.

We have kept the topic and rewritten the body, but we are not going to launder an unattributed claim into an attributed one. Where a number in this article comes from published reference material it is described as such. Where it does not, it has been removed.

Where paternosters still run today

The surviving machines are concentrated in central and northern Europe, and most of them are in buildings where staff, students or officials use them as ordinary transport rather than as an attraction.

Compiled figures put about 230 working paternosters in Germany and 68 in the Czech Republic, with smaller numbers in Austria, Finland, Denmark, Hungary, the Netherlands, Belgium and a handful of other countries. Outside Europe only three installations have been identified: one each in Malaysia, Sri Lanka and Peru.

What the survivors have in common

Almost every surviving paternoster serves a building with a closed population. Ministries, universities, hospitals, parliaments and company headquarters all have people who walk past the same machine every day and learn how to use it. The machines that were open to the general public have proved far harder to keep open, and Prague's New City Hall shows why: a renovated lift was closed again within six years because visitors treated it as a ride.

The pattern matters for anyone trying to draw a lesson about lift safety. The surviving fleet is not evidence that the boarding risk was solved. It is evidence that the risk can be managed inside a controlled population, which is a narrower claim.

How modern home elevators remove the same risks

A modern home lift solves the paternoster problem by refusing to expose the passenger to a moving gap in the first place. Where the paternoster asks the user to judge a moving car, a contemporary machine makes the judgement itself and keeps the doors locked until it is safe to open them.

The comparison is useful even if you will never travel in a paternoster, because it shows what each protective function is actually for. Every feature on a modern lift exists because some earlier arrangement failed in a way that could be predicted, and most of those predictions came from machines exactly like this one.

Boarding: the landing door and its interlock

On a conventional or home lift the landing door is the first line of protection. It stays closed and mechanically locked for as long as the car is anywhere except level at that landing, and the interlock is arranged so that the car cannot start a run while a landing door stands open. The system does not depend on the passenger seeing whether the car is there or judging whether it is safe to step across.

The paternoster inverts that logic completely. Its landing opening is permanent, the car never becomes level with the floor, and there is no door to lock. Protection has to be supplied by the passenger, by supervision or by access control, which is why the machine survived in staff-only buildings and struggled in public ones.

Stopping, levelling and the door zone

A home lift stops, holds the car level with the floor within a small tolerance, opens the door, waits, then closes and locks it before moving on. The controller will not accept a new destination until the door is locked again, and it will not open a door until the car has settled inside its levelling zone.

That sequence is a chain of preconditions, and every link in it removes a decision from the passenger. The paternoster has no equivalent because it has nothing to sequence: no stop, no level, no door and no state to verify. The comparison shows that the safety of a lift comes less from the strength of its drive than from the number of dangerous states the control system refuses to enter.

Overspeed, free fall and the brake

Three independent protective layers are standard on a modern traction or hydraulic home lift. A brake at the machine holds the car whenever the drive is not commanded to move and applies automatically on power loss. An overspeed governor detects a car travelling faster than its design speed and trips mechanical safety gear that grips the guide rails. A buffer or end stop limits what happens if the car reaches the end of its travel.

The point of having three is that they fail independently. A brake can be defeated by oil on the drum. A governor can be defeated by a seized linkage, and a buffer only matters at the extremities. All three would have to fail at once for a free fall to develop. Redundancy is the design principle, and it is precisely the principle that a single-chain loop with an open car cannot apply to its boarding interface.

Power failure and entrapment

An ordinary lift failure leaves a passenger inside a closed car. That is uncomfortable, but it is a survivable and well-understood situation, and the industry has built the recovery around it: lighting that stays on, an alarm, a voice link and a rescue routine that brings the car to a landing.

A paternoster has no equivalent. The passenger is not sealed inside a car with a telephone; they are standing in an open compartment in an open shaft, and the people outside can reach them directly. Paradoxically, that openness is more dangerous rather than less, because the hazards remain within reach of both the passenger and the rescuer.

What to specify instead

Perhaps you are reading about paternosters because you want a small, efficient lift in a house or a low-rise building. The machine you can actually buy is a modern home elevator, and the specification work is about protective functions rather than about the drive.

Use the list below as an enquiry checklist. It turns the abstract question of whether a lift is safe into a short series of items that a supplier can answer in writing before you sign anything.

Six terms worth knowing before you compare offers

Where this article sits on our own website

A paternoster is a historical machine and a live engineering case study. It is not a product we build, and it is not a product anyone can order from us. We manufacture and supply residential and commercial lifts. If the loop has led you to think about a compact installation for a house, start from the product overview. The special elevator range covers unusual buildings, and the screw-driven range is the simplest modern drive we offer for homes with limited headroom.

Questions readers ask

The same handful of questions comes up whenever the safety debate is discussed. These answers give the short version, with the caveat attached where the evidence is thinner than the headline suggests.

What we still need to confirm

This article is honest about its limits, and there are four gaps that only an operator or a manufacturer can close. Until they are closed, the numbers above stay at the level of published estimates rather than measured performance.

If you are planning a lift rather than researching one

Send the building information and we will work from the structure rather than from a catalogue page. Six items are enough to start.

• Floors and travel. How many stops, and the total distance between the lowest and the highest.
• Floor-to-floor heights. Needed to judge headroom at the top landing and whether a compact drive will fit.
• Available space. Shaft dimensions if you have them, or the wall or stairwell space you are prepared to give up.
• Intended use. Who will ride, how often, and whether a wheelchair, walking frame or stretcher has to fit.
• Power supply. Single or three phase, and what the supply can actually deliver at the lift position.
• Local approval route. Anything your authority, building management or insurer has already told you.

With those six items we can tell you which drive family fits and what the installation will need in the building.

Paternoster elevators remain one of the most revealing chapters in lift engineering precisely because they show what happens when a machine is optimised for movement and not for the person standing at the landing. That lesson is why every modern lift we build begins with the door.