结论：单点失效不能导致坠落，这是设计底线
爬楼机（履带式或星轮式的楼梯升降设备）承载使用者在楼梯上移动。失效的后果是使用者连同设备从楼梯上滚落，后果极其严重。
所以这类产品的设计原则与平地使用的产品不同：任何单一部件的失效，都不应当直接导致坠落。 这就要求在关键路径上设置冗余。
验证工作的核心，就是逐项确认这个原则是否真的成立——不是看「有没有制动」，而是看「制动失效时还有什么」。
失效后果的分析
先把可能的失效模式和后果列清楚，验证方案才有针对性：
| 失效模式 | 直接后果 |
|---|---|
| 驱动失效 | 设备停止或溜车 |
| 制动失效 | 溜车、坠落 |
| 电源中断 | 设备停在楼梯上 |
| 控制失效 | 意外动作 |
| 履带或轮组脱落 | 失去支撑 |
| 结构断裂 | 坠落 |
| 约束失效 | 使用者滑落 |
| 操作者失控 | 设备倾覆 |
其中「溜车」和「坠落」是要重点防范的。 其余失效虽然造成不便，但如果设备能安全停住，风险可控。
冗余的层次
冗余可以在几个层次上实现：
双重制动。 工作制动与安全制动分开，前者失效时后者起作用。安全制动应当是失效安全型（断电时自动作用）。
机械自锁。 传动机构设计成有自锁特性，即使动力中断也不会反转。
结构冗余。 关键承力件采用双路径或加大安全系数。
电气冗余。 控制回路、传感器的冗余，避免单一元件失效造成误动作。
操作冗余。 需要持续按住才动作的控制方式（松手即停），避免操作者失能时设备继续运行。
最后一项成本很低但很有效。 持续按压式控制意味着操作者一旦失去控制能力，设备立即停止，而不是继续运行。
各项安全功能的验证
制动能力。 在规定坡度和额定载荷下，验证制动距离和保持能力。要在上行和下行两个方向做。
制动冗余。 人为使工作制动失效，验证安全制动能否独立停住并保持。这一项是冗余验证的核心，不能只看设计图纸。
断电行为。 在楼梯上运行中断电，验证设备是否立即安全停住并保持，而不是溜车。
超载保护。 超过额定载荷时的行为。
倾角限制。 超出允许坡度时的保护动作。
限位与防脱。 履带、轮组的防脱结构验证。
约束系统。 使用者约束的强度和可靠性，包括在倾斜状态下的表现。
耐久后复测。 上述项目在耐久循环之后重测，特别是制动性能。
「人为使工作制动失效然后验证安全制动」是最能说明问题的试验，因为它直接模拟了冗余需要发挥作用的场景。只验证正常状态下的制动，等于没有验证冗余。
楼梯条件的覆盖
实际楼梯的差异很大，验证条件应当覆盖：
踏步尺寸。 不同的踏面宽度和踢面高度。
坡度。 从缓到陡的范围。
表面材质。 瓷砖、石材、木质、金属、有无防滑条。
表面状态。 干燥与潮湿。潮湿楼梯的摩擦条件差别很大。
转角平台。 转弯处的操作。
扶手与净宽。 空间限制对操作的影响。
「潮湿楼梯」这一项建议纳入验证，因为雨雪天气进出建筑时楼梯往往是湿的，而这正是需要使用设备的时候。
操作者因素
多数爬楼机需要操作者控制，所以操作者是安全链条的一环：
操作力。 操作者需要施加的力和保持的姿势。力过大会导致操作者疲劳或失控。
操作的直观性。 控制方式应当直观，避免紧急时操作错误。
培训要求。 应当明确需要培训，并提供培训材料。
单人还是双人。 说明书应当明确，并考虑实际中可能只有一人的情况。
操作者的体力限制。 设备重量和操作力决定了什么样的人能安全操作，应当在资料中说明。
建议在资料中给出操作者的能力要求，比如需要能承受多大的力、需要什么身体条件。含糊地说「由受过培训的人员操作」，实际中无法判断谁合格。
说明书与培训
这类设备的说明书应当包括：适用的楼梯条件与限制；操作者的要求；使用前检查清单；正常操作步骤；紧急情况处理；电池维护；定期检查与保养；以及禁止的使用方式。
「使用前检查清单」尤其重要，因为制动和约束的失效往往有前兆——制动距离变长、约束带磨损、履带张紧度变化。每次使用前检查能在失效前发现。
电池与续航
电动爬楼机依赖电池，电池状态直接关系安全：
续航的确定。 按实际工况（载荷、楼层数）测定，而不是空载数据。
电量指示的准确性。 指示不准可能导致在楼梯中途耗尽。
低电量保护。 电量不足时应当有明确警告，并保证有足够余量完成当前行程。
低温下的容量。 冬季续航下降，要有数据说明。
电池老化。 使用一段时间后容量下降，应当给出更换判断依据。
「在楼梯中途耗尽」是要避免的场景，因为此时设备停在楼梯上，处理起来很困难。低电量保护的设计应当保证不会出现这种情况。
转运与存放
爬楼机常需要搬运到使用地点，这带来额外考虑：
自重与搬运。 设备本身较重，搬运方式和所需人力要说明。
拆装的可靠性。 可拆装的机型，重新组装后的连接可靠性要验证，并给出组装后的检查方法。
运输中的固定。 车辆运输时的固定方式。
存放条件。 温度、湿度要求，长期存放前的电池处理。
长期未用后的检查。 重新使用前应当检查什么，特别是制动和电池。
「拆装后的检查」对可拆装机型尤其重要，因为组装不到位可能在楼梯上才暴露，那时已经来不及。
我们的做法
做爬楼机验证时，我们坚持做冗余的实际验证——人为使主要安全部件失效，看备份是否真的起作用。 这比核对设计文件有说服力得多。
另外，我们建议把潮湿楼梯条件和耐久后的制动复测纳入方案。前者对应实际使用中的不利条件，后者对应设备用了一段时间之后的真实状态。
如果你有爬楼类设备需要安排验证，想先理清测试条件和冗余验证的做法，可以把产品资料发过来一起讨论，或者直接联系：132 4819 8029。检测能力见服务介绍，产品分类见手动轮椅检测与电动轮椅检测，案例见案例。
English version
Conclusion. Stair climbers, whether track-type or star-wheel, carry a user up and down stairs. Failure means user and machine tumbling down the staircase, with extremely serious consequences. The design principle therefore differs from products used on the level: no single component failure should lead directly to a fall, which requires redundancy on critical paths. The core of verification is confirming item by item that the principle actually holds, which means not asking whether there is a brake but asking what remains when the brake fails.
Analysing failure consequences. Set out the failure modes and their consequences so that the verification programme can target them. Drive failure stops the machine or lets it run away. Brake failure allows runaway and falling. Loss of power leaves the machine stranded on the stairs. Control failure causes unintended movement. Track or wheel detachment removes support. Structural fracture causes a fall. Restraint failure lets the user slide out. And loss of operator control overturns the machine. Runaway and falling are the modes to guard against; the others cause inconvenience but remain manageable if the machine stops safely.
Levels of redundancy. Dual braking separates the service brake from a safety brake that acts when the first fails, the safety brake being fail-safe so that it applies on loss of power. Mechanical self-locking designs the transmission so that it cannot back-drive even without power. Structural redundancy uses dual load paths or increased safety factors on critical members. Electrical redundancy duplicates control circuits and sensors so that a single component failure cannot cause unintended operation. And operational redundancy uses hold-to-run control, stopping the moment the control is released, so that an incapacitated operator does not leave the machine running. The last costs very little and is highly effective.
Verifying safety functions. Braking capability is verified for stopping distance and holding at the specified gradient and rated load, in both ascent and descent. Brake redundancy is verified by deliberately disabling the service brake and confirming that the safety brake alone stops and holds; this is the core of redundancy verification and cannot be done from drawings. Power failure behaviour is verified by interrupting power while running on stairs and confirming that the machine stops safely and holds rather than running away. Overload protection is verified above rated load. Inclination limiting is verified beyond the permitted gradient. Anti-detachment features on tracks and wheels are verified. The restraint system is verified for strength and reliability including when inclined. And all of the above are re-measured after durability cycling, braking performance especially. Disabling the service brake and then verifying the safety brake is the most informative test, because it directly reproduces the scenario in which redundancy must work; verifying braking in the normal state alone verifies no redundancy at all.
Covering stair conditions. Real staircases vary widely and verification should cover step dimensions across a range of tread widths and riser heights; gradients from shallow to steep; surface materials including tile, stone, timber and metal, with and without nosings; surface condition, dry and wet, since a wet staircase offers markedly different friction; turning landings and the manoeuvre around them; and handrails and clear width, since space constrains operation. Include wet stairs, because staircases are frequently wet when people enter and leave buildings in rain or snow, which is exactly when the equipment is needed.
Operator factors. Most stair climbers require an operator, making the operator part of the safety chain. Operating force and the posture required matter, since excessive force tires the operator or causes loss of control. Control must be intuitive to avoid errors under pressure. Training requirements should be stated explicitly with materials provided. Whether one or two operators are required should be stated, with consideration of the real possibility that only one is present. And the operator's physical limits matter, since machine weight and operating force determine who can operate safely. State the operator capability requirements in the documentation, such as the force that must be sustained and the physical condition needed; a vague instruction that trained personnel should operate the machine gives no practical way to judge who qualifies.
Instructions and training. Documentation should cover applicable stair conditions and limitations, operator requirements, a pre-use check list, normal operating steps, emergency procedures, battery maintenance, periodic inspection and servicing, and prohibited uses. The pre-use check list matters particularly, because brake and restraint failures usually give warning through lengthening stopping distance, worn straps or changed track tension, and checking before each use finds them before they fail.
How we handle it. For stair climbers we insist on verifying redundancy in practice, deliberately disabling a principal safety component and seeing whether the backup genuinely works. That carries far more weight than reviewing design documentation. We also suggest including wet stair conditions and post-durability brake re-measurement, the first representing the unfavourable conditions of real use and the second the machine's true state after a period in service.
Send us the product information and we will work out the test conditions and how to verify the redundancy. Phone or WeChat: +86 132 4819 8029.