2.19.1 Ascending Car Overspeed Protection
(b) the control system
(1) If the overspeed detection means requires electrical power for its functioning
(-b) any of the following shall not render the detection means inoperative:
(-1) the occurrence of a single ground
(-2) the failure of any mechanically operated switch that does not meet the requirements of 188.8.131.52.1
(-3) the failure of any single magnetically operated switch, contactor, or relay
(-4) the failure of any single solid-state device
(-5) the failure of a software system not conforming to 184.108.40.206.2
(2) The failure of any single mechanically operated switch that does not meet the requirements of 220.127.116.11 shall not render the detection means inoperative.
(3) When a fault specified in (1)(-b) or (2) is detected, the car shall stop at or before the next landing for which a demand was registered, and shall not be permitted to restart.
(4) Once actuated by overspeed, the overspeed detection means shall remain actuated until it is manually reset, and the car shall not start or run unless the detection means is reset.
(b) decelerate the car when loaded with any load up to its rated load [see 2.16.8(h)] by applying an emergency brake conforming to 2.19.3. The car shall not start or run unless the emergency brake is reset.