Overview of IoT Security Challenges and Sensors Specifications in PMSM for Elevator Applications

Abstract

The applications of the permanent magnet synchronous motor (PMSM) are the most seen in the elevator industry due to their high efficiency, low losses and the potential for high energy savings. The Internet of Things (IoT) is a modern technology which is being incorporated in various industrial applications, especially in electrical machines as a means of control, monitoring and preventive maintenance. This paper is focused on reviewing the use PMSM in lift systems, the application of various condition monitoring techniques and real-time data collection techniques using IoT technology. In addition, we focus on different categories of industrial sensors, their connectivity and the standards they should meet for PMSMs used in elevator applications. Finally, we analyze various secure ways of transmitting data on different platforms so that the transmission of information takes into account possible unwanted instructions from exogenous factors.

1. Introduction

Electric motors are crucial in modern elevator technology, with Permanent Magnet Synchronous Motors (PMSMs) being the preferred choice due to their high efficiency, energy savings and superior torque control [1]. In recent years, leading electric motor manufacturers have focused on developing PMSM systems optimized for elevator applications, where reliability, fault tolerance and smooth operation under load are paramount [2,3]. High-efficiency designs and advancements in regenerative braking systems have significantly contributed to energy conservation in high-rise buildings [4]. Moreover, the integration of IoT-based monitoring and fault-tolerant control strategies enhances system safety and minimizes downtime, reflecting the latest trends in elevator drive technology [5].

The transport of people and large loads in tall buildings relies on the use of elevators, which are electromechanical systems with extensive use and considerable potential [6]. Lifting systems are of particular research interest as they combine both electrical and mechanical aspects. Electromechanical elevators are the dominant technology compared to hydraulics [7]. Their transmission of motion is based on the PMSM, which is chosen over the induction motor. Electric motor designers pay special attention to the parametric configuration of the geometric characteristics that come in relation to the load that the motor is required to serve in each case to ensure the safe movement of the users [8].

The continuous use and stress of the motors in such applications poses the risk of unwanted failures that can compromise the functionality of the system [9]. Industries place a strong emphasis on continuous inspection and preventive maintenance in order to minimize the occurrence of failure and to determine the likelihood of faults for a given period of time [10]. Utilizing modern power electronic inverters and also plant control panels provides the ability to record faults and also to adjust tolerance of any faults in the motor through proper drive control techniques. The evolution of electronic systems in recent years and their integration in elevator systems has led to development models for the diagnosis and recording of problems [11].

Technological advances in the Internet of Things (IoT) have opened up new horizons in industrial diagnostics and maintenance, especially for electrical machines. The use of IoT technology combined with advanced communication protocols and robust safety techniques provides a comprehensive framework for early detection, analysis and prevention of faults in the elevators. In addition, an emerging technology based on smart sensors is being utilized for data collection and processing [12]. Serious security vulnerabilities can make the system resistant to any external interference which might affect important parameters of the electric motor, in regard to both electrical and mechanical characteristics [13]. This offers the possibility of early detection of a fault, improving efficiency and reliability, and increasing the lifetime. The application of these technologies can lead to a significant reduction in maintenance and operating costs, as well as the prevention of unexpected outages [14].

The main objective of this paper is to provide an overview to investigate the contribution of the Internet of Things and the use of smart sensors in PMSM in order to ensure motor tolerance of any faults that may occur. Initially, Section 2 highlights the basic techniques of monitoring and data collection from electric motors and elevators and the standards for sensor placement in the machine, as well as the integration of IoT technology in the elevator system. In Section 3, fault diagnosis techniques are presented based on signal analysis. The results obtained from a real experimental setup are analyzed and discussed, providing accuracy in the visualization of current waveforms and vibration. Section 4 describes communication protocols and security issues for the sensors used in the experimental elevator setup. Section 5 discusses IoT technology for elevator applications, and the communication protocols, the possible risks and the security gaps in data transmission. The paper proposes a model for integrating multi-sensors in various parts of elevator subsystems, considering the possibility of cyber-attacks and external interference to the electrical and mechanical parts of the motor and the elevator. Section 6 presents proposals for future extension of this research study. Finally, Section 7 summarizes the conclusions drawn from our literature survey and confirmed in our proposed methodology for condition monitoring.

2. Condition Monitoring in PMSM

Elevators are of enormous importance both in the national economy and in everyday life, operating as a complex electromechanical system. The main fundamental subsystems are the mechanical parts, electrical parts and safety devices [15]. As science and technology advance rapidly and automation becomes more widespread, ensuring the safety and reliability of engineering systems has emerged as a critical concern. Accurate and timely fault detection, as well as the identification and evaluation of fault types, has become a central area of research in mechanical fault diagnosis technology [16].

2.1. Condition Monitoring Techniques

Depending on how a failure is resolved, we can distinguish three different types of maintenance strategies for operating systems. Each process is differentiated based on some specific criteria such as cost, time or the resolution result it offers [17]. Corrective maintenance is the least widespread monitoring technique in elevator systems as it is very costly, time consuming and considered inefficient due to the continuous maintenance that may need to be performed at regular intervals [18].

Similarly, reactive maintenance involves repairing the damage after it has occurred. This process involves the replacement of defective subsystems. The main disadvantage is the downtime during working hours and the high cost of repairing the components [19]. A maintenance schedule based either on specific statistical historical data occurring at intervals or based on operating conditions with continuous monitoring should be followed [20].

Predictive maintenance is considered particularly important in the context of Industry 4.0, with a strong emphasis on data analysis and continuous monitoring of equipment [21]. In recent years, the modern elevator industry has focused on the creation and development of advanced monitoring systems to generate valuable data, thereby helping to improve the accuracy of fault predictions [22]. Recent research [23] has shown that predictive maintenance plays a significant role in extending the life of equipment in order to detect a future anomaly in time. By integrating various technologies such as cyber–physical systems, the Industrial Internet of Things (IIoT) and machine learning, such technological needs can be met.

In order to collect, analyze and process this volume of data, these systems consist of the following elements [24]:

• Sensor measurements;
• Data transmission to the platform;
• Signal processing;
• Decision making;
• Performance indicators;
• Planning and maintenance control; and
• Feedback control.

Utilizing reactive and predictive maintenance techniques, scheduling and feedback control were studied. The use and development of new smart sensors contribute to drawing useful conclusions for fault detection [25]. State-of-the-art predictive maintenance uses new diagnostic techniques and multimodal data from the various elevator subsystems. These data include vibration measurements, current intensity in the stator windings, acoustic analysis and thermal imaging [26].

The evolution of the Internet of Things (IoT) over time has revolutionized the field of engineering electromotive systems. In addition, for data collection and processing on cloud platforms, data integration has also taken place in other mobile applications that have the ability to operate and utilize control strategies [27]. According to [28], an advanced elevator system based on a wireless AdHoc network was developed and evolved by integrating and utilizing information from all elevator motion floors. The results indicated that real-time elevator movement was related to the information received by the system about the number of passengers for each floor.

Based on the elevator automation panel, a modern technique for monitoring and controlling the system involves the integration of a programmable logic controller (PLC) where sensors are stored in a database [29]. Similar data collection techniques to detect a potential failure have been applied in a variety of industrial applications, such as wind turbines using permanent magnet synchronous generators (PMSGs) [30].

The gradual decrease in experts who are able to identify equipment failures and rapidly repair them has led to the development of information systems for forecasting and diagnosing equipment failures [31]. Many systems have been proposed and implemented in practice. One of the most successful involves artificial intelligence (AI). These advanced information systems are known as expert predictive maintenance systems, and diagnose equipment failures [32] using the same verbal rules that humans use.

New machine learning methods such as LS-SVM [33], XSBoost [34] and the genetic algorithm [35,36] have been used to process data and identify potential faults. The main problem faced by these techniques for fault prediction in elevation systems is related to the noise of the signal transmitted by the sensors [37]. This limits the accuracy of the data that can be extracted from the analysis of the signals.

In order to address this problem, stochastic models have been proposed, where, by exploiting wavelets and thresholding techniques, extraction of reliable features is achieved [38]. The most typical techniques for analysis and fault detection for monitoring the functional state of the PMSM are as follows [39]:

• Vibration analysis;
• Stator winding current analysis;
• Thermal analysis;
• Torque and speed measurements;
• Power analysis;
• Axial leakage flux analysis; and
• Gas analysis.

With the application of neural network models, and the exploiting of a large amount of data, the capability to detect electrical faults in the case of short circuit was given [40]. Moreover, it was observed that other techniques based on technical intelligence such as Support Vector Machine (SVM), K-nearest neighbor (KNN) and artificial neural networks showed reduced signal processing image resolution, affecting the study of critical features. Thus, the convolutional neural network (CNN) was found to be more qualified [41].

Traditional deep learning models operating in the context of supervised learning require the following: (a) huge datasets to identify complex patterns of errors, and that (b) the population of labels containing these datasets must be balanced to reduce model bias [42]. At the industrial level, the Industrial Internet of Things (IIoT) has significantly improved the size of acquired and used datasets [43].

This improves the safety and reliability of the equipment for long-term use, allowing real-time monitoring and data collection through sensors and devices embedded in modern industrial subsystems [44]. In the newest modern electromechanical elevators, it has been found that the central panel, using the appropriate algorithm (Relief-F algorithm), can detect early signs of malfunctions thanks to IIoT integration [23].

Figure 1 shows a typical, complete laboratory analysis block diagram including the modeling of the electrical machine, the collection of data from the computer and the processing of the signals obtained from the experimental setup. With the integration of neural networks, the actual dynamic situation is visualized by detecting bearing failures and thermal stress.

2.2. Sensors Specifications

In order to accurately achieve the collection and processing of signals, it is necessary to comply with certain international standards and regulations that define specifications, sensor placement procedures and soundness limits for various parameters such as temperature, current, vibration and harmonics. The next sub-section provides an overview of the most commonly used standards.

2.2.1. International Standards (ISO)

• ISO 10816-3:

ISO 10816-1 [46] and ISO 10816-3 have been the de facto standards for the evaluation of machine vibration for many years. Every condition monitoring practitioner will have referred to these standards for the evaluation of vibration severity, acceptance testing and setting database alarms. Whilst ISO 10816-1 has been succeeded by 20816-1 [47], the replacement for ISO 10816-3 is yet to be released. The new standard, 20816-1, is used to analyze the mounting positions of the vibration sensor. According to Figure 2, related to vibration severity, for small machines the limits for satisfactory values reach 1.8 mm/s [48]. Table 1 shows the ISO 10816 vibration levels for Class 1 motors.

• ISO 13373-1:2002:

ISO 13373-1 [49] addresses the monitoring of vibration in machines through condition analysis by providing guidance on the sensor installation process and data collection procedure. Thus, based on the experimental measurements, value limits are also determined.

• ISO 14694:2003:

ISO 14694:2003 [50] is mainly used in pumps, but is also relevant for machines focused on the measurements of vibration.

• ISO 10816:8:2014:

ISO 10816:8:2014 [51] defines where sensors should be placed on electric motors. Its main advantage is the high accuracy in the range of its measurements. According to Figure 3, we distinguish four categories regarding the use and status of the electric motor.

Level 1, with the green color, is the good condition for the electrical motor, in which it operates without concern; Level 2, with the yellow color, is an acceptable condition, wherein the machine works satisfactorily for continued operation. Level 3, with the pink color, is an undesirable condition, and indicates that attention is required for maintenance or repair, and Level 4, with the red color, is the serious condition, which may pose serious harm to the operation of the machine.

The categorization of each class depends on the size and power of the motor. Class 1 refers to individual components or parts of the machine with power up to 15 kW. Similarly, Class 2 includes medium-sized motors with power ratings of 15–75 kW without special foundations, or with special foundations reaching up to 300 kW.

Class 3 concerns large electrical motors with rotating masses mounted on heavy and rigid foundations, which are rigid in relation to the direction of vibration. Finally, Class 4 concerns large machines mounted on foundations which are soft in relation to the direction of vibration measurement.

Table 1. ISO 10816 vibration levels for Class 1 motors [53].

Motor Conditions	Minimum Level (mm/s)	Maximum Level (mm/s)
Good	0.28	0.71
Acceptable	1.12	1.80
Monitored closely	2.80	4.50
Unacceptable	7.10	45.90

Table 1. ISO 10816 vibration levels for Class 1 motors [53].

Motor Conditions	Minimum Level (mm/s)	Maximum Level (mm/s)
Good	0.28	0.71
Acceptable	1.12	1.80
Monitored closely	2.80	4.50
Unacceptable	7.10	45.90

2.2.2. Sensor Placement

Measurements are collected using smart sensors as their accuracy is based on the points and the way they are placed. The three main categories of sensors for fault diagnosis in PMSM are the accelerometers, thermal and power sensors.

• Vibration sensors (accelerometers):

Vibration sensors (shown in Figure 4) are usually placed at points where strong vibrations are detected, such as around motor bearings. In order to ensure the accuracy of the measurements, they should be installed on solid surfaces [54]. For small machines, a vibration level of 2.3 mm/s RMS is generally acceptable; for a medium size motor, a vibration level of 4.5 mm/s RMS is the maximum permissible limit.

• Thermal Sensors:

The temperature sensors are placed in the bearings, the motor housing and the internal stator windings. For high power motors, the sensors should be located near the critical parts that have a higher risk of overheating. For the small and medium size electrical motors, the temperature levels should not exceed 90–100 °C for bearings and 130–140 °C for stator windings. Figure 5 illustrates the PMSM temperature and torque diagram for different loads:

Lee et al. [57] focused on temperature estimation in an interior permanent magnet synchronous motor (IPMSM) by utilizing equipment with a thermal circuit. This paper analyzes the modeling consideration, the eddy current losses in the permanent magnet and the core losses in the stator and rotor. Figure 6 shows an IPMSM that uses multi-sensors (thermal sensors in this case) which are placed on the windings, the outer casing and the engine bushings. Collecting and processing data from a set of sensors that are placed in various points in/on the motor can enhance the preventive maintenance for the system. The results indicated that the difference between calculated and experimental data is 10%, which is quite satisfactory.

A similar model of multi-location sensors in induction machines was used to predict the temperature of both the stator and rotor, providing better functionality. The developed thermal model was based on the Lumped-Parameter Thermal Network—LPTN. This enabled better monitoring of the machine’s condition in real time [58].

• Power Analyzer Sensors:

The power analyzer sensors involve the measurements of current and voltage and are mounted on the terminals of the motor windings (shown Figure 7a) or on the distribution board (shown Figure 7b) to monitor the current and voltage flowing through each phase of the motor [59]. The voltage and current measurements must be continuous to detect anomalies such as harmonics or overloads. In [60], the current sensors are placed in phases A and B for control purposes, while, respectively, the third sensor is placed in phase C and is used exclusively for fault detection and compensation in case of a failure in one of the two main sensors.

2.2.3. Elevator System

State-of-the-art elevator technology focuses on the safe and comfortable movement of passengers. In general, the integration of new and modern electromechanical and hydraulic systems tends to increase the risk of unexpected failures due to the complexity of these technologies. Smart cities and smart building solutions integrate predictive maintenance that contributes to the immediate maintenance of components, increasing the available lifespan [22]. Similarly, in hydraulic elevators, lubricating oil analysis was carried out to detect wear and corrosion of the metallic components of the elevator. This reduced the number of unscheduled outages [63].

Zhou et al. proposed the development of condition monitoring system based on Internet of Things (IoT). Various parameters, such as speed, vibration and chamber position, are recorded continuously and are stored and transmitted to internet platforms, the most typical of which is the cloud, in a non-intrusive way (shown in Figure 8) [64].

By utilizing low-cost materials such as Inertial Measurement Unit—IMU—speed sensors, the monitoring of elevator speed can be easily and economically achieved. Then, using the Kalman filter, the exact speed of the elevator is estimated. The aim of the research presented in [65] is to highlight the important role of proper sensor placement in accuracy issues and the efficient use of algorithms so that they can easily and quickly be adapted.

In [66], the application of deep machine learning methods using neural networks was investigated. The development of the automatic feature extraction model contributed to accurate error detection, while Random Forest algorithms were used accordingly. These techniques contributed to training the model to separate signals in two categories, healthy and erroneous, by reducing false alarms. These techniques were extended to other parts of the system besides the PMSM, such as in the operation of the elevator doors. The decision-making system includes three interconnected phases. First, the door functionality is classified, the data are preprocessed as they are, timing is aligned and finally the errors are classified using autoencoder and a Support Vector Machine (SVM) [67].

The use of a combined weighting method can lead to an estimation of performance and operational safety. Noise sensors are placed in the motor room and elevator cab while opening and closing time sensors are placed on the door leaves. The signal processing includes vibration and noise frequencies, deviations from normal values and door speed [68].

3. Fault Diagnosis Methods in PMSMs

The PMSM is the dominant technology in the elevator industry due to its many advantages both in terms of performance and proper guidance, as well as energy savings in buildings. These are multi-pole, low-crank and high-torque motors of particular research interest to designers studying optimization techniques to reduce motor and entire-system losses [69].

The continuous operation of PMSMs, especially in high load lifting systems, can cause severe failures, affecting the stability of the system. Depending on the damage, we can classify the failures as electrical, mechanical and magnetic [70]. The following graphs (shown in Figure 9a,b) show the percentages of failures based on specified voltage levels (48 V to 380 V). Thus, we find that at a low voltage, the highest rate of failure is observed in the bearings (41%); respectively, at a high voltage, we find higher rates of failure in the stator (66%) [71].

3.1. Electrical Faults

According to [72], more of the failures that occur are due to electrical problems. Some of them are due to open or short circuits, voltage instability, inverter driving or insulation faults [73]. The most typical cause failures is due to insulation faults. Stator faults are divided into three types: the internal turn short circuit (ITSC), phase-to-phase short circuit and earth short circuit. In general, an interconnection among the three types of failure can lead to a possible failure in the motor windings, which could develop into a catastrophic phase-to-phase short circuit and a grounding short circuit [74]. The intense mechanical and thermal stresses to which the electric motor is subject are the main cause of these failures [75].

ITSCs are particularly destructive in nature as they spread very quickly. It is fairly difficult to detect faults that can lead to total motor destruction. Research efforts are focused on designing and controlling the PMSM to exhibit tolerance to such faults, so the elevator can continue to move [76]. Manufacturers pay particular attention to the correct design parametrization of the PMSM as the intensity of the inter-turn short circuit fault (ISCF) varies depending on the design of the electrical machine [77].

3.1.1. Signal Processing in the Frequency Domain

The most common methods for diagnosing ITSC faults involve the analysis of signals in the frequency domain. Upon receiving a signal, frequency domain processing is performed using FFT, which is widely used as the basic diagnostic approach [78]. Its main advantages are related to its simplicity, low cost and its ability to monitor the machine in real time [31].

The utilization of the stator phase signal contributed to the extraction of potential problems in the PMSM stator windings [79]. The technique is known as Motor Current Signal Analysis (MCSA) which uses symmetrical elements and discrete Fourier transform for error analysis [80]. This creates the possibility of detecting cracks in the magnets, influencing rotor geometry and also reduced magnet forcing [81].

In most investigations, the increase in amplitude of the second harmonic (2 fs) component is considered a symptom of a stator winding fault [82]. Many studies have shown that the occurrence of third harmonic spectral resolution causes an increase in amplitude and thus a greater likelihood of failures [83]. In order to increase the accuracy of the model, the authors presented, in [84], a motor fault diagnosis technique based on waveform transformation energy analysis and Bayesian classification.

In addition, another parameter considered is the instantaneous negative values of the current component as the amplitude increase causes asymmetry between phases [85]. Using the experimental setup of [86], the stability of this method relative to variations in charge and rotation speed was found. The incorporation of fuzzy logic to analyze the negative sequence (shown in Figure 10) of the current and voltage components of the stator winding contributed to the successful detection of ITSCs [87].

Boileau et al. proposed the detection of winding faults by studying the harmonic analysis of the voltage signal, and approximating it in the d-q field [89]. In [90], the FFT analysis of the axial flux signal is proposed, which is also a very effective technique. In order to draw more reliable conclusions, other characteristics of the PMSM, such as the electromagnetic torque [91], the sum of the phase voltage and the line voltage, were also exploited. By studying amplitudes, it was found that the occurrence of third and second harmonics in both the line voltage and electromagnetic torque significantly increases the risk of PMSM rotational or control instability [92].

The current distortion in the machine windings can also be a result of unbalanced supply voltage. In these cases, the side frequencies from the healthy and faulty signal are examined and compared [93]. Many researchers have focused their interest on envelope diagnostic techniques, as some limitations were observed from harmonic analysis of the current signal [94]. One proposed methodology was based on the analysis of the Zero Sequence Voltage Component (ZSVC). Utilizing discrete wavelet transform (DWT), the noise was removed, while FFT was used to process the signal accordingly. This enabled the finding of challenges in identifying subtle faults that are hard to detect due to limited resolution of the fundamental frequency [95].

Also, it is distinguished for its analysis of operational characteristics of PM-type machines without limitations with regard to rotational speed, detection capabilities—even in transient situations—and without affecting the PM-type machine’s motion [96]. Easy adaptation to fault-tolerant systems make it an attractive option, as transducers in these cases are connected to the neutral point of the motor under fault conditions [97].

A fairly innovative method for fault diagnosis in stator windings in Line Start Permanent Magnet Synchronous Motors (LPMSMs) is performed using acoustic signals. Analysis of the sounds produced during motor operation indicates the extent of the damage. The data are collected easily and economically using a simple smartphone [98].

3.1.2. Signal Processing in the Time Domain

Although for many research projects frequency domain signal conversion is the most popular method due to its efficiency, it has a major drawback, as it requires, during FFT analysis, the signals to be stationary, making them unusable in modern electric-drive systems [99]. An alternative method considered involves the use of Short-Time Fourier Transform (STFT) for fault detection in PMSMs.

This method is distinguished by its ability to process the signal in the frequency–time domain simultaneously. Thus, it provides a complete spectral analysis for each time period by detecting both stable and transient faults regardless of variations in machine functionality [100]. Comparing various transformation techniques such as Short-Time Fourier Transform (STFT), Undecimated Discrete Wavelet Transform (UDWT), Wigner–Ville Distribution (WVD) and Choi–Williams Distribution (CWD). Linear discrimination classification indicated that the UDWT method has higher accuracy and efficiency identifying and diagnosing failures that occur during transient operation conditions [101].

In [102], the authors demonstrated that STFT is particularly capable of detecting electrical and mechanical faults in transient situations. Changes in the STFT spectrograms resulting from ITSCs in the PMSM during variable speed are studied in [103]. The main selection criteria are related to the possibility of continuously monitoring the growth of amplitudes and observing their possible changes over time [104]. The incorporation of neural networks has contributed to the creation of models for classification and separation into levels of short-circuit fault conditions [105].

CWT uses a time window, ensuring good resolution in both the time and frequency domains, allowing a more accurate time–frequency response [106]. It is particularly notable for its efficient operation on non-static signals and has been used with great success in electric and hybrid vehicle applications [107]. Particularly when combined with a Deep Learning Network (DBN) and the use of the Least-Squares Support Vector Machine (LSSVM), signal processing can be performed even in noisy environments [108].

Discrete wavelet transform (DWT) analyses the signal at discrete scales, as the signal can be divided into two components, the detail and the approximation. The symptom of the appearance of a PMSM electrical fault is a change in the approximation and detail waveforms, masking the characteristic components of this type of damage. Similarly, in addition to electrical machines, it is also widely used to diagnose faults in power transmission lines [109]. Utilizing the DWT stator phase current, the possibility of detecting fault in windings at the initial stage was studied in order to avoid the complete destruction of the machine [71].

The capability of splitting the signal into low and high frequencies contributes even to the processing of complex signals that require component noise removal. The creation of a DWT-CNN system offers the possibility of splitting the signal into different frequency bands and multiple levels [110]. Converting the three-phase voltage signal in the q-axis, with waveform transformation, can lead to safe conclusions regarding possible future errors [111].

An equally effective technique for time–frequency domain analysis is the Hilbert–Huang Transform (HHT). Yang and Chen, who studied a multi-phase PMSMs, used the HHT to analyze the instantaneous reactive power of each phase to detect even small ones in the signal frequencies [112]. The HHT stator phase current and energy calculation offer the possibility to detect the fault during transient periods, even in cases of load switching [113]. Figure 11 shows the HHT spectrogram for specific rotation speeds where we can see significant variations in noise or vibration levels, which may indicate fault development in the operating frequencies.

The combination of HHT with appropriate feature selection through the Pearson correlation coefficient created a reliable fault detection system. Its ease of use in polycyclic signal currents without limitations of dynamic and nonlinear signal detection make it particularly attractive for predicting severe failures, such as temperature rise and magnetic saturation in transformer cores [114,115]. The collection and analysis of the current signal from the embedded motor sensors without the use of the external sensors is what is proposed in [116].

3.2. Mechanical Faults

Another equally important parameter to consider is the occurrence of mechanical failures that are the result of deviations of a process variable. These are gradual or sudden faults that are divided, on the basis of their time of occurrence, into abrupt, incipient and intermittent faults [117]. Many researchers have tried to apply modern diagnostic techniques focused on monitoring mechanical quantities such as force, mechanical torque, shaft rotation speed, vibration and noise [118]. By studying the international literature, the most typical faults encountered are bearing failures, shaft eccentricity and rotor bar failure. These faults significantly affect the performance and life of the machines, and early diagnosis through vibration monitoring or other methods is critical [119]. Thus, it is essential to select an appropriate acceleration sensor with a high sampling frequency and place it in a specific location either inside or outside the machine.

3.2.1. Bearing Faults

Bearings are a major component of the PMSM, as they support the rotational speed of the machine shaft. Due to the mechanical stresses during operation of the machine, they are made vulnerable to such working conditions [120]. Severe vibration, misalignment and load variability are some of the causes that result in small pieces becoming detached from the bearing [121].

The occurrence of severe vibration and noise are causes of damaged bearings. Changes in the direction of flux in the clearance create additional harmonics in the winding current [122]. The main signals considered are vibration, noise and stator currents [123,124]. The majority of the methods qualified are related to the collection and processing of appropriate mechanical signals. The most typical and simple technique is also, in mechanical terms, the conversion from the time domain to the frequency domain by FFT [125].

Initially, based on the cost, the stator current was particularly studied as specific signatures associated with bearing faults tend to appear. Statistical approaches proved that spectral kurtosis is a very effective method for monitoring mechanical faults [126]. The Tacholess Order Tracking (TOT) method relies on the use of only one current measurement without the presence of a speed sensor. The central objective of the method is to make the signal spectrum independent of the rotational speed, thereby facilitating the analysis of the spectral components associated with the faults [127].

In [128], the merging of data from multiple sources to achieve higher accuracy was proposed. In this study, the periodically studied current signal, the fusion of biphasic signal and multi-scale feature fusion are used to isolate the features associated with faults. Using machine learning techniques, Yu and Gao processed the current signal in the time domain, separated fault factors to construct feature vectors and, using the GA-SVM model, classified the faults [129].

The spectral analysis of the magnetic flux signal contained more symptoms for a damaged bearing than the analysis of the winding spectrum [130]. By testing the velocity signal with FFT and kurtosis, Rems et al. found that analysis of the speed spectrum kurtosis signal could achieve results similar to those obtained for the vibration method [131]. An electromagnetic model was based on the diagnosis by FFT of mechanical vibrations and FFT of the Park vector unit of current stator. Thus, it is shown that the bearing failure is visible also in the electromagnetic torque [132].

The analysis of the vibration and noise signal can be examined with a comparative combination of multiple processing techniques. One particularly novel technology is related to deep learning. The system can be properly trained to isolate key signal characteristics, while eliminating noise in real operating environments [133]. A particularly novel method for elevators, as has been studied with great success in PMSMs for electric vehicles, is through the optimization of motor sound quality and critical band analysis to identify noise sources [134].

In addition to one-dimensional signal analysis, two-dimensional analysis is also considered, in which images derived from transformations of the original signal, such as time–frequency images, are used [135]. A particularly combinatorial technique proposed for the first time in the literature involves the combination of STFT and the Image Classification Transformer (ICT) model, which is distinguished by its improved capabilities compared to neural networks. The diagnosis results reached 98.3%, and the simulation execution time was noticeably limited as high computational resources were not required [136].

By proposing the Order Analysis (OA) technique, Lu et al. was able to diagnose failures in PMSM bearings even under variable speed conditions. The central objective was to analyze the rotational order and resample the vibration or sound signals in the angular plane instead of with regard to time, known as Fast and Online Order Analysis (FOOA) [119]. Moreover, the Zoom FFT (ZFFT) method achieves improved frequency analysis by focusing on specific bands where accurate analysis is required in order to identify the fault [137]. Figure 12 clearly shows the difference between a healthy and a damaged bearing race.

Discrete wavelet transforms (DWTs) can detect fluctuations in the current signal and analyze the harmonic content of the current signal. By isolating the frequencies, they can determine any changes in the air gap between the stator and rotor [139]. The combination of discrete wavelet transforms (DWTs) with the Ridges Algorithm (Ridges Algorithm) technique has enabled the identification of the local maxima of the signals in order to extract the most critical features that will give us better insight into the probability of faults [140]. Figure 13 depicts the continuous wavelet transform (CWT) time-frequency diagram of fault imaging in with rheostats for the inner (shown Figure 13a) and outer ring (shown Figure 13b).

The differences in the peaks of the spectrum in the first diagram are observed and analyzed, and characterized as irregular with strong fluctuations that are not clear. By processing the signals, we find that the vibrations depend on the static position of the ring and its contact with the spheres. In the second diagram, frequent and discrete peaks in the signal spectrum are shown, which are particularly pronounced at regular intervals. In the red region the intensities are particularly high as a result of the intense vibrations.

The introduction of Industry 4.0 has led to the use of the IoT as an effective diagnostic tool. In [142], an algorithm was implemented where the data from the magnetic sensor and accelerometer were collected by IoT devices where they were processed to produce a new signal, reducing, by 95%, the total volume of transmitted data. The integration of this technology contributed to the collection of data via Wi-Fi or GSM to a web server, and helped to record and view the data even in the most remote areas [143].

3.2.2. Eccentricity Faults

The largest percentage of mechanical failures (about 80%) lead to eccentricity [144]. Eccentricity in electric machines occurs when the rotor’s axis is displaced from the center of the stator bore and, therefore, there is unevenness in the distribution of the air gap between the stator and the rotor [145]. Three types of eccentricity are distinguished: static, where the rotor is displaced but its axis remains parallel to the stator axis, so the minimum length of the air gap is constant and does not change position during engine operation; dynamic, where the rotor’s axis is both displaced and tilting or moving, so the minimum length of the air gap remains constant, but changes position during engine operation; and mixed, where the minimum air gap length changes both in value and position with rotor rotation [146].

The eccentricity of the air gap causes uneven air gap flux density distribution, and is the cause of the forces acting on the rotor, and of the imbalance in the magnetic pull, which leads to undesirable phenomena such as power imbalance, demagnetization, misalignment and overload, and can lead, in extreme cases, to friction of the rotor against the stator, and as a result the destruction of the insulation of the windings and damage to the rotor magnets [147].

The basic signals in eccentricity diagnosis are as follows: stator current [148,149,150], mechanical vibrations, noise [151,152,153], air gap search coil voltage occurrence [154,155], stator voltage, speed, load torque [156], stator inductance in the d-axis, Ld [157,158], Back Electromotive Force (BEMF) [155] and unbalanced magnetic pull [159,160].

The most basic method applied to evaluate the type and level of eccentricity is the stator current, using frequency domain techniques such as FFT and power frequency spectral density (PSD) [161]. Eccentricity detection is often performed on the basis of Order Analysis (OA), Angular Domain-Order Tracking (AD-OT) [162] and wavelet transform (WT) [163], which enable the analysis of drive signals in steady states. But, there is a problem in distinguishing dynamic eccentricity from demagnetization or load unbalance. Only with the flux analysis in the air gap is it possible to distinguish these faults from each other; but, this requires the use of an additional measuring coil in the stator slots.

3.2.3. Unbalance Faults

Unbalance refers to unequal mass distribution in the rotor, which leads to centrifugal forces and moments. This situation can cause dynamic reactions in bearings, resulting in vibration and noise, thus leading to bearing damage. A symptom of imbalance is an increase in the amplitude of the rotational frequency that occurs in the diagnostic signal. Thus, the techniques used to detect unbalance are mainly related to the vibration signal and the stator current [164,165]. The methods are based either on external sensors (accelerometers, cameras, temperature sensors), or on phase current sensors embedded in the motor, and signals are analyzed in the frequency domain by the application of FFT or PSD. The misalignment in the PMSM drive concerns the connection between the motor and the loading machine [166,167].

This can be classified as angular misalignment, when the angle between the rotor and the stator axis is incorrect, and parallel misalignment when the rotor and stator axes are parallel but not collinear. It is difficult to determine the level of misalignment when the drive is operating, as there are no measurement systems to measure it [168]. The only way to detect it is to measure the secondary effects of forces acting on bearings, shafts and couplings. For this purpose, the changes in amplitudes of characteristic frequencies related to the rotational speed of the motor or to stator current are looked for in diagnostic signals. In the FFT [124] and PSD [169] analyses, Park’s vectors of these signals in the frequency domain, the detection of the type and importance of the damage, for all cases, such as eccentricity, imbalance and misalignment, are based on the third and fifth order harmonic frequencies [170].

3.3. Magnetic Faults

Demagnetization

Magnetic issues in PMSMs arise due to various reasons, including poor design, material degradation, or operational stresses. Common magnetic problems include demagnetization, magnetic saturation, uneven magnetic field distribution and cogging torque. Demagnetization occurs when the permanent magnets in the rotor lose their magnetic properties, either due to overheating or exposure to excessive external magnetic fields. Demagnetization can result in reduced torque production, loss of efficiency and motor instability [171].

Excessive current can lead to magnetic saturation in the stator core. When the magnetic flux density exceeds the material’s capability to linearly magnetize, the motor may lose efficiency and operation may become unstable [172]. Improper rotor alignment, rotor eccentricity or unbalanced loads can lead to uneven magnetic field distribution, causing vibrations, noise and mechanical wear. Cogging Torque is caused by the interaction between the stator slots and the rotor magnets. It leads to torque ripples, which can cause vibrations, noise and reduced smoothness during low-speed operation, caused by the interaction between the stator slots and the rotor magnets [173].

Understanding magnetic problems, fault diagnosis and fault tolerance methods for PMSMs is critical for maintaining their performance and ensuring system reliability [174]. The appearance of these symptoms is highly dependent on the winding configuration and sometimes, even in the case of demagnetization, there are no different harmonics or sub-harmonics compared to those in a normal motor due to asymmetry, eccentricity or misalignment [175].

Gyftakis et al. explores the generation of demagnetization harmonics in permanent magnet machines with concentrated windings. It specifically investigates the mechanisms through which these harmonics are generated and their effects on the machine’s performance, and focuses on the interactions between the winding configuration and the magnetic field, highlighting how concentrated windings can lead to specific harmonic frequencies that impact the efficiency, and ensuring dynamic stability of the machine under varying load conditions [176]. However, in some cases, the application of the conventional FFT concerns only the stationary motor conditions relative to speed and load torque. But also, there are other motor damages related to rotational speed, such as ITSC and mechanical damages, such as dynamic eccentricity, that can be identified by the same frequencies in the stator current or rotation speed [177].

Faults in the permanent rotor magnet mainly include uniform demagnetization faults, local demagnetization faults and complete demagnetization faults. Existing fault-tolerant control systems rely heavily on both robust hardware design and sophisticated software algorithms to ensure resilience [178]. From the perspective of the fault tolerance of the hardware design of permanent magnet synchronous motors, regarding the use of suitable permanent magnet materials, optimization of the magnetic circuit structure, heat dissipation and cooling analysis of the motor body, etc., in order to reduce the risk of permanent magnet loss [179], or by an adding auxiliary excitation source, the hybrid excitation motor is designed to improve the influence of permanent magnet demagnetization [180].

The finite element method is an effective analysis method in the PMSM anti-demagnetization design process, which is used to realize the qualitative and quantitative diagnosis of the demagnetization fault of the permanent magnet. This method is used to obtain accurate information regarding permanent magnet flux through analysis and processing of a physical model of the motor [181].

Existing research on the demagnetization of permanent rotor magnets has mostly been carried out in the area of fault diagnosis [182,183], where a detailed study on the impact of magnetic field disturbances on PMSM performance has been carried out, and the use of MCSA techniques and other methods for detecting demagnetization faults in PMSMs has been discussed, and the related results of fault tolerance control are few [184,185] where various fault-tolerant design techniques for PMSMs are presented, including reconfiguration methods and advanced control algorithms, especially focusing on stator winding faults.

The occurrence of demagnetization faults will cause the amplitude of the permanent magnet flux linkage to decrease. To maintain a constant electromagnetic torque, it is necessary to ensure that the effective flux linkage of the motor is unchanged, since the magnetomotive force of the rotor’s permanent magnet cannot be controlled. However, proper control of the stator current can be achieved with the use of a Variable Voltage Variable Frequency (VVVF) inverter, with the possibility to adjust the speed of the elevator in order to achieve safe movement of passengers and better energy saving rates, so that the motor is fault-tolerant and remains operational under fault conditions [186].

Wang et al. [187] proposed a fault tolerant control method based on adaptive observer flux linkage on-line detection. By monitoring the flux loss of permanent magnets in real time, the state current observations were calculated in real time and the current observation values were fed back to the controller to respond to the current. Accurately track a given current to achieve stable operation under motor demagnetization faults.

In [188], a nonsingular terminal sliding mode observer (NTSMO) is designed, which can estimate the torque according to the permanent magnetic flux and stator current. Compared with the traditional sliding mode observer, it improves the torque accuracy of the system. Considering the uncertainty of PMSM model when the parameters are disturbed, the model-free control (MFC) method can reduce dependence on the system model and significantly improve the control performance of the motor.

By applying the combined model of free control and sliding control, the main advantages and disadvantages of these techniques are highlighted in the different PMSM control classes, as well as their contributions to both speed and motor current control. The speed and current controllers were designed using the model-free nonsingular terminal sliding-mode control algorithm to improve the response speed and steady-state tracking accuracy of the PMSM drive system. Additionally, the unknown variables of the SMO estimation ultra-local model were designed to overcome the impact of permanent magnet demagnetization failure on the output torque [189].

A robust predictive current control (RFT-PCC) fault-tolerant scheme based on composite observers was developed for PMSMs. Compared with the traditional PCC method, a composite observer based on the sliding mode observer and Luenberger observer is added to observe the next prediction value of compensation voltage and current. The proposed method improves the tracking accuracy of stator current, and reduces parameter disturbance and torque ripple during demagnetization [190]. Figure 14 shows the generation of a demagnetization failure in the PMSM.

3.4. Taxonomies—Literature Overview

This section presents a taxonomy of the studied literature.

Table 2. Fault-Tolerance Methods.

Fault Type	Method	Identification Method	Advantages	Disadvantages	Limitations
Electrical Faults [96,97,185]	Fault Tolerant Control (FTC)	MCSA, Wavelet Transform	Automated strategies to adapt and reorder operation to continue despite failures	Complex programming and reliance on algorithms	Requires constant monitoring of system parameters for proper operation
Mechanical Faults [16,82,184,185,188,189]	Redundant System Passive Vibration Isolation	Vibration Analysis, Acoustic Emission Analysis	Simple and reliable, as the redundant configurations allow continuous operation despite mechanical failures	Increased installation and maintenance costs; requires more space	Does not address fundamental system failures; additional components may introduce other potential failure points
Magnetic Faults [178,179,180,181,186,187,190]	Reconfigurable Hardware	Magnetic Flux Monitoring, BEMF Analysis	Allows reallocation of system resources to avoid errors; enhances motor robustness against magnetic faults	Requires specialized equipment and infrastructure; increases cost and complexity of the motor	Limited by system architecture; not applicable to existing motors

and

Table 3. Fault Diagnosis methods.

Fault Type	Diagnosis Method	Advantages	Disadvantages	Limitations
Electrical Faults
Short Circuit [79,80,81,82,83,84,85,86,120]	Motor Current Signature Analysis (MCSA) FFT, EPVA, HHT	Low cost; can be applied in real time; ideal for detecting faults in the stator and magnets	Stable operation required for optimal performance	Limited to noise and transient faults
Insulation Failure Voltage Instability [66,92,104,129,130,131,132,171]	Model-Based Diagnosis Observation, Voltage Monitoring, Kalman Filter	Compares actual motor behavior with a mathematical model to detect discrepancies which indicate faults	High accuracy if the model is well-calibrated; can detect incipient faults	Inaccurate models may lead to false positives/negatives; computationally intensive
Short Circuit, Inverter Malfunction [99,100,101,102,103,106,107,108,109,111,112]	Wavelet Transform DWT, FFT, ZSVC	Can detect transient faults and isolate noise signals	High computational cost and requires specialized algorithms for analysis	Difficulty in real-time implementation
Inverter Malfunction [87,104,105,107,108,110]	Artificial Intelligence (AI) Neural Networks, Fuzzy Logic, Machine Learning	Automatic feature extraction; ability to handle complex data and nonlinear systems	Large datasets are needed for training; high computational cost	Algorithms can be hypersensitive to training data, which can lead to fault estimation
Mechanical Faults
Bearing Failure [107,108,122,123,133,137,138,168,169,170,171]	Vibration Analysis FFT, CWT, OA	Particularly effective for diagnosing mechanical fault, such as bearing faults	Requires placement of sensors in critical locations and may be expensive in large-scale installations	The quality of the data depends on the correct placement of the sensors
Bearing Failure, Shaft Misalignment [122,123,124,133,134,151,152,153,164,165]	Acoustic Emission Analysis STFT, FFT, OA	Can detect early-stage faults; non-invasive; applicable for real-time monitoring	Sensitive to environmental noise; requires specialized equipment	Effective only for certain types of mechanical faults, such as bearings
Shaft Misalignment, Bearing Failure [56,57,58,135,136,141,166,167]	Thermal Imaging and Temperature Sensors	Immediate detection of overheating in critical points such as the stator and bearings	Can detect faults only when a thermal anomaly has already occurred	Limited to the initial stages of the damage
Magnetic Faults
Demagnetization Eccentricity [171,172,173,174,175,176,177,186,188]	Magnetic Flux Monitoring	Direct method for detecting demagnetization or rotor eccentricity	Requires specialized magnetic sensors; invasive to some extent	May not detect minor flux disturbances; limited data interpretation capabilities
Uneven Magnetic Field [154,177,182]	Back Electromotive Force (BEMF) Analysis Torque Ripple Detection	Non-invasive; can be used in real-time; cost-effective	Requires careful signal processing; affected by noise and load conditions	Difficult to detect subtle magnetic faults or partial demagnetization
Eccentricity Demagnetization [146,149,181,183]	Finite Element Analysis (FEA)	High accuracy; detailed analysis of magnetic flux behavior	Requires high computational power; time-consuming	Applicable mainly for design and offline diagnosis rather than real-time monitoring

show the papers on fault tolerance and fault diagnosis methods and classify them based on their advantages and disadvantages in PMSMs and divisions into different categories.

Our research was based on a comprehensive literature review focusing on key areas at the cutting edge of science. The literature studied included research papers related to fault diagnosis in permanent magnet synchronous motors and secure data transmission for better condition-monitoring using IoT technology. Scientific publications in international conferences and journals were studied in order to achieve a complete taxonomy of the relevant literature. Figure 15a,b show the percentage of the research areas and the number of publications per year that meet our selection criteria. From 2019 to the present, a highly increasing trend in the collaboration of IoT and secure data transmission technologies involving traditional diagnostic techniques for motors and elevators is observed. The integration of these technologies shows improved maintenance results compared to the technologies used in earlier years.

4. Communication Protocols and Security Issues for IoT Devices in Elevator Systems

This section discusses the communication protocols used when transmitting data using IoT sensors in an elevator network, as well as the security gaps that may arise. Security issues can be due either to tampering attempts by unauthorized users, or to volatile factors such as motor winding temperature increases and vibration. In the elevator system that will be described in the next section, there are two parallel data transmission devices.

One is a wired one, where the transmission is carried out via cable based on the MODBUS communication protocol, and the other is a wireless one, comprising a wireless sensor network (WSN) using the Zigbee communication protocol. The choice of two devices that simultaneously communicate and exchange data is recommended for the transmission of critical information within the local network of the elevator, and for the transmission of data at a distance. Both protocols (Modbus and Zigbee) were designed to support various layers of the OSI model; however, the work presented in this paper will focus on the operating functions of the physical layer (PHY) and data link layer.

Table 4. Characteristics of communication protocols.

Protocol	Main Characteristics	Advantages	Disadvantages	Security Vulnerabilities of Attack Types	Countermeasure Techniques
Modbus	Widely used communication protocol in industrial environments; supports serial communication (ASCII, RTU) and Ethernet TCP/IP modes	Supports multiple communication methods (ASCII, RTU, TCP/IP); easy to implement; compatible with many industrial devices	No built-in security mechanisms (e.g., authentication, encryption); vulnerable to man-in-the-middle and DoS attacks	Vulnerable to various attacks such as reconnaissance, command injection, response injection, DoS and MiTM; no encryption or authentication	Use of Snort for intrusion detection, Modbus/TLS for encryption and authentication and dynamic watermarking for attack detection
Zigbee	Low-power wireless communication protocol designed for sensor and control system applications; based on IEEE 802.15.4 [192], supports various network topologies like star, peer-to-peer, and mesh	Low energy consumption; supports real-time monitoring; ideal for sensor networks and applications with low power requirements	Limited security due to low processing power and simplicity of available security services; challenges in battery life and scalability	Exposed to attacks such as Sinkhole, Sybil, Wormhole, selective forwarding and replay attacks; low detection of low-rate DoS	Use of blockchain for secure data management, dynamic identity-based authentication schemes, anomaly detection and error correction mechanisms

shows the key features of the two protocols (Modbus and Zigbee) which were proposed for the monitoring of the elevator system.

4.1. Modbus Protocol in Elevator Systems

The elevator control system we mentioned uses the Modbus protocol to communicate with various parts of the elevator, such as the cabin control panel (COP), floor position indicators and landing operating panel (LOP). The central controller is the “master” and coordinates the communication, while the other devices are the “slaves” that only respond when called by the controller [193]. The Modbus protocol enables serial data transmission in ASCII and RTU Modes, as well as via an Ethernet network with TCP. The choice of transmission mode depends on the requirements of the elevator application. In the system described in the next section, the controller supports all three data transmission methods, so that the performance can be tested in each case and finally the most efficient method can be proposed [194].

The Modbus protocol is a widely used communication protocol in industrial environments, designed to facilitate the exchange of information between electronic devices. It was developed by Modicon in the 1970s and works mainly at layers 5 (Session), 6 (Presentation) and 7 (Application) of the OSI model. There are different versions of it, such as Modbus RTU and Modbus ASCII, which operate at the physical and data link layers (Data Link Layer), and Modbus TCP/IP, which operates at layers 3 (Network), 4 (Transport) and 7 (Application) [195].

In the ASCII mode, data are transmitted in text format, as each byte is converted into two ASCII characters. It is easier to read and interpret, as it uses text. It provides high reliability and debugging capability, since it is easier to detect errors in an ASCII character string [196]. In the other format (Modbus RTU Mode), the data are transmitted in binary form. It is used by applications that require a high data rate. It is more difficult to read by the user, due to the binary data format. Devices that communicate using the Modbus RTU mode should be at short distances from each other [197]. It uses TCP/IP to transfer information over an Ethernet network. Data are transferred in TCP/IP packet format. It is suitable for remote access to devices in different locations, but Ethernet network installation requirements can have an impact on construction and maintenance costs [198].

4.1.1. Security Issues in Modbus

The traditional approach to the design and maintenance of an elevator system did not require the connection of its individual devices to the internet, as the operational needs were met with closed data transmission in local networks. For this reason, the Modbus protocol was originally designed without any security level [199]. However, the recent construction needs of multi-story buildings, combined with the requirements for remote control of the various IoT devices in an elevator system, generated the need to connect the individual devices to the internet, revealing some security vulnerabilities [200].

Attacks on Modbus systems fall into four main categories. Reconnaissance attacks aim to gather information about network architectures and characteristics. Response injection attacks alter the responses of Modbus servers by adding false data. In command injection attacks, malicious commands are introduced that cause changes in device operation, such as modifying parameters or state. Denial of service (DoS) attacks aim to disrupt communication or overload the network with malicious traffic, leading to system failure [201]. Figure 16 shows the main categories of attacks targeting Modbus traffic in industrial networks.

Although quite popular, Modbus presents serious security issues due to the lack of built-in protection, authentication and encryption mechanisms, which makes it vulnerable to unauthorized access, denial of service (DoS) and Man in The Middle (MiTM) attacks [199,203]. This means that any properly formatted request can be considered valid and answered by the system. These attacks allow an attacker to interface, falsify or alter the communication between master and slave devices, without the changes being noticed by the involved parties [204].

Jakaboczki and Adamko report that the Modbus RTU protocol does not have capabilities to identify devices connected to the network, nor does it incorporate encryption to protect the data being transmitted. This allows an attacker in by inserting monitoring devices between nodes to interrupt, modify or destroy communication in a Modbus RTU network [205]. In addition, the protocol presents a low level of security in real-time applications. Using Deep Packet Inspection (DPI) to detect Modbus/TCP attacks can increase communication latency, which can cause problems in applications that require real-time communication, but does not completely eliminate protocol vulnerabilities [206].

Another important vulnerability concerns Modbus/IP converters using old versions of the Linux kernel (2.6.9 to 2.6.33) and the BoaHTTPd HTTP server used by these converters, which has not been supported since 2005, and which are vulnerable to denial of service (DoS) attacks and remote executions of malicious code [207]. A vulnerability detection method using intelligent fuzzing technology revealed both known and new vulnerabilities in Modbus TCP that allow attackers to install unauthorized firmware, cause a memory overflow and denial of service (DoS), or to execute malicious code. Additionally, new 0-day vulnerabilities related to invalid request parameters were discovered, causing device malfunctions [208].

It is also worth noting that a major security problem of the Modbus protocol is false instruction execution (FCI) due to the lack of authentication and integrity check mechanisms [209,210]. Another type of attack that can occur in an industrial environment and in elevator systems using the Modbus protocol is flooding, where the programmable logic controller (PLC) is targeted by spurious requests sent in very rapid succession, causing a buffer overflow. This renders the PLC unable to respond to legitimate requests, shutting down systems and requiring a reboot to recover [211].

Increasing the bit error rate (BER) significantly affects the performance of the Modbus TCP system, especially when the number of devices in the network increases. As BER increases, more messages contain errors and need to be retransmitted, which increases communication time between devices and can lead to delays. This makes the elevator system more vulnerable, as attacks aimed at increasing the BER could burden performance and disrupt the smooth operation of the system [212].

4.1.2. Modbus Protocol Instruction Detection and Countermeasure Techniques

One intrusion detection mechanism for the Modbus RTU/ASCII protocol involves the addition of the Snort tool to detect and prevent attacks on industrial networks using this protocol [213]. Snort adapts to monitor Modbus RTU/ASCII serial networks, detecting attacks such as denial of service (DoS), command injection and response injection attacks through rules that control data flow and integrity [214]. The Snort system allows systems to be protected without affecting their performance [215].

Another of the proposed solutions combines the Modbus protocol with Transport Layer Security (TLS), creating a secure version of the Modbus protocol known as Modbus/TLS [216]. TLS adds encryption and authentication, ensuring communication integrity and confidentiality [217]. This prevents attacks such as packet jamming and eavesdropping, while keeping throughput at levels suitable for critical applications [218].

One solution focuses on authenticating sensors in industrial networks via the Modbus TCP protocol, using cryptographic hashes entered in the TCP Options field. This method ensures that data comes from trusted sources and prevents man-in-the-middle attacks [216]. The main advantages include easy integration into existing systems, the maintaining of compatibility without protocol modifications, and low resource usage. At the same time, it does not affect the performance of the network [219].

An approach to detecting man-in-the-middle (MiTM) attacks—particularly applicable to converters—involves adding a random watermark signal to the DC circuit of the converter [220]. The system compares meters readings with predicted values, detecting any deviation that could indicate data corruption. This method allows immediate detection of attacks without affecting the normal operation of the converter [221,222,223].

An alternative solution for detecting abnormal operation in control systems using the Modbus protocol focuses on using entropy analysis to monitor randomness in network traffic, while combining features from the Modbus and TCP/IP protocols to classify potential attacks [224]. This method provides effective abnormal operation detection, with particular success in DoS-type attacks, although the accuracy is slightly lower in MITM-type attacks [225].

Table 5. Methods of security vulnerabilities for Modbus.

Bibliography References	Method of Security Vulnerabilities	Advantages	Disadvantages	Limitations
Vulnerability to Reconnaissance and Command Injection [201,203,214]	Vulnerable to reconnaissance, command injection, response injection, DoS, MiTM	Widely adopted in industrial control systems; easy integration with existing infrastructure	Lack of built-in security mechanisms; susceptible to man-in-the-middle and command injection attacks	No encryption or authentication by default, requires additional security measures like Modbus/TLS
Lack of Encryption and Authentication [199,205,209,210]	No encryption or authentication; vulnerable to unauthorized access	Multiple modes of transmission (serial, Ethernet)	Vulnerable to eavesdropping and tampering due to lack of encryption	High latency in communication under attack; limited to closed networks for safety
Susceptibility to Injection and MiTM Attacks [207,220,221,222,223,224,225]	Susceptible to injection and MiTM attacks	Easy to implement and use in legacy systems	Lower data transmission speed and increased risk of security breaches	Vulnerable to attacks without security layers like TLS; requires wider bandwidth
Detection Methods for Vulnerabilities (Deep Packet Inspection, Fuzzing) [205,206,207,214]	Deep Packet Inspection to detect Modbus vulnerabilities	Allows detection of intrusions and attack patterns	Increases latency in real-time systems; does not fully address protocol weaknesses	High processing overhead, impacting performance in critical systems
Susceptibility to Processing and Computational Load [208,209,213,225]	Fuzzing to detect vulnerabilities and false command injections	Can reveal unknown vulnerabilities; improves system reliability	Requires continuous monitoring and may introduce delays	Limited by the complexity of the system being analyzed

presents a classification of the studied papers on the methods of security vulnerabilities for the Modbus protocol.

4.1.3. Wireless Sensor Networks in Elevator Systems

Wireless sensor networks (WSNs) are used in applications such as elevators to monitor critical parameters, enhancing safety and preventive maintenance. Techniques such as duty cycling help save energy by switching sensors between active and sleep mode [226]. Although WSNs have the benefit of wireless communication (e.g., Zigbee, Bluetooth), they face challenges in battery life and data security [227].

Zigbee is a low-power wireless communication protocol designed for control and sensor applications that can be used effectively in elevator systems [228]. It is based on the IEEE 802.15.4 standard and supports network topologies such as star, peer-to-peer and mesh, which makes it ideal for real-time monitoring and control, and is used for low-power systems [229]. Figure 17 shows the Zigbee network in an elevator, connected to a data center via a wireless access point.

Zigbee security is ensured through AES 128-bit encryption, management of different keys (master, network, link key) and built-in mechanisms such as the trust center. Despite these security features, Zigbee remains vulnerable to attacks due to the limited processing capabilities and the simplicity of the available security services [231].

4.1.4. WNS Security Issues with Zigbee Protocol in IIoT and Elevator Networks

The Industrial Internet of Things (IIoT) brings automation to elevator systems, but makes them vulnerable to cyber-attacks, which can affect critical functions such as car movement and door security [232]. Protecting the confidentiality and integrity of data are essential, as traditional encryption techniques are not sufficient due to the limited resources of the devices [233]. In addition, secure communication between devices from different vendors is critical, and blockchain is emerging as a solution for secure management and attack detection [234,235].

Key security threats in wireless sensor networks (WSNs) include attacks such as Sinkhole, Sybil, Wormhole, Selective Forwarding and HELLO Floods. These attacks aim to disrupt or alter the flow of data, compromising the reliability and confidentiality of the network [236]. Attackers can spoof the routing, impersonate multiple identities, or create fake connections, disrupting network coherence and reducing communication efficiency [237].

According to Imane Sahmi et al., IoT security threats include the following: node tampering, malicious node injection and jamming as physical attacks, RFID spoofing, Sinkhole attacks and denial of service (DoS) attacks as network threats, eavesdropping and traffic analysis for violation of privacy and SQL injection and cross-site scripting as attacks on the system. These threats exploit vulnerabilities in IoT devices to disrupt or gain access to sensitive data [238].

Also, low-rate denial of service (LDoS) attacks on Zigbee exploit the indirect transmission process to overload the Zigbee Router’s cache with malicious packets, which can reduce the delivery of normal packets to 0% [239]. These attacks are characterized by low traffic intensity and are not easily detected by standard detection methods, thus making Zigbee particularly vulnerable to such threats [240,241]. Zigbee is vulnerable to replay attacks, where, by applying a noise removal technique, redundant data are removed from the intercepted packets to resemble the original packets, increasing the likelihood of successful system compromise [242].

4.1.5. Techniques for Detecting and Countering Intrusions in WSNs and the Zigbee Protocol

Intrusion detection in the Industrial Internet of Things (IIoT) is a critical field of study due to the increasing security threats these networks face. Especially when using protocols such as Zigbee, which is particularly popular for its low power consumption and ability to support communication in multi-sensor environments, the need for efficient malicious node detection mechanisms is great [243].

In this direction, new approaches combining technologies such as blockchain with detection algorithms such as CHSA and MNDA are proposed to enhance the security of wireless sensor networks. CHSA is used for the energy-efficient selection of cluster heads, while MNDA evaluates the trustworthiness of nodes, while the blockchain ensures transparency and immutable recording of results. This combinatorial approach is particularly suitable for IIoT applications using Zigbee, where protection from malicious activities is critical for reliable system operation [244].

Allakany et al. proposes a new system to enhance security in ZigBee networks without using complex asymmetric encryption methods. It uses dynamic identities for each device and a secure one-way hash system for authentication to provide anonymity and protection against tracking and replay attacks. This ensures that communication keys are unique for each session, enhancing network security [245].

Also, applying techniques such as Fair Queuing limits the aggressive packets’ access to the malicious node’s queue, protecting the other nodes. Additionally, techniques such as Random Drop on Full (RDOF) randomly drops packets when the queue is full, reducing the impact of LDoS attacks. These two techniques could increase packet delivery by up to 80% [239].

Anomaly detection and filtering of malicious requests and encryption can be used to protect legitimate requests. These techniques reduce vulnerability to DDoS attacks [246]. The use of machine learning techniques such as an anomaly detection system for ZigBee networks with One Class SVM can detect deviations from normal operation as attacks [247].

A proposed technique uses device fingerprinting with features such as RSSI, LQI and Noise Floor to generate unique device fingerprints and detect spoofing attacks. Detection is performed with machine learning algorithms, such as kNN, for high accuracy [248]. To deal with jamming attacks in ZigBee networks, techniques such as adaptive frequency hopping, adaptive modulation and the use of anomaly detection to detect attacks are proposed. Also, the application of error correction and retransmission mechanisms to maintain communication are suggested [249]. Another method for dealing with replay attacks in ZigBee networks is the use of timestamps. In this method, fully powered ZigBee devices provide updated timestamps to low-powered devices, preventing the reuse of old packets. This approach is energy efficient and can be applied to various network topologies without affecting performance [250].

An alternative method to deal with jamming attacks in ZigBee networks is to use a neural network in combination with multiple antenna (MIMO) technology. The network is trained in real-time to filter out the interference and allow the receiver to decode the signals, even when the interference is much stronger than the ZigBee signal. This method significantly improves the robustness of ZigBee communications [251].

Table 6. Methods of security vulnerabilities for Zigbee.

Bibliography References	Method of Security Vulnerabilities	Advantages	Disadvantages	Limitations
Low Power Consumption for Basic Applications [236,237,242]	Vulnerable to replay attacks, DoS, Sybil, Sinkhole, Wormhole	Low power consumption; widely used in low-data rate applications	Limited processing power; vulnerable to low-rate DoS attacks	Limited encryption capabilities due to resource constraints; vulnerable to jamming and eavesdropping
Blockchain Security [232,233,234,235,243,244]	Blockchain for secure data management	Enhances security and transparency in IIoT environments	Requires additional infrastructure and may introduce delays	High complexity and potential energy overhead in resource-constrained devices
Network Stability Improvement [239,240,241]	Low-rate denial of service (LDoS) exploitation of Zigbee routers	Detection methods improve network stability	Difficult to detect due to low traffic volume	Affects real-time data transmission; high susceptibility to low-rate DoS
Mitigation of Replay Attacks [242,244,250]	Replay attacks through intercepted packets	Reduces packet noise, improving network performance	Requires noise removal techniques, exposing the system to security risks [232,233,234,235]	Limited protection in complex networks; prone to noise exploitation

presents a classification of the studied papers on security vulnerabilities of the Zigbee protocol.

5. Proposed Methodology for IoT Sensor-Based Elevator Systems’ Fault Diagnosis

The occurrence of damage and malfunctions of the lifting system can lead to interruption of the operation of the lift and the need for the intervention of a technician to solve it. For this purpose, smart sensors are integrated into various subsystems, and a suitable platform is created to achieve continuous monitoring. The proposed methodology was based on the use of a real experimental elevator setup and the integration of a prototype combination of secure data while using IoT technology for fault diagnosis.

The aim of condition monitoring in the proposed system is to provide continuous tracking of motor health and operational efficiency. Key challenges include selecting sensors with sufficient accuracy and stability, as well as optimizing the monitoring strategy to minimize system interruptions. In the fault diagnosis section, we analyzed diagnostic techniques suitable for detecting faults at an early stage. The main goal is to achieve fault identification with high precision and to reduce downtime. Challenges include managing signal interference and selecting appropriate analysis methods for each fault type. The communication section addresses secure data transmission within the IoT framework for elevators. The goal is to ensure that all data transfers remain reliable and secure. This requires addressing both cybersecurity challenges and real-time data demands for fault detection.

5.1. Experimenatal Setup

The experiment setup includes an eight-passenger transfer elevator with a 5.1 kW, 160 rpm motor with surface magnets. It is a multi-pole, low-electrical-frequency and highly electromagnetic torque motor. The experimental setup concerns a conventional eight-station elevator installed in six flats. The main characteristics of the elevator are shown in

Table 7. Nominal Characteristics of the test elevator.

Quantity	Value	Units
Mass of the chamber (P)	750	kg
Nominal Load (Q)	600	kg
Mass of the counterweight (G)	1050	kg
Force power (F)	300	kg
Nominal Speed Cabin (V)	1	m/s
Radius of the friction pulley (R)	0.15	m
Stops (S)	9	-

. Similarly, the nominal characteristics of the motor are illustrated in

Table 8. PMSM Main Characteristics.

Quantity	Value	Units
Output Power (${\mathrm{P}}_{\mathrm{o}\mathrm{u}\mathrm{t}}$)	5.1	kW
Input Power (${\mathrm{P}}_{\mathrm{i}\mathrm{n}}$)	6	kW
Efficiency (a)	85	%
Nominal Voltage (${\mathrm{V}}_{\mathrm{n}}$)	350	Volt
Electrical Frequency (f)	16	Hz
Poles (2p)	12	-
Nominal Torque (${\mathrm{T}}_{\mathrm{n}}$)	350	Nm
Nominal Current (${\mathrm{I}}_{\mathrm{n}}$)	10	A
Power Factor (cosφ)	0.95	-
Nominal Speed (n)	160	rpm

.

The setup implemented is depicted in Figure 18 and consists of the following:

• Automation Panel Elevator System;
• Variable Voltage Variable Frequency (VVVF) Inverter;
• Uninterruptible Power Supply (UPS);
• Control Board;
• Magnetic field current transformers;
• Gearless PMSM;
• Vibration sensors;
• Automatic switch;
• Rail socket for connecting the device that will send the data to the cloud;
• Meanwell HDR 30–24 power supply;
• Data collector;
• Three-phase circuit breaker;
• Raspberry pi compute module 4G;
• Three-phase connections for current measurements;
• Energy–Power analyzer;
• Ethernet cable from data collector to raspberry pi module 4G;
• Device for sending the data to the cloud.

The installed system consists of two external data acquisition units, a Schneider Electronics PM 3250 energy-power analyzer and a Hansford HS422ST0105406 accelerometer. The energy analyzer was installed in the panel in order to collect data on energy consumption, input power and the electrical parameters of the motor. The following sections present a brief description of the system’s key components used to derive a methodology for elevator fault diagnosis.

The energy analyzer is used to measure electrical parameters such as three-phase current (A) and voltage (V), total energy consumption (kWh), electrical frequency (Hz), and power factor. Three inductive current transformers are installed in the automation panel for the measurements. The vibration sensor is mounted externally on the motor shell in order to measure the vibration accurately. Signals are collected in the time domain and transformed into the frequency domain to draw conclusions about the proper operation of the motor. The data collector is designed to transmit the data to the cloud, process signals and through an appropriate machine learning algorithm—using the Random Forest algorithm—display alerts and possible future PMSM faults.

5.2. System Architecture

The occurrence of damage and malfunctioning of the lifting system can lead to the interruption of the operation of the lift and the need for intervention by a technician to solve it. For this purpose, smart sensors (IoT devices) are integrated into various subsystems and a suitable platform is created to achieve continuous monitoring. The proposed methodology is based on the use of a real experimental elevator setup and the integration of a prototype combination of secure data transmission using wired data transmission (Modbus TCP) and IoT technology (Zigbee) for fault diagnosis (shown in Figure 19). The system for monitoring the elevator was installed by Seems P.C.

To effectively detect and manage faults or malfunctions in elevator systems through a monitoring system, the following components are essential:

• Sensor and Information Collection:

• Vibration Sensor: Detects anomalies in vibration patterns, which are often indicative of mechanical faults, such as bearing wear or shaft misalignment.
• Current and Voltage Sensor or Energy Analyzer: Measures real-time current and voltage to identify electrical deviations. Techniques like Motor Current Signature Analysis (MCSA) can be used to detect short circuits and other electrical faults.
• Temperature Sensor: Monitors the temperature of the PMSM and power electronics. Excessive temperature can indicate issues such as short circuits or cooling failures.
• Magnetic Field Sensor: Detects variations in the magnetic field, enabling the monitoring of demagnetization events or rotor asymmetry.
• Chamber Load Sensor: Measures the weight of passengers and cargo inside the cabin during upward and downward movement, giving an estimate of current consumption in conjunction with the energy analyzer.

2.

Diagnostics Algorithm and Required Calculations:

• Machine Learning Models: Trained machine learning models, such as Support Vector Machines (SVM) and Neural Networks, help recognize patterns related to malfunctions.
• Model-Based Diagnosis: Uses physical or mathematical models to compare real-time data with expected values, facilitating the detection of deviations from normal operation.
• Signal Processing Techniques: Used to analyze sensor data, such as Fast Fourier Transform (FFT) and wavelet transform, which identify frequencies associated with specific faults.

3.

Notification Mechanisms and Operation Mode Adjustment:

• Automated Alerts: The system can send real-time alerts to technicians via an IoT network when a deviation from normal operation is detected.
• Automated Mode Switching: In the case of a severe fault, the system can automatically switch the elevator to a safe operational mode, such as reduced speed or restricted access, until maintenance is performed.
• Data Logging for Maintenance: Anomalies and related data are logged over time to support preventive maintenance and continuous improvement of elevator operation.

For classification purposes, the flow of information and the key points for security vulnerability in the elevator system shown in Figure 19 are described. The information is transmitted from the sensors to the collector (11) serially through cable. The sensors (7) measure vibrations, and the energy analyzers (15) are capable of measuring current, voltage, frequency, power factor, active and reactive power, consumption and harmonics. The information is sent to the collector with a signal cable (14), while it is the received though the current transformers (5) with a current intensity of 100 A/5 A. However, it is possible to obtain information as chamber load, speed and position of the elevator and the situation of the doors from other points, either on the elevator control panel or on the inverter (2).

Specifically, more information can be obtained from the cabin and well, such as the cabin load with an analog weighing sensor (signal range 4–20 mA), elevator calls from digital relays, frequency, current and voltage from the output of the inverter (2), the state of chamber doors on each floor, either wired or wireless, motor thermal protection, etc.

The collector (11) performs the initial signal processing. Furthermore, the collector (11) sets the sampling frequency, the time duration of the measurements, the conversion from the time domain to the frequency domain, and the data transmission rate to the modem (13). The collector is powered by the Meanwell HDR 30–24 power supply (10), while the energy analyzer is powered by three-phase power (12), and the 4G modem is powered by a rail socket (9). The data are transmitted from the collector (11) to the orange 4G Mic modem (13) with an Ethernet cable (16). The antennas in (13) transmit the signal to the Wi-Fi card (17), and then the data are transmitted to the cloud and stored on a computer with remote access to the Seems P.C. platform.

The elevator subsystems that possible attacks could be carried out on are as follows:

The inverter (2), which is independent of the digital data transmission platform and drives the PMSM (6) by regulating its speed and consumption current;

The Seems P.C. collector (11), which processes the sensor data either when collecting from the sensors or when processing them with the embedded software, or when transmitting them via Ethernet to the modem (13);

The input signal to the modem (13) from the Ethernet cable (16), or at the output of modem (13) when the data are transmitted wirelessly to the Wi-Fi card (17);

The Wi-Fi card (17) when transmitting the data to the Cloud.

To monitor and control the elevator system, a solution that combines wired and wireless communication systems is proposed. The proposed solution sets the emphasis on data security in the used devices. The wired subsystem uses the MODBUS RTU protocol, which allows for stable and reliable data transmission from the energy–power analyzer and the three-phase transformers to the collector. The data contains critical information on voltage, current, frequency and harmonics. The security of this subsystem is enhanced through the use of TLS (Transport Layer Security) in the MODBUS TCP protocol, which adds encryption to data transmitted over Ethernet, preventing unauthorized access and eavesdropping.

The proposed solution includes a wireless subsystem which operates in parallel with the wired subsystem to enhance the monitoring of the elevator. The second subsystem employs a wireless sensor network (WSN) that uses the Zigbee protocol. Vibration and load sensors, such as the wireless accelerometer sensor, are placed in the elevator cab and shaft, collecting data regarding the structural integrity and operating condition of the elevator.

The data are transmitted wirelessly to the collector, and from there to the router, via Ethernet TCP. The security of the wireless devices uses AES 128-bit encryption, enhancing the integrity and confidentiality of data during transmission. To detect and defend from security attacks, both subsystems use Intrusion Detection Systems (IDS), based on machine learning algorithms, to identify anomalies and attacks such as spoofing or denial of service (DoS). Parallel operation of wired and wireless communication subsystems allow continuous data collection and improves system resilience. In addition, preventive maintenance and remote cloud data monitoring improve system security and performance by providing early alerts of any failures or attacks.

The proposed dual communication system ensures both the reliability and safety of the elevator system by incorporating multiple layers of protection and providing real-time, uninterrupted operation.

6. Discussion

Some suggestions for extending our paper for future research could be the following:

Develop novel or enhanced performance fault diagnosis algorithms;

Propose efficient and lightweight protocols for IoT security in elevator systems. Thus, the application of blockchain or other distributed systems to ensure data confidentiality could be considered;

Application of hybrid encryption strategies combining symmetric and asymmetric cryptographic schemes, especially on sensors characterized by limited processing power;

Incorporating automated monitoring and responses to real-time cyber-attacks is crucial to protect PMSM systems. Therefore, future research could focus on developing smart elevator systems that can detect and react to malicious attacks;

By using edge and fog computing technologies, the latency in data processing can be reduced as the data can be processed locally;

Designing sensors and IoT systems that are energy-efficient while consuming minimal energy during operation. Use renewable energy sources to charge IoT devices.

7. Conclusions

Ensuring smoother operation with greater security is a critical research topic for high-motion systems such as elevators. A key conclusion drawn from the performed literature search relates to the integration of Internet of Things (IoT) in permanent magnet synchronous motors (PMSMs) in elevator applications. The integration of IoT smart sensors enables the potential to continuously collect data. Utilizing advanced processing techniques including machine learning and artificial intelligence algorithms provides accurate and faster responses to maintenance needs. This enables early fault detection, reducing downtime and improving efficiency. Furthermore, predictive maintenance models can anticipate potential problems before they escalate, contributing to the long-term durability of the lift system. While the IoT offers many advantages, it also faces significant security challenges.

Modern PMSM monitoring techniques provide the ability to record data in real time. They play a key role in the early detection of anomalies and prolong equipment life. Algorithms such as Random Forest and neural networks contribute to automatic feature extraction and reductions in false alarms. By studying the literature, numerous faults and diagnostic techniques related to electrical machines can be found. Common electrical faults of PMSMs include winding short circuits, circuit openings and insulation problems. Diagnosis of these faults is carried out through current signal analysis (MCSA) and harmonic analysis.

Similarly, typical mechanical faults include bearing wear, eccentricity and asymmetry affecting the performance of the machine. These faults can be diagnosed through vibration and sound analysis. Signal processing methods in the time domain and frequency domain allow for the detection of faults even during transient conditions. Additionally, an increase in the intensity of harmonic frequencies may indicate problems.

Enhancing secure communication protocols, such as Modbus and Zigbee, is essential to protect against cyber-attacks that could disrupt elevator operations. Implementing encryption, authentication and monitoring protocols can mitigate these risks. Thus, our research focused on the importance of selecting appropriate communication protocols for data transmission, considering factors such as data security, real-time monitoring and energy efficiency. Protocols such as Modbus and Zigbee offer flexibility; however, they need improvements to ensure robust security against modern cyber threats.

The proposed prototype methodology combines an IoT architecture with an integrated system for recording, collecting and processing current and vibration data in an elevator system that uses a PMSM. The collected data are analyzed in real-time by machine learning algorithms to identify patterns and predict potential failures. The algorithms are continuously adapted, improving their accuracy with each new dataset. In addition, the system provided alerts managers when it detects anomalies requiring immediate intervention. Finally, to ensure that potential cyber threats are avoided, secure data transfer protocols are incorporated to ensure that the integrity of the data from the source to the end user is not compromised.