Harpur Hill, Buxton

Derbyshire, SK17 9JN

T: +44 (0)1298 218000
F: +44 (0)1298 218590
W: www.hsl.gov.uk

Technical assessment of means of preventing

crushing risks on lifts subject to directive
95/16/EC

Report Number ME/07/07

Project Leader: Jonathan Statham

Author(s): Simon Coldrick

Jonathan Statham
Anthony Wray
Iain Ferguson
Melanie Smith

Science Group: Hazard Reduction Group

 DISTRIBUTION
Beata Pich EC Project Officer
Ian Fraser EC

David Kershaw-Wright Director Hazard Reduction

Graham Norton Section Head, Mechanical Engineering Section

PRIVACY MARKING:

Available to the public.

HSL report approval: David Kershaw-Wright

Date of issue: 30 August 2007
Job number: JC3200045
Registry file: 024468/026597
Electronic file name: HSLReport

Crown copyright (2007)

 ACKNOWLEDGEMENTS
The authors would like to thank all those who contributed to the study and volunteered their
time to provide valuable information and discussion; the EU for facilitating the project, the lift
and components manufacturers, industry bodies, consultants, national authorities and notified
bodies.

iii
 CONTENTS

1 INTRODUCTION......................................................................................... 9
1.1 The aim of the study ................................................................................ 9
1.2 The structure of the report ....................................................................... 9

2 TASK 1 - INCIDENT DATA COLLECTION .............................................. 10

2.1 Introduction............................................................................................ 10
2.2 Data collection method .......................................................................... 10
2.3 Data received country by country .......................................................... 11
2.4 Analysis of data ..................................................................................... 13
2.5 Summary of incident data collection ...................................................... 17

3 TASK 2 - EXAMINATION OF MEANS TO PREVENT CRUSHING RISK

EXISTING STANDARDS ................................................................................. 18
3.1 Introduction............................................................................................ 18
3.2 Pre-existing standards and regulations................................................. 18
3.3 Current standards. ................................................................................. 22
3.4 Summary of space requirements ........................................................... 27

4 TASK 2 - EXAMINATION OF MEANS TO PREVENT CRUSHING RISK

STATE OF THE ART ....................................................................................... 28
4.1 Introduction............................................................................................ 28
4.2 Information collection method................................................................ 28
4.3 Solutions according to draft standard pr EN81-21 ................................. 28
4.4 Manufacturers solutions........................................................................ 30

5 TASK 3 EVALUATION OF ALTERNATIVE SOLUTIONS .................... 47

5.1 Introduction............................................................................................ 47
5.2 Ergonomics evaluation of existing refuge provision ............................... 47
5.3 Ergonomics conclusions and recommendations.................................... 56
5.4 Mechanical evaluation ........................................................................... 57
5.5 Mechanical conclusions and recommendations .................................... 59
5.6 Evaluation of electrical control systems ................................................. 60
5.7 Control system conclusions and recommendations............................... 73
5.8 Economics of providing refuge space by alternative technical solutions 74

6 TASK 3 - RISK BASED COMPARISON................................................... 75

6.1 Objective................................................................................................ 75
6.2 Approach ............................................................................................... 75
6.3 Findings ................................................................................................. 79
6.4 Conclusion............................................................................................. 80

7 CONCLUSIONS........................................................................................ 81

8 RECOMMENDATIONS............................................................................. 83

APPENDIX 1 CONTACT LETTERS ............................................................. 84

iv
Letter 1 - H&S organisations ............................................................................ 84
Letter 2 - manufacturers/lift groups................................................................... 84
Letter 3 - Trade unions ..................................................................................... 85

APPENDIX 2 CONTACT DETAILS .............................................................. 86

Pan European health and safety organisations ................................................ 86
National health and safety organisations.......................................................... 86
Contact points in charge of implementation of lifts directive ............................. 87
Lift industry organisations................................................................................. 87
Lift manufacturers............................................................................................. 88
Notified bodies.................................................................................................. 88
Complete list of contacts for tasks 1 and 2 ....................................................... 89

APPENDIX 3 - ACCIDENT DETAILS .............................................................. 93

APPENDIX 4 SYSTEM OPERATION ........................................................... 97

Wittur System function during maintenance: .................................................... 97
Liftmaterial/Sematic Emerald 300..................................................................... 97
Cardiff lift system.............................................................................................. 97

APPENDIX 5 ERGOMONIC SPACE REQUIREMENTS ................................. 99

APPENDIX 6 RISK ASSESSMENT TABLES................................................ 100

REFERENCES............................................................................................... 117

BIBLIOGRAPHY............................................................................................ 119

v
 EXECUTIVE SUMMARY
Objectives

Section 2.2 of Annex 1 of Directive 95/16/EC on lifts states the objective of preventing the risk
of crushing when the lift car is in one of the extreme positions. It further states that this
objective will be achieved by means of free spaces or refuges. Where this solution is
impossible to apply, other appropriate means may be provided to avoid this risk, subject to
prior approval by the member states.

Application of this derogation by Member States has proved problematic and given rise to
divergent procedures and interpretations.

The report on the evaluation study on application of the Lifts Directive made in 2004 suggested
that section 2.2 of Annex 1 could be modified to state only the safety objective, the means to
achieve it being left to the installer.

The aim of this technical assessment was to examine whether the solutions available, other than
free space or refuges, to prevent the crushing risk provide an equivalent level of safety.

Main Findings

1. There was insufficient quantity and detail in the accident data to be able to determine
the effectiveness of either existing refuge space provision or alternative technical solutions.
However, the data has shown that where safe working practice is essential to the safety integrity
of a system, the safe practice is not always followed.

2. Current European harmonised standards have arrived at a specification for free space
that has evolved from existing European standards. These requirements can be briefly
summarised as:

The accommodation of a rectangular block as refuge space in both the pit and the
headroom
A 1 metre clearance in the headroom

The current American standard follows a similar route with the requirement of a 1.1 metre space
in the headroom and a rectangular block in the pit. It was indicated that Japan has not taken a
lead in the development of standards and as a result, appears to be less prescriptive in the
provision of pit and headroom. Recent movements in international standardisation indicate that
a less prescriptive route may be taken in future. In effect, the lift must be designed to prevent the
risk of crushing. It is evident that there are differing interpretations over what should constitute
a free space or refuge across Europe.

3. The state of the art in terms of alternative means for providing free space consists of a
number of mechanical devices used to block the travel of the car into the refuge space when the
risk of crushing is present. These devices may be:

Automatic or manually operated mechanical stops such as props, buffers and stop bars.

vi
 Devices which act to operate the car safety gear (or a similar system) at a set point in
the lift travel.

The mechanical devices used to ensure free space are only part of a system for providing free
space. Complete systems for providing space are achieved by interconnecting the mechanical
devices to the lifts control system with appropriate interlocks. These systems may function as
soon as the risk of crushing is present.

4. The ergonomic study has shown that, based on the information available, using 1.0m,
0.6m or 0.5m as the pit refuge dimensions does not allow people to fit into the space or adopt a
safe posture in the area that is given to them. Using 0.8m, 0.6m or 0.5m as the headroom refuge
dimensions does not allow people to fit into the space or adopt a safe posture in the area that is
given to them. However, where there is a free space of 1.0m clearance in the headroom it is
possible that someone could be accommodated in the space provided. However, it is unlikely
that the user would know what posture to adopt without instruction. This assessment is based on
one person in the refuge space. To try and accommodate 2 persons within these spaces is
unacceptable and unsafe. This assessment does not take into account any equipment or ropes
and assumes that the refuge is a free space. Where there may be equipment in the refuge space,
these dimensions are even less appropriate and safe.

5. In any approach to risk reduction, the first step is to eliminate the hazard wherever
possible. Only if this cannot be achieved should protection methods be considered. Therefore,
the ideal approach would be to provide an adequate fixed refuge within the lift shaft and, only if
this is not possible, should an alternative means of providing refuge be considered.

6. It is unlikely that any means of providing an adequate temporary refuge will operate
independently of a suitable system of work. However, the aim of the designer should be to
design the system such that the contribution of the safe system of work, on the overall integrity
of the refuge, is minimized.

7. Evaluation of the alternative technical solutions and subsequent risk assessment has
shown that it is possible to achieve comparable levels of safety using the alternative solutions as
provided by the existing space requirements.

8. The alternative technical solutions have the ability to provide a larger more viable
refuge space than is currently provided.

9. The alternative technical solutions can provide safety for both workers and the general
public.

10. Currently all alternative solutions would appear to have some reliance on a safe system
of working. This can potentially lead to accidents as a result of human error.

11. At present there is little or no cost difference between supplying and installing a
standard lift with refuge space or one that is subject to the derogation.

vii
Recommendations

Where refuge space is provided consideration needs to be given to the number of persons at
risk, when this has been decided an appropriate space should be provided. This space provision
should then be indicated by signage or marking so that people can occupy the correct location.
This space should not require a person to adopt a posture or position which would be difficult to
achieve in a relatively short time.

Using a block of at least 1.25m high (to allow sufficient sitting height and enough head room to
kneel), 0.7m wide (increased to allow a more comfortable fit around the shoulders) and 0.8m
long, a user might be able to sit in the refuge and clutch their knees, or kneel on their knees and
lower their head. However, there are no dynamic anthropometric measurements to prove this.
3D modelling would be required to validate this remark.

The minimum recommended height of the refuge if one were designed to accommodate a
standing posture is 2.0m. This would protect 95% of the population. The width of this refuge
would need to be at least 0.63m (based on whole body breadth of 95th percentile British male).

The size of the refuge is irrelevant if the people, who need to occupy it, do not know where it is.
Factors that could improve the safety of the users and assist them in emergencies of this nature
would be to highlight where the refuge is e.g. a coloured zone. To further assist the users
signage and pictures/diagrams of recommended postures could be installed around the area, as
safe postures which need to be adopted in the space provided, may not be intuitive.

In order that people entering the refuge space could have confidence that they are protected, the
safety system should have a clear indication that it is in operation. This would dissuade people
from attempting to leave the refuge space in the event of the lift car approaching.

Existing standards i.e. EN954 and EN61508, could be applied to the design and operation of the
control and/or interlocking systems associated with temporary refuges in order to provide an
adequate level of integrity.

The safety integrity of a system would be increased if it can be provided with little or no
reliance on a safe system of work. Automatic deployment of the safety system would also
significantly reduce the risk to both workers and other people. Automatic deployment would
also reduce the necessity for workers to have knowledge of how to deploy a range of potentially
diverse systems.

If the above conclusions are accepted and the recommendations are to be adopted, this will
necessitate amendment of the directive and the associated standards.

viii
 1 INTRODUCTION

1.1 THE AIM OF THE STUDY

This report describes the work undertaken by the Health and Safety Laboratory (HSL) on the
technical assessment of means of preventing crushing risks on lifts subject to directive
95/16/EC. The work was awarded to HSL as a result of a general invitation to tender, No
ENTR/05/010, by the European Commission Enterprise Directorate-General, unit:
mechanical and electrical equipment ENTR/H/5.

Section 2.2 of Annex 1 of Directive 95/16/EC on lifts states the objective of preventing the
risk of crushing when the lift car is in one of the extreme positions. It further states that this
objective will be achieved by means of free spaces or refuges. Where this solution is
impossible to apply, other appropriate means may be provided to avoid this risk, subject to
prior approval by the member states.

Application of this derogation by Member States has proved problematic and given rise to
divergent procedures and interpretations.

The report on the evaluation study on application of the Lifts Directive made in 2004
suggested that section 2.2 of Annex 1 could be modified to state only the safety objective, the
means to achieve it being left to the installer.

The aim of this technical assessment was to examine whether the solutions available, other
than free space or refuges, to prevent the crushing risk provide an equivalent level of safety.

1.2 THE STRUCTURE OF THE REPORT

The assessment consisted of three key tasks;

Task 1 the investigation of data on accidents that have occurred at extreme positions of the lift
cars.

Task 2, the description of the existing means to prevent the crushing risk.

Task 3, a comparative assessment of the alternative means available for the preventing of the
crushing risk.

Tasks 1 and 2 were conducted by Dr Simon Coldrick with the assistance of Mr Jonathan
Statham. The ergonomic study which formed part of task 3, was conducted by Miss Mel
Smith. The control system evaluation was conducted by Dr Anthony Wray and the risk
assessment by Mr Iain Ferguson.

9
 2 TASK 1 - INCIDENT DATA COLLECTION

2.1 INTRODUCTION

This section presents the investigation of data on accidents that have occurred at extreme
positions of lift cars. The project specification set out the requirement to collect data over a
five year period from a range of European member states where possible. The purpose of this
part of the work is to establish the frequency of such accidents and an assessment of their
consequences, circumstances and causal factors.

2.2 DATA COLLECTION METHOD

Several methods were employed in the collection of accident data. At the outset of the project,
those parties with relevance to both tasks 1 and 2 of the project were identified and therefore
could be contacted in the most appropriate way. International and national government
bodies and regulatory authorities were identified in addition to companies within the lift
industry and its associations. As the project progressed, further contacts were made, usually
as a result of meetings and through forwarding of emails. The result was that, whilst most of
the organisations were contacted directly, a number were also contacted indirectly. The
following organisations were initially targeted:

Pan European health and safety organisations

National government health and safety organisations

Contact points in charge of implementation of lifts directive

Lift industry associations

Companies within the lift industry

Notified bodies

Following the initial identification of relevant contacts, a standard letter/email was drafted
and translated as appropriate by HSE translation services. Copies of the email and letter are
available in appendix 1. Appendix 2 lists the full details of all the contacts and a brief note of
any relevant information received. As the project progressed, it became apparent that certain
organisations were not in a position to be able to provide any accident data. Furthermore,
when seeking data from sources other than government bodies, it was recognised that these
sources may not be willing to volunteer accident data.

Two lift industry associations, the European Lift Association (ELA) and the Lift and
Escalator Industry Association (LEIA), polled their members for accident data. ELA provided
responses including 11 accidents from parties in 7 countries. LEIA were also able to provide
brief summaries of three accidents.

It should be noted that the report includes data on accidents that have occurred on lifts that do
not fall under the scope of the lifts directive. Furthermore, a proportion of the accidents did

10
not result in direct crushing or were near misses. Whilst the relevance of these accidents
could be questioned, it was considered that they should be included in the analysis as useful
information could still be obtained. By way of example, an accident involving a goods lift
may involve failings relevant to passenger lifts or highlight a particular human error. The
necessity of broadening the scope of the definition of a relevant accident was reinforced in
light of the fairly small amount of accident data obtained.

In the United Kingdom, the Royal Society for the Prevention of Accidents (RoSPA) collects
data on accidents to the general public that are not work related. The data provided by RoSPA
in terms of accidents with lifts did not reveal any crushing incidents in the pit or headroom1.

On the whole, replies were received to the requests for accident data. In total, there were 60
contacts approached in respect of the project, of these, only 14 did not provide any reply at
all. For some contacts it became clear that they would be unable to provide any data and these
were not pursued further. A follow up letter was sent to those contacts that did not reply to the
original request and were considered as worthwhile sources.

2.3 DATA RECEIVED COUNTRY BY COUNTRY

2.3.1 France

The request sent to the Ministry for Transport, Infrastructure, Tourism and Maritime Affairs
was directed to the Ministry for Employment, Social Cohesion and Housing. They were able
to provide reports of crushing in lifts for the years 1996-2005. The reports list six incidents
detailing the victim, place and circumstances of each. All six incidents involved maintenance
workers. Following the request by ELA, la Fdration des Ascenseurs provided details of
four further accidents. These had less detail but are included for completeness.

2.3.2 Germany

Bundesanstalt fr Arbeitsschutz und Arbeitsmedizin confirmed that they do not hold accident
statistics. Contact with Dr. Gerhard Schiffner (STC Lift Consulting) revealed that the official
accident statistics did not show any accidents between 2000 and the present day. Statistics
prior to 2000 were of insufficient detail to be able to determine the cause of the accident.

2.3.3 Italy

Instituto Superiore per la Prevenzione e la Sicurezza del Lavoro and Ministero delle Attivit
Produttive were contacted but no data was received.

2.3.4 Hungary

The Hungarian Lift Association was contacted by ELA. They were able to provide details of
three non-fatal incidents.

1
The pit and headroom refer to the spaces at the extremes of the car travel and may also be known as bottom and
top car clearances

11
2.3.5 Poland

The Central Institute for Labour Protection confirmed that they do not have any detailed
statistics on lift accidents.

2.3.6 Spain

No official data was received and the contact through ELA was not able to provide any data.
Part of the reason for this may be due to the fact that accident data in Spain is dealt with on a
regional basis, rather than a national basis.

2.3.7 Finland

The request sent to the Ministry of Trade and Industry was directed to the Safety Technology
Authority who maintain and promote the technical safety culture in Finland. The Safety
Technology Authority provided details of the two crushing incidents known to have occurred
since 1960. Whilst there had been 258 injuries involving lifts since 1960, most of these
resulted in minor injuries.

2.3.8 Belgium

The national outreach centre for European Foundation for the improvement of living and
working conditions (PREVENT) informed us that there are no statistics for accidents with
lifts or lift maintenance staff.

2.3.9 Cyprus

The Department of Labour Inspection informed us that there were no accidents involving
crushing at the extremes of travel.

2.3.10 Ireland

The Health and Safety Authority and the Department of Enterprise, Trade & Employment
informed us that no data was available.

2.3.11 The Netherlands

Liftinstituut informed us that there were no known fatal accidents directly related to free
spaces above and under the lift car.

2.3.12 United Kingdom

Workplace accidents above a certain severity must be reported by law to HSE. Thereafter
responsibility for the investigation of accidents lies with HSE or a local authority depending
on the type of premises involved. A copy of the database for all accidents involving lifts
investigated by HSE in the period 1997-2007 was obtained. The total number of lift accidents
for the period was 868, but these involve several kinds of lifting apparatus and injury
mechanisms. Of the 868, two accidents were identified in which there had been a crushing
resulting from the lift car. Reports on the accidents were obtained from the HSE inspectors
involved in their investigation. LEIA were also able to provide a brief record of three
accidents involving their members. Further details of two of these were obtained through the

12
relevant local authority and the HSE specialist involved in the investigation. In Northern
Ireland Department of Enterprise, Trade and Investment reported that no data was available
until April 2006 and since then there had only been one incident that was a low fall.

2.3.13 Other countries contacted by ELA

The Czech republic and Switzerland had no reported accidents. Norway was not able to
provide a report due to inaccurate reporting.

2.4 ANALYSIS OF DATA

The details of the accidents as received country by country are given in full in appendix 3.
The number of accident details obtained is comparatively small and raises the question of
completeness. It could be considered that accidents with lifts, in particular crushing accidents,
form a minor subset in comparison to other forms of accidents. Therefore, national accident
statistic collection does not often extend to such a level of detail. The mechanism for the
reporting of workplace accidents also depends on the legal framework in place in a particular
country. In many cases, the investigation of accidents and collection of data is not carried out
on a centralised national basis. It can also be considered that many accidents do not make
their way into the official statistics. Manufacturers have an interest in collecting accident data
in terms of their own safety processes. However, they may be unwilling to release accident
details as they may reflect unfavourably on technical solutions or themselves.

The small amount of accident data limits the amount of analysis that can be performed.
Furthermore, the detail available on each accident is limited, for example, the size of the
refuge space, the age of the lift and the type of lift. However, it is possible to comment on the
circumstances of the accidents and draw some conclusions in respect of their causes.

The official accident data from France was translated into English by HSE translation
services. Details of the accidents from Hungary and Finland and those provided by ELA were
copied as received into the table in appendix 3. Details of 3 accidents from the United
Kingdom were taken from the investigation reports and summarised accordingly, whilst the
details of 2 were provided anecdotally from 2 sources. The accident summaries are
anonymous and contain a brief description of the accident and its cause, where known.

A total of 19 reports were received. Of those, 14 are of sufficient detail to be able to comment
on the circumstances of the accident. Not all the accidents resulted in crushing directly above
or below the car. There were 4 instances in which the victim was crushed when leaving the
headroom or pit and one instance of the victim being found between the car and the wall.
These hold relevance to the project as they feature unintended movement of the lift car with a
person present on or under the car and serve to illustrate failings that could lead to crushing in
the headroom or pit.

There are 2 instances in which the refuge space functioned as intended and prevented the
occurrence of more severe injuries. A single instance of a limit switch and buffer functioning
was also recorded.

Of the 19 reports, there were 13 confirming fatalities. Two were due to crushing between the
car and the roof of the well and 1 was due to entrapment between the car and the shaft. The 4
instances of the victim being crushed when leaving the headroom or pit resulted in fatalities.

13
2.4.1 Accident frequency

The total number of crushing accidents at extreme positions of lifts is not known and
therefore it is not possible to calculate and accident rate. However, the available accident data
give 18 accidents in the period 1987-2007, or an approximate rate of 1 per year. By way of
comparison, a presentation given by the ELA statistical committee details the most frequent
causes for worker accidents between 2001 and 2005. In this period, there were 241 accidents
resulting from inadequate means of handling equipment and 228 resulting from unsafe access
to the machine room. These respectively equate to 60 and 57 accidents per year. Of the fatal
accidents in the period 2001-2005, 8 were due to unknown causes and 5 due to installation of
new lifts, giving 2 and 1.25 per year respectively. In terms of total accident numbers, the
number due to crushing at extremes travel of lift car is therefore small. However, crushing
accidents generally led to fatalities, and therefore constitute a high proportion of the fatal
accidents in comparison with other causes. According to the ELA statistical data, the
European lift and escalator industry has approximately 117,600 employees. The rate of fatal
accidents involving crushing at the extremities can be calculated to be approximately 0.55 per
100,000 employees per year within the lift industry. This can be compared to the European
workplace rate of 2.4 per 100,000 employees per year. (source: Eurostat).

2.4.2 Accident causal factors

Table 1 is a summary of the causes of all the accident data received. The number of
occurrences of failings is greater than the total number of accidents as some of the accidents
are attributable to multiple causes. The causes were only taken when explicitly stated in the
reports and were not inferred.

Table 1 Accident causes

Cause Number of occurrences
Lift not in manual inspection mode 8
Mechanical/electrical fault 6
Incomplete lift (No Counterweight buffer/limit switch) 3
Bypassing safety system (landing door contacts bypassed) 3

2.4.2.1 Lift not in inspection mode

EN81-1 [1] clause 14.2.1.2 permits control of levelling and re-levelling with both the car and
landing doors open, providing that certain conditions are met. However, when a lift is put in
inspection mode, control of the lift is passed to a car top control station covered by EN81-1
14.2.1.3. When inspection mode is entered, EN81-1 14.2.1.3 requires that the normal controls,
emergency operation and docking operation are neutralised. At the same time, the operation
of the lift has to remain dependent on the safety devices. This requirement was present in
EN81-1:1977 [2]. Inspection mode allows the lift to be controlled from the car top station
using push to run buttons. The car will run at a reduced speed in inspection mode, typically
between 0.1 and 0.6 m/s.

There were 6 occurrences of the lifts being worked on when not switched into inspection
mode. This presents the obvious danger that the lift car can start moving without warning. In
the case of an accident that occurred in the United Kingdom in 2001, the movement was a
result of an automatic function of the lift control system. On the other hand, an accident
occurred in France in 1996 when a cleaner used the lift without realising that the maintenance
engineer was in the pit. In normal service mode, for lifts without permanent pit and

14
headroom, there is no need for the limit switches and buffers to function. Therefore, the car is
permitted to travel in regions that it would not under inspection mode.

At a meeting with ELA, it was suggested that when maintenance engineers are under pressure
to complete a large number of jobs, they would take shortcuts in order to save time. For
example, in the case of needing to travel up a large number of floors, it may be tempting to
use the lift in the normal service operating at a higher speed. Although levelling and re-
levelling are permitted with the car and landing doors open, it is also possible that such
adjustments are made with the lift in service mode. It was noted in the report on an accident in
the United Kingdom in 1998 that it should have been entirely possible to test the floor
levelling without riding on top of the car. Whilst the approach would have been more time
consuming, it would have been inherently safe.

Historically, it may have been acceptable to travel on the lift car whilst the car is controlled
from within. This would depend to a large degree on local regulations and the prevailing
safety culture. For example, British Standard 7255:1989 [3] paragraph 7.3.2.6 makes
provision for travel on the lift car if the car top was provided with a stopping device only.

2.4.2.2 Mechanical/electrical fault

The 6 occurrences of mechanical or electrical faults include faults of the lift actuation system,
control system and safety system. Two of the failures were on old lifts, whilst one failure
occurred in 1961 on a lift built in 1960. Alongside age, other possible reasons for mechanical
failures include lack of maintenance and incorrect or poor installation of components.

The one instance of the safety system not working occurred in France in 2004. The accident
report indicated that there was doubt over whether certain safety features and electrical locks
were operating properly. The report does not give sufficient detail as to the reasons for the
safety systems not operating.

2.4.2.3 Incomplete installation of lift

Major lift renovation and installation differs from routine maintenance insofar as it requires
work on lifts that are often incomplete and hence not fully functioning. Certain safety features
may therefore not be present and systems that rely on them cannot work as designers intend.
The point was also raised that, during installation, trades unfamiliar with lifts such as
decorators, may carry out work. Essentially, a lift being installed is different to an installed
lift.

Of the 14 accidents with sufficiently detailed reports, 3 occurred on lifts that were incomplete.
Whilst none were directly caused by incompleteness, the absence of safety features meant that
devices could not function to stop the lift car. A single accident in Finland in 1988 resulted
from the counterweight buffer having not been installed. Fatalities in France in 1998 and the
United Kingdom in 2005 resulted from the absence of both the stop/limit switches and
counterweight buffers. In all three cases, the parts had either not been installed or, in the case
of switches, not been connected.

Due to the mechanical buffers, lifts with a permanent refuge space do not rely entirely on the
electrical limit switches functioning in order to provide the space,. However, for traction drive
lifts, the permanent headroom is dependent on the presence of the counterweight buffer to
limit the upward travel of the car. If the counterweight buffer is missing, there is no means to
prevent over-travel of the car into the headroom.

15
The accident that occurred in the United Kingdom in 2005 was on an incomplete lift.
However, the uncontrolled upward travel of the lift was due to an unexpected control cable
breakage. The engineer was aware that the counterweight buffer and limit switches were
missing and was crushed attempting to leave the car top through a landing door.

2.4.2.4 Bypassing safety system

A method of operating the lift in normal service mode while the landing doors are open is to
bypass (shunt) the landing door contacts and defeat the safety system. This enables an
engineer to access the lift car and operate the lift without using the inspection mode. The
investigator of the accident in the United Kingdom in 2000 had learned from a number of
engineers that there was a practice of keeping door beaks for this purpose. The door beak is a
component of the car door that mates with corresponding electrical contacts to signal that the
doors are closed. It is not clear from the accident data whether other means were also
employed to enable a lift to be used in service mode with the landing doors open.

2.4.3 Analysis of the effectiveness of safety systems

The effectiveness of safety systems such as the refuge space or alternatives is based on the
assumption that a person will remain on top of, or below the car in the event of an emergency.
Furthermore, it is necessary for them to locate the safety space and be able to accommodate
themselves in the time available. Of the 19 accidents, there were 11 in which it is clear the
victim was on top of, or below the lift car at the time of the accident. In the remaining
accidents, the victim was crushed either at the side of the car, or between the car and the
landing door. This was due to the victim being caught unaware or attempting to leave the car
top to avoid being crushed. There was only one instance of a person successfully leaving the
pit in the path of the descending lift car.

The 11 instances in which the victim was on or below the lift car include 3 in which the safety
systems functioned and 7 in which the systems failed. Two of the failures were those due to
the counterweight buffer not being installed. Details of one accident suggest that the
maintenance engineer did not have sufficient time to be able to get into the correct position as
the car descended into the pit. The other cases where the safety systems failed do not give
sufficient detail to determine the cause. The 3 cases where the safety systems functioned
include 2 of the refuge space and a single case of the buffer and end switch working. It was
noted that the refuge spaces were of sufficient dimensions to prevent serious injuries, leading
only to a broken ankle and a concussion.

Generally, there are a number of contributory factors in lift crushing accidents. The report on
the accident in the United Kingdom in 1998 stated that the victim was crushed in attempting
to use the car top emergency stop. However, the report also noted that there was likely to have
been sufficient refuge space had the victim not attempted to reach over the rope guard to
operate the emergency stop. Ultimately, the speed of the lift in contract mode gave little time
to decide what action to take.

The accident in the United Kingdom in 1998 was the only instance in which it was clear that
the lift was a limited headroom installation. Ordinarily, in inspection mode, the upper travel
limit would have stopped the lift 1.8 metres from the well ceiling. Due to the lift being run in
service mode, the available headroom was limited to the height of the rope guard. As
explained above, this was 810 mm above the car top and would have allowed a refuge space.

16
2.5 SUMMARY OF INCIDENT DATA COLLECTION

According to the data provided by the ELA statistical committee, within eight European
countries, there were 1339 lift accidents involving workers between 2001 and 2005. In
comparison to this, the numbers of accidents due to crushing at extreme positions of lift cars
is very small. Due to the nature of accident reporting processes across Europe, the amount of
detail available on each accident is also limited.

Of those accidents for which sufficient details are available, the main cause was found to be
that the lift was not set into inspection mode. Mechanical and electrical faults accounted for
the second largest proportion of accidents, yet the causes of these faults were not always
clear. It is worth noting also that a number of accidents occurred on incomplete lifts. In these
cases, an almost total reliance is placed upon a safe system of work as the lifts safety systems
cannot function as designers intend if they are incomplete.

For the purpose of making an informed comparison of the various means of preventing
crushing at extremes of lift travel, the benefit of a small amount of accident data can be
questioned. Furthermore, it is worth noting that accident data alone does not give a complete
picture of the effectiveness of safety systems. The nature of reporting systems means that
there is a strong incentive to investigate and report accidents, yet there is no corresponding
incentive to report instances of the success of safety systems. On the whole, such near misses
do not attract the same level of enquiry as accidents. In order to use historic data to make a
complete appraisal of means for preventing crushing, it would be necessary to give equal
consideration to both accidents and near misses.

In those instances when full accident reports have been available, it has become apparent that
a large proportion of accidents are attributable to a number of failings.

17
3 TASK 2 - EXAMINATION OF MEANS TO PREVENT
CRUSHING RISK EXISTING STANDARDS

3.1 INTRODUCTION

This section provides a summary of specifications for free space within existing standards.
European harmonised standards in addition to international, Japanese and American standards
have been covered. In addition to standards for free space, a draft standard for alternative
solutions is also introduced.

3.2 PRE-EXISTING STANDARDS AND REGULATIONS

A starting point for the examination of standards is the first editions of the European
standards. It is thought that the space requirements of the first European standards were drawn
from the best practices of the relevant national standards.

3.2.1 EN81-1 and EN81-2 first editions

The first edition of EN81-1 was published as EN 81-1:1977 Lifts and service lifts - Part 1:
Safety rules for the construction and installation of electric lifts. Paragraph 5.7 specifies
clearances for the headroom and pit for both traction drive and positive drive lifts. Headroom
clearances for traction drive lifts are specified when the counterweight is resting on its fully
compressed buffers, as this corresponds to the maximum useable upward car travel.
Additionally, the clearances for traction drive and indirect acting hydraulic lifts take into
account the rated speed of the car. For a roped lift, the inertia of the car means it will not stop
immediately as the counterweight comes to rest on its buffers. This stopping distance is
represented in the standards by a value of 0.035v2, which is half the gravity stopping distance
when the lift is travelling at 115% of its rated speed. For positive drive lifts, the clearances are
given for the upper buffers fully compressed and do not include the dynamic component
0.035v2. Similarly, direct acting hydraulic lifts do not include the dynamic component as the
lift car is not free to travel upwards when its actuation is stopped.

The first edition of EN81-2 was published as EN 81-2:1987 Lifts and service lifts - Part 2:
Safety rules for the construction and installation of hydraulic lifts [4]. Paragraph 5.7
specifies clearances for the headroom and pit for hydraulic lifts.

The standards include a number of clearance dimensions; these are shown diagrammatically
in Figures 1 and 2. The principal dimension is the free height above the roof of the car
enclosure (Figures 1 and 2, dimension A). Two further clearances are specified in the
standard, these are shown as dimensions B and C in Figures 1 and 2. These are smaller
clearances for the purpose of preventing trapping of limbs and to allow a working clearance
between the lift car and well. These dimensions are consistent with the clearances specified in
EN 349:1993 Minimum gaps to avoid crushing of parts of the human body [5]. Table 2
summarises the principal requirements of the standard for top clearance for traction drive,
positive drive and hydraulic lifts.

18
 headroom

C C B
B A A D
D

hydraulic
ram
counterweight
and buffer

pit

Figure 1 Top clearances non hydraulic Figure 2 Top clearances - hydraulic

Table 2 Top clearance summary for EN 81 first editions

Requirement EN 81-1:1977 EN 81-2:1987
Positive Indirect Direct
Traction drive
drive acting acting

Free height above the roof of the car

enclosure (Figures 1 and 2, dimension 1 m +
1 m + 0.035v2 1m 1 m*
A) 0.035v2*

Accommodation of rectangular block

resting on one of its faces (Figures 1 not required not required 0.5 m 0.6 0.5 m 0.6
and 2 item D) m 0.8 m m 0.8 m

*Above a clear area for standing of at least 0.12 m2, in which the lesser dimension is at least 0.25 m.

For a typical lift with a rated speed of 1 m/s, the contribution of the dynamic factor 0.035v2 is
small. It is further specified that the value of 0.035v2 may be reduced when the retardation of
the lift is positively monitored. The value may be reduced to 1/2 for lifts with a rated speed of
4 m/s and 1/3 for lifts whose rated speed > 4 m/s, provided the value is not less than 0.25m.

The top clearance requirements of EN 81-2:1987 were made consistent with Lift Directive
84/529/EEC. As a result, there are two significant differences between the requirements of
EN 81-2:1987 and the earlier EN 81-1:1977. The first is that EN 81-2 1987 specifies a clear
standing area on top of the car. The second is that EN 81-2 1987 requires that a rectangular

19
block is accommodated on top of the car. The clear standing area is specified in paragraph
8.13.1(b) and it is from this area that the clearance distance is measured. The requirement for
accommodation of a rectangular block recognises that, in provision of a refuge space, the
volume available is of importance, in addition to the height clearance. However, for lifts with
direct roping, the standard permits the lift suspension ropes to be included within the space of
the rectangular block. It is also interesting to note that paragraph 8.13.1 (a) specifies that the
car roof must be able to support the weight of two people, yet the requirement for free space
does not necessarily accommodate more than one person.

According to interpretation 565 of CEN/TS 81-29:2004 [6], the space within the rectangular
block is not intended to accommodate one person. Rather, taken together with the clearance
requirements, it is claimed that the available safety spaces are sufficient. This raises a point of
interest in respect of a discrepancy between the CEN intended interpretation of the standard
and the requirement of a safety space according to the directive. The directive states that the
requirement to prevent the risk of crushing will be achieved by means of a free space or
refuge. It is therefore possible that the free space can be interpreted as being the rectangular
block, the 1 metre linear clearance dimension or a combination of the two. On the other hand,
the message from interpretation 565 of CEN/TS 81-29:2004 is that the free space is provided
by the rectangular block together with the clearance requirements. An example of the
differing practices in this respect is evident in the United Kingdom and The Netherlands. In
the United Kingdom, the minimum requirement for free space is set out by the Department of
Trade and Industry to be the rectangular block. However, the Liftinstituut in The Netherlands
informed us that the criteria for acceptable free space based on a combination of free vertical
space and the rectangular block.

A further difference between EN 81-2 1987 and EN 81-1:1977 is that the latter requires the
car roof to be designed to permit the installation of a balustrade. However, whether a
balustrade is fitted is left to the discretion of local regulatory bodies and there is no
specification for any dimensions of the balustrade. Although it would seem possible to use a
balustrade for providing safety space, the intention of the balustrade is to prevent a person on
top of the car from falling between the lift and shaft wall.

A second edition [7] of EN 81-1 was published in 1985, to accommodate Lift Directive
84/529/EEC. This edition incorporated the requirement for a rectangular block in the
overhead safety space and the increase of the size of the rectangular block in the pit.

Paragraphs 5.7.3 of EN 81-1:1977 and 5.7.2 of EN 81-2 1987 define the requirement of the
pit. The pit floor must be smooth and level, but it is permitted to accommodate bases for
buffers, guides and jacks and for water drainage devices. Pit clearances are specified when the
car is resting on the fully compressed buffers. In contrast to the requirements for headroom,
the pit clearance distance is halved. However, there is the requirement for accommodation of
a rectangular block resting on one of its faces. The clearance of 0.5m is consistent with the
clearance specified in EN 349:1993 for preventing crushing of the body. Table 3 summarises
the pit clearance distances.

20
 B

A D A D

Figure 3 Pit clearances non hydraulic Figure 4 Pit clearances hydraulic

Table 3 Pit clearance summary

Requirement EN 81-1:1977 EN 81-2:1987

The clear distance between the

bottom of the pit and the lowest
portions of the car (Figure 3 and 0.5 m 0.5 m
4, dimension A).

The free vertical distance between

the bottom of the pit and the
lowest guiding yoke of a
not applicable 0.5 m
telescopic jack below the car of a
direct acting lift
(Figure 4, dimension B).

Accommodation of rectangular
0.5 m 0.6 m 0.8 0.5 m 0.6 m 1
block resting on one of its faces
m m
(Figures 3 and 4, item D)

The pit clearances specified in EN 81-2:1987 mirror those of the EN 81-1:1977, other than
the increase in the size of the rectangular block. This was a result of EN 81-2:1987 being
aligned with the Lift Directive 84/529/EEC.

21
3.3 CURRENT STANDARDS.

3.3.1 Harmonised standards

EN81-1:1998 and EN81-2:1998 [9] differ from the previous editions in that they are part of
the new approach harmonised standards. However, the free space requirements of previous
editions were unchanged. Tables 4 and 5 summarise the current EN safety space
requirements. It is apparent that there is a difference between the rectangular block
requirement in the headroom and the pit. One reason given for this was that less space is
needed on top of the lift car as a person is moving with the lift car and therefore aware of the
hazard.

Table 4 Summary of top clearances for current EN 81 standards

Requirement EN 81-1:1998 EN81-2:1998
Traction drive Positive drive Indirect acting Direct acting

Free height above the roof 1 m + 0.035v2* 1 m* 1 m + 0.035v2* 1 m*

of the car enclosure
(Figures 1 and 2,
dimension A)

Accommodation of 0.5 m 0.6 m 0.5 m 0.6 m 0.5 m 0.6 m 0.5 m 0.6 m

rectangular block resting 0.8 m 0.8 m 0.8 m 0.8 m
on one of its faces
(Figures 1 and 2 item D)

*Above a clear area for standing of at least 0.12 m2, in which the lesser dimension is at least 0.25 m.

Table 5 Summary of pit clearances for current EN 81 standards

Requirement EN81-1:1998 EN81-2:1998

The clear distance between the 0.5 m 0.5 m

bottom of the pit and the lowest
portions of the car (Figures 3 and 4
dimension A).

The free vertical distance between not applicable

the bottom of the pit and the lowest 0.5 m
guiding yoke of a telescopic jack
below the car of a direct acting lift
(Figure 4, dimension B).

Accommodation of rectangular 0.5 m 0.6 m 1 m 0.5 m 0.6 m 1 m

block resting on one of its faces
(Figures 3 and 4, item D)

22
3.3.2 New lifts in existing buildings

Draft standard prEN 81-21 Safety rules for the construction and installation of lifts Lifts
for the transport of persons and goods Part 21: New passenger and goods passenger lifts in
existing buildings [10] was instigated to address the requirements of new lifts in existing
buildings. The document is currently submitted to the Unique Acceptance Procedure. It aims
to provide standards for the alternative to provision of free space, if the space requirement is
impossible to fulfil. Such a case may arise where a lift in an old building is being replaced.
If the existing lift was installed prior to the adoption of harmonised standards, it is possible
that there is insufficient space available for the provision of safety spaces. Necessary
clearances may also be unavailable when replacing an existing hydraulic lift with new traction
lift.

3.3.2.1 Top and pit clearances

Paragraph 5.5 reduced top clearances replaces the requirements of EN 81-1:1998, 5.7.1.1
b), c) and d), EN 81-1:1998, 5.7.2.2 and EN 81-2, 5.7.1.1 b), c) and d). These are the
requirements for the 1 m clearance and for the accommodation of a rectangular block on the
car roof. Paragraph 5.7 reduced bottom clearances replaces the requirement of EN 81-1,
5.7.3.3 and EN 81-2, 5.7.2.3. These are the requirements for the accommodation of the
rectangular block in the pit. The alternative means given in paragraphs 5.5 and 5.7 of prEN
81-21 are essentially the same for both the top clearance and the pit clearance and must
consist of the following:

Movable stops or
A pre-triggered stopping system.

When the devices providing safety spaces are in operation, prEN81-21 specifies dimensions
for the resulting safety spaces as follows:

A top clearance of 1.2+0.035v2 and the accommodation of a rectangular block of 0.5

m 0.6 m 0.8 m resting on one of its faces.

A free vertical distance between the lowest parts of the car and the bottom of the pit
of 0.6m and the accommodation of a rectangular block of 0.5 m 0.6 m 1 m resting
on one of its faces.

Both top and pit refuge spaces are increased due to the fact that they are not permanent and
therefore do not require any modifications to existing buildings. The means for providing
temporary free space allow almost any amount of clearance

3.3.3 International standards

ISO 4190 [11] has the general title Lift (US: Elevator) installation. Part 1 covers class I, II,
III and VI lifts. Of these, classes I and II are passenger carrying lifts. ISO 4190 is not a safety
standard, rather it is a guide to the building dimensions necessary to install a lift. ISO 4190
adopts a slightly different approach to EN 81 in specifying pit depth and headroom. Rather
than absolute values, ISO 4190 tabulates pit depth and headroom in terms of rated load and
speed. Further, unlike EN 81, there is no definition of how the pit depth and headroom are
defined in respect of the various parts of the lift car. The most recent version of ISO 4190
makes reference to the fact that there is now improved utilization of building space by
reducing well sizes where practical.

23
Recently, it was recognised that there was a need for an ISO publication that would set global
essential safety requirements (GSERs) for lifts. The intention is that GSERs specify safety
objectives so lift designers are then free to decide how these objectives are met. The need for
a new safety standard was recognised when an attempt was made for global harmonisation
based on existing national standards. The committee came to the conclusion that the existing
national standards were disparate and were written in a prescriptive language. DD ISO/TS
22559-1:2004 [12] is the result of the new approach to the development of lift standards.
According to DD ISO/TS 22559-1:2004 the intent was to develop safety requirements where
the lift is defined as a load carrying unit (LCU) carrying a load from one floor to another. In
this way, there are no restrictions imposed on the design of the lift and therefore no barriers to
the development of lift technologies.

DD ISO/TS 22559-1:2004 sets out a risk based process for evaluating a lift system or
component for compliance with a particular GESR. The process is based upon formulating a
risk scenario based upon a harmful event and assessing the risk associated with the event. If
the risk level is deemed to require mitigation, measures are required to eliminate the hazard or
reduce the risk. One of the ways in which the risk may be reduced is by implementing GSPs
or Global Safety Parameters. It is possible that in eliminating the hazard or reducing the risk,
that a new hazard is introduced. In this case, the new hazard is to be mitigated using the
foregoing process. The following GSERs are relevant to the possibility of crushing in the pit
or headroom:

6.5.7 LCU movement under control of an authorized person Only authorized persons shall
be provided with means to prevent or to enable the movement of the LCU when they are in
the travel path. When an authorized person is within reach of unprotected moving parts of the
lift, that person shall be able to prevent or activate movement of the lift equipment. NOTE
Equipment includes all possible moving parts, such as the LCU, counterweight

6.5.8 Uncontrolled, unintended equipment movement inside the well (hoistway) Means shall
be provided to protect authorized persons from the effects related to uncontrolled or
unintended movement of equipment inside the well (hoistway). Any acceleration or
deceleration to which an authorized person is subjected as a result of uncontrolled or
unintended movement shall be limited to sufficiently mitigate the risk of harm.

6.5.9 Means of protection from various hazards

Means shall be provided to adequately protect an authorized person in working spaces from
the effects of shearing, crushing, abrasion, laceration, high temperature or entrapment.

In addition to the GSERs, DD ISO/TS 22559-1:2004 lists the various lift subsystems with
relevance to each GSER. It is worth noting that risk based assessment was present in the
development the EN81 standard. The general introduction of EN 81-1:1977 states that An
analysis of the risks has been carried out for each component that may be incorporated in a
complete lift or service lift installation. Rules have been drawn up accordingly.

3.3.4 United States ASME A17.1

ASME A17.1-2004 Safety Code for Elevators and Escalators [13] section 2.4 defines
headroom and pit clearances. In addition to the clearances, the code specifies separate refuge
spaces. Refuge space for the pit is defined in clause 2.4.1.3 and refuge space on top of the car
is defined under 2.4.12. In both cases, the refuge space is equal to, or greater than, the
minimum car clearance. Table 6 summarises the refuge space requirements. Both the top and
pit refuges are specified for maximum car travel. There is no clear indication of whether any
suspension ropes are permitted in the car top refuge area.

24
 Table 6 Top and pit refuge according to ASME A17.1

Requirement Measurement
2
1.1 m above a clear area of not less than 0.5m measuring no less than 0.6 m on any
Top refuge
side
A horizontal area of 0.6m x 1.2m with a height of 0.6 m or
Pit refuge
A horizontal area of 0.45 x 0.9 m with a height of 1.07m.

A17.1 makes special provision for limited-use/limited-application passenger elevators.

These are defined as elevators in which the use and application is limited by size, capacity,
speed and rise. Paragraphs 5.2.1.4.2 and 5.2.1.4.4 allow alternative provisions to the top and
bottom car clearances. The alternative for bottom car clearance is a nonremovable means to
mechanically hold the car at a height of not less than 0.9 m above the pit floor. The means
should either automatically operate when the lowest hoistway door is opened, or be capable of
being operated without complete bodily entry into the pit.

Paragraph 5.2.1.4.4 permits that an alternative to top car clearances may be used in existing
buildings where the specified top car clearance cannot be provided. The alternative means is
specified as a nonremovable means to mechanically and electrically prevent upward
movement of the car to provide a refuge space conforming to 2.4.12 (existing refuge space).

At the meeting with LEIA it was noted that ASME may be moving towards a two-tier
system. In effect, the existing standard would be supplemented by a parametric standard in
the style of DD ISO/TS 22559-1:2004.

3.3.5 Japan

The requirements for headroom and pit clearances in Japan are stipulated in the Building
Standard Law of Japan (BSLJ) and Ministry of Construction notices, and summarised in
PD ISO/TR 11071-1:2004 [16]. The dimensions depend on the lift type and, for traction drive
lifts, the rated speed of the car. It was suggested that the Japanese take a similar line to ISO
4190 and do not lead in the development of standards.

3.3.5.1 Traction drive lift clearances

Top clearances for traction drive lifts are tabulated according to the rated speed of the car as
set out in Table 7. The top clearance is specified as the distance between the car crosshead
and the well ceiling, or the car roof and well ceiling if there is no crosshead. Additionally, the
clearances are specified when the car is stopped at the top landing. Unlike the ASME and EN
standards, there is no requirement for the counterweight to be on fully compressed buffers.

25
 Table 7 Top clearances for traction drive lifts
Rated speed (m/s) TCC (m)
V 0,75 1.2
0,75 < V 1,0 1.4
1,0 < V 1,5 1.6
1,5 < V 2,0 1.8
2,0 < V 2,5 2.0
2,5 < V 3,0 2.3
3,0 < V 3,5 2.7
3,5 < V 4,0 3.3
4,0 < V 4,0 4

Alternatively, a formula is provided for calculating the clearances based upon the rated speed.
However, the minimum distance of 1.2m must be observed. Whilst this minimum distance is
also the requirement for the car top refuge space, there is no minimum area requirement.

Pit clearances for traction drive lifts are also tabulated according to rated speed, as shown in
Table 8. It is worth noting that the pit depth is defined differently to that in the ASME and EN
standards and is the distance between the lowest floor level and the bottom of the pit.

Table 8 Pit clearances for traction drive lifts

Rated speed (m/s) BCC (m)
V 0,75 1.2
0,75 < V 1,0 1.5
1,0 < V 1,5 1.8
1,5 < V 2,0 2.1
2,0 < V 2,5 2.4
2,5 < V 3,0 2.7
3,0 < V 3,5 3.2
3,5 < V 4,0 3.8
4,0 < V 4,0 4.0

3.3.5.2 Hydraulic lift clearances

Top clearance for direct acting hydraulic lifts does not depend on the rated speed and is given
as 1.2 m during maintenance. This dimension also applies as the refuge space. There is no
corresponding requirement for pit clearance.

3.3.6 Persons at risk

Section 2.1 of the EU lifts directive guidance states that The lift must be designed and
constructed to ensure that the space in which the car travels is inaccessible except for
maintenance or in emergencies. Before a person enters that space, normal use of the lift must
be made impossible. The general introductions of EN 81-1:1998 and EN 81-2:1998 also list
the Persons to be safeguarded as:

26
a) users;
b) maintenance and inspection personnel;
c) persons outside the lift well, the machine room and pulley room (if any).

The recently introduced standard EN 81-71:2005 Vandal resistant lifts [14] clause 5.1.2.1
specifies a level of integrity for inspection and emergency doors and inspection traps. Taken
together with the requirements of EN 81-71, it would appear that the current EU directive and
EN standards aim to safeguard maintenance and inspection personnel. Furthermore, although
there is a requirement for refuge space, there is no requirement for it to be marked.

3.4 SUMMARY OF SPACE REQUIREMENTS

Current European harmonised standards have arrived at a specification for free space that has
evolved from existing European standards. These requirements can be briefly summarised as:

The accommodation of a rectangular block as refuge space in both the pit and the
headroom
A 1 metre clearance in the headroom

The current American standard follows a similar route with the requirement of a 1.1 metre
space in the headroom and a rectangular block in the pit. It was indicated that Japan has not
taken a lead in the development of standards and as a result, appears to be less prescriptive in
the provision of pit and headroom. Recent movements in international standardisation
indicate that a less prescriptive route may be taken in future. In effect, the lift must be
designed to prevent the risk of crushing.

27
4 TASK 2 - EXAMINATION OF MEANS TO PREVENT
CRUSHING RISK STATE OF THE ART

4.1 INTRODUCTION

This section presents a summary and examination of the alternative means to prevent crushing
risk adopted by lift manufacturers worldwide. In essence, the alternative means comprise
systems to temporarily provide refuge space when the risk of crushing is present. In general,
the solutions are applicable to lower speed lifts that may travel at typically less than 1.6 m/s.
Often, the long stroke buffers necessitated by high speed lifts mean that a safety space is
inherent in the construction.

4.2 INFORMATION COLLECTION METHOD

The collection of information relating to manufacturers solutions was carried out in a similar
way to that used to collect accident data. A total of 9 manufacturers were contacted and
meetings were held with the industry associations ELA and LEIA. In all cases, the companies
were given the opportunity to volunteer their technical solutions. During the meetings at ELA
and LEIA it was suggested that manufacturers may not be keen to offer their technical
solutions to a third party though this would not preclude the possibility of identifying trends
in the technologies.

The contacts approached in respect of task 2 of the project were able to provide technical
information to be able to identify the general trend of systems used to provide free space. Two
manufacturers provided relatively detailed reports of their solutions. A third manufacturer,
Cardiff Lift Company of Cardiff, United Kingdom arranged a visit to an installation of a
limited headroom lift. In addition to the foregoing sources of information, the European
patent office database was searched under the classification B66B5/00C2B: Devices
enhancing safety during maintenance - of maintenance workers - against crushing.

ThyssenKrupp Elevator have recently developed their Twin system for operating two cars
independently in a single shaft. The system raises the question of what constitutes extremes of
travel according to the Lifts Directive. Effectively, the headroom of the lower car is provided
by the position of the upper car and vice versa. A presentation detailing the operation of the
system the system was attended and provided a useful indication of state of the art.

4.3 SOLUTIONS ACCORDING TO DRAFT STANDARD PR EN81-21

The space requirements of the draft standard prEN81-21 were introduced in section 3.3.2.1.
The means by which these spaces are to be achieved is set out in a relatively prescriptive
manner. Part of the reason for this was suggested to be to assist manufacturers to buy into
the standard. Essentially, prEN81-21 offers the option of two alternative means to physically
stop the car and provide safety space. In addition to the alternative means, the standard
specifies a safety system for controlling the operation of the lift. It is instructive to examine
prEN 81-21 as it gives an indication of the state of the art.

4.3.1 System function

28
Figure 5 illustrates the basic system for creating artificial refuge space according to prEN 81-
21.

upper limit
switch

pre-triggered
stopping system

car movable
stop
lower limit
switch Counterweight
movable stop

Figure 5 System for creating artificial refuge space according to prEN 81-21

The alternative means for providing safety spaces are specified as a safety system for
controlling operation of the lift in addition to:

a) Either movable stops, or

b) A pre-triggered stopping system.

The same arrangements apply to both the headroom and pit.

4.3.2 Movable stops

Moveable stops allow the lift car to move to the extremes of travel during normal use. When
actuated, the moveable stops act to block the travel of the car and hence provide the safety
space. Movable stops for providing safety space in the pit act directly under the car to limit its
downward travel. Provision of headroom depends on the type of lift. For traction drive lifts,
the movable stops operate on the counterweight, for hydraulic and positive drive lifts, the
movable stops operate directly on the car. One of the reasons given for this arrangement was
that blocking the counterweight travel will stop the lift car from being driven upward. Any
buffers fixed to the guide rails or well roof would rely on the strength of the guide rail fixings
or the well roof. This would lead to the possibility that the guide rails or well roof could lift
off in the event of the lift car colliding with the buffers.

4.3.3 Pre-triggered system

29
The pre-triggered stopping system is specified as a means for tripping a mechanical stopping
gear by a linkage when the car reaches a fixed point in the up or down direction. The stopping
gear is required to be fixed on the car and act on the guide rails with its actuation method as a
mechanical triggering device using a mechanical linkage. When the stopping gear has been
tripped, it is required that its release is by a competent person and that it is in a condition to
operate after release.

In essence, the pre-triggered system is akin to an arrangement for tripping and holding the lift
safety gear when the car reaches a set point in its travel. There is no indication in the standard
that the safety gear may or may not be used for this purpose. Indeed, certain types of safety
gear are unsuitable for being used as a parking brake. For example, it was suggested that
progressive safety gear used for retarding the fall of high speed lifts cannot be used for this
purpose. It is also worth noting that the pre-triggered stopping system may be required to
operate in both up and down directions and therefore be bi-directional.

4.3.4 Safety system

The safety system is required to neutralise normal operation of the lift when any door giving
access to the pit or car top is opened by means of a key. There are a number of conditions that
must simultaneously be met before the lift can be reset into normal operation. These are:

1) The lift is not in inspection mode

2) Stop switches are in the STOP position
3) Any access doors are closed and locked
4) The movable stops or the triggering device of the pre-triggered stopping system are not in
the active position.

Furthermore, it is required that entering the inspection mode is only possible if the movable
stops or the triggering device are in the active position.

4.3.5 Operation

The movable stops or pre-triggered stopping devices may be operated automatically or

manually. When automatic operation is used, this must be at the latest when the safety
system has been activated. It is possible therefore, to have a pit prop that is manually inserted
to provide safety space.

4.4 MANUFACTURERS SOLUTIONS

The following sections present an overview of the alternative means for providing free space
as employed by the lift industry. Three solutions were volunteered by manufacturers and are
detailed in terms of the devices for providing space and their means of control. Throughout
the information gathering process, it became evident that there were a number of stock
solutions in use. The adoption of these stock solutions was confirmed in the meetings with the
major manufacturers, consultants and notified bodies. The general consensus of the
manufacturers was that any solution for providing space must prioritise safety. For this
reason, many of the solutions use some form of mechanical means to physically prevent
movement of the car into the safety space.

30
4.4.1 Mechanical stops

The most basic system for providing a free space is a prop that is manually inserted into a
socket in the in pit. The prop may be stored in the well or in the machine room if space
allows. In order to insert the prop, a person must enter the pit and correctly align the prop
with the lift car. It was suggested that, in some cases, the lift has to be slowly lowered onto
the prop whilst it is being held so that the prop can be correctly aligned with a socket on the
lift car. Pit props have been a common feature of hydraulic lifts as they may be subject to
creep which is the slow leaking of oil through valves etc. leading to the gradual descent of the
lift car.

4.4.1.1 Manually erected fixed supports

Fixed supports provide a more permanent means than removable props and their inclusion in
the lift well means that they are readily accessible. Figure 6 is an example of a basic hinged
support. Another example is shown in Figure 7, taken from patent number WO 2006/024173
assigned to Garry Scott. The device is accessible through the access door (7) and swings into
a deployed position. In deploying the device, the disconnect plug (4) is removed from the stop
switch (6) thus activating the lift stop circuit.

Figure 6 Hinged support (Wittur AG)

31
 Figure 7 Hinged pit prop (source - the esp@cenet service/EPO)

There are many variations operating on a similar theme. Certain solutions have been proposed
that act on both the car and the counterweight of traction drive lifts to limit both the upward
and downward travel. It is worth noting that manually erected supports may require a safe
system of work if they are not monitored by the lift control system and if their erection
necessitates a person enter the pit or headroom.

4.4.1.2 Automatically erected fixed supports

Automatically erected supports avoid the need for manual intervention. The requirement to be
partially or wholly in the lift well to erect the support is removed and therefore the exposure
to crushing risk is reduced. Figure 8, from patent number WO 2005/105644 assigned to Otis
Elevator Company, is an example of a device for providing pit refuge space. Its actuation
method is either by a pressure sensitive pad or by detection of the landing doors being
unlocked. Actuation causes the brace (1) to hinge into a vertical position and contact a buffer
element (9) on the lift car.

32
 Figure 8 Automatically erected prop (source - the esp@cenet service/EPO)

Figure 9 is a further example of an arrangement for the automatic provision of both pit and
headroom. Taken from patent number US 2004/0251087 assigned to Huber and Kocher, it
shows a buffer device (44) that can be rotated about its vertical axis and thus block the paths
of both the car and its counterweight.

33
Figure 9 Buffer for pit and headroom provision (source - the esp@cenet
service/EPO)

34
 Figure 10 Hinged support (Wittur AG)

Figure 10 shows a hinged support as provided by the Wittur safety clearance system HSK.
For provision of pit clearance, the supports sit below the lift car and act on the car frame. For
provision of headroom, the arrangement depends on the lift type. When used in a traction
drive lift, the supports act on the counterweight (Figure 11) to reduce its downward stroke.
When used on a positive drive lift, such as a hydraulic lift, the supports are installed to hang
down (Figure 12) and act on the top of the car frame. The hinged supports are connected into
a control system and arranged to be electromagnetically held in the inactive position during
lift travel.

When supports act directly on the car frame to limit its upward travel, it is worth noting that
the forces that result from the car hitting the supports must be accommodated by the
construction of the well.

35
Figure 11 Hinged support for headroom Figure 12 Hinged support for headroom
on traction lift (Wittur AG) on positive drive lift (Wittur AG)

4.4.2 Stop bars

An alternative to movable buffers for providing a safety space is demonstrated in the Otis
Gen2 lift range which utilises flexible belt tension members in place of ropes. Due to the
size of the lift, certain maintenance operations are carried out from a platform on the car roof.
The crushing risk is therefore between the platform and the well roof. The proposed solution
for providing safety space is shown in Figure 13, taken from patent number US 2007/0034455
assigned to Otis elevator company. The arrangement consists of a rod (9) which is moved
manually by a lever (11) to protrude from the side of the car. When the lift is set in
maintenance mode, the normal limit switch should stop the car on approach to the stop rail
(23). In the event of a failure of the brake or traction, the rods contact the stop rail to limit the
car travel.

36
 Figure 13 Manual stop bars (source - the esp@cenet service/EPO)

An automatic system working along similar lines was viewed at an installation by Cardiff Lift
Company of Cardiff, Wales. The system, shown in Figure 14, consists of stop bars fitted to
the lower car frame. Hydraulic rams driven from a car mounted pump move the stop bars into
an active position as soon as the lift safety circuit is broken, for example by opening a landing
door. In the event of limit switch failure, travel of the car into the safety space is prevented as
the stop bars contact blocks fitted to the guide rails (Figure 15). An additional feature is that
the position of the stops is monitored. In the event of the stops failing to activate, operation of
the lift in inspection mode is prevented.

37
 Figure 14 Automatic stop bars

Figure 15 Stop block

The guide rails are attached to the hydraulic ram at their lower ends and are restrained by the
well ceiling at their upper ends. In the event of the stop bars contacting the stop blocks, there
is no danger of the guide rails being lifted out of the shaft.

38
4.4.3 Electrical stops

Limit switches are employed to stop the lift electrically prior to the car colliding with any
buffer stops. The limit switches effectively form the first means for creating safety space, and
allow the car to be brought to a halt in a controlled manner. Should the car contact the limit
switches, any further movement of the car is usually only possible in the opposite direction. In
a lift with reduced pit and headroom, the limit switches will permit the car to enter the
extremes of its travel under normal operation. When the lift is switched into inspection mode,
the limit switches become active. Figure 16 is an example of the use of limit switches as a
means to provide clearance and is taken from patent US 6223861 assigned to Otis Elevator
Company.

Figure 16 Limit switch provision of refuge (source - the esp@cenet service/EPO)

39
4.4.4 Pre-triggered system

Section 4.3.3 introduced arrangements for creating refuge space by actuating the lift safety
gear or an equivalent system. There are a number of ways in which this can be put into
practice. Figure 17 shows the basic arrangement of the overspeed governor. The governor
rope is linked to the car safety gear and the car moves the governor pulley in proportion to the
car speed. Should an overspeed condition occur, the governor pulley is locked, inducing a
tension in the governor rope and actuating the safety gear via linkages.

By blocking rotation of the governor pulley, for example by a solenoid and catch, it is
possible to cause the safety gear to be triggered at a set point in the car travel. Alternatively,
when the car is stationary, the solenoid can be actuated so that any further rotation of the
governor pulley causes the safety gear to be triggered. This arrangement has been offered for
some time by BODE Components GmbH to prevent car creep during maintenance or to
provide safety space. The means to actuate the solenoid may be linked into the lift safety
system. Consideration would need to be given to the rating of the solenoid used to block the
rotation of the overspeed governor as it could effectively be required to be held in an active
position over a considerable period of time.

Overspeed
governer

actuation
means

safety gear

tension
pulley

Figure 17 Overspeed governor arrangement

Rather than blocking the rotation of the governor pulley, it is also known to employ a system
of catches, clamps or the like to block movement of the governor rope itself. In these
arrangements, the governor rope may be fitted with protruding elements corresponding to the
required travel limits and the lift well may be fitted with swing catches. In order to create the
safety spaces, the swing catches are deployed to engage with the protruding elements on the
governor rope and thus activate the safety gear. Alternatively, a dedicated rope brake is used
to grip the governor rope. These examples require a system to initiate stopping of the
governor rope.

40
A lift installation employing the safety gear is demonstrated in Figure 18, taken from patent
application WO 2004/043842 (ThyssenKrupp Elevator). The installation relates to the Twin
system of two cars in a single shaft. Under normal conditions, the positions of the lift cars
with respect to each other and the ends of travel are set by the control system. However,
independently of the control system, the distances between the cars and the ends of travel are
limited by the safety gear. This is achieved by attaching sleeves (84) to the governor ropes
and catches to the cars. The minimum distance between the cars is therefore set according to
the length of the sleeves Should the inter-car distances fall below the preset distance, one or
both safety gears are triggered to stop the cars.

Figure 18 Application of the overspeed governor to provide clearances (source - the

esp@cenet service/EPO)

Rather than actuating the safety gear indirectly via the overspeed governor or its rope, it is
also known to actuate it directly. Such as system is shown in Figure 19, taken from European
patent number EP 1422182, assigned to Centoducati S.p.A. When the device is to be
activated, the actuation means (4) is moved into position either manually or by a solenoid
(23). Upon reaching the actuation means at predetermined height (Hmin), a system of rods
and levers (2, 3) engages the safety gear to stop the car.

41
 Figure 19 Direct actuation of safety gear (source - the esp@cenet service/EPO)

Overspeed governors and the safety gear are listed as a safety component under the lifts
directive. This carries the advantage that they are type tested components and subject to
inspection. However, it was suggested that the use of the safety gear to provide refuge space
is less than ideal as there are effectively two different requirements from the same system.
One is to be able to arrest the car in the event of an overspeed/loss of traction. The other is to
be able to stop or hold the car as a parking brake. Certain types of safety gear are known to
be unsuitable for this use as they are intended to stop the car from high speed are not suited to
low speed use. However, such systems are known to have been approved by notified bodies,
following practical demonstration and testing. Alternatively, it is entirely possible for a pre-
triggered system to use a separate system from the lift safety gear and overspeed goverenor.
Indeed, it was indicated by Kone that a system for providing safety space would be separate
and not involve the existing overspeed goverenor and safety gear.

It is also worth noting in relation to the above that the safety gear may not be routinely
actuated to provide the safety space, but would be used only in the case of other (for example
electrical) systems failing. In essence, the safety gear would be performing its intended
function as a safety gear, albeit in the provision of refuge space.

A system for using the safety gear to provide both pit and headroom requires the safety gear
to be operable in both the upward and downward directions. This places an additional
requirement on the integrity of the lifts guide rails in that they must be secured against
movement in the two directions.

42
4.4.5 Control/drive system provision of space

The use of devices such as encoders and shaft data systems as inputs to the control system
permits precise control of the lift car. Similar to the use of limit switches, it is possible to
control the lift so that it will not move to the extremes of travel under certain conditions. It
was indicated by manufacturers that the control system is not used as the sole means for
providing free space. The main reason for this is the reliance on the integrity of the drive
system. It is interesting to note that the greatest risk on a lift is passengers crossing the
threshold and this relies entirely on the integrity of the drive system.

4.4.6 Moveable car floor or roof

An alternative method of providing refuge space is shown in Figure 20, taken from patent
application WO 03016192, assigned to Kone Corporation. The refuge space (9) is provided
by a hinged floor (3) of the lift car (2). The claimed advantages of the system are that it is
economical, reliable and simple to use and does not require devices such as movable buffer
stops. Similar systems exist for providing safety space in the headroom through movable car
roof members. LM liftmaterial have also recently developed a system in which the car roof
can be hinged down to allow access to the lift machine from inside the car. Such a system
avoids the need to provide headroom as there is no longer the need to be on top of the car.

Figure 20 Space provision through hinged floor (source - the esp@cenet

service/EPO)

4.4.7 Combined layers of safety devices

The systems considered so far can be broadly grouped into three categories:

Mechanical means to stop the car

Electrical means to stop the car

Control means to stop the car

43
Clearly, it is undesirable to be able to routinely collide the car with mechanical stops or
actuate the safety gear. For this reason, it is usual to adopt a multi-layer approach to safety
devices as follows:

The control/drive system stops the car at a predetermined distance

Hardwired limit switches act as a backup

In the event of both of the above failing to operate (for example through a loss of
traction) the car is stopped by the mechanical means

Such arrangements have the advantage that an increased level of safety is offered in addition
to reducing the possibility of mechanical damage to the car or safety devices. The
ThyssenKrupp Twin system employs a four level arrangement claiming that a free space is
maintained between the two lift cars at all times:

1) The destination control system maintains a space between the cars during operation

2) The drive system independently monitors the space and operates the brake should a
minimum clearance be reached

3) An electrical limit acts to stop the system should 1 or 2 above fail.

4) A system of sleeves act on the overspeed governor ropes to ultimately engage the safety
gear should any of the above fail. This system is as described in section 4.4.4. For very high
speed installations, it was found that this arrangement required prohibitively long tubes to be
installed on the governor ropes. Therefore, an alternative system was developed in which an
electrical monitoring system monitors the space between the cars using two independent
systems. Should the minimum clearance be reached, an independent brake grips the governor
rope to actuate the safety gear. The entire monitoring and brake system is SIL level 3 and
battery operated in the case of a power failure.

4.4.8 Safety device actuation

Whilst the operation of safety devices such as movable buffers and stops can be entirely
manual, it us usual to link them into the lift control system and safety system. By monitoring
the state of the safety devices, the control/safety systems can be arranged to prevent the lift
entering either normal service mode or inspection mode. Furthermore, automatically operated
safety devices can be linked into the control system and arranged to be actuated under certain
conditions. For example, it is common for the safety devices to be actuated as soon as a
landing door is opened using the maintenance key

Generally, the safety devices are not used alone but are packaged as part of a complete
system. Examples of complete systems were provided by three manufacturers. Wittur AG
market a system called the Safety Clearance System. The package comprises buffers as
detailed in section 4.4.1.2 controlled by an electrical safety system. LM Liftmaterial offered
their Emerald 300 product that makes use of an artificial space pit prop, a locking device on
the overspeed governor in addition to an electrical safety system. Both the Wittur and LM
Liftmaterial systems have undergone examination and approval by notified bodies and are
sold as complete units. A third example was a site-specific installation by the Cardiff Lift
Company of Cardiff, Wales. This differed from the preceding examples as it was in effect, a
one-off installation required to cope with a limited headroom. The approach taken by the
company was the use of stop bars described in section 4.4.2 in addition to a safety system

44
controlling the operation of the lift. Details of the principle of operation of the three systems
are given in appendix 4.

Whilst the principle of operation of the systems for providing temporary free space differs
according to the manufacturer and installation, the common theme is that the solution is in
place when the risk of crushing is present. Furthermore, the solutions remain in place until
there is a manual intervention to reset the lift to its normal operating mode, e.g. by operating a
key switch on the lift control panel. The risk of crushing is usually detected by the opening of
a landing door, though there are other possibilities for providing additional security.
Examples of these are pressure sensitive pads or optical detection systems on the car roof and
in the pit.

Given a sufficiently strong intent, it is entirely possible to defeat the systems for providing
temporary free space and to be able to operate the car in service mode whilst riding on the car
top. However, practicality and cost would almost certainly rule out the design of a completely
infallible system; landing door contacts may be bridged and safety features may be
electrically bypassed.

4.4.9 Discussion

The salient point to emerge in respect of state of the art for technical solutions is that there are
a number of stock solutions in use. Generally, these comprise mechanical means to block
the travel of the car when the risk of crushing in the pit or headroom is present. Part of the
reason for the adoption of these stock solutions is that they can make use of components that
have had prior approval as safety components, such as the overspeed governor. It is also
advantageous in terms of installation and maintenance to be able to use existing components
that can readily be checked. There is the possibility that more esoteric solutions have been
developed, but they are not clearly in mainstream use.

On the whole, the view among manufacturers was that the safest way to provide temporary
free space is to use basic mechanical means to ultimately prevent travel of the car. Although
the control system may be used to slow or stop the car before it arrives at any such temporary
stops, it would not constitute the sole means for providing free space. Clearly, any failing of
the drive system such as a loss of traction or braking would lead to uncontrolled movement of
the car and reliance on the safety gear. However, there was an indication by one
manufacturer that in the future, control systems may be relied upon entirely. A three part
example was given, viz:

1. take away the need for a machine room

2. take away the need for a permanent refuge space
3. take away the provision of refuge by mechanical devices

This last point was reinforced in a suggestion by a representative from one company who
considered that electrical limit switches alone were sufficient to provide refuge space.

The systems used by the manufacturers generally vary from country to country and this partly
depends, amongst other aspects, on local competition. Alternatively, one manufacturer
explained that they would produce one design for free space that they would have approved
and use EU wide. The large manufacturers such as Otis and Kone indicated that they would
firstly comply with free space requirements. If this is not possible, then they will employ
alternative solutions.

45
There are both automatic and manual alternative solutions for providing free space. The most
obvious point is that manual systems, for example pit props, rely on a safe system of work.
Automatic systems, for example those working when a landing door is opened, do not place
such a reliance on a safe system of work. That is not to say that automatic systems are
completely infallible. Automatic systems that function when the risk of crushing is present go
some way to the goal of protecting anybody, even when unauthorised persons are in the pit or
headroom.

Whilst alternative means for providing free space can use approved safety components under
the lifts directive, the present position of the directive means they are not themselves
recognised as safety components.

A notable benefit of the use of alternative means for providing free space is that the amount of
free space created is not limited and can therefore be set at any appropriate value. When faced
with the necessity of providing a permanent free space, it would appear that currently, the
minimum possible is provided.

In collating the state of the art, it became apparent that there were different approaches to the
construction of complete systems to provide free space. This would depend on the size of the
company and the nature of the installation. Considering the following hypothetical examples:

A single designer within a small company produces a system that uses off-the-shelf
parts from a number of suppliers. These parts are interconnected to a control system
procured from another supplier.

A multidisciplinary design team within a large company design a complete system

that uses a number of parts produced in-house and an in-house designed controller.
The size of the company means that they can afford extensive testing of various
prototypes.

The first example may rely on the competence of a single designer in selecting appropriate
components and in addition to formulating a safe system as a whole. The second example
would therefore appear to have a distinct advantage in terms of the level of safety that could
be achieved. However, it was suggested by a representative from a large manufacturer that the
advantage gained would be in cost effectiveness, rather than safety. It was also noted that the
act of manufacture and procurement of components might result in departure from a
prescribed design. For example, a prescribed switch might be inadvertently substituted by one
with a lower level of safety in the interest of cost.

46
 5 TASK 3 EVALUATION OF ALTERNATIVE
SOLUTIONS

5.1 INTRODUCTION

The evaluation of the alternative technical solutions comprised four elements;

An ergonomic study of the existing refuge requirements.

Evaluation of the mechanical elements
Evaluation of control system elements
Economic assessment.

It was considered a necessity that the ergonomic study be conducted in order that the viability
of the existing refuge space provisions could be determined. It was not possible to determine
the viability of this space from the work carried out in task 1 as had been hoped, as there was
insufficient positive evidence of the refuge space having been adequate.

An assessment of the economics of the alternative means is also included. However, this had
no influence on the risk assessment and the outcome.

5.2 ERGONOMICS EVALUATION OF EXISTING REFUGE PROVISION

5.2.1 Background

The European standards EN 81-1 and EN 81-2 (1998) require an area in the lift recess pit and
overhead space that can be used as an emergency recess (refuge). This is a safety critical
aspect of lift design and as such it is important that the dimensions specified in these
standards provide enough space to accommodate the majority of the population.

Anthropometry is the study of body size and measurement and refers to body dimensions in
relation to the range dimensions exhibited by the population of concern. Percentile values are
used to indicate the proportion of the population that will exhibit a body dimension of a
particular magnitude (including those smaller). For example, if someone were 95th percentile
Stature (standing height), this would mean that 95 out of 100 people in the population would
be of that size and smaller, and only 5 people would be larger.

5.2.2 Assessment method

Appropriate measurements were selected from static anthropometry tables in Adultdata

[17]. Static anthropometry is the measurement of body dimensions with the body held in
standardised, static postures. Theses measurements can be used to assess the physical fit of
body dimensions in a given space. Critical dimensions were identified which were considered
the most appropriate to the postures that could be adopted in the volume provided by the
refuge dimensions.

The body dimensions that were used to assess the refuge dimensions and how they may relate
to refuge dimensions are summarised as follows:

Sitting Height - the refuge height and also the length if the user is required to lay on
their back.

47
 Buttock Knee Length - the dimension required to bend the legs
Shoulder Breadth - the minimum width required when sitting and the minimum
height if the user is required to lay on their side.
Abdominal Depth -the minimum height if the user is required to lay on their back.
Crawling Height: the refuge height
Crawling Length: the refuge length
Kneeling Leg Length: the refuge length
Kneeling Height: the refuge height.

A refuge space that is safety critical should accommodate and therefore protect as many
people as possible by design. It is common to design to accommodate up to the 95th percentile
in typical fit and reach applications, and the largest 95th percentile values from European
population data have been used in this report. However, it is important to note that a
proportion of the population will therefore not be protected.

A list of the critical body dimensions with descriptions and the corresponding 5th, 50th and
95th percentile values can be seen in Appendix 5. These dimensions include any adjustments
necessary for shoes, clothing and PPE.

5.2.3 3D Modelling

In addition, three-dimensional (3D) modelling software has been used to illustrate the
potential difficulties people might have in attempting to fit into the spaces allocated in the Pit
and Headroom areas.

Using UGS Tecnomatix Jack 3D ergonomics modelling software (version 5.1), the pit and
headroom spaces specified in the current standards have been modelled. The human figure
used in the figures below is scaled to match the stature (Dutch male 95th percentile) and
shoulder breadth (UK male 95th percentile) values to represent the largest European workers.

The postures modelled in the illustrations below reflect real joint motion characteristics, but
they do not show tissue compression. They are reasonably compact postures that are
considered to be likely to be adopted; they do not necessarily illustrate the most compact and
contorted postures that are attainable. They are intended to indicate the postures that could be
achieved relatively quickly and easily, i.e. in an emergency situation. The abdominal depth
and hip breadth have not been scaled because these produce a distorted human figure. The
illustrations are therefore indicative of the difficulties a large individual would have in fitting
into the required volume.

In all of the images, the human figure is always positioned resting on the ground level and so
as to touch three adjoining and orthogonal faces. The human figure may then protrude from
the opposite three faces. When the human figure is touching an edge, the area outside the box
is a darker shade.

48
5.2.4 Pit refuge

FIGURE 21 The height, width and length of the refuge space specified for the pit.
DARK black lines represent the dimensions of the refuge and the possible variations
based on EN 81-1 and EN 81-2 (1998). Coloured lines represent an anthropometric
measurement. Each square represents 0.1m.

5.2.4.1 Base area 0.6m x 1.0m - Height 0.5m. Width 0.6m. Length 1.0m

Figure 22. Curled on side posture

The minimum vertical distance of 0.5m makes it impossible to accommodate a 95th percentile
person in the space provided. The height dictates that the shoulders need to be angled within
the volume slightly in order to fit, otherwise the only means of fitting into the vertical

49
dimension is by laying flat as the only body dimension capable of fitting is the abdomen
depth. A width of 0.6m does accommodate the shoulders. The refuge length does not allow
the torso and legs to fit into the space provided. Sitting height (1.04m) exceeds the refuge
length, and the refuge height (0.5m) does not allow sufficient space to bend the legs (buttock
knee length 0.69m).

With the pit space is in this orientation, Figure 23 indicates that a largest European workers
may have difficulty fitting into this volume. Their trunk length means that even with the legs
curled up and the neck flexed there is not enough room to accommodate the knees and feet
easily.

SUMMARY:

Height 0.5m: Users must lie on their back

Does not allow the legs to bend, legs do not fit
Width 0.6m: Shoulders only just fit
Legs do not fit
Length 1.0m: Does not allow user to lie flat. Body does not fit
Body and legs combined do not fit

What this image does not show clearly is how close the upper body is to the space limits. The
shoulders are almost touching the upper face.

5.2.4.2 Base area 0.5m x 1.0m - Height 0.6m. Width 0.5m. Length 1.0m

The user is restricted to laying on their as the only dimensions that can fit the 0.6m height are
abdomen depth (0.42m) and shoulder breadth (0.58m). The user cannot fit into this space
width ways, as the breadth of the shoulders (0.58m) is greater than the width of the refuge
(0.5m). And again, the body and legs will not fit lengthways into the 1m of space provided.

SUMMARY

Height 0.6m: Users must lie on their side

(Shoulders only just fit)
Does not allow the legs to be bent
Width 0.5m: Shoulders do not fit
Legs do not fit
Length 1.0m: Does not allow user to lie flat. Body does not fit
Body and legs combined do not fit

The posture required remains the same but the orientation is changed to match that of the
volume, so the user will be as in Figure 1 above but laid on their back rather than on their
side.

5.2.4.3 Base area 0.5m x 0.6m Height 1.0m

Users cannot lie down due to insufficient length. The 1m provided is less than the 1.04m
required to sit upright but there is sufficient vertical space to accommodate crawling height
(0.82m). However, the buttock knee length (0.69m), kneeling length (0.81m) and crawling
length (1.54m) exceed the 0.6m dimension. For the crawling type posture to be viable, the

50
 minimum space required for the legs would be kneeling length (0.81m). The shoulder breadth
(0.58m) exceeds the width of the space.

SUMMARY

Height 1.0m: Users cannot sit upright. Must adopt crawling type posture
0.5m: Shoulders do not fit
Legs do not fit
0.6m: Legs do not fit

The two orientations of the base area of this space with respect to body fit are described
further below:

5.2.4.4 Long orientation - Height 1.0m. Width 0.5m. Length 0.6m

There are two possible postures illustrated. In both sitting/squatting (Figure 23) and kneeling
(Figure 24) postures the space provided is too narrow to accommodate the shoulders, and
when kneeling too short to accommodate the lower trunk and feet. When in a sitting/squatting
posture, the space is also inadequate to accommodate the head easily.

Figure 23 Sitting/squatting posture Figure 24 Kneeling posture

5.2.4.5 Base area 0.5m x 0.6m: Wide orientation - Height 1.0m. Width 0.6m.
Length 0.5m

When adopting the sitting/squatting posture, the space does not allow the human figure to fit
on any plane. The legs, shoulders and head are not accommodated.

In the kneeling posture, the head and shoulders are accommodated (tight fit) but the space is
too short to accommodate the legs.

51
Figure 25 Sitting/squatting posture Figure 26 Kneeling posture

5.2.4.6 Pit refuge Conclusion

Based on the information available, using 1.0m, 0.6m or 0.5m as the refuge dimensions does
not allow larger members of the population to fit into the space. This assessment is based on
one person in the refuge space. Accommodating 2 persons within these spaces is therefore
also not possible. This assessment does not take into account any equipment or ropes within
the refuge and assumes that the refuge is an unobstructed volume. Where there may be
obstructions in the refuge, these dimensions are even less suitable.

52
5.2.5 Headroom refuge

FIGURE 27 This shows the height, width and length of the refuge specified for the
headroom. DARK black lines represent the dimensions of the refuge and the possible
variations based on EN 81-1 and EN 81-2 (1998). Coloured lines represent an
anthropometric measurement. Each square represents 0.1m. The anthropometric
values are to scale with the refuge dimensions.

The refuge space is smaller in the headroom as the largest dimension is 0.8m. The largest
dimension in the pit is 1.0m. When the base area is 0.5m x 0.6m the assessments are therefore
the same as those for the pit but with less headroom. For the other orientations the extent to
which a large person can be accommodated is also reduced.

53
5.2.5.1 Base area 0.8m x 0.6m - Height 0.5m. Width 0.6m. Length 0.8m

Figure 28 Sideways Crouching Posture

Figure 28 shows clearly that the (large) human figure does not fit into this space. This is the
same posture as shown in Figure 21, but with 0.2m less length.

5.2.5.2 Base area 0.5m x 0.6m: Long Option Height 0.8m. Width 0.5m.
Length 0.6m

When the 0.8m is the vertical dimension it does not allow the user to sit or crawl. Only 1 of
the body dimensions is accommodated and this dictates that there is no feasible posture for
this orientation of the space. The height dictates that the user must lie on their back or on their
side. However, when laying in either of these positions it would be impossible for the rest of
the body to fit into the space provided as the refuge is not wide enough to accommodate bent
legs nor long enough to accommodate body length.

SUMMARY:

Height 0.8m: Users must lie on their side or on their back

Width 0.5m: Shoulders do not fit
Length 0.6m: Body does not fit
Legs do not fit

54
 Figure 29 Sitting Posture Figure 30 Kneeling Posture

When adopting sitting (Figure 29) and kneeling (Figure 30) postures, the space provided is
too small to accommodate the head, shoulders and arms, and also the feet and some of the
lower trunk when kneeling.

5.2.5.3 Base area 0.6m x 0.8m - With additional total vertical clearance of
1m

There is an option to have a vertical clearance of up to 1m. Within this the user could adopt a
kneeling posture. With the width of refuge at 0.6m the shoulders will fit, and the length at
0.8m, the legs and feet will be a tight fit.

If the initial height before the added space is 0.5m, and the additional vertical clearance of
1.0m is obstructed in any part above the base area, this may not be a viable option. However,
provided the space is free above the base area of the refuge, this is the most viable option.

SUMMARY:

Height 1.0m: Users cannot sit upright. Must adopt crawling type
posture
Width 0.5m: Shoulders do not fit
Legs do not fit
Width 0.6m: Shoulders fit
Length 0.8m: Accommodates kneeling leg length

55
 1.0m
1.0m
0.5m
0.5m

Figure 31 Sitting Posture Figure 32 Kneeling Posture

With the additional total vertical clearance allowance of 1m total (shown in green), it is
possible for the human figure to fit relatively easily into the 0.6m x 0.8m space whilst in a
kneeling posture (Figure 32). Most of the space provided is taken up by the person, therefore
the only way that someone will fit into this space easily would be if it were completely clear
and not obstructed by ropes or their attachment points. For this to be effective as a refuge in
an emergency situation the appropriate floor area would need to be clearly identified (e.g. use
of conspicuous markings) as well as the necessary posture.

5.2.6 Headroom conclusion

Based on the information available, using 0.8m, 0.6m or 0.5m as the refuge dimensions does
not allow people to fit into the space. This assessment is based on one person in the refuge
space. This assessment does not take into account any equipment or ropes within the allocated
refuge and assumes that the refuge is an unobstructed volume. Where there may be
obstructions in the refuge, these dimensions are even less appropriate.

Where there is the vertical free space of 1.0m it is possible that someone could be
accommodated in the space provided. However, it is unlikely that the user would know what
posture to adopt without instruction.

5.3 ERGONOMICS CONCLUSIONS AND RECOMMENDATIONS

The ergonomic study has shown that, based on the information available, using 1.0m, 0.6m or
0.5m as the pit refuge dimensions does not allow people to fit into the space or adopt a safe
posture in the area that is given to them. Using 0.8m, 0.6m or 0.5m as the headroom refuge
dimensions does not allow people to fit into the space or adopt a safe posture in the area that
is given to them. However, where there is a free space of 1.0m clearance in the headroom it is
possible that someone could be accommodated in the space provided. However, it is unlikely
that the user would know what posture to adopt without instruction. This assessment is based
on one person in the refuge space. To try and accommodate 2 persons within these spaces is
unacceptable and unsafe. This assessment does not take into account any equipment or ropes
and assumes that the refuge is an empty space. Where there may be equipment in the refuge
space, these dimensions are even less appropriate and safe.

56
The following dimensions for a refuge are suggested based upon the largest of the 95th
percentile European nationality population body size values identified (Appendix 5). These
are derived from body size data for standardised postures, and should enable at least 95% of
the working population to be accommodated (protected). They include allowance for clothing,
footwear and Personal Protective Equipment (PPE):

1. A space of at least 1.25m high (to allow sufficient sitting height and enough head
room to kneel), 0.6m wide (to allow clearance for the shoulders) and0.8m long, most users
would be able to sit in the refuge and clutch their knees, or kneel on their knees and their head
lowered.

2. A space to accommodate a standing posture would need to be at least 1.96m high.

The width of this space would need to be at least 0.63m (shoulders) and the depth 0.42m
(abdomen).

The size of the refuge has less relevance if the people who need to use do not know where it
is, or how use it effectively. Factors to consider to further improve the safety of the users and
to assist them in emergencies would be to highlight where the box is, e.g. clearly marked, and
to provide signage including pictures/diagrams of required postures, as the postures necessary
to fit into the space provided may not be intuitive.

5.4 MECHANICAL EVALUATION

State of the art in terms of alternative means to prevent the crushing risk comprises a number
of mechanical devices to block or halt the travel of the car or counterweight. In terms of
reliability and maintainability, some of these means are more desirable than others.

Pit/counterweight prop a manually installed prop has a mechanically simple

construction. The manual means of deployment at least ensures that the deployment
of the prop can be verified.

Manually erected fixed supports/stop bars installation of these may be more

straightforward than a basic prop. For example, there may be a need to align a prop
with a certain point on the lift car.

Automatically erected fixed supports/stop bars no manual installation is required,

but the mechanical integrity of the devices becomes important in terms of
deployment.

Pre-triggered system operating the safety gear or a similar system the safety gear is
an approved item under the Lifts Directive, but the safety gear relies on the jaws
gripping the guide rails.

Both manually and automatically erected supports may be fitted with buffers. The draft
standard prEN81-21 requires that the movable stops providing free space be fitted with
buffers according to EN 81-1, 10.3 and 10.4. In buffering the movable stops, the loading on
the stops is greatly reduced. Furthermore, buffers are an approved safety component under the
lifts directive. Through appropriate design, it is possible to produce a mechanism in which the
same buffer, or type of buffer, is used for the normal end of travel stop in addition to
providing a temporary refuge space.

A pre-triggered system operating the safety gear may be arranged in a number of ways. The
systems according to state of the art may be arranged to operate the safety gear either directly

57
or indirectly via the overspeed governor or its rope. In either case, the basis of the safety gear
is that it relies on the on the ability of the jaws to grip the guide rails in order to stop the car,
i.e. there is no mechanical stop. Additionally, it must be able to reliably stop the car under a
number of speed and loading situations. Depending on the type of safety gear, its
effectiveness may rely upon the condition of the guide rails in terms of integrity, corrosion or
contamination.

5.4.1 Verification of deployment of the systems

According to the accident data, there were a number of instances in which people attempted
to leave the pit or headroom in the path of the lift car, fearing the risk of crushing. It is worth
considering that a similar situation may arise in the case of a reduced pit or headroom lift.
Amongst the state of the art in terms of alternative means, it is evident that certain solutions
give an obvious indication that they have been deployed. By way of an example, the act of
manually inserting a pit prop may give a worker confidence that they will be safe should the
lift car inadvertently descend. On the other hand, in the case of a system relying solely on
limit switches to stop the car at a predetermined distance, there is no clear visual indication
that they will act to stop the car. Such an arrangement may therefore rely on other means such
as illuminating indicators in the machine room for example.

5.4.2 Maintenance

EN 13015:2001 [15] states that regular maintenance of the installation (lift) shall be carried
out to ensure the reliability of the installation. The standard lists a number of typical
maintenance checks that may be carried out:

Buffers:
o Check oil level.
o Check lubrication.
o Check switch where fitted.
o Check fixings.

Overspeed governor and tension pulley:

o Check moving parts for free movement and wear.
o Check operation.
o Check switch.

Safety gear(s)/Ascending car over speed protection means:

o Check moving parts for free movement and wear.
o Check lubrication.
o Check fixings.
o Check operation.
o Check switch

Electric safety devices:

o Check operation.
o Check electric safety chain.
o Check correct fuses are fitted.

Whilst the checks listed are only typical examples and are not binding, it can be noted that
they extend to devices that may form parts of alternative means to provide refuge space. From

58
a maintenance point of view, there would appear to be an advantage in using pre-existing
devices to provide refuge space. A maintenance worker who may visit several installations in
the course of a week would not be faced with having to familiarise themselves with and
maintain an array of differing systems.

Although applicable to all lift safety components, the following is also relevant to alternative
means for providing free space. During the lifetime of the lift, it is possible that components
of the alternative means have to be replaced during maintenance. Given the current climate of
maintenance contracts, it is unlikely that the original installer will be responsible for future
maintenance outside of any warranty period. It is important in this respect that any failed
components are replaced with ones of equal or higher integrity. In effect, in having an
alternative means to providing free space, a further layer of safety devices is introduced that
must be taken into account in maintenance.

5.5 MECHANICAL CONCLUSIONS AND RECOMMENDATIONS

There are a number of different mechanical devices that may be used to block or halt the
travel of the lift car. In general, their design varies according to the type and scale of the lift
installation. The mechanical devices can be split into two types: those that provide a positive
stop and those that operate the safety gear or a similar system. The essential difference
between the two is that the latter rely on the ability of the safety gear to grip the lifts guide
rails. This places a great emphasis on the condition of the safety gear and the surfaces of the
guide rails.

Some of the more basic devices i.e. props are installed manually and in some cases can
present an unnecessary risk to the person positioning them. Many of the devices are
relatively simple and therefore should not present reliability problems. Again many of the
devices should require relatively little maintenance and most are situated in accessible
locations. However, devices, which utilise safety gear may have components that are not
readily accessible and therefore not easy to inspect. This may not be the best approach. Most
devices have some degree of automation and therefore interact with the control system in a
number of ways. This has the potential to increase the safety integrity of the mechanical
device and system as a whole.

It is important that safety critical devices in any alternative means are identified with respect
to maintenance. Use of existing lift safety components in means for providing free space has
the benefit that they will subject to maintenance checks. It is also important to ensure that if
any components are replaced during maintenance, the replacement parts are of an equivalent
safety level.

In order that people entering the refuge space have confidence that they are protected the
system should have a clear indication that the system is in place. This would dissuade people
from attempting to leave the refuge space in the event of the lift car approaching.

59
5.6 EVALUATION OF ELECTRICAL CONTROL SYSTEMS

5.6.1 Introduction

This task provides an evaluation and commentary on the viability of using a control system to
limit the movement of a lift car in order to provide refuges in the lift well, and car headspace,
as an alternative to the provision of a fixed refuge.

It is outside the scope of this task to consider the reasons for using a temporary refuge, so the
techniques used in only its implementation will be considered and from only a control-system
viewpoint. Any considerations of the integrity of the control system for implementing a
safety-related function will be considered from first principles. Readers should note that the
author has approached the problem from the viewpoint of a safety-systems specialist and not
that of a lift engineer.

5.6.2 Potential techniques for providing a temporary refuge

Ideally, the first consideration in the design of any system that involves safety, should be to
eliminate the hazard from the outset. Therefore, ideally, an adequate refuge space should be
present at all times. Unfortunately, this is not always possible, so means of providing a
temporary refuge must be considered. A temporary refuge can be implemented in a number of
ways including the use of:
extension of the available refuge;
manually operated movable stops;
automatic operated movable stops, and
limitation of car movement by the control system using the normal motive
system.
Even though the first three techniques may rely on the operation of an interlock, they can be
regarded (to some extent) as passive systems, whilst any technique relying on the use of the
normal motive system must be regarded as an active system. The basic principles of each of
these techniques will now be discussed in general terms.

5.6.3 General discussion

5.6.3.1 A physical extension of the existing refuge

Although this technique is outside the scope of this task, one implementation (see Figure 20)
is remarkable for the simplicity by which the refuge in the pit is extended. In essence, the
technique attempts to eliminate the hazard from the outset rather than providing a means of
protection. This avoids the need to consider the integrity and potential fallibility of an
electronic protection system used to prevent movement of the lift car into the refuge area.
It is presumed that:
the floor is hinged toward the car door, so as to prevent inadvertent entry into
the car with the floor raised, and
the floor is not locked down so that protection is provided if an engineer fails
to raise the floor; however, in this case, consideration must be given to the
possibility of the possibility of the car containing a heavy load, or the floor
becoming jammed, so that the floor would be prevented from being pushed
up by a person in the well and leading to injury.

60
If the floor is not hinged toward the car door, an interlock may be required to ensure that, for
example:
the floor is locked down before the lift can enter normal operation;
when the floor is not locked down, the lift is in inspection mode (or
immovable) and the doors will not open automatically;
the car is near the bottom of the lift shaft, e.g., at the bottom landing, before
the floor can be raised.

5.6.3.2 Manually operated movable stops

Again, this technique is almost outside the scope of this task, and would be outside if there
were no interaction with the control system and the stops were used as part of a manual
system of work, e.g., isolation of the lift whilst someone enters the pit to operate the stop.
With the stop in place, the car must be prevented from colliding with the stop. Assuming that
the stop is adequate for preventing the car intruding into the refuge area, the interlock
required to achieve this may not be required to have a high integrity as its purpose is to
prevent damage. Nevertheless, the stopping distance of the car may need to be taken into
account in the design.
In the case of a traction lift, for example, the stop could prevent the downward movement of:
the car in order to provide a refuge in the pit, or
the counterweight in order to provide a refuge above the car.
In either of these cases, if the lift is driven into the stop under power, slippage will occur at
the main drive pulley. However, in the case of a (pure) hydraulic lift, although a stop could
provide a refuge in the pit, it may be difficult to ensure a refuge above the car, so the integrity
of the interlock required to prevent the car coming into contact with the stop may be
significantly increased.

5.6.3.3 Automatically operated movable stops

The use of automatically operated movable stops avoids the need of, for example, an engineer
to enter the well in order to set up the stops. This avoids reliance on a manual system of work,
but introduces a need to ensure that the stop is in its intended position.
For example, the stop could automatically move into place when the lift control system is
placed into inspection mode and move out of place when the lift is returned to normal
operation. However, the operation of the lift would need to be interlocked to position of the
stop. For example, consider a stop used to provide a car-top refuge. In this case, the interlock
could ensure that, if:
the stop is in place, the lift would be allowed to operate in inspection mode;
the stop is fully retracted, the lift would be allowed to operate in normal
mode, but
the stop is neither in place nor fully retracted, the lift would not operate under
power at all. (If the stop were to fail in this state with the car preventing
access to the stop, the car would have to be hand-wound to another position.)
The integrity requirements of each of these functions are not necessarily identical. For
example, if the lift were to operate in normal mode whilst the stop was in place, this may lead
to only damage to the lift and not be hazardous. In this case, a low integrity for this function
may be adequate. However, any movement of the lift in inspection mode, i.e., using the car-
top controls, without the stop in place must be considered to be extremely hazardous, so the
function preventing this must have a high integrity.

61
5.6.3.4 Limitation of car movement using an active system

The techniques described above operate passively with regard to their control systems;
however, some potential techniques may operate in a passive mode. For example, the normal
control system could be used to prevent the car intruding into the volume of the refuge. If no
stops/chocks of any form are implemented in the solution, reliance would be placed entirely
on the control system for bringing the car to a halt when a limit switch (or switches for
redundancy/diversity), for example, is reached.

The event leading to a demand on the stopping function may vary from inadvertent control of
the lift by the engineer to a control system fault. In the former case, for example, one would
expect that the traction motor could be used to bring the car to a halt under the control of the
normal control system; however, in the case of a control-system fault, the traction motor
could not be relied upon as a means of stopping the lift unless the system had an adequate
level of fault tolerance, which would be difficult to achieve.

Therefore, if an active system were to be used, it would have to operate independently of the
main control system. For example, it could cause the existing safety gear to be deployed.
Many other factors will need to be taken into account when implementing an active system.
These factors will include single faults, which could lead to a common-cause failure of both
the existing control system and the system providing the temporary refuge. An example of
such a fault would be a loss of electrical power, following which, the only available means of
stopping the car may be the spring-applied parking brake, which may lead to a long stopping
distance. Not only has the lift to be brought to a halt, this must be done before the car intrudes
into the refuge volume, so the worst-case stopping distance associated with every eventuality
must be taken into account in the design.

5.6.4 Integrity requirements of the control system

5.6.4.1 Introduction

We shall now consider how to determine the integrity requirements of a safety-related system.
EN 954 [18] provides a relatively simple means of determining integrity; however, whilst its
simplicity lends itself to its application to simple interlocks, it takes a somewhat arbitrary
approach in determining the target integrity and the association of this integrity with control
system architectures. Nevertheless, it is highly regarded (including by the author) in the field
of machinery interlocks and, especially where these are hardwired. A monogram in EN 954
(Figure B1) provides a simple and effective means of determining the integrity requirement of
an interlock, especially where this is based on hardwired relay-based technology. This
standard has proved itself in use over a number of years.

With complex, for example programmable, systems a more sophisticated approach becomes
appropriate as defined by EN 61508 [19-25]. It could be argued that a lift engineer would be
present for only a small fraction of the overall time. Therefore, the integrity of the control
system in relation to the provision of the refuge may not be high. Unfortunately, this may not
be the case because, for example, the mere presence of the lift engineer may indicate that he
has been called to the site following there being a control-system fault. In addition, in order to
carry out tests and/or maintenance, the lift engineer may make changes, which place a greater
reliance on his need for a refuge. Therefore, the designer of the system that implements the
safety-related function associated with maintaining the integrity of the refuge must take into
account:
the frequency and duration of access to the refuge;
the rate of demands on the safety-related function;

62
 the consequences of a failure of the safety function maintaining the integrity
of the refuge, and, ultimately,
the reduction in risk that the safety-related function must provide.
Even though the major safety function is likely to be that which maintains the integrity of the
refuge, it is likely that the presence of this system will lead to the need for additional safety-
related functions. For example, if the major function were automatically to place chocks in
the path of a runaway car in order to ensure the integrity of the refuge, consideration must be
given to an additional safety-related function, which will prevent the chocks being moved into
place whilst the lift is in normal operation. Clearly, these functions are related, but both are
independent and, probably, have different integrity requirements, depending on the outcome
of their failure. It will be clear that, to achieve the integrity requirements, the designer of a
safety-related control system should:
divide its operation into the individual control functions that it carries out;
consider each control function individually in order to determine its integrity
requirements,
consider all factors, but essentially the risk reduction that the function is
required to carry out the integrity requirements for each safety-related
function will depend on many factors,.
Once the integrity requirements (defined by the safety integrity level [SIL]) have been
determined, the designer is able to design the control system such that these requirements are
met. However, a good design will not necessarily ensure that safety is maintained throughout
the operational life of the safety-related system, so means must be considered for ensuring the
integrity of the control system throughout its entire life including, for example, operation and
maintenance. Therefore EN 61508 considers the entire lifecycle of a safety-related system so
that, compliance with the requirements of this standard will ensure that:
the integrity requirements (target safety integrity) of each safety function is
determined;
the design of the safety-related system is appropriate for the safety-related
function(s) that it carries out;
the safety integrity of the safety-related system is adequate throughout its life.
For example, compliance will ensure that the maintenance requirements are
not only defined from the outset, bur are fully documented, and effectively
carried out.
Therefore, the authors approach would be to apply:
EN 954 in the case of simple hardwired relay-based safety-related systems,
and
EN 61508 in the case of complex electronic or programmable-electronic
safety-related systems.

5.6.5 A worked example

The intention of this worked example is not to carry out a full assessment of a particular
technique for providing a refuge but, instead, to illustrate the basic approach that should be
taken. Readers will be able to apply this approach in relation to other techniques.

The example chosen has been deliberately made simple to facilitate the description and
analysis. It is not intended to indicate a means of providing a temporary refuge but, instead, to
illustrate a means by which the integrity of the safety-related systems may be determined.

63
Clearly, alternative means of providing a temporary refuge may be implemented, and the
author makes no claim that the hypothetical example is the best available approach. Consider
a hydraulic lift having three floors. When the car is at the ground floor there is inadequate
space below the car to provide a refuge, and when the car is at the third floor there is
inadequate space above the car to provide a refuge.

The approach that we shall take to provide a temporary refuge is to fit shot-bolts to the car
which engage into plates fastened to the wall of the lift shaft. These bolts are operated
hydraulically by means of a small electric power pack fitted to the car. The position of the
bolts will be monitored using cam-operated switches so that, with the shot-bolts extended, the
car can be moved only in Test mode and, with them withdrawn, the car can be moved only in
normal mode.

It will be assumed that there is a pressure-limiting valve to prevent the hydraulic system
driving the car upward through the shot bolts and that no damage will be caused by the car
coming to rest on the shotbolts under the influence of gravity. In both cases, the shotbolts are
capable of stopping the car from the limited speed available in inspection mode without
sustaining damage and are fully capable of stopping the car whilst travelling at the maximum
speed. In this hypothetical example, we shall hardwire the safety-related systems using a
relay-based system. Therefore, the example will be based on EN 954.

5.6.5.1 Summary of the hypothetical system

The hypothetical example is based on the use of a captive key system. A keyswitch (Socket
A) will be located in the machine room of the lift. This will be operated by a captive key,
which I shall refer to as Key A, which will be unique to any particular lift. Key A is normally
inserted into Socket A and set at the Shotbolts-withdrawn position. When in this position,
Key A cannot be withdrawn from Socket A. If Key A is rotated to the shotbolts-extended
position, the shotbolts will extend. When the shotbolts have extended, a solenoid is operated
within Socket A. Only when the solenoid is energized AND Socket A is set to the shotbolts-
extended position, will Socket A allow Key A to be withdrawn. The landing doors of the lift
cannot be opened using a standard v-shaped engineers key. Instead, the engineer must take
Key A to the landing that he wishes to enter the lift shaft from and use Key A to open the
door. This will ensure that Key A is removed from the machine room, preventing the
shotbolts from being withdrawn. Having opened a landing door:
if the engineer wishes to operate the car in inspection mode he can insert Key
A into another keyswitch fitted to the roof of the car (Socket B). With Key A
inserted into Socket B, and rotated, the lift is in Test mode. Whilst in the Test
mode position, Key A cannot be removed from Socket B, or;
if the engineer wishes to work in the lift well, he must enter through the
bottom-landing door. In the case of only this door, Key B will be retained
until the door has been closed.
Whilst this hypothetical example provides a potential solution to the problem, it could be
defeated. For example, if the engineer were working

in the pit, the bottom landing door could be closed with engineer in shaft and
accomplice could take Key A back to machine room and reactivate the lift. In
this case, the only protection for the engineer would be an emergency-stop
button, or;

on top of car, but with no need to operate the Test mode keyswitch using Key
A. Again, a third party could take Key A back to machine room and

64
 reactivate the lift, and again, the only protection for the engineer would be an
emergency-stop button.

Therefore, it is important that a system of work is implemented by the engineer to ensure that
Key A remains in his possession whilst he is in the lift shaft. (A photo-electric presence
detection system could be employed; however, this would introduce additional
considerations.)

5.6.5.2 The safety-related functions

Our first task is to determine the safety-related functions that must be implemented.

5.6.5.3 Safety-related Function 1

If the car does not move, the position of the shotbolts is largely irrelevant. What matters is
that the shotbolts are extended whenever the lift is in inspection mode. Therefore, Safety
Function 1 is to prevent the car being moved in Inspection mode unless the shotbolts are fully
extended. Safety Function 1 will not cause the lift to enter inspection mode, but will prevent
the lift entering inspection mode when the Test switch is operated. The failure of Safety-
related Function 1 would allow an engineer to operate the car using the car-top controls
without the shotbolts being extended and, as a consequence, there being no temporary refuge
to ensure his safety. The consequence of this would be an irreversible injury or, most
probably, a fatality.

5.6.5.4 Safety-related Function 2

If the car comes into contact with the shotbolts during normal operation, passengers in the car
may be subjected to a severe acceleration. Therefore, Safety Function 2 is to ensure that the
shotbolts are withdrawn before the lift can be put into normal operation. The failure of Safety-
related Function 2 would allow the lift to be returned to normal operation with the shotbolts
extend. The car could come into contact with the shotbolts whilst travelling at the normal
contract speed of the lift leading to any passengers in the car receiving relatively minor
(reversible) injuries.

5.6.5.5 Safety-related Function 3

If the engineer were to open a landing door and climb onto the roof of the car, he will be
protected from movement of the car by the Safety Circuit whilst the landing door remains
open. However, unless the shotbolts are extended, as soon as the doors close, the lift will be
capable of being started by a potential passenger pressing a landing call push, leading to the
engineer being at risk if the call is made from the top-floor landing. A similar situation is less
likely to occur in the case of the lift well as the engineer would be entering the shaft from the
same landing at which the potential passenger would need to press the push; nevertheless, the
situation must be considered because of the hazard level and the finite probability of a fault or
even misbehaviour. Therefore, in this hypothetical example, it will not be possible to open the
landing doors by means of a standard v-shaped engineers key. Instead, Key A, a special
captive key, must be inserted at a landing in order to open the door. Key A will be available
only when the shotbolts are extended. Safety-related Function 3 is to ensure that the shotbolts
are extended before the engineer can enter the lift shaft. In this hypothetical example, Safety-
related Function 3 will be handled by the captive-key interlock system.

5.6.5.6 Safety-related Function 4

The engineer should be able to cause the shotbolts to retract; however, he must not be able to
do this from within the lift shaft. Therefore, the key-operated switch (Socket A), operated by

65
Key A, is located in the machine room. The engineer must return Key A to Socket A before
the shotbolts can be withdraw. To ensure that the engineer takes Key A with him, this key
must be used to open the landing doors and to put the lift into inspection mode. Safety-related
Function 4 is to ensure that the shotbolts cannot be withdrawn unless Key A is returned to
Socket A, and is taken care of by the captive-key interlock system.

5.6.5.7 Other potential safety-related functions

In this hypothetical example, it has been assumed that the shotbolts are strong enough to
ensure the safety of the engineer even if a demand is made of them at the full contract speed
of the lift. If such a demand could potentially cause damage to the infrastructure of the lift, it
may be necessary to provide switches in the shaft that would cause the lift to slow before the
shotbolts made contact. The operation of these limit switches may not be considered to be
safety-related unless there was a possibility of the shotbolts failing to prevent the car entering
the temporary refuge, or Safety-related Function 2 will ensure freedom from injury.

5.6.6 The target integrity for each safety-related function

In this hypothetical example, each function is relatively simple and will be carried out using
switches and relays. Therefore, EN 954 will be used to determine the integrity requirements.
Readers should refer to this standard for details. The monogram at Figure B.1 of EN 954 will
now be used to determine the integrity requirements of each safety-related function. This
monogram allows the integrity (i.e., categories B, 1, 2, 3 or 4) to be determined in terms of
the parameters S (severity of injury), F (frequency of access or exposure time), and P
(possibility of avoiding injury).

5.6.6.1 Safety-related Function 1

If Safety-related Function 1 were to fail, the engineer would most likely receive fatal injuries.
Therefore:
the severity of injury must be considered to be S2 irreversible injury,
including death;
the frequency of access or exposure time is considered to be F2 as the
engineer could be within the lift shaft for a significant time during his
inspection or maintenance activities, and
the possibility of avoiding injury could be either P1 or P2 as the engineer may
be able to reach his emergency-stop button. However, as we are dealing with
a hydraulic lift, which could move downwards silently, the worst-case
assumption (P2) will be taken.
This leads to a Category 4 system being required for Safety-related Function 1.

5.6.6.2 Safety-related Function 2

If Safety-related Function 2 were to fail, the car could come into contact with the shotbolts
when operating in normal mode at full contract speed. Although the shotbolts will ensure that
the car does not enter the temporary refuge, the sudden stopping of the car could lead to
passenger injury. For this hypothetical example, it will be assumed that any passenger injury
is fully reversible. This leads to:
the severity of injury being S1 slight (normally reversible) injury;
the frequency of access or exposure time being F2 as if the shotbolts
remained extended, there would be at least a 50% probability of there being a
passenger in the car when the shotbolts were reached, and

66
 the possibility of avoiding injury being P2 as the passenger(s) would not be
aware of the impact with the shotbolts until it occurred.
This leads to a Category 1 system being required for Safety-related Function 2. Let us assume
that the contract speed of the lift is 1m/second in each direction. If the car were to be suddenly
stopped by the shotbolts whilst travelling upward, passengers within the car would be
launched a distance of about 5cm from the floor of the car. Similarly, if the stoppage occurred
whilst travelling downward, the passengers would receive a jolt as if they had hit the ground
after falling 5cm. Whilst this seems to be a very short distance, the passengers legs are
unlikely to be prepared (i.e., bent at the knee) for the impact, so there may be a possibility of,
for example, spinal (e.g., disc) injury. Therefore, depending on the actual contract speed of
the lift, it may be considered worthwhile to increase the integrity of Safety-related Function 2
beyond Category 1 if the cost of so doing would be relatively small.

5.6.6.3 Safety-related Function 3

If the engineer were to enter the lift shaft without first extending the shotbolts, this would
result in:
a severity of injury is S2 irreversible injury, including death;
a frequency of access or exposure time is F2 as the engineer could be within
the lift shaft for a significant time during his inspection or maintenance
activities, and
a possibility of avoiding injury is either P1 or P2 as the engineer may be able
to reach his emergency-stop button. However, as we are dealing with a
hydraulic lift, which could move downwards silently, the worst-case
assumption (P2) will be taken.
This leads to a Category 4 system being required for Safety-related Function 3.

5.6.6.4 Safety-related Function 4

This function is associated with the withdrawal of the shotbolts.

If the shotbolts were to:
extend when they should not, the lift would be taken out of normal operation
by Safety-related Function 2;
fail to extend, the engineer would not receive a visual indication that they had
extended; however,
withdraw whilst the engineer was still in the lift shaft, this would leave him
with no temporary refuge.
The availability of a single key that operates both the shotbolt-extension keyswitch and the
shotbolt-withdrawal keyswitch, together with a system of work that requires the engineer to
keep the key on his person, will make it difficult for the shotbolt-withdrawal keyswitch to be
operated inadvertently by a third party. Therefore:
the severity of injury is S2 irreversible injury, including death;
the frequency of access or exposure time is F2 as the engineer could be within
the lift shaft for a significant time during his inspection or maintenance
activities, and
the possibility of avoiding injury is either P1 or P2 as the engineer may be
able to reach his emergency-stop button. However, as we are dealing with a

67
 hydraulic lift, which could move downwards silently, the worst-case
assumption (P2) will be taken.
This leads to a Category 4 system being required for Safety-related Function 4.

5.6.7 Implementing the safety-related functions

We shall now consider means by which the safety-related functions can be implemented on
the hypothetical lift. The following paragraphs show only one possible implementation
there are likely to be others. As the descriptions apply to a hypothetical example, they may
not be appropriate to a specific lift control system; however, the underlying principles should
be. The descriptions in this document are, by necessity, brief; however, detailed information
can be obtained from other sources. For example, the monitoring of dual-channel relays to the
outputs of a Safety Relay will be described in detail in the literature supplied with the Safety
Relay.

5.6.7.1 Safety-related Function 1

Safety-function 1 requires an integrity of Category 4. This is the highest category defined by

Reference 9 which states that Safety-related parts shall be designed, so that:
a single fault in any of these parts does not lead to a loss of the safety
function, and
the single fault is detected at or before the next demand upon the safety
function. If this is not possible, then an accumulation of faults shall not lead
to a loss of the safety function.
The ability to tolerate a single fault requires a dual-channel design. In addition, the
requirement to detect a single fault before the next demand requires that the dual-channel
system is cross-monitored. A cross-monitored dual-channel system is readily facilitated using
a Safety Relay. It is not the purpose of this document to explain the operation of Safety
Relays; however, it sufficient to state that they contain at least 3 physical relays and are
available from a number of manufacturers in forms for different applications. The type
referred to in the following paragraph could be used for, for example, an interlocked gate.
The basic properties of a Safety Relay are:
it accepts a dual-channel input;
it normally provides three normally open dual-channel outputs;
if only one input becomes de-energized (e.g., a switch contact fails closed),
the outputs of the Safety Relay will not re-energize if the input channel that
remains operational becomes energized;
the dual-channel output relays are checked at each operation so, if one were
to fail to the energized state, the other will not re-energize when the inputs
next become energized;
although the safety-related outputs use normally open contacts, normally
closed contacts are usually available for monitoring purposes, and
inputs are provided to allow the state of external contactors to be monitored.
Therefore, if an insufficient number of output contacts are available in the
Safety Relay, or a high-power load must be driven, a contactor can be driven
by each of the outputs of the Safety Relay. Spare contacts of these contactors
can be monitored by the Safety Relay, which, if one of the contactors were to
fail to the energized state, will prevent the other contactor becoming
energized the next time that the inputs to the Safety Relay become energized.

68
We shall now consider how the safety relay will be connected. We must monitor the position
of the shotbolt using limit switches. Ideally, these should be positive-action2 switches;
however, if a positive action switch is not fastened adequately, or wear becomes apparent in it
cam mechanism, it could fail to danger. Therefore, both a positive-action, and a negative-
action, switch will be used as shown at Figure 33 in order to give a measure of diversity.

A: Shotbolt extended
Hydraulic
Shotbolt
mechanism
Cam

B: Shotbolt retracted
Hydraulic
Shotbolt
mechanism

Figure 33 The arrangement for the switches monitoring the shotbolt for safety
function 1

The actuators of the switches shown at Figure 33 are spring loaded in the upward direction,
but these springs have been omitted for clarity. It will be seen from Figure 33 that both switch
contacts are closed only when the shotbolt is fully extended and that they are open if the
shotbolt is only a short distance from being fully extended. Therefore, the contacts are closed
only if the shotbolts are ensuring the temporary refuge. We shall assume that two shotbolts
are fitted, one at each side of the car. Therefore, the four limit switches will be connected to
the inputs of the Safety Relay as shown at Figure 34. The procedure for operating the circuit
is as follows:
the engineer extends the shotbolts using his shotbolt key;
as soon as (either of) the shotbolts leave their fully withdrawn position the
normal operation of the lift is disabled (See Safety-related function 2.);
when both of the shotbolts reach the fully extended position, the shot-bolts-
extended Safety Relay energizes, one output contact of which causes an
indicator lamp to illuminate (Safety-related Function 3) informing the
engineer that he may now enter the lift-shaft;
the engineer enters the lift shaft and climbs onto the top of the car, and

2
When the cam operating the actuator of a positive action switch comes into contact with the actuator, the
contacts of the switch are forced apart. If the cam has moved into place, one can be sure that the switch contacts
have opened. A microswitch, or any other snap-action switch is NOT a positive-action switch.

69
 the engineer is now able to operate his inspection mode switch on top of the
car to gain control of the lift.
Figure 34 assumes that 3 contacts are sufficient to take the disabled lift back into operation,
but in Test mode. If 3 contacts are insufficient, a forced-contact3 relay should be driven by
each of two outputs of the safety relay. A normally closed contact of each of these two relays
should be connected in series with the link in order to carry out an automatic confirmation
that both relays de-energize correctly when power is removed from their coils.

Switches for shotbolt A

Switches for shotbolt B

Safety relay

Link such that the

Safety Relay energizes
as soon as both switch Normally open contact
inputs are present used to operate the
Normally open contacts solenoid for Socket B
used to enable the (Safety Function 3)
Test-mode switch
Figure 34 The shot-bolt-extended monitoring circuit

It should be noted that each of the normally open outputs of the Safety Relay is controlled by
contacts from both of the control channels. Therefore, the safety function has two (cross-
monitored) channels up to this point. It is presumed that the design of the lift control system
will allow the selection of Test mode with a comparable level of integrity and ensure that Test
mode cannot be selected unless the Safety Relay is energized.

5.6.7.2 Safety-related Function 2

Safety-related Function 2 is required to have a Category 1 interlock. This need be of only a

single-channel design; however, the components must comply with relevant standards and
Well-tried components and well-tried safety principles shall be used. As stated previously,

3
A contact of a relay may weld at sometime. This will not only cause that contact to remain permanently closed,
but it could affect the mechanism that causes the other relay contacts to move. The design of a forced-contact relay
is such that, if, for example, one of its normally open contacts becomes welded, when the coil is de-energized, none
of the normally closed contacts will close. As a result, the normally closed contacts can be used, in conjunction
with a safety relay, to monitor the correct operation of a forced-contact relay.

70
depending on the contract speed of the lift, it may be decided that only a Category 1 interlock
is required for Safety-related Function 2. However, for the cost of only an additional limit
switch and a safety Relay, it may be considered prudent to implement a Category 4 interlock.
Therefore, both alternatives will be considered. Figure 35 shows a limit that could be used for
the single-channel design. It will be seen that a positive-action switch is used. Therefore,
unless the shotbolt is fully retracted, the contacts will be forced open by the cam.

The unfortunate side-issue of using a positive action switch is that, if, for example, the switch
were to become detached from its mounting, the cam would never be able to operate the
actuator, so the switch contacts would remain permanently closed. Therefore, the switch
could fail to danger. This should be considered in relation to a negative action switch whose
actuator could stick so that the return spring is unable to open the contacts. Ensuring that
either fault does not occur involves maintenance issues, which should be defined at the design
stage in readiness for their implementation in the operation and maintenance phase of the
lifts lifecycle.

A: Shotbolt extended
Hydraulic
Shotbolt
mechanism
Cam

B: Shotbolt retracted
Hydraulic
Shotbolt
mechanism

Figure 35 Safety-related Function 2: Single channel switch arrangement

The control system of the lift will be connected such that it will not operate in normal mode
unless the contacts of limit switch shown at Figure 35 are closed. If it is decided that a
Category 4 interlock is required, this could take the form of that at Figure 36. Clearly, two
cams have been shown in order to facilitate this illustration and a single cam would be used in
practice. The cam switches will be connected as shown at Figure 37 and the output contacts of
the Safety Relay will be connected to the lift control circuit such that the lift will operate in
normal mode only when the shot-bolts withdrawn Safety Relay is energized. In the case of
Safety-related Function 2, a link has been fitted such that the Safety Relay will energize, as
soon as the shotbolts have both fully withdrawn, causing the lift to return to normal mode (as
it would if the single-channel option had been implemented).

71
A: Shotbolt extended
Cam 2
Hydraulic
Shotbolt
mechanism
Cam 1

B: Shotbolt retracted

Hydraulic
Shotbolt
mechanism

Figure 36 Safety-related Function 2: dual-channel switch arrangement

72
 Switches for shotbolt A

Switches for shotbolt B

Safety relay

Link such that the

Safety Relay energizes
as soon as both switch Normally open
inputs are present contacts used to
enable normal mode
Figure 37 The shot-bolt-withdrawn monitoring circuit

5.6.7.3 Safety-related Function 3

Safety-related Function 3 is largely taken care of by the captive key interlock system;
however, the control system operates the solenoid that must be energized in order to release
Key B.
Fortunately, the Safety Relay used to implement Safety-related Function 1 by means of a
Category 4 interlock can be used to operate the solenoid as shown at Figure 34.

5.6.7.4 Safety-related Function 4

The withdrawal of the shotbolts can be carried out only when Key A has been returned to
Socket A in the machine room, allowing Key A to be rotated to the normal position in which
it becomes captive. It is important that the engineer does not allow Key A to be returned to
the machine room by a third party. This function is carried out by the captive-key interlock
system.

5.6.8 Additional considerations

The above description covers only the basic design principles of EN 954. Other requirements
of the standard, for example, the use of suitable components, will need to be followed in order
to ensure compliance.

5.7 CONTROL SYSTEM CONCLUSIONS AND RECOMMENDATIONS

In any approach to risk reduction, the first step is to eliminate the hazard wherever possible.
Only if this cannot be achieved should protection methods be considered. Therefore, the ideal

73
approach would be to provide an adequate fixed refuge within the lift shaft and, only if this is
not possible, should a temporary refuge be considered.

Existing standards i.e. EN954 and EN61508, could be applied to the design and operation of
the control and/or interlocking systems associated with temporary refuges in order to provide
an adequate level of integrity.

It is unlikely that any means of providing an adequate temporary refuge will operate
independently of a suitable system of work. However, the aim of the designer should be to
design the system such that the contribution of the safe system of work, on the overall
integrity of the refuge, is minimized.

5.8 ECONOMICS OF PROVIDING REFUGE SPACE BY ALTERNATIVE

TECHNICAL SOLUTIONS

Discussions with lift manufacturers have indicated that at present there is little or no cost
difference between supplying and installing a standard lift with refuge space or one which is
subject to the derogation. It was suggested that the additional components required to provide
an alternative solution to prevent crushing do not add significantly to the overall cost of the
lift system hard-ware, and when considered as part of the overall cost of the lift installation
are insignificant in most applications. Clearly the scale of the lift installation will affect the
additional proportion of the overall costs with smaller lifts bearing a greater additional cost.
However, in certain member states where the application of the derogation is limited there is
less experience of this type of lift application and therefore costs may appear disproportionate
due to the rather bespoke nature of the applications and the availability of solutions. If the
application of the alternative technical solutions were to become more commonplace across
all member states then any apparent cost difference would be likely to disappear.

Generally it was considered that the greatest cost influence when selecting a lift was that of
building cost. Where new building was concerned this was not considered to be significantly
different in most cases. However, in existing buildings where there are technical difficulties
in providing the refuge space for a new lift, this can clearly have a significant impact on the
cost of lift installation.

There are some cost benefits to be gained in the design of new buildings from the application
of machine room less lifts. The top floor of a building can be fully accessed and therefore
generate more income. It may also be considered to be financially beneficial in having a
more architecturally pleasing design, which does not require a traditional rooftop machine-
room. There would appear to be no economic gain in dispensing with the refuge space in the
base of the lift.

74
 6 TASK 3 - RISK BASED COMPARISON

6.1 OBJECTIVE

The objective of this element of the project is to develop a methodology to undertake a

comparative assessment of the crushing risk presented by lifts subject to Directive 95/16/EC.

This project specifically concentrates on the risk of crushing to persons in the headroom and
pit of lift shafts.

The scope of the project excludes any risk caused by catastrophic failure of the lift.

6.2 APPROACH

Undertaking a risk-based comparison of crushing hazard prevention devices requires a

determination of:

Who may be harmed;

How frequently they are exposed to the hazard and for how long;
By what mechanism they may be harmed and the effectiveness of the devices in
protecting against this mechanism;
What the consequences of exposure to the hazard would be.

Risk is generally calculated on the frequency of occurrence and the consequence. Whilst the
mechanism by which the consequence is realised is defined by the remit of the project
(crushing), the severity of the consequence, the causes of crushing risk and frequency of
exposure are not, and are often specific to the type and location of the lift, the safety
equipment and the type of access occurring. The type of access occurring is determined by
who is entering the lift well area and for what reason. Because of limitations in the amount of
data available and the diversity of lift types and configurations the risk assessment has been
conducted at a high level using a semi-quantitative approach which will be reviewed using a
workshop based approach in order to validate the subjective findings included here.

6.2.1 Who may be harmed:

The scope of the risk assessment covers the following types of entry:

To undertake inspection or maintenance activities;

In these circumstances it is assumed that a competent person makes entrance
into the well area under controlled conditions. This category, however, also
needs to take into account the likelihood of violations and/or errors by the
competent person. Duration of exposure is likely to be determined by the
nature of the equipment being maintained/inspected/repaired in the well
headspace and pit.
To commit an act of vandalism;
In these circumstances it is assumed that the person is not competent
and not fully aware of the hazards that they are exposed to and may
cause damage that would result in lift failures or be present in the lift
with the lift in full operational use.
To obtain a location to rest/sleep/use drugs;
In these circumstances it is assumed that an individual gains access to
the pit area with a view to spending a period of time. It is highly likely

75
 that the individual will be unaware of the hazards presented if there is
no pit and will have in sufficient experience to be able to identify
whether there is sufficient space available. The likelihood of this
scenario is dependent on the level of security available. The research
will need to identify if residential/public car park installations are more
susceptible than office installations where access may be limited.
To commit an act of errant behaviour such as surfing on the lift roof.
This again is dependant on the degree of access afforded and could be more
prevalent in certain areas.
To escape from a lift or as a result of a spurious door opening.
This type of activity is considered to be very rare.

6.2.2 How often they might be exposed to the hazard and for how long:

The frequency and duration of exposure to the hazard is determined by the activities of the
person affected.

The first of these categories, frequency of access was assessed using expert judgement for
each type of activity, using a five-scale matrix as detailed in Table 9. Each rating is roughly
an order of magnitude different.

Table 9 Frequency of access

Frequency of exposure (per lift)
Descriptor Rating Scale

Often Hourly 1
Frequent Daily 2
Regular Monthly 3

Infrequent Annually 4

Rare Once a decade 5

Authorised access will be dependent on the reliability of the well-borne equipment and the
inspection/preventative maintenance regimes in place. Currently, there are two main types of
passenger lift in use:

Electric lifts, whose design standards are recorded in EN 81-1:1998. Electric lifts are
subdivided in to traction drive lifts (where lifting ropes are driven by friction in the
grooves of the driving sheave of the machine) or positive drive )where the lift is
suspended on ropes or chains driven by means other than friction. An increasing
number of lifts installations utilise a lift borne drive system, negating the need for a
separate machine room, but potentially increasing the frequency and duration of work
within the lift well.

Hydraulic Lifts, where the lifting power is derived from an electronically driven
pump transmitting hydraulic fluid to a jack acting directly or indirectly to the
passenger car. The design standards for construction are recorded in EN 81-2:1998.

76
Review of these standards indicated that the many items of equipment could be
maintained/inspected/repaired with the maintenance technician required to spend time within
the well area. It is not considered necessary or desirable to assess each component
individually, however, an understanding of the frequency and duration of combinations of
components will allow a better comparison between the safety devices used. It is considered
useful to use the following groupings of components during any analysis:

Counterweight/balancing system
Lighting
Ventilation
Suspension
Pulley and suspension system
Hydraulic system / Motors & Gears
Control System
o Failure detection system
o Software System

The duration of exposure is dependent on the time taken to repair the equipment. However, it
is not practicable for this assessment to drive down to such a low level of detail. Therefore,
the failure rate and mean time to undertake repairs to the subsystems have been assessed
using a five-point scale as detailed in Tables 9 and 10, each point representing an order of
magnitude difference between them. Clearly this factor is only relevant for maintenance and
inspection so further criteria were used to establish the duration of exposure for other
categories of activity, these correlated well with the table used for maintenance etc and hence
all activities were assessed using this approach.

Table 10 Duration of exposure

Duration of Exposure
Descriptor Rating Scale

Short Minutes 5
4
Medium Hours 3
2
Extended Days 1

The methodology provided by this element of the study provides a way to establish the
implications of lift configurations in relation to the means of preventing crushing. For
example; if access is required into the lift area for routine inspection of the underside of the
lift on an annual basis and the control adopted is a fixed physical restraint such as a manual
erected buffer, it is unlikely that the risk of crushing will justify the installation of any other,
more expensive controls such as a pit. However, if access was required on a weekly basis and
maintenance work required a maintainer to be in the base of the lift well for extended periods
of time then the level of protection would need to be commensurately higher in order to offer
a suitable level of safety. This is outside of the scope for this study but would be relatively
simple to apply in any future work undertaken by a manufacturer or any other organisation
with sufficient information.

77
6.2.3 The mechanism by which harm is realised

This is the main focus of the study and examines the failure modes of any proposed
equipment, their reliability and maintainability and consequently their effectiveness in
assuring the prevention of crushing risk.

The failure modes leading to crushing injuries in this study are considered to fall into the
following groups:

Override of Safety Equipment/Interlocks;

Operator Error;
Inherent design faults; (i.e. needing to be in a position of danger to activate/remove a
control)
Electrical Failure; (wiring, overload etc)
Programme Electronic Equipment failure/error; and
Mechanical Failure of the device or associated fixings.

The reliability of the safety controls is therefore determined by a range of factors including:

Usability of the controls (e.g. is it possible to have a false impression of the correct
installation of a physical restraint, does it require a disproportionate amount of effort
that would deter use/promote violations of protocol, does it prevent access to
equipment needing repair),
Reliability/effectiveness of the equipment, and
Reliability of the users (in terms of human error).

For each safety device an evaluation will be made of the effectiveness of the controls using a
matrix based approach using a five-point scale. The assumptions relating to why a particular
rating is given are detailed. But the following generic assumptions have also been made:

Door interlocking is a simple on/off logic. A higher safety rating would be awarded
if control system is considered to remain in maintenance mode until an engineers
key or code resets the system.
All designs use an appropriate standard such as EN61508 to establish the level of
integrity required.
In certain circumstances, if the equipment is intuitive to set up, there may be
circumstances where unauthorised occupants operate a device in order to provide
protection.

Where a device is only effective in provision of refuge space in the lift base, the effectiveness
of the device was reduced to reflect this.

6.2.4 Consequences

For the purposes of the project we have currently assumed that the most likely consequence of
any crushing injury is a fatality. If evidence suggests that other consequences are more likely,
we will revise the risk assessment accordingly.

78
6.3 FINDINGS

Table 11 summarises the results obtained from the spreadsheets in Appendix 6 and provides
an initial ranking of the different systems and combinations of systems identified. The table
is sorted on a total score which is the sum of the weighted averages taking into account the
frequency and duration of exposure for each of the categories.

Table 11 Reliability summary

Reliability Human
Device Usability Total
Rating Reliability

Automatically installed fixed support vertically

acting on car and on counter weight - interlocked
53.25 63.9 21.1 138.25
with lift control system via limit switches and
access points
Automatically installed stop bars, engineer
operated, coupled with limit switches - interlocked 42.6 53.25 37.6 133.45
with access points into areas of danger
Automatically installed stop bars in car - initiated
by engineers key or via control panel, interlocked 42.6 53.25 27.5 123.35
with lift shaft access points
Use of Pretriggered System interlocked with
35.5 53.25 26.3 115.05
access points
Limit Switches - interlocked with access points
21.3 53.25 29.1 103.65
into areas of danger
Manually installed fixed support vertically acting
on car or on counter weight - interlocked with lift 31.95 29.2 18.7 79.85
control system
Manually installed fixed support horizontally acting
on car and on counter weight - interlocked with lift 15.5 25.95 25.2 66.65
control system
Refuge Space 35.5 24.35 0 59.85
Manually installed fixed support vertically acting
27 18.55 6.6 52.15
on car or on counter weight - not interlocked
Manually installed moveable prop in lift base - not
12 33.5 3.7 49.2
interlocked
Manually installed fixed support horizontally acting
15 15.6 7.4 38
on car and on counter weight - not interlocked
Limit Switches - not interlocked and initiated from
21.3 9 3.8 34.1
position on lift roof or in lift shaft base
Automatically installed stop bars in car - initiated
3.6 24.35 6 18.6
by engineers key or via control panel

6.3.1 Reliability/Effectiveness

An evaluation of the capability of the systems to provide a suitable space once initiated
reveals that the most effective device is a vertically located support installed in the base or
roof of the lift shaft. This is because the force applied by any unexpected lift movement

79
would be physically resisted through compression of the device, and the energy will act
linearly through the base into the lift shaft. This is opposed to the stop bar and horizontally
acting supports which create a turning moment thus increasing the potential for failure of the
device at the anchor. Conversely limit switches offer no physical protection to the user but do
provide a means to avoid collision with fixed barriers and hence should form part of a control
system. The ratings table reflects this, and also the increased redundancy in the system
afforded by two safety systems exemplified in, for example, limit switches coupled with
automatically installed, interlocked stop bars.

The design of each system has been reviewed to identify design features that increase or
decrease the safety afforded to affected persons depending on the nature by which access is
gained. Issues identified include the need to be in a position of danger in order to activate a
device acted to decrease the rating given where as automatically installed systems that initiate
once access points have been opened (and are not reset without the use of an engineers key or
maintenance code).

It can be clearly seen that comparison of other methods of protection with refuge space
provision indicates that a number of systems offer comparable and superior levels of safety.
This is primarily because of issues surrounding the usability of a refuge that is not clearly
indicated.

6.3.2 Usability

Any system that uses a fully automated process to apply an artificial/temporary refuge space
with the user in a position of safety outside of the lift is likely to afford the greatest degree of
usability as very little user effort or competence is required. More complex requirements
such as locating a prop in the correct position were scored lower as they required a level of
understanding and were unlikely to be useful to any person other than a trained lift
maintainer.

6.3.3 Human Reliability

This area focussed on the potential for a user/misuse of the lift system to override the system
and the level of incentive to do so. A may be predicted, the table shows that systems with
more than one form of control are more difficult to defeat and may reduce the likelihood of a
violation unless a high level of technical competence is available (such as with a lift
technician) and a strong motivation to override (which is less likely to be seen with a lift
technician).

6.4 CONCLUSION

Based on the systems and types of configurations identified in part 2 the report it is concluded
that a large number of the proposed solutions offer a comparable, if not improved, level of
safety when compared to the reliance on a refuge space. For unauthorised use, those systems
that are interlocked with access points provide the greatest level of protection, especially if
the system requires an authorised person to restore the lift to normal operation. Clearly
optimal protection is provided by mechanical restraint, the optimal arrangement being the use
of a vertical support that acts on the lift and counter weights (for traction and indirectly acting
pneumatic lift) or car mounted lift bars (the highest rated protection for directly acting lifts).

80
 7 CONCLUSIONS

1. There was insufficient quantity and detail in the accident data to be able to determine
the effectiveness of either existing refuge space provision or alternative technical solutions.
However, the data has shown that where safe working practice is essential to the safety
integrity of a system, the safe practice is not always followed.

2. Current European harmonised standards have arrived at a specification for free space
that has evolved from existing European standards. These requirements can be briefly
summarised as:

The accommodation of a rectangular block as refuge space in both the pit and the
headroom
A 1 metre clearance in the headroom

The current American standard follows a similar route with the requirement of a 1.1 metre
space in the headroom and a rectangular block in the pit. It was indicated that Japan has not
taken a lead in the development of standards and as a result, appears to be less prescriptive in
the provision of pit and headroom. Recent movements in international standardisation
indicate that a less prescriptive route may be taken in future. In effect, the lift must be
designed to prevent the risk of crushing. It is evident that there are differing interpretations
over what should constitute a free space or refuge across Europe.

3. The state of the art in terms of alternative means for providing free space consists of a
number of mechanical devices used to block the travel of the car into the refuge space when
the risk of crushing is present. These devices may be:

Automatic or manually operated mechanical stops such as props, buffers and stop
bars.

Devices which act to operate the car safety gear (or a similar system) at a set point in
the lift travel.

The mechanical devices used to ensure free space are only part of a system for providing free
space. Complete systems for providing space are achieved by interconnecting the mechanical
devices to the lifts control system with appropriate interlocks. These systems may function as
soon as the risk of crushing is present.

4. The ergonomic study has shown that, based on the information available, using 1.0m,
0.6m or 0.5m as the pit refuge dimensions does not allow people to fit into the space or adopt
a safe posture in the area that is given to them. Using 0.8m, 0.6m or 0.5m as the headroom
refuge dimensions does not allow people to fit into the space or adopt a safe posture in the
area that is given to them. However, where there is a free space of 1.0m clearance in the
headroom it is possible that someone could be accommodated in the space provided.
However, it is unlikely that the user would know what posture to adopt without instruction.
This assessment is based on one person in the refuge space. To try and accommodate 2
persons within these spaces is unacceptable and unsafe. This assessment does not take into
account any equipment or ropes and assumes that the refuge is an empty space. Where there
may be equipment in the refuge space, these dimensions are even less appropriate and safe.

81
5. In any approach to risk reduction, the first step is to eliminate the hazard wherever
possible. Only if this cannot be achieved should protection methods be considered. Therefore,
the ideal approach would be to provide an adequate fixed refuge within the lift shaft and, only
if this is not possible, should an alternative means of providing refuge be considered.

6. It is unlikely that any means of providing an adequate temporary refuge will operate
independently of a suitable system of work. However, the aim of the designer should be to
design the system such that the contribution of the safe system of work, on the overall
integrity of the refuge, is minimized.

7. Evaluation of the alternative technical solutions and subsequent risk assessment has
shown that it is possible to achieve comparable levels of safety using the alternative solutions
as provided by the existing space requirements.

8. The alternative technical solutions have the ability to provide a larger more viable
refuge space than is currently provided.

9. The alternative technical solutions can provide safety for both workers and the
general public.

10. Currently all alternative solutions would appear to have some reliance on a safe
system of working. This can potentially lead to accidents as a result of human error.

11. At present there is little or no cost difference between supplying and installing a
standard lift with refuge space or one that is subject to the derogation.

82
 8 RECOMMENDATIONS

Where refuge space is provided consideration needs to be given to the number of persons at
risk; when this has been decided an appropriate space should be provided. This space
provision should then be indicated by signage or marking so that people can occupy the
correct location. This space should not require a person to adopt a posture or position which
would be difficult to achieve in a relatively short time.

Using a block of at least 1.25m high (to allow sufficient sitting height and enough head room
to kneel), 0.7m wide (increased to allow a more comfortable fit around the shoulders) and
0.8m long, a user might be able to sit in the refuge and clutch their knees, or kneel on their
knees and lower their head. However, there are no dynamic anthropometric measurements to
prove this. 3D modelling would be required to validate this remark.

The minimum recommended height of the refuge if one were designed to accommodate a
standing posture is 2.0m. This would protect 95% of the population. The width of this refuge
would need to be at least 0.63m (based on whole body breadth of 95th percentile British
male).

The size of the refuge is irrelevant if the people, who need to occupy it, do not know where it
is. Factors that could improve the safety of the users and assist them in emergencies of this
nature would be to highlight where the refuge is e.g. a coloured zone. To further assist the
users signage and pictures/diagrams of recommended postures could be installed around the
area, as safe postures which need to be adopted in the space provided, may not be intuitive.

In order that people entering the refuge space could have confidence that they are protected,
the safety system should have a clear indication that it is in operation. This would dissuade
people from attempting to leave the refuge space in the event of the lift car approaching.

Existing standards i.e. EN954 and EN61508, could be applied to the design and operation of
the control and/or interlocking systems associated with temporary refuges in order to provide
an adequate level of integrity.

The safety integrity of a system would be increased if it can be provided with little or no
reliance on a safe system of work. Automatic deployment of the safety system would also
significantly reduce the risk to both workers and other people. Automatic deployment would
also reduce the necessity for workers to have knowledge of how to deploy a range of
potentially diverse systems.

If the above conclusions are accepted and the recommendations are to be adopted, this will
necessitate amendment of the directive and the associated standards.

83
 APPENDIX 1 CONTACT LETTERS

LETTER 1 - H&S ORGANISATIONS

Dear Sir or Madam

I am an engineer with the Health and Safety Laboratory, an agency of the United Kingdom
Heath and Safety Executive. We are working on a project on the EU lifts directive (contract
number 2006 / SI2.449867 with DG Enterprise and Industry). Specifically, the project relates
to the requirements of Annex I, section 2.2 preventing the risk of crushing. The project
involves collecting information on lift incidents in which people have been crushed above or
below a lift, for example during maintenance work. We are also looking at the systems
proposed by manufacturers for prevention of crushing at the ends of the lift travel, as required
by the directive. I would be grateful for any information or statistics that your organisation
could supply on such accidents.

Yours faithfully

LETTER 2 - MANUFACTURERS/LIFT GROUPS

Dear Sir or Madam

I am an engineer with the Health and Safety Laboratory, an agency of the United Kingdom
Heath and Safety Executive. We are working on a project on the EU lifts directive (contract
number 2006 / SI2.449867 with DG Enterprise and Industry). Specifically, the project relates
to the requirements of Annex I, section 2.2 preventing the risk of crushing. The project
involves collecting information on lift incidents in which people have been crushed above or
below a lift, for example during maintenance work. We are also looking at the systems
proposed by manufacturers for prevention of crushing at the ends of the lift travel, as required
by the directive.

I would be grateful for any information or statistics that your organisation could supply on
crushing incidents. I would further be interested in any relevant technical solutions proposed
by your organisation to the requirements of Annex I, section 2.2 of the directive. It would be
helpful if you could provide a relevant contact within your organisation in relation to the
above.

Yours faithfully

84
LETTER 3 - TRADE UNIONS

Dear Sir or Madam

I am an engineer with the Health and Safety Laboratory, an agency of the United Kingdom
Heath and Safety Executive. We are working on a project on the EU lifts directive (contract
number 2006 / SI2.449867 with DG Enterprise and Industry). Specifically, the project relates
to the requirements of Annex I, section 2.2 preventing the risk of crushing. The project
involves collecting information on lift incidents in which people have been crushed above or
below a lift, for example during maintenance work. We are also looking at the systems
proposed by manufacturers for prevention of crushing at the ends of the lift travel, as required
by the directive.

I would be interested to know if your organisation has any involvement with lift maintenance
personnel and would be able to provide any information concerning crushing incidents and
their prevention.

Yours faithfully

85
 APPENDIX 2 CONTACT DETAILS

PAN EUROPEAN HEALTH AND SAFETY ORGANISATIONS

The European Agency for Safety and Health at Work works with governments, employers
and workers representatives. They commission, collect and publish new scientific research
and statistics on OSH risks. The organisation exists as a hub for the health and safety bodies
in the member states.

EUROSHNET, the EURopean Occupational Safety and Health NETwork, exists as a means
of communication for European occupational safety and health experts.

NATIONAL HEALTH AND SAFETY ORGANISATIONS

Each country has a body charged with the protection of the workplace health and safety of its
people. In general, these bodies function to:

Identify areas in which workplace health can be improved.

Instigate research into workplace health issues.

Raise awareness of workplace health issues with industry and the general public.

For consistency, the relevant national health and safety at work organisations were
approached through contact from the HSE Information Services:

France - Institut National de Recherche et de Scurit (INRS) operates under the general
Social Security scheme and provides research, technical advice and information in the field of
health and safety at work.

Germany - Bundesanstalt fr Arbeitsschutz und Arbeitsmedizin (BAuA) is within the Federal

Ministry of Labour and Social Affairs. It provides research, analysis, training and advice to
companies, government and the general public.

Italy - Instituto Superiore per la Prevenzione e la Sicurezza del Lavoro (Ispesl) reports to the
Ministry of Health as a technical and scientific body. The institute is involved with technical
research, analysis and advisory functions across a wide range of industries.

Poland Central Institute for Labour Protection is a legally, economically and financially
independent state body carrying out research into occupational safety and health.

Spain - Instituto Nacional de Seguridad e Higiene en el Trabajo. The institutes mission is the
analysis and study of Occupational Health and Safety Conditions. This is acheived through
means such as technical assistance, research and testing/certification of protective equipment
and machinery.

Finland - Finnish Institute of Occupational Health (FIOH) produces, compiles and

disseminates research based information on the interaction between work and health.

Belgium PREVENT is the national outreach centre for European Foundation for the
improvement of living and working conditions.

86
Ireland Health and Safety Authority reports to the Minister for Enterprise, Trade and
Employment. It is a state sponsored body responsible for securing health and safety at work
and enforcement of the health and safety legislation.

Northern Ireland - Dept of Enterprise, Trade and Investment. DETI is responsible for,
amongst other things, economic policy development, health and safety at work and labour
market and economic statistics services.

United Kingdom Heath and Safety Executive (HSE) is the enforcing authority for the
workplace health and safety legislation. Workplace accidents are required by law to be
reported to HSE and are collected on a central database. Due to a close link with HSE, the
database maintainer was contacted separately.

CONTACT POINTS IN CHARGE OF IMPLEMENTATION OF LIFTS DIRECTIVE

Central contact points in charge of implementation of lifts directive were obtained from the
Eurpoean Commission website and are listed as follows:

France - Ministre des Transports, de l'quipement, du Tourisme et de la Mer. The ministry

deals with Transport, Infrastructure, Tourism and Maritime Affairs.

Cyprus Ministry of Labour and Social InsuranceDepartment of Labour Inspection

Germany - Bundesministerium fr Arbeit und Soziales is within the Federal Ministry of

Labour and Social Affairs. The ministry is responsible for responsible for labour market
policy, employment promotion, labour law and occupational safety and health.

Italy - Ministero delle Attivit Produttive

Poland Office for Competition and Consumer Protection is responsible for protection of
consumer interest and the control of abuse of dominant market position.

Spain - Ministerio de Industria, Turismo y Comercio. The ministry deals with Industry,
Tourism and Trade.

Finland - Ministry of Trade and Industry is responsible for technology and innovation policy
in addition to operations of enterprise.

Belgium - Service Public Fdral Economie, P.M.E., Classes moyennes & Energie operates to
ensure a competitive and balanced market for goods in Belgium.

Ireland - Department of Enterprise, Trade & Employment is a key economic department that
works to promote national competitiveness.

United Kingdom Department of Trade and Industry is the government department

responsible for trade, business, employees, consumers, science and energy.

LIFT INDUSTRY ORGANISATIONS

87
The lift industry in Europe has a number of industry associations which work in various
capacities including liaising with government, standards committees, and representing
industry.

The European Lift Association (ELA) represents the lifts, escalators, and moving walks
associations active in the European Union (EU) or the European Free Trade Area (EFTA).

The European Lifts Components Association (ELCA) represents the lifts components
manufacturers in Europe. The role of the association is to safeguard the interests of lifts
components manufacturers and small lifts companies.

The Lift and Escalator Industry Association (LEIA) is the trade association and advisory body
for the lift and escalator industry in Britain.

LIFT MANUFACTURERS

At the outset of the project, the four large International lift manufacturers were identified as
Oits, Kone, Schindler and ThyssenKrupp. Additional manufacturers and suppliers were
identified during the course of the project.

NOTIFIED BODIES

Notified bodies act to assess conformity with the Lifts Directive 95/16/EC. Bodies may be
notified in respect of parts of the Lift Directive.

88
COMPLETE LIST OF CONTACTS FOR TASKS 1 AND 2

Country Organisation Contact name Reason for contact Method of access Outcome (where relevant)
Belgium PREVENT Accident data Email No statistics for accidents with lifts or
lift maintenance staff
Le Fonds des Accidents Accident data No statistics for accidents with lifts or
du Travail Email lift maintenance staff
Schindler Philippe Casteleyn Accident data/technical Meeting at ELA
solutions/standards
Kone Pierre Bianchini Accident data/technical Meeting at ELA
solutions/standards
Kone Esfandiar Gharibaan Accident data/technical Telephone interview
solutions/
Cyprus Department of Labour Stephanos Achillides Accident data Email No accidents due to crushing at extremes
Inspection of travel

France Institut National de Catherine Blotiere

Recherche et de Securite Accident data Email No reply
Ministre des Transports, Patrick Levasseur
de l'quipement, du Accident data Email Provided contact at Ministry for
Tourisme et de la Mer employment, Social Cohesion and
Housing
Ministry for employment, Marie-Noelle Rouxel
Social Cohesion and Accident data Email Accident details provided
Housing
Otis Philippe Lamalle Technical solutions Email

Finland Finnish Institute of Irja Laaman

Occupational Health Accident data Email No reply
Ministry of Trade and Kalevi Vaittinen
Industry Accident data Email Contact at TUKES provided
Safety Technology Heikki Viitala Accident data Email Accident details provided
Authority (TUKES)

89
Germany Bundesanstalt fr
Arbeitsschutz und Ulrich Trapp Accident data Email No data held, contact at HVBG given
Arbeitsmedizin
Hauptverband der
gewerblichen Accident data Email MMBG informed us that they do not
Berufsgenossenschaften hold accident data or deal with the Lifts
(HVBG) Directive
Federal statistical office Accident data Email No reply
Federal Ministry of
Labour and Social Affairs Marc Schulze Accident data Email No statistics held
STC lift consulting Gerhard Schiffner Accident data Email Official statistics showed no accidents
Allianz-azt insurance Accident data Email No reply
Wittur Wolfgang Adldinger Accident data/technical solutions Telephone interview
Liftmaterial Hartmut Liebig/ Accident data/technical solutions Telephone interview
Stephan Kretzschmar

Italy Instituto Superiore per la Maria Castriotta

Prevenzione e la Sicurezza Accident data Email No reply
del Lavoro
Ministero delle Attivit Paolo Cavanna Accident data Email/letter No reply
Produttive
Ministero delle Attivit Giuseppe Magliacane Accident data Email No reply
Produttive
SEMATIC Roberto Zappa Accident data/technical solutions Email Contact at Liftmaterial provided

Ireland Health and Safety Accident data Email No reply

Authority
Department of Enterprise, Hillery Saunders Accident data Email No data available
Trade & Employment
Northern Dept of Enterprise, Trade Accident data Email One low fall incident
Ireland and Investment
Netherlands Liftinstituut (coordination Frank Tegel Accident data/technical solutions Email No fatal crushing accidents known
of notified bodies)
United Health and Safety Accident data Internal contact Accident data obtained
Kingdom Executive (HSE)

90
Health and Safety Ian Simpson Accident data/technical solutions Meeting
Executive (HSE)
Health and Safety Vaughan Cole Accident data/technical solutions Meeting
Executive (HSE)
Gina Barney Associates Gina Barney Accident data/technical Meeting
solutions/standards
LECS David Cooper Accident data/technical solutions Telephone interview
Michael Savage Michael Savage Accident data/technical Meeting
solutions/standards
Otis Ian Jones Accident data/technical Meeting
solutions/standards
Otis Richard Askew Accident data Telephone interview
Otis Derek Smith Accident data/technical solutions Telephone interview
Oakland Elevators David Holmes Accident data/technical Meeting
solutions/standards
Schindler Steve Reynolds Accident data/technical Meeting
solutions/standards
Kone Adrian Shiner Accident data/technical solutions Meeting arranged
Thyssen-Krupp Joe Kruger Accident data/technical solutions Telephone
Thyssen-Krupp Neil Sulliven Accident data/technical solutions Telephone
Cardiff Lift Company David Beard Technical solutions Visit to installation
Safety Assessment Richard Hulmes Accident data/technical solutions Telephone interview
Federation (SAFed)
Lift and Escalator Industry Robert Lee Accident data/technical Meeting
Association (LEIA) solutions/standards
Engineering Employers' Accident data Email No statistics held
Federation (EEF)
Department of Trade and Mike Dodds Accident data/technical Meeting
Industry (DTI) solutions/standards
Department of Trade and Bernard James Technical solutions Telephone interview
Industry (DTI)
Lloyd's Register Quality Paul Williams Accident data/technical solutions Meeting
Assurance Limited
Bureau Veritas Inspection Alex Carmichael Accident data/technical solutions Meeting
Limited

91
 Royal Society for the Maya Parmar Public accident data Telephone Accident data did not show any
Prevention of Accidents incidents to the public in terms of
(RoSPA) crushing
Poland Central Institute for Accident data Email No Statistics available
Labour Protection
Office for competition and Accident data Email No reply
consumer protection
Spain The European Agency for Accident data Email No reply
Safety and Health at Work
Instituto Nacional de Accident data Email No reply
Seguridad e Higiene en el
Trabajo
Ministerio de Industria, Accident data Email/letter No reply
Turismo y Comercio
European
industry
bodies
European Federation for Accident data/technical solutions Email/letter No reply
Elevator Small and
Medium sized Enterprises
(EFESME)
European Lift Accident data/technical solutions Email/letter No reply
Components Association
(ELCA)
European Lift Association Luc Rivet Accident data/technical Meeting Accident reports were provided for
(ELA) solutions/standards several member states

92
 APPENDIX 3 - ACCIDENT DETAILS

Date Description Cause Consequence

Hungary
1998 A mechanic adjusted the cabin levelling close to the top floor from top of car at an Fault of cabin position contact No injury
old lift, his assistant followed his instructions from the cabin. Due to a fault of cabin
position contact when he wanted to start moving cabin downstairs it went upwards.
Fortunately the end switch and buffer blocked before he could have been crushed.
1999 At an old freight elevator a mechanic worked on top of car when -due to controller Controller problem Injury
problem the cabin was running up with high speed (1 m/s), the counterweight was
stopped on a spring buffer, the mechanic was lying down on the car top. Fortunately
there were enough space he just got a cerebral concussion
2003 Code inspector controlled the pit installation of a hydraulic lift while main switch was Valve problem No injury
switched off. Due to valve problem the cabin moved down and he recognized just in
the last minute the situation and jumped out from the pit.
There were also four near misses with MRL lifts in the last five years but no official
report. In all cases the brake did not operate properly and the cabin went into the
headroom. Nobody was on the car top at the time.
Finland
1961 A maintenance-man wanted to examine a locator switch on a car roof. Jammed control relay (lift built in Injury
He stepped onto the car roof at the highest floor and activated the service-drive push- 1960)
buttons and rode up a little bit. He noticed that the car didnt stop when he lifted his
finger off the button. When the car approached the top of the shaft he tried to take
cover. The lift stopped when the final limit switch operated, with the man squeezed
into the 500 mm space between the car roof and the ceiling. His ankle was twisted
into an abnormal position, and was later on found to have been broken.
1988 Repairing personnel were examining the front wall of a lift shaft under renovation. As the buffer spring had not yet Injury
One man stood on the car roof and the other one was inside the car using temporary been installed it had been possible to
service-drive push-buttons, in aural contact with the man on the roof. Neither of them drive the car beyond safe limits.
noticed that the uppermost floor level had been already reached as the drive upwards (original lift 1941)
continued, until the man on the roof yelled loudly. He was crushed against the ceiling,
93
 breaking some dorsal vertebrae. His back was operated on but his legs remained
paralysed.
France
1996 Fitter/ maintenance worker. No emergency stop device at the Injury
The victim had gone down into the pit of the lift when the caretaker, who was bottom of the pit (equipment dates
cleaning the staircase, took the lift to travel down one floor. The victim shouted to the from 1975). The victim was working
caretaker to stop the lift but he was unable to as the lift car was not equipped with an alone on a lift which was still in
emergency stop button. The lift maintenance engineer had easily shunted one of the operation. The safety audit had not
safety devices on the landing door enabling the lift to travel with its door open while yet been carried out. Door contacts
work was being carried out. When the caretaker took the lift car, the speed of descent shunted.
(0.75 m/s) did not give the maintenance engineer time either to lie down on the floor
or to grab the control lever on the shaft to stop the car.
1997 Qualified lift maintenance engineer. 32 years service. The victim was probably working Fatal
The victim was to carry out running repairs to the landing doors of the residential alone on a lift which was still in
building. Lift car moved unexpectedly while victim still working on roof of the car. service.
1998 Lift maintenance engineer. Qualification P3. The victim was working alone on a Fatal
The victim was replacing several components of the lift including the inspection lift which was still in service. No
casing. He had taken out all the shut-off devices in the shaft and fitted the new parts work plan, instructions or equipment
but they were not yet connected. The old inspection casing was still in service and in necessary to ensure work could be
normal mode. The victim was crushed between the roof of the lift car and the top of performed safely.
the shaft. As soon as all the landing doors to the floors are closed, the lift
automatically starts moving to be chocked, either at the base of the shaft or, as in The lift cars travel upwards was
this case, at the top of the shaft. longer than usual as the normal
damper spring of the counterweight
was missing.
2004 Lift maintenance engineer. No safety audit prior to the Fatal
After the lift broke down, the victim went to the machine room to carry out repairs maintenance engineers intervention.
and then climbed onto the roof of the lift car, probably to carry out an inspection. His The victim was working alone.
body was found the following day pinned between the shaft and the wall of the lift There is some doubt whether certain
car which had stopped between the 1st and 2nd floor. The lift was in service at the safety features as well as certain
time of the accident. According to a witness, the lighting in the shaft was not electrical locks were operating
working. This fault was noted in several inspection reports. Without prejudice to the properly.
conclusions of the judicial inquiry, there is some doubt as to whether certain safety
94
 devices were working properly, especially the emergency stop function.
2004 Lift maintenance engineer. It is likely that the lift was still in Fatal
The victim was crushed against the frame of the landing door when climbing down normal operational mode. For some
from the roof of the lift car upon which he had been carrying out a repair. unknown reason, the victim does not
appear to have used the inspection
mode.
France provided by ELA
1996 Worker crushed in pit - no information. The company did not belong to the French Fatal
federation.
2000 Worker crushed in pit - no information. The company did not belong to the French Fatal
federation.
2003 During mounting of lift in public building, worker crushed on top of shaft, the car Fatal
having departed at high speed
2007 During modernisation of lift in housing complex, worker crushed on top of shaft, the Fatal
car having departed suddenly at high speed.
United Kingdom
1998 Two engineers were improving the levelling on a lift on which the safety gear had Lift was operated in service mode, Fatal
previously engaged The lift was of limited headroom type and there was a sign car top emergency stop was only
indicating this. During adjustment of the lift positioning, the lift was being operated accessible from one side of the car.
in service mode, rather than inspection mode. An experienced engineer was on the car
top and another was inside the car operating the service controls. For some reason,
the lift travelled to the third floor, rather than the second that had been selected. The
engineer on the top of the car became aware that the car was moving toward the well
roof and decided to activate the car top emergency stop. However, to do so, it was
necessary to reach over the car roping pulleys. The engineer was able to operate the
stop but was subsequently crushed between the rope guard and the well ceiling.
2000 An experienced lift engineer was killed whilst working underneath a hydraulic goods Fatal
lift. The engineer had failed to sign in on arrival and as far as could be ascertained Landing door contacts bypassed, lift
from witnesses, was working underneath the lift when it began to return to ground was still in service.
floor level. The engineer was trapped in attempting to leave the pit and subsequently
died of his injuries. The investigation revealed that he had failed to isolate the lift
power, failed to use the pit prop and had not pressed the pit wall stop button. The
engineer had sent the lift up to the first floor with the door open by utilizing a door
95
 beak to bypass the landing door contacts.
2001 Lift installation engineering staff were engaged in fault finding during the installation A temporary link had been placed Fatal
of a new lift in a new building. An engineer had entered the pit to check equipment across the landing door contacts.
on the underside of the car. As he emerged from the pit, the car descended and he was
crushed between the underside of the car and the ground floor. It was concluded that
the door safety circuits had been overridden when checking the door closure
mechanism. This allowed the car to move with the doors open and with the car top
controller set to normal mode. It is thought that the car began to move when one of
the stop buttons was reset or the timing mechanism timed out.
2005 During installation of a new lift in an existing lift shaft, a lift engineer was using a The control pendant cable was Fatal
temporary control pendant to drive the lift from the car top. It is thought that the severed, leading to the lift travelling
connecting cable for the control pendant became caught around a bolt and was out of control. There was no limit
severed. However, some of the conductors remained in contact, leading to the lift switch or counterweight buffer to
moving upward out of control of the pendant. There was no upper limit switch stop the car.
connected and the engineer had not replaced the buffer for the counterweight.
Realising that there was nothing to stop the car before reaching the top of the shaft,
the engineer tried to jump out of the top landing door and was crushed between the
car top and landing door frame.
1998 Accident involving an engineer crushed between the car top and the steelwork top of Fatal
the well.

96
 APPENDIX 4 SYSTEM OPERATION

WITTUR SYSTEM FUNCTION DURING MAINTENANCE:

1) The lift car must firstly be positioned at a floor above the lower landing level to allow access
to the pit.

2) Two hinged supports (shown previously in Figure 10) swing into the travel zone of the lift
car to limit any downward movement of the lift car into the safety space.

3) When the landing door is unlocked, the circuit providing power to the magnets of the hinged
supports is cut. The lift cannot be operated until the reset switch is operated.

4) The pit is accessed by manually opening the landing door and the control system for the lift is
switched off by a standard stop switch in the pit.

5) After the maintenance operations are complete, the emergency stop in the pit can be switched
on and the landing doors closed.

6) The lift can only be reactivated by resetting a switch in the control cabinet.

LIFTMATERIAL/SEMATIC EMERALD 300.

1) The pit can only be accessed using an EN81 compliant release key. When the key is used to
open the landing door, the lift safety circuit is interrupted and the lift is prevented from moving.

2) The lift can only be moved under inspection control when the artificial space prop is in
position. In addition, an emergency stop switch is provided.

3) The overspeed governor is also fitted with a device that allows only one rotation of the
overspeed governor pulley if involuntary movement occurs.

4) The lift cannot be restarted without a key switch adjacent the release key aperture being reset.

CARDIFF LIFT SYSTEM

The installation by Cardiff Lift Company was a hydraulic lift that was a replacement for an
existing traction drive lift. The space available in the lift shaft meant that no headroom was
available. The solution used by Cardiff Lift Company was based upon a system of hydraulically
actuated mechanical stops (shown previously in Figures 14 and 15).

Operation

1) Upon detection of an upper landing door being opened whilst lift is not present at floor level,
the control panel without further intervention will de-activate car and landing buttons & signal
the locking pin drive motor-pump and solenoid B to energise, the locking pins will be driven
OUT to the extended position and the drive will shut off when contacts in LS1 (1 per pin) are
open circuited this is self actuated by the locking pin. The limit switch LS1 secondary contacts
will initiate the feed to Car Top Control UP direction Inspection button. This will further
97
enhance the safety, should the pins fail to drive out it will not be possible to move the lift in the
upward direction from the Car Top Control in Inspection Mode.

2) The upward direction in Inspection mode will be further limited by a Up Test Limit which
will be set to limit the distance between the car roof and the underside of lift shaft roof
(1800mm), (BS 7255:2001 - Annex B.2.2.2) This will allow access to the top of shaft lift
equipment for maintenance purposes but will minimize the possibility of contact between
maintenance personnel and the shaft roof.

3) Should the up test limit fail and the lift still proceed in the upward direction then the under
car locking pins which are already extended will engage with striking plates secured to the main
lift guides, and the upward motion will be mechanically stopped. Should the upward drive
signal still be present then a high pressure electrical switch will open circuit and terminate any
drive signals in either direction. As a further measure the high pressure hydraulic relief
mechanical bypass valve fitted to the main lift drive unit, will open should the pressure within
the main hydraulic drive system rises above 1.4 times the maximum operation pressure EN81-
2:1998 12.5.3.2),

4) Upon exiting the car roof the Car Top Control Normal / Inspection switch is returned to the
normal position, and the landing doors closed as standard practice. The lift will not function
until the following procedure has been completed.

a) The key switch located on the door of the Main lift control panel located in the lift motor
room and marked Locking Pin reset must be turned to the RESET position and held (Spring
return type key switch). This will initiate the retraction of the locking pins. The control panel
without further intervention will signal the auxiliary motor-pump and solenoid A to energise,
the locking pins will be driven IN to the retracted position and the drive will shut off when
contacts in LS2 (1 per pin) are open circuited this is self actuated by the locking pin. The limit
switch LS2 secondary contacts will initiate the illumination of the locking pin retracted
indicator and the reinstatement of car and landing call buttons.

98
 APPENDIX 5 ERGOMONIC SPACE REQUIREMENTS

5th 50th 95th Corrected

Dimension Population Largest Corrections
%ile %ile %ile Value
UK 1641 1755.1 1869.2 Safety Hat 35
Stature Swedish 1630 1740 1850 Shoes 25
The vertical distance from
Dutch 1690 1795 *1900 1900 1960
the floor to the crown of the
head French 1607 1715 1830
Polish 1623 1695 1862
UK 860.4 920.2 980 Safety Hat 35
Sitting Height Swedish 830 900 970 Clothing 10
Vertical distance from the
Dutch 885 940 *995 995 1040
sitting surface to the crown
of the head French 850 910 970
Polish 830 885 940
UK 540 595 645 Clothing (outdoor) 20
Buttock Knee Length
Horizontal distance from the Swedish 545 595 645
back of the uncompressed Dutch 575 620 *665 665 685
buttock to the front of the French 550 595 640
kneecap
Polish 540 585 630
UK 449.5 496.7 543.9 Clothing (outdoor) 40
Shoulder Breadth
(Biteltoid) Swedish 420 465 510
Maxiumum horizontal Dutch 430 475 520 543.9 583.9
breadth across the French 425 470 515
shoulders
Polish 405 440 475
UK 343.3 411.5 479.6 Clothing (light) 10
Hip Breadth (F) Swedish 315 365 415 Clothing (medium) 25
Maximum horizontal
Dutch 340 395 450 479.6 Clothing (outdoor) 50 529.6
distance across the hips in
the sitting position French 334 375 432
Polish 333 345 429
UK 216.5 280.4 344.3 Clothing 40
Abdominal Depth
Maximum horizontal Swedish 190 240 290
distance from the vertical Dutch 245 310 *375 375 415
reference place to the French 220 270 320
abdomen (sitting)
Polish 220 265 310
UK 1234.7 1355.4 1476 Shoes 25
Crawling Length
Hard Hat 35
Horizontal distance from the
1476 1536
crown of the head to the
foot in the crawling position

Crawling Height UK 712.1 773.7 835.4 Clothing 20

Vertical distance from the
floor to the top of the 835.4 855.4
shoulder blades in the
crawling position
Kneeling Leg Length UK 620 685 750 Clothing 20
Measured horizontally from Shoes 35
the tip of the toes to the
750 805
front of the knee whilst in a
kneeling posture with the
trunk vertical
Kneeling Height UK 1215 1297 1378 Clothing 20
Vertical distance from the Hard Hat 35
floor to the top of the head 1378 1433
whilst in a kneeling posture
with the trunk vertical

99
 APPENDIX 6 RISK ASSESSMENT TABLES

It was important to ensure that the risk comparison broadly reflects the relative importance of
each device in relation to the scenarios identified. In order to combine the scores derived for
each device the following equation was used to derive the relative benefits accrued for each
aspect (Reliability, Usability and Human Reliability):

(F+D) * (A+B) = X

(F+D) * (I+E) = Y

(F+D) * (O+V) = Z

When:

F= Frequency
D= Duration
A= Mechanical protection rating
B= Electronic equipment protection rating
I= Inherent design rating
E= Ease of use rating
O= Override protection rating
V= Incentive to violate rating
X= Weighted rating for safety equipment
Y= Weighted rating for usability rating
Z= Weighted rating for human reliability rating

2X+Y+Z = Total Rating.

It should be noted that the total score incorporates an increased weighting to balance the human
and engineering elements of the evaluation.

100
Manually installed moveable prop in lift base - not interlocked
Frequency of Duration of Exposure Reliability of Safety Equipment Usability Human Reliability Total
Exposure to hazard
Rating Notes Rating Notes Mechanical Programmable Combined Inherent design Ease of Use Total Override of Controls Deliberate Violation Combined
Electronic
Equipment
Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift 3 Assumed to be 3 Considered to 2 Protection only 0 Not provided 12 2 Device 2 Device 24 0 Device not 2 Device 12 48
Maintenance bi-monthly but be around 1- provided for work in requires user requires interlocked easily
and Inspection will vary 2hours the base, integrity of to be in careful ignored but
according to prop may not be position of positioning incentive to
the reliability of known danger to use
the operate and
components only protects
the base of the
lift shaft not
the head
space
Storage of Illicit 4 Entry likely to 2 Time spent in lift 0 No Protection as not 0 Not provided 0 0 Not interlocked 0.5 Device 3 0 Device not 0 Device 0 3
substances in be regular due area is unlikely automatically requires interlocked easily
lift shaft base to value of to be overnight instigated careful ignored and
stowed and is primarily positioning incentive
material but for stowage and not to use
unlikely to be a recovery.
regular event
Recovery of 1 Very rare event 5 Time spent in lift 0 Protection only 0 Not provided 0 0 Not interlocked 0 Device 0 0 Device not 0 Device 0 0
object in base is likely to be provided for work in requires interlocked easily
minimal the base, integrity of careful ignored
prop may not be positioning
known
Resting 4.5 Unlikely to be a 2 Likely to be 0 Protection only 0 Not provided 0 0 Not interlocked 1 Device 6.5 0 Device not 1 Device 6.5 13
regular event overnight provided for work in requires interlocked easily
the base, integrity of careful ignored but
prop may not be positioning incentive to
known use
Accidental fall 5 Very rare event 2 Unlikely to be for 0 Protection only 0 Not provided 0 0 Not interlocked 0 Device 0 0 Device not 0 Device 0 0
into lift shaft an extended provided for work in requires interlocked easily
period of time the base, integirty of careful ignored
but also risk of prop may not be positioning
being left known
undiscovered
Overall Rating 0.4 0 12 33.5 3.7 49.2

101
Manually installed fixed support vertically acting on car or on counter weight - not interlocked
Frequency of Duration of Exposure Reliability of Safety Equipment Usability Human Reliability Combined Total
Exposure to hazard
Rating Notes Rating Notes Mechanical Programmable Combined Inherent design Ease of Use Total Override of Deliberate Violation
Electronic Controls
Equipment

Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift 3 Assumed to 3 Considered to 4.5 As support is fixed, the 0 Not provided 27 3 Requirement to 3 Device easily 36 2 Easily 2.5 No interlock 27 90
Maintenance be bi-monthly be around 1- integrity of the support be in a position installed overridden but device
and Inspection but will vary 2hours is more easily assured of danger to using hinged relatively
according to than for the removable install device, process and simple to
the reliability prop. Device provides potential for lock to use
of the physical resistance to device to be ensure
components encroachment of knocked over correct
refuge space unless fixed (for locating of
example, using a device.
pin), device is not
interlocked to
movement of the
lift, integrity of
the material is
easier to assure
than with the
prop, inhibition of
lift movement is
provided
mechanically
through
compression.
Storage of Illicit 4 Entry likely to 2 Time spent in 0 No Protection as not 0 Not provided 0 0 Not interlocked 2.5 Device easily 15 0 Easily 0 Strong 0 15
substances in be regular due lift area is automatically installed overridden incentive
lift shaft base to value of unlikely to be instigated using hinged not to use
stowed overnight and is process and
material primarily for lock to
stowage and ensure
recovery. correct
locating of
device.
Fairly
intuitive and
could be
installed by
untrained
individual
Recovery of 1 Very rare 5 Time spent in 0 No Protection as not 0 Not provided 0 0 Not interlocked 2.5 Device easily 15 0 Easily 1 Some 6 21
object in base event lift is likely to be automatically installed overridden incentive to
minimal instigated using hinged use
process and
lock to
ensure
correct
locating of
device.
Fairly
intuitive and
could be
installed by
untrained
individual

102
 Resting 4.5 Unlikely to be 2 Likely to be 0 No Protection as not 0 Not provided 0 0 Not interlocked 2.5 Device easily 16.25 0 Easily 0 Strong 0 16.25
a regular overnight automatically installed overridden incentive
event instigated using hinged not to use
process and
lock to
ensure
correct
locating of
device.
Fairly
intuitive and
could be
installed by
untrained
individual
Accidental fall 5 Very rare 2 Unlikely to be 0 No Protection as not 0 Not provided 0 0 Not interlocked 1.5 Device easily 10.5 0 Easily 0 No interlock 0 10.5
event for an extended automatically installed overridden
period of time instigated using hinged
but also risk of process and
beg left lock to
undiscovered ensure
correct
locating of
device.
Fairly
intuitive and
could be
installed by
untrained
individual but
injured
person may
struggle to
use.
Overall Rating 3.5 2.8 0.9 0 27 0.6 2.4 18.55 0.4 0.7 6.6 52.15

103
Manually installed fixed support horizontally acting on car and on counter weight - not interlocked
Frequency of Duration of Exposure Reliability of Safety Equipment Usability Human Reliability Total
Exposure to hazard
Rating Notes Rating Notes Mechanical Programmable Combined Inherent design Ease of Use Total Override of Deliberate Combined
Electronic Controls Violation
Equipment

Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift 3 Assumed to 3 Considered to 2.5 Assumed to be of 0 Not provided 15 2.5 Requirement to be 3 Device 33 2 Device 2.5 No interlock 27 75
Maintenance be bi-monthly be around 1- lower strength than in a position of easily present and but device
and Inspection but will vary 2hours that for a vertically danger to install installed easily used relatively
according to acting prop due to device, potential using hinged but no simple to
the reliability the direction by for device to be process and interlocking use but may
of the which the force is knocked out of lock to be more
components applied and the bi- position unless ensure complex
directional acting fixed (for example, correct than a
nature of some using a pin), locating of prop/fixed
devices. device is not device. vertical
interlocked to support
movement of the
lift, integrity of the
material is easier
to assure than with
the prop, inhibition
of lift movement is
provided
mechanically but
risk of
turning/bending
may apply.
Storage of 2 Entry likely to 4 Time spent in 0 No Protection as not 0 Not provided 0 0 Not interlocked 2 Device 12 0 Easily 0 Strong 0 12
Illicit be regular due lift area is automatically easily overridden incentive
substances in to value of unlikely to be instigated installed not to use
lift shaft base stowed overnight and is using hinged
material primarily for process and
stowage and lock to
recovery. ensure
correct
locating of
device.
Fairly
intuitive and
could be
installed by
untrained
individual
Recovery of 5 Very rare 5 Time spent in 0 No Protection as not 0 Not provided 0 0 Not interlocked 2 Device 20 0 Easily 1 Some 10 30
object in base event lift is likely to be automatically easily overridden incentive to
minimal instigated installed use
using hinged
process and
lock to
ensure
correct
locating of
device.
Fairly
intuitive and
could be
installed by
untrained
individual

104
 Resting 4.5 Unlikely to be 2 Likely to be 0 No Protection as not 0 Not provided 0 0 Not interlocked 2 Device 13 0 Easily 0 Strong 0 13
a regular overnight automatically easily overridden incentive
event instigated installed not to use
using hinged
process and
lock to
ensure
correct
locating of
device.
Fairly
intuitive and
could be
installed by
untrained
individual
Accidental fall 5 Very rare 2 Unlikely to be 0 No Protection as not 0 Not provided 0 0 Not interlocked 0 0 Easily 0 No interlock 0 0
event for an extended automatically overridden
period of time instigated
but also risk of
beg left
undiscovered
Overall Rating 0.5 0 15 0.5 2.25 15.6 0.4 0.7 7.4 38

105
Manually installed fixed support horizontally acting on car and on counter weight - interlocked with lift control system
Frequency of Duration of Exposure Reliability of Safety Equipment Usability Human Reliability Total
Exposure to hazard
Rating Notes Rating Notes Mechanical Programmable Combined Inherent design Ease of Use Total Override of Deliberate Violation Combined
Electronic Controls
Equipment

Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift 3 Assumed to 3 Considered to 2.5 Assumed to be of 0 Not provided 15 3 Reduced 3 Device easily 36 2 Device easily 4 Device 36 87
Maintenance be bi-monthly be around 1- lower strength than requirement to be installed overridden if relatively
and Inspection but will vary 2hours that for a vertically in a position of using hinged doors closed simple to use
according to acting prop due to danger to install process and and little
the reliability the direction by device, potential lock to incentive to
of the which the force is for device to be ensure override
components applied and the bi- knocked out of correct
directional acting position unless locating of
nature of some fixed (for example, device.
devices. using a pin) but
device is
interlocked to
movement of the
lift, integrity of the
material is easier
to assure than with
the prop, inhibition
of lift movement is
provided
mechanically and
via interlock but
risk of
turning/bending
may apply.
Storage of Illicit 2 Entry likely to 4 Time spent in 2.5 Assumed to be of 0 Not provided 15 1.5 Device linked to 2.5 Device easily 24 2 Device 0 Device easily 12 51
substances in be regular due lift area is lower strength than opening of doors installed interlocked to overridden
lift shaft base to value of unlikely to be that for a vertically therefore likely to using hinged doors but and strong
stowed overnight and is acting prop due to provide some process and overridden if incentive to
material primarily for the direction by protection but If lock to doors closed do so
stowage and which the force is doors closed then ensure
recovery. applied and the bi- lift can still be correct
directional acting operated in normal locating of
nature of some mode device.
devices. Fairly
intuitive and
could be
installed by
untrained
individual
Recovery of 5 Very rare 5 Time spent in 2.5 Assumed to be of 0 Not provided 25 1.5 Device linked to 2.5 Device easily 40 2 Device easily 3 Device 50 115
object in base event lift is likely to be lower strength than opening of doors installed overridden if relatively
minimal that for a vertically therefore likely to using hinged doors closed simple to use
acting prop due to provide some process and and little
the direction by protection but If lock to incentive to
which the force is doors closed then ensure override
applied and the bi- lift can still be correct
directional acting operated in normal locating of
nature of some mode device.
devices. Fairly
intuitive and
could be
installed by
untrained
individual

106
 Resting 4.5 Unlikely to be 2 Likely to be 2.5 Assumed to be of 0 Not provided 16.25 1.5 Device linked to 2.5 Device easily 26 2 Device easily 0 Device easily 13 55.25
a regular overnight lower strength than opening of doors installed overridden if overridden
event that for a vertically therefore likely to using hinged doors closed and strong
acting prop due to provide some process and incentive to
the direction by protection but If lock to do so
which the force is doors closed then ensure
applied and the bi- lift can still be correct
directional acting operated in normal locating of
nature of some mode device.
devices. Fairly
intuitive and
could be
installed by
untrained
individual
Accidental fall 0.5 Very rare 2 Unlikely to be 2.5 Assumed to be of 0 Not provided 6.25 1.5 Device linked to 3.75 2 Device easily 4 Fall into lift is 15 25
event for an extended lower strength than opening of doors overridden if only caused
period of time that for a vertically therefore likely to doors closed if door is
but also risk of acting prop due to provide some open
beg left the direction by protection but If therefore no
undiscovered which the force is doors closed then incentive to
applied and the bi- lift can still be violate
directional acting operated in normal
nature of some mode
devices.
Overall Rating 2.5 0 15.5 1.8 2.625 25.95 2 2.2 25.2 66.65

107
Automatically installed fixed support vertically acting on car and on counter weight - interlocked with lift control system
Frequency of Duration of Exposure Reliability of Safety Equipment Usability Human Reliability Most Likely
Exposure to hazard Consequence
Rating Notes Rating Notes Mechanical Programmable Combined Inherent design Ease of Use Total Override of Deliberate Violation Combined
Electronic Equipment Controls

Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift 3 Assumed to 3 Considered to 4.5 Assumed to 3 Assumed that 45 4 Device is 5 Automatically 54 3 Simple 4 Device 42 141
Maintenance be bi-monthly be around 1- be of high simple interlocked to installed means to present and
and Inspection but will vary 2hours strength command is movement of the override easily used
according to required (e.g. lift, integrity of the through and simply
the reliability turning of material is easier closure of interlocked, if
of the engineers key to assure than the door lift operation
components etc) and if door with the prop, is linked to
into lift shaft inhibition of lift doors then
opened then lift movement is there is risk
disabled and provided that doors
device mechanically and may be
automatically via interlock but closed from
manoeuvred risk of the inside
into place. turning/bending and support
Visual check will may apply. lowered
ensure that
position of
danger no
entered
Storage of 2 Entry likely to 4 Time spent in 4.5 Assumed to 3 Assumed that 45 4 Device is 5 Automatically 54 1 Device 0 Device easily 6 105
Illicit be regular due lift area is be of high simple interlocked to installed easily overridden
substances in to value of unlikely to be strength command is movement of the overridden if and strong
lift shaft base stowed overnight and is required (e.g. lift, integrity of the doors closed incentive to
material primarily for turning of material is easier do so
stowage and engineers key to assure than
recovery. etc) and if door with the prop,
into lift shaft inhibition of lift
opened then lift movement is
disabled and provided
device mechanically and
automatically via interlock but
manoeuvred risk of
into place. turning/bending
Visual check will may apply.
ensure that
position of
danger no
entered
Recovery of 5 Very rare 5 Time spent in 4.5 Assumed to 3 Assumed that 75 4 Device is 5 Automatically 90 1 Device 2 Device 30 195
object in base event lift is likely to be be of high simple interlocked to installed easily relatively
minimal strength command is movement of the overridden if simple to use
required (e.g. lift, integrity of the doors closed and little
turning of material is easier incentive to
engineers key to assure than override
etc) and if door with the prop,
into lift shaft inhibition of lift
opened then lift movement is
disabled and provided
device mechanically and
automatically via interlock but
manoeuvred risk of
into place. turning/bending
Visual check will may apply.
ensure that
position of

108
 danger no
entered

Resting 4.5 Unlikely to be 2 Likely to be 4.5 Assumed to 3 Assumed that 48.75 4 Device is 5 Automatically 58.5 1 Device 0 Device easily 6.5 113.75
a regular overnight be of high simple interlocked to installed easily overridden
event strength command is movement of the overridden if and strong
required (e.g. lift, integrity of the doors closed incentive to
turning of material is easier do so
engineers key to assure than
etc) and if door with the prop,
into lift shaft inhibition of lift
opened then lift movement is
disabled and provided
device mechanically and
automatically via interlock but
manoeuvred risk of
into place. turning/bending
Visual check will may apply.
ensure that
position of
danger no
entered
Accidental fall 5 Very rare 2 Unlikely to be 4.5 Assumed to 3 Assumed that 52.5 4 Device is 5 Automatically 63 1 If doors 2 Fall into lift 21 136.5
event for an extended be of high simple interlocked to installed close then shaft is only
period of time strength command is movement of the no caused if
but also risk of required (e.g. lift, integrity of the protection is door is open
beg left turning of material is easier afforded therefore no
undiscovered engineers key to assure than incentive to
etc) and if door with the prop, violate
into lift shaft inhibition of lift
opened then lift movement is
disabled and provided
device mechanically and
automatically via interlock but
manoeuvred risk of
into place. turning/bending
Visual check will may apply.
ensure that
position of
danger no
entered
Overall Rating 4.5 3 53.25 4 5 63.9 1.4 1.6 21.1 138.25

109
Automatically installed stop bars in car - initiated by engineers key or via control panel
Frequency of Duration of Exposure Reliability of Safety Equipment Usability Human Reliability Most Likely
Exposure to hazard Consequence
Rating Notes Rating Notes Mechanical Programmable Combined Inherent design Ease of Use Total Override of Deliberate Combined
Electronic Equipment Controls Violation

Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift 3 Assumed to be 3 Considered to 3 Assumed to be of 0 not interlocked 18 3.5 Device is 4 Automatically 45 3 Simple 2 Does not 30 93
Maintenance bi-monthly but be around 1- lower strength applied from installed but means to prevent
and Inspection will vary 2hours than that for a position requires lift to be override and access to
according to vertically acting outside of lift correctly located enter lift if the lift
the reliability of prop due to the shaft using an to ensure desired shaft or lift
the direction by which engineers successful roof if
components the force is initiated application doors
applied and the device. May opened
bi-directional be issues but device
acting nature. around is simple
locating of to use
stop bar into
lift shaft - i.e.
some potential
for failure.
Storage of Illicit 4 Entry likely to 4 Time spent in lift 0 Not interlocked 0 not interlocked 0 0 Design is not Not applicable 0 Not 0 Does not 0 0
substances in be regular due area is unlikely with points of interlocked applicable prevent
lift shaft base to value of to be overnight access access to
stowed and is primarily the lift
material for stowage and shaft or lift
recovery. roof if
doors
opened
Recovery of 5 Very rare event 5 Time spent in lift 0 Not interlocked 0 not interlocked 0 0 Design is not Not applicable 0 Not 0 Does not 0 0
object in base is likely to be with points of interlocked applicable prevent
minimal access access to
the lift
shaft or lift
roof if
doors
opened
Resting 4.5 Unlikely to be a 2 Likely to be 0 Not interlocked 0 not interlocked 0 0 Design is not Not applicable 0 Not 0 Does not 0 0
regular event overnight with points of interlocked applicable prevent
access access to
the lift
shaft or lift
roof if
doors
opened
Accidental fall 5 Very rare event 2 Unlikely to be for 0 Not interlocked 0 not interlocked 0 0 Design is not Not applicable 0 Not 0 Does not 0 0
an extended with points of interlocked applicable prevent
period of time access access to
but also risk of the lift
beg left shaft or lift
undiscovered roof if
doors
opened
Overall Rating 0.6 0 3.6 0.7 4 9 3 0.4 6 18.6

110
 Automatically installed stop bars in car - initiated by engineers key or via control panel, interlocked with lift shaft access points

Frequency of Duration of Exposure to Reliability of Safety Equipment Usability Human Reliability Most Likely
Exposure hazard Consequence
Rating Notes Rating Notes Mechanical Programmable Combined Inherent design Ease of Use Total Override of Controls Deliberate Violation Combined
Electronic Equipment

Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift 3 Assumed to be 3 Considered to 3 Assumed to be of 3 Interlocked to 36 3.5 Device is 4 Automatically 45 3 Simple means to 3 Does not prevent 36 117
Maintenance bi-monthly but be around 1-2 lower strength than lift access applied from installed override through access to the lift shaft
and will vary hours that for a vertically points and position closure of the or lift roof if doors
Inspection according to acting prop due to assumed that outside of lift door opened but device is
the reliability of the direction by simple shaft using an simple to use with little
the which the force is command is engineers key incentive to override
components applied and the bi- required (e.g. to initiate
directionally acting turning of device.
nature. engineers key Interlocked
etc). with roof
access and
doors
Storage of 2 Entry likely to 4 Time spent in 3 Assumed to be of 3 Interlocked to 36 3.5 Interlocking 4 Automatically 45 3 Simple means to 0 Device easily 18 99
Illicit be regular due lift area is lower strength than lift access with roof installed override through overridden and strong
substances in to value of unlikely to be that for a vertically points access and closure of the incentive to do so
lift shaft base stowed overnight and acting prop due to doors door
material is primarily for the direction by
stowage and which the force is
recovery. applied and the bi-
directionally acting
nature.
Recovery of 5 Very rare 5 Time spent in 3 Assumed to be of 3 Interlocked to 60 3.5 Interlocking 4 Automatically 75 3 Simple means to 2 Little incentive to 50 185
object in base event lift is likely to lower strength than lift access with roof installed override through override system
be minimal that for a vertically points access and closure of the
acting prop due to doors door
the direction by
which the force is
applied and the bi-
directionally acting
nature.
Resting 4.5 Unlikely to be 2 Likely to be 3 Assumed to be of 3 Interlocked to 39 3.5 Interlocking 4 Automatically 48.75 3 Simple means to 0 Device easily 19.5 107.25
a regular event overnight lower strength than lift access with roof installed override through overridden and strong
that for a vertically points access and closure of the incentive to do so
acting prop due to doors door
the direction by
which the force is
applied and the bi-
directionally acting
nature.
Accidental 5 Very rare 2 Unlikely to be 3 Assumed to be of 3 Interlocked to 42 3.5 Interlocking 4 Automatically 52.5 2 Little incentive to 14 108.5
fall event for an lower strength than lift access with roof installed override system
extended that for a vertically points access and
period of time acting prop due to doors
but also risk the direction by
of being left which the force is
undiscovered applied and the bi-
directionally acting
nature.
Overall 3 3 42.6 3.5 4 53.25 3 1.4 27.5 123.35
Rating

111
Limit Switches - interlocked with access points into areas of danger
Frequency of Duration of Exposure Reliability of Safety Equipment Usability Human Reliability Total
Exposure to hazard
Rating Notes Rating Notes Mechanical Programmable Combined Inherent design Ease of Use Total Override of Deliberate Violation Combined
Electronic Equipment Controls
Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift 3 Assumed to be 3 Considered to 0 No physical 3 Interlocked to 18 3.5 Device is 4 Automatically 45 3 Simple 2 Does not 30 93
Maintenance bi-monthly but be around 1-2 barrier lift access applied from installed means to prevent
and Inspection will vary hours points and position outside override access to the
according to assumed that of lift shaft through lift shaft or lift
the reliability of simple using an closure of roof if doors
the command is engineers key the door opened but
components required (e.g. to initiate device is
turning of device. simple to use
engineers key Interlocked with with little
etc). roof access and incentive to
doors override
Storage of Illicit 2 Entry likely to 4 Time spent in lift 0 No physical 3 Interlocked to 18 3.5 Interlocking 4 Automatically 45 3 Simple 0 Device easily 18 81
substances in be regular due area is unlikely barrier lift access with roof installed means to overridden
lift shaft base to value of to be overnight points and access and override and strong
stowed and is primarily assumed that doors through incentive to
material for stowage and simple closure of do so
recovery. command is the door
required (e.g.
turning of
engineers key
etc).
Recovery of 5 Very rare 5 Time spent in lift 0 No physical 3 Interlocked to 30 3.5 Interlocking 4 Automatically 75 3 Simple 2 Little 50 155
object in base event is likely to be barrier lift access with roof installed means to incentive to
minimal points and access and override override
assumed that doors through system
simple closure of
command is the door
required (e.g.
turning of
engineers key
etc).
Resting 4.5 Unlikely to be 2 Likely to be 0 No physical 3 Interlocked to 19.5 3.5 Interlocking 4 Automatically 48.75 3 Simple 0 Device easily 19.5 87.75
a regular event overnight barrier lift access with roof installed means to overridden
points and access and override and strong
assumed that doors through incentive to
simple closure of do so
command is the door
required (e.g.
turning of
engineers key
etc).
Accidental fall 5 Very rare 2 Unlikely to be 0 No physical 3 Interlocked to 21 3.5 Interlocking 4 Automatically 52.5 3 Simple 1 Little 28 101.5
event for an extended barrier lift access with roof installed means to incentive to
period of time points and access and override override
but also risk of assumed that doors through system
being left simple closure of
undiscovered command is the door
required (e.g.
turning of
engineers key
etc).
Overall Rating 0 3 21.3 3.5 4 53.25 3 1 29.1 103.65

112
Limit Switches - not interlocked and initiated from position on lift roof or in lift shaft base
Frequency of Duration of Exposure Reliability of Safety Equipment Usability Human Reliability Total
Exposure to hazard
Rating Notes Rating Notes Mechanical Programmable Combined Inherent design Ease of Use Total Override of Deliberate Violation Combined
Electronic Equipment Controls

Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift Maintenance 3 Assumed to be 3 Considered to 0 No physical 3 Interlocked to 18 3.5 Device is 4 Applied by use of 45 0 No 2 Does not 12 75
and Inspection bi-monthly but be around 1-2 barrier lift access applied from engineers key interlock prevent
will vary hours points and position access to
according to assumed that outside of lift the lift shaft
the reliability of simple shaft using an or lift roof if
the command is engineers key doors
components required (e.g. to initiate opened but
turning of device. device is
engineers key Interlocked simple to
etc). with roof use with
access and little
doors incentive to
override
Storage of Illicit 2 Entry likely to 4 Time spent in lift 0 No physical 3 Interlocked to 18 0 Not interlocked 0 Automatically 0 0 No 0 Does not 0 18
substances in be regular due area is unlikely barrier lift access installed interlock prevent
lift shaft base to value of to be overnight points and access to
stowed and is primarily assumed that the lift shaft
material for stowage and simple or lift roof if
recovery. command is doors
required (e.g. opened
turning of
engineers key
etc).
Recovery of 5 Very rare event 5 Time spent in lift 0 No physical 3 Interlocked to 30 0 Not interlocked 0 Automatically 0 0 No 0 Does not 0 30
object in base is likely to be barrier lift access installed interlock prevent
minimal points and access to
assumed that the lift shaft
simple or lift roof if
command is doors
required (e.g. opened
turning of
engineers key
etc).
Resting 4.5 Unlikely to be a 2 Likely to be 0 No physical 3 Interlocked to 19.5 0 Not interlocked 0 Automatically 0 0 No 0 Does not 0 19.5
regular event overnight barrier lift access installed interlock prevent
points and access to
assumed that the lift shaft
simple or lift roof if
command is doors
required (e.g. opened
turning of
engineers key
etc).
Accidental fall 5 Very rare event 2 Unlikely to be for 0 No physical 3 Interlocked to 21 0 Not interlocked 0 Automatically 0 1 No 0 Does not 7 28
an extended barrier lift access installed interlock prevent
period of time points and access to
but also risk of assumed that the lift shaft
being left simple or lift roof if
undiscovered command is doors
required (e.g. opened
turning of
engineers key
etc).
Overall Rating 21.3 0.7 0.8 9 0.2 0.4 3.8 34.1

113
 Pretriggered System interlocked with access points

Frequency of Duration of Exposure Reliability of Safety Equipment Usability Human Reliability Total
Exposure to hazard
Rating Notes Rating Notes Mechanical Programmable Combin Inherent design Ease of Use Total Override of Controls Deliberate Violation Combined
Electronic Equipment ed
Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift Maintenance 3 Assumed to 3 Considered to 2 Not specifically 3 Interlocked to 30 3.5 Device is applied 4 Automatically 45 3 Simple 2 Does not prevent 30 105
and Inspection be bi-monthly be around 1-2 intended for the lift access from position installed means to access to the lift shaft
but will vary hours purpose of providing a points and outside of lift override or lift roof if doors
according to protective assumed that shaft using an through opened but device is
the reliability environment but simple engineers key to closure of simple to use with
of the considered to provide command is initiate device. the door little incentive to
components a good level of required (e.g. Interlocked with override
mechanical protection turning of roof access and
engineers key doors
etc).
Storage of Illicit 2 Entry likely to 4 Time spent in 2 Not specifically 3 Interlocked to 30 3.5 Interlocking with 4 Automatically 45 3 Simple 0 Device easily 18 93
substances in lift be regular due lift area is intended for the lift access roof access and installed means to overridden and strong
shaft base to value of unlikely to be purpose of providing a points and doors override incentive to do so
stowed overnight and protective assumed that through
material is primarily for environment but simple closure of
stowage and considered to provide command is the door
recovery. a good level of required (e.g.
mechanical protection turning of
engineers key
etc).
Recovery of 5 Very rare 5 Time spent in 2 Not specifically 3 Interlocked to 50 3.5 Interlocking with 4 Automatically 75 3 Simple 2 Little incentive to 50 175
object in base event lift is likely to intended for the lift access roof access and installed means to override system
be minimal purpose of providing a points and doors override
protective assumed that through
environment but simple closure of
considered to provide command is the door
a good level of required (e.g.
mechanical protection turning of
engineers key
etc).
Resting 4.5 Unlikely to be 2 Likely to be 2 Not specifically 3 Interlocked to 32.5 3.5 Interlocking with 4 Automatically 48.75 3 Simple 0 Device easily 19.5 100.75
a regular overnight intended for the lift access roof access and installed means to overridden and strong
event purpose of providing a points and doors override incentive to do so
protective assumed that through
environment but simple closure of
considered to provide command is the door
a good level of required (e.g.
mechanical protection turning of
engineers key
etc).
Accidental fall 5 Very rare 2 Unlikely to be 2 Not specifically 3 Interlocked to 35 3.5 Interlocking with 4 Automatically 52.5 2 Little incentive to 14 101.5
event for an intended for the lift access roof access and installed override system but
extended purpose of providing a points and doors access points may
period of time protective assumed that not be open (i.e.
but also risk of environment but simple
beg left considered to provide command is
undiscovered a good level of required (e.g.
mechanical protection turning of
engineers key
etc).
Overall Rating 35.5 3.5 4 53.25 3 1.2 26.3 115.05

114
 Automatically installed stop bars, engineer operated, coupled with limit switches - interlocked with access points into areas of danger
Frequency of Exposure Duration of Exposure to Reliability of Safety Equipment Usability Human Reliability Total
hazard
Rating Notes Rating Notes Mechanical Programmable Combined Inherent design Ease of Use Total Override of Deliberate Violation Combined
Electronic Equipment Controls

Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift 3 Assumed to be 3 Considered to be 3 Assumed to be of 3 Interlocked to 36 3.5 Device is 4 Automatically 45 3 Simple 3 Does not 36 117
Maintenance bi-monthly but around 1-2 hours lower strength than lift access applied from installed means to prevent
and Inspection will vary that for a vertically points and position override access to the
according to acting prop due to the assumed that outside of lift through lift shaft or lift
the reliability of direction by which the simple shaft using an closure of roof if doors
the force is applied and command is engineers key the door opened but
components the bi-directionally required (e.g. to initiate device is
acting nature. turning of device. simple to use
engineers key Interlocked with little
etc). with roof incentive to
access and override
doors
Storage of Illicit 2 Entry likely to 4 Time spent in lift 3 Assumed to be of 3 Interlocked to 36 3.5 Interlocking 4 Automatically 45 3 Simple 1 Device easily 24 105
substances in be regular due area is unlikely to lower strength than lift access with roof installed means to overridden
lift shaft base to value of be overnight and that for a vertically points and access and override and strong
stowed is primarily for acting prop due to the assumed that doors through incentive to
material stowage and direction by which the simple closure of do so
recovery. force is applied and command is the door
the bi-directionally required (e.g.
acting nature. turning of
engineers key
etc).
Recovery of 5 Very rare 5 Time spent in lift 3 Assumed to be of 3 Interlocked to 60 3.5 Interlocking 4 Automatically 75 3 Simple 3 Little 60 195
object in base event is likely to be lower strength than lift access with roof installed means to incentive to
minimal that for a vertically points and access and override override
acting prop due to the assumed that doors through system
direction by which the simple closure of
force is applied and command is the door
the bi-directionally required (e.g.
acting nature. turning of
engineers key
etc).
Resting 4.5 Unlikely to be 2 Likely to be 3 Assumed to be of 3 Interlocked to 39 3.5 Interlocking 4 Automatically 48.75 3 Simple 1 Device easily 26 113.75
a regular event overnight lower strength than lift access with roof installed means to overridden
that for a vertically points and access and override and strong
acting prop due to the assumed that doors through incentive to
direction by which the simple closure of do so
force is applied and command is the door
the bi-directionally required (e.g.
acting nature. turning of
engineers key
etc).
Accidental fall 5 Very rare 2 Unlikely to be for 3 Assumed to be of 3 Interlocked to 42 3.5 Interlocking 4 Automatically 52.5 3 Simple 3 Little 42 136.5
event an extended lower strength than lift access with roof installed means to incentive to
period of time but that for a vertically points and access and override override
also risk of being acting prop due to the assumed that doors through system
left undiscovered direction by which the simple closure of
force is applied and command is the door
the bi-directionally required (e.g.
acting nature. turning of
engineers key
etc).
Overall Rating 3 3 42.6 3.5 4 53.25 3 2.2 37.6 133.45

115
Refuge Space
Frequency of Duration of Exposure Reliability of Safety Equipment Usability Human Reliability Total
Exposure to hazard
Rating Notes Rating Notes Mechanical Programmable Combined Inherent design Ease of Use Total Override of Deliberate Violation Combined
Electronic Equipment Controls
Rating Notes Rating Notes Rating Rating Notes Rating Notes Rating Notes Rating Notes Rating Notes
Lift 3 Assumed to 3 Considered to 5 Design of the lift 0 No interlocking 30 2.5 Refuge space 2 Unless 27 0 Not 0 Not 0 57
Maintenance be bi-monthly be around 1-2 ensures that a is ensured but marked, the applicable applicable
and Inspection but will vary hours refuge space is issues around location of the as passive as passive
according to maintained locating safe position of system system
the reliability position in a safety will not
of the timely manner be clear, but
components lift technicians
should be
suitably
trained
Storage of Illicit 2 Entry likely to 4 Time spent in 5 Design of the lift 0 No interlocking 30 2.5 Interlocking 1 Unless 21 0 Not 0 Not 0 51
substances in be regular due lift area is ensures that a with roof marked, the applicable applicable
lift shaft base to value of unlikely to be refuge space is access and location of the as passive as passive
stowed overnight and is maintained doors position of system system
material primarily for safety will not
stowage and be clear, but
recovery. potential for
area to be
identified
Recovery of 5 Very rare 5 Time spent in 5 Design of the lift 0 No interlocking 50 2.5 Interlocking 0.5 Unless 30 0 Not 0 Not 0 80
object in base event lift is likely to be ensures that a with roof marked, applicable applicable
minimal refuge space is access and unlikely to as passive as passive
maintained doors offer any system system
assistance
Resting 4.5 Unlikely to be 2 Likely to be 5 Design of the lift 0 No interlocking 32.5 2.5 Interlocking 1 Unless 22.75 0 Not 0 Not 0 55.25
a regular overnight ensures that a with roof marked, the applicable applicable
event refuge space is access and location of the as passive as passive
maintained doors position of system system
safety will not
be clear, but
potential for
area to be
identified
Accidental fall 5 Very rare 2 Unlikely to be 5 Design of the lift 0 No interlocking 35 2.5 Interlocking 0.5 Unless 21 0 Not 0 Not 0 56
event for an extended ensures that a with roof marked, applicable applicable
period of time refuge space is access and unlikely to as passive as passive
but also risk of maintained doors offer any system system
beg left assistance
undiscovered
Overall Rating 5 0 No interlocking 35.5 2.5 1 24.35 0 0 0 59.85

116
 REFERENCES

1. EN 81-1:1998 Incorporating Amendment No. 1 and Corrigendum No. 1 Safety rules for the
construction and installation of lifts - Part 1: Electric lifts.

2. EN 81-1:1977 Safety rules for the construction and installation of lifts

and service lifts Part 1: Electric lifts.

3. BS 7255:2001 Code of practice for safe working on lifts.

4. EN 81-2:1987 Safety rules for the construction and installation of lifts

and service lifts Part 2: Hydraulic lifts.

5. EN 349:1993 Safety of machinery Minimum gaps to avoid crushing of

parts of the human body.

6. DD CEN/TS 81-29:2004 Safety rules for the construction and installation of lifts Lifts for
the transport of persons and goods Part 29: Interpretations related to EN 81-20 up to EN 81-
28 (includes EN 81-1:1998 and EN 81-2:1998) ICS 91.140.90.

7. EN 81-1:1985 Safety rules for the construction and installation of lifts

and service lifts Part 1: Electric lifts.

8. Lifts directive 84/529

9. EN 81-2:1998 Incorporating Amendment No. 1 and Corrigendum No. 1 Safety rules for the
construction and installation of lifts Part 2 : Hydraulic lifts.

10. prEN 81-21:2006 Safety rules for the construction and installation of lifts Lifts for the
transport of persons and goods Part 21: New passenger and goods
passenger lifts in existing buildings.

11. ISO 41901:1999 Lift (US: Elevator) installation Part 1: Class I, II, III and VI lifts.

12. DD ISO/TS 22559-1:2004 Safety requirements for lifts (elevators) Part 1: Global safety
requirements (GESR's) for lifts (elevators).

13. ASME A17.12004 safety code for elevators and escalators.

14. EN 81-71:2005 Safety rules for the construction and installation of lifts - Particular
applications to passenger lifts and goods passenger lifts - Part 71: Vandal resistant lifts.

15. EN 13015:2001 Maintenance for lifts and escalators Rules for maintenance
instructions.

16. PD ISO/TR 11071-1:2004 Comparison of worldwide lift safety

standards Part 1: Electric lifts (elevators).

17. Department of Trade and Industry, ADULTDATA: The handbook of adult anthropometric
and strength measurements, 1998, DTI/Pub 2917/3k/6/98/NP.URN 98/736

117
18. EN 954-1:1997, Safety of machinery - Safety related parts of control systems - Part 1.
General principles for design.

19. EN 61508-1:2002, Functional safety of electrical/electronic/programmable electronic

safety-related systems Part 1: General requirements.

20. EN 61508-2:2002, Functional safety of electrical/electronic/programmable electronic

safety-related systems Part 2: Requirements for electrical/electronic/programmable electronic
safety-related systems, BSI Standards.

21. EN 61508-3:2002, Functional safety of electrical/electronic/programmable electronic

safety-related systems Part 3: Software requirements, BSI Standards.

22. EN 61508-4:2002, Functional safety of electrical/electronic/programmable electronic

safety-related systems Part 4: Definitions and abbreviations.

23. EN 61508-5:2002, Functional safety of electrical/electronic/programmable electronic

safety-related systems Part 5: Example of methods for the determination of safety integrity
levels.

24. EN 61508-6:2002, Functional safety of electrical/electronic/programmable electronic

safety-related systems Part 6: Guidelines on the application of IEC 61508-2 and IEC 61508-
3.

25. EN 61508-7:2002, Functional safety of electrical/electronic/programmable electronic

safety-related systems Part 7: Overview of techniques and Measures.

118
 BIBLIOGRAPHY

Janovsk, Lubomr Elevator mechanical design, third edition. Published by Elevator World,
Inc. ISBN 1 886 536 26 0

Barney, G. C, Cooper, D. A, Inglis, J, Elevator and Escalator Micropedia IAEE Publications.

ISBN 0 9525696 1 2

119