Modern lift safety: confusing lift standards could be dangerous
Accidents with lifts are extremely rare, but confusing standards and ever more complex elevator systems mean that lift safety could be heading in the wrong direction, explains E&T.
When a lift in London's Tower Bridge dropped several feet to the ground on 11 May, it injured some of its passengers and sparked a major alert. Police, the fire brigade, ambulance crews and a "hazardous area response team" were rushed to the scene and the bridge itself had to be closed, causing major disruption to traffic.
Thankfully, in terms of actual injuries, the accident was comparatively minor - a few broken limbs and some bruising among the 15 or so passengers. However, it generated national - and in some quarters rather dramatic - media coverage.
Needless to say, if it had been a road accident it might just about have made it into the local paper. The difference with lifts is that such accidents are extremely rare.
"It's almost the case that lift accidents make the news precisely because they are so rare," says Richard Hulmes, chief executive of the Safety Assessment Federation (SAFed), whose members are responsible for about 90 per cent of lift inspections in the UK each year.
Official figures bear him out. According to the Health and Safety Executive (HSE), since 2002 there have been nine reported fatal injuries - five of which were to members of the public and two to lift engineers - and 114 non-fatal injuries. To put that it context, there are about 300,000 lifts in the UK, and according to the Lift and Escalator Industry Association (LEIA), which represents the installers and designers, about 40 per cent of them are more than 20 years old. "Statistically, lifts are the safest mode of transport," says a LEIA spokesman.
It's a safety record even the airline industry would envy, and is due in large part to the veritable scaffold of regulations and standards taking in their design and installation to inspection, certification and maintenance.
Across Europe, lift safety has been governed since 1997 by the overarching Lifts Directive, which "covers new lifts permanently installed in buildings and constructions for carrying passengers or passengers and loads." It also covers safety components and the installation of lifts. In the UK, the directive is enacted by the Lift Regulations 1997.
Existing lifts - those installed before the directive came into force - are subject to national regulations. In the UK, and depending on their use, that means the Health and Safety at Work etc Act 1974. Where the lift is used in connection with work, the Lifting Operations and Lifting Equipment Regulations 1998 (LOLER) and the Provision and Use of Work Equipment Regulations 1998 (PUWER) apply. SAFed provides a supplement here, called LG1, which includes guidance on non-workplace lifts.
Under LOLER, if you are a lift owner or someone responsible for the safe operation of a lift used at work, such as a facilities manager or supervisor, you are a 'dutyholder'. This means you have a legal responsibility to ensure the lift has a regular and thorough examination so that it is safe to use. If the lift is used primarily by the public, LOLER is there to help lift owners comply with the more general health and safety legal duties under the Health and Safety at Work etc Act.
A thorough examination has to be carried out by a competent person, most of whom are SAFed members, and is required to detect any defects that are or might become dangerous. The competent person will of course be looking at the safety components in a lift, and the EC directive defines these as consisting of:
- devices for locking landing doors;
- devices to prevent the car from falling or unchecked upward movements;
- overspeed limitation devices;
- energy-accumulating shock absorbers - either non-linear or with damping of the return movement - and energy-dissipating shock absorbers;
- safety devices fitted to jacks of hydraulic power circuits where these are used as devices to prevent falls, and;
- electric safety devices in the form of safety switches containing electronic components.
For passenger lifts, these examinations have to take place at least every six months or in accordance with an examination scheme drawn up by the competent person. The scheme may specify periods which are different from the statutory intervals, but the HSE says this must be based on a rigorous assessment of the risks.
If any defects are found, the competent person must report them to the dutyholder and, if appropriate, the enforcing authority - more often than not the relevant local authority, not the HSE - so that appropriate remedial action can be taken.
"The reason there are so few accidents," says Hulmes, "is that, of the 270,000 inspections our members carry out each year, they find only about 14,000 defects, and these are rectified before an accident can happen."
The onus here though is still on the lift owner. Although the competent person must notify the owner of any dangerous or possibly dangerous defects, only the owner can take the lift out of service. And even if no such defects are found, the lift can only be said to be safe at the time of the examination, so the owner still has to arrange for regular inspections and maintenance.
As well as the regulations there are the safety standards, principally the 40 or so EN81 specifications, which cover the spectrum of lift types - electric, hydraulic, screw, and rack and pinion for example - and the rules for their construction, installation and maintenance, as well as aspects such as remote alarms, resistance to vandalism and their behaviour in the event of a fire.
"They're a bit of a minefield," concedes Dr Gina Barney, an independent consultant who also serves on various British Standards Institution lifts committees. "But then lifts are complicated, and the last line of defence is the safety devices."
ThyssenKrupp twin elevator
And lifts are becoming more complicated all the time. For example, ThyssenKrupp Elevator has a system called the Twin that runs two independent cabs in a single shaft. Designed for use in buildings more than 50m high, the Twin is set up like an express shuttle service, transporting more passengers more quickly and with fewer stops on the way than a conventional cab.
The two cars are arranged one above the other at a set distance depending on their speeds. But they can also move in different directions, so of course they can move towards each other.
Control-wise, this has created a need for what is called programmable electronic systems in safety-related applications for lifts - PESSRALs - and these are worrying some people in the industry. Because they're based on the EN 61508 functional safety standard for programmable safety-related systems they are subject to its Safety Integrity Level (SIL) scheme, which indicates the probability of failure of the safety function and the degree of redundancy. The levels go from 1 to 4; lift safety components go up to level 3 while those in power stations, for example, go up to level 4.
PESSRALs and EN81-1/A1
PESSRALs now have their own specific standard, EN81-1/A1, and this, according to Dr Barney, is where the trouble starts. "If you look at the standard, you'll see it's very complicated. Because these systems are computer-based, the standard is full of terms like 'galloping pattern test' and the use of a 'watchdog', which the average lift mechanic simply wouldn't understand. And yet a system like the Twin couldn't work without a PESSRAL," she says.
"Also, now we've got this standard, companies can design a PESSRAL to it, but no one can check if a company has got it right - and even if they could check it there's no way of telling whether the system could be changed. That said, however, the nuts and bolts of a PESSRAL are less important than the standards and regulations for them."
But Alan John, a lift consultant at Dunbar and Boardman, holds a contrasting view. "The design of the system would be checked by a notified body, and the system's protection software is 'hardwritten' into it anyway, so its settings can't be changed," he says. He also points out that there will always be a place for traditional lift mechanics, and that systems like the Twin also come with comprehensive diagnostics and redundancy - they have to, the standards demand it.
You can liken the issue to modern cars and fly-by-wire systems. If you take your car for a service, you'll expect "traditional" things like the brakes to be checked, yet also that the engine and its management unit will be given the once-over to make sure it's properly tuned. And as with FBW systems, which for example use multiple but different software systems to control the same subsystem, the latest lifts have software systems that cross-check one another, and they also use multiple hardware-based subsystems such as fibre optics and barcode scanners to perform the same safety task.
As in other safety-related settings, the development of standards in the lift industry tracks the development of the technology, something the SIL scheme for example is designed to address. "And the SIL provision in the standard shows that we're moving forward in the correct way," says John.
Or should that be moving upward?