Reducing Risk

Codes and standards provide a roadmap for maintenance and inspection as protective measures.

This article was first presented at the 2019 International Elevator and Escalator Symposium in Las Vegas. For more information on December 7-8, 2020’s event in Amsterdam and to participate, visit www.elevatorsymposium.org

Maintenance and inspection have been recognized for many years as essential functions to ensure the safety of elevators and escalators. It is acknowledged that safety is a quality that can be continuously improved with the passage of time, although there is always an element of risk inherent in any device or system. Risk is a complex entity that is difcult to quantify; however, the need for structured processes aimed at assessing and reducing risk has gained momentum over the years. ISO 14798 Lifts (elevators), escalators and moving walks — Risk assessment and risk reduction methodology has become widely used in the elevator industry on a global basis. This methodology has many applications in design, development and ongoing use of elevator equipment. It entails the identifcation of hazardous situations, the causes of harmful events, the assessment of risk and the implementation of protective measures to sufciently mitigate risk. The main objective of this article is to show how maintenance and inspection may be used as protective measures and thus serve as a means of risk reduction using the ISO 14798 risk assessment process through the lifecycle of elevator equipment. ISO 14798 is currently being revised to enhance its use in addressing the safety of existing elevators and escalators and the application of maintenance and inspection protocols for risk-reduction purposes. CEN EN 13015 Maintenance for lifts and escalators — Rules for maintenance instructions recommends the use of risk assessment in developing procedures and priorities for maintenance. Specifc requirements have been included in many elevator and escalator safety standards, such as the ASME A17/CSS B44 series of documents. Risk assessment can be used as a tool to supplement established maintenance and inspection criteria, thus enhancing overall safety.

Introduction

It has become universally accepted that equipment of all types requires maintenance and service to assure reliability of operation and safety to the user. Inspection is also recognized as a vital part of the process of assuring reliability and safety. While reliability and safety are linked, each of these important aspects has its own attributes and consequences.

Reliability of operation is an important criterion during the design and development phase of typical products. Moreover, the impact of failure on safety is a vital concern. Thus, it is a common approach to ensure safety by building redundancy, margins of safety and inherent failsafe operation into the design of products.

Maintenance and inspection are required to ensure that the design aspects upon which reliable, safe operation depends are, in reality, efective. Maintenance and inspection, in efect, reduce the overall risk of a product not operating as intended or failing in an unsafe manner. These functions thus play an essential role in the overall risk-assessment process, which is intended to assure that risk has been sufciently mitigated.

In the elevator industry, the role of maintenance and inspection is well established. Comprehensive standards for maintenance and inspection have been developed and are being deployed in many parts of the world. In North America, the ASME A17.1/CSA B44 Safety Code for Elevators and Escalators^[1] is the baseline standard for elevator equipment safety. A17.1/B44 Section 8.6: Maintenance, Repair, Replacement and Testing is widely used. In addition, the same standard provides requirements for Acceptance Inspections and Tests (Section 8.10) and Periodic Inspections and Witnessing of Tests (Section 8.11). Recommended inspection and test interval guidelines are elaborated in Appendix N. Additional guidance is provided for users of A17.1/B44 in the ASME A17.2 Guide for Inspection of Elevators, Escalators and Moving Walks.^[2] Many AHJs in North America have adopted A17.1/B44 into regulation. The maintenance and inspection requirements described in the code thus become enforceable by law in the subject jurisdictions. It is also worthy of note that A17.1/B44 requires all inspections be performed by elevator inspectors qualifed according to the ASME QEI-1 Standard for QEIs.^[3]

Another important standard that addresses maintenance is CEN EN 13015 Maintenance for lifts and escalators — rules for maintenance instructions.[4] This standard recommends the use of risk assessment in developing procedures and priorities for maintenance.

Reliability and Safety

To gain more insight into the need for overall risk reduction, it is constructive to review the elements of reliability. Reliability is, essentially, the degree to which something can be depended upon. Viewed another way, reliability is the probability of the item not failing, thus being available for the purpose intended.

Reliability is, by its very nature, a function of time. Thus, the reliability of a component, device or system varies over time with use. The dependence of reliability upon time is often illustrated by the probability of failure versus time function (Figure 1). The function is usually referred to as a “bathtub curve” due to its shape resembling the profle of a longitudinal section through a typical bathtub. The function exhibits three distinct phases. The frst phase is known as “early failure” or “infant mortality.” This phase is characterized by a high initial failure rate that rapidly declines in a relatively short interval of time. The early failures are due to defective parts, improper installation, improper adjustment, etc. Such failures generally occur during the “breaking-in” or “running-in” phase of new product use. The time duration of the early failure period can be signifcantly reduced by efective quality-assurance  processes, pre-testing and rigorous feld training of installing technicians. Pre-testing of electronic components includes such methods as stressing devices under constant operating conditions, power cycling, temperature cycling, vibration, testing at the thermal destruct limits and highly accelerated stress and life-testing. Nevertheless, some degree of early failure is often present.

The second phase of the function is known as “random failure” or “useful life period.” As the product matures, the failure rate becomes nearly constant and is generally very low. Failures occur randomly due to miscellaneous causes. Such causes include, but are not restricted to, failure of the weaker items and foreseeable misuse, which may be envisaged but cannot be efectively predicted on a time scale. Robust design, comprehensive quality-assurance protocols, well-orchestrated installation, consistent maintenance and inspection can all help to extend the useful life period substantially.

The third phase of the function is known as the wear-out period. As components begin to fatigue or wear out, failures occur at increasing rates. Wear-out in industrial electronic devices is usually caused by the breakdown of electrical components that are subject to physical wear and electrical and thermal stress. For mechanical parts, wear of adjacent moving surfaces, fatigue of components subject to cyclic stress, corrosion, fretting, etc., are common. Maintenance and inspection are efective in delaying and extending the wear-out phase, by replacing, adjusting, lubricating components as needed and checking that this work has been correctly executed.

Safety and reliability are inseparable. In conducting a risk assessment, it is essential that the reliability of safety-critical functions is considered. It is also necessary that the safety- related efects of operational reliability are addressed.

Safety-Critical Functions

It is imperative that the reliability of safety-critical functions be assessed and that backup systems or processes are available to address the failure of the primary safety means. Efective maintenance and inspection can alleviate potential failures of the primary safety means and thus reduce the incidence of possible injuries and entrapments, while assuring the availability of the elevator. Moreover, efective maintenance and inspection are crucial to ensure safety in the event of primary safety-system failure or malfunction. The major elevator codes, such as A17.1/B44, CEN/EN 81-20 Safety rules for the construction and installation of lifts — Lifts for the transport of persons and goods — Part 20 Passenger and goods passenger lifts^[4]; CEN/EN 81-50 Safety rules for the construction and installation of lifts — Examinations and tests — Part 50 Design rules, calculations, examinations and tests of lift components^[5]; ISO 8100-1 Safety rules for the construction and installation of lifts — Lifts for the transport of persons and goods — Part 1: Passenger and goods passenger lifts^[6]; ISO 8100-2 Safety rules for the construction and installation of lifts — Examinations and tests — Part 2 Design rules, calculations, examinations and tests of lift components^[7]; etc., provide safety requirements for primary, as well as backup, safety systems. However, all major codes assume efective maintenance and inspection are being routinely performed.

Safety-critical functions include ensuring the doors are closed before and during elevator motion and protection in the event of overspeed, loss of suspension, brake failure, etc. As an example, the following scenario may be considered.

Due to improper adjustment and lack of maintenance, the driving machine braking surfaces are worn out to the point that the brake alone is incapable of holding a lightly loaded elevator against the upward force applied to the car by the counterweight. The elevator is kept in position at the landing by the control system. If the power fails, or a controller failure occurs while passengers are entering or exiting the car at a landing, the elevator car could ascend rapidly and injure passengers at or near the entrance to the car. Clearly, poor maintenance is the root cause of this scenario, and, indeed, applicable code requirements have been violated. Nevertheless, such events have occurred with tragic results. Major standards- development organizations, such as ASME, CSA, CEN and ISO, have implemented additional safety requirements in their relevant standards to prevent such occurrences. Such requirements involve the provision of an independent emergency brake actuated by means separate from the normal operating and control systems. While such means provide an additional layer of safety, they should not be considered a substitute for comprehensive, systematic maintenance and inspection. It should be noted that secondary safety devices in critical safety functions can certainly prevent serious injuries or death but can still result in minor injuries, entrapment of passengers and loss of elevator use. Suitable maintenance and inspection are the most efective means of reducing overall risk.

Operational Reliability

There are many aspects of elevator operation not directly connected to safety. For example, if an elevator ignores a hall call or skips foors for which a call has been registered, this is primarily an inconvenience to the passengers, rather than a safety issue. If an elevator is stalled in a hoistway, away from a landing, passengers entrapped within are generally safe, from a primary injury viewpoint. However, some people are subject to the occurrence of cleithrophobia, which is the fear of being trapped and not being able to escape. Cleithrophobia is diferent from claustrophobia, which is the fear of confned spaces. People subject to cleithrophobia may willingly enter a confned space as long as they are able to vacate the space at will. If an elevator is stalled and such people cannot exit, an intense anxiety attack can occur. This can lead to a strong physical and psychological reaction, and subsequent injury to the person.

While all potential causes of elevators stalling in hoistways cannot be prevented, many of those caused by operational malfunction can be addressed by a rigorous maintenance and inspection protocol.

It should also be noted that there is a secondary efect to the non-availability of elevators due to operational malfunction. The crowding of elevator lobbies while waiting for the remaining operating elevators, when one or more have been taken out of service, can lead to unsafe conditions. In the same way, people crowding elevators when one comes can also lead to injuries due to jostling and aggression between passengers. Overloaded elevators are usually programmed to remain at the landing; this causes further delay and adds to the overcrowding in the lobbies. A further risk is that people unaccustomed to physical exertion may take the stairs to avoid waiting for elevators in crowded hallways. Such people may sufer unexpected health issues in the process. Again, suitable maintenance and inspection routines can help keep elevators operational and thus reduce overall risk.

A further consideration relating to operational reliability pertains to the use of elevators for evacuation purposes during emergencies. There has been a trend in recent times to construct increasingly tall buildings in many parts of the world. This trend is expected to continue for the foreseeable future, so the role of elevators in evacuating persons at higher foors during an emergency is a relevant issue. It is well recognized that egress by solely using the staircases is inadequate and can be dangerous, particularly for people who are unaccustomed to physical exertion. The International Building Code ^[8] encourages the use of Occupant Evacuation Operation (OEO) for tall buildings. It allows the provision of two staircases, instead of three, if OEO is installed in the building. A17.1/B44 provides requirements for OEO. Clearly, if elevators are to be used during emergency evacuation, reliability is absolutely essential. Efective maintenance and inspection are key factors in enhancing reliability and, hence, reducing overall risk.

Maintenance and Inspection as Mitigation Factors in Risk Assessment

ISO 14798 Lifts (elevators), escalators and moving walks — Risk assessment and reduction methodology^[9] is widely used around the world for risk assessment of elevator equipment. The development of the ISO 14798 methodology and its use is comprehensively described in the paper, “The role of risk assessment in innovative product development.”^[10] As discussed in that paper, one of the important aspects of risk reduction is to follow a hierarchy of risk mitigations. The hierarchy consists of three sequential major courses of action in risk reduction: the frst is to try to eliminate the hazard by design. If this is not possible, the second course is to guard or protect against the hazard. If this does not yield a sufcient reduction of risk, the third course of action is to warn of the residual risks and, if appropriate, to utilize protective gear.

It is often infeasible to eliminate hazards by design. This is particularly true when the hazard is directly related to the function of the device or system. For example, the function of an elevator is to transport passengers and freight from one level to another. The height of the elevator above ground level is a hazard, as the elevator could fall and thus cause harm. However, if the height is eliminated, the elevator can no longer fulfll the function for which it was intended. But, there are many subsystems and components in an elevator that are not directly connected with the prime function of the elevator. In these cases, the hazard may be eliminated without rendering the elevator dysfunctional. For example, excessive space between the car doors and the landing doors is an entrapment hazard. The excessive space is not essential to the function of the elevator and can be eliminated. Functional analysis engineering may be benefcently applied to help determine the actual function of components and subsystems.^[11]

Guarding against hazards, or protecting people from hazards, is a widely used course of action in risk reduction. Such protections include walls of the elevator car that prevent passengers from falling of the platform, locked panel covers that prevent passengers from contacting electrical equipment, handrails that help to stabilize passengers in elevators and isolated machinery spaces. Maintenance and inspection are powerful actions that guard against the malfunction of elevators and, hence, are instrumental in reducing risk. In general, maintenance and inspection are applied as essential elements of mitigation in conjunction with other forms of guarding in the risk-assessment process. This is further elaborated by way of example in the next section of this article.

The third course of action in risk reduction is to warn of residual risks and provide protective gear where appropriate. The latter is applicable to worker safety, which is addressed in the heading “Risks to Personnel Performing Maintenance and Inspections.” The former is particularly applicable when guarding does not sufciently mitigate the risks. Warnings can be in the form of visual and/or audible alarms. Examples include intermittent beeping when the door dwell time has been exceeded and the elevator is being excessively delayed and illuminated visual and audible signals required on elevators during Phase I Emergency Recall Operation, per A17.1/ B44. It must be emphasized that warnings are not intended to be substitutes for hazard elimination or guarding against hazards. Rather, they are additional means to be applied when excessive residual risk remains.

Risk-Assessment Example Pertaining to Suspension-Means Failure as a Result of Lack of Maintenance and Inspection

A hypothetical example has been constructed to illustrate a failure scenario that can occur if maintenance and inspection are not conducted. The example assumes A17.1/B44 is in force in the region of the incident, but that code-required inspection and periodic maintenance have not been applied. The example could equally apply, in principle, to any jurisdiction around the world. The loss of suspension means as a result of neglect of maintenance and inspection has been specifcally chosen, as failures of suspension means are rare, and, when they do occur, they are usually the result of this type of lack of care.

For the purpose of the example, it is assumed that the elevator was designed, manufactured and installed compliant with the relevant editions of A17.1/B44 and A17.6-2010 Standard for Elevator Suspension, Compensation, and Governor Systems [15]. Moreover, it is assumed that the elevator was compliant with the “Acceptance Inspection” requirements of A17.1/B44. Once an installation is handed over to the building owner, and the terms of the contract fulflled, the owner of the building is responsible for the safe operation of the elevator. In general, the owner will engage a reputable maintenance company that will ensure the elevator equipment remains safe. Most jurisdictions require periodic inspection of elevators as part of their regulations.

However, this is not always the case, and it is possible in some circumstances that an elevator is neither maintained nor inspected for lengthy intervals after handover to the building owner. When this is the case, items such as steel wire ropes (SWRs) that are subject to wear, fretting and corrosion can become vulnerable to eventual failure. The example given is intended to illustrate that, if the elevator is maintained as prescribed in the code, the suspension means will have been replaced long before becoming vulnerable to failure. Moreover, if the suspension means are inspected as required by code, deterioration will be noticed, and the building owner will be ordered to take appropriate action.

The methodology of ISO 14798 is employed in this example, and the risk-assessment template (Table A.1 of ISO 14798) is utilized (Figure 2). The risk estimation and evaluation charts (Tables D.1 and D.2 of ISO 14798) are also used in this example (Figures 3 and 4).

Risks to Personnel Performing Maintenance and Inspection

Elevators and escalators are potential sources of serious injuries and deaths to the general public and to the workers installing, repairing, maintaining and inspecting them.

Workers are also at risk when cleaning elevator shafts, conducting emergency evacuations of stalled elevators or performing construction work near open shafts. It is, indeed, a sad irony that the members of society most closely engaged with ensuring the safety of the public at large are themselves highly vulnerable to elevator- and escalator-related accidents.

According to the U.S.-based Center for Construction, Research and Training, there is an upward trend in elevator- related fatalities in construction, as the number of deaths and rate of deaths per 10,000 workers has doubled from 2003 to 2016.^[12] The same organization reports that, between 2011 and 2016, 145 construction workers died due to elevator-related injuries, accounting for more than half of such fatalities in all industries in the U.S. The majority (53.5%) of elevator-related fatalities in construction were caused by falls to a lower level — nearly half of which (48%) were falls from 10 m or more. Other major causes of fatalities are crushing, being struck by moving objects and electrocution.

Unlike fatalities, elevator-related nonfatal injuries in construction generally declined from 380 in 2003 to 280 in 2016. While some improvement has been made, it is clear that far too many dedicated, hardworking individuals are still being injured or killed.

Much has been done over the years by the elevator industry to counter work-related fatalities and injuries. Organizations such as the National Elevator Industry Educational Program ofer training programs for apprentices and journeymen in safe elevator construction and maintenance. The Elevator Industry Field Employees’ Safety Handbook^[13] is intended to provide safety information and practices that workers can use to help prevent injuries resulting from unsafe acts and/or conditions.

Another important organization is OSHA, which provides numerous safety regulations and standards for workers in all industries. OSHA, an agency of the U.S. Department of Labor, also ofers training programs designed to enhance worker safety.

While training is a major method for improving worker safety, the provision and use of suitable protective equipment is essential. Thus, protective gear, such as fall-protection equipment, ofcial jumpers for electrical troubleshooting and protective clothing are important to enhance feld-worker safety.

Risk assessment can play an important role in contributing to worker safety. CEN EN 13015 provides an excellent approach to the application of risk assessment to the maintenance of elevators. Some of the important issues highlighted by this standard are:

• The necessity of determining the various intervention procedures in executing maintenance and ascertaining the relevant safety measures for each procedure
• The use of remote monitoring and remote diagnostic methods for fault fnding, which reduce the direct exposure of workers to hazards. (See also EN 627 Specifcation for data logging and monitoring of lifts, escalators and passenger conveyors,^[14] which provides further information on methodologies for remote monitoring.)
• The provision of safety measures and instructions that can help ensure safe maintenance
• The need to compile a list of hazards for any working area to be accessed and a risk assessment carried out to address all hazards. The following should be considered in this process: the presence of one or more personnel, foreseeable action by persons not directly involved in the maintenance activity and possible states of the installation (e.g., normal or abnormal state due to foreseeable failures of components).
• The need for particular attention to hazards that result from the intentional bypassing of safety functions for diagnostic purposes
• The essential need for maintenance workers to be made aware of residual risks when working on the equipment. This can be in the form of warning signs, safety instruction and training.
• Specifcation of personal protective equipment, tools and procedures to safely carry out all maintenance operations
• Annex B of EN 13015, which provides a comprehensive list of elements to be considered in preparation for and during maintenance of elevators and escalators

ISO 14798 can be used as a valid methodology for risk assessment in maintenance and inspection activities. It should be noted that ISO 14798 is currently under review, and it is anticipated that a future edition will include specifc procedures for risk assessment of maintenance activities, as well as relevant examples, to guide users.

Concluding Thoughts

Safety and reliability of elevator and escalator equipment are strongly linked, and it is important to review them holistically. The maintenance and inspection of elevator equipment is imperative to assure safety of the general public. It is thus essential that this important aspect of safety receives the visibility necessary at all levels so as to ensure it is carried out rigorously. Risk assessment is a viable tool that may be used to ensure that all relevant hazards have been identifed and that all applicable risks have been sufciently mitigated.

ISO 14798 is a powerful methodology for addressing and mitigating risk. It has been used for many years and is well- established in the industry worldwide. It is currently being revised to enhance its value and overall applicability, and to provide more guidance to users. The safety of workers in construction, maintenance and inspection of elevators is of paramount importance. Such workers are more vulnerable to hazardous situations than is the general public, due the inherent nature of their work responsibilities. Risk assessment can be used as an efective tool to enhance the safety of these vital personnel. As new techniques of fault identifcation, such as remote monitoring, become more prevalent, it will become more feasible to predict and prevent faults from locations other than the jobsite. This will help enhance the safety of workers and the public as a whole.

References

[1] ASME A17.1-2019/CSA B44-19: Safety Code for Elevators and Escalators.
[2] ASME A17.2-2017 Guide for Inspection of Elevators, Escalators and Moving Walks.
[3] ASME QEI-1 2018 Standard for the Qualifcation of Elevator Inspectors.
[4] CEN EN 81-20: 2014 Safety rules for the construction and Installation of lifts — Lifts for the transport of persons and goods — Part 20: Passenger and goods passenger lifts.
[5] CEN/EN 81-50: 2014 Safety rules for the construction and installation of lifts — Examinations and tests — Part 50 Design rules, calculations, examinations and tests of lift components.
[6] ISO 8100-1: 2019 Safety rules for the construction and installation of lifts
— Lifts for the transport of persons and goods — Part 1: Passenger and goods passenger lifts.
[7] ISO 8100-2: 2019 Safety rules for the construction and installation of lifts
— Examinations and tests — Part 2 Design rules, calculations, examinations and tests of lift components.
[8] IBC 2018 International Code Council (ICC).
[9] ISO 14798:2009: Lifts (elevators), escalators and moving walks — Risk assessment and reduction methodology.
[10] Bialy, Louis. “The role of risk assessment in innovative product development” Proceedings of International Elevator and Escalator Symposium 2018, Istanbul, November 2018.
[11] Bartolomei, J.E. and Miller, T. “Functional Analysis Systems Technique (F.A.S.T), a Group Knowledge Elicitation Method for Model Building,” U.S. Air Force, Wright-Patterson Air Force Base, 2002.
[12] Xiuwen Sue Dong, Xuanwen Wang and Katz, Rebecca. “Deaths and Injuries Involving Elevators and Escalators in Construction and the General Population.” Center for Construction, Research and Training, December 2018.
[13] Elevator Industry Field Employees’ Safety Handbook, Elevator World, Inc., 2015.
[14] CEN EN 627:1996 Specifcation for data logging and monitoring of lifts, escalators and passenger conveyors.
[15] ASME A17.6-2010 Standard for Elevator Suspension, Compensation, and
Governor Systems.