ISO/TS 14798:2006

TECHNICAL ISO/TS
SPECIFICATION 14798
Second edition
2006-02-01
Lifts (elevators), escalators and moving
walks — Risk assessment and reduction
methodology
Ascenseurs, escaliers mécaniques et trottoirs roulants — Méthodologie
de l'évaluation et de la réduction du risque

Reference number
©
ISO 2006
PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but
shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In
downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat
accepts no liability in this area.
Adobe is a trademark of Adobe Systems Incorporated.
Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation
parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In
the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below.

©  ISO 2006
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO 2006 – All rights reserved

Contents Page
Foreword. iv
Introduction . v
1 Scope .1
2 Terms and definitions .1
3 General principles.3
4 Risk analysis procedure .5
5 Step 6 — Risk evaluation .15
6 Step 7 — Has the risk been sufficiently reduced? .15
7 Reduction of risk — Protective measures .16
8 Documentation.16
Annex A (normative) Risk assessment template.18
Annex B (informative) Quick references to hazards (Table B.1), hazardous situations (Table B.2),
causes (Table B.3), effects (Table B.4) and harm (Table B.5) .19
Annex C (normative) Estimation of risk elements — Severity and probability (see 4.5).23
Annex D (normative) Risk estimation and evaluation.24
Annex E (informative) Role of the team moderator .26
Annex F (informative) Examples of a risk assessment and protective measures .30
Bibliography .35

Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies
(ISO member bodies). The work of preparing International Standards is normally carried out through ISO
technical committees. Each member body interested in a subject for which a technical committee has been
established has the right to be represented on that committee. International organizations, governmental and
non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the
International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of technical committees is to prepare International Standards. Draft International Standards
adopted by the technical committees are circulated to the member bodies for voting. Publication as an
International Standard requires approval by at least 75 % of the member bodies casting a vote.
In other circumstances, particularly when there is an urgent market requirement for such documents, a
technical committee may decide to publish other types of normative document:
⎯ an ISO Publicly Available Specification (ISO/PAS) represents an agreement between technical experts in
an ISO working group and is accepted for publication if it is approved by more than 50 % of the members
of the parent committee casting a vote;
⎯ an ISO Technical Specification (ISO/TS) represents an agreement between the members of a technical
committee and is accepted for publication if it is approved by 2/3 of the members of the committee casting
a vote.
An ISO/PAS or ISO/TS is reviewed after three years in order to decide whether it will be confirmed for a
further three years, revised to become an International Standard, or withdrawn. If the ISO/PAS or ISO/TS is
confirmed, it is reviewed again after a further three years, at which time it must either be transformed into an
International Standard or be withdrawn.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO shall not be held responsible for identifying any or all such patent rights.
ISO/TS 14798 was prepared by Technical Committee ISO/TC 178, Lifts, escalators and moving walks.
This second edition cancels and replaces the first edition (ISO/TS 14798:2000), which has been technically
revised.
iv © ISO 2006 – All rights reserved

Introduction
After the first edition of this Technical Specification had been published in 2000, with Resolutions 169/1999
and 186/2001, the Technical Committee ISO/TC178 requested the users of ISO/TS 14798 and the Committee
members to report on the use of the document with comments and proposals for any improvements to be
considered in a revision within 3 years.
Having received numerous comments and proposals, the Technical Committee ISO/TC178 decided, with
Resolutions 186/2001 and 209/2002, to revise ISO/TS 14798 in response to the comments and proposals,
with a proviso that the revised document does not change the concept and principles of the original Technical
Specification.
The objective of this Technical Specification is to describe principles and set procedure for a consistent and
systematic risk assessment methodology relevant to lifts (elevators), escalators, moving walks (“lifts” for short).
The risk analysis and assessment principles and process described in this document may, however, be used
for assessment of risk relevant to equipment other than lifts.
This risk assessment methodology is a tool used to identify risk of harm resulting from various hazards,
hazardous situations, and harmful events. Knowledge and experience of the design, use, installation,
maintenance, incidents, accidents, and related harm are brought together in order to assess the risk during all
1)
phases of the life of lifts (elevators), escalators, and moving walks (hereafter referred to as “lifts”), from
design and construction up to decommissioning. The users of the methodology do not make medical
judgments but, rather, evaluate events that can possibly lead to levels of harm defined in this document. By
itself, this Technical Specification does not provide a presumption of conformity to any safety requirements for
lifts, including those noted in Clause 1.
NOTE Risk assessment is not an exact science, as there is a certain degree of subjectivity in the process.
It is recommended that this Technical Specification be incorporated into training courses and manuals so as to
provide basic instructions on safety aspects to those involved in
⎯ assessing designs, operations, testing, and use of lift equipment; and
⎯ writing specifications or standards incorporating safety requirements for lifts.
Clause 3 describes the concept of safety and risk assessment. Clause 4 describes the procedure of risk
analysis, including risk estimation. The procedure for risk evaluation is set out in Clause 5 and for assessment
in Clause 6. Clause 7 deals with protective measures. Clause 8 specifies relevant documentation. Annexes A,
C, and D form a normative part of this Technical Specification. Annexes B, E, and F are for information only.

1) Hereinafter in this ISO/TS 14798, the term “lift” is used instead of the term “elevator”. In addition, the term “lift” is also
used instead of the terms “lifts, elevators, and moving walks”.
TECHNICAL SPECIFICATION ISO/TS 14798:2006(E)

Lifts (elevators), escalators and moving walks —
Risk assessment and reduction methodology
1 Scope
This Technical Specification establishes general principles and specific procedures for assessing risk.
The purpose of this Technical Specification is to provide a process for making decisions relevant to the safety
of lifts during the
⎯ design, construction, and installation of lifts, lift components, and systems;
⎯ developing generic procedures for the use, operation, testing, compliance verification, and servicing of
lifts; and
⎯ development of technical specifications and standards affecting the safety of lifts.
While examples in this document refer primarily to risks of harm to persons, the risk assessment procedure
set out in this document can be equally effective for assessing other types of risks relevant to lifts, such as the
risk of damage to property and environment.
2 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
2.1
cause
circumstance, condition, event or action that in a hazardous situation contributes to the production of an effect
2.2
effect
result of a cause in the presence of a hazardous situation
2.3
harm
physical injury or damage to the health of people, or damage to property or the environment
[ISO/IEC Guide 51:1999, 3.3]
2.4
harmful event
occurrence in which a hazardous situation results in harm
[ISO/IEC Guide 51:1999, 3.4]
NOTE In this document, the term “harmful event” is interpreted as a combination of “cause” and “effect”.
2.5
hazard
potential source of harm
NOTE The term “hazard” can be qualified in order to define its origin or the nature of the expected harm (e.g., electric
shock hazard, crushing hazard, cutting hazard, toxic hazard, fire hazard, and drowning hazard).
[ISO/IEC Guide 51:1999, 3.5]
2.6
hazardous situation
circumstance in which people, property, or the environment are exposed to one or more hazards
[ISO/IEC Guide 51:1999, 3.6]
2.7
life cycle
period of usage of a component or a lift system
2.8
protective measure
means used to reduce risk
NOTE Protective measures include risk reduction by inherently safe design, protective devices, personal protective
equipment, information for use and installation, and training
[ISO/IEC Guide 51:1999, 3.8]
2.9
residual risk
risk remaining after protective measures have been taken
[ISO/IEC Guide 51:1999, 3.9]
2.10
risk
combination of the probability of occurrence of harm and the severity of that harm
[ISO/IEC Guide 51:1999, 3.2]
2.11
risk analysis
systematic use of available information to identify hazards and to estimate the risk
[ISO/IEC Guide 51:1999, 3.10]
2.12
risk assessment
overall process comprising a risk analysis and a risk evaluation
[ISO/IEC Guide 51:1999, 3.12]
2.13
risk evaluation
consideration of the risk analysis results to determine if the risk reduction is required
2.14
scenario
sequence of a hazardous situation, cause, and effect
2.15
severity
level of a potential harm
2 © ISO 2006 – All rights reserved

3 General principles
3.1 Concept of safety
Safety, within this document, is considered as freedom from unacceptable risk. There can be no absolute
safety. Some risks, defined in this Technical Specification as “residual risk” can remain. Therefore, a product
or process (e.g., operation, use, inspection, testing, or servicing) can be only relatively safe. Safety is
achieved by sufficient mitigation or reduction of the risk.
Safety is achieved by the search for an optimal balance between the ideal of absolute safety, the demand to
be met by a product or process, and factors such as benefit to the user, suitability for purpose, cost
effectiveness and conventions of the society concerned. Consequently, there is a need to review continually
the established safety levels, in particular when experience necessitates review of the pre-set safety levels
and when developments, both in technology and knowledge, can lead to feasible improvements to attain
sufficient mitigation of the risk compatible with the use of a product, process, or service.
3.2 Concept of risk assessment
3.2.1 Safety is achieved by the iterative process of risk assessment (risk analysis and risk evaluation) and
risk reduction (see Figure 1).
3.2.2 Risk assessment is a series of logical steps that enables, in a systematic way, the examination of
hazards associated with lifts. Risk assessment is followed, whenever necessary, by the risk reduction process,
as described in Clause 7. When this process is repeated, it gives the iterative process for eliminating hazards
as far as possible and for implementing protective measures.
3.2.3 Risk assessment includes.
a) risk analysis:
1) determination of the subject of analysis (see 4.3);
2) identification of scenarios: hazardous situations, cause and effects (see 4.4);
3) risk estimation (see 4.5); and
b) risk evaluation (see Clause 5).
3.2.4 Risk analysis provides the information required for the risk evaluation, which in turn allows judgments
to be made on the level of safety of the lift, lift component, and any relevant process (e.g. operation, use,
inspection, testing, or servicing).
3.2.5 Risk assessment relies on judgmental decisions. These decisions should be supported by qualitative
methods complemented, as far as possible, by quantitative methods. Quantitative methods are particularly
appropriate when the foreseeable severity and extent of harm are high. Qualitative methods are useful to
assess alternative safety measures and to determine which one gives better protection.
NOTE The application of quantitative methods is restricted by the amount of useful data that is available, and in
many applications only a qualitative risk assessment is possible.
3.2.6 The risk assessment shall be conducted so that it is possible to document the procedure, that has
been followed and the results that have been achieved (see Clause 8).
Figure 1 — Iterative process of risk assessment and risk reduction
4 © ISO 2006 – All rights reserved

4 Risk analysis procedure
4.1 Step 1 — Determination of the reason for conducting a risk assessment
Before a risk assessment process can start, the reason for the assessment should be determined.
It can be, but is not limited to, any of the following:
a) verification that the risks are eliminated or sufficiently mitigated in relation to
1) design for, or installation of, a lift or a component, or a subsystem thereof;
2) the operation and use of a lift; or
3) procedures for testing, inspection, servicing, or performing any other work with intent to maintain the
lift or a lift component in its intended operating conditions.
NOTE This especially applies to lifts and their components for which no recognized relevant safety standards are
available.
b) development of standards and regulations that stipulate requirements related to lift safety.
4.2 Step 2 — Formation of a risk assessment team
4.2.1 General
Considering the variety in designs, processes, and technologies relevant to lifts and the diversity in the
interests and working experience of lift experts and, in order to minimize any bias, a team approach for this
risk assessment process is preferable.
NOTE Risk assessment made by an individual might not be as comprehensive as that carried out by a team.
4.2.2 Team members
Selection of the members of the team, including the team moderator, is of paramount importance for the
success of this risk assessment process.
The team should be comprised of individuals with varied interests and having experience in all fields that can
be affected by the product or process being assessed.
EXAMPLE When assessing a design of a lift with a view to the safety of mechanics who will service the lift, the team
can include persons with related work experience in construction, installation, testing, inspection, and servicing, in addition
to safety experts and experts in the design of various lift systems, subsystems, etc.
Experts with specialized knowledge can be engaged in a consulting role for all or appropriate portions of the
risk assessment process. Such participation can significantly enhance the quality of the results.
4.2.3 Team moderator
The team moderator should
a) have an overall understanding of the product or process being assessed;
b) understand the risk assessment process;
c) be able to assume an impartial view free of any bias;
d) have “facilitating” abilities;
e) act as a facilitator rather than participant in the debates of the team, and
f) be able to facilitate arbitration when no team consensus agreement can be reached.
NOTE For further information on the role and responsibilities of the moderator, refer to Annex E.
4.3 Step 3 — Determination of the subject of risk assessment and related factors
4.3.1 Determination of the subject of the assessment
Once the reason for a risk assessment process is determined in accordance with 4.1, the subject of the
assessment shall be determined as precisely as possible. Without limiting generalities, the subject can include
one or more of the following:
a) complete lift system:
1) for a specific load, speed, travel, or a range thereof;
2) for any location type, e.g., indoor or exposed to weather, in a public building or private residence, in a
factory or a school;
3) for a specified or unspecified life cycle (see 4.3.2.2);
4) powered by any drive type, e.g., electric, hydraulic, etc.;
5) in a building that is accessible to general public or has strictly controlled use and access thereto; and
6) for transportation of persons from general public, defined category of persons, goods only, or
combination thereof;
b) component or subsystem of a lift in a), such as
1) enclosure of car, lift well, machine room or machinery spaces;
2) drive system or braking system, during normal operation or in case of emergency;
3) entrances to the car and well (hoistway) or to the machine room or to the well pit area;
4) operation control or motion control, incorporating diversified or specific technologies; and
5) locking devices;
c) persons in relation to a lift in a), such as those who
1) use the lift for transportation;
2) are in, or could gain access to, the area where any part of the lift is located or operated;
3) perform any work on, or in the vicinity of, a lift, such as installing, testing, inspection, servicing,
repairing, altering, cleaning (e.g., cleaning pit, car or well enclosures);
4) have certain physical disabilities; and
5) perform specific functions, e.g., fire fighting, transportation of hospital patients; and
d) processes related to a lift or its components, such as
1) installation;
2) servicing;
3) repairs;
4) cleaning;
5) testing;
6) modernization; and
7) replacement.
6 © ISO 2006 – All rights reserved

4.3.2 Determination of any additional factors and data to consider
4.3.2.1 General
In addition to the reason (see 4.1) and the subject (see 4.3.1) for the risk assessment, any additional factors
that can modify or clarify the subject shall be determined, and any experience with similar products should be
taken into consideration in the course of the assessment.
4.3.2.2 Life cycle of the subject being assessed
4.3.2.2.1 The intended life cycle is an important factor in determining the probability that a given event can
occur. It does not, however, always come into play. If a standard is being written to address intrinsic safety,
the life cycle need not apply.
EXAMPLE A safe gap can be defined by “a dimension not exceeding x”. This requirement is not related to time.
Exceeding “x” is deemed to be unsafe.
4.3.2.2.2 Life cycle does have a role when considering the probability that a particular event will occur due
to a component failure. In this situation, the life cycle of the system incorporating the component shall be
considered. If, for example, the system is to perform its function for eight years, then the life of components
shall at least match this to avoid a high probability of failure and, therefore, the occurrence of a given event. If,
however, the component, through preventive maintenance, is replaced before failure occurs, the probability of
the occurrence of a given event is low.
EXAMPLE 1 If a component expected to perform its safety function no longer than eight years is incorporated in a lift
system that is expected to operate safely during a 20 year interval, the lift will do so only if the component is replaced with
a new one in intervals less than eight years, as shown in Figure 2.

Key
1 system life cycle time: 20 years
2 component life cycle, eight years
3 time of replacement of the component
Figure 2 — Replacement of components with a component life cycle shorter than the system life cycle
EXAMPLE 2 If a component critical for lift safety could fail once or twice or three times during the life cycle of a lift
system, the probability of the failure of the component, as well as the probability of an unsafe condition occurring on the lift
system, would be estimated as “C — occasional” when estimating the risk in accordance with 4.5.4 and Table C.2 in
Annex C. If, however, there is a program in place to regularly replace the component before its estimated probable failure,
the probability of an unsafe condition occurring on the lift system would be estimated as “D — remote” or “E —
improbable”, depending on the reliability of the component, as well as the reliability of the replacement program.
4.3.2.3 Information and data
4.3.2.3.1 Any available information and data that could assist in the qualitative and quantitative analysis
should be taken into account, such as accident and incident history, including causes and effects, that is
relevant to the subject of the assessment or to similar products or procedures.
4.3.2.3.2 The absence of an accident history, a small number of accidents, or the low severity of the effects
of the accidents should not lead to an automatic presumption of low risk.
4.3.2.3.3 Quantitative data can be used to supplement the data, based on the consensus of expert
opinion derived from experience, as described in this document.
4.4 Step 4 — Identification of scenarios: hazardous situations, causes, and effects
NOTE 1 In addition to the risk scenarios given in 4.4, Annex B, and Annex F, further examples are provided in
ISO/TS 22559-1.
NOTE 2 Examples of hazards in Annex B are related to lifts. More general and comprehensive examples of hazards,
hazardous situation, and harmful events as related to machinery in general are provided in ISO 14121.
4.4.1 Hazard identification
4.4.1.1 The focal point of a scenario is the identification of hazards that could be associated with the
subject being assessed. Table B.1 lists typical hazards that could be associated with lifts, including details and
examples of the hazards. The list can be used as a starting point when formulating a scenario.
EXAMPLE The risk assessment team can start by asking whether there is any situation in which people can be
exposed to any type of hazards, e.g., mechanical, electrical, fire, chemical, etc.
4.4.1.2 A hazard may be inherent to the functionality of the lift system.
EXAMPLE A car and counterweight, when moving adjacent to an open floor or stairway used by people, is an
inherent hazard to people. A counterweight moving adjacent to the car inside the well is also an inherent hazard to the
mechanic working from the car top. Both hazards and related situations are covered in Table B.1, item B.1.1 b), and
Table B.2, item B.2.1 b).
4.4.1.3 In many cases, a hazard becomes obvious only after a scenario is formulated. Hazards that are
not inherent to the functionality of the lift system include the following:
a) hazards associated with the failure of the lift system, a component or a part of a lift or the malfunction of a
safety-related system or component (see Table B.3, items B.3.1 and B.3.2);
b) hazards associated with outside influences such as the environment, temperature, fire, climatic conditions,
lightning, rain, wind, snow, earthquakes, electromagnetic phenomena (EMC), conditions of the building
and its use, etc. (see Table B.3, items B.3.4 through B.3.6); and
c) hazards associated with inappropriate procedures for the operation, use, servicing, cleaning, or other
functions performed on a lift or parts thereof and with the misuse of the system or process, and also
hazards related to the disregard of ergonomic principles affecting safety (see Table B.3, item B.3.7).
4.4.2 Formulation of scenario
4.4.2.1 Scenario
The formulation of a scenario includes the identification of a hazard and the formulation of a hazardous
situation, cause, and effect. It is important to identify and record the hazards before the formulation of scenario
proceeds. It is critical for a scenario to be formulated in the sequence of occurrence of each part of the
scenario.
4.4.2.2 Hazardous situations
All situations or other circumstances in which people (or property or environment) can be exposed to one or
more hazards should be identified. This applies to all hazardous situations associated with the subject being
assessed, through the life cycle of the subject (see 4.3). Table B.2 contains examples of hazardous situations
8 © ISO 2006 – All rights reserved

in which people can be exposed to the specific types of hazards listed in Table B.1. Table B.2 can help the
team when formulating hazardous situations.
4.4.2.3 Causes
All events that could occur within a hazardous situation and that can create the possibility for people to be
exposed to a hazard should be identified. Table B.3 gives examples of causes that can create possibility of
exposure to specific types of hazards.
4.4.2.4 Effects
4.4.2.4.1 The effects that can result from a cause within a hazardous situation shall be identified. Harm
may be part of such effects.
4.4.2.4.2 Table B.4 gives examples of main features of possible effects. For the purpose of risk
assessment in certain cases, in addition to the descriptive format given in Table B.4, a more explicit
description of a possible effect might be needed.
EXAMPLE In the case of an effect of a person “slipping and falling” on the floor because it is slippery, the description
of the effect as “slipping and falling on the floor” might be sufficient for the estimation of the level of severity of the effect,
including harm. However, in the case of an effect involving “falling from a height”, more detailed description, such as falling
height, might be needed for the purpose of the estimation of the level of severity of the effect, including the harm as the
part of the effect.
4.4.2.4.3 Then it comes to the description of harm in terms of harm, the team may decide to expand the
description of the effect by specifying the nature of possible harm, using examples in Table B.5 before
proceeding to the estimation of the level of severity of harm (see 4.5.3.1).
NOTE Example 1 in Annex F illustrates two approaches to the description of effect and harm as the part of the effect,
for the purpose of the estimation of the degree of severity.
4.4.3 Recording of scenario elements
Annex F gives examples of identifying and recording the subject of the risk analysis, hazards and scenarios.
It is not always necessary to list all hazards before formulating relevant hazardous situations and harmful
events, because, in most cases, the description of the hazardous situation, cause and effect states the type of
hazard being considered. It is, however, important that all members of the risk assessment team (4.2) agree
on the type of hazard, hazardous situation, cause and effect before the estimation of the risk elements and the
risk evaluation proceed.
NOTE ISO/TS 22559-1 includes global essential safety requirements for lifts that can be used to provide samples of
scenarios in addition to examples in Annex F of this Technical Specification.
4.5 Step 5 — Risk estimation
4.5.1 General
4.5.1.1 Through step 4 (see 4.4), the scenarios have been formulated, including the hazard, hazardous
situation and cause, as well as the potential effects that can result in harm. The possibility of harm has been
identified but the level of the risk of harm remains to be determined. The risk estimation process is used to
establish the level of risk elements and hence the level of risk.
4.5.1.2 When determining elements of risk, and, in particular, the probability of the occurrence of harm
(see 4.5.4), only one lift shall be considered, rather than multiple installations of the same kind or the whole
population of lifts. However, there are the following additional considerations.
a) When the elements of risk for one lift are being determined, where appropriate, the risks related to a
group of interconnected lifts should also be considered for inclusion in the scenario.
EXAMPLE One moving escalator is feeding passengers onto a non-moving escalator (see also Example 4 in
Annex F).
b) When elements of risk for one lift are being determined, statistics and experience derived from multiple
installations or the whole lift population may be used.
EXAMPLE Statistics can indicate that out of all 200 000 hydraulic lifts equipped with direct-plunger and in-ground
cylinders, one incident per year occurs involving the car over-speeding or falling into the lift pit, due to the rupture of
the cylinder. The probability of the occurrence of such an incident on a lift being analysed should be estimated as
1/200 000 per year or 1/10 000 during the 20 year life cycle of the lift.
4.5.1.3 Where a risk assessment team cannot reach consensus on the estimation of risk elements, the
level of harm (see 4.5.3.1), or the level of probability (see 4.5.4.1), the scenario formulated in accordance with
4.4 should be re-examined for clarity and, if necessary, re-defined (see also E.5).
4.5.2 Elements of risk
4.5.2.1 The risk associated with a particular scenario is derived from a combination of the following
elements:
a) the severity of harm; and
b) the probability of the occurrence of that harm, which can be a function of
1) the frequency and duration of the exposure of persons to the hazard,
2) the probability of occurrence of the scenario, and
3) the technical and human possibilities to avoid or limit the harm.
4.5.2.2 The elements are shown in Figure 3. Further details on elements of risk and the process of
estimation of the level of severity of the possible harm and the level of probability of the occurrence of that
harm are given in 4.5.3 and 4.5.4. Ultimately, the level of risk is determined in accordance with 4.5.6 and
evaluated in accordance with Clause 5.
NOTE In many cases, these elements cannot be exactly determined, but can only be estimated. This applies
especially to the probability of occurrence of possible harm.
Risk Severity Probability of occurrence of the harm
related to the is a possible harm that which can be a function of
considered function can result from the
and • the frequency and duration of the
hazard of the considered scenario
exposure;
• the probability of harmful events; and
• the possibility of avoiding or limiting
the harm.
Figure 3 — Elements of risk
10 © ISO 2006 – All rights reserved

4.5.3 Severity of harm
4.5.3.1 For the purpose of this risk assessment process, the level of severity of harm that can occur in a
scenario should be estimated by considering possible effects on human life, or property, or the environment,
depending on the reason (see 4.1) and the subject (see 4.3) of the risk assessment, as one of the following
(see details in Table C.1):
⎯ level “1”: high;
⎯ level “2”: medium;
⎯ level “3”: low; and
⎯ level “4”: negligible.
NOTE It can be necessary to modify the definitions of levels of severity, given in Table C.1, depending on the reason
for, and the subject of, the risk assessment (see 4.1 and 4.3).
4.5.3.2 When estimating the level of harm, the following should be taken into account:
a) the nature of what is affected:
1) persons;
2) property;
3) environment; and
4) other factors as appropriate; and
b) the extent of harm that could occur on a lift:
1) one person; and
2) several persons.
4.5.4 Probability of occurrence of harm
4.5.4.1 Levels of probability
The probability of occurrence of harm can be estimated by taking into account the factors listed in 4.5.4.2 to
4.5.4.4. For the purpose of this risk assessment methodology, the level of probability of occurrence of harm
should be estimated as one of the following (see details in Table C.2):
⎯ level “A”: highly probable;
⎯ level “B”: probable;
⎯ level “C”: occasional;
⎯ level “D”: remote;
⎯ level “E”: improbable; and
⎯ level “F”: highly improbable.
4.5.4.2 Probability of occurrence of a scenario
When estimating the probability of occurrence of a harmful event (cause and effect) and of persons being in
hazardous situations when the event occurs, the following factors can be useful:
a) the reliability of the lift components and the lift system as a whole (see 4.5.5.1). When assessing a
process, such as servicing a lift or training service mechanics, the reliability and effectiveness of such
processes should be considered;
b) statistical data;
c) accident history;
d) history of nature and degree of harm; and
e) comparisons with similar lifting devices, or components, or processes.
NOTE 1 A cause that triggers a harmful event can be of technical, natural, or human origin.
NOTE 2 When estimating the probability of an occurrence, the regional statistical data can be taken into account,
because the probability can be influenced by regional practices and regulations, such as those related to installation,
maintenance, periodic testing, and inspection of lift systems, etc.
4.5.4.3 Frequency and duration of exposure to hazard
When estimating the probability of the occurrence of harm, the following factors should be considered:
a) The exposure of all persons working on or using the lift to the hazards relevant to a specific lift situation or
event should be considered. The exposure of lift users or mechanics should be estimated in relation to
one lift, not to multiple lifts (see 4.5.1.2).
b) Exposure and duration can be continuous.
EXAMPLE A hazard that can have the effect of passengers tripping or falling when entering or leaving the car exists
even on lifts with perfectly level car-to-landing door sills.
c) There are continuously existing hazardous situations, but exposure to a hazard can be very infrequent
and of short duration, which implies a lower level of probability.
EXAMPLE Relative movement of lift parts inside a lift well can present hazards to mechanics working on the car top,
which could cause shearing and crushing effects. However, exposure to these hazards is infrequent and of short
duration, because the mechanic works infrequently on the car top of a lift and because the car does not always move
when the mechanic is on the car top. The possibility of harm to the mechanic exists only while the car moves and
only if the mechanic’s body parts protrude beyond the car top perimeter. The mechanic’s training and hazard
awareness (see 4.5.4.4) can certainly reduce probability of the event and effect.
d) Exposure can also be less frequent, but the duration can vary.
EXAMPLE If the strength of a landing door or its fixings is not sufficient to take any foreseeable misuse, such as a
person’s hitting the closed door and breaking through when the car is away from the landing, there is a risk of a door
breaking and a person’s falling into the well. Simultaneously, the person is exposed to the hazard with the possible
effect of falling into the well and suffering serious harm. However, if the entrance remains unprotected after the door
has been dislodged, the hazardous situation continues to exist, and potential users and passers-by are continuously
exposed to the hazard of falling into the well.
e) In general, when estimating the frequency and duration of exposure, all relevant factors should be
considered, such as the need for and frequency of access to potentially unsafe locations and the time
spent therein.
EXAMPLE Compare access into the lift well for the purpose of servicing the lift to access to the lift car for the
purpose of transportation.
12 © ISO 2006 – All rights reserved

4.5.4.4 Possibilities of affecting, avoiding or limiting harm
When estimating the probability of occurrence of harm, the following elements should be taken into account:
a) Who are the users of the lift:
⎯ members of general public, including people of all ages, persons having physical disabilities, etc.; or
⎯ trained goods handlers, or trained fire-fighters, who are aware of specific risks;
b) Who are the persons who will perform any work on the lift:
⎯ skilled mechanics,
⎯ inspectors,
⎯ authorized persons with limited knowledge of the lift installation,
⎯ unskilled persons;
c) Are all necessary resources given to persons in a) and b) to assist them in avoiding or limiting harm,
such as the following:
⎯ necessary training, work procedures, and experience,
⎯ control over car movement,
⎯ means of risk awareness, such as warning signs, and indicating devices,
⎯ adequate working space and
⎯ procedure and means for escape from the hazardous situation; and
d) Have all human factors been adequately considered, such as the following:
⎯ interaction of persons with the lift equipment,
⎯ interaction between persons, typically when performing complex servicing tasks,
⎯ psychological aspects, such as complexity of tasks and claustrophobia,
⎯ ergonomic effects, such as working space,
⎯ capacity of persons to be aware of risks in a given situation, depending on their training, experience,
and ability,
⎯ temptations to deviate from prescribed and necessary safe working practices,
⎯ the likelihood that a person or persons will not act as anticipated and
⎯ whether protective measures provided to mitigate one hazard can cause other hazards;
EXAMPLE A guard railing preventing mechanics from falling off the car top could crush them if the car moves into
the overhead, allowing the top of the railing to come close to the well ceiling.
e) Training, experience, and ability can affect the risk, but none of these factors should be used as a
substitute for hazard elimination or risk reduction by design or safeguarding where these safety measures
can be implemented.
4.5.5 Further factors to consider
4.5.5.1 Reliability of safety functions
Risk estimation shall take into account the reliability of components and systems (see Table B.3). It shall
identify the circumstances that can result in effect and ultimately in harm, such as component failure, power
failure, electrical disturbances, etc.
When more than one safety-related device contributes toward a safety function, the selection of these devices
shall have consistent performance when considering their reliability (see also 4.3.2.2).
When protective measures include work organization, appropriate behaviour, warnings, application of
personal protective equipment, skill, or training, the relatively low reliability of such measures as compared to
proven technical protective measures shall be taken into account in the risk estimation.
4.5.5.2 Possibility of defeating or circumventing protective measures
Risk estimation shall take into account the possibility of defeating or circumventing protective measures. The
estimation shall also take into account the incentive to defeat or circumvent protective measures.
EXAMPLE Protective measures can slow down the work on the lift, such as troubleshooting, or can interfere with
any working method preferred by the worker. Furthermore, a protective measure can be difficult to use.
The possibility of defeating a protective measure depends on both its design characteristics and the type of
protective measure, such as an adjustable or removable guard or a programmable rather than
non-programmable safety device.
4.5.5.3 Ability to maintain protective measures
Risk estimation shall consider whether the protective measures can be maintained in the condition necessary
to provide the required level of protection.
NOTE If a protective measure cannot easily be maintained in its correct working order, this can encourage people to
defeat or circumvent the protective measure to allow continued use of the lift without needed repair.
4.5.5.4 Effects of foreseeable misuse, vandalism, and human error
Risk estimation shall take into account the susceptibility of a lift or its components to acts of foreseeable
misuse or vandalism, based on experience related to lifts in general or to specific types of lift location. This
applies to the risk estimation of a design, conformity assessment process, or any other process. Acts of
foreseeable misuse or vandalism include forcible entry, overloading, removing parts, lighting fires, spraying
paint, hosing water into the well, and smashing doors and leaving the well entrance unprot
...