Änderungen vergleichen: Commission Decision (EU) 2021/534 of 24 March 2021 determining under Article 39(1) of Directive 2014/33/EU of the European Parliament and of the Council whether a measure taken by Germany to prohibit the placing on the market of a lift model manufactured by Orona is justified or not (notified under document C(2021) 1863) (Text with EEA relevance)
Versionen auswählen:
COMMISSION DECISION (EU) 2021/534
of 24 March 2021
determining under Article 39(1) of Directive 2014/33/EU of the European Parliament and of the Council whether a measure taken by Germany to prohibit the placing on the market of a lift model manufactured by Orona is justified or not
(notified under document C(2021) 1863)
(Text with EEA relevance)
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Directive 2014/33/EU of the European Parliament and of the Council of 26 February 2014 on the harmonisation of the laws of the Member States relating to lifts and safety components for lifts (1), and in particular Article 39(1) thereof,
Whereas:
1.
PROCEDURE
(1) On 10 March 2016, Germany notified the Commission of a measure that it had taken on 26 November 2015 pursuant to Article 7(1) of European Parliament and Council Directive 95/16/EC (2) (‘the national measure’). That measure prohibited the placing on the market of the lift model M33v3 produced by Orona Sociedad Cooperativa, Hernani, Spain (‘the M33v3 lift’) and introduced conditions for the placing on the market of equipment.
(2) Germany’s justification for adopting the national measure was based on prior market surveillance activities carried out by the Central Authority of the Länder for Safety Technology (‘the German authority’). The German authority found the M33v3 lift to be in breach of the essential health and safety requirements set out in section 2.2 of Annex I to Directive 95/16/EC (‘the essential requirements’).
(3) Orona Sociedad Cooperativa (‘Orona’) had submitted its objections against the national measure to the Commission already on 11 December 2015, arguing that their innovative M33v3 lift presents alternative safety systems which would amount to an at least equivalent level of safety compared to any lift designed according to the relevant harmonised standards and thus fulfils the essential requirements and invoking the need for the German authority to notify the national measure to the Commission.
(4) In April 2016, the Commission entered into consultation with the Member States and Orona to evaluate the national measure.
(5) Directive 95/16/EC was subsequently recast and repealed by Directive 2014/33/EU with effect from 20 April 2016.
(6) By letter of 20 April 2016, the Commission invited Orona to submit its observations on the national measure, which Orona did by letter of 18 May 2016, which included extensive observations and supporting documents. A follow-up meeting between the Commission and Orona took place on 9 June 2016.
(7) By separate letter of 20 April 2016, the Commission also invited Liftinstituut, the notified body chosen by Orona, which in 2012 had certified the compliance of the M33v3 lift with Directive 95/16/EC, to submit its comments. However, as Liftinstituut had already sent to the Commission extensive observations and supporting documents in a letter of 20 January 2016 in line with Orona’s observations, it did not provide any further substantial comments.
(8) At a meeting of the Working Group for Administrative Cooperation in the Sector of Lifts on 16 June 2016, which was chaired by the Member States, the German authoritypresented the national measure to the market surveillance authorities of the Member States. The Commission attended the meeting as a member of that working group.
(9) The Commission also conducted an independent expert study (the ‘independent study’). The independent study was initially contracted on 29 November 2016, and on 9 February 2017 the German authority, Orona, the independent expert and the Commission attended an on-site inspection of the M33v3 lift. However, the contract was subsequently terminated and a second expert was hired. That expert performed the independent study and issued a final report (3) on 10 December 2018. In that final report, it was concluded that the lift ‘conclusively meets Essential Requirement 2.2 by achieving at least the equivalent level of safety, at the time of installation, of the harmonised standard which conferred the presumption of conformity to the EHSR 2.2 of Annex I to Directive 95/16/EC’. On 17 December 2018, the Commission invited the German authority, Orona and Liftinstituut to submit observations on the independent study. The Commission received comments from Liftinstituut on 14 January 2019, from Orona on 15 January 2019 and from the German authority on 28 February 2019.
(10) On 16 May 2019, a meeting took place with the Commission, the German authority, Orona and Liftinstituut to clarify the observations received on the independent study. Upon the Commission’s request, the German authority sent the clarifications on the observations made on the independent study by email of 28 May 2019. The Commission received comments on those clarifications from Orona on 12 July 2019 and from Liftinstituut on 19 July 2019.
(11) On 14 April 2020, the Commission invited Orona and the German authority to comment on a summary of the parties’ positions and the Commission’s tentative assessment. All comments were received by 29 May 2020.
2.
POSITIONS AND ARGUMENTS OF THE PARTIES
2.1.
Position and arguments of the German authority
(12) The German local market surveillance authorities started investigations of the M33v3 lift in October 2014. Subsequently, the German authority took over the investigation.
(13) As stated in the notification to the Commission of the national measure, following a check of documentation in January and February 2015 and a test of a lift installation in Munich on 23 March 2015, the German authority has concluded that the requirements of harmonised standards EN 81-1:1998+A3:2009 (4) (‘EN 81-1’) and EN 81-21:2009 (5) (‘EN 81-21’) (‘the harmonised standards’) are not met by the lift. The reason for this is that the planned head room in the M33v3 lift of 0,5 m is insufficient, as a distance of 1 m is required by EN 81-1. The German authority did not find the alternative safety measures taken in the design and construction of the M33v3 lift equivalent to the state of the art represented by the harmonised standards, and thus in breach of the essential requirements.
(14) In particular, according to the German authority, while the alternative measures taken by the manufacturer decrease the probability of an accident (namely the unintended movement of the lift car to the upper extreme position), the minimum vertical distance required by the harmonised standards from the car roof to the ceiling of the well is cut by half, which considerably increases the degree of severity of possible injuries. Notwithstanding that, in the case of an emergency, a person on the roof of the car can ensure his or her safety by lying down in the remaining protection area, even though assuming this position would take considerably more time in the M33v3 lift than in a another lift that meets the requirements of the harmonised standards. That time aspect was neither taken into account by the manufacturer, nor by Liftinstituut in the context of the conformity assessment for the EC-type examination. In a lift designed following the implementation of the requirements of the harmonised standards there would, as a result of the higher protection area, be enough free space or refuge to crouch in order to ensure safety of persons using the lift.
(15) During the consultation with the concerned parties, the German authority clarified the arguments provided in the notification to the Commission of the national measure and in the national measure itself.
(16) With respect to the free space or refuge referred to in the essential requirements, the German authority has concluded that the protection against crushing in the M33v3 lift is achieved exclusively by the mechanically protected shelter, which has the dimensions 0,5 m × 0,7 m × 1 m (height × width × length). The German authority also notes that Orona regards this solution as equivalent to the solution set out in the harmonised standard, because the reduction of the vertical distance by 0,5 m is offset by an increase in the width and length of the protective space by 0,1 m and 0,2 m respectively. However, the German authority considers that the shortcoming of the M33v3 lift is not the reduced free space per se but the time it takes a person to ensure his or her safety (namely assuming a lying position) due to that lesser space, which can result in serious injuries. According to the German authority, Orona did not provide evidence, prior to the adoption of the national measure, that the time aspect did not play a role in the M33v3 lift’s safety or that there was indeed enough time to assume a safe position.
(17) The German authority specified in its observations sent by email of 28 May 2019 that the vertical distance between the car roof and the well ceiling only drops to 0,5 m in case the lift brake fails. Otherwise, when someone is entering into the well, the lift would be already blocked or stopped at the vertical distance between the car roof and the well ceiling of 1,8 m or, if the two safeguard limit switches in the electric system fail, of 1 m. However, the German authority has subsequently indicated in additional observations of 29 May 2020 that the observations of 28 May 2019 on the vertical distances are incorrect. Instead, the German authority refers to Orona’s risk assessment, in which several possible hypotheses based on various events (namely brake failure, control failure, safety switch failure) were foreseen and according to which it is all those events taken together, and not only the brake failure scenario, which could lead to the vertical distance being reduced to 0,5 m. Moreover, the German authority refers to its observations on the independent study of 28 February 2019, in which it stated that there are at least three potential causes of an incident due to the failure of the electronic stopping system: (i) a human error (for example, inspection staff fails to activate or deactivate inspection mode even though there is still a person on the car roof of the lift), (ii) a failure of the limit switch and (iii) a failure of the brake. However, as for the human error, the German authority confirms the conclusion in the independent study that such an error would not lead to a shortening of the vertical distance to 0,5 m.
(18) With respect to the failure of the limit switch, the German authority states in its observations on the independent study of 28 February 2019 that such a scenario is unlikely but cannot be entirely excluded. As for the brake failure cause, the German authority acknowledges that such a failure in the lift would be extremely rare, given that Orona designed the brake as a safety component (a redundant brake, that is to say, a brake that is a protection device both against unintended car movement and ascending car over speed), bearing in mind that the safety components must comply with the essential requirements and go through the conformity assessment and CE marking independently from the lift. Furthermore, the German authority has stated that the brake in the M33v3 lift is safer than the one in the lifts applying the technical specifications set out in EN 81-1, because that harmonised standard requires brakes being certified as safety components for lifts only in particular cases.
(19) When assessing the M33v3 lift, the German authority assumed, in Orona’s favour, that the brake of the lift failed less frequently than a non-redundant brake in a lift compliant with EN 81-1. Nonetheless, the German authority considers that despite the low probability of brake failure, the M33v3 lift is not compliant with the essential requirements, because it does not meet the principles of safety integration referred to in Annex I, section 1.1, last sentence, of Directive 95/16/EC. According to those principles, eliminating risks through constructive measures takes clear precedence over merely minimising them.
(20) Finally, in the additional clarifications sent to the Commission by email of 28 May 2019, the German authority stated that when the brake fails, neither the M33v3 lift nor a lift compliant with EN 81-1 can be stopped and a possible failure of the buffers is equally probable for both lifts.
2.2.
Position and arguments of Orona
(21) During the consultations, Orona stated that, in accordance with Article 8(2) of Directive 95/16/EC, it had assessed the conformity of the lift with the essential requirements via the notified body Liftinstitut. In accordance with Annex V to that Directive, Liftinstituut performed the EC-type examination to assess the safety of the lift. EC-type examination is the procedure whereby a notified body ascertains and certifies that a model lift, or that a lift for which there is no provision for an extension or variant, satisfies the requirements of Directive 95/16/EC. Liftinstituut issued the EC-type examination certificate on 17 July 2012, and revised it on 15 March 2013.
(22) In accordance with Article 8(2) (ii) of Directive 95/16/EC and section 4 of Annex VI to that Directive, a notified body chosen by the installer of the lift is to carry out or have carried out the final inspection of the lift before it is placed on the market. The appropriate tests and checks set out in the standards referred to in Article 5 of Directive 95/16/EC, or equivalent tests, are to be carried out by that notified body in order to ensure conformity of the lift with the essential requirements. Orona chose the notified body TÜV SÜD to perform the final inspection of the M33v3 lift, TÜV SÜD confirmed the conformity of the M33v3 lift and issued the final inspection certificate on 7 August 2014.
(23) Orona requested the market surveillance authorities in the Netherlands to perform an inspection of a M33v3 lift in the city of ’s-Hertogenbosch on 20 August 2015 and they concluded that the specific technical measures taken by Orona fulfilled the essential requirements.
(24) Orona argues that the German authority failed to notify the Commission immediately of the national measure, contrary to the requirement to do so under Article 7(1) of Directive 95/16/EC. While the national measure was adopted on 26 November 2015, the Commission only became aware of it through a complaint from Orona of 11 December 2015. The German authority did not notify the Commission of the measure until 10 March 2016. In Orona’s view that delay has negatively affected Orona’s rights of defence and reputation.
(25) As for the object of the national measure, Orona recalled that the German authority had explained to Orona that it ‘did not doubt the EC-type examination in general, but only the version with the smallest headroom in combination with the smallest lift’. The German authority maintained that position until the adoption of the national measure several months later, which consisted of a ban of any M33v3 lift model with reduced headroom, regardless of the size of the lift cabin. Orona considers that the national measure was therefore not only unjustified, but also in breach of the principle of proportionality.
(26) Orona recalled in its observations of 18 May 2016 that rather than focusing merely on how the M33v3 model compares to the harmonised standards concerning vertical headroom, which is merely one factor in evaluating lift safety, an overall safety assessment is required. In this respect, Orona referred to the position paper of NB-L, the coordination group of notified bodies for Directive 95/16/EC of 3 November 2009, entitled ‘Crushing danger, free space, criteria’, which sets criteria for acceptable free space equivalent to the criteria set out in clause 5.7 of EN 81-1. The criteria set out in that position paper are based on a combination of the free vertical space, a free space volume (cube) and the integration of those spaces in the spatial area. The same position paper contains a non-exhaustive list of additional criteria that must be taken into account during a risk assessment. Those additional criteria include warnings, ergonomic principles, frequency of maintenance and unexpected circumstances.
(27) With respect to the free vertical space between the car roof and the well ceiling, Liftinstsitutt stated, in a letter to Orona of 10 July 2015, supporting Orona’s considerations, that ‘a guaranteed minimum free space of 0,5 m is generally accepted as sufficient to avoid the danger of crushing the human body [...]. That this is also acceptable for application in lifts is reflected in EN 81-1:1998+A3:2009, clause 5.7.3.3 b)’. In any case, Orona stated in its observations of 18 May 2016 that the block above the car of the M33v3 lift has the same vertical clearance (0,5 m) as the vertical clearance required under EN 81-1 for the rescue space below the car (in the well). As for the free space volume (cube), as described in the technical specifications of the M33v3 lift, the block above the car of the lift has a greater volume (0,5 m × 0,7 m × 1,0 m) than the minimum volume required under EN 81-1 for both the rescue space above the car (0,5 m × 0,6 m × 0,8 m) and the rescue space below the car (0,5 m × 0,6 m × 1,0 m). A study requested by Orona and sent to the Commission on 15 March 2016, carried out by a technology centre specialised in product, process and service innovation named IK4-Ikerlan (‘the IK4-Ikerlan study’), shows that all the maintenance personnel tested (representative of the usual variety of maintenance personnel, aged between 18 and 65, and male) fit within the cube above the car of the lift, while this was not the case in the cube dimensioned in accordance with EN 81-1.
(28) According to Orona’s observations of 18 May 2016, and as described in the technical specifications sent to the German authority before the national measure was adopted, the M33v3 lift contains a number of additional and specific safety features that substantially exclude human error. Those features include not only the redundant brake EC-type certified safety component, but also a number of other safety features which, altogether, render the lift even safer than lifts designed in accordance with EN 81-1. In that respect, the lift contains (i) a warning sign stating that only one person is allowed on the car roof, and that the correct safety position to prevent the risk of crushing is lying down, (ii) a safety component to switch off normal operation when the car roof is accessed (detection switch) to avoid the car starting upwards when entering the car roof, (iii) a control system which, when an entry into the well is detected, keeps the lift inactive until the inspection switch on top of the car is switched to inspection mode, (iv) an additional inspection limit safety switch which stops the lift when the car is 1,8 m from the ceiling of the well, (v) an additional final limit switch which prevents movement of the car, and (vi) a telescopic balustrade, which prevents normal operation if the balustrade is not fully retracted and prevents inspection operation if the balustrade is not fully extended.
(29) Orona stated in its observations of 18 May 2016 that in the national measure, the German authority argues that it would take ‘considerably more time’ for a technician on the roof of the car to assume the lying position, which is required to ensure safety in the lift, in contrast to the crouching position. Orona states that this claim was unsubstantiated by any evidence submitted by the German authority and that the need to assume a safe position is not a specific requirement under Directive 95/16/EC. Furthermore, following a meeting between the German authority and Orona on 15 December 2015, it was agreed, in line with the national measure, that Orona would perform some additional trials to further support the safe design of the M33v3 lift. Special emphasis was placed on the influence of the size of the lift roof on reaction time. In this respect, the IK4-Ikerlan study found that the position of the maintenance personnel and the size of the M33v3 lifts is not a factor influencing reaction time. In addition, it is shown that age and body mass index have no effect on the reaction time. Furthermore, the IK4-Ikerlan study concluded that the fact that the reaction time for taking up the squatting position in lifts according to EN 81-20 was on average only 1,26 seconds does not affect the specific potential risk, since this time difference corresponds to a mere 0,9 m with an inspection speed of 0,6 m/s. The different reaction times could be relevant only in the event of a failure of the safety system, for example the redundant brake system. However, in that scenario, the difference in height would not matter, as an accident would be fatal in both the M33v3 lift and a lift meeting the harmonised standards.
(30) As regards the time aspect, Orona stated that, as described in the technical file, the car roof of the M33v3 lift is flat and free from obstacles, and that due to this fact maintenance personnel may assume a safe position faster by lying flat on the roof. Orona pointed out in particular that on a car roof of a lift complying with EN 81-1, there can be many components interfering in the space for the lying position, for example ropes and their attachments, which can delay the time to assume the safe lying position. Furthermore, Orona emphasised that EN 81-1 only states that the safety space must be reachable from the working space. However, in the M33v3 lift, the working space coincides with the safety space, meaning that if something goes wrong and a person must adopt the lying position, the person is already in the correct place, which reduces the time needed to assume the safe position. The differences in the technical specifications (namely the obstacles on the car roof and the access to the safety space) between the M33v3 lift and a lift compliant with EN 81-1 were further clarified in Orona’s letter to the Commission of 20 January 2016 and in its email to the Commission of 12 July 2019.
(31) Regarding the brake failure, Liftinstituut explained in a letter sent to Orona on 21 April 2015 that a brake failure, in any lift, would lead to an uncontrolled upward movement of the empty lift car, which would, within a short travel distance, result in a speed causing the lift car to jump into the free space intended to prevent the risk of crushing between the roof of the lift car and the ceiling of the well, that is to say, the lift car continues its upward movement in the well although the counterweight hits the buffers. For a lift with a rated speed of 1 m/s, a headroom of 1 m as required in EN 81-1 would be consumed by the jump where the lift car has travelled uncontrolled over a distance of only 4 m, in other words, only a short travel distance is needed. There would be no free space left implying a fatal crushing of a person on the car roof. The fact that only a short travel distance is needed to accelerate the lift to a speed exceeding 115 % of the rated speed of the lift implies that the buffers are likely to collapse, because their integrity is not guaranteed at speeds exceeding 115 % of the rated speed (EN 81-1 requires that the buffers withstand an impact due to a speed of no more than 115 % of the rated speed).
(32) Furthermore, Orona stated that, in any case, the free space provided (0,5 m vertical distance) and the time aspect are not relevant for the comparison of the safety level between the M33v3 lift and the technical specifications set out in EN 81-1. As explained in Orona’s email to the German authority of 22 April 2015, which included the position expressed by Liftinstituut in its letter of 21 April 2015, the risk of crushing would occur only when the brake fails. Orona concluded that if that happens, the risk of crushing is prevented neither by the design of the M33v3 lift, nor by the design of a lift compliant with EN 81-1.
(33) Orona stated in its observations to the Commission of 12 July 2019 that the redundant brake system of the M33v3 lift is in any event far safer than the brake system of a lift compliant with EN 81-1, a fact acknowledged by the German authority in its observations of 28 May 2019. The probability of a brake failure in the M33v3 lift is, unlike in a lift compliant with EN 81-1, an extremely improbable event because the brake is an EC-type certified safety component for unintended car movement protection and ascending car movement protection. Therefore, it is far more unlikely that a brake failure in the M33v3 lift would result in a situation where a person could be confronted with the safe refuge space on the car roof suddenly and non-intentionally.
(34) Orona also stated that the concerns of the German authority in 2015 centered on the issue of risk. Orona provided the German authority with a risk assessment, conducted by Orona according to the ISO/DIS 14798 standard (6) (‘the risk assessment’), on 16 February 2015, nine months before the national measure was adopted. In the risk assessment it was concluded that, having regard to the protective measures put in place by Orona, the M33v3 lift was safe and no further action to reduce risks needed to be taken since, on the basis of both the probability of harm (graded A-F, F being the least probable) and the degree of seriousness of injury (graded 1-4, 4 being the most minor injury), the result ‘2F’ was obtained.
(35) In particular, it is concluded in the risk assessment that the probability of the brake failing (as an EC-type certified safety component) was so remote that the level of risk was acceptable. Orona stated that in a risk analysis it is not common to consider the failure of EC-type certified safety components because of their intrinsic high level of safety.
(36) As concluded in the risk assessment, there is no difference between the M33v3 lift and lifts compliant with the harmonised standards. The theoretical scenario of a break failure ends invariably fatally for the affected technician due to unrestricted crushing so that it is irrelevant whether the rescue space above the car is 0,5 m or 1 m.
(37) Finally, Orona highlights in its observations to the Commission of 18 May 2016 that Directive 95/16/EC does not require the complete elimination of any possible risk – that is simply impossible – but only compliance with the essential requirements set out in that Directive, which are guaranteed through harmonised standards or equivalent safety measures. Moreover, Orona stated that the equivalent safety measures must be proven to be equally safe to those reflected in the harmonised standards, which does not involve the same standard of proof as the demonstration of a complete lack of risk.
3.
ASSESSMENT
(38) Based on the extensive consultation with all concerned parties, the Commission has evaluated the national measure.
(39) Article 2(1) of Directive 95/16/EC, as in force when the national measure was taken, required Member States to take all appropriate measures to ensure that lifts covered by that Directive may be placed on the market and put into service only if they are not liable to endanger the health or safety of persons or, where appropriate, the safety of property, when properly installed and maintained and used for their intended purpose.
(40) Article 3 of Directive 95/16/EC provided that lifts covered by that Directive are to satisfy the essential requirements.
(41) Article 7(1) of Directive 95/16/EC required a Member State that ascertains that a lift is liable to endanger the safety of persons and, where applicable, of property, to take all appropriate measures to withdraw it from the market, to prohibit it from being placed on the market or put into service or to restrict its free movement. It follows from the second subparagraph of that Article that the Member State was to immediately inform the Commission of any such measure, indicating the reasons for its decision and in particular whether non-conformity was due to failure to satisfy the essential requirements, incorrect application of standards or shortcomings in the standards themselves.
(42) Article 8(2) of Directive 95/16/EC required that a lift, before being placed on the market, had been made subject to a conformity assessment by a notified body.
(43) The essential requirements were set out in section 2.2 of Annex I to Directive 95/16/EC, which provided that the lift was to be designed and constructed to prevent the risk of crushing when the car is in one of its extreme positions and that that objective was to be achieved by means of free space or refuge beyond the extreme positions.
(44) In accordance with Article 5(2) of the Directive, EN 81-1 gave a presumption of conformity with section 2.2 of Annex I to Directive 95/16/EC at the time the M33v3 lift was placed on the market.
(45) Orona did not rely on harmonised standards to achieve conformity with the essential requirements. Instead, Orona presented to the German authority an alternative technical solution, certified by Liftinstituut in the EC-type examination procedure, and further clarified by Liftinstituut in a letter to the German authority of 12 November 2014. Even though, the minimum free space in the headroom deviates from the requirements set out in clause 5.7.1.1 a) of EN 81-1, in accordance with the EC-type examination certificate NL12-400-1002-035-30 rev.2, issued by Liftinstituut, the free space on the car roof is a larger minimum free space (rectangular volume) than what is required as minimum free space in the pit according to EN 81-1, to prevent crushing risk in the extreme positions of the car. Liftinstituut stated in its letter of 12 November 2014 that in the event that the ropes slip when the traction sheave continues to rotate upward, that free space will be guaranteed by the permanently fixed counterweight buffer. Moreover, that notified body stated that Orona’s dimensions of the free space which are alternative to the dimensions set out in EN 81-1 are also compatible with the essential requirements when reliable additional means provide a larger temporary space with dimensions that fulfil the requirements of EN 81-1 and EN 81-21, provided that the crushing risk is always covered by the permanently available free space. Those additional means, ensuring a larger temporary space, include three main elements. First, the application of two additional safety contacts which act directly in the safety circuit of the lift and which are, for additional reliability, checked by the positioning measurement system of the lift. Second, a reliable redundant brake, EC-type certified as a safety component for protection, both against unintended car movement and ascending car over speed that achieves the actual stopping of the lift. Third, a car roof access monitoring, which directly cuts off the normal operation of the lift when a person accesses the car roof via any landing door.
(46) In accordance with Article 8(2) (ii) of Directive 95/16/EC and Annex V to that Directive, Liftinstituut ascertained and certified (7) that the reliability of the protection system with respect to crushing risk on top of the car is proved by the EC-type examination for the M33v3 lift to be at least equal compared to a lift fulfilling the EN 81-1 requirements. The M33v3 lift only deviates from the vertical free space dimensions set out in clause 5.7.1.1 a) of EN 81-1. Orona has followed the procedure of EC-type examination set out in part B of Annex V to Directive 95/16/EC. In that procedure, Orona explained how the alternative technical solutions were equivalent to the EN 81-1 requirements with regard to safety. The EC-type examination certificate issued by Liftinstituut follows the position paper of NB-L that sets out general technical criteria for how lifts with free space dimensions deviating from clause 5.7 of EN 81-1 can still be in full compliance with the essential requirements set out in Directive 95/16/EC.
(47) In accordance with Article 8(2)(ii) of Directive 95/16/EC and section 4 of Annex VI to that Directive, TÜV SÜD issued a final inspection certificate declaring that the lift satisfied the requirements set out in Directive 95/16/EC, after having carried out the appropriate tests and checks of the lift before it was to be placed on the market.
(48) According to the German authority, the technical solution provided by Orona does not satisfy the essential requirements mainly because the lift deviates from EN 81-1 in that it provides for only 0,5 m vertical distance instead of 1 m from the car roof to the well ceiling. The German authority considers that this does not allow sufficient time for a person to assume a safe position in case other precautionary measures fail to stop the lift at a greater distance. However, the German authority did not specify in the national measure in which cases the vertical distance in the M33v3 lift would be 0,5 m and consequently, in which cases the risk of crushing may appear.
(49) According to the German authority, the alternative technical specifications applied by Orona do not provide an equivalent level of safety because even if they reduce the probability of an accident (lift car travels unintentionally to the highest extreme position), the degree of severity of possible injuries is clearly increased by the minimal vertical space being reduced by half. A person on the lift car roof can ensure his or her safety if need be by lying down in the remaining refuge space, but it requires more time than in the case of a lift that corresponds to the harmonised standards.
(50) With respect to the free space or refuge, the German authority considers that EN 81-1 requires a vertical distance of 1 m in the entire free space or refuge from the car roof to the well ceiling. This fact is disputed by Orona, Liftinstituut and the Commission, which follows the independent study conclusions in this respect. However, as the German authority does not consider the 0,5 m vertical distance itself as incompatible with the essential requirements but instead the time it takes to assume a safe position, the vertical distance element as such does not need to be further elaborated upon as regards the interpretation of the requirements of EN 81-1.
(51) Regarding the free space or refuge in the M33v3 lift, once in inspection mode, the technician has a minimum working space of 1,8 m (top rescue space). However, the German authority has indicated, during the Commission consultation phase, the three potential causes of an incident in the lift that could lead to the vertical distance dropping to 0,5 m instead of 1,8 m when the lift works properly. Among those three causes, Orona recognises only the brake failure cause. Even in this case, Orona considers that a brake failure is very improbable. As for the human error cause, the German authority did not take this cause into account when adopting the national measure. In this respect, Orona explained in its observations of 15 January 2019 that there is no incentive for a qualified service engineer to ride the lift at a normal operating speed instead of in a maintenance speed mode. For the service engineer to perform his or her work it is of paramount importance to have full control over the movement of the car. If the lift is in normal operation mode it is not possible to stop the lift at any desired location other than a landing to perform the maintenance operations. In any event, in clause 0.3.8 of EN 81-1, it is stated that maintenance personnel are assumed to be instructed and work according to the instructions, meaning that riding the lift in normal operating speed is not genuinely foreseeable. Furthermore, the independent study considers it extremely unlikely that maintenance personnel would deliberately circumvent safety features described in the operating instructions.
(52) Regarding the third potential cause indicated by the German authority that could lead to the vertical distance dropping to 0,5 m, due to the potential failure of the limit switch, Orona explained in its observations of 18 May 2016 that the technician stands on the roof of the car, duly switches on inspection mode on the controller and thereby takes sole control over the lift. The technician then moves the car in the direction of the top of the well. The control system may fail. Due to this failure, the lift continues to move but still only at 0,6 m/s (inspection speed). Even in the case of uncontrolled movement upwards (‘UCMP’), the speed of 1 m/s (normal mode speed) would not be surpassed. The possibility that the technician stops the lift immediately in case of a danger by means of the two emergency limits on the controller remains unchanged. Even if the technician does not operate the emergency stop for unascertainable reasons, the final limit switch will ensure that the lift stops with a minimum free space of 1 m, without any risk of crushing. Therefore, also in this case, the overall probability of serious injury in the M33v3 lift is close to zero and the risk is the same as in a lift compliant with EN 81-1. For those reasons, the human error and the failure of the limit switch cannot be considered as causes leading to the vertical distance dropping to 0,5 m instead of 1,8 m when the M33v3 lift works properly.
(53) As for the complete failure of the braking system, the brake is a mechanical safety device EC-type certified as a UCMP safety component. The brake is a monitored, redundant safety brake and each brake has sufficient force to stop the lift on its own. Both brake circuits brake when the springs are applied, that is to say, in energised operating condition, the electromagnetic brake is open. In case of unforeseeable power failures, both brake circuits automatically close, actuated through spring force, and thus reliably ensures static holding or dynamic deceleration of the moving elevator car in any operating situation. Therefore, the complete failure of the braking system in the M33v3 lift is almost impossible.
(54) Furthermore, NB-L stated that the criteria for acceptable free space equivalent to those set out in clause 5.7 of N 81-1 are based on a combination of free vertical space, free space volume (cube) and the integration of those spaces in the spatial area.
(55) With respect to the time it takes for a person to assume a safe position, according to the national measure, the risk of crushing caused by insufficient time to adopt a safe position appears when the vertical distance is 0,5 m. However, as explained in recital 32, the free space or refuge in the M33v3 lift would have a vertical distance of 0,5 m only in the case that the brake fails. Since Orona provided the German authority with that technical explanation before the adoption of the national measure, specifically in its email of 22 April 2015, the scenario of brake failure is the only one, which will be considered further.
(56) The safety level provided by the technical specifications in EN 81-1 and by the M33v3 lift can only be compared by assessing the same scenario in a lift compliant with EN 81-1 and in the M33v3 lift. This means that, as explained above, the only scenario to be considered when assessing the risk of crushing is the case in which the brake fails in both lifts. Based on the evidence provided by Orona to the German authority before the adoption of the measure, and in particular the letter from Liftinstituut to Orona of 21 April 2015, if the brake fails, the speed of the free acceleration of only few meters would already imply that the travel speed of the lift would, for both lifts, make it impossible for the buffers to stop the lift car and would likely cause the buffers to collapse. In that event, the car would hit the ceiling of the well and crush anyone on the car roof independently of the vertical distance available. As explained by Liftinstituut in its letter, if the brake fails, there is a risk of crushing in both lifts, as the probability that the refuge space could avoid an accident is very small irrespective of the time it takes to assume a certain position on the car roof. In this respect, the German authority stated in its email to the Commission of 28 May 2019, that when the brake fails, neither the M33v3 lift nor a lift compliant with EN 81-1 can be stopped and a possible failure of the buffers is equally probable for both lifts.
(57) Therefore, it can be concluded that the time aspect, namely the time needed to adopt a safety position related to the vertical distance in the car roof, does not play a role in terms of preventing the risk of crushing.
(58) Furthermore, as explained by Orona and admitted by the German authority, the redundant brake used by Orona in the M33v3 lift, which is always an EC-type certified safety component, is safer than the brake used in lifts compliant with the technical specifications set out in EN 81-1, which in most cases do not require the brake to be an EC-type certified safety component.
(59) Indeed, under Article 3 of Directive 95/16/EC, a safety component is to satisfy the essential requirements or enable the lifts in which they are installed to satisfy the essential requirements. This means that the brake system has undergone a thorough independent conformity assessment procedure as referred to in Article 8.1 (ii) of Directive 95/16/EC and that it is thereby fitted with a CE marking, additional to the conformity assessment of the whole lift. A safety component failure is in fact a no risk situation, since it is extremely highly improbable as stated by ISO standard 14798, referred to in recital 33. As the brake failure is the only scenario in which the safe space between the car roof and the well would be reduced to less than what is required by EN 81-1 as vertical distance, and the failure of the brake system is almost impossible, the lift is safer than a lift compliant with EN 81-1, as such a lift does not need to be equipped with a redundant brake, which is a safety component.
(60) As for the principles of safety integration, first, the German authority has not referred to those principles in the national measure. Second, the principles of safety integration are not an abstract concept but are linked to the essential health and safety requirements and the state of the art at the time the lift was placed on the market. This means that the risks presented by the lift must be addressed by the manufacturer considering those elements. Third, the principles of safety integration must be regarded as equally applicable to any lift. In this case, the only scenario to be considered to compare the level of safety is the brake failure and the risk of such a failure in the M33v3 lift is extremely highly improbable, unlike in the case of a lift compliant with EN 81-1.
(61) As for the risks not related to the brake system, in addition to the risk assessment carried out by Orona and its conclusions, the independent study contains a risk assessment based on EN 81-1 and on the technical solution used in the M33v3 lift in order to compare the level of safety achieved by the M33v3 lift and a lift compliant with EN 81-1 with regard to the risk of crushing. A comparison of the level of risk of crushing when applying the measures set out in EN 81-1 and when applying the alternative measures provided by Orona in the M33v3 lift led to the conclusion in the independent study that, when the lift is maintained as intended, ‘the alternative measures provided by Orona achieve a level of safety significantly superior to that provided by the application of EN 81-1’ (8). Moreover, the independent study concluded that even in the highly unlikely event of misuse of the lift (due to a deliberate deviation from the maintenance instructions by the maintenance personnel), the lift ‘conclusively achieves at least the same level of safety as the standard’ (9).
4.
CONCLUSION
(62) Based on the analysis in recitals 38 to 60, and taking account of the results of the independent study confirming that analysis, it can be concluded that the M33v3 lift was compliant with the essential requirements. The safety level achieved by the M33v3 lift is at least equivalent to the safety level of a lift compliant with EN 81-1, which provided a presumption of conformity at the time the M33v3 lift was placed on the market. Therefore, the national measure should not be considered justified.
HAS ADOPTED THIS DECISION:
Article 1
The measure taken by Germany, which was adopted by the Central Authority of the Länder for Safety Technology on 26 November 2015 and notified to the Commission on 10 March 2016, to prohibit the placing on the market of the lift model M33v3 manufactured by Orona, Sociedad Cooperativa, Hernani, Spain, is not justified.
Article 2
This Decision is addressed to the Member States.
Done at Brussels, 24 March 2021.
For the Commission
Thierry BRETON
Member of the Commission
(1)
OJ L 96, 29.3.2014, p. 251
.
(2) European Parliament and Council Directive 95/16/EC of 29 June 1995 on the approximation of the laws of the Member States relating to lifts (
OJ L 213, 7.9.1995, p. 1
).
(3) Final report of 10 December 2018, Conformance, ‘Technical support relating to the Lifts Directive 95/16/EC and the compliance of Orona M33v3 lift, focusing on its essential health and safety requirement 2.2 of Annex I.’.
(4)
OJ C 52, 2.3.2010, p. 5
.
(5)
OJ C 263, 5.11.2009, p. 3
.
(6) ISO 14798, lifts (elevators), escalators and moving walks – risk assessment and reduction methodology, international standard, first edition 01-03-2009.
(7) The EC-type examination certificate NL12-400-1002-035-30 rev.2.
(8) Task 3 – ‘Comparative analysis of the technical specifications of the relevant harmonised standards’, section 7.1.1.
(9) Task 3 – ‘Comparative analysis of the technical specifications of the relevant harmonised standards’, section 7.1.2.
COMMISSION DECISION (EU) 2021/534
of 24 March 2021
determining under Article 39(1) of Directive 2014/33/EU of the European Parliament and of the Council whether a measure taken by Germany to prohibit the placing on the market of a lift model manufactured by Orona is justified or not
(notified under document C(2021) 1863)
(Text with EEA relevance)
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Directive 2014/33/EU of the European Parliament and of the Council of 26 February 2014 on the harmonisation of the laws of the Member States relating to lifts and safety components for lifts (1), and in particular Article 39(1) thereof,
Whereas:
1.
PROCEDURE
(1) On 10 March 2016, Germany notified the Commission of a measure that it had taken on 26 November 2015 pursuant to Article 7(1) of European Parliament and Council Directive 95/16/EC (2) (‘the national measure’). That measure prohibited the placing on the market of the lift model M33v3 produced by Orona Sociedad Cooperativa, Hernani, Spain (‘the M33v3 lift’) and introduced conditions for the placing on the market of equipment.
(2) Germany’s justification for adopting the national measure was based on prior market surveillance activities carried out by the Central Authority of the Länder for Safety Technology (‘the German authority’). The German authority found the M33v3 lift to be in breach of the essential health and safety requirements set out in section 2.2 of Annex I to Directive 95/16/EC (‘the essential requirements’).
(3) Orona Sociedad Cooperativa (‘Orona’) had submitted its objections against the national measure to the Commission already on 11 December 2015, arguing that their innovative M33v3 lift presents alternative safety systems which would amount to an at least equivalent level of safety compared to any lift designed according to the relevant harmonised standards and thus fulfils the essential requirements and invoking the need for the German authority to notify the national measure to the Commission.
(4) In April 2016, the Commission entered into consultation with the Member States and Orona to evaluate the national measure.
(5) Directive 95/16/EC was subsequently recast and repealed by Directive 2014/33/EU with effect from 20 April 2016.
(6) By letter of 20 April 2016, the Commission invited Orona to submit its observations on the national measure, which Orona did by letter of 18 May 2016, which included extensive observations and supporting documents. A follow-up meeting between the Commission and Orona took place on 9 June 2016.
(7) By separate letter of 20 April 2016, the Commission also invited Liftinstituut, the notified body chosen by Orona, which in 2012 had certified the compliance of the M33v3 lift with Directive 95/16/EC, to submit its comments. However, as Liftinstituut had already sent to the Commission extensive observations and supporting documents in a letter of 20 January 2016 in line with Orona’s observations, it did not provide any further substantial comments.
(8) At a meeting of the Working Group for Administrative Cooperation in the Sector of Lifts on 16 June 2016, which was chaired by the Member States, the German authoritypresented the national measure to the market surveillance authorities of the Member States. The Commission attended the meeting as a member of that working group.
(9) The Commission also conducted an independent expert study (the ‘independent study’). The independent study was initially contracted on 29 November 2016, and on 9 February 2017 the German authority, Orona, the independent expert and the Commission attended an on-site inspection of the M33v3 lift. However, the contract was subsequently terminated and a second expert was hired. That expert performed the independent study and issued a final report (3) on 10 December 2018. In that final report, it was concluded that the lift ‘conclusively meets Essential Requirement 2.2 by achieving at least the equivalent level of safety, at the time of installation, of the harmonised standard which conferred the presumption of conformity to the EHSR 2.2 of Annex I to Directive 95/16/EC’. On 17 December 2018, the Commission invited the German authority, Orona and Liftinstituut to submit observations on the independent study. The Commission received comments from Liftinstituut on 14 January 2019, from Orona on 15 January 2019 and from the German authority on 28 February 2019.
(10) On 16 May 2019, a meeting took place with the Commission, the German authority, Orona and Liftinstituut to clarify the observations received on the independent study. Upon the Commission’s request, the German authority sent the clarifications on the observations made on the independent study by email of 28 May 2019. The Commission received comments on those clarifications from Orona on 12 July 2019 and from Liftinstituut on 19 July 2019.
(11) On 14 April 2020, the Commission invited Orona and the German authority to comment on a summary of the parties’ positions and the Commission’s tentative assessment. All comments were received by 29 May 2020.
2.
POSITIONS AND ARGUMENTS OF THE PARTIES
2.1.
Position and arguments of the German authority
(12) The German local market surveillance authorities started investigations of the M33v3 lift in October 2014. Subsequently, the German authority took over the investigation.
(13) As stated in the notification to the Commission of the national measure, following a check of documentation in January and February 2015 and a test of a lift installation in Munich on 23 March 2015, the German authority has concluded that the requirements of harmonised standards EN 81-1:1998+A3:2009 (4) (‘EN 81-1’) and EN 81-21:2009 (5) (‘EN 81-21’) (‘the harmonised standards’) are not met by the lift. The reason for this is that the planned head room in the M33v3 lift of 0,5 m is insufficient, as a distance of 1 m is required by EN 81-1. The German authority did not find the alternative safety measures taken in the design and construction of the M33v3 lift equivalent to the state of the art represented by the harmonised standards, and thus in breach of the essential requirements.
(14) In particular, according to the German authority, while the alternative measures taken by the manufacturer decrease the probability of an accident (namely the unintended movement of the lift car to the upper extreme position), the minimum vertical distance required by the harmonised standards from the car roof to the ceiling of the well is cut by half, which considerably increases the degree of severity of possible injuries. Notwithstanding that, in the case of an emergency, a person on the roof of the car can ensure his or her safety by lying down in the remaining protection area, even though assuming this position would take considerably more time in the M33v3 lift than in a another lift that meets the requirements of the harmonised standards. That time aspect was neither taken into account by the manufacturer, nor by Liftinstituut in the context of the conformity assessment for the EC-type examination. In a lift designed following the implementation of the requirements of the harmonised standards there would, as a result of the higher protection area, be enough free space or refuge to crouch in order to ensure safety of persons using the lift.
(15) During the consultation with the concerned parties, the German authority clarified the arguments provided in the notification to the Commission of the national measure and in the national measure itself.
(16) With respect to the free space or refuge referred to in the essential requirements, the German authority has concluded that the protection against crushing in the M33v3 lift is achieved exclusively by the mechanically protected shelter, which has the dimensions 0,5 m × 0,7 m × 1 m (height × width × length). The German authority also notes that Orona regards this solution as equivalent to the solution set out in the harmonised standard, because the reduction of the vertical distance by 0,5 m is offset by an increase in the width and length of the protective space by 0,1 m and 0,2 m respectively. However, the German authority considers that the shortcoming of the M33v3 lift is not the reduced free space per se but the time it takes a person to ensure his or her safety (namely assuming a lying position) due to that lesser space, which can result in serious injuries. According to the German authority, Orona did not provide evidence, prior to the adoption of the national measure, that the time aspect did not play a role in the M33v3 lift’s safety or that there was indeed enough time to assume a safe position.
(17) The German authority specified in its observations sent by email of 28 May 2019 that the vertical distance between the car roof and the well ceiling only drops to 0,5 m in case the lift brake fails. Otherwise, when someone is entering into the well, the lift would be already blocked or stopped at the vertical distance between the car roof and the well ceiling of 1,8 m or, if the two safeguard limit switches in the electric system fail, of 1 m. However, the German authority has subsequently indicated in additional observations of 29 May 2020 that the observations of 28 May 2019 on the vertical distances are incorrect. Instead, the German authority refers to Orona’s risk assessment, in which several possible hypotheses based on various events (namely brake failure, control failure, safety switch failure) were foreseen and according to which it is all those events taken together, and not only the brake failure scenario, which could lead to the vertical distance being reduced to 0,5 m. Moreover, the German authority refers to its observations on the independent study of 28 February 2019, in which it stated that there are at least three potential causes of an incident due to the failure of the electronic stopping system: (i) a human error (for example, inspection staff fails to activate or deactivate inspection mode even though there is still a person on the car roof of the lift), (ii) a failure of the limit switch and (iii) a failure of the brake. However, as for the human error, the German authority confirms the conclusion in the independent study that such an error would not lead to a shortening of the vertical distance to 0,5 m.
(18) With respect to the failure of the limit switch, the German authority states in its observations on the independent study of 28 February 2019 that such a scenario is unlikely but cannot be entirely excluded. As for the brake failure cause, the German authority acknowledges that such a failure in the lift would be extremely rare, given that Orona designed the brake as a safety component (a redundant brake, that is to say, a brake that is a protection device both against unintended car movement and ascending car over speed), bearing in mind that the safety components must comply with the essential requirements and go through the conformity assessment and CE marking independently from the lift. Furthermore, the German authority has stated that the brake in the M33v3 lift is safer than the one in the lifts applying the technical specifications set out in EN 81-1, because that harmonised standard requires brakes being certified as safety components for lifts only in particular cases.
(19) When assessing the M33v3 lift, the German authority assumed, in Orona’s favour, that the brake of the lift failed less frequently than a non-redundant brake in a lift compliant with EN 81-1. Nonetheless, the German authority considers that despite the low probability of brake failure, the M33v3 lift is not compliant with the essential requirements, because it does not meet the principles of safety integration referred to in Annex I, section 1.1, last sentence, of Directive 95/16/EC. According to those principles, eliminating risks through constructive measures takes clear precedence over merely minimising them.
(20) Finally, in the additional clarifications sent to the Commission by email of 28 May 2019, the German authority stated that when the brake fails, neither the M33v3 lift nor a lift compliant with EN 81-1 can be stopped and a possible failure of the buffers is equally probable for both lifts.
2.2.
Position and arguments of Orona
(21) During the consultations, Orona stated that, in accordance with Article 8(2) of Directive 95/16/EC, it had assessed the conformity of the lift with the essential requirements via the notified body Liftinstitut. In accordance with Annex V to that Directive, Liftinstituut performed the EC-type examination to assess the safety of the lift. EC-type examination is the procedure whereby a notified body ascertains and certifies that a model lift, or that a lift for which there is no provision for an extension or variant, satisfies the requirements of Directive 95/16/EC. Liftinstituut issued the EC-type examination certificate on 17 July 2012, and revised it on 15 March 2013.
(22) In accordance with Article 8(2) (ii) of Directive 95/16/EC and section 4 of Annex VI to that Directive, a notified body chosen by the installer of the lift is to carry out or have carried out the final inspection of the lift before it is placed on the market. The appropriate tests and checks set out in the standards referred to in Article 5 of Directive 95/16/EC, or equivalent tests, are to be carried out by that notified body in order to ensure conformity of the lift with the essential requirements. Orona chose the notified body TÜV SÜD to perform the final inspection of the M33v3 lift, TÜV SÜD confirmed the conformity of the M33v3 lift and issued the final inspection certificate on 7 August 2014.
(23) Orona requested the market surveillance authorities in the Netherlands to perform an inspection of a M33v3 lift in the city of ’s-Hertogenbosch on 20 August 2015 and they concluded that the specific technical measures taken by Orona fulfilled the essential requirements.
(24) Orona argues that the German authority failed to notify the Commission immediately of the national measure, contrary to the requirement to do so under Article 7(1) of Directive 95/16/EC. While the national measure was adopted on 26 November 2015, the Commission only became aware of it through a complaint from Orona of 11 December 2015. The German authority did not notify the Commission of the measure until 10 March 2016. In Orona’s view that delay has negatively affected Orona’s rights of defence and reputation.
(25) As for the object of the national measure, Orona recalled that the German authority had explained to Orona that it ‘did not doubt the EC-type examination in general, but only the version with the smallest headroom in combination with the smallest lift’. The German authority maintained that position until the adoption of the national measure several months later, which consisted of a ban of any M33v3 lift model with reduced headroom, regardless of the size of the lift cabin. Orona considers that the national measure was therefore not only unjustified, but also in breach of the principle of proportionality.
(26) Orona recalled in its observations of 18 May 2016 that rather than focusing merely on how the M33v3 model compares to the harmonised standards concerning vertical headroom, which is merely one factor in evaluating lift safety, an overall safety assessment is required. In this respect, Orona referred to the position paper of NB-L, the coordination group of notified bodies for Directive 95/16/EC of 3 November 2009, entitled ‘Crushing danger, free space, criteria’, which sets criteria for acceptable free space equivalent to the criteria set out in clause 5.7 of EN 81-1. The criteria set out in that position paper are based on a combination of the free vertical space, a free space volume (cube) and the integration of those spaces in the spatial area. The same position paper contains a non-exhaustive list of additional criteria that must be taken into account during a risk assessment. Those additional criteria include warnings, ergonomic principles, frequency of maintenance and unexpected circumstances.
(27) With respect to the free vertical space between the car roof and the well ceiling, Liftinstsitutt stated, in a letter to Orona of 10 July 2015, supporting Orona’s considerations, that ‘a guaranteed minimum free space of 0,5 m is generally accepted as sufficient to avoid the danger of crushing the human body [...]. That this is also acceptable for application in lifts is reflected in EN 81-1:1998+A3:2009, clause 5.7.3.3 b)’. In any case, Orona stated in its observations of 18 May 2016 that the block above the car of the M33v3 lift has the same vertical clearance (0,5 m) as the vertical clearance required under EN 81-1 for the rescue space below the car (in the well). As for the free space volume (cube), as described in the technical specifications of the M33v3 lift, the block above the car of the lift has a greater volume (0,5 m × 0,7 m × 1,0 m) than the minimum volume required under EN 81-1 for both the rescue space above the car (0,5 m × 0,6 m × 0,8 m) and the rescue space below the car (0,5 m × 0,6 m × 1,0 m). A study requested by Orona and sent to the Commission on 15 March 2016, carried out by a technology centre specialised in product, process and service innovation named IK4-Ikerlan (‘the IK4-Ikerlan study’), shows that all the maintenance personnel tested (representative of the usual variety of maintenance personnel, aged between 18 and 65, and male) fit within the cube above the car of the lift, while this was not the case in the cube dimensioned in accordance with EN 81-1.
(28) According to Orona’s observations of 18 May 2016, and as described in the technical specifications sent to the German authority before the national measure was adopted, the M33v3 lift contains a number of additional and specific safety features that substantially exclude human error. Those features include not only the redundant brake EC-type certified safety component, but also a number of other safety features which, altogether, render the lift even safer than lifts designed in accordance with EN 81-1. In that respect, the lift contains (i) a warning sign stating that only one person is allowed on the car roof, and that the correct safety position to prevent the risk of crushing is lying down, (ii) a safety component to switch off normal operation when the car roof is accessed (detection switch) to avoid the car starting upwards when entering the car roof, (iii) a control system which, when an entry into the well is detected, keeps the lift inactive until the inspection switch on top of the car is switched to inspection mode, (iv) an additional inspection limit safety switch which stops the lift when the car is 1,8 m from the ceiling of the well, (v) an additional final limit switch which prevents movement of the car, and (vi) a telescopic balustrade, which prevents normal operation if the balustrade is not fully retracted and prevents inspection operation if the balustrade is not fully extended.
(29) Orona stated in its observations of 18 May 2016 that in the national measure, the German authority argues that it would take ‘considerably more time’ for a technician on the roof of the car to assume the lying position, which is required to ensure safety in the lift, in contrast to the crouching position. Orona states that this claim was unsubstantiated by any evidence submitted by the German authority and that the need to assume a safe position is not a specific requirement under Directive 95/16/EC. Furthermore, following a meeting between the German authority and Orona on 15 December 2015, it was agreed, in line with the national measure, that Orona would perform some additional trials to further support the safe design of the M33v3 lift. Special emphasis was placed on the influence of the size of the lift roof on reaction time. In this respect, the IK4-Ikerlan study found that the position of the maintenance personnel and the size of the M33v3 lifts is not a factor influencing reaction time. In addition, it is shown that age and body mass index have no effect on the reaction time. Furthermore, the IK4-Ikerlan study concluded that the fact that the reaction time for taking up the squatting position in lifts according to EN 81-20 was on average only 1,26 seconds does not affect the specific potential risk, since this time difference corresponds to a mere 0,9 m with an inspection speed of 0,6 m/s. The different reaction times could be relevant only in the event of a failure of the safety system, for example the redundant brake system. However, in that scenario, the difference in height would not matter, as an accident would be fatal in both the M33v3 lift and a lift meeting the harmonised standards.
(30) As regards the time aspect, Orona stated that, as described in the technical file, the car roof of the M33v3 lift is flat and free from obstacles, and that due to this fact maintenance personnel may assume a safe position faster by lying flat on the roof. Orona pointed out in particular that on a car roof of a lift complying with EN 81-1, there can be many components interfering in the space for the lying position, for example ropes and their attachments, which can delay the time to assume the safe lying position. Furthermore, Orona emphasised that EN 81-1 only states that the safety space must be reachable from the working space. However, in the M33v3 lift, the working space coincides with the safety space, meaning that if something goes wrong and a person must adopt the lying position, the person is already in the correct place, which reduces the time needed to assume the safe position. The differences in the technical specifications (namely the obstacles on the car roof and the access to the safety space) between the M33v3 lift and a lift compliant with EN 81-1 were further clarified in Orona’s letter to the Commission of 20 January 2016 and in its email to the Commission of 12 July 2019.
(31) Regarding the brake failure, Liftinstituut explained in a letter sent to Orona on 21 April 2015 that a brake failure, in any lift, would lead to an uncontrolled upward movement of the empty lift car, which would, within a short travel distance, result in a speed causing the lift car to jump into the free space intended to prevent the risk of crushing between the roof of the lift car and the ceiling of the well, that is to say, the lift car continues its upward movement in the well although the counterweight hits the buffers. For a lift with a rated speed of 1 m/s, a headroom of 1 m as required in EN 81-1 would be consumed by the jump where the lift car has travelled uncontrolled over a distance of only 4 m, in other words, only a short travel distance is needed. There would be no free space left implying a fatal crushing of a person on the car roof. The fact that only a short travel distance is needed to accelerate the lift to a speed exceeding 115 % of the rated speed of the lift implies that the buffers are likely to collapse, because their integrity is not guaranteed at speeds exceeding 115 % of the rated speed (EN 81-1 requires that the buffers withstand an impact due to a speed of no more than 115 % of the rated speed).
(32) Furthermore, Orona stated that, in any case, the free space provided (0,5 m vertical distance) and the time aspect are not relevant for the comparison of the safety level between the M33v3 lift and the technical specifications set out in EN 81-1. As explained in Orona’s email to the German authority of 22 April 2015, which included the position expressed by Liftinstituut in its letter of 21 April 2015, the risk of crushing would occur only when the brake fails. Orona concluded that if that happens, the risk of crushing is prevented neither by the design of the M33v3 lift, nor by the design of a lift compliant with EN 81-1.
(33) Orona stated in its observations to the Commission of 12 July 2019 that the redundant brake system of the M33v3 lift is in any event far safer than the brake system of a lift compliant with EN 81-1, a fact acknowledged by the German authority in its observations of 28 May 2019. The probability of a brake failure in the M33v3 lift is, unlike in a lift compliant with EN 81-1, an extremely improbable event because the brake is an EC-type certified safety component for unintended car movement protection and ascending car movement protection. Therefore, it is far more unlikely that a brake failure in the M33v3 lift would result in a situation where a person could be confronted with the safe refuge space on the car roof suddenly and non-intentionally.
(34) Orona also stated that the concerns of the German authority in 2015 centered on the issue of risk. Orona provided the German authority with a risk assessment, conducted by Orona according to the ISO/DIS 14798 standard (6) (‘the risk assessment’), on 16 February 2015, nine months before the national measure was adopted. In the risk assessment it was concluded that, having regard to the protective measures put in place by Orona, the M33v3 lift was safe and no further action to reduce risks needed to be taken since, on the basis of both the probability of harm (graded A-F, F being the least probable) and the degree of seriousness of injury (graded 1-4, 4 being the most minor injury), the result ‘2F’ was obtained.
(35) In particular, it is concluded in the risk assessment that the probability of the brake failing (as an EC-type certified safety component) was so remote that the level of risk was acceptable. Orona stated that in a risk analysis it is not common to consider the failure of EC-type certified safety components because of their intrinsic high level of safety.
(36) As concluded in the risk assessment, there is no difference between the M33v3 lift and lifts compliant with the harmonised standards. The theoretical scenario of a break failure ends invariably fatally for the affected technician due to unrestricted crushing so that it is irrelevant whether the rescue space above the car is 0,5 m or 1 m.
(37) Finally, Orona highlights in its observations to the Commission of 18 May 2016 that Directive 95/16/EC does not require the complete elimination of any possible risk – that is simply impossible – but only compliance with the essential requirements set out in that Directive, which are guaranteed through harmonised standards or equivalent safety measures. Moreover, Orona stated that the equivalent safety measures must be proven to be equally safe to those reflected in the harmonised standards, which does not involve the same standard of proof as the demonstration of a complete lack of risk.
3.
ASSESSMENT
(38) Based on the extensive consultation with all concerned parties, the Commission has evaluated the national measure.
(39) Article 2(1) of Directive 95/16/EC, as in force when the national measure was taken, required Member States to take all appropriate measures to ensure that lifts covered by that Directive may be placed on the market and put into service only if they are not liable to endanger the health or safety of persons or, where appropriate, the safety of property, when properly installed and maintained and used for their intended purpose.
(40) Article 3 of Directive 95/16/EC provided that lifts covered by that Directive are to satisfy the essential requirements.
(41) Article 7(1) of Directive 95/16/EC required a Member State that ascertains that a lift is liable to endanger the safety of persons and, where applicable, of property, to take all appropriate measures to withdraw it from the market, to prohibit it from being placed on the market or put into service or to restrict its free movement. It follows from the second subparagraph of that Article that the Member State was to immediately inform the Commission of any such measure, indicating the reasons for its decision and in particular whether non-conformity was due to failure to satisfy the essential requirements, incorrect application of standards or shortcomings in the standards themselves.
(42) Article 8(2) of Directive 95/16/EC required that a lift, before being placed on the market, had been made subject to a conformity assessment by a notified body.
(43) The essential requirements were set out in section 2.2 of Annex I to Directive 95/16/EC, which provided that the lift was to be designed and constructed to prevent the risk of crushing when the car is in one of its extreme positions and that that objective was to be achieved by means of free space or refuge beyond the extreme positions.
(44) In accordance with Article 5(2) of the Directive, EN 81-1 gave a presumption of conformity with section 2.2 of Annex I to Directive 95/16/EC at the time the M33v3 lift was placed on the market.
(45) Orona did not rely on harmonised standards to achieve conformity with the essential requirements. Instead, Orona presented to the German authority an alternative technical solution, certified by Liftinstituut in the EC-type examination procedure, and further clarified by Liftinstituut in a letter to the German authority of 12 November 2014. Even though, the minimum free space in the headroom deviates from the requirements set out in clause 5.7.1.1 a) of EN 81-1, in accordance with the EC-type examination certificate NL12-400-1002-035-30 rev.2, issued by Liftinstituut, the free space on the car roof is a larger minimum free space (rectangular volume) than what is required as minimum free space in the pit according to EN 81-1, to prevent crushing risk in the extreme positions of the car. Liftinstituut stated in its letter of 12 November 2014 that in the event that the ropes slip when the traction sheave continues to rotate upward, that free space will be guaranteed by the permanently fixed counterweight buffer. Moreover, that notified body stated that Orona’s dimensions of the free space which are alternative to the dimensions set out in EN 81-1 are also compatible with the essential requirements when reliable additional means provide a larger temporary space with dimensions that fulfil the requirements of EN 81-1 and EN 81-21, provided that the crushing risk is always covered by the permanently available free space. Those additional means, ensuring a larger temporary space, include three main elements. First, the application of two additional safety contacts which act directly in the safety circuit of the lift and which are, for additional reliability, checked by the positioning measurement system of the lift. Second, a reliable redundant brake, EC-type certified as a safety component for protection, both against unintended car movement and ascending car over speed that achieves the actual stopping of the lift. Third, a car roof access monitoring, which directly cuts off the normal operation of the lift when a person accesses the car roof via any landing door.
(46) In accordance with Article 8(2) (ii) of Directive 95/16/EC and Annex V to that Directive, Liftinstituut ascertained and certified (7) that the reliability of the protection system with respect to crushing risk on top of the car is proved by the EC-type examination for the M33v3 lift to be at least equal compared to a lift fulfilling the EN 81-1 requirements. The M33v3 lift only deviates from the vertical free space dimensions set out in clause 5.7.1.1 a) of EN 81-1. Orona has followed the procedure of EC-type examination set out in part B of Annex V to Directive 95/16/EC. In that procedure, Orona explained how the alternative technical solutions were equivalent to the EN 81-1 requirements with regard to safety. The EC-type examination certificate issued by Liftinstituut follows the position paper of NB-L that sets out general technical criteria for how lifts with free space dimensions deviating from clause 5.7 of EN 81-1 can still be in full compliance with the essential requirements set out in Directive 95/16/EC.
(47) In accordance with Article 8(2)(ii) of Directive 95/16/EC and section 4 of Annex VI to that Directive, TÜV SÜD issued a final inspection certificate declaring that the lift satisfied the requirements set out in Directive 95/16/EC, after having carried out the appropriate tests and checks of the lift before it was to be placed on the market.
(48) According to the German authority, the technical solution provided by Orona does not satisfy the essential requirements mainly because the lift deviates from EN 81-1 in that it provides for only 0,5 m vertical distance instead of 1 m from the car roof to the well ceiling. The German authority considers that this does not allow sufficient time for a person to assume a safe position in case other precautionary measures fail to stop the lift at a greater distance. However, the German authority did not specify in the national measure in which cases the vertical distance in the M33v3 lift would be 0,5 m and consequently, in which cases the risk of crushing may appear.
(49) According to the German authority, the alternative technical specifications applied by Orona do not provide an equivalent level of safety because even if they reduce the probability of an accident (lift car travels unintentionally to the highest extreme position), the degree of severity of possible injuries is clearly increased by the minimal vertical space being reduced by half. A person on the lift car roof can ensure his or her safety if need be by lying down in the remaining refuge space, but it requires more time than in the case of a lift that corresponds to the harmonised standards.
(50) With respect to the free space or refuge, the German authority considers that EN 81-1 requires a vertical distance of 1 m in the entire free space or refuge from the car roof to the well ceiling. This fact is disputed by Orona, Liftinstituut and the Commission, which follows the independent study conclusions in this respect. However, as the German authority does not consider the 0,5 m vertical distance itself as incompatible with the essential requirements but instead the time it takes to assume a safe position, the vertical distance element as such does not need to be further elaborated upon as regards the interpretation of the requirements of EN 81-1.
(51) Regarding the free space or refuge in the M33v3 lift, once in inspection mode, the technician has a minimum working space of 1,8 m (top rescue space). However, the German authority has indicated, during the Commission consultation phase, the three potential causes of an incident in the lift that could lead to the vertical distance dropping to 0,5 m instead of 1,8 m when the lift works properly. Among those three causes, Orona recognises only the brake failure cause. Even in this case, Orona considers that a brake failure is very improbable. As for the human error cause, the German authority did not take this cause into account when adopting the national measure. In this respect, Orona explained in its observations of 15 January 2019 that there is no incentive for a qualified service engineer to ride the lift at a normal operating speed instead of in a maintenance speed mode. For the service engineer to perform his or her work it is of paramount importance to have full control over the movement of the car. If the lift is in normal operation mode it is not possible to stop the lift at any desired location other than a landing to perform the maintenance operations. In any event, in clause 0.3.8 of EN 81-1, it is stated that maintenance personnel are assumed to be instructed and work according to the instructions, meaning that riding the lift in normal operating speed is not genuinely foreseeable. Furthermore, the independent study considers it extremely unlikely that maintenance personnel would deliberately circumvent safety features described in the operating instructions.
(52) Regarding the third potential cause indicated by the German authority that could lead to the vertical distance dropping to 0,5 m, due to the potential failure of the limit switch, Orona explained in its observations of 18 May 2016 that the technician stands on the roof of the car, duly switches on inspection mode on the controller and thereby takes sole control over the lift. The technician then moves the car in the direction of the top of the well. The control system may fail. Due to this failure, the lift continues to move but still only at 0,6 m/s (inspection speed). Even in the case of uncontrolled movement upwards (‘UCMP’), the speed of 1 m/s (normal mode speed) would not be surpassed. The possibility that the technician stops the lift immediately in case of a danger by means of the two emergency limits on the controller remains unchanged. Even if the technician does not operate the emergency stop for unascertainable reasons, the final limit switch will ensure that the lift stops with a minimum free space of 1 m, without any risk of crushing. Therefore, also in this case, the overall probability of serious injury in the M33v3 lift is close to zero and the risk is the same as in a lift compliant with EN 81-1. For those reasons, the human error and the failure of the limit switch cannot be considered as causes leading to the vertical distance dropping to 0,5 m instead of 1,8 m when the M33v3 lift works properly.
(53) As for the complete failure of the braking system, the brake is a mechanical safety device EC-type certified as a UCMP safety component. The brake is a monitored, redundant safety brake and each brake has sufficient force to stop the lift on its own. Both brake circuits brake when the springs are applied, that is to say, in energised operating condition, the electromagnetic brake is open. In case of unforeseeable power failures, both brake circuits automatically close, actuated through spring force, and thus reliably ensures static holding or dynamic deceleration of the moving elevator car in any operating situation. Therefore, the complete failure of the braking system in the M33v3 lift is almost impossible.
(54) Furthermore, NB-L stated that the criteria for acceptable free space equivalent to those set out in clause 5.7 of N 81-1 are based on a combination of free vertical space, free space volume (cube) and the integration of those spaces in the spatial area.
(55) With respect to the time it takes for a person to assume a safe position, according to the national measure, the risk of crushing caused by insufficient time to adopt a safe position appears when the vertical distance is 0,5 m. However, as explained in recital 32, the free space or refuge in the M33v3 lift would have a vertical distance of 0,5 m only in the case that the brake fails. Since Orona provided the German authority with that technical explanation before the adoption of the national measure, specifically in its email of 22 April 2015, the scenario of brake failure is the only one, which will be considered further.
(56) The safety level provided by the technical specifications in EN 81-1 and by the M33v3 lift can only be compared by assessing the same scenario in a lift compliant with EN 81-1 and in the M33v3 lift. This means that, as explained above, the only scenario to be considered when assessing the risk of crushing is the case in which the brake fails in both lifts. Based on the evidence provided by Orona to the German authority before the adoption of the measure, and in particular the letter from Liftinstituut to Orona of 21 April 2015, if the brake fails, the speed of the free acceleration of only few meters would already imply that the travel speed of the lift would, for both lifts, make it impossible for the buffers to stop the lift car and would likely cause the buffers to collapse. In that event, the car would hit the ceiling of the well and crush anyone on the car roof independently of the vertical distance available. As explained by Liftinstituut in its letter, if the brake fails, there is a risk of crushing in both lifts, as the probability that the refuge space could avoid an accident is very small irrespective of the time it takes to assume a certain position on the car roof. In this respect, the German authority stated in its email to the Commission of 28 May 2019, that when the brake fails, neither the M33v3 lift nor a lift compliant with EN 81-1 can be stopped and a possible failure of the buffers is equally probable for both lifts.
(57) Therefore, it can be concluded that the time aspect, namely the time needed to adopt a safety position related to the vertical distance in the car roof, does not play a role in terms of preventing the risk of crushing.
(58) Furthermore, as explained by Orona and admitted by the German authority, the redundant brake used by Orona in the M33v3 lift, which is always an EC-type certified safety component, is safer than the brake used in lifts compliant with the technical specifications set out in EN 81-1, which in most cases do not require the brake to be an EC-type certified safety component.
(59) Indeed, under Article 3 of Directive 95/16/EC, a safety component is to satisfy the essential requirements or enable the lifts in which they are installed to satisfy the essential requirements. This means that the brake system has undergone a thorough independent conformity assessment procedure as referred to in Article 8.1 (ii) of Directive 95/16/EC and that it is thereby fitted with a CE marking, additional to the conformity assessment of the whole lift. A safety component failure is in fact a no risk situation, since it is extremely highly improbable as stated by ISO standard 14798, referred to in recital 33. As the brake failure is the only scenario in which the safe space between the car roof and the well would be reduced to less than what is required by EN 81-1 as vertical distance, and the failure of the brake system is almost impossible, the lift is safer than a lift compliant with EN 81-1, as such a lift does not need to be equipped with a redundant brake, which is a safety component.
(60) As for the principles of safety integration, first, the German authority has not referred to those principles in the national measure. Second, the principles of safety integration are not an abstract concept but are linked to the essential health and safety requirements and the state of the art at the time the lift was placed on the market. This means that the risks presented by the lift must be addressed by the manufacturer considering those elements. Third, the principles of safety integration must be regarded as equally applicable to any lift. In this case, the only scenario to be considered to compare the level of safety is the brake failure and the risk of such a failure in the M33v3 lift is extremely highly improbable, unlike in the case of a lift compliant with EN 81-1.
(61) As for the risks not related to the brake system, in addition to the risk assessment carried out by Orona and its conclusions, the independent study contains a risk assessment based on EN 81-1 and on the technical solution used in the M33v3 lift in order to compare the level of safety achieved by the M33v3 lift and a lift compliant with EN 81-1 with regard to the risk of crushing. A comparison of the level of risk of crushing when applying the measures set out in EN 81-1 and when applying the alternative measures provided by Orona in the M33v3 lift led to the conclusion in the independent study that, when the lift is maintained as intended, ‘the alternative measures provided by Orona achieve a level of safety significantly superior to that provided by the application of EN 81-1’ (8). Moreover, the independent study concluded that even in the highly unlikely event of misuse of the lift (due to a deliberate deviation from the maintenance instructions by the maintenance personnel), the lift ‘conclusively achieves at least the same level of safety as the standard’ (9).
4.
CONCLUSION
(62) Based on the analysis in recitals 38 to 60, and taking account of the results of the independent study confirming that analysis, it can be concluded that the M33v3 lift was compliant with the essential requirements. The safety level achieved by the M33v3 lift is at least equivalent to the safety level of a lift compliant with EN 81-1, which provided a presumption of conformity at the time the M33v3 lift was placed on the market. Therefore, the national measure should not be considered justified.
HAS ADOPTED THIS DECISION:
Article 1
The measure taken by Germany, which was adopted by the Central Authority of the Länder for Safety Technology on 26 November 2015 and notified to the Commission on 10 March 2016, to prohibit the placing on the market of the lift model M33v3 manufactured by Orona, Sociedad Cooperativa, Hernani, Spain, is not justified.
Article 2
This Decision is addressed to the Member States.
Done at Brussels, 24 March 2021.
For the Commission
Thierry BRETON
Member of the Commission
(1)
OJ L 96, 29.3.2014, p. 251
.
(2) European Parliament and Council Directive 95/16/EC of 29 June 1995 on the approximation of the laws of the Member States relating to lifts (
OJ L 213, 7.9.1995, p. 1
).
(3) Final report of 10 December 2018, Conformance, ‘Technical support relating to the Lifts Directive 95/16/EC and the compliance of Orona M33v3 lift, focusing on its essential health and safety requirement 2.2 of Annex I.’.
(4)
OJ C 52, 2.3.2010, p. 5
.
(5)
OJ C 263, 5.11.2009, p. 3
.
(6) ISO 14798, lifts (elevators), escalators and moving walks – risk assessment and reduction methodology, international standard, first edition 01-03-2009.
(7) The EC-type examination certificate NL12-400-1002-035-30 rev.2.
(8) Task 3 – ‘Comparative analysis of the technical specifications of the relevant harmonised standards’, section 7.1.1.
(9) Task 3 – ‘Comparative analysis of the technical specifications of the relevant harmonised standards’, section 7.1.2.
Feedback